Skip to content

Instantly share code, notes, and snippets.

@Cyb3rWard0g
Created October 4, 2018 05:53
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Cyb3rWard0g/31a2f550e4b92fcd19e800f89b617b5d to your computer and use it in GitHub Desktop.
Save Cyb3rWard0g/31a2f550e4b92fcd19e800f89b617b5d to your computer and use it in GitHub Desktop.
This file has been truncated, but you can view the full file.
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<wfpstate>
<timeStamp>2018-10-04T05:38:46.705Z</timeStamp>
<sessions numItems="15">
<item>
<sessionKey>{3c1f4d46-4e9d-4fab-bcb5-00c5403ee1cd}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>488</processId>
<sid>S-1-5-20</sid>
<username>NT AUTHORITY\NETWORK SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{314f4262-57b8-414f-9b37-af635ab553eb}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{9825d111-3d28-4b37-a6fb-f40b3c6bcd2b}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{57379ce8-313c-49cc-8701-144fefb705b2}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{6667406c-c873-499e-b2a5-5d3619a4d2cf}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{de5bf023-20ad-45e5-8b8f-adafa3a4b5ad}</sessionKey>
<displayData>
<name>POLICYAGNT</name>
<description>PolicyAgent Session</description>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>300000</txnWaitTimeoutInMSec>
<processId>1776</processId>
<sid>S-1-5-20</sid>
<username>NT AUTHORITY\NETWORK SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{3fb22358-90e8-49b5-ba86-95d331bf2724}</sessionKey>
<displayData>
<name>Windows Defender Firewall Dynamic Session</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>18000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{40cce534-a34e-46cf-82f4-5d5813b36d25}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>4294967295</txnWaitTimeoutInMSec>
<processId>1104</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{d45ca2c2-ca58-4836-bae5-36726e407979}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1104</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{76f7c8ce-12d7-433b-9a9d-814b2e23adce}</sessionKey>
<displayData>
<name>Modern Network Isolation Diagnostics Bfe Session</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>18000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{6f2b4fb3-f176-45ed-aa26-886c77fb3ffb}</sessionKey>
<displayData>
<name>Teredo Callback Session</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>4294967295</txnWaitTimeoutInMSec>
<processId>1104</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{118aaab5-c97c-4258-b69d-c60b54f7a04b}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>2388</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{15fbeb7a-240a-495e-aeed-ee4f27e480af}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>2388</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{12dd6e01-0a86-4c83-b672-b186c0cbe1a0}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>4080</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{cd64ba98-4c29-4321-8c36-71d08d500b7b}</sessionKey>
<displayData>
<name>wfputil</name>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>4294967295</txnWaitTimeoutInMSec>
<processId>3844</processId>
<sid>S-1-5-21-3825400013-1856045589-1834093677-1001</sid>
<username>DESKTOP-WARDOG\wardog</username>
<kernelMode>false</kernelMode>
</item>
</sessions>
<layers numItems="103">
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V4</layerKey>
<displayData>
<name>Inbound IP Packet v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>0</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V4_DISCARD</layerKey>
<displayData>
<name>Inbound IP Packet v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>1</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V6</layerKey>
<displayData>
<name>Inbound IP Packet v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>2</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V6_DISCARD</layerKey>
<displayData>
<name>Inbound IP Packet v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>3</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V4</layerKey>
<displayData>
<name>Outbound IP Packet v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>4</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V4_DISCARD</layerKey>
<displayData>
<name>Outbound IP Packet v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>5</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V6</layerKey>
<displayData>
<name>Outbound IP Packet v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>6</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V6_DISCARD</layerKey>
<displayData>
<name>Outbound IP Packet v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>7</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V4</layerKey>
<displayData>
<name>IP Forward v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>8</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Inbound Tunnel v4 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V4</applicableLayer>
<calloutId>9</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Outbound Tunnel v4 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V4</applicableLayer>
<calloutId>11</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V4_DISCARD</layerKey>
<displayData>
<name>IP Forward v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>9</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V6</layerKey>
<displayData>
<name>IP Forward v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>10</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Inbound Tunnel v6 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V6</applicableLayer>
<calloutId>10</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Outbound Tunnel v6 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V6</applicableLayer>
<calloutId>12</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V6_DISCARD</layerKey>
<displayData>
<name>IP Forward v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>11</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4</layerKey>
<displayData>
<name>Inbound Transport v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>12</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Transport v4 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>1</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Tunnel v4 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>5</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</layerKey>
<displayData>
<name>Inbound Transport v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>13</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP</calloutKey>
<displayData>
<name>WFP Built-in Silent Drop Transport v4 Discard Layer Callout</name>
<description>Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint.</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000040</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</applicableLayer>
<calloutId>17</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6</layerKey>
<displayData>
<name>Inbound Transport v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>14</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Transport v6 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>2</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Tunnel v6 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>6</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</layerKey>
<displayData>
<name>Inbound Transport v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>15</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP</calloutKey>
<displayData>
<name>WFP Built-in Silent Drop Transport v6 Discard Layer Callout</name>
<description>Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint.</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000040</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</applicableLayer>
<calloutId>18</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</layerKey>
<displayData>
<name>Outbound Transport v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>16</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Transport v4 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over transport mode security associations.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>3</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Tunnel v4 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>7</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD</layerKey>
<displayData>
<name>Outbound Transport v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>17</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</layerKey>
<displayData>
<name>Outbound Transport v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>18</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Transport v6 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over transport mode security associations.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>4</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Tunnel v6 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>8</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD</layerKey>
<displayData>
<name>Outbound Transport v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>19</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V4</layerKey>
<displayData>
<name>Stream v4 Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>20</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0414}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Connection-oriented protocol packet inspection.</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V4</applicableLayer>
<calloutId>288</calloutId>
</item>
<item>
<calloutKey>{d67b238d-d80c-4ba7-96df-4a0c83464fa7}</calloutKey>
<displayData>
<name>windefend_stream_v4</name>
<description>windefend</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V4</applicableLayer>
<calloutId>290</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{42e67750-e0ae-4ec7-aa42-97c6605b1c96}</filterKey>
<displayData>
<name>windefend_stream_v4</name>
<description>windefend</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<layerKey>FWPM_LAYER_STREAM_V4</layerKey>
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
<filterType>{d67b238d-d80c-4ba7-96df-4a0c83464fa7}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>66191</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V4_DISCARD</layerKey>
<displayData>
<name>Stream v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>21</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V6</layerKey>
<displayData>
<name>Stream v6 Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>22</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0416}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Connection-oriented protocol packet inspection.</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V6</applicableLayer>
<calloutId>289</calloutId>
</item>
<item>
<calloutKey>{36d4cf95-fd3a-4bb8-90a9-ffdb3749237f}</calloutKey>
<displayData>
<name>windefend_stream_v6</name>
<description>windefend</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V6</applicableLayer>
<calloutId>291</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{094b9bb6-e451-4069-ac23-5fe695ec9662}</filterKey>
<displayData>
<name>windefend_stream_v6</name>
<description>windefend</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<layerKey>FWPM_LAYER_STREAM_V6</layerKey>
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
<filterType>{36d4cf95-fd3a-4bb8-90a9-ffdb3749237f}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>66192</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V6_DISCARD</layerKey>
<displayData>
<name>Stream v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>23</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V4</layerKey>
<displayData>
<name>Datagram Data v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>24</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V4_DISCARD</layerKey>
<displayData>
<name>Datagram Data v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>25</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V6</layerKey>
<displayData>
<name>Datagram Data v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>26</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V6_DISCARD</layerKey>
<displayData>
<name>Datagram Data v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>27</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4</layerKey>
<displayData>
<name>Inbound ICMP Error v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="22">
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>28</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD</layerKey>
<displayData>
<name>Inbound ICMP Error v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="22">
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>29</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e011d}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD</applicableLayer>
<calloutId>276</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
<displayData>
<name>Inbound ICMP Error v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="22">
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>30</layerId>
</layer>
<callouts/>
<filters numItems="4">
<item>
<filterKey>{6bf306cf-fe94-45d2-b3cf-26095c19bc52}</filterKey>
<displayData>
<name>ET ICMPV6 Destination Unreachable - Permit</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>1</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65954</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3538b8c7-b5c7-403e-ba7b-2f8e5a894377}</filterKey>
<displayData>
<name>ET ICMPV6 Packet Too Big - Permit</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>2</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65955</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{42cdc327-ad25-43b2-ac7c-644735f14b9a}</filterKey>
<displayData>
<name>ET ICMPV6 Parameter Problem - Permit</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>4</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65956</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a2003323-e08e-41cd-ac7f-d9e690980370}</filterKey>
<displayData>
<name>ET ICMPV6 Time Exceeded - Permit</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65957</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD</layerKey>
<displayData>
<name>Inbound ICMP Error v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="22">
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>31</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e011f}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD</applicableLayer>
<calloutId>277</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
<displayData>
<name>Outbound ICMP Error v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>32</layerId>
</layer>
<callouts/>
<filters numItems="2">
<item>
<filterKey>{f43b6000-48aa-4631-96de-07aece59fca4}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>8</uint8>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67345</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>9223372036854775812</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2ba26ffa-587a-4aa2-98d5-dc4573c63984}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>3</uint8>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67349</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>3458764513820540928</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD</layerKey>
<displayData>
<name>Outbound ICMP Error v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>33</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0121}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD</applicableLayer>
<calloutId>272</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
<displayData>
<name>Outbound ICMP Error v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>34</layerId>
</layer>
<callouts/>
<filters numItems="2">
<item>
<filterKey>{165eb31b-9a40-4d77-bb15-fcc4888e6f3e}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>8</uint8>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67347</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>9223372036854775812</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{36b3a9ab-de53-46d6-94b4-d5ae7aee7bb3}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>3</uint8>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67351</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>3458764513820540928</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD</layerKey>
<displayData>
<name>Outbound ICMP Error v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>35</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0123}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD</applicableLayer>
<calloutId>273</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
<displayData>
<name>ALE Resource Assignment v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="18">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>36</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</calloutKey>
<displayData>
<name>WFP Built-in Edge Traversal ALE Resource Assignment v4 Layer Callout</name>
<description>Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000014</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</applicableLayer>
<calloutId>27</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0024}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Notifies the user.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</applicableLayer>
<calloutId>268</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD</layerKey>
<displayData>
<name>ALE Resource Assignment v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>37</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
<displayData>
<name>ALE Resource Assignment v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="18">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>38</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</calloutKey>
<displayData>
<name>WFP Built-in Edge Traversal ALE Resource Assignment v6 Layer Callout</name>
<description>Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000014</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</applicableLayer>
<calloutId>28</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0026}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Notifies the user.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</applicableLayer>
<calloutId>269</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{4c1b3569-ef2b-4988-97a4-ff820287d066}</filterKey>
<displayData>
<name>ET Bind callout</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
<filterType>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65953</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD</layerKey>
<displayData>
<name>ALE Resource Assignment v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>39</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
<displayData>
