Skip to content

Instantly share code, notes, and snippets.

@Cyb3rWard0g
Created October 4, 2018 05:53
Show Gist options
  • Save Cyb3rWard0g/31a2f550e4b92fcd19e800f89b617b5d to your computer and use it in GitHub Desktop.
Save Cyb3rWard0g/31a2f550e4b92fcd19e800f89b617b5d to your computer and use it in GitHub Desktop.
This file has been truncated, but you can view the full file.
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<wfpstate>
<timeStamp>2018-10-04T05:38:46.705Z</timeStamp>
<sessions numItems="15">
<item>
<sessionKey>{3c1f4d46-4e9d-4fab-bcb5-00c5403ee1cd}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>488</processId>
<sid>S-1-5-20</sid>
<username>NT AUTHORITY\NETWORK SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{314f4262-57b8-414f-9b37-af635ab553eb}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{9825d111-3d28-4b37-a6fb-f40b3c6bcd2b}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{57379ce8-313c-49cc-8701-144fefb705b2}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{6667406c-c873-499e-b2a5-5d3619a4d2cf}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{de5bf023-20ad-45e5-8b8f-adafa3a4b5ad}</sessionKey>
<displayData>
<name>POLICYAGNT</name>
<description>PolicyAgent Session</description>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>300000</txnWaitTimeoutInMSec>
<processId>1776</processId>
<sid>S-1-5-20</sid>
<username>NT AUTHORITY\NETWORK SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{3fb22358-90e8-49b5-ba86-95d331bf2724}</sessionKey>
<displayData>
<name>Windows Defender Firewall Dynamic Session</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>18000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{40cce534-a34e-46cf-82f4-5d5813b36d25}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>4294967295</txnWaitTimeoutInMSec>
<processId>1104</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{d45ca2c2-ca58-4836-bae5-36726e407979}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1104</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{76f7c8ce-12d7-433b-9a9d-814b2e23adce}</sessionKey>
<displayData>
<name>Modern Network Isolation Diagnostics Bfe Session</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>18000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{6f2b4fb3-f176-45ed-aa26-886c77fb3ffb}</sessionKey>
<displayData>
<name>Teredo Callback Session</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>4294967295</txnWaitTimeoutInMSec>
<processId>1104</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{118aaab5-c97c-4258-b69d-c60b54f7a04b}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>2388</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{15fbeb7a-240a-495e-aeed-ee4f27e480af}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>2388</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{12dd6e01-0a86-4c83-b672-b186c0cbe1a0}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>4080</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{cd64ba98-4c29-4321-8c36-71d08d500b7b}</sessionKey>
<displayData>
<name>wfputil</name>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>4294967295</txnWaitTimeoutInMSec>
<processId>3844</processId>
<sid>S-1-5-21-3825400013-1856045589-1834093677-1001</sid>
<username>DESKTOP-WARDOG\wardog</username>
<kernelMode>false</kernelMode>
</item>
</sessions>
<layers numItems="103">
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V4</layerKey>
<displayData>
<name>Inbound IP Packet v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>0</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V4_DISCARD</layerKey>
<displayData>
<name>Inbound IP Packet v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>1</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V6</layerKey>
<displayData>
<name>Inbound IP Packet v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>2</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V6_DISCARD</layerKey>
<displayData>
<name>Inbound IP Packet v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>3</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V4</layerKey>
<displayData>
<name>Outbound IP Packet v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>4</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V4_DISCARD</layerKey>
<displayData>
<name>Outbound IP Packet v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>5</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V6</layerKey>
<displayData>
<name>Outbound IP Packet v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>6</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V6_DISCARD</layerKey>
<displayData>
<name>Outbound IP Packet v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>7</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V4</layerKey>
<displayData>
<name>IP Forward v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>8</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Inbound Tunnel v4 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V4</applicableLayer>
<calloutId>9</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Outbound Tunnel v4 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V4</applicableLayer>
<calloutId>11</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V4_DISCARD</layerKey>
<displayData>
<name>IP Forward v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>9</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V6</layerKey>
<displayData>
<name>IP Forward v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>10</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Inbound Tunnel v6 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V6</applicableLayer>
<calloutId>10</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Outbound Tunnel v6 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V6</applicableLayer>
<calloutId>12</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V6_DISCARD</layerKey>
<displayData>
<name>IP Forward v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>11</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4</layerKey>
<displayData>
<name>Inbound Transport v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>12</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Transport v4 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>1</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Tunnel v4 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>5</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</layerKey>
<displayData>
<name>Inbound Transport v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>13</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP</calloutKey>
<displayData>
<name>WFP Built-in Silent Drop Transport v4 Discard Layer Callout</name>
<description>Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint.</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000040</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</applicableLayer>
<calloutId>17</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6</layerKey>
<displayData>
<name>Inbound Transport v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>14</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Transport v6 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>2</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Tunnel v6 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>6</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</layerKey>
<displayData>
<name>Inbound Transport v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>15</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP</calloutKey>
<displayData>
<name>WFP Built-in Silent Drop Transport v6 Discard Layer Callout</name>
<description>Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint.</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000040</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</applicableLayer>
<calloutId>18</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</layerKey>
<displayData>
<name>Outbound Transport v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>16</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Transport v4 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over transport mode security associations.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>3</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Tunnel v4 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>7</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD</layerKey>
<displayData>
<name>Outbound Transport v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>17</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</layerKey>
<displayData>
