shell bypass 403

UnknownSec Shell

C:/Windows/Migration/WTR/ [ drwxrwxrwx ]
upload mass deface mass delete console info server

name : wmf3.inf
[WTR]
Name="MICROSOFT WINDOWS MANAGEMENT FRAMEWORK 4.0"
WRFVersion="1"
SupportedOS="win7","win8"


[WTR.W7]
NotifyUser="No"

[WTR.W8]
NotifyUser="No"


[System.File]
"%windir%\System32 [DscCore.dll]"
"%windir%\System32 [DscCoreConfProv.dll]"
"%windir%\System32 [Microsoft.Management.Infrastructure.Native.Unmanaged.dll]"
"%windir%\System32 [mimofcodec.dll]"
"%windir%\System32 [MPUnits.dll]"
"%windir%\System32 [MPEval.dll]"
"%windir%\System32 [Microsoft.Monitoring.Commands.dll]"
"%windir%\System32\* [MPUnits.dll.mui]"
"%windir%\System32\* [MPEval.dll.mui]"
"%windir%\System32\* [Microsoft.Monitoring.Commands.resources.dll]"
"%windir%\System32\* [DscCore.dll.mui]"
"%windir%\System32\* [DscCoreConfProv.dll.mui]"
"%windir%\System32\* [mibincodec.dll.mui]"
"%windir%\System32\* [mimofcodec.dll]"
"%windir%\System32\dsc [DscCoreR.dll]"
"%windir%\System32\dsc [PSDSCFileDownloadManagerEvents.dll]"
"%windir%\System32\dsc\* [DscCoreR.dll.mui]"
"%windir%\System32\dsc\* [PSDSCFileDownloadManagerEvents.dll.mui]"
"%windir%\SysWOW64 [mibincodec.dll]"
"%windir%\SysWOW64 [Microsoft.Management.Infrastructure.Native.Unmanaged.dll]"
"%windir%\SysWOW64 [mimofcodec.dll]"
"%windir%\SysWOW64 [wbemcomn2.dll]"
"%windir%\SysWOW64\* [mibincodec.dll.mui]"
"%windir%\System32\WindowsPowerShell\v1.0 [*.exe]"
"%windir%\System32\WindowsPowerShell\v1.0 [*.dll]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\PackageManagement [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\PackageManagement [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0 [*.ps1xml]"
"%windir%\System32\WindowsPowerShell\v1.0 [*.config]"
"%windir%\System32\WindowsPowerShell\v1.0\Schemas\PSMaml [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Examples [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Diagnostics [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Activities\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Powershell.Commands.Management\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Powershell.Commands.Utility\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Cmdletization.OData\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Powershell.ConsoleHost\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Powershell.Core.Activities\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Diagnostics.Activities\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Powershell.Editor\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Powershell.GPowerShell\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Powershell.GraphicalHost\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Powershell.ISECommon\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Management.Activities\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ScheduledJob\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Activities\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Powershell.Security\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Utility.Activities\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Powershell.Workflow.ServiceCore\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management.Activities\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Policy.1.0.Microsoft.Powershell.Commands.Management\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\policy.1.0.Microsoft.Powershell.Commands.Utility\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Policy.1.0.Microsoft.Powershell.ConsoleHost\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Policy.1.0.System.Management.Automation\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\System.Spatial.PowerShell\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Odata.Resources\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Odata\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Data.Services.PowerShell\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Data.Services.Client.PowerShell\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Data.OData.PowerShell\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Data.Edm.PowerShell\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.DSC.CoreConfProviders\*[*]"
"%windir%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.DSC.CoreConfProviders.resources\*[*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\Microsoft.WSMan.Management [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\ISE [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\PSDiagnostics [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\PSWorkflow [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\Modules\PSScheduledJob [*.*]"
"%windir%\System32\WindowsPowerShell\v1.0\* [powershell_ise.resources.dll]"
"%windir%\System32\WindowsPowerShell\v1.0\* [default.help.txt]"
"%windir%\System32\WindowsPowerShell\v1.0\* [powershell.exe.mui]"
"%windir%\System32\WindowsPowerShell\v1.0\* [PSEvents.dll.mui]"
"%windir%\System32\WindowsPowerShell\v1.0\* [pspluginwkr.dll.mui]"
"%windir%\System32\WindowsPowerShell\v1.0\* [pwrshmsg.dll.mui]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0 [*.exe]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0 [*.dll]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0 [*.ps1xml]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0 [*.config]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Examples [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Diagnostics [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.WSMan.Management [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\ISE [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDiagnostics [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\Modules\PSScheduledJob [*.*]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\* [powershell_ise.resources.dll]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\* [default.help.txt]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\* [powershell.exe.mui]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\* [PSEvents.dll.mui]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\* [pspluginwkr.dll.mui]"
"%windir%\SysWOW64\WindowsPowerShell\v1.0\* [pwrshmsg.dll.mui]"
"%windir%\System32\wbem [mgmtprovider.dll]"
"%windir%\System32\wbem [mgmtprovider.mof]"
"%windir%\System32\wbem [mgmtprovideruninstall.mof]"
"%windir%\System32 [CallUxxProvider.vbs]"
"%windir%\System32 [FeatureInfoDl.xml]"
"%windir%\System32\wbem\* [mgmtprovider.dll.mui]"
"%windir%\System32\wbem\* [mgmtprovider.mfl]"
"%windir%\System32\wbem\* [mgmtprovideruninstall.mfl]"