<name>ALE Listen v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>40</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</calloutKey>
<displayData>
<name>WFP Built-in Edge Traversal ALE Listen v4 Layer Callout</name>
<description>Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000014</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V4</applicableLayer>
<calloutId>29</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0028}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Notifies the user.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V4</applicableLayer>
<calloutId>270</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4_DISCARD</layerKey>
<displayData>
<name>ALE Listen v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>41</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
<displayData>
<name>ALE Listen v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>42</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</calloutKey>
<displayData>
<name>WFP Built-in Edge Traversal ALE Listen v6 Layer Callout</name>
<description>Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000014</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V6</applicableLayer>
<calloutId>30</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e002a}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Notifies the user.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V6</applicableLayer>
<calloutId>271</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{a0bf977e-2351-4973-a59c-250292cf3688}</filterKey>
<displayData>
<name>ET Listen Callout</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
<filterType>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65952</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6_DISCARD</layerKey>
<displayData>
<name>ALE Listen v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>43</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<displayData>
<name>ALE Receive/Accept v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="39">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>44</layerId>
</layer>
<callouts numItems="7">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Initiate Secure v4 Layer Callout</name>
<description>Verifies that each incoming connection that is supposed to arrive secure arrives securely.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>13</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in TCP Chimney Offload ALE Receive/Accept v4 Layer Callout</name>
<description>Enables or disables TCP Chimney Offload for each incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>21</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v4 Layer Callout</name>
<description>Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>25</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in TCP Templates ALE Receive/Accept v4 Layer Callout</name>
<description>Applies TCP Template for each incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>35</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in Set Option ALE Receive/Accept v4 Layer Callout</name>
<description>Sets classify options on inbound flows.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>39</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_RECV_ACCEPT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in Policy Silent Mode ALE Receive/Accept v4 Layer Callout</name>
<description>Audit and log policy for incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>43</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e022c}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Allows secondary connections.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
<calloutId>284</calloutId>
</item>
</callouts>
<filters numItems="68">
<item>
<filterKey>{89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}</filterKey>
<displayData>
<name>AppContainerBoottimeFilter</name>
<description>AppContainerBoottimeFilter</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65710</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e72646bc-7d3f-4c5c-a679-b3716f8c6cc8}</filterKey>
<displayData>
<name>AppContainerBoottimeFilter</name>
<description>AppContainerBoottimeFilter</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65712</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d870c96c-75ee-46a6-8a02-8e4401a73423}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65737</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>68719476736</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{916c0dbf-7cec-40f9-9dd9-a5e68b904510}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65739</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4137b143-2770-43d4-91a2-55bb0a069830}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65743</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1152921575473807360</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{17043d46-fac2-4561-bca1-0c7a05e95f5f}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65745</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1152921575473807360</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4e718c57-c397-4221-9fbb-14fd51701d6a}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>68</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>67</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65747</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1154907291326087168</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{6fa2adad-a771-49d6-9706-229a11edae9f}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>8388608</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65932</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2d979248-9665-4f3d-bd78-78fc606785ff}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>16777216</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65934</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{5a81e7a2-5f3d-4bfe-8800-9896155a26a9}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65936</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b826a27f-f11b-4cf2-a344-367fcd949bfb}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65946</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7ae3438b-09e8-4dab-b4c9-a718a0fb2f21}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>6755399457832960</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65981</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>4503668346847264</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{07dd77a2-af5f-4d95-ac8a-5f67ed37a795}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>6755399457832960</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65982</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>4503668346847264</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{aa93fcde-150c-4336-b7b7-b5c6e65eacff}</filterKey>
<displayData>
<name>Block Inbound Default Rule</name>
<description>Block Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67369</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1099511627776</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{35b8f62f-f844-4491-8b4c-1dba1ad2e152}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to CDPSvc port 5050</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9a02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5050</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67377</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a25a6414-81bc-488d-9bdc-3357a328b156}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5160</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67387</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e4188afb-1b2b-4690-a846-8e047d267602}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5040</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5040</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67391</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7b110f84-74f4-4e78-9304-7109daaf2d6e}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>68</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>67</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67395</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1987367267205120</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4000f760-370b-492b-b793-b79468863478}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>546</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>547</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67397</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1987367267205120</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4bf0556b-2f82-43ab-b255-06b97088d4bb}</filterKey>
<displayData>
<name>Allow RPC/TCP traffic to EventLog</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67403</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690533487443968</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f81aa7b2-b58e-44c9-b248-c63d7bbf8658}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to fdphost port 3702</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67405</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b5764ab6-dea2-4a46-9a52-4900acc11074}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to fdphost port 1900</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>aa02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>1900</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67409</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2c98874b-2196-400d-b0b3-02cfd785e9a0}</filterKey>
<displayData>
<name>Allow Grouping to receive from port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ad02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67415</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{5299f6b9-973e-4e2d-bade-2fe989567ad4}</filterKey>
<displayData>
<name>Allow PNRP to receive from port 3540</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ae02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3540</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67417</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{261293a0-516b-434b-843b-28d9dd7e58e1}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening - Block incoming TCP traffic</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67427</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1689949371891712</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a60451c7-4a79-4136-91d3-0565d8d84c14}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67429</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971424348602368</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4e6c2740-4135-47cf-bb6b-4f232afd1ff9}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23555</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67430</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971424348602368</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{6fd5d401-c7a3-451a-a7c3-4238f6048c71}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23556</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67431</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971424348602368</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{674636e1-d1c8-49c7-88bd-85d6344f3f92}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>9955</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67435</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1decc740-3020-4931-b8c4-f4a32fa4eb62}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67437</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9e4c1498-cc50-42f2-8d8d-e9fb234dfc4a}</filterKey>
<displayData>
<name>Allow Grouping to receive from port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67443</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e894bfc1-0232-41eb-bd1b-dba62c581cc3}</filterKey>
<displayData>
<name>Allow PNRP to send to port 3540</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bb02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3540</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67447</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{5367ad7b-786a-4b2d-897d-e3ac3903b030}</filterKey>
<displayData>
<name>IPsec Policy Agent service hardening - Remote Management</name>
<description>Allow IPsec Policy Agent inbound RPC/TCP traffic for Remote Management</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>be02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67453</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690533487443968</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7c182b6c-685d-4d5f-93a5-7e3d6c721cae}</filterKey>
<displayData>
<name>Block all inbound traffic to SearchFilterHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bf02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchfilterhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67455</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1099511627776</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{678216b6-5986-4313-a1ea-b8510e8e55f2}</filterKey>
<displayData>
<name>Allow inbound traffic to SearchProtocolHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchprotocolhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67461</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1099511627776</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3b842cb6-50e7-407f-83d1-5505010d5958}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to SNMPTRAP service</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006e006d00700074007200610070002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\snmptrap.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67465</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{47944d31-0ea2-4401-8f82-817923ff5e4d}</filterKey>
<displayData>
<name>Allow all inbound TCP and RPC to SPPEXTCOMOBJ</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\sppextcomobj.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67467</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d2674ed0-d179-417d-900d-71c52cce2a28}</filterKey>
<displayData>
<name>TermServiceLOM</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67471</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9a2de3d6-de6b-4a6e-a639-c1be9e690c45}</filterKey>
<displayData>
<name>TermServiceLOM</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4</filterType>
</action>
<providerContextKey>{54144fae-35d1-47ea-b03c-c8817abdc485}</providerContextKey>
<reserved/>
<filterId>67472</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{bb982e40-5073-4fe1-bad0-342b507915a3}</filterKey>
<displayData>
<name>Allow incoming RPC traffic to VDS</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007600640073002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\vds.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67475</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690533487443968</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4df5da5b-47ae-4b4d-a60d-b1670fe0a294}</filterKey>
<displayData>
<name>Allow inbound TCP port 389 traffic for vmicheartbeat</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>389</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67477</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{968d0f97-7966-4c8f-ac3e-e2cb530b5138}</filterKey>
<displayData>
<name>Allow inbound TCP port 636 traffic for vmicheartbeat</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ca02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>636</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67479</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9ef070eb-918e-4fc7-91f5-6751e7b09dad}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to NTP port 123</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>cc02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>123</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67483</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{506c8ac2-abd5-4eda-952a-f9ff8e0c2699}</filterKey>
<displayData>
<name>Allow inbound RPC traffic to the Block Level Backup service (wbengine) over TCP</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ce02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007700620065006e00670069006e0065002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\wbengine.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67487</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690533487443968</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4e14b157-2674-4058-b56f-05d4fe2864b3}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67505</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b4f19d1c-ab0c-44b7-9219-abdcffb208ef}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>8554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67506</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1971974104416256</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{34d30aa5-8cd7-4e0f-8f6c-8d5ecb22c5a0}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - Block any other incoming TCP traffic</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67509</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9bd6eb23-a436-48f2-870e-4903429be10a}</filterKey>
<displayData>
<name>Allow incoming TCP to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67511</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1690499127705600</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d50bdeed-32a5-4547-ae60-2f39244a7500}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>10000003</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>1689399616077824</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67535</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>4503668346847264</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{c4450478-471e-43c9-be04-c987f28e3145}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>10000003</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>1689399616077824</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67536</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>4503668346847264</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{52f5f2b7-c554-4d47-9884-216611369828}</filterKey>
<displayData>
<name>WSH Default Inbound Block</name>
<description>Blocks all inbound traffic for services who have been network hardened</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)(A;NP;CC;;;S-1-5-80-4028305664-2774326660-44957573-2454826285-2129126537)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-957450137-3151016590-2548878560-3726258338-3930544608)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67538</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e15898ea-ab4e-467c-ac0b-74b8f32c14dc}</filterKey>
<displayData>
<name>PrivateNetwork Inbound Default Rule</name>
<description>PrivateNetwork Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ea02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67581</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>432347213495025536</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e9542e11-ff0f-4838-9b74-d0d870c98bcd}</filterKey>