<name>Outbound Transport v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>18</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Transport v6 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over transport mode security associations.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>4</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Tunnel v6 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>8</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD</layerKey>
<displayData>
<name>Outbound Transport v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>19</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V4</layerKey>
<displayData>
<name>Stream v4 Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>20</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0414}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Connection-oriented protocol packet inspection.</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V4</applicableLayer>
<calloutId>288</calloutId>
</item>
<item>
<calloutKey>{d67b238d-d80c-4ba7-96df-4a0c83464fa7}</calloutKey>
<displayData>
<name>windefend_stream_v4</name>
<description>windefend</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V4</applicableLayer>
<calloutId>290</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{42e67750-e0ae-4ec7-aa42-97c6605b1c96}</filterKey>
<displayData>
<name>windefend_stream_v4</name>
<description>windefend</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<layerKey>FWPM_LAYER_STREAM_V4</layerKey>
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
<filterType>{d67b238d-d80c-4ba7-96df-4a0c83464fa7}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>66191</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V4_DISCARD</layerKey>
<displayData>
<name>Stream v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>21</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V6</layerKey>
<displayData>
<name>Stream v6 Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>22</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0416}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Connection-oriented protocol packet inspection.</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V6</applicableLayer>
<calloutId>289</calloutId>
</item>
<item>
<calloutKey>{36d4cf95-fd3a-4bb8-90a9-ffdb3749237f}</calloutKey>
<displayData>
<name>windefend_stream_v6</name>
<description>windefend</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V6</applicableLayer>
<calloutId>291</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{094b9bb6-e451-4069-ac23-5fe695ec9662}</filterKey>
<displayData>
<name>windefend_stream_v6</name>
<description>windefend</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<layerKey>FWPM_LAYER_STREAM_V6</layerKey>
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
<filterType>{36d4cf95-fd3a-4bb8-90a9-ffdb3749237f}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>66192</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V6_DISCARD</layerKey>
<displayData>
<name>Stream v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>23</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V4</layerKey>
<displayData>
<name>Datagram Data v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>24</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V4_DISCARD</layerKey>
<displayData>
<name>Datagram Data v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>25</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V6</layerKey>
<displayData>
<name>Datagram Data v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>26</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V6_DISCARD</layerKey>
<displayData>
<name>Datagram Data v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>27</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4</layerKey>
<displayData>
<name>Inbound ICMP Error v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="22">
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>28</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD</layerKey>
<displayData>
<name>Inbound ICMP Error v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="22">
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>29</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e011d}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD</applicableLayer>
<calloutId>276</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
<displayData>
<name>Inbound ICMP Error v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="22">
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>30</layerId>
</layer>
<callouts/>
<filters numItems="4">
<item>
<filterKey>{6bf306cf-fe94-45d2-b3cf-26095c19bc52}</filterKey>
<displayData>
<name>ET ICMPV6 Destination Unreachable - Permit</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>1</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65954</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3538b8c7-b5c7-403e-ba7b-2f8e5a894377}</filterKey>
<displayData>
<name>ET ICMPV6 Packet Too Big - Permit</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>2</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65955</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{42cdc327-ad25-43b2-ac7c-644735f14b9a}</filterKey>
<displayData>
<name>ET ICMPV6 Parameter Problem - Permit</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>4</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65956</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a2003323-e08e-41cd-ac7f-d9e690980370}</filterKey>
<displayData>
<name>ET ICMPV6 Time Exceeded - Permit</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65957</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD</layerKey>
<displayData>
<name>Inbound ICMP Error v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="22">
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>31</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e011f}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD</applicableLayer>
<calloutId>277</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
<displayData>
<name>Outbound ICMP Error v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>32</layerId>
</layer>
<callouts/>
<filters numItems="2">
<item>
<filterKey>{f43b6000-48aa-4631-96de-07aece59fca4}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>8</uint8>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67345</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>9223372036854775812</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2ba26ffa-587a-4aa2-98d5-dc4573c63984}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>3</uint8>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67349</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>3458764513820540928</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD</layerKey>
<displayData>
<name>Outbound ICMP Error v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>33</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0121}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD</applicableLayer>
<calloutId>272</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
<displayData>
<name>Outbound ICMP Error v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>34</layerId>
</layer>
<callouts/>
<filters numItems="2">
<item>
<filterKey>{165eb31b-9a40-4d77-bb15-fcc4888e6f3e}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>8</uint8>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67347</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>9223372036854775812</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{36b3a9ab-de53-46d6-94b4-d5ae7aee7bb3}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>3</uint8>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67351</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>3458764513820540928</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD</layerKey>
<displayData>
<name>Outbound ICMP Error v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>35</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0123}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD</applicableLayer>
<calloutId>273</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
<displayData>
<name>ALE Resource Assignment v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="18">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>36</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</calloutKey>
<displayData>
<name>WFP Built-in Edge Traversal ALE Resource Assignment v4 Layer Callout</name>
<description>Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000014</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</applicableLayer>