"%windir%\System32\* [ModataPerfCounters.dll]"
"%windir%\System32\* [ModataPerfCounters.dll.mui]"
"%windir%\System32\* [ModataEvents.dll.mui]"
"%windir%\System32 [ModataEvents.dll]"
"%windir%\PolicyDefinitions\* [EventForwarding.adml]"
"%windir%\PolicyDefinitions\* [EventForwarding.admx]"
"%windir%\System32\* [wevtfwd.dll.mui]"
"%windir%\System32 [wevtfwd.dll]"
"%windir%\System32\* [wecutil.exe.mui]"
"%windir%\System32\* [wecsvc.dll.mui]"
"%windir%\System32 [wecutil.exe]"
"%windir%\System32 [wecapi.dll]"
"%windir%\System32 [wecsvc.dll]"
"%windir%\System32\* [Winrs.exe.mui]"
"%windir%\System32 [winrs.exe]"
"%windir%\System32 [winrscmd.dll]"
"%windir%\System32 [winrsmgr.dll]"
"%windir%\System32 [winrssrv.dll]"
"%windir%\System32 [winrshost.exe]"
"%windir%\PolicyDefinitions\* [WindowsRemoteShell.admx]"
"%windir%\PolicyDefinitions\* [WindowsRemoteShell.adml]"
"%windir%\System32\inetsrv\config\schema [wsmanconfig_schema.xml]"
"%windir%\PolicyDefinitions\* [WindowsRemoteManagement.admx]"
"%windir%\PolicyDefinitions\* [WindowsRemoteManagement.adml]"
"%windir%\System32\* [WsmRes.dll.mui]"
"%windir%\System32\* [WsmSvc.dll.mui]"
"%windir%\System32\winrm\* [winrm.ini]"
"%windir%\System32\wbem [WsmAuto.mof]"
"%windir%\System32\wbem [WsmAgent.mof]"
"%windir%\System32\wbem [WsmAgentUninstall.mof]"
"%windir%\System32 [WsmPty.xsl]"
"%windir%\System32 [WsmTxt.xsl]"
"%windir%\System32 [wsmanconfig_schema.xml]"
"%windir%\System32 [winrm.vbs]"
"%windir%\System32 [WsmAuto.dll]"
"%windir%\System32 [WsmSvc.dll]"
"%windir%\System32 [WsmWmiPl.dll]"
"%windir%\System32 [WsmAgent.dll]"
"%windir%\System32 [WsmRes.dll]"
"%windir%\System32 [WsmGCDeps.dll]"
"%windir%\System32 [WSManHTTPConfig.exe]"
"%windir%\System32 [WSManMigrationPlugin.dll]"
"%windir%\System32 [winrm.cmd]"
"%windir%\System32 [wsmplpxy.dll]"
"%windir%\System32 [wsmprovhost.exe]"
"%windir%\System32 [Wsmselrr.dll.mui]"
"%windir%\SysWOW64\* [wevtfwd.dll.mui]"
"%windir%\SysWOW64 [wevtfwd.dll]"
"%windir%\SysWOW64\* [wecutil.exe.mui]"
"%windir%\SysWOW64\* [wecsvc.dll.mui]"
"%windir%\SysWOW64 [wecutil.exe]"
"%windir%\SysWOW64 [wecapi.dll]"
"%windir%\SysWOW64 [wecsvc.dll]"
"%windir%\SysWOW64\* [Winrs.exe.mui]"
"%windir%\SysWOW64 [winrs.exe]"
"%windir%\SysWOW64 [winrscmd.dll]"
"%windir%\SysWOW64 [winrsmgr.dll]"
"%windir%\SysWOW64 [winrssrv.dll]"
"%windir%\SysWOW64 [winrshost.exe]"
"%windir%\SysWOW64\inetsrv\config\schema [wsmanconfig_schema.xml]"
"%windir%\SysWOW64\* [WsmRes.dll.mui]"
"%windir%\SysWOW64\* [WsmSvc.dll.mui]"
"%windir%\SysWOW64\winrm\* [winrm.ini]"
"%windir%\SysWOW64\wbem [WsmAuto.mof]"
"%windir%\SysWOW64\wbem [WsmAgent.mof]"
"%windir%\SysWOW64\wbem [WsmAgentUninstall.mof]"
"%windir%\SysWOW64 [WsmPty.xsl]"
"%windir%\SysWOW64 [WsmTxt.xsl]"
"%windir%\SysWOW64 [wsmanconfig_schema.xml]"
"%windir%\SysWOW64 [winrm.vbs]"
"%windir%\SysWOW64 [WsmAuto.dll]"
"%windir%\SysWOW64 [WsmSvc.dll]"
"%windir%\SysWOW64 [WsmWmiPl.dll]"
"%windir%\SysWOW64 [WsmAgent.dll]"
"%windir%\SysWOW64 [WsmRes.dll]"
"%windir%\SysWOW64 [WsmGCDeps.dll]"
"%windir%\SysWOW64 [WSManHTTPConfig.exe]"
"%windir%\SysWOW64 [WSManMigrationPlugin.dll]"
"%windir%\SysWOW64 [winrm.cmd]"
"%windir%\SysWOW64 [wsmplpxy.dll]"
"%windir%\SysWOW64 [wsmprovhost.exe]"
"%windir%\SysWOW64 [Wsmselrr.dll.mui]"
"%windir%\System32\wbem [esscli.dll]"
"%windir%\SysWOW64\wbem [esscli.dll]"
"%windir%\System32\wbem [fastprox.dll]"
"%windir%\SysWOW64\wbem [fastprox.dll]"
"%windir%\System32 [framedyn.dll]"
"%windir%\SysWOW64 [framedyn.dll]"
"%windir%\System32 [framedynos.dll]"
"%windir%\SysWOW64 [framedynos.dll]"
"%windir%\System32\wbem [krnlprov.dll]"
"%windir%\System32\wbem [mofcomp.exe]"
"%windir%\SysWOW64\wbem [mofcomp.exe]"
"%windir%\System32\wbem [mofd.dll]"
"%windir%\SysWOW64\wbem [mofd.dll]"
"%windir%\System32\wbem [mofinstall.dll]"
"%windir%\System32\wbem [ncprov.dll]"
"%windir%\System32\wbem [repdrvfs.dll]"
"%windir%\System32\wbem [smtpcons.dll]"
"%windir%\System32\wbem [stdprov.dll]"
"%windir%\SysWOW64\wbem [stdprov.dll]"
"%windir%\System32\wbem [unsecapp.exe]"
"%windir%\System32\wbem [wbemcons.dll]"
"%windir%\System32\wbem [wbemcore.dll]"
"%windir%\System32\wbem [wbemess.dll]"
"%windir%\System32\wbem [wbemprox.dll]"
"%windir%\SysWOW64\wbem [wbemprox.dll]"
"%windir%\System32\wbem [wbemsvc.dll]"
"%windir%\SysWOW64\wbem [wbemsvc.dll]"
"%windir%\System32\wbem [wbemtest.exe]"
"%windir%\System32\wbem [winmgmt.exe]"
"%windir%\SysWOW64\wbem [winmgmt.exe]"
"%windir%\System32\wbem [winmgmtr.dll]"
"%windir%\System32\wbem [wmiadap.exe]"
"%windir%\SysWOW64\wbem [wmiadap.exe]"
"%windir%\System32\wbem [wmiapres.dll]"
"%windir%\System32\wbem [wmicookr.dll]"
"%windir%\SysWOW64\wbem [wmicookr.dll]"
"%windir%\System32\wbem [wmidcprv.dll]"
"%windir%\SysWOW64\wbem [wmidcprv.dll]"
"%windir%\System32\wbem [scrcons.exe]"
"%windir%\System32\wbem [wmiaprpl.dll]"
"%windir%\SysWOW64\wbem [wmiaprpl.dll]"
"%windir%\System32 [wbemcomn2.dll]"
"%windir%\System32\wbem [WMIMigrationPlugin.dll]"
"%windir%\SysWOW64\wbem [WMIMigrationPlugin.dll]"
"%windir%\System32 [ncobjapi.dll]"
"%windir%\SysWOW64 [ncobjapi.dll]"
"%windir%\System32\wbem\Xml [wmi2xml.dll]"
"%windir%\SysWOW64\wbem\xml [wmi2xml.dll]"
"%windir%\System32\wbem [wmitimep.dll]"
"%windir%\System32\wbem [wmiprvsd.dll]"
"%windir%\System32\wbem [wmiprvse.exe]"
"%windir%\SysWOW64\wbem [wmiprvse.exe]"
"%windir%\System32\wbem [wmisvc.dll]"
"%windir%\System32\wbem [wmiutils.dll]"
"%windir%\SysWOW64\wbem [wmiutils.dll]"
"%windir%\System32\wbem [wmiapsrv.exe]"
"%windir%\System32 [mi.dll]"
"%windir%\SysWOW64 [mi.dll]"
"%windir%\System32 [miutils.dll]"
"%windir%\SysWOW64 [miutils.dll]"
"%windir%\System32 [prvdmofcomp.dll]"
"%windir%\SysWOW64 [prvdmofcomp.dll]"
"%windir%\System32 [PSModuleDiscoveryProvider.dll]"
"%windir%\System32 [Register-CimProvider.exe]"
"%windir%\SysWOW64 [Register-CimProvider.exe]"
"%windir%\System32 [wmidcom.dll]"
"%windir%\System32 [wmitomi.dll]"
"%windir%\SysWOW64 [wmitomi.dll]"
"%windir%\System32\Configuration\*[*]"


[System.Gac]
"[System.Management.Automation,*]"
"[Microsoft.PowerShell.Activities,*]"
"[Microsoft.Powershell.Commands.Management,*]"
"[Microsoft.Powershell.Commands.Utility,*]"
"[Microsoft.Powershell.ConsoleHost,*]"
"[Microsoft.Powershell.Core.Activities,*]"
"[Microsoft.PowerShell.Diagnostics.Activities,*]"
"[Microsoft.Powershell.Editor,*]"
"[Microsoft.Powershell.GPowerShell,*]"
"[Microsoft.Powershell.GraphicalHost,*]"
"[Microsoft.Powershell.ISECommon,*]"
"[Microsoft.PowerShell.Management.Activities,*]"
"[Microsoft.PowerShell.ScheduledJob,*]"
"[Microsoft.PowerShell.Security.Activities,*]"
"[Microsoft.Powershell.Security,*]"
"[Microsoft.PowerShell.Utility.Activities,*]"
"[Microsoft.Powershell.Workflow.ServiceCore,*]"
"[Microsoft.WSMan.Management.Activities,*]"
"[Microsoft.PowerShell.Cmdletization.OData,*]"
"[Policy.1.0.Microsoft.Powershell.Commands.Management,*]"
"[policy.1.0.Microsoft.Powershell.Commands.Utility,*]"
"[Policy.1.0.Microsoft.Powershell.ConsoleHost,*]"
"[Policy.1.0.Microsoft.Powershell.Security,*]"
"[Policy.1.0.System.Management.Automation,*]"
"[System.Spatial.PowerShell,*]"
"[Microsoft.Management.Odata.Resources,*]"
"[Microsoft.Management.Odata,*]"
"[Microsoft.Data.Services.PowerShell,*]"
"[Microsoft.Data.Services.Client.PowerShell,*]"
"[Microsoft.Data.OData.PowerShell,*]"
"[Microsoft.Data.Edm.PowerShell,*]"
"[Microsoft.Windows.DSC.CoreConfProviders,*]"
"[Microsoft.Windows.DSC.CoreConfProviders.resources,*]"



[System.Registry]
"HKLM\SOFTWARE\Microsoft\PowerShell\* [*]"
"HKLM\SOFTWARE\Microsoft\ServerManager\MgmtProvider\* [*]"
"HKLM\SOFTWARE\CLASSES\CLSID\{93D5B54E-1F7E-4E6E-8701-35E81DD832E3}\* [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\Subscriptions [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\Globals [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\ConfigurationModes\Normal [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\ConfigurationModes\MinLatency [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\ConfigurationModes\MinBandwidth [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\ConfigurationModes\Custom [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System\wecsvc [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\HardwareEvents [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\Wecsvc\Parameters [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventForwarding [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell\1\PSConfigurationProviders [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell\1\PSConfigurationProviders\Microsoft.PowerShell [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell\3\0409 [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell\3\0501 [*]"
"HKCR\Microsoft.PowerShellScript.1\Shell\Edit\Command [*]"
"HKCR\Microsoft.PowerShellScript.1\DefaultIcon [*]"
"HKCR\Microsoft.PowerShellData.1\Shell\Edit\Command [*]"
"HKCR\Microsoft.PowerShellModule.1\Shell\Edit\Command [*]"
"HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351} [*]"
"HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351} [*]"
"HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{603BCC1F-4B59-4E08-B724-D2C6297EF351} [*]"
"HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351} [*]"
"HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351} [*]"
"HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351} [*]"
"HKLM\SOFTWARE [*]"
"HKLM\SOFTWARE\Microsoft [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell\1 [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Windows PowerShell [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Windows PowerShell\PowerShell [*]"
"HKCR\.ps1 [*]"
"HKCR\.psd1 [*]"
"HKCR\.psm1 [*]"
"HKCR\.ps1xml [*]"
"HKCR\.psc1 [*]"
"HKCR\Microsoft.PowerShellConsole.1 [*]"
"HKCR\Microsoft.PowerShellConsole.1\Shell [*]"
"HKCR\Microsoft.PowerShellConsole.1\Shell\Open [*]"
"HKCR\Microsoft.PowerShellConsole.1\Shell\Open\Command [*]"
"HKCR\Microsoft.PowerShellConsole.1\Shell\0 [*]"
"HKCR\Microsoft.PowerShellConsole.1\Shell\0\Command [*]"
"HKCR\Microsoft.PowerShellScript.1 [*]"
"HKCR\Microsoft.PowerShellScript.1\Shell [*]"
"HKCR\Microsoft.PowerShellScript.1\Shell\0 [*]"
"HKCR\Microsoft.PowerShellScript.1\Shell\0\Command [*]"
"HKCR\Microsoft.PowerShellScript.1\Shell\Open\Command [*]"
"HKCR\Microsoft.PowerShellXMLData.1 [*]"
"HKCR\Microsoft.PowerShellData.1 [*]"
"HKCR\Microsoft.PowerShellData.1\Shell [*]"
"HKCR\Microsoft.PowerShellData.1\Shell\Open\Command [*]"
"HKCR\Microsoft.PowerShellModule.1 [*]"
"HKCR\Microsoft.PowerShellModule.1\Shell [*]"
"HKCR\Microsoft.PowerShellModule.1\Shell\Open\Command [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PowerShell.exe [*]"
"%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk [*]"
"%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell (x86).lnk [*]"
"HKCR\CLSID\{93D5B54E-1F7E-4E6E-8701-35E81DD832E3}\ [*]"
"HKCR\CLSID\{93D5B54E-1F7E-4E6E-8701-35E81DD832E3}\InprocServer32\ [*]"
"HKLM\Software\Microsoft\ServerManager\MgmtProvider [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\HardwareEvents\Microsoft-Windows-WSMAN-SEL_LogRecord [*]"
"HKCR\CLSID\{BCED617B-EC03-420b-8508-977DC7A686BD} [*]"
"HKCR\CLSID\{BCED617B-EC03-420b-8508-977DC7A686BD}\InprocServer32 [*]"
"HKCR\CLSID\{BCED617B-EC03-420b-8508-977DC7A686BD}\ProgID [*]"
"HKCR\CLSID\{BCED617B-EC03-420b-8508-977DC7A686BD}\Programmable [*]"
"HKCR\CLSID\{BCED617B-EC03-420b-8508-977DC7A686BD}\Typelib [*]"
"HKCR\CLSID\{BCED617B-EC03-420b-8508-977DC7A686BD}\VersionIndependentProgID [*]"
"HKCR\CLSID\{7DE087A5-5DCB-4df7-BB12-0924AD8FBD9A} [*]"
"HKCR\CLSID\{7DE087A5-5DCB-4df7-BB12-0924AD8FBD9A}\InprocServer32 [*]"
"HKCR\CLSID\{7DE087A5-5DCB-4df7-BB12-0924AD8FBD9A}\ProgID [*]"
"HKCR\CLSID\{7DE087A5-5DCB-4df7-BB12-0924AD8FBD9A}\Programmable [*]"
"HKCR\CLSID\{7DE087A5-5DCB-4df7-BB12-0924AD8FBD9A}\Typelib [*]"
"HKCR\CLSID\{7DE087A5-5DCB-4df7-BB12-0924AD8FBD9A}\VersionIndependentProgID [*]"
"HKCR\Typelib\{F010BE25-296D-4036-980F-5A0669A17577} [*]"
"HKCR\Typelib\{F010BE25-296D-4036-980F-5A0669A17577}\1.0 [*]"
"HKCR\Typelib\{F010BE25-296D-4036-980F-5A0669A17577}\1.0\0 [*]"
"HKCR\Typelib\{F010BE25-296D-4036-980F-5A0669A17577}\1.0\0\win64\ [*]"
"HKCR\Typelib\{F010BE25-296D-4036-980F-5A0669A17577}\1.0\FLAGS [*]"
"HKCR\Typelib\{F010BE25-296D-4036-980F-5A0669A17577}\1.0\HELPDIR [*]"
"HKCR\Interface\{190D8637-5CD3-496D-AD24-69636BB5A3B5} [*]"
"HKCR\Interface\{190D8637-5CD3-496D-AD24-69636BB5A3B5}\ProxyStubClsid32 [*]"
"HKCR\Interface\{190D8637-5CD3-496D-AD24-69636BB5A3B5}\TypeLib [*]"
"HKCR\Interface\{2D53BDAA-798E-49E6-A1AA-74D01256F411} [*]"
"HKCR\Interface\{2D53BDAA-798E-49E6-A1AA-74D01256F411}\ProxyStubClsid32 [*]"
"HKCR\Interface\{2D53BDAA-798E-49E6-A1AA-74D01256F411}\TypeLib [*]"
"HKCR\Interface\{F704E861-9E52-464F-B786-DA5EB2320FDD} [*]"
"HKCR\Interface\{F704E861-9E52-464F-B786-DA5EB2320FDD}\ProxyStubClsid32 [*]"
"HKCR\Interface\{F704E861-9E52-464F-B786-DA5EB2320FDD}\TypeLib [*]"
"HKCR\Interface\{FC84FC58-1286-40C4-9DA0-C8EF6EC241E0} [*]"
"HKCR\Interface\{FC84FC58-1286-40C4-9DA0-C8EF6EC241E0}\ProxyStubClsid32 [*]"
"HKCR\Interface\{FC84FC58-1286-40C4-9DA0-C8EF6EC241E0}\TypeLib [*]"
"HKCR\Interface\{F3457CA9-ABB9-4FA5-B850-90E8CA300E7F} [*]"
"HKCR\Interface\{F3457CA9-ABB9-4FA5-B850-90E8CA300E7F}\ProxyStubClsid32 [*]"
"HKCR\Interface\{F3457CA9-ABB9-4FA5-B850-90E8CA300E7F}\TypeLib [*]"
"HKCR\Interface\{A7A1BA28-DE41-466A-AD0A-C4059EAD7428} [*]"
"HKCR\Interface\{A7A1BA28-DE41-466A-AD0A-C4059EAD7428}\ProxyStubClsid32 [*]"
"HKCR\Interface\{A7A1BA28-DE41-466A-AD0A-C4059EAD7428}\TypeLib [*]"
"HKCR\Interface\{EFFAEAD7-7EC8-4716-B9BE-F2E7E9FB4ADB} [*]"
"HKCR\Interface\{EFFAEAD7-7EC8-4716-B9BE-F2E7E9FB4ADB}\ProxyStubClsid32 [*]"
"HKCR\Interface\{EFFAEAD7-7EC8-4716-B9BE-F2E7E9FB4ADB}\TypeLib [*]"
"HKCR\WSMan.Automation [*]"
"HKCR\WSMan.Automation\CLSID [*]"
"HKCR\WSMan.Automation\CurVer [*]"
"HKCR\WSMan.Automation.1 [*]"
"HKCR\WSMan.Automation.1\CLSID [*]"
"HKCR\WSMan.InternalAutomation [*]"
"HKCR\WSMan.InternalAutomation\CLSID [*]"
"HKCR\WSMan.InternalAutomation\CurVer [*]"
"HKCR\WSMan.InternalAutomation.1 [*]"
"HKCR\WSMan.InternalAutomation.1\CLSID [*]"
"HKCR\AppId\{3feb2f63-0eec-4b96-84ab-da1307e0117c}\ [*]"
"HKCR\AppId\{209444d2-2540-495e-962c-a61ad3243526}\ [*]"
"HKCR\CLSID\{9678f47f-2435-475c-b24a-4606f8161c16}\ [*]"
"HKCR\CLSID\{9678f47f-2435-475c-b24a-4606f8161c16}\LocalServer32 [*]"
"HKCR\CLSID\{9acf41ed-d457-4cc1-941b-ab02c26e4686}\ [*]"
"HKCR\CLSID\{9acf41ed-d457-4cc1-941b-ab02c26e4686}\LocalServer32 [*]"
"HKCR\CLSID\{BA9BB214-D930-4206-8F8F-BF0F1EAA4A6B}\ [*]"
"HKCR\CLSID\{BA9BB214-D930-4206-8F8F-BF0F1EAA4A6B}\InProcServer32 [*]"
"HKCR\Interface\{BA9BB214-D930-4206-8F8F-BF0F1EAA4A6B}\ [*]"
"HKCR\Interface\{BA9BB214-D930-4206-8F8F-BF0F1EAA4A6B}\NumMethods [*]"
"HKCR\Interface\{BA9BB214-D930-4206-8F8F-BF0F1EAA4A6B}\ProxyStubClsid32 [*]"
"HKCR\Interface\{17245DB2-74E5-45F6-8843-B7AEF309B6D6}\ [*]"
"HKCR\Interface\{17245DB2-74E5-45F6-8843-B7AEF309B6D6}\NumMethods [*]"
"HKCR\Interface\{17245DB2-74E5-45F6-8843-B7AEF309B6D6}\ProxyStubClsid32 [*]"
"HKCR\CLSID\{DA13DC3D-3F88-4A85-A89E-5735588A65E5} [*]"
"HKCR\CLSID\{DA13DC3D-3F88-4A85-A89E-5735588A65E5}\InprocServer32 [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\Protocols\WINRM [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\Protocols\WINRM\1.0 [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System\WinRM [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\WinRM\Parameters [*]"
"HKLM\SOFTWARE\Microsoft\ServerManager\OobOptionalComponents\WinRM-IIS-Extensions [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\SEL Plugin [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Listener\*+HTTP [*]"
"HKCR\CLSID\{442FF639-3DA0-4A70-A1D8-579E26C46A60}\InprocServer32\ [*]"
"HKCR\CLSID\{442FF639-3DA0-4A70-A1D8-579E26C46A60}\ [*]"
"HKCR\AppId\{3e5ca495-8d6a-4d1f-ad99-177b426c8b8e}\ [*]"
"HKCR\AppId\{7d378de6-ed8d-426d-91df-0273d07cd7f6}\ [*]"
"HKCR\CLSID\{047DEC5A-95C1-4C86-827F-7B8C92EBA67A}\ [*]"
"HKCR\CLSID\{047DEC5A-95C1-4C86-827F-7B8C92EBA67A}\InProcServer32 [*]"
"HKCR\CLSID\{F73C1438-71B4-4D91-AD13-1F889A03AC67}\ [*]"
"HKCR\CLSID\{F73C1438-71B4-4D91-AD13-1F889A03AC67}\InProcServer32 [*]"
"HKCR\CLSID\{0289a7c5-91bf-4547-81ae-fec91a89dec5}\ [*]"
"HKCR\CLSID\{0289a7c5-91bf-4547-81ae-fec91a89dec5}\LocalServer32 [*]"
"HKCR\CLSID\{98068995-54d2-4136-9bc9-6dbcb0a4683f}\ [*]"
"HKCR\CLSID\{98068995-54d2-4136-9bc9-6dbcb0a4683f}\LocalServer32 [*]"
"HKCR\Interface\{047DEC5A-95C1-4C86-827F-7B8C92EBA67A}\ [*]"
"HKCR\Interface\{047DEC5A-95C1-4C86-827F-7B8C92EBA67A}\NumMethods [*]"
"HKCR\Interface\{047DEC5A-95C1-4C86-827F-7B8C92EBA67A}\ProxyStubClsid32 [*]"
"HKCR\Interface\{F73C1438-71B4-4D91-AD13-1F889A03AC67}\ [*]"
"HKCR\Interface\{F73C1438-71B4-4D91-AD13-1F889A03AC67}\NumMethods [*]"
"HKCR\Interface\{F73C1438-71B4-4D91-AD13-1F889A03AC67}\ProxyStubClsid32 [*]"
"HKCR\CLSID\{C7A3A54B-0250-11D3-9CD1-00105A1F4801}\ [*]"
"HKCR\CLSID\{C7A3A54B-0250-11D3-9CD1-00105A1F4801}\InprocServer32\ [*]"
"HKCR\CLSID\{266C72E6-62E8-11D1-AD89-00C04FD8FDFF}\InprocServer32\ [*]"
"HKCR\CLSID\{266C72D4-62E8-11D1-AD89-00C04FD8FDFF}\InprocServer32\ [*]"
"HKCR\CLSID\{266C72E5-62E8-11D1-AD89-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{266C72D4-62E8-11D1-AD89-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{266C72E5-62E8-11D1-AD89-00C04FD8FDFF}\InprocServer32\ [*]"
"HKCR\CLSID\{266C72E6-62E8-11D1-AD89-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{266C72E7-62E8-11D1-AD89-00C04FD8FDFF}\LocalServer32\ [*]"
"HKCR\CLSID\{266C72E7-62E8-11D1-AD89-00C04FD8FDFF}\ [*]"
"HKCR\Appid\{266C72E7-62E8-11D1-AD89-00C04FD8FDFF}\ [*]"
"HKCR\Interface\{027947E1-D731-11CE-A357-000000000001}\NumMethods\ [*]"
"HKCR\Interface\{027947E1-D731-11CE-A357-000000000001}\ [*]"
"HKCR\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\ [*]"
"HKCR\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\ [*]"
"HKCR\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\ [*]"
"HKCR\CLSID\{00B8308C-09F2-4c18-A7B0-4594D6B22EFE}\ [*]"
"HKCR\CLSID\{00B8308C-09F2-4c18-A7B0-4594D6B22EFE}\InprocServer32\ [*]"
"HKCR\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\ [*]"
"HKCR\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\InprocServer32\ [*]"
"HKCR\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}\ [*]"
"HKCR\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}\NumMethods\ [*]"
"HKCR\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ [*]"
"HKCR\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\NumMethods\ [*]"
"HKCR\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\ [*]"
"HKCR\CLSID\{C71566F2-561E-11D1-AD87-00C04FD8FDFF}\InprocServer32\ [*]"
"HKCR\CLSID\{C71566F2-561E-11D1-AD87-00C04FD8FDFF}\ [*]"
"HKCR\Interface\{755F9DA6-7508-11D1-AD94-00C04FD8FDFF}\NumMethods\ [*]"
"HKCR\Interface\{755F9DA6-7508-11D1-AD94-00C04FD8FDFF}\ [*]"
"HKCR\Interface\{755F9DA6-7508-11D1-AD94-00C04FD8FDFF}\ProxyStubClsid32\ [*]"
"HKCR\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ [*]"
"HKCR\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\ [*]"
"HKCR\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\Implemented Categories\ [*]"
"HKCR\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32\ [*]"
"HKCR\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\Implemented Categories\{00000003-0000-0000-C000-000000000046}\ [*]"
"HKCR\CLSID\{7016F8FA-CCDA-11D2-B35C-00105A1F8177}\ [*]"
"HKCR\CLSID\{7016F8FA-CCDA-11D2-B35C-00105A1F8177}\InprocServer32\ [*]"
"HKCR\Interface\{E246107B-B06E-11D0-AD61-00C04FD8FDFF}\NumMethods\ [*]"
"HKCR\Interface\{E246107B-B06E-11D0-AD61-00C04FD8FDFF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{E246107B-B06E-11D0-AD61-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ [*]"
"HKCR\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ [*]"
"HKCR\CLSID\{9A653086-174F-11D2-B5F9-00104B703EFD}\InprocServer32\ [*]"
"HKCR\CLSID\{9A653086-174F-11D2-B5F9-00104B703EFD}\ [*]"
"HKCR\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ [*]"
"HKCR\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\NumMethods\ [*]"
"HKCR\CLSID\{CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D}\ [*]"
"HKCR\CLSID\{CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D}\InprocServer32\ [*]"
"HKCR\CLSID\{CC9072AB-C000-49D8-A5AA-00266C8DBB9B}\ [*]"
"HKCR\CLSID\{CC9072AB-C000-49D8-A5AA-00266C8DBB9B}\InprocServer32\ [*]"
"HKCR\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\ [*]"
"HKCR\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\Implemented Categories\ [*]"
"HKCR\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\Implemented Categories\{00000003-0000-0000-C000-000000000046}\ [*]"
"HKCR\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\InprocServer32\ [*]"
"HKCR\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\InprocServer32\ [*]"
"HKCR\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\ [*]"
"HKCR\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ [*]"
"HKCR\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\ [*]"
"HKCR\CLSID\{DCF33DF4-B510-439F-832A-16B6B514F2A7}\InprocServer32\ [*]"
"HKCR\CLSID\{DCF33DF4-B510-439F-832A-16B6B514F2A7}\ [*]"
"HKCR\CLSID\{78103FB7-AED7-4066-8BCD-30BB27B02331}\ [*]"
"HKCR\CLSID\{78103FB7-AED7-4066-8BCD-30BB27B02331}\InprocServer32\ [*]"
"HKCR\CLSID\{29B5828C-CAB9-11D2-B35C-00105A1F8177}\ [*]"
"HKCR\CLSID\{29B5828C-CAB9-11D2-B35C-00105A1F8177}\InprocServer32\ [*]"
"HKCR\CLSID\{F5F75737-2843-4F22-933D-C76A97CDA62F}\InprocServer32\ [*]"
"HKCR\CLSID\{F5F75737-2843-4F22-933D-C76A97CDA62F}\NotInsertable\ [*]"
"HKCR\CLSID\{F5F75737-2843-4F22-933D-C76A97CDA62F}\ [*]"
"HKCR\CLSID\{4DE225BF-CF59-4CFC-85F7-68B90F185355}\NotInsertable\ [*]"
"HKCR\CLSID\{4DE225BF-CF59-4CFC-85F7-68B90F185355}\InprocServer32\ [*]"
"HKCR\CLSID\{4DE225BF-CF59-4CFC-85F7-68B90F185355}\ [*]"
"HKCR\CLSID\{F5A55D36-8750-432C-AB52-AD49A016EABC}\NotInsertable\ [*]"
"HKCR\CLSID\{F5A55D36-8750-432C-AB52-AD49A016EABC}\InprocServer32\ [*]"
"HKCR\CLSID\{F5A55D36-8750-432C-AB52-AD49A016EABC}\ [*]"
"HKCR\CLSID\{7F598975-37E0-4A67-A992-116680F0CEDA}\NotInsertable\ [*]"
"HKCR\CLSID\{7F598975-37E0-4A67-A992-116680F0CEDA}\InprocServer32\ [*]"
"HKCR\CLSID\{7F598975-37E0-4A67-A992-116680F0CEDA}\ [*]"
"HKCR\CLSID\{8BEBCE8B-1AF0-4323-8B4D-36994567CAE1}\NotInsertable\ [*]"
"HKCR\CLSID\{8BEBCE8B-1AF0-4323-8B4D-36994567CAE1}\InprocServer32\ [*]"
"HKCR\CLSID\{8BEBCE8B-1AF0-4323-8B4D-36994567CAE1}\ [*]"
"HKCR\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} [*]"
"HKCR\AppID\{1F87137D-0E7C-44d5-8C73-4EFFB68962F2} [*]"
"HKCR\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} [*]"
"HKCR\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 [*]"
"HKCR\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\NotInsertable [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters\ [*]"
"HKCR\CLSID\{1F87137D-0E7C-44d5-8C73-4EFFB68962F2} [*]"
"HKCR\CLSID\{1F87137D-0E7C-44d5-8C73-4EFFB68962F2}\LocalServer32 [*]"
"HKCR\CLSID\{1F87137D-0E7C-44d5-8C73-4EFFB68962F2}\NotInsertable [*]"
"HKCR\CLSID\{7998DC37-D3FE-487C-A60A-7701FCC70CC6}\ [*]"
"HKCR\CLSID\{7998DC37-D3FE-487C-A60A-7701FCC70CC6}\InprocServer32\ [*]"
"HKLM\System\CurrentControlSet\Services\winmgmt\Parameters [*]"
"HKLM\System\CurrentControlSet\Services\winmgmt [*]"
"HKLM\System\CurrentControlSet\Services\wmiApSrv [*]"
"HKCR\CLSID\{4FA18276-912A-11D1-AD9B-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{4FA18276-912A-11D1-AD9B-00C04FD8FDFF}\InprocServer32\ [*]"
"HKCR\CLSID\{6543D242-A80B-44A3-B828-95C1EC452423}\ [*]"
"HKCR\CLSID\{6543D242-A80B-44A3-B828-95C1EC452423}\InprocServer32\ [*]"
"HKCR\CLSID\{A83EF168-CA8D-11D2-B33D-00104BCC4B4A}\ [*]"
"HKCR\CLSID\{A83EF168-CA8D-11D2-B33D-00104BCC4B4A}\InprocServer32\ [*]"
"HKCR\CLSID\{1860E246-E924-4F73-B2C5-93E0577E3AA1}\ [*]"
"HKCR\CLSID\{1860E246-E924-4F73-B2C5-93E0577E3AA1}\InprocServer32\ [*]"
"HKCR\CLSID\{1F0BC6AD-46D4-488B-BE1F-047FC7505E60}\ [*]"
"HKCR\CLSID\{1F0BC6AD-46D4-488B-BE1F-047FC7505E60}\InprocServer32\ [*]"
"HKCR\CLSID\{ED999FF5-223A-4052-8ECE-0B10C8DBAA39}\ [*]"
"HKCR\CLSID\{ED999FF5-223A-4052-8ECE-0B10C8DBAA39}\InprocServer32\ [*]"
"HKCR\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\ [*]"
"HKCR\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32\ [*]"
"HKCR\CLSID\{5D08B586-343A-11D0-AD46-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{5D08B586-343A-11D0-AD46-00C04FD8FDFF}\InprocServer32\ [*]"
"HKCR\CLSID\{6c19be35-7500-11d1-ad94-00c04fd8fdff}\ [*]"
"HKCR\CLSID\{6c19be35-7500-11d1-ad94-00c04fd8fdff}\Implemented Categories\{00000003-0000-0000-C000-000000000046}\ [*]"
"HKCR\CLSID\{6c19be35-7500-11d1-ad94-00c04fd8fdff}\InprocServer32\ [*]"
"HKCR\CLSID\{6c19be35-7500-11d1-ad94-00c04fd8fdff}\Implemented Categories\ [*]"
"HKCR\CLSID\{288a2d5f-253c-46b4-b58c-2ced3180b993}\ [*]"
"HKCR\CLSID\{288a2d5f-253c-46b4-b58c-2ced3180b993}\InprocServer32 [*]"
"HKCR\CLSID\{DC923725-0FDD-45E1-AE74-EA09182E739B}\ [*]"
"HKCR\CLSID\{DC923725-0FDD-45E1-AE74-EA09182E739B}\InprocServer32\ [*]"
"HKCR\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\ [*]"
"HKCR\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\ [*]"
"HKCR\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\ [*]"
"HKCR\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\InProcServer32\ [*]"
"HKCR\CLSID\{29F06F0C-FB7F-44A5-83CD-D41705D5C525}\TypeLib\ [*]"
"HKCR\CLSID\{29F06F0C-FB7F-44A5-83CD-D41705D5C525}\Version\ [*]"
"HKCR\NCProv.NCProvider.1\CLSID\ [*]"
"HKCR\TypeLib\{5F099F16-6A6E-4BBC-8BD8-98F3221D58C4}\1.0\HELPDIR\ [*]"
"HKCR\CLSID\{29F06F0C-FB7F-44A5-83CD-D41705D5C525}\ProgID\ [*]"
"HKCR\NCProv.NCProvider.1\ [*]"
"HKCR\NCProv.NCProvider\ [*]"
"HKCR\CLSID\{29F06F0C-FB7F-44A5-83CD-D41705D5C525}\VersionIndependentProgID\ [*]"
"HKCR\TypeLib\{5F099F16-6A6E-4BBC-8BD8-98F3221D58C4}\1.0\0\ [*]"
"HKCR\TypeLib\{5F099F16-6A6E-4BBC-8BD8-98F3221D58C4}\1.0\ [*]"
"HKCR\TypeLib\{5F099F16-6A6E-4BBC-8BD8-98F3221D58C4}\1.0\FLAGS\ [*]"
"HKCR\CLSID\{29F06F0C-FB7F-44A5-83CD-D41705D5C525}\InprocServer32\ [*]"
"HKCR\TypeLib\{5F099F16-6A6E-4BBC-8BD8-98F3221D58C4}\ [*]"
"HKCR\NCProv.NCProvider\CLSID\ [*]"
"HKCR\TypeLib\{5F099F16-6A6E-4BBC-8BD8-98F3221D58C4}\1.0\0\win64\ [*]"
"HKCR\NCProv.NCProvider\CurVer\ [*]"
"HKCR\CLSID\{29F06F0C-FB7F-44A5-83CD-D41705D5C525}\ [*]"
"HKCR\WBEMComLocator\CLSID\ [*]"
"HKCR\WBEMComLocator\ [*]"
"HKCR\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\ [*]"
"HKCR\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\InprocServer32\ [*]"
"HKCR\CLSID\{CD184336-9128-11D1-AD9B-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{CD184336-9128-11D1-AD9B-00C04FD8FDFF}\InprocServer32\ [*]"
"HKCR\CLSID\{443E7B79-DE31-11D2-B340-00104BCC4B4A}\InprocServer32\ [*]"
"HKCR\CLSID\{443E7B79-DE31-11D2-B340-00104BCC4B4A}\ [*]"
"HKCR\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32\ [*]"
"HKCR\CLSID\{C49E32C6-BC8B-11d2-85D4-00105A1F8304} [*]"
"HKCR\Interface\{C49E32C7-BC8B-11D2-85D4-00105A1F8304}\ [*]"
"HKCR\Interface\{C49E32C7-BC8B-11D2-85D4-00105A1F8304}\NumMethods\ [*]"
"HKCR\Interface\{C49E32C7-BC8B-11D2-85D4-00105A1F8304}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{2DB9FA90-9973-46CF-B310-9865B644699D}\ [*]"
"HKCR\Interface\{2DB9FA90-9973-46CF-B310-9865B644699D}\NumMethods\ [*]"
"HKCR\Interface\{2DB9FA90-9973-46CF-B310-9865B644699D}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{A359DEC5-E813-4834-8A2A-BA7F1D777D76}\ [*]"
"HKCR\Interface\{A359DEC5-E813-4834-8A2A-BA7F1D777D76}\NumMethods\ [*]"
"HKCR\Interface\{A359DEC5-E813-4834-8A2A-BA7F1D777D76}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{1CFABA8C-1523-11D1-AD79-00C04FD8FDFF}\ [*]"
"HKCR\Interface\{1CFABA8C-1523-11D1-AD79-00C04FD8FDFF}\NumMethods\ [*]"
"HKCR\Interface\{1CFABA8C-1523-11D1-AD79-00C04FD8FDFF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ [*]"
"HKCR\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\NumMethods\ [*]"
"HKCR\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{B1B55910-8BA0-47A5-A16E-2B733B1D987C}\ [*]"
"HKCR\Interface\{B1B55910-8BA0-47A5-A16E-2B733B1D987C}\NumMethods\ [*]"
"HKCR\Interface\{B1B55910-8BA0-47A5-A16E-2B733B1D987C}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{41AA40E6-2FBA-4E80-ADE9-34306567206D}\ [*]"
"HKCR\Interface\{41AA40E6-2FBA-4E80-ADE9-34306567206D}\NumMethods\ [*]"
"HKCR\Interface\{41AA40E6-2FBA-4E80-ADE9-34306567206D}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{F0E4EDDE-475A-498A-93D7-D4347F68A8F3}\ [*]"
"HKCR\Interface\{F0E4EDDE-475A-498A-93D7-D4347F68A8F3}\NumMethods\ [*]"
"HKCR\Interface\{F0E4EDDE-475A-498A-93D7-D4347F68A8F3}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ [*]"
"HKCR\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\NumMethods\ [*]"
"HKCR\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ [*]"
"HKCR\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\NumMethods\ [*]"
"HKCR\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ [*]"
"HKCR\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\NumMethods\ [*]"
"HKCR\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{A210BFE9-C9F7-4919-B114-0D98B3D5341E}\ [*]"
"HKCR\Interface\{A210BFE9-C9F7-4919-B114-0D98B3D5341E}\NumMethods\ [*]"
"HKCR\Interface\{A210BFE9-C9F7-4919-B114-0D98B3D5341E}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{580ACAF8-FA1C-11D0-AD72-00C04FD8FDFF}\ [*]"
"HKCR\Interface\{580ACAF8-FA1C-11D0-AD72-00C04FD8FDFF}\NumMethods\ [*]"
"HKCR\Interface\{580ACAF8-FA1C-11D0-AD72-00C04FD8FDFF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ [*]"
"HKCR\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\NumMethods\ [*]"
"HKCR\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{6C19BE32-7500-11D1-AD94-00C04FD8FDFF}\ [*]"
"HKCR\Interface\{6C19BE32-7500-11D1-AD94-00C04FD8FDFF}\NumMethods\ [*]"
"HKCR\Interface\{6C19BE32-7500-11D1-AD94-00C04FD8FDFF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{60E512D4-C47B-11D2-B338-00105A1F4AAF}\ [*]"
"HKCR\Interface\{60E512D4-C47B-11D2-B338-00105A1F4AAF}\NumMethods\ [*]"
"HKCR\Interface\{60E512D4-C47B-11D2-B338-00105A1F4AAF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ [*]"
"HKCR\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\NumMethods\ [*]"
"HKCR\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{1BE41571-91DD-11D1-AEB2-00C04FB68820}\ [*]"
"HKCR\Interface\{1BE41571-91DD-11D1-AEB2-00C04FB68820}\NumMethods\ [*]"
"HKCR\Interface\{1BE41571-91DD-11D1-AEB2-00C04FB68820}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{FD450835-CF1B-4C87-9FD2-5E0D42FDE081}\ [*]"
"HKCR\Interface\{FD450835-CF1B-4C87-9FD2-5E0D42FDE081}\NumMethods\ [*]"
"HKCR\Interface\{FD450835-CF1B-4C87-9FD2-5E0D42FDE081}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{37196B38-CCCF-11D2-B35C-00105A1F8177}\ [*]"
"HKCR\Interface\{37196B38-CCCF-11D2-B35C-00105A1F8177}\NumMethods\ [*]"
"HKCR\Interface\{37196B38-CCCF-11D2-B35C-00105A1F8177}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{92B9503D-19C3-4181-9F42-57FFC1A4BF37}\ [*]"
"HKCR\Interface\{92B9503D-19C3-4181-9F42-57FFC1A4BF37}\NumMethods\ [*]"
"HKCR\Interface\{92B9503D-19C3-4181-9F42-57FFC1A4BF37}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{31739D04-3471-4CF4-9A7C-57A44AE71956}\ [*]"
"HKCR\Interface\{31739D04-3471-4CF4-9A7C-57A44AE71956}\NumMethods\ [*]"
"HKCR\Interface\{31739D04-3471-4CF4-9A7C-57A44AE71956}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{F1E9C5B2-F59B-11D2-B362-00105A1F8177}\ [*]"
"HKCR\Interface\{F1E9C5B2-F59B-11D2-B362-00105A1F8177}\NumMethods\ [*]"
"HKCR\Interface\{F1E9C5B2-F59B-11D2-B362-00105A1F8177}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{BAC6B661-167E-4957-AD77-286AB256585E}\ [*]"
"HKCR\Interface\{BAC6B661-167E-4957-AD77-286AB256585E}\NumMethods\ [*]"
"HKCR\Interface\{BAC6B661-167E-4957-AD77-286AB256585E}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{1BE41572-91DD-11D1-AEB2-00C04FB68820}\ [*]"
"HKCR\Interface\{1BE41572-91DD-11D1-AEB2-00C04FB68820}\NumMethods\ [*]"
"HKCR\Interface\{1BE41572-91DD-11D1-AEB2-00C04FB68820}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{E245105B-B06E-11D0-AD61-00C04FD8FDFF}\ [*]"
"HKCR\Interface\{E245105B-B06E-11D0-AD61-00C04FD8FDFF}\NumMethods\ [*]"
"HKCR\Interface\{E245105B-B06E-11D0-AD61-00C04FD8FDFF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{2B322B6E-A9DF-44E3-97BF-259E3583FDA4}\ [*]"
"HKCR\Interface\{2B322B6E-A9DF-44E3-97BF-259E3583FDA4}\NumMethods\ [*]"
"HKCR\Interface\{2B322B6E-A9DF-44E3-97BF-259E3583FDA4}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ [*]"
"HKCR\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\NumMethods\ [*]"
"HKCR\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{6919DD07-1637-4611-A8A7-C16FAC5B2D53}\ [*]"
"HKCR\Interface\{6919DD07-1637-4611-A8A7-C16FAC5B2D53}\NumMethods\ [*]"
"HKCR\Interface\{6919DD07-1637-4611-A8A7-C16FAC5B2D53}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{5FBA5051-3124-4112-B723-46BFBAF1D622}\ [*]"
"HKCR\Interface\{5FBA5051-3124-4112-B723-46BFBAF1D622}\NumMethods\ [*]"
"HKCR\Interface\{5FBA5051-3124-4112-B723-46BFBAF1D622}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{88F3781C-6902-4647-9A6B-A74F450AF861}\ [*]"
"HKCR\Interface\{88F3781C-6902-4647-9A6B-A74F450AF861}\NumMethods\ [*]"
"HKCR\Interface\{88F3781C-6902-4647-9A6B-A74F450AF861}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{11CAA957-4E80-474E-A819-7FD72148ADA9}\ [*]"
"HKCR\Interface\{11CAA957-4E80-474E-A819-7FD72148ADA9}\NumMethods\ [*]"
"HKCR\Interface\{11CAA957-4E80-474E-A819-7FD72148ADA9}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{44ACA675-E8FC-11D0-A07C-00C04FB68820}\ [*]"
"HKCR\Interface\{44ACA675-E8FC-11D0-A07C-00C04FB68820}\NumMethods\ [*]"
"HKCR\Interface\{44ACA675-E8FC-11D0-A07C-00C04FB68820}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ [*]"
"HKCR\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\NumMethods\ [*]"
"HKCR\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{48FF3109-A366-4B56-B340-01FAE758BA64}\ [*]"
"HKCR\Interface\{48FF3109-A366-4B56-B340-01FAE758BA64}\NumMethods\ [*]"
"HKCR\Interface\{48FF3109-A366-4B56-B340-01FAE758BA64}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{484E3ECE-1F81-4591-B9D4-943BA13B609D}\ [*]"
"HKCR\Interface\{484E3ECE-1F81-4591-B9D4-943BA13B609D}\NumMethods\ [*]"
"HKCR\Interface\{484E3ECE-1F81-4591-B9D4-943BA13B609D}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{854D745C-6742-42C0-8BB9-01EC466B6E87}\ [*]"
"HKCR\Interface\{854D745C-6742-42C0-8BB9-01EC466B6E87}\NumMethods\ [*]"
"HKCR\Interface\{854D745C-6742-42C0-8BB9-01EC466B6E87}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{8A0DC377-A9D3-41CB-BD69-AE1FDAF2DC68}\ [*]"
"HKCR\Interface\{8A0DC377-A9D3-41CB-BD69-AE1FDAF2DC68}\NumMethods\ [*]"
"HKCR\Interface\{8A0DC377-A9D3-41CB-BD69-AE1FDAF2DC68}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{B60EF4F1-A411-462B-B51E-477CBDBB90B4}\ [*]"
"HKCR\Interface\{B60EF4F1-A411-462B-B51E-477CBDBB90B4}\NumMethods\ [*]"
"HKCR\Interface\{B60EF4F1-A411-462B-B51E-477CBDBB90B4}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{2A504CA2-CA90-4731-87BC-6E99CA2019AF}\ [*]"
"HKCR\Interface\{2A504CA2-CA90-4731-87BC-6E99CA2019AF}\NumMethods\ [*]"
"HKCR\Interface\{2A504CA2-CA90-4731-87BC-6E99CA2019AF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{E8107BDF-BAAF-4C7C-BB5F-9D732E8D8F07}\ [*]"
"HKCR\Interface\{E8107BDF-BAAF-4C7C-BB5F-9D732E8D8F07}\NumMethods\ [*]"
"HKCR\Interface\{E8107BDF-BAAF-4C7C-BB5F-9D732E8D8F07}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{04963311-C399-408E-AD51-05D01506EED0}\ [*]"
"HKCR\Interface\{04963311-C399-408E-AD51-05D01506EED0}\NumMethods\ [*]"
"HKCR\Interface\{04963311-C399-408E-AD51-05D01506EED0}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{631F7D97-D993-11D2-B339-00105A1F4AAF}\ [*]"
"HKCR\Interface\{631F7D97-D993-11D2-B339-00105A1F4AAF}\NumMethods\ [*]"
"HKCR\Interface\{631F7D97-D993-11D2-B339-00105A1F4AAF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{AC9EA02A-2C8A-4ACD-B562-D7E8EBEE8E8E}\ [*]"
"HKCR\Interface\{AC9EA02A-2C8A-4ACD-B562-D7E8EBEE8E8E}\NumMethods\ [*]"
"HKCR\Interface\{AC9EA02A-2C8A-4ACD-B562-D7E8EBEE8E8E}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{DF2373F5-EFB2-475C-AD58-3102D61967D4}\ [*]"
"HKCR\Interface\{DF2373F5-EFB2-475C-AD58-3102D61967D4}\NumMethods\ [*]"
"HKCR\Interface\{DF2373F5-EFB2-475C-AD58-3102D61967D4}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ [*]"
"HKCR\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\NumMethods\ [*]"
"HKCR\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{D8EC9CB1-B135-4F10-8B1B-C7188BB0D186}\ [*]"
"HKCR\Interface\{D8EC9CB1-B135-4F10-8B1B-C7188BB0D186}\NumMethods\ [*]"
"HKCR\Interface\{D8EC9CB1-B135-4F10-8B1B-C7188BB0D186}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{3AE0080A-7E3A-4366-BF89-0FEEDC931659}\ [*]"
"HKCR\Interface\{3AE0080A-7E3A-4366-BF89-0FEEDC931659}\NumMethods\ [*]"
"HKCR\Interface\{3AE0080A-7E3A-4366-BF89-0FEEDC931659}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{6C19BE34-7500-11D1-AD94-00C04FD8FDFF}\ [*]"
"HKCR\Interface\{6C19BE34-7500-11D1-AD94-00C04FD8FDFF}\NumMethods\ [*]"
"HKCR\Interface\{6C19BE34-7500-11D1-AD94-00C04FD8FDFF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ [*]"
"HKCR\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\NumMethods\ [*]"
"HKCR\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{CE61E841-65BC-11D0-B6BD-00AA003240C7}\ [*]"
"HKCR\Interface\{CE61E841-65BC-11D0-B6BD-00AA003240C7}\NumMethods\ [*]"
"HKCR\Interface\{CE61E841-65BC-11D0-B6BD-00AA003240C7}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{25411283-46FC-4326-8DF2-FF5D34B2DFEF}\ [*]"
"HKCR\Interface\{25411283-46FC-4326-8DF2-FF5D34B2DFEF}\NumMethods\ [*]"
"HKCR\Interface\{25411283-46FC-4326-8DF2-FF5D34B2DFEF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{2C9273E0-1DC3-11D3-B364-00105A1F8177}\ [*]"
"HKCR\Interface\{2C9273E0-1DC3-11D3-B364-00105A1F8177}\NumMethods\ [*]"
"HKCR\Interface\{2C9273E0-1DC3-11D3-B364-00105A1F8177}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{37196B39-CCCF-11D2-B35C-00105A1F8177}\ [*]"
"HKCR\Interface\{37196B39-CCCF-11D2-B35C-00105A1F8177}\NumMethods\ [*]"
"HKCR\Interface\{37196B39-CCCF-11D2-B35C-00105A1F8177}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ [*]"
"HKCR\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\NumMethods\ [*]"
"HKCR\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{6963B029-B969-40AA-9180-2B2F84075973}\ [*]"
"HKCR\Interface\{6963B029-B969-40AA-9180-2B2F84075973}\NumMethods\ [*]"
"HKCR\Interface\{6963B029-B969-40AA-9180-2B2F84075973}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{755F9DA7-7508-11D1-AD94-00C04FD8FDFF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{755F9DA7-7508-11D1-AD94-00C04FD8FDFF}\NumMethods\ [*]"
"HKCR\Interface\{755F9DA7-7508-11D1-AD94-00C04FD8FDFF}\ [*]"
"HKCR\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ [*]"
"HKCR\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\NumMethods\ [*]"
"HKCR\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{E246107A-B06E-11D0-AD61-00C04FD8FDFF}\ [*]"
"HKCR\Interface\{E246107A-B06E-11D0-AD61-00C04FD8FDFF}\NumMethods\ [*]"
"HKCR\Interface\{E246107A-B06E-11D0-AD61-00C04FD8FDFF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{631F7D96-D993-11D2-B339-00105A1F4AAF}\ [*]"
"HKCR\Interface\{631F7D96-D993-11D2-B339-00105A1F4AAF}\NumMethods\ [*]"
"HKCR\Interface\{631F7D96-D993-11D2-B339-00105A1F4AAF}\ProxyStubClsid32\ [*]"
"HKCR\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ [*]"
"HKCR\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\NumMethods\ [*]"
"HKCR\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\ [*]"
"HKLM\Software\Microsoft\ODBC\ODBC.INI\ [*]"
"HKLM\Software\Microsoft\ODBC\ [*]"
"HKLM\Software\Microsoft\ODBC\ODBC.INI\ODBC Data Sources\ [*]"
"HKLM\Software\Microsoft\ODBC\ODBCINST.INI\ODBC Drivers\ [*]"