<displayData>
<name>PrivateNetwork Inbound Default Rule</name>
<description>PrivateNetwork Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ea02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67582</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>72059243305385856</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ee32ef7d-1cb5-4f0b-919e-9534cc457f71}</filterKey>
<displayData>
<name>InternetClientServer Inbound Default Rule</name>
<description>InternetClientServer Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ec02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>0.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67585</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>9008848522198912</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d0e39566-5c38-407a-ae61-d9b45776937d}</filterKey>
<displayData>
<name>InternetClientServer Inbound Default Rule</name>
<description>InternetClientServer Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ec02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67586</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>54044844795903872</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{012e4ec2-7e9e-47c2-9c3e-8c4bba736f3d}</filterKey>
<displayData>
<name>InternetClientServer Inbound Default Rule</name>
<description>InternetClientServer Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ec02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>255.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67587</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>72059243305385856</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4b5864ed-a51e-49e9-bd6e-3c46ec86e402}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ef02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67597</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434332932568514560</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a0454a4c-4bd7-4312-8b06-befb3f363446}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ef02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="8">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67598</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434333001287991296</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2e3c31df-e381-4d55-93ee-8e1daf5fd162}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ef02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67599</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>74044962378874880</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d72d15fa-94ce-420d-b2c4-6dc970c9b613}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ef02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="8">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67600</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>74045031098351616</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{416b05d3-ef92-45ab-9527-d2607b4d4175}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67605</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434317539405725696</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{24fd4aac-4823-4739-b176-f2c68cf37295}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67606</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434317608125202432</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b497ea9d-4bfe-40ec-9e6d-c987378c0872}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67607</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>74029569216086016</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{c0a6e371-15b2-4941-b5c1-0b5d2bfd59c9}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67608</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>74029637935562752</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a9b0bc20-6550-4c4c-9169-ce72c1a61d45}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67609</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434051457591803904</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{76b4a6e9-0d68-4da2-8fce-e0f5d40b8eb6}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67610</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>434051526311280640</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7463f439-74a2-48bf-b04f-3b95786d0a4c}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67611</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>73763487402164224</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f724fbc6-a3a5-4404-a1fe-6b043549c9dc}</filterKey>
<displayData>
<name>Allow incoming WSD to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67612</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>73763556121640960</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD</layerKey>
<displayData>
<name>ALE Receive/Accept v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="35">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>45</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e012d}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD</applicableLayer>
<calloutId>278</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<displayData>
<name>ALE Receive/Accept v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="39">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>46</layerId>
</layer>
<callouts numItems="7">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Initiate Secure v6 Layer Callout</name>
<description>Verifies that each incoming connection that is supposed to arrive secure arrives securely.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>14</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in TCP Chimney Offload ALE Receive/Accept v6 Layer Callout</name>
<description>Enables or disables TCP Chimney Offload for each incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>22</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v6 Layer Callout</name>
<description>Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>26</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in TCP Templates ALE Receive/Accept v6 Layer Callout</name>
<description>Applies TCP Template for each incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>36</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in Set Option ALE Receive/Accept v6 Layer Callout</name>
<description>Sets classify options on inbound flows.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>40</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_RECV_ACCEPT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in Policy Silent Mode ALE Receive/Accept v6 Layer Callout</name>
<description>Audit and log policy for incoming connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>44</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e022e}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Allows secondary connections.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
<calloutId>285</calloutId>
</item>
</callouts>
<filters numItems="57">
<item>
<filterKey>{84750a0c-b836-48e3-ab80-104985c857db}</filterKey>
<displayData>
<name>AppContainerBoottimeFilter</name>
<description>AppContainerBoottimeFilter</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65711</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b98b75dc-17c0-4e84-bd4e-2080527ca6a6}</filterKey>
<displayData>
<name>AppContainerBoottimeFilter</name>
<description>AppContainerBoottimeFilter</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65713</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b02a4013-b6b5-4859-9168-1e3299e43b24}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65736</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>34359738368</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{0593d9b7-8e2b-44b1-9f9e-2831da1c9bd9}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65738</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{8b50e2ec-7cf0-4b71-b42e-5b0536f6cab8}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65742</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1152921540040327168</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3180114b-8338-4740-9a16-444134ad62f4}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65744</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1152921540040327168</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{567d3836-3f5b-4067-b9c4-952f677010a2}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>58</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>135</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65746</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1153414085816090624</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3a90a266-1519-4d23-911b-e84cd0f02ab8}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>546</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>547</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65748</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1153417418710712320</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{70694559-714a-4a38-a0cd-51439e06f1d8}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>1</uint8>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>58</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>134</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>530079007300740065006d000000</data>
<asString>System</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>fe80::</byteArray16>
</valueLow>
<valueHigh>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>fe80:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65749</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1225472229609832448</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{93c8b706-6ea8-4770-849c-0f600e1da68c}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>8388608</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65933</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f94d665d-ecd0-49f7-a1c2-b44d59fd1259}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>16777216</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65935</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f50908db-0509-4b52-90a1-64183fb2d3ec}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4194304</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65937</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7c0e3462-4a76-43ad-86e6-85c258c0a02e}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65947</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e8efa035-3607-4526-b509-4dff9cb16eb3}</filterKey>
<displayData>
<name>ET Default Block All</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65950</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{36976114-f3bb-4b0c-83d5-cc4ec87b2e84}</filterKey>
<displayData>
<name>ET Allow All</name>
<description/>
</displayData>
<flags/>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65951</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{efd42055-2e95-4ecd-9c25-e1686c3a5d5c}</filterKey>
<displayData>
<name>ET ICMPV6 NA - Permit</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>530079007300740065006d000000</data>
<asString>System</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>136</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>58</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65958</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{0e549565-6f4e-480f-9809-3a51e44655d9}</filterKey>
<displayData>
<name>ET ICMPV6 NS - Permit</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>530079007300740065006d000000</data>
<asString>System</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>135</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>58</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65959</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{51c1f05f-5496-4068-9f77-981ecc749546}</filterKey>
<displayData>
<name>Teredo socket option opt out block filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{131dfd38-ce06-4fa3-ab8a-f84f62ac84d5}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{7b6b11f6-cbb5-433c-ae06-6a4f0076e49e}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>131</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>14</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65960</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{139250d7-7c22-4840-9d82-ea5f8e96c6ad}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>6755399457832960</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65983</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1125934266581024</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{c1092084-db12-4ece-91af-cc70b90721a3}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>0</uint8>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT64</type>
<uint64>6755399457832960</uint64>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65984</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>1125934266581024</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1121d831-0154-4d89-8bc4-2f5265b14832}</filterKey>
<displayData>
<name>Block Inbound Default Rule</name>
<description>Block Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67370</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{06c0d623-daf6-4374-8c95-2575a648b544}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to CDPSvc port 5050</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9a02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5050</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67378</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{008f131f-556a-459d-aedf-a6fe18bb6602}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5160</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67388</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{cb792cb2-cd30-4803-8091-66fdc568511e}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5040</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5040</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67392</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e968a6eb-3a9c-4f95-b069-d70147dcddd0}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>68</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>67</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67396</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>496704377847808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{aad1f5ea-b28b-4cbd-816d-a8f61acde344}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>546</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>547</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67398</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>496704377847808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{61065fc1-f566-4c03-88b5-5c61874a884c}</filterKey>
<displayData>
<name>Allow RPC/TCP traffic to EventLog</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67404</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423054278656000</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b7a3d53c-c935-4c00-9773-6410b460be4e}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to fdphost port 3702</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67406</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{06299b7c-943f-429a-99cb-d5f2d9d1ab43}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to fdphost port 1900</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>aa02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>1900</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67410</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{add4c54f-b2be-43ee-9b60-f1b89fae508d}</filterKey>
<displayData>
<name>Allow Grouping to receive from port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ad02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67416</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7da0ab5f-7ade-4195-91cd-eb3fc150ded7}</filterKey>
<displayData>
<name>Allow PNRP to receive from port 3540</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ae02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3540</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67418</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{cfe5b7fd-860e-4906-b10d-6673610e1c54}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening - Block incoming TCP traffic</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67428</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>422762220879872</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{385574dd-c2a0-4d8f-9759-cb1a8e788503}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67432</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493130965057536</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2cc647af-42d3-423c-8435-5b4a386515a7}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23555</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67433</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493130965057536</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{56ce6c5c-43a0-4e83-9f86-3fe31ac28007}</filterKey>
<displayData>
<name>Cast to Device streaming server hardening rules for RTSP</name>
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\mdeserver.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>23556</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67434</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493130965057536</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ea5ee07a-193f-462a-b370-a9babef4edd8}</filterKey>
<displayData>
<name>Allow inbound TCP traffic to AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>9955</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67436</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{aaf38099-868d-42f2-8fb1-990654548555}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67438</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{40218195-c4b2-463b-9f74-8685acb18b98}</filterKey>
<displayData>
<name>Allow Grouping to receive from port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67444</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ab00f66b-e20e-4e31-a11c-967fa2fb197d}</filterKey>
<displayData>
<name>Allow PNRP to send to port 3540</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bb02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3540</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67448</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{98185aff-ae7e-45ee-b3b3-c86a7b2c953e}</filterKey>
<displayData>
<name>IPsec Policy Agent service hardening - Remote Management</name>
<description>Allow IPsec Policy Agent inbound RPC/TCP traffic for Remote Management</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>be02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67454</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423054278656000</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{dc663daf-cf38-43e7-abda-2f384fa4d55a}</filterKey>