<calloutId>27</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0024}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Notifies the user.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</applicableLayer>
<calloutId>268</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD</layerKey>
<displayData>
<name>ALE Resource Assignment v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>37</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
<displayData>
<name>ALE Resource Assignment v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="18">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>38</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</calloutKey>
<displayData>
<name>WFP Built-in Edge Traversal ALE Resource Assignment v6 Layer Callout</name>
<description>Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000014</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</applicableLayer>
<calloutId>28</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0026}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Notifies the user.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</applicableLayer>
<calloutId>269</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{4c1b3569-ef2b-4988-97a4-ff820287d066}</filterKey>
<displayData>
<name>ET Bind callout</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
<filterType>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65953</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD</layerKey>
<displayData>
<name>ALE Resource Assignment v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>39</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
<displayData>
<name>ALE Listen v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>40</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</calloutKey>
<displayData>
<name>WFP Built-in Edge Traversal ALE Listen v4 Layer Callout</name>
<description>Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000014</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V4</applicableLayer>
<calloutId>29</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0028}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Notifies the user.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V4</applicableLayer>
<calloutId>270</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4_DISCARD</layerKey>
<displayData>
<name>ALE Listen v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>41</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
<displayData>
<name>ALE Listen v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>42</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</calloutKey>
<displayData>
<name>WFP Built-in Edge Traversal ALE Listen v6 Layer Callout</name>
<description>Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000014</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V6</applicableLayer>
<calloutId>30</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e002a}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Notifies the user.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V6</applicableLayer>
<calloutId>271</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{a0bf977e-2351-4973-a59c-250292cf3688}</filterKey>
<displayData>
<name>ET Listen Callout</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
<filterType>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65952</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6_DISCARD</layerKey>
<displayData>
<name>ALE Listen v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>43</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<displayData>
<name>ALE Receive/Accept v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="39">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>44</layerId>
</layer>
<callouts numItems="7">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Initiate Secure v4 Layer Callout</name>
<description>Verifies that each incoming connection that is supposed to arrive secure arrives securely.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>13</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in TCP Chimney Offload ALE Receive/Accept v4 Layer Callout</name>
<description>Enables or disables TCP Chimney Offload for each incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>21</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v4 Layer Callout</name>
<description>Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>25</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in TCP Templates ALE Receive/Accept v4 Layer Callout</name>
<description>Applies TCP Template for each incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>35</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in Set Option ALE Receive/Accept v4 Layer Callout</name>
<description>Sets classify options on inbound flows.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>39</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_RECV_ACCEPT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in Policy Silent Mode ALE Receive/Accept v4 Layer Callout</name>
<description>Audit and log policy for incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>43</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e022c}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Allows secondary connections.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>284</calloutId>
</item>
</callouts>
<filters numItems="68">
<item>
<filterKey>{89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}</filterKey>
<displayData>
<name>AppContainerBoottimeFilter</name>
<description>AppContainerBoottimeFilter</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65710</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e72646bc-7d3f-4c5c-a679-b3716f8c6cc8}</filterKey>
<displayData>
<name>AppContainerBoottimeFilter</name>
<description>AppContainerBoottimeFilter</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65712</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d870c96c-75ee-46a6-8a02-8e4401a73423}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65737</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>68719476736</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{916c0dbf-7cec-40f9-9dd9-a5e68b904510}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65739</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4137b143-2770-43d4-91a2-55bb0a069830}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65743</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1152921575473807360</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{17043d46-fac2-4561-bca1-0c7a05e95f5f}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65745</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1152921575473807360</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4e718c57-c397-4221-9fbb-14fd51701d6a}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>68</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>67</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65747</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1154907291326087168</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{6fa2adad-a771-49d6-9706-229a11edae9f}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>8388608</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65932</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2d979248-9665-4f3d-bd78-78fc606785ff}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>16777216</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65934</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{5a81e7a2-5f3d-4bfe-8800-9896155a26a9}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65936</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b826a27f-f11b-4cf2-a344-367fcd949bfb}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65946</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7ae3438b-09e8-4dab-b4c9-a718a0fb2f21}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>6755399457832960</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65981</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>4503668346847264</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{07dd77a2-af5f-4d95-ac8a-5f67ed37a795}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>6755399457832960</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65982</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>4503668346847264</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{aa93fcde-150c-4336-b7b7-b5c6e65eacff}</filterKey>
<displayData>
<name>Block Inbound Default Rule</name>