"HKLM\Software\Microsoft\ODBC\ODBCINST.INI\ [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance\ [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\ [*]"
"HKCR\CLSID\{B0A2AB46-F612-4469-BEC4-7AB038BC476C}\InprocServer32\ [*]"
"HKCR\CLSID\{B0A2AB46-F612-4469-BEC4-7AB038BC476C}\ [*]"
"HKCR\CLSID\{4CFC7932-0F9D-4BEF-9C32-8EA2A6B56FCB}\InprocServer32\ [*]"
"HKCR\CLSID\{4CFC7932-0F9D-4BEF-9C32-8EA2A6B56FCB}\NotInsertable\ [*]"
"HKCR\CLSID\{4CFC7932-0F9D-4BEF-9C32-8EA2A6B56FCB}\ [*]"
"HKCR\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\ [*]"
"HKCR\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\InprocServer32\ [*]"
"HKCR\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\ [*]"
"HKCR\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\ [*]"
"HKCR\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\ [*]"
"HKCR\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\InprocServer32\ [*]"
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WbemPerf [*]"
"HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\WinMgmt [*]"
"HKCR\CLSID\{C10B4771-4DA0-11D2-A2F5-00C04F86FB7D}\ [*]"
"HKCR\CLSID\{6DAF9757-2E37-11D2-AEC9-00C04FB68820}\ [*]"
"HKCR\CLSID\{D215781D-019E-4FA0-903D-0CDCDE13A4F5}\InProcServer32\ [*]"
"HKCR\CLSID\{D215781D-019E-4FA0-903D-0CDCDE13A4F5}\ [*]"
"HKCR\CLSID\{6DAF9757-2E37-11D2-AEC9-00C04FB68820}\InprocServer32\ [*]"
"HKCR\CLSID\{C10B4771-4DA0-11D2-A2F5-00C04F86FB7D}\InprocServer32\ [*]"
"HKCR\CLSID\{49BD2028-1523-11D1-AD79-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{49BD2028-1523-11D1-AD79-00C04FD8FDFF}\LocalServer32\ [*]"
"HKCR\Appid\{49BD2028-1523-11D1-AD79-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ [*]"
"HKCR\AppID\winmgmt [*]"
"HKCR\AppID\{63A53A38-004F-489B-BD61-96B5EEFADC04} [*]"
"HKCR\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} [*]"
"HKCR\AppID\{D215781D-019E-4FA0-903D-0CDCDE13A4F5} [*]"
"HKCR\CLSID\{72967901-68EC-11D0-B729-00AA0062CBB7}\ [*]"
"HKCR\CLSID\{72967901-68EC-11D0-B729-00AA0062CBB7}\InprocServer32\ [*]"
"HKCR\CLSID\{72967903-68EC-11D0-B729-00AA0062CBB7}\ [*]"
"HKCR\CLSID\{72967903-68EC-11D0-B729-00AA0062CBB7}\InprocServer32\ [*]"
"HKCR\CLSID\{F00B4404-F8F1-11CE-A5B6-00AA00680C3F}\ [*]"
"HKCR\CLSID\{F00B4404-F8F1-11CE-A5B6-00AA00680C3F}\InprocServer32\ [*]"
"HKCR\CLSID\{FA77A74E-E109-11D0-AD6E-00C04FD8FDFF}\ [*]"
"HKCR\CLSID\{FA77A74E-E109-11D0-AD6E-00C04FD8FDFF}\InprocServer32\ [*]"
"HKCR\CLSID\{FE9AF5C0-D3B6-11CE-A5B6-00AA00680C3F}\ [*]"
"HKCR\CLSID\{FE9AF5C0-D3B6-11CE-A5B6-00AA00680C3F}\InprocServer32\ [*]"
"HKLM\SOFTWARE\Microsoft\WBEM\TextSource\1\ [*]"
"HKLM\SOFTWARE\Microsoft\WBEM\xml\Decoders\ [*]"
"HKLM\SOFTWARE\Microsoft\WBEM\xml\Encoders\ [*]"
"HKLM\SOFTWARE\Microsoft\WBEM\TextSource\2\ [*]"
"HKCR\CLSID\{C4819C8D-9AB8-4B2F-B8AE-C77DABF553D5}\ [*]"
"HKCR\CLSID\{C4819C8D-9AB8-4B2F-B8AE-C77DABF553D5}\InprocServer32\ [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\Applications [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\{00000000-0000-0000-0000-000000000000} [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\Protocols [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\wmiutils.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\wsmres.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\appidapi.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\blbres.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\csrsrv.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\CertEnroll.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\cryptxml.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\dmutil.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\fltLib.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\eapphost.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\EAPQEC.DLL [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\iphlpsvc.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\kpssvc.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\gpprefcl.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\imapi2.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\iologmsg.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\iscsidsc.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\microsoft-windows-kernel-power-events.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\MPSSVC.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\msxml6r.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\ncbservice.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\pwrshplugin.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\rpcrt4.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\user32.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\storagewmi.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\vdsutil.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\vmbusres.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\vmicres.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\vdsdyn.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\vmstorfltres.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\tapi3.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\sppc.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\vsstrace.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\slc.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\vdsbas.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\urlmon.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\Syncreg.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\sysmain.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\sxs.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\ws2_32.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\wsbappres.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\WSClient.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\winbio.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\wsbonline.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\ErrorResources\wimgapi.dll [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\Protocols\WMIDCOM [*]"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Management Infrastructure\Protocols\WMIDCOM\1.0 [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell.Workflow [*]"
"HKCR\.cdxml [*]"
"HKCR\Microsoft.PowerShellCmdletDefinitionXML.1 [*]"
"HKCR\.pssc [*]"
"HKCR\Microsoft.PowerShellSessionConfiguration.1 [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell\3 [*]"
"HKLM\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell [*]"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32 [*]"
"HKCR\Typelib\{F010BE25-296D-4036-980F-5A0669A17577}\1.0\0\win32\ [*]"

© 2026 UnknownSec