<displayData>
<name>Block all inbound traffic to SearchFilterHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bf02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchfilterhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67456</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f226eb59-2489-4fe1-a2fa-e4057ebea9c2}</filterKey>
<displayData>
<name>Allow inbound traffic to SearchProtocolHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchprotocolhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67462</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{29e6a362-4f0d-4eae-b5cc-4ec25fe8511a}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to SNMPTRAP service</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006e006d00700074007200610070002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\snmptrap.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67466</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{775c804a-fe58-4de3-b407-42e2e1a349a9}</filterKey>
<displayData>
<name>Allow all inbound TCP and RPC to SPPEXTCOMOBJ</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\sppextcomobj.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67468</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e60c427d-02c2-41fd-8728-e1823bea826d}</filterKey>
<displayData>
<name>TermServiceLOM</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67473</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ba7869aa-36fe-44bb-842d-534ce08088f2}</filterKey>
<displayData>
<name>TermServiceLOM</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6</filterType>
</action>
<providerContextKey>{54144fae-35d1-47ea-b03c-c8817abdc485}</providerContextKey>
<reserved/>
<filterId>67474</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{14c98b28-1f15-4e17-8e00-441d5e000eb2}</filterKey>
<displayData>
<name>Allow incoming RPC traffic to VDS</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007600640073002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\vds.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67476</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423054278656000</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{58e23952-927d-49b0-a381-7c37630dd491}</filterKey>
<displayData>
<name>Allow inbound TCP port 389 traffic for vmicheartbeat</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>389</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67478</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2cb35df3-3507-42f6-bfef-80dcece0e16e}</filterKey>
<displayData>
<name>Allow inbound TCP port 636 traffic for vmicheartbeat</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ca02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>636</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67480</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{88e0210c-d5e3-4fb3-b9b4-f966d71be136}</filterKey>
<displayData>
<name>Allow inbound UDP traffic to NTP port 123</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>cc02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>123</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67484</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a44c86b7-eec1-4ba9-8f3b-fef0e511c566}</filterKey>
<displayData>
<name>Allow inbound RPC traffic to the Block Level Backup service (wbengine) over TCP</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ce02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007700620065006e00670069006e0065002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\wbengine.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67488</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423054278656000</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{c9c243e4-38d3-42b5-9ecd-3e7b9f720ecc}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67507</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{621e2a09-1bc6-4299-a024-70a58edfaf30}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>8554</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67508</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>493405842964480</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{624b1865-f4c9-47fe-8868-1edf21d4993a}</filterKey>
<displayData>
<name>Windows Media Player Network Sharing Service service hardening - Block any other incoming TCP traffic</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows media player\wmpnetwk.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67510</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{bf497f8e-908a-4160-81b4-b22400b94f57}</filterKey>
<displayData>
<name>Allow incoming TCP to PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67512</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>423037098786816</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b732e7a2-e3f4-441a-8aaf-ae7ff2b67391}</filterKey>
<displayData>
<name>WSH Default Inbound Block</name>
<description>Blocks all inbound traffic for services who have been network hardened</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)(A;NP;CC;;;S-1-5-80-4028305664-2774326660-44957573-2454826285-2129126537)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-957450137-3151016590-2548878560-3726258338-3930544608)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67537</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>274877906944</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{dacd0dc2-7d8a-48d5-b362-1ecfe8ebfd9e}</filterKey>
<displayData>
<name>InternetClientServer Inbound Default Rule</name>
<description>InternetClientServer Inbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ec02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>::</byteArray16>
</valueLow>
<valueHigh>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67588</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>824633728896</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD</layerKey>
<displayData>
<name>ALE Receive/Accept v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="35">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>47</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e012f}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD</applicableLayer>
<calloutId>279</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<displayData>
<name>ALE Connect v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="41">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_EFFECTIVE_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>48</layerId>
</layer>
<callouts numItems="7">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_ALE_CONNECT_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec ALE Connect v4 Layer Callout</name>
<description>Applies IPsec policy modifiers to client applications.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>15</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in TCP Chimney Offload ALE Connect v4 Layer Callout</name>
<description>Enables or disables TCP Chimney Offload for each outgoing connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>19</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in Set Option ALE Connect v4 Layer Callout</name>
<description>Sets classify options on outbound flows.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>23</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in TCP Templates ALE Connect v4 Layer Callout</name>
<description>Applies TCP Template for each outgoing connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>33</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in Reserved callout</name>
<description>WFP Built-in Reserved callout</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>37</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_CONNECT_LAYER_V4</calloutKey>
<displayData>
<name>WFP Built-in Policy Silent Mode ALE Connect v4 Layer Callout</name>
<description>Audit and log policy for outgoing connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>41</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0230}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Allows secondary connections.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
<calloutId>282</calloutId>
</item>
</callouts>
<filters numItems="65">
<item>
<filterKey>{082edf36-12d7-4698-858a-cf274b78d09a}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65741</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{fa8635e6-fa79-4019-aeeb-9122dbec91c2}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65938</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{781067e8-7937-4fb7-97e0-7b7b2d966562}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>137</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65940</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{6cdef8f6-db3a-4563-8693-3b0c5dbc46f2}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>D:(A;NP;CC;;;WD)(A;NP;CC;;;AN)(A;NP;CC;;;S-1-15-3-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4256926629-1688279915-2739229046-3928706915)(A;NP;CC;;;S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4256926629-1688279915-2739229046-3928706915)(A;NP;CC;;;S-1-15-3-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4043415302-551583165-304772019-4009825106)(A;NP;CC;;;S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4043415302-551583165-304772019-4009825106)S:NO_ACCESS_CONTROL</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V4</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65942</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2beb431a-5568-403a-a816-0499f5363a6c}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(XA;;CC;;;WD;(Exists WP://SKUID))</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V4</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65944</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{22d836a8-5c2b-4626-8e73-0834eb63f738}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65948</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{54c9ad17-5c71-454a-b0b0-27f8f8789f7f}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>8</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67346</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>9223372036854792064</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e3d2e765-e6b0-4e54-98d4-6be7a89edfd4}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>3</uint8>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67350</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>3458764513820540928</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d913b1ae-6a69-47b3-ae50-6227edfb2180}</filterKey>
<displayData>
<name>Block Outbound Default Rule</name>
<description>Block Outbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67371</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b633bf1c-65ae-4644-bf5a-5f9267dfaf3b}</filterKey>
<displayData>
<name>AxInstSV TCP outbound allow</name>
<description>Allow only outbound TCP traffic from AxInstSV</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>80</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67373</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{38e692a8-be53-4c84-a7a8-247ba9801724}</filterKey>
<displayData>
<name>AxInstSV TCP outbound allow</name>
<description>Allow only outbound TCP traffic from AxInstSV</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>443</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67374</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d5ca90a8-e087-4bee-968e-3bfd4ff2561a}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from CDPSvc from any port to port 5040</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9b02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5040</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67379</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{46f1b4b1-621e-4e8d-8615-578be0bccb8b}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from any port to CDPSvc port 5050</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9c02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5050</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67381</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{38d6d06b-7a96-4e50-93c3-dbf81f846d8c}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from CDPSvc port 5050</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9d02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5050</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67383</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>985987052208128</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{0ea24f57-5231-4626-b04f-2621eb056e3c}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from CDPSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9e02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67385</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4c6e69d1-0a9d-4a1f-abcf-b6ff1c91803c}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5160</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67389</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1e089297-979e-4973-bdca-d92d64d67180}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>68</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>67</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67393</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>993683633602560</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9da5441b-e247-447d-985f-f2fc1e8f13b0}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>546</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>547</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67399</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>993683633602560</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e1db7bbc-0ce5-42d7-a31b-77bbaca20874}</filterKey>
<displayData>
<name>Device Metadata Retrieval</name>
<description>Allow dmrc communication with WMIS</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-286057374-2594772386-1471686342-3682429118-820474675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>80</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67401</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{efe8892b-31b0-40c2-8701-325a5f47d8f9}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from fdphost port 3702</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67407</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f2925fb1-650f-4a16-b72b-4294a8d9e0f5}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from fdphost port 1900</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ab02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>1900</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67411</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{8a8aa21d-8df5-49b9-be02-19d0b70adaa4}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from fdphost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ac02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67413</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2118fa06-5df5-4e70-94c9-3d0987eacc89}</filterKey>
<displayData>
<name>Allow Grouping to send to port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>af02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67419</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{547919af-0063-4d62-9f46-d82512279404}</filterKey>
<displayData>
<name>Allow PNRP to send from port 3540</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3540</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67421</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{770f483b-075c-4397-be1b-eecc0db9fc8a}</filterKey>
<displayData>
<name>NetBIOSHelperFirewallPolicy</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>53</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67423</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{90912539-b564-44ce-a338-b55589fc79b0}</filterKey>
<displayData>
<name>NetBIOSHelperFirewallPolicy</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>53</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67425</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{183acaa8-b8f9-48b7-8e57-7059eb6ae8e0}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67439</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a36e7dca-0bd5-4365-a814-07b1a380f028}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67441</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f55d560a-aa2f-4835-8d45-6e9abbe22a5b}</filterKey>
<displayData>
<name>Allow Grouping to send to port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ba02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67445</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{0e58e0b6-dbe4-4c11-afa3-8611565375a1}</filterKey>
<displayData>
<name>IPsec Policy Agent service hardening - LDAP/TCP</name>
<description>Allow IPsec Policy Agent outbound LDAP/TCP traffic to Active Directory</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bc02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>389</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67449</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2e61f0df-9caf-4b37-959f-5eb28b50187b}</filterKey>
<displayData>
<name>IPsec Policy Agent service hardening - LDAP/UDP</name>
<description>Allow IPsec Policy Agent outbound LDAP/UDP traffic to Active Directory</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bd02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>389</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67451</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7d9e3de4-05ee-4d30-8809-823344bb2c0c}</filterKey>
<displayData>
<name>Block all outbound traffic from SearchFilterHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchfilterhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67457</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e8e419d9-b4c0-45f6-88de-e60619ccb774}</filterKey>
<displayData>
<name>Allow outbound LDAP traffic from SearchIndexer</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006500610072006300680069006e00640065007800650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchindexer.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>389</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67459</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{39cb4aa3-c637-4af9-82f6-9522bdab193d}</filterKey>
<displayData>
<name>Allow outbound traffic from SearchProtocolHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchprotocolhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67463</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>549755813888</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e41f429b-73ee-4946-bef6-d1551e477b48}</filterKey>
<displayData>
<name>Allow all outbound TCP and RPC from SPPEXTCOMOBJ</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\sppextcomobj.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67469</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d565ffc4-cc90-4f25-a175-ace8ebf0e77f}</filterKey>