<description>Block Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67369</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1099511627776</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{35b8f62f-f844-4491-8b4c-1dba1ad2e152}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to CDPSvc port 5050</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9a02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5050</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67377</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a25a6414-81bc-488d-9bdc-3357a328b156}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5160</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67387</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e4188afb-1b2b-4690-a846-8e047d267602}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5040</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5040</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67391</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7b110f84-74f4-4e78-9304-7109daaf2d6e}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>68</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>67</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67395</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1987367267205120</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4000f760-370b-492b-b793-b79468863478}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>546</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>547</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67397</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1987367267205120</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4bf0556b-2f82-43ab-b255-06b97088d4bb}</filterKey>
<displayData>
<name>Allow RPC/TCP traffic to EventLog</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67403</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690533487443968</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f81aa7b2-b58e-44c9-b248-c63d7bbf8658}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to fdphost port 3702</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67405</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b5764ab6-dea2-4a46-9a52-4900acc11074}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to fdphost port 1900</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>aa02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>1900</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67409</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2c98874b-2196-400d-b0b3-02cfd785e9a0}</filterKey>
<displayData>
<name>Allow Grouping to receive from port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ad02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67415</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{5299f6b9-973e-4e2d-bade-2fe989567ad4}</filterKey>
<displayData>
<name>Allow PNRP to receive from port 3540</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ae02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3540</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67417</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{261293a0-516b-434b-843b-28d9dd7e58e1}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening - Block incoming TCP traffic</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67427</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1689949371891712</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a60451c7-4a79-4136-91d3-0565d8d84c14}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67429</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971424348602368</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4e6c2740-4135-47cf-bb6b-4f232afd1ff9}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23555</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67430</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971424348602368</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{6fd5d401-c7a3-451a-a7c3-4238f6048c71}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23556</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67431</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971424348602368</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{674636e1-d1c8-49c7-88bd-85d6344f3f92}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>9955</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67435</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1decc740-3020-4931-b8c4-f4a32fa4eb62}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67437</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9e4c1498-cc50-42f2-8d8d-e9fb234dfc4a}</filterKey>
<displayData>
<name>Allow Grouping to receive from port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67443</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e894bfc1-0232-41eb-bd1b-dba62c581cc3}</filterKey>
<displayData>
<name>Allow PNRP to send to port 3540</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bb02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3540</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67447</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{5367ad7b-786a-4b2d-897d-e3ac3903b030}</filterKey>
<displayData>
<name>IPsec Policy Agent service hardening - Remote Management</name>
<description>Allow IPsec Policy Agent inbound RPC/TCP traffic for Remote Management</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>be02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67453</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690533487443968</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7c182b6c-685d-4d5f-93a5-7e3d6c721cae}</filterKey>
<displayData>
<name>Block all inbound traffic to SearchFilterHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bf02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchfilterhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67455</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1099511627776</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{678216b6-5986-4313-a1ea-b8510e8e55f2}</filterKey>
<displayData>
<name>Allow inbound traffic to SearchProtocolHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchprotocolhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67461</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1099511627776</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3b842cb6-50e7-407f-83d1-5505010d5958}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to SNMPTRAP service</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006e006d00700074007200610070002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\snmptrap.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67465</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{47944d31-0ea2-4401-8f82-817923ff5e4d}</filterKey>
<displayData>
<name>Allow all inbound TCP and RPC to SPPEXTCOMOBJ</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\sppextcomobj.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67467</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d2674ed0-d179-417d-900d-71c52cce2a28}</filterKey>
<displayData>
<name>TermServiceLOM</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67471</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9a2de3d6-de6b-4a6e-a639-c1be9e690c45}</filterKey>
<displayData>
<name>TermServiceLOM</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4</filterType>
</action>
<providerContextKey>{54144fae-35d1-47ea-b03c-c8817abdc485}</providerContextKey>
<reserved/>
<filterId>67472</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{bb982e40-5073-4fe1-bad0-342b507915a3}</filterKey>
<displayData>
<name>Allow incoming RPC traffic to VDS</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007600640073002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\vds.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67475</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690533487443968</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4df5da5b-47ae-4b4d-a60d-b1670fe0a294}</filterKey>
<displayData>
<name>Allow inbound TCP port 389 traffic for vmicheartbeat</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>389</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67477</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{968d0f97-7966-4c8f-ac3e-e2cb530b5138}</filterKey>
<displayData>