<displayData>
<name>Allow outbound TCP traffic for vmicheartbeat</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>cb02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67481</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1632a98f-cfaa-4428-92dd-f2697f512a2d}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from local NTP port 123</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>cd02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>123</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67485</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>985987052208128</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a08ccb6d-b07c-4254-9262-84f8f67e019d}</filterKey>
<displayData>
<name>Allow NTP traffic from Wcmsvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>cf02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>123</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67489</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{41fd4a94-1d21-4b11-a91b-3ad25c527ad9}</filterKey>
<displayData>
<name>Allow Out TCP traffic from WinDefend</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f0077007300200064006500660065006e006400650072005c006d0073006d00700065006e0067002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows defender\msmpeng.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67491</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9bfc6ceb-8dbf-40b5-99b5-f083bdf94257}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from WinHttpAutoProxySvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67493</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4dc80957-f1b4-4f0c-98eb-ce884a298e15}</filterKey>
<displayData>
<name>Allow TCP traffic from lpasvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>443</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67503</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1a8b23c0-dcb2-4714-a5c4-c81e454d88cc}</filterKey>
<displayData>
<name>Allow outgoing TCP from PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67513</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d82b6901-3b64-45af-96e0-377114ecd84d}</filterKey>
<displayData>
<name>WinDefend Outbound for HTTPS</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>dd02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d0064006100740061005c006d006900630072006f0073006f00660074005c00770069006e0064006f0077007300200064006500660065006e006400650072005c0070006c006100740066006f0072006d005c0034002e00310032002e00310037003000300037002e00310038003000310031002d0030005c006d0073006d00700065006e0067002e006500780065000000</data>
<asString>\device\harddiskvolume2\programdata\microsoft\windows defender\platform\4.12.17007.18011-0\msmpeng.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>443</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67531</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>852946145247232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{dc616562-0540-4775-a754-37e919cae16e}</filterKey>
<displayData>
<name>WinDefend Outbound for TCP</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>de02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d0064006100740061005c006d006900630072006f0073006f00660074005c00770069006e0064006f0077007300200064006500660065006e006400650072005c0070006c006100740066006f0072006d005c0034002e00310038002e0031003800300039002e0032002d0030005c006d0073006d00700065006e0067002e006500780065000000</data>
<asString>\device\harddiskvolume2\programdata\microsoft\windows defender\platform\4.18.1809.2-0\msmpeng.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67533</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>845249563852800</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ad75ba67-0272-4ff5-a3a8-849ac40a0357}</filterKey>
<displayData>
<name>WSH Default Outbound Block</name>
<description>Blocks all outbound traffic for services who have been network hardened</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)(A;NP;CC;;;S-1-5-80-4028305664-2774326660-44957573-2454826285-2129126537)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-957450137-3151016590-2548878560-3726258338-3930544608)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67540</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>274877906944</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{0fbb6f9a-1917-41cc-8502-5531b193de64}</filterKey>
<displayData>
<name>PrivateNetwork Outbound Default Rule</name>
<description>PrivateNetwork Outbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>eb02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67583</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>216173606747520896</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{66b27d60-455f-4a61-98fd-d8616dfef709}</filterKey>
<displayData>
<name>PrivateNetwork Outbound Default Rule</name>
<description>PrivateNetwork Outbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>eb02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67584</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>36029621652701056</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3fe69772-bfa4-4b1a-9d96-dc4a2ee51deb}</filterKey>
<displayData>
<name>InternetClientServer Outbound Default Rule</name>
<description>InternetClientServer Outbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ed02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>0.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67589</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>4504424261107584</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4d05bb38-c465-4735-8d30-d3714b4a9787}</filterKey>
<displayData>
<name>InternetClientServer Outbound Default Rule</name>
<description>InternetClientServer Outbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ed02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67590</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>27022422397960064</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e290c822-2490-4083-971d-57bc3402f608}</filterKey>
<displayData>
<name>InternetClientServer Outbound Default Rule</name>
<description>InternetClientServer Outbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ed02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>255.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67591</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>36029621652701056</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1a63aa69-b8fc-4f2d-964e-1e8dc313b68b}</filterKey>
<displayData>
<name>InternetClient Default Rule</name>
<description>InternetClient Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ee02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>0.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67593</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>4504424261107584</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{56eac3c3-e5d5-4599-8770-c0de337bc6f0}</filterKey>
<displayData>
<name>InternetClient Default Rule</name>
<description>InternetClient Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ee02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67594</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>27022422397960064</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7f51449d-6002-4068-aafb-a6e6abc27aea}</filterKey>
<displayData>
<name>InternetClient Default Rule</name>
<description>InternetClient Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ee02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>255.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67595</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>36029621652701056</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ae91a38f-9b1b-49c9-8391-7a739b33ca9a}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-Out)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67601</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>217166470042353664</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7e9ee782-3678-4d2b-8799-777f2cac0d13}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-Out)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="8">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67602</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>217166607481307136</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{dbe3d69a-479e-46d4-92d6-65ce80e996cb}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-Out)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67603</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>37022484947533824</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1ba482a6-e94a-4467-a8df-e0c7c2d455d5}</filterKey>
<displayData>
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-Out)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="8">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>7235</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67604</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>37022622386487296</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{c1e24a1a-0082-47ad-849d-e170d68d885d}</filterKey>
<displayData>
<name>Allow outgoing WSD from PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67613</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>217158773460959232</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f58fc5f5-2df7-46ca-87bc-242575ab074a}</filterKey>
<displayData>
<name>Allow outgoing WSD from PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67614</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>217158910899912704</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{159d8a4d-2382-4ba0-a5e7-1bebbaefea53}</filterKey>
<displayData>
<name>Allow outgoing WSD from PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67615</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>37014788366139392</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{eff8a40d-cc56-4b9b-b3a9-ab38f942e9b1}</filterKey>
<displayData>
<name>Allow outgoing WSD from PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67616</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>37014925805092864</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{bf70de39-0f0c-4017-8676-2578cde9365c}</filterKey>
<displayData>
<name>Allow outgoing WSD from PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67617</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>217025732553998336</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{86691230-17cb-48c2-8efa-ef46dd9b6972}</filterKey>
<displayData>
<name>Allow outgoing WSD from PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>192.168.64.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>192.168.64.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67618</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>217025869992951808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b0ec86fd-e687-4255-b32d-a845b16e7c0b}</filterKey>
<displayData>
<name>Allow outgoing WSD from PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="6">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67619</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>36881747459178496</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{aaadf4e7-81ed-4b25-bc24-a906e07a61d2}</filterKey>
<displayData>
<name>Allow outgoing WSD from PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>f402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="7">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_UINT32</type>
<uint32>224.0.0.0</uint32>
</valueLow>
<valueHigh>
<type>FWP_UINT32</type>
<uint32>239.255.255.255</uint32>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>4</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67620</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>36881884898131968</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD</layerKey>
<displayData>
<name>ALE Connect v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="37">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_EFFECTIVE_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>49</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0131}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD</applicableLayer>
<calloutId>274</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<displayData>
<name>ALE Connect v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="41">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_EFFECTIVE_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>50</layerId>
</layer>
<callouts numItems="7">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_ALE_CONNECT_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec ALE Connect v6 Layer Callout</name>
<description>Applies IPsec policy modifiers to client applications.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
<calloutId>16</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in TCP Chimney Offload ALE Connect v6 Layer Callout</name>
<description>Enables or disables TCP Chimney Offload for each outgoing connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
<calloutId>20</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in Set Option ALE Connect v6 Layer Callout</name>
<description>Sets classify options on outbound flows.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
<calloutId>24</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in TCP Templates ALE Connect v6 Layer Callout</name>
<description>Applies TCP Template for each outgoing connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
<calloutId>34</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in Reserved callout</name>
<description>WFP Built-in Reserved callout</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
<calloutId>38</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_CONNECT_LAYER_V6</calloutKey>
<displayData>
<name>WFP Built-in Policy Silent Mode ALE Connect v6 Layer Callout</name>
<description>Audit and log policy for outgoing connection.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
<calloutId>42</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0232}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Allows secondary connections.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
<calloutId>283</calloutId>
</item>
</callouts>
<filters numItems="47">
<item>
<filterKey>{15d327cf-89c3-4032-9ded-774ae6b0b49f}</filterKey>
<displayData>
<name>Interface Un-quarantine filter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65740</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9121aaef-82b1-4840-a952-9d2bc3f3c975}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65939</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3c7471a8-0862-4676-b1e5-02561682398c}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>137</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65941</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{777e0157-3235-447a-8f91-e67357fb71f1}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>D:(A;NP;CC;;;WD)(A;NP;CC;;;AN)(A;NP;CC;;;S-1-15-3-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4256926629-1688279915-2739229046-3928706915)(A;NP;CC;;;S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4256926629-1688279915-2739229046-3928706915)(A;NP;CC;;;S-1-15-3-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4043415302-551583165-304772019-4009825106)(A;NP;CC;;;S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-4043415302-551583165-304772019-4009825106)S:NO_ACCESS_CONTROL</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V6</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65943</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{8373aa47-cdd0-4038-bfa2-6f632a0349af}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(XA;;CC;;;WD;(Exists WP://SKUID))</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V6</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65945</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551615</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9a1c79e9-aa3d-426c-a285-0f657cfc5431}</filterKey>
<displayData>
<name>AppContainerLoopback</name>
<description>AppContainerLoopback</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>ffffffffffffffff</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65949</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>18446744073709551614</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{64b4e8d1-f7fd-4639-b075-b07129c4b089}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>8</uint8>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67348</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>9223372036854783872</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3e04dc5c-0550-40fd-859e-3ca12ccbad6e}</filterKey>
<displayData>
<name>Default Outbound</name>
<description>Default Outbound</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData>
<data>8f02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<weight>
<type>FWP_UINT8</type>
<uint8>3</uint8>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67352</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>3458764513820540928</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7719e7e4-4895-47d5-9dc8-b287b63bf43a}</filterKey>
<displayData>
<name>Block Outbound Default Rule</name>
<description>Block Outbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67372</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>137438953472</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{0148a814-d539-4bb1-8a27-6d2f8bd89027}</filterKey>
<displayData>
<name>AxInstSV TCP outbound allow</name>
<description>Allow only outbound TCP traffic from AxInstSV</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>80</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67375</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4ab8f7ca-c947-467d-b92f-4195141358ac}</filterKey>
<displayData>
<name>AxInstSV TCP outbound allow</name>
<description>Allow only outbound TCP traffic from AxInstSV</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>443</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67376</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ba13b2ba-86a6-47d9-9b3d-cb3fe3c3ad16}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from CDPSvc from any port to port 5040</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9b02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5040</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67380</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{13215412-4837-4af3-8efb-091e1af5435a}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from any port to CDPSvc port 5050</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9c02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5050</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67382</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1f30213f-b9f6-4bd7-8a5d-903db5ed18bf}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from CDPSvc port 5050</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9d02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5050</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67384</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>246496763052032</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{b256b077-b2d6-44b0-aa0b-498061eb9ce9}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from CDPSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>9e02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67386</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>211312390963200</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{df72a0c9-8ca8-4d42-98a5-6fa0f972d351}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>5160</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67390</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{c7ecaeb3-a3d6-408a-9818-1576cfc489fe}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>68</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>67</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67394</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>248420908400640</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a4119abd-084f-430d-9a7f-6f7d928e2a24}</filterKey>
<displayData>
<name>DhcpFirewallPolicy</name>
<description>DhcpFirewallPolicy</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a502000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>546</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>547</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67400</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>248420908400640</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{7854bee0-bc81-4ab9-8b3c-d02c719e9f84}</filterKey>
<displayData>
<name>Device Metadata Retrieval</name>
<description>Allow dmrc communication with WMIS</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-286057374-2594772386-1471686342-3682429118-820474675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>80</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67402</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{6422f164-5a48-42ae-b2bb-23bc0920a751}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from fdphost port 3702</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>a902000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3702</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67408</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d58ba683-1150-412c-868c-4ba9ca56a721}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from fdphost port 1900</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ab02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>1900</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67412</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9d580b5d-e9e7-4fed-bf9c-3befc7d5bdcb}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from fdphost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ac02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67414</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>211312390963200</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a32e363c-467e-4352-b324-17606d93cabe}</filterKey>
<displayData>
<name>Allow Grouping to send to port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>af02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67420</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{3dec0d2b-24b3-4022-bb19-bacffaf8b43e}</filterKey>
<displayData>
<name>Allow PNRP to send from port 3540</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3540</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67422</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{94927170-cd17-4569-acd0-8f486ce2390b}</filterKey>
<displayData>
<name>NetBIOSHelperFirewallPolicy</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>53</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67424</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{6932f72b-7beb-4d3b-941e-8e36bf741e8c}</filterKey>
<displayData>
<name>NetBIOSHelperFirewallPolicy</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b202000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>53</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67426</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{275c1534-27cf-45d5-8d2a-71aba3d59059}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b702000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67440</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>211312390963200</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{5af7f6d0-1caf-4524-9160-11bd5c627ca0}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from AJRouter</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>b802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67442</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>211312390963200</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{6e539e6c-424f-40c9-af12-1354c0a0b372}</filterKey>
<displayData>
<name>Allow Grouping to send to port 3587</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ba02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>3587</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67446</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{d0fbaa07-721c-4d6e-a184-ced57203a3f9}</filterKey>
<displayData>
<name>IPsec Policy Agent service hardening - LDAP/TCP</name>
<description>Allow IPsec Policy Agent outbound LDAP/TCP traffic to Active Directory</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bc02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>389</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67450</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{bb833bf7-27f2-45d7-bdd1-df5c79258935}</filterKey>
<displayData>
<name>IPsec Policy Agent service hardening - LDAP/UDP</name>
<description>Allow IPsec Policy Agent outbound LDAP/UDP traffic to Active Directory</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>bd02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>389</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67452</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1d5f536c-477b-48c5-bfd1-27c8dc1b9f30}</filterKey>
<displayData>
<name>Block all outbound traffic from SearchFilterHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchfilterhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67458</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>137438953472</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{f3fd1e3c-e06c-499a-ad17-9b07610ff0ab}</filterKey>
<displayData>
<name>Allow outbound LDAP traffic from SearchIndexer</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006500610072006300680069006e00640065007800650072002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchindexer.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>389</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67460</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e123dad7-153d-47b9-8190-8f206a6c3cac}</filterKey>
<displayData>
<name>Allow outbound traffic from SearchProtocolHost</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c302000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\searchprotocolhost.exe</asString>
</byteBlob>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67464</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>137438953472</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{067b6f09-62fe-4bd7-8712-545fb418d380}</filterKey>
<displayData>
<name>Allow all outbound TCP and RPC from SPPEXTCOMOBJ</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>c602000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\sppextcomobj.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67470</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>211312390963200</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{870bb059-ca3a-471f-9016-0017c9a2e94d}</filterKey>
<displayData>
<name>Allow outbound TCP traffic for vmicheartbeat</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>cb02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67482</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>211312390963200</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1d1be196-ad8e-4693-8683-33baf592ad5d}</filterKey>
<displayData>
<name>Allow outbound UDP traffic from local NTP port 123</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>cd02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>123</uint16>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67486</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>246496763052032</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{2d1b7ab8-7e4a-409a-a230-7bb692179cbd}</filterKey>
<displayData>
<name>Allow NTP traffic from Wcmsvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>cf02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>17</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>123</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67490</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{48b3807f-f3ba-417a-8dbb-5237097e48e3}</filterKey>
<displayData>
<name>Allow Out TCP traffic from WinDefend</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d002000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f0077007300200064006500660065006e006400650072005c006d0073006d00700065006e0067002e006500780065000000</data>
<asString>\device\harddiskvolume2\program files\windows defender\msmpeng.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67492</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>211312390963200</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ce643110-8d76-49bf-a67c-8cb5502e3378}</filterKey>
<displayData>
<name>Allow outbound TCP traffic from WinHttpAutoProxySvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d102000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67494</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>211312390963200</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{e6a2e4fb-111a-4e1a-a2e1-7cad26b58849}</filterKey>
<displayData>
<name>Allow TCP traffic from lpasvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d402000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>443</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67504</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{ac484b2a-ff68-4f9c-9e0f-501fcf665ef4}</filterKey>
<displayData>
<name>Allow outgoing TCP from PeerDistSvc</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>d802000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
<asString>\device\harddiskvolume2\windows\system32\svchost.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67514</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>211312390963200</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{98e5c33a-f7c7-4789-b59f-bf270cea5c54}</filterKey>
<displayData>
<name>WinDefend Outbound for HTTPS</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>dd02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="4">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d0064006100740061005c006d006900630072006f0073006f00660074005c00770069006e0064006f0077007300200064006500660065006e006400650072005c0070006c006100740066006f0072006d005c0034002e00310032002e00310037003000300037002e00310038003000310031002d0030005c006d0073006d00700065006e0067002e006500780065000000</data>
<asString>\device\harddiskvolume2\programdata\microsoft\windows defender\platform\4.12.17007.18011-0\msmpeng.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT16</type>
<uint16>443</uint16>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67532</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>213236536311808</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{9009f532-d466-4e85-8f09-7f174a983355}</filterKey>
<displayData>
<name>WinDefend Outbound for TCP</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_INDEXED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>de02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="3">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_BYTE_BLOB_TYPE</type>
<byteBlob>
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650032005c00700072006f006700720061006d0064006100740061005c006d006900630072006f0073006f00660074005c00770069006e0064006f0077007300200064006500660065006e006400650072005c0070006c006100740066006f0072006d005c0034002e00310038002e0031003800300039002e0032002d0030005c006d0073006d00700065006e0067002e006500780065000000</data>
<asString>\device\harddiskvolume2\programdata\microsoft\windows defender\platform\4.18.1809.2-0\msmpeng.exe</asString>
</byteBlob>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)</sd>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67534</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>211312390963200</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{353c94e2-01fc-498e-8ddf-8b8381c55cf7}</filterKey>
<displayData>
<name>WSH Default Outbound Block</name>
<description>Blocks all outbound traffic for services who have been network hardened</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811)(A;NP;CC;;;S-1-5-80-4028305664-2774326660-44957573-2454826285-2129126537)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-957450137-3151016590-2548878560-3726258338-3930544608)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_BLOCK</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67539</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>68719476736</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{1968f9ca-472c-409a-a286-5d96adc33ab3}</filterKey>
<displayData>
<name>InternetClientServer Outbound Default Rule</name>
<description>InternetClientServer Outbound Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ed02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>::</byteArray16>
</valueLow>
<valueHigh>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67592</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>206158438272</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{69dbbd7c-bae6-4123-bb5c-f89b0d9740ce}</filterKey>
<displayData>
<name>InternetClient Default Rule</name>
<description>InternetClient Default Rule</description>
</displayData>
<flags/>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData>
<data>ee02000000000000</data>
<asString>........</asString>
</providerData>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
<conditionValue>
<type>FWP_SID</type>
<sid>S-1-0-0</sid>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<matchType>FWP_MATCH_RANGE</matchType>
<conditionValue>
<type>FWP_RANGE_TYPE</type>
<rangeValue>
<valueLow>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>::</byteArray16>
</valueLow>
<valueHigh>
<type>FWP_BYTE_ARRAY16_TYPE</type>
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
</valueHigh>
</rangeValue>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>2</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
<sd>O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_PERMIT</type>
<filterType/>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>67596</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>206158438272</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD</layerKey>
<displayData>
<name>ALE Connect v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="37">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_EFFECTIVE_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>51</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0133}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD</applicableLayer>
<calloutId>275</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</layerKey>
<displayData>
<name>ALE Flow Established v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="24">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>52</layerId>
</layer>
<callouts numItems="4">
<item>
<calloutKey>{8e44982b-f477-11df-85ce-78e7d1810190}</calloutKey>
<displayData>
<name>NDU Flow Established V4 Callout</name>
<description>NDU Flow Established V4 Callout</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</applicableLayer>
<calloutId>262</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0134}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</applicableLayer>
<calloutId>280</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0334}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Initiates deep protocol inspection on the flow.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</applicableLayer>
<calloutId>286</calloutId>
</item>
<item>
<calloutKey>{f762e452-8bfd-47f6-9425-368d888b01dc}</calloutKey>
<displayData>
<name>windefend_flow_established_v4</name>
<description>windefend</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</applicableLayer>
<calloutId>292</calloutId>
</item>
</callouts>
<filters numItems="2">
<item>
<filterKey>{8e44982c-f477-11df-85ce-78e7d1810190}</filterKey>
<displayData>
<name>NDU Flow Established V4 SubLayer Filter</name>
<description>NDU Flow Established V4 SubLayer Filter</description>
</displayData>
<flags/>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</layerKey>
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>{8e44982b-f477-11df-85ce-78e7d1810190}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65750</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>32</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{a1dd6389-d3b1-4f46-9300-611216024728}</filterKey>
<displayData>
<name>windefend_flow_established_v4</name>
<description>windefend</description>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</layerKey>
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>{f762e452-8bfd-47f6-9425-368d888b01dc}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>66193</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>2130304040448</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD</layerKey>
<displayData>
<name>ALE Flow Established v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="20">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>53</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</layerKey>
<displayData>
<name>ALE Flow Established v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="24">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_BITMAP_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BITMAP_INDEX_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>54</layerId>
</layer>
<callouts numItems="4">
<item>
<calloutKey>{8e44982d-f477-11df-85ce-78e7d1810190}</calloutKey>
<displayData>
<name>NDU Flow Established V6 Callout</name>
<description>NDU Flow Established V6 Callout</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</applicableLayer>
<calloutId>263</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0136}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Performs logging.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</applicableLayer>
<calloutId>281</calloutId>
</item>