<name>Allow inbound TCP port 636 traffic for vmicheartbeat</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ca02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>636</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67479</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9ef070eb-918e-4fc7-91f5-6751e7b09dad}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to NTP port 123</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>cc02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>123</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67483</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{506c8ac2-abd5-4eda-952a-f9ff8e0c2699}</filterKey>
<displayData>
<name>Allow inbound RPC traffic to the Block Level Backup service (wbengine) over TCP</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ce02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007700620065006e00670069006e0065002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\wbengine.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67487</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690533487443968</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4e14b157-2674-4058-b56f-05d4fe2864b3}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67505</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b4f19d1c-ab0c-44b7-9219-abdcffb208ef}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>8554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67506</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{34d30aa5-8cd7-4e0f-8f6c-8d5ecb22c5a0}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - Block any other incoming TCP traffic</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67509</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9bd6eb23-a436-48f2-870e-4903429be10a}</filterKey>
<displayData>
<name>Allow incoming TCP to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67511</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d50bdeed-32a5-4547-ae60-2f39244a7500}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>10000003</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>1689399616077824</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67535</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>4503668346847264</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{c4450478-471e-43c9-be04-c987f28e3145}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>10000003</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>1689399616077824</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67536</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>4503668346847264</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{52f5f2b7-c554-4d47-9884-216611369828}</filterKey>
<displayData>
<name>WSH Default Inbound Block</name>
<description>Blocks all inbound traffic for services who have been network hardened</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)(A;NP;CC;;;S-1-5-80-4028305664-2774326660-44957573-2454826285-2129126537)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-957450137-3151016590-2548878560-3726258338-3930544608)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67538</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e15898ea-ab4e-467c-ac0b-74b8f32c14dc}</filterKey>
<displayData>
<name>PrivateNetwork Inbound Default Rule</name>
<description>PrivateNetwork Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ea02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67581</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>432347213495025536</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e9542e11-ff0f-4838-9b74-d0d870c98bcd}</filterKey>
<displayData>
<name>PrivateNetwork Inbound Default Rule</name>
<description>PrivateNetwork Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ea02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67582</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>72059243305385856</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ee32ef7d-1cb5-4f0b-919e-9534cc457f71}</filterKey>
<displayData>
<name>InternetClientServer Inbound Default Rule</name>
<description>InternetClientServer Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ec02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>0.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67585</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>9008848522198912</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d0e39566-5c38-407a-ae61-d9b45776937d}</filterKey>
<displayData>
<name>InternetClientServer Inbound Default Rule</name>
<description>InternetClientServer Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ec02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67586</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>54044844795903872</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{012e4ec2-7e9e-47c2-9c3e-8c4bba736f3d}</filterKey>
<displayData>
<name>InternetClientServer Inbound Default Rule</name>
<description>InternetClientServer Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ec02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>255.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67587</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>72059243305385856</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4b5864ed-a51e-49e9-bd6e-3c46ec86e402}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ef02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67597</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434332932568514560</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a0454a4c-4bd7-4312-8b06-befb3f363446}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ef02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="8">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67598</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434333001287991296</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2e3c31df-e381-4d55-93ee-8e1daf5fd162}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ef02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67599</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>74044962378874880</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d72d15fa-94ce-420d-b2c4-6dc970c9b613}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ef02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="8">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67600</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>74045031098351616</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{416b05d3-ef92-45ab-9527-d2607b4d4175}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67605</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434317539405725696</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{24fd4aac-4823-4739-b176-f2c68cf37295}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67606</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434317608125202432</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b497ea9d-4bfe-40ec-9e6d-c987378c0872}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67607</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>74029569216086016</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{c0a6e371-15b2-4941-b5c1-0b5d2bfd59c9}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67608</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>74029637935562752</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a9b0bc20-6550-4c4c-9169-ce72c1a61d45}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67609</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434051457591803904</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{76b4a6e9-0d68-4da2-8fce-e0f5d40b8eb6}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67610</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434051526311280640</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7463f439-74a2-48bf-b04f-3b95786d0a4c}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67611</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>73763487402164224</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f724fbc6-a3a5-4404-a1fe-6b043549c9dc}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67612</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>73763556121640960</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD</layerKey>
<displayData>
<name>ALE Receive/Accept v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="35">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>45</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e012d}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD</applicableLayer>
<calloutId>278</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<displayData>
<name>ALE Receive/Accept v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="39">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>46</layerId>
</layer>