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0336}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Initiates deep protocol inspection on the flow.</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</applicableLayer>
<calloutId>287</calloutId>
</item>
<item>
<calloutKey>{31114833-2891-4edd-a8ec-2ff8549aa491}</calloutKey>
<displayData>
<name>windefend_flow_established_v6</name>
<description>windefend</description>
</displayData>
<flags numItems="1">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</applicableLayer>
<calloutId>293</calloutId>
</item>
</callouts>
<filters numItems="2">
<item>
<filterKey>{8e44982e-f477-11df-85ce-78e7d1810190}</filterKey>
<displayData>
<name>NDU Flow Established V6 SubLayer Filter</name>
<description>NDU Flow Established V6 SubLayer Filter</description>
</displayData>
<flags/>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</layerKey>
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="1">
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>{8e44982d-f477-11df-85ce-78e7d1810190}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65751</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>32</uint64>
</effectiveWeight>
</item>
<item>
<filterKey>{4994b7fe-47d8-4ac5-8fa8-77b203c5b640}</filterKey>
<displayData>
<name>windefend_flow_established_v6</name>
<description>windefend</description>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</layerKey>
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition numItems="2">
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT32</type>
<uint32>0</uint32>
</conditionValue>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<matchType>FWP_MATCH_EQUAL</matchType>
<conditionValue>
<type>FWP_UINT8</type>
<uint8>6</uint8>
</conditionValue>
</item>
</filterCondition>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>{31114833-2891-4edd-a8ec-2ff8549aa491}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>66194</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>128849149440</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD</layerKey>
<displayData>
<name>ALE Flow Established v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="20">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>55</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET</layerKey>
<displayData>
<name>Inbound Ethernet Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="12">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_MAC_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ETHER_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NDIS_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>56</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET</layerKey>
<displayData>
<name>Outbound Ethernet Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="12">
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_MAC_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ETHER_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NDIS_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>57</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE</layerKey>
<displayData>
<name>Inbound Native MAC Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_NDIS_MEDIA_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NDIS_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>58</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE</layerKey>
<displayData>
<name>Outbound Native MAC Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_NDIS_MEDIA_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NDIS_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>59</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_NAME_RESOLUTION_CACHE_V4</layerKey>
<displayData>
<name>Name Resolution Cache v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>60</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_NAME_RESOLUTION_CACHE_V6</layerKey>
<displayData>
<name>Name Resolution Cache v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="5">
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>61</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_RESOURCE_RELEASE_V4</layerKey>
<displayData>
<name>ALE Resource Release v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="11">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>62</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_RESOURCE_RELEASE_V6</layerKey>
<displayData>
<name>ALE Resource Release v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="11">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>63</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4</layerKey>
<displayData>
<name>ALE Endpoint Closure v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="13">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>64</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V6</layerKey>
<displayData>
<name>ALE Endpoint Closure v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="13">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>65</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_CONNECT_REDIRECT_V4</layerKey>
<displayData>
<name>ALE Connect Redirect v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>66</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_CONNECT_REDIRECT_V6</layerKey>
<displayData>
<name>ALE Connect Redirect v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>67</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_BIND_REDIRECT_V4</layerKey>
<displayData>
<name>ALE Bind Redirect v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>68</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{8bc14e84-4287-4c9e-81da-532335532058}</calloutKey>
<displayData>
<name>Interface Binding Callout</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_BIND_REDIRECT_V4</applicableLayer>
<calloutId>258</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_BIND_REDIRECT_V6</layerKey>
<displayData>
<name>ALE Bind Redirect v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_SID</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>69</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{8bc14e84-4287-4c9e-81da-532335532059}</calloutKey>
<displayData>
<name>Interface Binding Callout</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_ALE_BIND_REDIRECT_V6</applicableLayer>
<calloutId>259</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_PACKET_V4</layerKey>
<displayData>
<name>Stream Packet v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="12">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>70</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_PACKET_V6</layerKey>
<displayData>
<name>Stream Packet v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="12">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>71</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INGRESS_VSWITCH_ETHERNET</layerKey>
<displayData>
<name>Ingress vSwitch Ethernet layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_MAC_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ETHER_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>72</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_EGRESS_VSWITCH_ETHERNET</layerKey>
<displayData>
<name>Egress vSwitch Ethernet layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="17">
<item>
<fieldKey>FWPM_CONDITION_MAC_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ETHER_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>73</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V4</layerKey>
<displayData>
<name>Ingress vSwitch Transport v4 layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>74</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V6</layerKey>
<displayData>
<name>Ingress vSwitch Transport v6 layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>75</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V4</layerKey>
<displayData>
<name>Egress vSwitch Transport v4 layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="17">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>76</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V6</layerKey>
<displayData>
<name>Egress vSwitch Transport v6 layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="17">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>77</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_FAST</layerKey>
<displayData>
<name>Inbound Transport v4 Layer fast</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field/>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>78</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{8e44982f-f477-11df-85ce-78e7d1810190}</calloutKey>
<displayData>
<name>NDU Inbound Transport Callout</name>
<description>NDU Inbound Transport Callout</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_FAST</applicableLayer>
<calloutId>264</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{8e449830-f477-11df-85ce-78e7d1810190}</filterKey>
<displayData>
<name>NDU Inbound Transport SubLayer Filter</name>
<description>NDU Inbound Transport SubLayer Filter</description>
</displayData>
<flags/>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_FAST</layerKey>
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>{8e44982f-f477-11df-85ce-78e7d1810190}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65752</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>576460752303423487</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_FAST</layerKey>
<displayData>
<name>Outbound Transport v4 Layer fast</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field/>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>79</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{8e449833-f477-11df-85ce-78e7d1810190}</calloutKey>
<displayData>
<name>NDU Outbound Transport Callout</name>
<description>NDU Outbound Transport Callout</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_FAST</applicableLayer>
<calloutId>265</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{8e449834-f477-11df-85ce-78e7d1810190}</filterKey>
<displayData>
<name>NDU Outbound Transport SubLayer Filter</name>
<description>NDU Outbound Transport SubLayer Filter</description>
</displayData>
<flags/>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_FAST</layerKey>
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>{8e449833-f477-11df-85ce-78e7d1810190}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65753</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>576460752303423487</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST</layerKey>
<displayData>
<name>Inbound Native MAC Layer fast</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field/>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>80</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{8e449837-f477-11df-85ce-78e7d1810190}</calloutKey>
<displayData>
<name>NDU Inbound Mac Frame Native Callout</name>
<description>NDU Inbound Mac Frame Native Callout</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>000000E0</item>
</flags>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST</applicableLayer>
<calloutId>266</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{8e449838-f477-11df-85ce-78e7d1810190}</filterKey>
<displayData>
<name>NDU Inbound Mac Frame Native SubLayer Filter</name>
<description>NDU Inbound Mac Frame Native SubLayer Filter</description>
</displayData>
<flags/>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST</layerKey>
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>{8e449837-f477-11df-85ce-78e7d1810190}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65754</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>576460752303423487</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST</layerKey>
<displayData>
<name>Outbound Native MAC Layer fast </name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field/>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>81</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>{8e449839-f477-11df-85ce-78e7d1810190}</calloutKey>
<displayData>
<name>NDU Outbound Mac Frame Native Callout</name>
<description>NDU Outbound Mac Frame Native Callout</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>000000E0</item>
</flags>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST</applicableLayer>
<calloutId>267</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{8e44983a-f477-11df-85ce-78e7d1810190}</filterKey>
<displayData>
<name>NDU Outbound Mac Frame Native SubLayer Filter</name>
<description>NDU Outbound Mac Frame Native SubLayer Filter</description>
</displayData>
<flags/>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<providerData/>
<layerKey>FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST</layerKey>
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
<filterType>{8e449839-f477-11df-85ce-78e7d1810190}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>65755</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>576460752303423487</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_PRECLASSIFY_IP_LOCAL_ADDRESS_V4</layerKey>
<displayData>
<name>@bfe.dll,-492</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="1">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>82</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_PRECLASSIFY_IP_REMOTE_ADDRESS_V4</layerKey>
<displayData>
<name>@bfe.dll,-493</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="1">
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>83</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_PRECLASSIFY_IP_LOCAL_PORT_V4</layerKey>
<displayData>
<name>@bfe.dll,-494</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="1">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>84</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_PRECLASSIFY_IP_REMOTE_PORT_V4</layerKey>
<displayData>
<name>@bfe.dll,-495</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="1">
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>85</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_PRECLASSIFY_IP_LOCAL_ADDRESS_V6</layerKey>
<displayData>
<name>@bfe.dll,-496</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="1">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>86</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_PRECLASSIFY_IP_REMOTE_ADDRESS_V6</layerKey>
<displayData>
<name>@bfe.dll,-497</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="1">
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>87</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_PRECLASSIFY_IP_LOCAL_PORT_V6</layerKey>
<displayData>
<name>@bfe.dll,-498</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="1">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>88</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_ALE_PRECLASSIFY_IP_REMOTE_PORT_V6</layerKey>
<displayData>
<name>@bfe.dll,-499</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="1">
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>89</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_RESERVED2</layerKey>
<displayData>
<name>Inbound HTTP Reserved Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="13">
<item>
<fieldKey>FWPM_CONDITION_RESERVED0</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED1</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED2</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED3</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED4</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED5</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED6</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED7</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED8</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED9</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED10</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED11</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RESERVED12</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>90</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPSEC_KM_DEMUX_V4</layerKey>
<displayData>
<name>IPsec KM Demux v4 Layer</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
</flags>
<field numItems="6">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_QM_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>91</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPSEC_KM_DEMUX_V6</layerKey>
<displayData>
<name>IPsec KM Demux v6 Layer</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
</flags>
<field numItems="6">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_QM_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>92</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPSEC_V4</layerKey>
<displayData>
<name>IPsec v4 Layer</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>93</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPSEC_V6</layerKey>
<displayData>
<name>IPsec v6 Layer</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>94</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IKEEXT_V4</layerKey>
<displayData>
<name>IKE v4 Layer</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="5">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>95</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IKEEXT_V6</layerKey>
<displayData>
<name>IKE v6 Layer</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="5">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>96</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_RPC_UM</layerKey>
<displayData>
<name>RPC UM Layer</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="17">
<item>
<fieldKey>FWPM_CONDITION_REMOTE_USER_TOKEN</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_IF_UUID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_IF_VERSION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_IF_FLAG</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DCOM_APP_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IMAGE_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_AUTH_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_AUTH_LEVEL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SEC_KEY_SIZE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_V4</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_V6</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_PIPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS_V4</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS_V6</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>97</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_RPC_EPMAP</layerKey>
<displayData>
<name>RPC EPMAP Layer</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_REMOTE_USER_TOKEN</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_IF_UUID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_IF_VERSION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_AUTH_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_AUTH_LEVEL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SEC_KEY_SIZE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_V4</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_V6</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_PIPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS_V4</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS_V6</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>98</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_RPC_EP_ADD</layerKey>