<callouts numItems="7">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Initiate Secure v6 Layer Callout</name>
<description>Verifies that each incoming connection that is supposed to arrive secure arrives securely.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>14</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in TCP Chimney Offload ALE Receive/Accept v6 Layer Callout</name>
<description>Enables or disables TCP Chimney Offload for each incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>22</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v6 Layer Callout</name>
<description>Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>26</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in TCP Templates ALE Receive/Accept v6 Layer Callout</name>
<description>Applies TCP Template for each incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>36</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in Set Option ALE Receive/Accept v6 Layer Callout</name>
<description>Sets classify options on inbound flows.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>40</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_RECV_ACCEPT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in Policy Silent Mode ALE Receive/Accept v6 Layer Callout</name>
<description>Audit and log policy for incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>44</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e022e}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Allows secondary connections.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>285</calloutId>
</item>
</callouts>
<filters numItems="57">
<item>
<filterKey>{84750a0c-b836-48e3-ab80-104985c857db}</filterKey>
<displayData>
<name>AppContainerBoottimeFilter</name>
<description>AppContainerBoottimeFilter</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65711</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b98b75dc-17c0-4e84-bd4e-2080527ca6a6}</filterKey>
<displayData>
<name>AppContainerBoottimeFilter</name>
<description>AppContainerBoottimeFilter</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65713</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b02a4013-b6b5-4859-9168-1e3299e43b24}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65736</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>34359738368</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{0593d9b7-8e2b-44b1-9f9e-2831da1c9bd9}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65738</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{8b50e2ec-7cf0-4b71-b42e-5b0536f6cab8}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65742</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1152921540040327168</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3180114b-8338-4740-9a16-444134ad62f4}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65744</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1152921540040327168</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{567d3836-3f5b-4067-b9c4-952f677010a2}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>58</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>135</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65746</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1153414085816090624</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3a90a266-1519-4d23-911b-e84cd0f02ab8}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>546</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>547</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65748</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1153417418710712320</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{70694559-714a-4a38-a0cd-51439e06f1d8}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>58</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>134</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>530079007300740065006d000000</data>
<asString>System</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>fe80::</byteArray16>
</valueLow>
<valueHigh>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>fe80:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65749</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1225472229609832448</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{93c8b706-6ea8-4770-849c-0f600e1da68c}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>8388608</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65933</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f94d665d-ecd0-49f7-a1c2-b44d59fd1259}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>16777216</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65935</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f50908db-0509-4b52-90a1-64183fb2d3ec}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65937</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7c0e3462-4a76-43ad-86e6-85c258c0a02e}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65947</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e8efa035-3607-4526-b509-4dff9cb16eb3}</filterKey>
<displayData>
<name>ET Default Block All</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65950</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{36976114-f3bb-4b0c-83d5-cc4ec87b2e84}</filterKey>
<displayData>
<name>ET Allow All</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65951</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{efd42055-2e95-4ecd-9c25-e1686c3a5d5c}</filterKey>
<displayData>
<name>ET ICMPV6 NA - Permit</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>530079007300740065006d000000</data>
<asString>System</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>136</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>58</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65958</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{0e549565-6f4e-480f-9809-3a51e44655d9}</filterKey>
<displayData>
<name>ET ICMPV6 NS - Permit</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>530079007300740065006d000000</data>
<asString>System</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>135</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>58</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65959</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{51c1f05f-5496-4068-9f77-981ecc749546}</filterKey>
<displayData>
<name>Teredo socket option opt out block filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{131dfd38-ce06-4fa3-ab8a-f84f62ac84d5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{7b6b11f6-cbb5-433c-ae06-6a4f0076e49e}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65960</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{139250d7-7c22-4840-9d82-ea5f8e96c6ad}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>6755399457832960</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65983</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1125934266581024</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{c1092084-db12-4ece-91af-cc70b90721a3}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>6755399457832960</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65984</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1125934266581024</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1121d831-0154-4d89-8bc4-2f5265b14832}</filterKey>
<displayData>
<name>Block Inbound Default Rule</name>
<description>Block Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67370</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{06c0d623-daf6-4374-8c95-2575a648b544}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to CDPSvc port 5050</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9a02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5050</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67378</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{008f131f-556a-459d-aedf-a6fe18bb6602}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5160</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67388</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{cb792cb2-cd30-4803-8091-66fdc568511e}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5040</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5040</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67392</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e968a6eb-3a9c-4f95-b069-d70147dcddd0}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>68</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>67</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67396</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>496704377847808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{aad1f5ea-b28b-4cbd-816d-a8f61acde344}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>546</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>547</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67398</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>496704377847808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{61065fc1-f566-4c03-88b5-5c61874a884c}</filterKey>
<displayData>
<name>Allow RPC/TCP traffic to EventLog</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67404</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423054278656000</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b7a3d53c-c935-4c00-9773-6410b460be4e}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to fdphost port 3702</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67406</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{06299b7c-943f-429a-99cb-d5f2d9d1ab43}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to fdphost port 1900</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>aa02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>1900</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67410</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{add4c54f-b2be-43ee-9b60-f1b89fae508d}</filterKey>
<displayData>
<name>Allow Grouping to receive from port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ad02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67416</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7da0ab5f-7ade-4195-91cd-eb3fc150ded7}</filterKey>
<displayData>
<name>Allow PNRP to receive from port 3540</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ae02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3540</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67418</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{cfe5b7fd-860e-4906-b10d-6673610e1c54}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening - Block incoming TCP traffic</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67428</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>422762220879872</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{385574dd-c2a0-4d8f-9759-cb1a8e788503}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67432</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493130965057536</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2cc647af-42d3-423c-8435-5b4a386515a7}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23555</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67433</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493130965057536</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{56ce6c5c-43a0-4e83-9f86-3fe31ac28007}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23556</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67434</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493130965057536</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ea5ee07a-193f-462a-b370-a9babef4edd8}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>9955</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67436</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{aaf38099-868d-42f2-8fb1-990654548555}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67438</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{40218195-c4b2-463b-9f74-8685acb18b98}</filterKey>
<displayData>
<name>Allow Grouping to receive from port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67444</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ab00f66b-e20e-4e31-a11c-967fa2fb197d}</filterKey>
<displayData>
<name>Allow PNRP to send to port 3540</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bb02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3540</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67448</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{98185aff-ae7e-45ee-b3b3-c86a7b2c953e}</filterKey>
<displayData>
<name>IPsec Policy Agent service hardening - Remote Management</name>
<description>Allow IPsec Policy Agent inbound RPC/TCP traffic for Remote Management</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>be02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67454</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423054278656000</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{dc663daf-cf38-43e7-abda-2f384fa4d55a}</filterKey>
<displayData>
<name>Block all inbound traffic to SearchFilterHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bf02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchfilterhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67456</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f226eb59-2489-4fe1-a2fa-e4057ebea9c2}</filterKey>
<displayData>
<name>Allow inbound traffic to SearchProtocolHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchprotocolhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67462</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{29e6a362-4f0d-4eae-b5cc-4ec25fe8511a}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to SNMPTRAP service</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006e006d00700074007200610070002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\snmptrap.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67466</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{775c804a-fe58-4de3-b407-42e2e1a349a9}</filterKey>
<displayData>
<name>Allow all inbound TCP and RPC to SPPEXTCOMOBJ</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\sppextcomobj.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67468</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e60c427d-02c2-41fd-8728-e1823bea826d}</filterKey>
<displayData>
<name>TermServiceLOM</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67473</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ba7869aa-36fe-44bb-842d-534ce08088f2}</filterKey>
<displayData>
<name>TermServiceLOM</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6</filterType>
</action>
<providerContextKey>{54144fae-35d1-47ea-b03c-c8817abdc485}</providerContextKey>
<reserved/>
<filterId>67474</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{14c98b28-1f15-4e17-8e00-441d5e000eb2}</filterKey>
<displayData>
<name>Allow incoming RPC traffic to VDS</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007600640073002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\vds.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67476</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423054278656000</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{58e23952-927d-49b0-a381-7c37630dd491}</filterKey>
<displayData>
<name>Allow inbound TCP port 389 traffic for vmicheartbeat</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>389</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67478</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2cb35df3-3507-42f6-bfef-80dcece0e16e}</filterKey>
<displayData>
<name>Allow inbound TCP port 636 traffic for vmicheartbeat</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ca02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>636</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67480</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{88e0210c-d5e3-4fb3-b9b4-f966d71be136}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to NTP port 123</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>cc02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>123</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67484</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a44c86b7-eec1-4ba9-8f3b-fef0e511c566}</filterKey>
<displayData>
<name>Allow inbound RPC traffic to the Block Level Backup service (wbengine) over TCP</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ce02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007700620065006e00670069006e0065002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\wbengine.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67488</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423054278656000</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{c9c243e4-38d3-42b5-9ecd-3e7b9f720ecc}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67507</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{621e2a09-1bc6-4299-a024-70a58edfaf30}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>8554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67508</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{624b1865-f4c9-47fe-8868-1edf21d4993a}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - Block any other incoming TCP traffic</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67510</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{bf497f8e-908a-4160-81b4-b22400b94f57}</filterKey>
<displayData>
<name>Allow incoming TCP to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67512</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b732e7a2-e3f4-441a-8aaf-ae7ff2b67391}</filterKey>
<displayData>
<name>WSH Default Inbound Block</name>
<description>Blocks all inbound traffic for services who have been network hardened</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)(A;NP;CC;;;S-1-5-80-4028305664-2774326660-44957573-2454826285-2129126537)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-957450137-3151016590-2548878560-3726258338-3930544608)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67537</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>274877906944</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{dacd0dc2-7d8a-48d5-b362-1ecfe8ebfd9e}</filterKey>
<displayData>
<name>InternetClientServer Inbound Default Rule</name>
<description>InternetClientServer Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ec02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>::</byteArray16>
</valueLow>
<valueHigh>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67588</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>824633728896</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD</layerKey>
<displayData>
<name>ALE Receive/Accept v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="35">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>47</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e012f}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD</applicableLayer>
<calloutId>279</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<displayData>
<name>ALE Connect v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="41">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_EFFECTIVE_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>48</layerId>
</layer>
<callouts numItems="7">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_ALE_CONNECT_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec ALE Connect v4 Layer Callout</name>
<description>Applies IPsec policy modifiers to client applications.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>15</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in TCP Chimney Offload ALE Connect v4 Layer Callout</name>
<description>Enables or disables TCP Chimney Offload for each outgoing connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>19</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in Set Option ALE Connect v4 Layer Callout</name>
<description>Sets classify options on outbound flows.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>23</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in TCP Templates ALE Connect v4 Layer Callout</name>
<description>Applies TCP Template for each outgoing connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>33</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in Reserved callout</name>
<description>WFP Built-in Reserved callout</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>37</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_CONNECT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in Policy Silent Mode ALE Connect v4 Layer Callout</name>
<description>Audit and log policy for outgoing connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>41</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0230}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Allows secondary connections.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>282</calloutId>
</item>
</callouts>
<filters numItems="65">
<item>
<filterKey>{082edf36-12d7-4698-858a-cf274b78d09a}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65741</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{fa8635e6-fa79-4019-aeeb-9122dbec91c2}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65938</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{781067e8-7937-4fb7-97e0-7b7b2d966562}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>137</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65940</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{6cdef8f6-db3a-4563-8693-3b0c5dbc46f2}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>D:(A;NP;CC;;;WD)(A;NP;CC;;;AN)(A;NP;CC;;;S-1-15-3-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4256926629-1688279915-2739229046-3928706915)(A;NP;CC;;;S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4256926629-1688279915-2739229046-3928706915)(A;NP;CC;;;S-1-15-3-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4043415302-551583165-304772019-4009825106)(A;NP;CC;;;S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4043415302-551583165-304772019-4009825106)S:NO_ACCESS_CONTROL</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V4</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65942</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2beb431a-5568-403a-a816-0499f5363a6c}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(XA;;CC;;;WD;(Exists WP://SKUID))</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V4</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65944</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{22d836a8-5c2b-4626-8e73-0834eb63f738}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65948</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{54c9ad17-5c71-454a-b0b0-27f8f8789f7f}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>8</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67346</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>9223372036854792064</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e3d2e765-e6b0-4e54-98d4-6be7a89edfd4}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>3</uint8>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67350</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>3458764513820540928</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d913b1ae-6a69-47b3-ae50-6227edfb2180}</filterKey>
<displayData>
<name>Block Outbound Default Rule</name>
<description>Block Outbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67371</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b633bf1c-65ae-4644-bf5a-5f9267dfaf3b}</filterKey>
<displayData>
<name>AxInstSV TCP outbound allow</name>
<description>Allow only outbound TCP traffic from AxInstSV</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>80</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67373</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{38e692a8-be53-4c84-a7a8-247ba9801724}</filterKey>
<displayData>
<name>AxInstSV TCP outbound allow</name>
<description>Allow only outbound TCP traffic from AxInstSV</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>443</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67374</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d5ca90a8-e087-4bee-968e-3bfd4ff2561a}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from CDPSvc from any port to port 5040</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9b02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5040</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67379</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{46f1b4b1-621e-4e8d-8615-578be0bccb8b}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from any port to CDPSvc port 5050</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9c02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5050</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67381</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{38d6d06b-7a96-4e50-93c3-dbf81f846d8c}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from CDPSvc port 5050</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9d02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5050</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67383</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>985987052208128</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{0ea24f57-5231-4626-b04f-2621eb056e3c}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from CDPSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9e02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67385</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4c6e69d1-0a9d-4a1f-abcf-b6ff1c91803c}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5160</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67389</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1e089297-979e-4973-bdca-d92d64d67180}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>