<displayData>
<name>RPC EP ADD Layer</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
</flags>
<field numItems="4">
<item>
<fieldKey>FWPM_CONDITION_PROCESS_WITH_RPC_IF_UUID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_EP_VALUE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_EP_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>99</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_RPC_PROXY_CONN</layerKey>
<displayData>
<name>RPC Proxy Connect Layer</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="6">
<item>
<fieldKey>FWPM_CONDITION_CLIENT_TOKEN</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_SERVER_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_SERVER_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_PROXY_AUTH_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CLIENT_CERT_OID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>100</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_RPC_PROXY_IF</layerKey>
<displayData>
<name>RPC Proxy Interface Layer</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_CLIENT_TOKEN</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_IF_UUID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_IF_VERSION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_SERVER_NAME</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_SERVER_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_RPC_PROXY_AUTH_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CLIENT_CERT_OID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>101</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_KM_AUTHORIZATION</layerKey>
<displayData>
<name>Keying Module Authorization Layer</name>
<description/>
</displayData>
<flags numItems="2">
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="7">
<item>
<fieldKey>FWPM_CONDITION_REMOTE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_TOKEN_INFORMATION_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_AUTHENTICATION_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_KM_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_KM_MODE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_POLICY_KEY</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_KM_AUTH_NAP_CONTEXT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>102</layerId>
</layer>
<callouts/>
<filters/>
</item>
</layers>
<providers numItems="11">
<item>
<providerKey>FWPM_PROVIDER_IKEEXT</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Microsoft Windows WFP Built-in IKEEXT provider used to identify filters added by IKE/AuthIP.</description>
</displayData>
<flags/>
<providerData/>
<serviceName>IKEEXT</serviceName>
</item>
<item>
<providerKey>{aa6a7d87-7f8f-4d2a-be53-fda555cd5fe3}</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Microsoft Windows IPsec Policy Agent</description>
</displayData>
<flags numItems="2">
<item>FWPM_PROVIDER_FLAG_PERSISTENT</item>
<item>FWPM_PROVIDER_FLAG_DISABLED</item>
</flags>
<providerData/>
<serviceName>Policyagent</serviceName>
</item>
<item>
<providerKey>FWPM_PROVIDER_TCP_CHIMNEY_OFFLOAD</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Microsoft Windows WFP Built-in TCP Chimney Offload provider used to identify filters added by TCP Chimney Offload.</description>
</displayData>
<flags/>
<providerData/>
<serviceName/>
</item>
<item>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Microsoft Windows Defender Firewall Provider</description>
</displayData>
<flags numItems="1">
<item>FWPM_PROVIDER_FLAG_PERSISTENT</item>
</flags>
<providerData/>
<serviceName>mpssvc</serviceName>
</item>
<item>
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Microsoft Windows Teredo firewall provider</description>
</displayData>
<flags/>
<providerData/>
<serviceName/>
</item>
<item>
<providerKey>{131dfd38-ce06-4fa3-ab8a-f84f62ac84d5}</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Microsoft Windows edge traversal socket option authorization provider</description>
</displayData>
<flags/>
<providerData/>
<serviceName/>
</item>
<item>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Microsoft Windows Defender Firewall Provider</description>
</displayData>
<flags numItems="1">
<item>FWPM_PROVIDER_FLAG_PERSISTENT</item>
</flags>
<providerData/>
<serviceName>mpssvc</serviceName>
</item>
<item>
<providerKey>FWPM_PROVIDER_IPSEC_DOSP_CONFIG</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Microsoft Windows WFP Built-in IPsec DoS Protection configuration provider used to identify filters added by IPsec Denial of Service Protection.</description>
</displayData>
<flags/>
<providerData/>
<serviceName/>
</item>
<item>
<providerKey>FWPM_PROVIDER_TCP_TEMPLATES</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Microsoft Windows WFP Built-in TCP Templates provider used to identify filters added by TCP Template based configuration.</description>
</displayData>
<flags/>
<providerData/>
<serviceName/>
</item>
<item>
<providerKey>{1bebc969-61a5-4732-a177-847a0817862a}</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Microsoft Windows Defender Firewall IPsec Provider</description>
</displayData>
<flags numItems="1">
<item>FWPM_PROVIDER_FLAG_PERSISTENT</item>
</flags>
<providerData/>
<serviceName>MPSSVC</serviceName>
</item>
<item>
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
<displayData>
<name>Microsoft Corporation</name>
<description>Windows Network Data Usage (NDU) Provider</description>
</displayData>
<flags/>
<providerData/>
<serviceName>NDU</serviceName>
</item>
</providers>
<providerContexts numItems="5">
<item>
<providerContextKey>FWPM_PROVIDER_CONTEXT_SECURE_SOCKET_AUTHIP</providerContextKey>
<displayData>
<name>WFP Built-in Default Secure Socket AuthIP Policy Provider Context</name>
<description>Authenticated Internet Protocol (AuthIP) main mode default policy for secure sockets.</description>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<type>FWPM_IPSEC_AUTHIP_MM_CONTEXT</type>
<authIpMmPolicy>
<softExpirationTime>0</softExpirationTime>
<authenticationMethods numItems="1">
<item>
<authenticationMethodType>IKEEXT_ANONYMOUS</authenticationMethodType>
</item>
</authenticationMethods>
<initiatorImpersonationType>IKEEXT_IMPERSONATION_NONE</initiatorImpersonationType>
<ikeProposals numItems="2">
<item>
<cipherAlgorithm>
<algoIdentifier>IKEEXT_CIPHER_AES_128</algoIdentifier>
<keyLen>0</keyLen>
<rounds>0</rounds>
</cipherAlgorithm>
<integrityAlgorithm>
<algoIdentifier>IKEEXT_INTEGRITY_SHA1</algoIdentifier>
</integrityAlgorithm>
<maxLifetimeSeconds>7200</maxLifetimeSeconds>
<dhGroup>IKEEXT_DH_ECP_256</dhGroup>
<quickModeLimit>0</quickModeLimit>
</item>
<item>
<cipherAlgorithm>
<algoIdentifier>IKEEXT_CIPHER_3DES</algoIdentifier>
<keyLen>0</keyLen>
<rounds>0</rounds>
</cipherAlgorithm>
<integrityAlgorithm>
<algoIdentifier>IKEEXT_INTEGRITY_SHA1</algoIdentifier>
</integrityAlgorithm>
<maxLifetimeSeconds>7200</maxLifetimeSeconds>
<dhGroup>IKEEXT_DH_GROUP_2</dhGroup>
<quickModeLimit>0</quickModeLimit>
</item>
</ikeProposals>
<flags/>
<maxDynamicFilters>0</maxDynamicFilters>
<retransmitDurationSecs>0</retransmitDurationSecs>
</authIpMmPolicy>
<providerContextId>9223372036854775808</providerContextId>
</item>
<item>
<providerContextKey>FWPM_PROVIDER_CONTEXT_SECURE_SOCKET_IPSEC</providerContextKey>
<displayData>
<name>WFP Built-in Default Secure Socket IPsec Policy Provider Context</name>
<description>Internet Protocol Security (IPsec) quick mode default policy for secure sockets.</description>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<type>FWPM_IPSEC_AUTHIP_QM_TRANSPORT_CONTEXT</type>
<authipQmTransportPolicy>
<ipsecProposals numItems="4">
<item>
<lifetime>
<lifetimeSeconds>3600</lifetimeSeconds>
<lifetimeKilobytes>56320</lifetimeKilobytes>
<lifetimePackets>2147483647</lifetimePackets>
</lifetime>
<saTransforms numItems="1">
<item>
<ipsecTransformType>IPSEC_TRANSFORM_ESP_AUTH</ipsecTransformType>
<espAuthTransform>
<authTransformId>
<authType>IPSEC_AUTH_SHA_1</authType>
<authConfig>IPSEC_AUTH_CONFIG_HMAC_SHA_1_96</authConfig>
</authTransformId>
<cryptoModuleId/>
</espAuthTransform>
</item>
</saTransforms>
<pfsGroup>IPSEC_PFS_NONE</pfsGroup>
</item>
<item>
<lifetime>
<lifetimeSeconds>3600</lifetimeSeconds>
<lifetimeKilobytes>56320</lifetimeKilobytes>
<lifetimePackets>2147483647</lifetimePackets>
</lifetime>
<saTransforms numItems="1">
<item>
<ipsecTransformType>IPSEC_TRANSFORM_ESP_AUTH_AND_CIPHER</ipsecTransformType>
<espAuthAndCipherTransform>
<authTransform>
<authTransformId>
<authType>IPSEC_AUTH_SHA_1</authType>
<authConfig>IPSEC_AUTH_CONFIG_HMAC_SHA_1_96</authConfig>
</authTransformId>
<cryptoModuleId/>
</authTransform>
<cipherTransform>
<cipherTransformId>
<cipherType>IPSEC_CIPHER_TYPE_AES_128</cipherType>
<cipherConfig>IPSEC_CIPHER_CONFIG_CBC_AES_128</cipherConfig>
</cipherTransformId>
<cryptoModuleId/>
</cipherTransform>
</espAuthAndCipherTransform>
</item>
</saTransforms>
<pfsGroup>IPSEC_PFS_NONE</pfsGroup>
</item>
<item>
<lifetime>
<lifetimeSeconds>3600</lifetimeSeconds>
<lifetimeKilobytes>56320</lifetimeKilobytes>
<lifetimePackets>2147483647</lifetimePackets>
</lifetime>
<saTransforms numItems="1">
<item>
<ipsecTransformType>IPSEC_TRANSFORM_ESP_AUTH_AND_CIPHER</ipsecTransformType>
<espAuthAndCipherTransform>
<authTransform>
<authTransformId>
<authType>IPSEC_AUTH_SHA_1</authType>
<authConfig>IPSEC_AUTH_CONFIG_HMAC_SHA_1_96</authConfig>
</authTransformId>
<cryptoModuleId/>
</authTransform>
<cipherTransform>
<cipherTransformId>
<cipherType>IPSEC_CIPHER_TYPE_3DES</cipherType>
<cipherConfig>IPSEC_CIPHER_CONFIG_CBC_3DES</cipherConfig>
</cipherTransformId>
<cryptoModuleId/>
</cipherTransform>
</espAuthAndCipherTransform>
</item>
</saTransforms>
<pfsGroup>IPSEC_PFS_NONE</pfsGroup>
</item>
<item>
<lifetime>
<lifetimeSeconds>3600</lifetimeSeconds>
<lifetimeKilobytes>56320</lifetimeKilobytes>
<lifetimePackets>2147483647</lifetimePackets>
</lifetime>
<saTransforms numItems="1">
<item>
<ipsecTransformType>IPSEC_TRANSFORM_AH</ipsecTransformType>
<ahTransform>
<authTransformId>
<authType>IPSEC_AUTH_SHA_1</authType>
<authConfig>IPSEC_AUTH_CONFIG_HMAC_SHA_1_96</authConfig>
</authTransformId>
<cryptoModuleId/>
</ahTransform>
</item>
</saTransforms>
<pfsGroup>IPSEC_PFS_NONE</pfsGroup>
</item>
</ipsecProposals>
<flags numItems="1">
<item>IPSEC_POLICY_FLAG_ND_BOUNDARY</item>
</flags>
<ndAllowClearTimeoutSeconds>10</ndAllowClearTimeoutSeconds>
<saIdleTimeout>
<idleTimeoutSeconds>300</idleTimeoutSeconds>
<idleTimeoutSecondsFailOver>60</idleTimeoutSecondsFailOver>
</saIdleTimeout>
<emPolicy>
<authenticationMethods numItems="2">
<item>
<authenticationMethodType>IKEEXT_KERBEROS</authenticationMethodType>
<kerberosAuthentication>
<flags/>
<proxyServer/>
</kerberosAuthentication>
</item>
<item>
<authenticationMethodType>IKEEXT_SSL</authenticationMethodType>
<sslAuthentication>
<inboundConfigType>IKEEXT_CERT_CONFIG_TRUSTED_ROOT_STORE</inboundConfigType>
<inboundTrustedRootStoreCriteria numItems="1">
<item>
<certData/>
<certHash/>
<eku>
<numEku>1</numEku>
<eku numItems="1">
<item>1.3.6.1.5.5.7.3.2</item>
</eku>
</eku>
<name/>
<flags/>
</item>
</inboundTrustedRootStoreCriteria>
<outboundConfigType>IKEEXT_CERT_CONFIG_TRUSTED_ROOT_STORE</outboundConfigType>
<outboundTrustedRootStoreCriteria numItems="4">
<item>
<certData/>
<certHash/>
<eku>
<numEku>2</numEku>
<eku numItems="2">
<item>1.3.6.1.5.5.7.3.2</item>
<item>1.3.6.1.5.5.8.2.2</item>
</eku>
</eku>
<name/>
<flags/>
</item>
<item>
<certData/>
<certHash/>
<eku>
<numEku>1</numEku>
<eku numItems="1">
<item>1.3.6.1.5.5.7.3.2</item>
</eku>
</eku>
<name/>
<flags/>
</item>
<item>
<certData/>
<certHash/>
<eku>
<numEku>1</numEku>
<eku numItems="1">
<item>1.3.6.1.5.5.8.2.2</item>
</eku>
</eku>
<name/>
<flags/>
</item>
<item>
<certData/>
<certHash/>
<eku/>
<name/>
<flags/>
</item>
</outboundTrustedRootStoreCriteria>
<flags/>
<localCertLocationUrl/>
</sslAuthentication>
</item>
</authenticationMethods>
<initiatorImpersonationType>IKEEXT_IMPERSONATION_SOCKET_PRINCIPAL</initiatorImpersonationType>
</emPolicy>
</authipQmTransportPolicy>
<providerContextId>9223372036854775809</providerContextId>
</item>
<item>
<providerContextKey>{753d98f8-58ec-4c68-a8e5-8df3dcac52d0}</providerContextKey>
<displayData>
<name>State Management Provider Context</name>
<description>Contains State Management Options</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<type>FWPM_CLASSIFY_OPTIONS_CONTEXT</type>
<classifyOptions>
<options numItems="1">
<item>
<type>FWP_CLASSIFY_OPTION_LOOSE_SOURCE_MAPPING</type>
<value>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</value>
</item>
</options>
</classifyOptions>
<providerContextId>9223372036854775810</providerContextId>
</item>
<item>
<providerContextKey>{54144fae-35d1-47ea-b03c-c8817abdc485}</providerContextKey>
<displayData>
<name>State Management Provider Context</name>
<description>Contains State Management Options</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<type>FWPM_CLASSIFY_OPTIONS_CONTEXT</type>
<classifyOptions>
<options numItems="1">
<item>
<type>FWP_CLASSIFY_OPTION_LOCAL_ONLY_MAPPING</type>
<value>
<type>FWP_UINT32</type>
<uint32>1</uint32>
</value>
</item>
</options>
</classifyOptions>
<providerContextId>9223372036854775811</providerContextId>
</item>
<item>
<providerContextKey>{fdb4c0f3-ace7-4d5a-bd0f-743a4f251546}</providerContextKey>
<displayData>
<name>Policy Silent Mode Provider Context</name>
<description>The poicy is inspected only but not enforced</description>
</displayData>
<flags/>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<type>FWPM_GENERAL_CONTEXT</type>
<dataBuffer>
<data>50006f006c00690063007900530069006c0065006e0074004d006f0064006500500072006f00760069006400650072000000</data>
<asString>P.o.l.i.c.y.S.i.l.e.n.t.M.o.d.e.P.r.o.v.i.d.e.r...</asString>
</dataBuffer>
<providerContextId>9223372036854775812</providerContextId>
</item>
</providerContexts>
<subLayers numItems="18">
<item>
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
<displayData>
<name>WFP Built-in Inspection Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>0</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
<displayData>
<name>WFP Built-in Edge Traversal Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>1</weight>
</item>
<item>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
<displayData>
<name>Microsoft Corporation</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SUBLAYER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<weight>2</weight>
</item>
<item>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2300}</subLayerKey>
<displayData>
<name>Microsoft Corporation</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SUBLAYER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData/>
<weight>3</weight>
</item>
<item>
<subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2302}</subLayerKey>
<displayData>
<name>Microsoft Corporation</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SUBLAYER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{4b153735-1049-4480-aab4-d1b9bdc03710}</providerKey>
<providerData/>
<weight>4</weight>
</item>
<item>
<subLayerKey>{7b6b11f6-cbb5-433c-ae06-6a4f0076e49e}</subLayerKey>
<displayData>
<name>Edge traversal Teredo Authorization Sublayer</name>
<description>Edge traversal Teredo Authorization Sublayer</description>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>5</weight>
</item>
<item>
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
<displayData>
<name>windefend</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>4096</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_TCP_CHIMNEY_OFFLOAD</subLayerKey>
<displayData>
<name>WFP Built-in TCP Chimney Offload Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>8192</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_TCP_TEMPLATES</subLayerKey>
<displayData>
<name>WFP Built-in TCP Templates Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>8704</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_IPSEC_SECURITY_REALM</subLayerKey>
<displayData>
<name>WFP Built-in IPsec Security Realm Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>12288</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_SECURE_SOCKET</subLayerKey>
<displayData>
<name>WFP Built-in Secure Socket Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>16384</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_LIPS</subLayerKey>
<displayData>
<name>WFP Built-in Legacy IPsec Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>32767</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_UNIVERSAL</subLayerKey>
<displayData>
<name>WFP Built-in Universal Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>32768</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_IPSEC_DOSP</subLayerKey>
<displayData>
<name>WFP Built-in IPsec DoS Protection Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>34816</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_IPSEC_FORWARD_OUTBOUND_TUNNEL</subLayerKey>
<displayData>
<name>WFP Built-in IPsec Forward Outbound Tunnel Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>36864</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_IPSEC_TUNNEL</subLayerKey>
<displayData>
<name>WFP Built-in IPsec Tunnel Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>40960</weight>
</item>
<item>
<subLayerKey>{9ba30013-c84e-47e5-ac6e-1e1aed72fa69}</subLayerKey>
<displayData>
<name>Microsoft Corporation</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SUBLAYER_FLAG_PERSISTENT</item>
</flags>
<providerKey>{1bebc969-61a5-4732-a177-847a0817862a}</providerKey>
<providerData/>
<weight>40961</weight>
</item>
<item>
<subLayerKey>FWPM_SUBLAYER_RPC_AUDIT</subLayerKey>
<displayData>
<name>RPC Built-in Audit Sublayer</name>
<description/>
</displayData>
<flags/>
<providerKey/>
<providerData/>
<weight>49152</weight>
</item>
</subLayers>
<subscriptions>
<calloutSubscriptions/>
<filterSubscriptions numItems="8">
<item>
<enumTemplate>
<providerKey/>
<layerKey>FWPM_LAYER_RPC_UM</layerKey>
<enumType>FWP_FILTER_ENUM_OVERLAPPING</enumType>
<flags/>
<providerContextTemplate/>
<filterCondition/>
<actionMask numItems="4">
<item>FWP_ACTION_FLAG_TERMINATING</item>
<item>FWP_ACTION_FLAG_NON_TERMINATING</item>
<item>FWP_ACTION_FLAG_CALLOUT</item>
<item>FFFF8FFF</item>
</actionMask>
<calloutKey/>
</enumTemplate>
<flags numItems="2">
<item>FWPM_SUBSCRIPTION_FLAG_NOTIFY_ON_ADD</item>
<item>FWPM_SUBSCRIPTION_FLAG_NOTIFY_ON_DELETE</item>
</flags>
<sessionKey>{3c1f4d46-4e9d-4fab-bcb5-00c5403ee1cd}</sessionKey>
</item>
<item>
<enumTemplate>
<providerKey/>
<layerKey>FWPM_LAYER_RPC_EPMAP</layerKey>
<enumType>FWP_FILTER_ENUM_OVERLAPPING</enumType>
<flags/>
<providerCon
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment