WireGuard Log - Registry Items

Key Operation Value Data Type Old Data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-
1-5-18\Components\32D8053C2633EC74290223B1BDA1A1CC\ Created
1-5-18\Components\32D8053C2633EC74290223B1BDA1A1CC\ Set
EC97BDF2391593A428BB0E1085CC5133 C:\Program Files\WireGuard\wireguard.exe
REG_SZ
1-5-18\Components\644FC0453CCF25449BBFBEC420872015\ Created
1-5-18\Components\644FC0453CCF25449BBFBEC420872015\ Set
EC97BDF2391593A428BB0E1085CC5133 C:\Program Files\WireGuard\wg.exe REG_SZ
1-5-18\Products\EC97BDF2391593A428BB0E1085CC5133\ Created
1-5-18\Products\EC97BDF2391593A428BB0E1085CC5133\InstallProperties\ Created
1-5-18\Products\EC97BDF2391593A428BB0E1085CC5133\InstallProperties\ Set
LocalPackage C:\WINDOWS\Installer\27187e0.msi REG_SZ
AuthorizedCDFPrefix REG_SZ
Comments REG_SZ
Contact REG_SZ
DisplayVersion 0.5.3 REG_SZ
HelpLink REG_SZ
HelpTelephone REG_SZ
InstallDate 20230731 REG_SZ
InstallLocation REG_SZ
InstallSource C:\WINDOWS\Temp\ REG_SZ
ModifyPath MsiExec.exe /X{2FDB79CE-5193-4A39-82BB-E00158CC1533} REG_EXPAND_SZ
NoModify 1 REG_DWORD
Publisher WireGuard LLC REG_SZ
Readme REG_SZ
1-5-18\Products\EC97BDF2391593A428BB0E1085CC5133\InstallProperties\ Set Size
REG_SZ
EstimatedSize 8132 REG_DWORD
UninstallString MsiExec.exe /X{2FDB79CE-5193-4A39-82BB-E00158CC1533}
REG_EXPAND_SZ
URLInfoAbout https://www.wireguard.com/ REG_SZ
URLUpdateInfo REG_SZ
VersionMajor 0 REG_DWORD
VersionMinor 5 REG_DWORD
WindowsInstaller 1 REG_DWORD
Version 327683 REG_DWORD
Language 1033 REG_DWORD
DisplayName WireGuard REG_SZ
1-5-18\Products\EC97BDF2391593A428BB0E1085CC5133\Usage\ Created
1-5-18\Products\EC97BDF2391593A428BB0E1085CC5133\Features\ Created
1-5-18\Products\EC97BDF2391593A428BB0E1085CC5133\Features\ Set
WireGuardFeature BDkjg$w_)?!Wzg+ZKpZjoJ2$C%{Uz9lZKf@K}*&B REG_SZ
1-5-18\Products\EC97BDF2391593A428BB0E1085CC5133\Patches\ Created
1-5-18\Products\EC97BDF2391593A428BB0E1085CC5133\Patches\ Set AllPatches
REG_SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\
Set C:\Program Files\WireGuard\ REG_SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\
Set C:\WINDOWS\Installer\{2FDB79CE-5193-4A39-82BB-E00158CC1533}\ REG_SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\
UpgradeCodes\5AD1A5E563ABD40429CE1450D0C197C9\ Created
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\
UpgradeCodes\5AD1A5E563ABD40429CE1450D0C197C9\ Set
EC97BDF2391593A428BB0E1085CC5133 REG_SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2FDB79CE-
5193-4A39-82BB-E00158CC1533}\ Created
5193-4A39-82BB-E00158CC1533}\ Set AuthorizedCDFPrefix REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set Comments REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set Contact REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set DisplayVersion 0.5.3 REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set HelpLink REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set HelpTelephone REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set InstallDate 20230731 REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set InstallLocation REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set InstallSource C:\WINDOWS\Temp\ REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set ModifyPath MsiExec.exe /X{2FDB79CE-5193-
4A39-82BB-E00158CC1533} REG_EXPAND_SZ
5193-4A39-82BB-E00158CC1533}\ Set NoModify 1 REG_DWORD
5193-4A39-82BB-E00158CC1533}\ Set Publisher WireGuard LLC REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set Readme REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set Size REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set EstimatedSize 8132 REG_DWORD
5193-4A39-82BB-E00158CC1533}\ Set UninstallString MsiExec.exe /X{2FDB79CE-
5193-4A39-82BB-E00158CC1533} REG_EXPAND_SZ
5193-4A39-82BB-E00158CC1533}\ Set URLInfoAbout https://www.wireguard.com/
REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set URLUpdateInfo REG_SZ
5193-4A39-82BB-E00158CC1533}\ Set VersionMajor 0 REG_DWORD
5193-4A39-82BB-E00158CC1533}\ Set VersionMinor 5 REG_DWORD
5193-4A39-82BB-E00158CC1533}\ Set WindowsInstaller 1 REG_DWORD
5193-4A39-82BB-E00158CC1533}\ Set Version 327683 REG_DWORD
5193-4A39-82BB-E00158CC1533}\ Set Language 1033 REG_DWORD
5193-4A39-82BB-E00158CC1533}\ Set DisplayName WireGuard REG_SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\ARP\ Set 157
Software\Microsoft\Windows\CurrentVersion\Uninstall {2FDB79CE-5193-4A39-82BB-
E00158CC1533} MsiExec.exe /X{2FDB79CE-5193-4A39-82BB-E00158CC1533} REG_MULTI_SZ
Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall {a9334a30-de6e-
40f7-a861-18b29a7d5d19} "C:\ProgramData\Package Cache\{a9334a30-de6e-40f7-a861-
18b29a7d5d19}\nitro_pro13.exe" /uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\
Set 418A073AA3BC1C75
f4c0000000404010ed0200029966045f9a24dadc14e7dd16675926fda61894da18e882295e2f29bb852
a6b6c1be8c51c31312d28c71df18d2df8452e9f672f168c11048a92104c8e21727ab2179338117c06f1
1a2d4221b779811be0a621bf6b01ec33022018f20213ac312278ce022a773123a85223116e1237af812
46b46124acc7024c18b1254f6e1264ba81267f9d22945112969e4129a89e22bd8e512c9f7a22fa8ff13
1484f0329f7a2361ee1136e9d20388a323e5bed13fdcd141bc3a242757b242822e242c54d245668a245
6db604677301483bdb148484c248c24f049cba3149da1b24adee114b2a9114b6ee314bf47424d3ed914
e1faa24ed77824fa53325020e01508f0251413e251b23425355e4154dfe2154e0a4255ffc01564a6057
7af81578a1b25792e257ad1215a28925af78325b12325c359815c732025ef05f261d98c161e99b26229
511639677063ec7426454e265a69e065ed1d265f4a6267ba6b269592a269b99226a61e816a736516a95
e216bf42b26d239026f8e5b272701b272a242172cd9917321fb0785dd3179f99c27a479427b90eb17c8
2c917d904a17df1e817e104417e5030281b069282fb2a283f160084e11e285311b285e341287d514287
f025187fc38288d13328aa7fb18beef208bfd6e18c1d8828c8f9428e48b018e78a209123d3092591609
28271092f6ef1931352947091295857b29b4a7229c429b29c4d2229ce0a809d9d9209f83142a2560a7c
2331a7e23e2a8723f2a8ea4e2a918e51aa2e831aab1fc1ab9fc91ac9322ad2db81af9c22b09e972b2ba
fc1b373202b4d7c51b566122b7e23e2b8ea892b9b92a2b9fa772ba8c6f1baaea72beaf8a2c079a0c2d9
52c36d810c399f30c4b4a82c75dd70c9ffc31ca23b70cb4ea02cc32922cc49560cdba832ce99e01d017
560d0f6e41d1e19f2d382610d6ef582d7d2c51d7e86c2d8e79c1d940e91dab731daff841dbb95d2dbe2
3e2deef372e118252e193b01e21b560e2b4631e3b0642e469c90e5e0392e61d282e6bd392e7e23e2eb3
b942ec63c51ee9322eeaf9b2efa9992f0e0b60f0ed3e2f1ad3d1f1d8422f2e932f38db0f31e5c2f37d6
a2f3a1e50f7125e0f7ed6a0f7ff9a2f9dfa11fbca22fe784f2fee2631ff10dd150600014669e24bfc6d
25e61b028b28942dcef8e240401006041ae0682c900a5adcf0ce99e01 REG_BINARY
f3c0000000404010ed0200029966045f9a24dadc14e7dd16675926fda61894da18e882295e2f29bb852
a6b6c1be8c51c31312d28c71df18d2df8452e9f672f168c11048a92104c8e21727ab2179338117c06f1
1a2d4221b779811be0a621bf6b01ec33022018f20213ac312278ce022a773123a85223116e1237af812
46b46124acc7024c18b1254f6e1264ba81267f9d22945112969e4129a89e22bd8e512c9f7a22fa8ff13
1484f0329f7a2361ee1136e9d20388a323e5bed13fdcd141bc3a242757b242822e242c54d245668a245
6db604677301483bdb148484c248c24f049cba3149da1b24adee114b2a9114b6ee314bf47424d3ed914
e1faa24ed77824fa53325020e01508f0251413e251b23425355e4154dfe2154e0a4255ffc01564a6057
7af81578a1b25792e257ad1215a28925af78325b12325c359815c732025ef05f261d98c161e99b26229
511639677063ec7426454e265a69e065ed1d265f4a6267ba6b269592a269b99226a61e816a736516a95
e216bf42b26d239026f8e5b272701b272a242172cd9917321fb0785dd3179f99c27a479427b90eb17c8
2c917d904a17df1e817e104417e5030281b069282fb2a283f160084e11e285311b285e341287d514287
f025187fc38288d13328aa7fb18beef208bfd6e18c1d8828c8f9428e48b018e78a209123d3092591609
28271092f6ef1931352947091295857b29b4a7229c429b29c4d2229ce0a809d9d9209f83142a2560a7c
2331a7e23e2a8723f2a8ea4e2a918e51aa2e831aab1fc1ab9fc91ac9322ad2db81af9c22b09e972b2ba
fc1b373202b4d7c51b566122b7e23e2b8ea892b9b92a2b9fa772ba8c6f1baaea72beaf8a2c079a0c2d9
52c36d810c399f30c4b4a82c75dd70c9ffc31ca23b70cb4ea02cc32922cc49560cdba832ce99e01d017
560d0f6e41d1e19f2d382610d6ef582d7d2c51d7e86c2d8e79c1d940e91dab731daff841dbb95d2dbe2
3e2deef372e118252e193b01e21b560e2b4631e3b0642e469c90e5e0392e61d282e6bd392e7e23e2eb3
b942ec63c51ee9322eeaf9b2efa9992f0e0b60f0ed3e2f1ad3d1f1d8422f2e932f38db0f31e5c2f37d6
a2f3a1e50f7125e0f7ed6a0f7ff9a2f9dfa11fbca22fe784f2fee2631ff10dd140600014669e24bfc6d
28b28942dcef8e240401006041ae0682c900a5adcf0ce99e01
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\
Set 418A073AA3BC3475
8ecf000000404012100000700079534427010002800007d7507000276b69140003dd73419a00056737d
0840006b507e0f2000cbf66084000e6c53101064000f000cd67c515065000550001c955c09300065a69
e076000a2560d62900e6c5310bf400f0e0b602066000c600065a69e054000a2560106700022000a2560
10680006e000a2560106900027b0065a69e01070000800065a69e01071000300065a69e010720005ad0
0a25601073000c600065a69e01077000900065a69e010780007200065a69e0107d0008200065a69e010
7f000b600065a69e01081000410065a69e0 REG_BINARY
8dcf000000404012100000700079534427010002800007d7507000276b69140003dd73419900056737d
0840006b507e0f2000cbf66084000e6c53101064000f000cd67c515065000550001c955c09300065a69
e076000a2560d62900e6c5310bf400f0e0b602066000c600065a69e054000a2560106700022000a2560
10680006e000a2560106900027b0065a69e01070000800065a69e01071000300065a69e010720005ad0
0a25601073000c600065a69e01077000900065a69e010780007200065a69e0107d0008200065a69e010
7f000b600065a69e01081000410065a69e0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\
EC97BDF2391593A428BB0E1085CC5133\ Created
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\
EC97BDF2391593A428BB0E1085CC5133\ Set WireGuardFeature REG_SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\
EC97BDF2391593A428BB0E1085CC5133\ Created
EC97BDF2391593A428BB0E1085CC5133\ Set ProductName WireGuard REG_SZ
EC97BDF2391593A428BB0E1085CC5133\ Set PackageCode
95F92915D6255534F9EA3FE06731F9BB REG_SZ
EC97BDF2391593A428BB0E1085CC5133\ Set Language 1033 REG_DWORD
EC97BDF2391593A428BB0E1085CC5133\ Set Version 327683 REG_DWORD
EC97BDF2391593A428BB0E1085CC5133\ Set Assignment 1 REG_DWORD
EC97BDF2391593A428BB0E1085CC5133\ Set AdvertiseFlags 388 REG_DWORD
EC97BDF2391593A428BB0E1085CC5133\ Set ProductIcon C:\WINDOWS\Installer\
{2FDB79CE-5193-4A39-82BB-E00158CC1533}\wireguard.ico REG_SZ
EC97BDF2391593A428BB0E1085CC5133\ Set InstanceType 0 REG_DWORD
EC97BDF2391593A428BB0E1085CC5133\ Set AuthorizedLUAApp 0 REG_DWORD
EC97BDF2391593A428BB0E1085CC5133\ Set DeploymentFlags 3 REG_DWORD
EC97BDF2391593A428BB0E1085CC5133\ Set Clients : REG_MULTI_SZ
EC97BDF2391593A428BB0E1085CC5133\SourceList\ Created
EC97BDF2391593A428BB0E1085CC5133\SourceList\ Set PackageName
7ee7436d24f863fe208dbf422d76ff8d40cc818a377610b9ea51e70f66658a7d REG_SZ
EC97BDF2391593A428BB0E1085CC5133\SourceList\ Set LastUsedSource n;1;C:\
WINDOWS\Temp\ REG_EXPAND_SZ
EC97BDF2391593A428BB0E1085CC5133\SourceList\Net\ Created
EC97BDF2391593A428BB0E1085CC5133\SourceList\Net\ Set 1 C:\WINDOWS\Temp\
REG_EXPAND_SZ
EC97BDF2391593A428BB0E1085CC5133\SourceList\Media\ Created
EC97BDF2391593A428BB0E1085CC5133\SourceList\Media\ Set 1 ; REG_SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\
5AD1A5E563ABD40429CE1450D0C197C9\ Created
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\
5AD1A5E563ABD40429CE1450D0C197C9\ Set EC97BDF2391593A428BB0E1085CC5133
REG_SZ
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\
Set GlobalAssocChangedCounter 3 REG_DWORD 2
HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Config\internal\
Set NextAutoInc 3933 REG_BINARY 393300
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-21-
4052716965-1104184976-741843801-1001\ Set \Device\HarddiskVolume3\Windows\
System32\dllhost.exe 7aa22ce8a0c3d910000000000002000 REG_BINARY
57884cd18dc3d910000000000002000
4052716965-1104184976-741843801-1001\ Set \Device\HarddiskVolume3\
RevoUninstallerPro\x64\RevoAppBar.exe f5f312d2a0c3d910000000000002000
REG_BINARY 871350d0a0c3d910000000000002000
4052716965-1104184976-741843801-1001\ Set SequenceNumber 130 REG_DWORD
127
4052716965-1104184976-741843801-1001\ Set \Device\HarddiskVolume3\Users\
regman\Downloads\wireguard-installer.exe 84822be6a0c3d910000000000002000
REG_BINARY
4052716965-1104184976-741843801-1001\ Set \Device\HarddiskVolume3\Windows\
System32\msiexec.exe 696f21e6a0c3d910000000000002000 REG_BINARY
9f2234adedc1d910000000000002000
4052716965-1104184976-741843801-1001\ Set \Device\HarddiskVolume3\Program
Files\WireGuard\wireguard.exe 64b6e4e7a0c3d910000000000002000 REG_BINARY
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-18\
Set \Device\HarddiskVolume3\Windows\System32\msiexec.exe
696f21e6a0c3d910000000000002000 REG_BINARY e6b260eec1d910000000000002000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WireGuardManager\ Created
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WireGuardManager\ Set Type
16 REG_DWORD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WireGuardManager\ Set Start
2 REG_DWORD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WireGuardManager\ Set
ErrorControl 1 REG_DWORD
ImagePath "C:\Program Files\WireGuard\wireguard.exe" /managerservice
REG_EXPAND_SZ
DisplayName WireGuard Manager REG_SZ
ObjectName LocalSystem REG_SZ
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\ Set
PATH C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Program Files\
Amazon Corretto\jdk19.0.2_7\bin;C:\Program Files\Amazon Corretto\jre8\bin;
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\
System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files\
Process Lasso\;C:\Program Files (x86)\Microsoft SQL Server\150\DTS\Binn\;C:\script\
c\bin;C:\script\perl\bin;C:\script\perl\site\bin;C:\Program Files\Docker\Docker\
resources\bin;C:\ProgramData\DockerDesktop\version-bin;C:\Program Files (x86)\
Microsoft SQL Server\150\Tools\Binn\;C:\Program Files\Microsoft SQL Server\150\
Tools\Binn\;C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\
Binn\;C:\Program Files\Microsoft SQL Server\150\DTS\Binn\;C:\Program Files (x86)\
Microsoft SQL Server\160\DTS\Binn\;C:\Program Files\Azure Data Studio\bin;C:\
Program Files\PowerShell\7\;C:\Program Files\WireGuard\ REG_EXPAND_SZ C:\
Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Program Files\Amazon
Corretto\jdk19.0.2_7\bin;C:\Program Files\Amazon Corretto\jre8\bin;%SystemRoot%\
system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\
WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files\Process
Lasso\;C:\Program Files (x86)\Microsoft SQL Server\150\DTS\Binn\;C:\script\c\
bin;C:\script\perl\bin;C:\script\perl\site\bin;C:\Program Files\Docker\Docker\
resources\bin;C:\ProgramData\DockerDesktop\version-bin;C:\Program Files (x86)\
Microsoft SQL Server\150\Tools\Binn\;C:\Program Files\Microsoft SQL Server\150\
Tools\Binn\;C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\
Binn\;C:\Program Files\Microsoft SQL Server\150\DTS\Binn\;C:\Program Files (x86)\
Microsoft SQL Server\160\DTS\Binn\;C:\Program Files\Azure Data Studio\bin;C:\
Program Files\PowerShell\7\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\ Set
StringCacheGeneration 473 REG_DWORD 471
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-
08002be10318}\ Set LastDeleteDate e66ff7e7a0c3d91 REG_BINARY
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ROOT\ Deleted
HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\TIP\AggregateResults\ Set data
cfaea5110080f5c467000020000000d9a7a811030ec3f46f000090300a00049a8a8112305c4614a6000
02a00024000d1a8a81123064b6561100006d1300e000d1a8a811240fb3b54eb0000ba30019000c25cab
13050cfa1db1e0000100077610023acad12240546dd0b40000100025000affbb911008055161afb0000
100026f60084ec31100806938f310000100000004428c3110080469996a20000c500beee004428c3130
040efd5a1db000010007d1004428c314010541f4af400007000000043ec8110a0fc89bffc00002000c2
00043ec8110b0654c22200002000ad10043ec81401094b12f2d00002000c00006597c9112080eb47f5d
000002000c61002c6d8110408a1488b400008000e512002c6d812010073f1d26d00004000b9e00823fd
91100806cc91420000200074000823fd91401022f8a52200002000710004245d9112507177b2f300004
0007d1e004245d911070436cb73f000030003819004245d9110806413a63500005000923300f3ced911
0080e138f4b000010009f0009f49dd11008045734be10000e00000006a44df11008054528c5d0000100
04e2f00a17edf130b0a676cac90000100022009178e1110080df19d73200002b000ad00081f7e1117f0
80cffd5c73000010009030081f7e114010c177129c0000c32009e1400c123e21100808fcdf2c0000100
058100addbe311008033784279000010008c000b7d2e411000dd78932000035000d5200ec9be5110080
6e4c67b60000100020007fe9e9110080a5b9b0290000d0001c2000c527eb1100804b8d54fb00003000d
50008c5ff21103025b04d21000010005000babf311000248cdfd40000a000321c006efcf31101079586
e9900003d0001432006efcf311020e2d270bf0000c70004152006efcf3110304b4d73e500001659002d
77306efcf3110501d427831000013000e43006efcf3110080105e37360000d430008719003fef411008
0e58c865c0000c9400ed2900ee8ff81100809096e6c20000c000dd9006289fd110080cc449ae0000100
0e90007489fd120205993a370000100080003d4a6210080c39240f00000e00084200564a6217f080784
a674b0000100064500bfde821008065b49d6b000023000fe005f3711210080856d77ff0000200035300
d2ef142100803c97c1700003000ab1006d3816210080738b74c7000010008d30037dd1b23017407838a
4be0000100042d00a41027217f08026fb9f90000a700069600bcf430210080be9498180000100042120
023f73021208091e6e45f000010003000e6ce332100808ef8219000010001000aa23421108014b450ca
000020002d000c752342100806d70b1f6000010006000b65b3421008058479dc8000020007d0006c973
4210080ee1839b9000050000000a8e38212080f269bf1a000010009000144382100804fe56b76000010
004c4003130392101016d2233a0000801004440031303921020ad57211400003000fe80031303923014
0ac788b5600001000596b0031303923014401b0ab44000010003795e409a4839210106d537548000010
00100092b13d2110807c27f6310000100085100dd9140210080e3e8517000001000280008ac04024020
41e1ce6000047000320007d3d4121020b1b246d6000090006a4007d3d4121030483844b000009000861
0005f304221008085a02cfe000010000000333942210080a1b1db3f00003000d3600a1f44210080ef87
caef00001000000029564521000f7519cdd0000a000ac3a00b9be452100808712a98300001000481007
73846217f50101e3ea300001000b000d6f47210080f82c30d1000010000000b4e747210206448b5c000
020004000487c4d210080127a123700003f0007f0008411552102034a7a6b1000010004000be5655210
080e0946b48000010003300050345922040ab9d207c00001b00057390050345923020d6c8482100001a
000a81a0093fe592121098fbb9d600001c0000000477f61210080ed3b2446000050009000b6ae612304
0b82f9da00003000851009e2664211080c0a21113000010000000579264210080fd299895000010002e
13009aaf6821050c99682fa00001000b000d9586f2104083c4de7f00004b000f5220048c17321008012
a5b518000030008000f3f073210080e1bd40cd00008300022000ff4089210080252a784000009eb00f5
1500ff408923004026ccd655000060003000461494210080682b516c00001000b17200
REG_BINARY
cfaea5110080f5c467000020000000d9a7a811030ec3f46f00008f300a00049a8a8112305c4614a6000
02a00024000d1a8a81123064b6561100006d1300e000d1a8a811240fb3b54eb0000b930019000c25cab
13050cfa1db1e0000100077610023acad12240546dd0b40000100025000affbb911008055161afb0000
100026f60084ec31100806938f310000100000004428c3110080469996a20000c500beee004428c3130
040efd5a1db000010007d1004428c314010541f4af400007000000043ec8110a0fc89bffc00002000c2
00043ec8110b0654c22200002000ad10043ec81401094b12f2d00002000c00006597c9112080eb47f5d
000002000c61002c6d8110408a1488b400008000e512002c6d812010073f1d26d00004000b9e00823fd
91100806cc91420000200074000823fd91401022f8a52200002000710004245d9112507177b2f300004
0007d1e004245d911070436cb73f000030003819004245d9110806413a63500005000923300f3ced911
0080e138f4b000010009f0009f49dd11008045734be10000e00000006a44df11008054528c5d0000100
04e2f00a17edf130b0a676cac90000100022009178e1110080df19d73200002b000ad00081f7e1117f0
80cffd5c73000010009030081f7e114010c177129c0000c32009e1400c123e21100808fcdf2c0000100
058100addbe311008033784279000010008c000b7d2e411000dd78932000035000d5200ec9be5110080
6e4c67b60000100020007fe9e9110080a5b9b0290000d0001c2000c527eb1100804b8d54fb00003000d
50008c5ff21103025b04d21000010005000babf311000248cdfd40000a000321c006efcf31101079586
e9900003d0001432006efcf311020e2d270bf0000c70004152006efcf3110304b4d73e500001659002d
77306efcf3110501d427831000013000e43006efcf3110080105e37360000d430008719003fef411008
0e58c865c0000c9400ed2900ee8ff81100809096e6c20000c000dd9006289fd110080cc449ae0000100
0e90007489fd120205993a370000100080003d4a6210080c39240f00000e00084200564a6217f080784
a674b0000100064500bfde821008065b49d6b000023000fe005f3711210080856d77ff0000200035300
d2ef142100803c97c1700003000ab1006d3816210080738b74c7000010008d30037dd1b23017407838a
4be0000100042d00a41027217f08026fb9f90000a700069600bcf430210080be9498180000100042120
023f73021208091e6e45f000010003000e6ce332100808ef8219000010001000aa23421108014b450ca
000020002d000c752342100806d70b1f6000010006000b65b3421008058479dc8000020007d0006c973
4210080ee1839b9000050000000a8e38212080f269bf1a000010009000144382100804fe56b76000010
004c4003130392101016d2233a0000801004440031303921020ad57211400003000fe80031303923014
0ac788b5600001000596b0031303923014401b0ab44000010003795e409a4839210106d537548000010
00100092b13d2110807c27f6310000100085100dd9140210080e3e8517000001000280008ac04024020
41e1ce6000047000320007d3d4121020b1b246d6000090006a4007d3d4121030483844b000009000861
0005f304221008085a02cfe000010000000333942210080a1b1db3f00003000d3600a1f44210080ef87
caef00001000000029564521000f7519cdd0000a000ac3a00b9be452100808712a98300001000481007
73846217f50101e3ea300001000b000d6f47210080f82c30d1000010000000b4e747210206448b5c000
020004000487c4d210080127a123700003f0007f0008411552102034a7a6b1000010004000be5655210
080e0946b48000010003300050345922040ab9d207c00001b00057390050345923020d6c8482100001a
000a81a0093fe592121098fbb9d600001c0000000477f61210080ed3b2446000050009000b6ae612304
0b82f9da00003000851009e2664211080c0a21113000010000000579264210080fd299895000010002e
13009aaf6821050c99682fa00001000b000d9586f2104083c4de7f00004b000f5220048c17321008012
a5b518000030008000f3f073210080e1bd40cd00008300022000ff4089210080252a784000009eb00f5
1500ff408923004026ccd655000060003000461494210080682b516c00001000b17200
HKEY_USERS\S-1-5-21-4052716965-1104184976-741843801-1001\Software\ESET\ESET
Security\CurrentVersion\Plugins\01000200\ Set ProxyLastPrecache 0
REG_QWORD 0
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d7\ Deleted
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d7\52C64B7E\
Deleted
Deleted @%SystemRoot%\System32\ci.dll,-100 REG_NONE Isolated User Mode
(IUM)
Deleted @%SystemRoot%\System32\ci.dll,-101 REG_NONE Enclave
Deleted @%SystemRoot%\system32\dnsapi.dll,-103 REG_NONE Domain Name
System (DNS) Server Trust
Deleted @%SystemRoot%\System32\fveui.dll,-843 REG_NONE BitLocker Drive
Encryption
Deleted @%SystemRoot%\System32\fveui.dll,-844 REG_NONE BitLocker Data
Recovery Agent
Deleted @%SystemRoot%\System32\wuaueng.dll,-400 REG_NONE Windows
Update
Deleted @%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124
REG_NONE Document Encryption
Deleted @%SystemRoot%\system32\NgcRecovery.dll,-100 REG_NONE Windows
Hello Recovery Key Encryption
Deleted @C:\WINDOWS\System32\msimsg.dll,-34 REG_NONE Windows Installer
Package
Deleted @C:\WINDOWS\system32\windows.storage.dll,-10152 REG_NONE File
folder
Deleted @C:\WINDOWS\system32\Taskmgr.exe,-32420 REG_NONE Task Manager
Deleted @C:\WINDOWS\system32\mstsc.exe,-4000 REG_NONE Remote Desktop
Connection
Deleted @%systemroot%\system32\FirewallControlPanel.dll,-12122 REG_NONE
Windows Defender Firewall
Deleted @Winlangdb.dll,-1121 REG_NONE English (United States)
Deleted @%SystemRoot%\system32\powrprof.dll,-15 REG_NONE Balanced
Deleted @%SystemRoot%\system32\powrprof.dll,-1405 REG_NONE Better
Battery-life Overlay
Deleted @%SystemRoot%\system32\powrprof.dll,-1401 REG_NONE High
Performance Overlay
Deleted @%SystemRoot%\system32\powrprof.dll,-1403 REG_NONE Max
Performance Overlay
Deleted @%SystemRoot%\system32\wpnservice.dll,-1 REG_NONE Windows Push
Notifications System Service
Deleted @%systemroot%\system32\usermgr.dll,-100 REG_NONE User Manager
Deleted @%SystemRoot%\system32\audiosrv.dll,-200 REG_NONE Windows
Audio
Deleted @%SystemRoot%\system32\windows.staterepository.dll,-1 REG_NONE
State Repository Service
Deleted @%SystemRoot%\system32\netprofmsvc.dll,-202 REG_NONE Network
List Service
Deleted @%SystemRoot%\system32\CapabilityAccessManager.dll,-1 REG_NONE
Capability Access Manager Service
Deleted @%SystemRoot%\system32\WpnUserService.dll,-1 REG_NONE Windows
Push Notifications User Service
Deleted @%SystemRoot%\system32\wlidsvc.dll,-100 REG_NONE Microsoft
Account Sign-in Assistant
Deleted @%SystemRoot%\system32\cryptsvc.dll,-1001 REG_NONE
Cryptographic Services
Deleted @%SystemRoot%\System32\shsvcs.dll,-12288 REG_NONE Shell
Hardware Detection
Deleted @%systemroot%\system32\webthreatdefsvc.dll,-100 REG_NONE Web
Threat Defense Service
Deleted @%SystemRoot%\system32\cdpsvc.dll,-100 REG_NONE Connected
Devices Platform Service
Deleted @%Systemroot%\system32\wbem\wmisvc.dll,-205 REG_NONE Windows
Management Instrumentation
Deleted @%systemroot%\system32\dps.dll,-500 REG_NONE Diagnostic Policy
Service
Deleted @%systemroot%\system32\appinfo.dll,-100 REG_NONE Application
Information
Deleted @%systemroot%\system32\tokenbroker.dll,-100 REG_NONE Web
Account Manager
Deleted C:\WINDOWS\system32,@elscore.dll,-2 REG_NONE Microsoft Script
Detection
Deleted C:\WINDOWS\system32,@elscore.dll,-5 REG_NONE Microsoft
Transliteration Engine
Simplified Chinese to Traditional Chinese Transliteration
Cyrillic to Latin Transliteration
Deleted C:\WINDOWS\system32,@elscore.dll,-10 REG_NONE Microsoft Hangul
Decomposition Transliteration
Traditional Chinese to Simplified Chinese Transliteration
Devanagari to Latin Transliteration
Malayalam to Latin Transliteration
Deleted C:\WINDOWS\system32,@elscore.dll,-9 REG_NONE Microsoft Bengali
to Latin Transliteration
Language Detection
Deleted @%SystemRoot%\system32\sysmain.dll,-1000 REG_NONE SysMain
Deleted @%SystemRoot%\system32\bdesvc.dll,-100 REG_NONE BitLocker
Drive Encryption Service
Deleted @%SystemRoot%\system32\windowsudkservices.shellcommon.dll,-100
REG_NONE Udk User Service
Deleted @%systemroot%\system32\Windows.Internal.Management.dll,-100
REG_NONE Device Management Enrollment Service
Deleted @%SystemRoot%\system32\sppsvc.exe,-101 REG_NONE Software
Protection
Deleted @%SystemRoot%\system32\dhcpcore.dll,-100 REG_NONE DHCP Client
Deleted @%SystemRoot%\System32\wscsvc.dll,-200 REG_NONE Security
Center
Deleted @%SystemRoot%\system32\cbdhsvc.dll,-100 REG_NONE Clipboard
User Service
Deleted @%systemroot%\system32\wuaueng.dll,-105 REG_NONE Windows
Update
Deleted @comres.dll,-2450 REG_NONE COM+ Event System
Deleted @%SystemRoot%\system32\appxdeploymentserver.dll,-1 REG_NONE
AppX Deployment Service (AppXSVC)
Deleted @%SystemRoot%\system32\AudioEndpointBuilder.dll,-204 REG_NONE
Windows Audio Endpoint Builder
Deleted @%SystemRoot%\system32\bfe.dll,-1001 REG_NONE Base Filtering
Engine
Deleted @%windir%\system32\bisrv.dll,-100 REG_NONE Background Tasks
Infrastructure Service
Deleted @%SystemRoot%\system32\coremessaging.dll,-1 REG_NONE
CoreMessaging
Deleted @combase.dll,-5012 REG_NONE DCOM Server Process Launcher
Deleted @%SystemRoot%\system32\das.dll,-100 REG_NONE Device
Association Service
Deleted @%SystemRoot%\system32\dispbroker.desktop.dll,-101 REG_NONE
Display Policy Service
Deleted @%SystemRoot%\System32\
Microsoft.Graphics.Display.DisplayEnhancementService.dll,-1000 REG_NONE
Display Enhancement Service
Deleted @%SystemRoot%\System32\dnsapi.dll,-101 REG_NONE DNS Client
Deleted @%SystemRoot%\System32\dusmsvc.dll,-1 REG_NONE Data Usage
Deleted @%SystemRoot%\system32\wevtsvc.dll,-200 REG_NONE Windows Event
Log
Deleted @%systemroot%\system32\FntCache.dll,-100 REG_NONE Windows Font
Cache Service
Deleted @%SystemRoot%\system32\PresentationHost.exe,-3309 REG_NONE
Windows Presentation Foundation Font Cache 3.0.0.0
Deleted @gpapi.dll,-112 REG_NONE Group Policy Client
Deleted @%SystemRoot%\System32\hidserv.dll,-101 REG_NONE Human
Interface Device Service
Deleted @%systemroot%\system32\HostNetSvc.dll,-100 REG_NONE Host
Network Service
Deleted @%SystemRoot%\system32\hvhostsvc.dll,-100 REG_NONE HV Host
Service
Deleted @%SystemRoot%\system32\ikeext.dll,-501 REG_NONE IKE and AuthIP
IPsec Keying Modules
Deleted @%SystemRoot%\system32\iphlpsvc.dll,-500 REG_NONE IP Helper
Deleted @keyiso.dll,-100 REG_NONE CNG Key Isolation
Deleted @%systemroot%\system32\srvsvc.dll,-100 REG_NONE Server
Deleted @%systemroot%\system32\wkssvc.dll,-100 REG_NONE Workstation
Deleted @%SystemRoot%\system32\lmhsvc.dll,-101 REG_NONE TCP/IP NetBIOS
Helper
Deleted @%windir%\system32\lsm.dll,-1001 REG_NONE Local Session
Manager
Deleted @%SystemRoot%\system32\FirewallAPI.dll,-23090 REG_NONE Windows
Defender Firewall
Deleted @%SystemRoot%\system32\ncbservice.dll,-500 REG_NONE Network
Connection Broker
Deleted @%systemroot%\system32\dosvc.dll,-100 REG_NONE Delivery
Optimization
Deleted @%SystemRoot%\system32\NetSetupSvc.dll,-3 REG_NONE Network
Setup Service
Deleted @%SystemRoot%\system32\nsisvc.dll,-200 REG_NONE Network Store
Interface Service
Deleted @%systemroot%\system32\NvAgent.dll,-100 REG_NONE Network
Virtualization Service
Deleted @%SystemRoot%\system32\umpnpmgr.dll,-200 REG_NONE Plug and
Play
Deleted @%systemroot%\system32\lpksetup.exe,-2 REG_NONE Language Pack
Installer
Deleted @%SystemRoot%\System32\polstore.dll,-5010 REG_NONE IPsec
Policy Agent
Deleted @%SystemRoot%\system32\umpo.dll,-100 REG_NONE Power
Deleted @%systemroot%\system32\profsvc.dll,-300 REG_NONE User Profile
Service
Deleted @%Systemroot%\system32\rasmans.dll,-200 REG_NONE Remote Access
Connection Manager
Deleted @%SystemRoot%\system32\RMapi.dll,-1001 REG_NONE Radio
Management Service
Deleted @%windir%\system32\RpcEpMap.dll,-1001 REG_NONE RPC Endpoint
Mapper
Deleted @combase.dll,-5010 REG_NONE Remote Procedure Call (RPC)
Deleted @%SystemRoot%\system32\samsrv.dll,-1 REG_NONE Security
Accounts Manager
Deleted @%SystemRoot%\system32\schedsvc.dll,-100 REG_NONE Task
Scheduler
Deleted @%SystemRoot%\system32\Sens.dll,-200 REG_NONE System Event
Notification Service
Deleted @%SystemRoot%\System32\sensorservice.dll,-1000 REG_NONE Sensor
Service
Deleted @%SystemRoot%\system32\ipnathlp.dll,-106 REG_NONE Internet
Connection Sharing (ICS)
Deleted @%systemroot%\system32\spoolsv.exe,-1 REG_NONE Print Spooler
Deleted @%SystemRoot%\system32\sstpsvc.dll,-200 REG_NONE Secure Socket
Tunneling Protocol Service
Deleted @%SystemRoot%\system32\wiaservc.dll,-9 REG_NONE Windows Image
Acquisition (WIA)
Deleted @%windir%\system32\SystemEventsBrokerServer.dll,-1001 REG_NONE
System Events Broker
Deleted @%SystemRoot%\system32\TabSvc.dll,-100 REG_NONE Text Input
Management Service
Deleted @%SystemRoot%\System32\themeservice.dll,-8192 REG_NONE Themes
Deleted @%windir%\system32\TimeBrokerServer.dll,-1001 REG_NONE Time
Broker
Deleted @%SystemRoot%\system32\trkwks.dll,-1 REG_NONE Distributed Link
Tracking Client
Deleted @%SystemRoot%\System32\wcmsvc.dll,-4097 REG_NONE Windows
Connection Manager
Deleted @%SystemRoot%\system32\winhttp.dll,-100 REG_NONE WinHTTP Web
Proxy Auto-Discovery Service
Deleted @%SystemRoot%\System32\wlansvc.dll,-257 REG_NONE WLAN
AutoConfig
Deleted @%SystemRoot%\system32\wpdbusenum.dll,-100 REG_NONE Portable
Device Enumerator Service
Deleted @%SystemRoot%\servicing\TrustedInstaller.exe,-100 REG_NONE
Windows Modules Installer
Deleted @%SystemRoot%\System32\StorSvc.dll,-100 REG_NONE Storage
Service
Deleted @%SystemRoot%\system32\ClipSVC.dll,-103 REG_NONE Client
License Service (ClipSVC)
Deleted @%systemroot%\system32\SecurityHealthAgent.dll,-1002 REG_NONE
Windows Security Service
Deleted @%SystemRoot%\system32\vaultsvc.dll,-1003 REG_NONE Credential
Manager
Deleted @%SystemRoot%\System32\moshost.dll,-100 REG_NONE Downloaded
Maps Manager
Deleted @%SystemRoot%\system32\pcasvc.dll,-1 REG_NONE Program
Compatibility Assistant Service
Deleted @%SystemRoot%\System32\Sgrm\SgrmBroker.exe,-100 REG_NONE
System Guard Runtime Monitor Broker
Deleted @%systemroot%\system32\usosvc.dll,-101 REG_NONE Update
Orchestrator Service
Deleted @%SystemRoot%\system32\pushtoinstall.dll,-200 REG_NONE Windows
PushToInstall Service
Deleted @%systemroot%\system32\wbiosrvc.dll,-100 REG_NONE Windows
Biometric Service
Deleted @%SystemRoot%\System32\ngcsvc.dll,-100 REG_NONE Microsoft
Passport
Deleted @%SystemRoot%\System32\NgcCtnrSvc.dll,-1 REG_NONE Microsoft
Passport Container
Deleted @%systemroot%\system32\wuaueng.dll,-106 REG_NONE Enables the
detection, download, and installation of updates for Windows and other programs. If
this service is disabled, users of this computer will not be able to use Windows
Update or its automatic updating feature, and programs will not be able to use the
Windows Update Agent (WUA) API.
Deleted @%SystemRoot%\servicing\TrustedInstaller.exe,-101 REG_NONE
Enables installation, modification, and removal of Windows updates and optional
components. If this service is disabled, install or uninstall of Windows updates
might fail for this computer.
Deleted @%systemroot%\system32\dosvc.dll,-101 REG_NONE Performs
content delivery optimization tasks
Deleted @%SystemRoot%\system32\qmgr.dll,-1000 REG_NONE Background
Intelligent Transfer Service
Deleted @%SystemRoot%\system32\qmgr.dll,-1001 REG_NONE Transfers files
in the background using idle network bandwidth. If the service is disabled, then
any applications that depend on BITS, such as Windows Update or MSN Explorer, will
be unable to automatically download programs and other information.
Deleted @%systemroot%\system32\usosvc.dll,-102 REG_NONE Manages
Windows Updates. If stopped, your devices will not be able to download and install
the latest updates.
Deleted @%SystemRoot%\system32\licensemanagersvc.dll,-200 REG_NONE
Windows License Manager Service
Deleted @%systemroot%\system32\browser.dll,-100 REG_NONE Computer
Browser
Deleted @%systemroot%\system32\FrameServerMonitor.dll,-100 REG_NONE
Windows Camera Frame Server Monitor
Deleted @%systemroot%\system32\FrameServer.dll,-100 REG_NONE Windows
Camera Frame Server
Deleted @%SystemRoot%\System32\urlmon.dll,-4200 REG_NONE Open File -
Security Warning
Deleted @%SystemRoot%\system32\AarSvc.dll,-100 REG_NONE Agent
Activation Runtime
Deleted @%systemroot%\system32\drivers\afd.sys,-1000 REG_NONE
Ancillary Function Driver for Winsock
Deleted @%systemroot%\system32\drivers\ahcache.sys,-102 REG_NONE
Application Compatibility Cache
Deleted @%SystemRoot%\system32\AJRouter.dll,-2 REG_NONE AllJoyn Router
Service
Deleted @%SystemRoot%\system32\Alg.exe,-112 REG_NONE Application Layer
Gateway Service
Deleted @%systemroot%\system32\srpapi.dll,-100 REG_NONE AppID Driver
Deleted @%systemroot%\system32\appidsvc.dll,-100 REG_NONE Application
Identity
Deleted @%systemroot%\system32\srpapi.dll,-102 REG_NONE Smartlocker
Filter Driver
Deleted @%SystemRoot%\System32\AppReadiness.dll,-1000 REG_NONE App
Readiness
Deleted @%systemroot%\system32\mprmsg.dll,-32000 REG_NONE RAS
Asynchronous Media Driver
Deleted @%SystemRoot%\System32\autotimesvc.dll,-6 REG_NONE Cellular
Time
Deleted @%SystemRoot%\system32\AxInstSV.dll,-103 REG_NONE ActiveX
Installer (AxInstSV)
Deleted @%SystemRoot%\system32\drivers\bam.sys,-100 REG_NONE
Background Activity Moderator Driver
Deleted @%SystemRoot%\system32\BcastDVRUserService.dll,-100 REG_NONE
GameDVR and Broadcast User Service
Deleted @%systemroot%\system32\drivers\bfs.sys,-100 REG_NONE Brokering
File System
Deleted @%systemroot%\system32\drivers\bindflt.sys,-100 REG_NONE
Windows Bind Filter Driver
Deleted @%SystemRoot%\system32\Microsoft.Bluetooth.UserService.dll,-101
REG_NONE Bluetooth User Support Service
Deleted @%systemroot%\system32\wkssvc.dll,-2001 REG_NONE Browser
Deleted @%SystemRoot%\system32\BTAGService.dll,-101 REG_NONE Bluetooth
Audio Gateway Service
Deleted @%SystemRoot%\system32\BthAvctpSvc.dll,-101 REG_NONE AVCTP
service
Deleted @%SystemRoot%\System32\bthserv.dll,-101 REG_NONE Bluetooth
Support Service
Deleted @%SystemRoot%\system32\CaptureService.dll,-100 REG_NONE
CaptureService
Deleted @%SystemRoot%\system32\cdpusersvc.dll,-100 REG_NONE Connected
Devices Platform User Service
Deleted @%SystemRoot%\System32\certprop.dll,-11 REG_NONE Certificate
Propagation
Deleted @%SystemRoot%\system32\drivers\clfs.sys,-100 REG_NONE Common
Log (CLFS)
Deleted @%SystemRoot%\system32\drivers\cnghwassist.sys,-100 REG_NONE
CNG Hardware Assist algorithm provider
Deleted @comres.dll,-947 REG_NONE COM+ System Application
Deleted @%SystemRoot%\system32\ConsentUxClient.dll,-100 REG_NONE
ConsentUX User Service
Deleted @%SystemRoot%\system32\CredentialEnrollmentManager.exe,-100
REG_NONE CredentialEnrollmentManagerUserSvc
Deleted @%SystemRoot%\system32\drivers\dam.sys,-100 REG_NONE Desktop
Activity Moderator Driver
Deleted @%SystemRoot%\system32\defragsvc.dll,-101 REG_NONE Optimize
drives
Deleted @%SystemRoot%\system32\deviceaccess.dll,-107 REG_NONE
DeviceAssociationBroker
Deleted @%SystemRoot%\system32\umpnpmgr.dll,-100 REG_NONE Device
Install Service
Deleted @%SystemRoot%\system32\Windows.Devices.Picker.dll,-1006 REG_NONE
DevicePicker
Deleted @%SystemRoot%\system32\DevicesFlowBroker.dll,-103 REG_NONE
DevicesFlow
Deleted @%SystemRoot%\system32\DevQueryBroker.dll,-100 REG_NONE
DevQuery Background Discovery Broker
Deleted @%systemroot%\system32\wkssvc.dll,-1008 REG_NONE DFS Namespace
Client Driver
Deleted @%SystemRoot%\system32\DiagSvcs\
DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 REG_NONE Microsoft
(R) Diagnostics Hub Standard Collector Service
Deleted @%systemroot%\system32\DiagSvc.dll,-100 REG_NONE Diagnostic
Execution Service
Deleted @%SystemRoot%\system32\diagtrack.dll,-3001 REG_NONE Connected
User Experiences and Telemetry
Deleted @%SystemRoot%\system32\dmwappushsvc.dll,-200 REG_NONE Device
Management Wireless Application Protocol (WAP) Push message Routing Service
Deleted @%systemroot%\system32\dot3svc.dll,-1102 REG_NONE Wired
AutoConfig
Deleted @%SystemRoot%\system32\DeviceSetupManager.dll,-1000 REG_NONE
Device Setup Manager
Deleted @%SystemRoot%\system32\dssvc.dll,-10003 REG_NONE Data Sharing
Service
Deleted @%systemroot%\system32\eapsvc.dll,-1 REG_NONE Extensible
Authentication Protocol
Deleted @%SystemRoot%\system32\efssvc.dll,-100 REG_NONE Encrypting
File System (EFS)
Deleted @%SystemRoot%\system32\drivers\EhStorClass.sys,-100 REG_NONE
Enhanced Storage Filter Driver
Deleted @%SystemRoot%\system32\embeddedmodesvc.dll,-201 REG_NONE
Embedded Mode
Deleted @EnterpriseAppMgmtSvc.dll,-1 REG_NONE Enterprise App
Management Service
Deleted @%SystemRoot%\System32\Drivers\ExecutionContext.sys,-101 REG_NONE
CPU Scheduler for High Performance I/O
Deleted @%systemroot%\system32\fxsresm.dll,-118 REG_NONE Fax
Deleted @%systemroot%\system32\fdPHost.dll,-100 REG_NONE Function
Discovery Provider Host
Deleted @%systemroot%\system32\fdrespub.dll,-100 REG_NONE Function
Discovery Resource Publication
Deleted @%systemroot%\system32\fhsvc.dll,-101 REG_NONE File History
Service
Deleted @%systemroot%\system32\drivers\filecrypt.sys,-100 REG_NONE
FileCrypt
Deleted @%SystemRoot%\system32\drivers\fileinfo.sys,-100 REG_NONE File
Information FS MiniFilter
Deleted @%SystemRoot%\system32\drivers\filetrace.sys,-10001 REG_NONE
FileTrace
Deleted @%SystemRoot%\system32\drivers\fltmgr.sys,-10001 REG_NONE
FltMgr
Deleted @%SystemRoot%\system32\drivers\fsdepends.sys,-10001 REG_NONE
File System Dependency Minifilter
Deleted @%SystemRoot%\system32\drivers\fvevol.sys,-100 REG_NONE
BitLocker Drive Encryption Filter Driver
Deleted @%SystemRoot%\system32\GraphicsPerfSvc.dll,-100 REG_NONE
GraphicsPerfSvc
Deleted @%SystemRoot%\System32\drivers\hnswfpdriver.sys,-5000 REG_NONE
HNS WFP Driver
Deleted @%SystemRoot%\system32\drivers\http.sys,-1 REG_NONE HTTP
Service
Deleted @%systemroot%\system32\drivers\hwpolicy.sys,-101 REG_NONE
Hardware Policy Driver
Deleted @%SystemRoot%\System32\tetheringservice.dll,-4097 REG_NONE
Windows Mobile Hotspot Service
Deleted @%SystemRoot%\system32\drivers\IndirectKmd.sys,-100 REG_NONE
Indirect Displays Kernel-Mode Driver
Deleted @%SystemRoot%\system32\inventorysvc.dll,-501 REG_NONE
Inventory and Compatibility Appraisal service
Deleted @%SystemRoot%\system32\drivers\iorate.sys,-101 REG_NONE Disk
I/O Rate Filter Driver
Deleted @%systemroot%\system32\mprmsg.dll,-32013 REG_NONE IP Traffic
Filter Driver
Deleted @%Systemroot%\system32\ipxlatcfg.dll,-500 REG_NONE IP
Translation Configuration Service
Deleted @comres.dll,-2946 REG_NONE KtmRm for Distributed Transaction
Coordinator
Deleted @%SystemRoot%\System32\drivers\l2bridge.sys,-5000 REG_NONE
Bridge Driver
Deleted @%SystemRoot%\System32\lfsvc.dll,-1 REG_NONE Geolocation
Service
Deleted @%SystemRoot%\system32\lltdres.dll,-6 REG_NONE Link-Layer
Topology Discovery Mapper I/O Driver
Topology Discovery Mapper
Deleted @%systemroot%\system32\drivers\luafv.sys,-100 REG_NONE UAC
File Virtualization
Deleted @%SystemRoot%\system32\LanguageOverlayServer.dll,-100 REG_NONE
Language Experience Service
Deleted @%SystemRoot%\system32\drivers\lxss.sys,-100 REG_NONE LXSS
Deleted @%systemroot%\system32\lxss\LxssManager.dll,-100 REG_NONE
LXSSMANAGER
Deleted @%SystemRoot%\system32\MessagingService.dll,-100 REG_NONE
MessagingService
Deleted @%SystemRoot%\system32\MixedRealityRuntime.dll,-101 REG_NONE
Windows Mixed Reality OpenXR Service
Deleted @%systemroot%\system32\drivers\mmcss.sys,-100 REG_NONE
Multimedia Class Scheduler
Deleted @%SystemRoot%\system32\drivers\mountmgr.sys,-100 REG_NONE
Mount Point Manager
Deleted @%SystemRoot%\system32\drivers\mpsdrv.sys,-23092 REG_NONE
Windows Defender Firewall Authorization Driver
Deleted @%systemroot%\system32\webclnt.dll,-104 REG_NONE WebDav Client
Redirector Driver
Deleted @%systemroot%\system32\wkssvc.dll,-1002 REG_NONE SMB
MiniRedirector Wrapper and Engine
Deleted @%systemroot%\system32\wkssvc.dll,-1006 REG_NONE SMB 2.0
MiniRedirector
Deleted @%SystemRoot%\system32\bridgeres.dll,-1 REG_NONE Microsoft MAC
Bridge
Deleted @comres.dll,-2797 REG_NONE Distributed Transaction Coordinator
Deleted @%SystemRoot%\system32\drivers\mshidumdf.sys,-100 REG_NONE
Pass-through HID to UMDF Driver
Deleted @%SystemRoot%\system32\iscsidsc.dll,-5000 REG_NONE Microsoft
iSCSI Initiator Service
Deleted @%SystemRoot%\system32\msimsg.dll,-27 REG_NONE Windows
Installer
Deleted @%SystemRoot%\system32\drivers\mslldp.sys,-200 REG_NONE
Microsoft Link-Layer Discovery Protocol
Deleted @%SystemRoot%\system32\drivers\msquic.sys,-200 REG_NONE MSQUIC
Deleted @%systemroot%\system32\drivers\mup.sys,-101 REG_NONE MUP
Deleted @%SystemRoot%\System32\drivers\nwifi.sys,-101 REG_NONE
NativeWiFi Filter
Deleted @%systemroot%\system32\NaturalAuth.dll,-100 REG_NONE Natural
Authentication
Deleted @%SystemRoot%\system32\ncasvc.dll,-3009 REG_NONE Network
Connectivity Assistant
Deleted @%SystemRoot%\system32\NcdAutoSetup.dll,-100 REG_NONE Network
Connected Devices Auto-Setup
Deleted @%SystemRoot%\system32\drivers\ndis.sys,-200 REG_NONE NDIS
System Driver
Deleted @%SystemRoot%\System32\drivers\ndiscap.sys,-5000 REG_NONE
Microsoft NDIS Capture
Deleted @%SystemRoot%\System32\drivers\ndisimplatform.sys,-501 REG_NONE
Microsoft Network Adapter Multiplexor Protocol
Deleted @%systemroot%\system32\mprmsg.dll,-32001 REG_NONE Remote
Access NDIS TAPI Driver
Deleted @%SystemRoot%\System32\drivers\NdisVirtualBus.sys,-200 REG_NONE
Microsoft Virtual Network Adapter Enumerator
Access NDIS WAN Driver
Access LEGACY NDIS WAN Driver
Deleted @%SystemRoot%\system32\drivers\ndproxy.sys,-6000 REG_NONE NDIS
Proxy Driver
Deleted @%SystemRoot%\system32\drivers\Ndu.sys,-10001 REG_NONE Windows
Network Data Usage Monitoring Driver
Deleted @%windir%\system32\drivers\netbios.sys,-503 REG_NONE NetBIOS
Interface
Deleted @%SystemRoot%\system32\drivers\netbt.sys,-2 REG_NONE NETBT
Deleted @%SystemRoot%\System32\netlogon.dll,-102 REG_NONE Netlogon
Deleted @%SystemRoot%\system32\netman.dll,-109 REG_NONE Network
Connections
Deleted @%systemroot%\Microsoft.NET\Framework64\v4.0.30319\
ServiceModelInstallRC.dll,-8201 REG_NONE Net.Tcp Port Sharing Service
Deleted @%SystemRoot%\system32\netprofmsvc.dll,-208 REG_NONE Network
Location Awareness
Deleted @%SystemRoot%\system32\drivers\nsiproxy.sys,-2 REG_NONE NSI
Proxy Service Driver
Deleted @%SystemRoot%\system32\APHostRes.dll,-10002 REG_NONE Sync Host
Deleted @%SystemRoot%\system32\pnrpsvc.dll,-8004 REG_NONE Peer
Networking Identity Manager
Deleted @%SystemRoot%\system32\p2psvc.dll,-8006 REG_NONE Peer
Networking Grouping
Deleted @%SystemRoot%\System32\drivers\p9rdr.sys,-100 REG_NONE Plan 9
Redirector Driver
Deleted @%systemroot%\system32\p9rdrservice.dll,-102 REG_NONE
P9RdrService
Deleted @%SystemRoot%\system32\drivers\partmgr.sys,-100 REG_NONE
Partition driver
Deleted @%systemroot%\system32\drivers\passthruparser.sys,-10010 REG_NONE
PassthroughParser
Deleted @%SystemRoot%\system32\drivers\pdc.sys,-100 REG_NONE PDC
Deleted @%SystemRoot%\system32\PenService.dll,-100 REG_NONE PenService
Deleted @%systemroot%\system32\PerceptionSimulation\
PerceptionSimulationService.exe,-101 REG_NONE Windows Perception
Simulation Service
Deleted @%systemroot%\sysWow64\perfhost.exe,-2 REG_NONE Performance
Counter DLL Host
Deleted @%SystemRoot%\system32\PhoneserviceRes.dll,-10000 REG_NONE
Phone Service
Deleted @%SystemRoot%\system32\UserDataAccessRes.dll,-15001 REG_NONE
Contact Data
Deleted @%systemroot%\system32\pla.dll,-500 REG_NONE Performance Logs
& Alerts
Deleted @%SystemRoot%\system32\pnrpauto.dll,-8002 REG_NONE PNRP
Machine Name Publication Service
Deleted @%SystemRoot%\system32\pnrpsvc.dll,-8000 REG_NONE Peer Name
Resolution Protocol
Deleted @%systemroot%\system32\mprmsg.dll,-32006 REG_NONE WAN Miniport
(PPTP)
Deleted @C:\WINDOWS\system32\spool\drivers\x64\3\PrintConfig.dll,-1
REG_NONE Printer Extensions and Notifications
Deleted @%SystemRoot%\system32\PrintWorkflowService.dll,-100 REG_NONE
PrintWorkflow
Deleted @%windir%\System32\drivers\pacer.sys,-101 REG_NONE QoS Packet
Scheduler
Deleted @%SystemRoot%\system32\qwave.dll,-1 REG_NONE Quality Windows
Audio Video Experience
Deleted @%SystemRoot%\system32\drivers\qwavedrv.sys,-1 REG_NONE QWAVE
driver
Deleted @%Systemroot%\system32\rasauto.dll,-200 REG_NONE Remote Access
Auto Connection Manager
Deleted @%systemroot%\system32\mprmsg.dll,-32005 REG_NONE WAN Miniport
(L2TP)
Access PPPOE Driver
Deleted @%systemroot%\system32\sstpsvc.dll,-202 REG_NONE WAN Miniport
(SSTP)
Deleted @%systemroot%\system32\wkssvc.dll,-1000 REG_NONE Redirected
Buffering Sub System
Deleted @%SystemRoot%\System32\DRIVERS\rdpdr.sys,-100 REG_NONE Remote
Desktop Device Redirector Driver
Deleted @%Systemroot%\system32\mprdim.dll,-200 REG_NONE Routing and
Remote Access
Deleted @regsvc.dll,-1 REG_NONE Remote Registry
Deleted @%SystemRoot%\System32\RDXService.dll,-256 REG_NONE Retail
Demo Service
Deleted @%systemroot%\system32\Locator.exe,-2 REG_NONE Remote
Procedure Call (RPC) Locator
Topology Discovery Responder
Deleted @%SystemRoot%\System32\SCardSvr.dll,-1 REG_NONE Smart Card
Deleted @%SystemRoot%\System32\ScDeviceEnum.dll,-100 REG_NONE Smart
Card Device Enumeration Service
Deleted @%SystemRoot%\System32\drivers\scfilter.sys,-11 REG_NONE Smart
card PnP Class Filter Driver
Deleted @%SystemRoot%\System32\certprop.dll,-13 REG_NONE Smart Card
Removal Policy
Deleted @%SystemRoot%\system32\sdrsvc.dll,-107 REG_NONE Windows Backup
Deleted @%SystemRoot%\system32\seclogon.dll,-7001 REG_NONE Secondary
Logon
Deleted @%SystemRoot%\System32\SEMgrSvc.dll,-1001 REG_NONE Payments
and NFC/SE Manager
Deleted @%SystemRoot%\system32\SensorDataService.exe,-101 REG_NONE
Sensor Data Service
Deleted @%SystemRoot%\System32\sensrsvc.dll,-1000 REG_NONE Sensor
Monitoring Service
Deleted @%SystemRoot%\System32\SessEnv.dll,-1026 REG_NONE Remote
Desktop Configuration
Deleted @%SystemRoot%\System32\Drivers\SgrmAgent.sys,-1001 REG_NONE
System Guard Runtime Monitor Agent
Deleted @%SystemRoot%\system32\SharedRealitySvc.dll,-100 REG_NONE
Spatial Data Service
Deleted @%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100
REG_NONE Shared PC Account Manager
Deleted @%SystemRoot%\System32\smphost.dll,-102 REG_NONE Microsoft
Storage Spaces SMP
Deleted @%SystemRoot%\System32\SmsRouterSvc.dll,-10001 REG_NONE
Microsoft Windows SMS Router Service.
Deleted @firewallapi.dll,-50323 REG_NONE SNMP Trap
Deleted @%systemroot%\system32\spectrum.exe,-101 REG_NONE Windows
Perception Service
Deleted @%systemroot%\system32\srvsvc.dll,-104 REG_NONE Server SMB
2.xxx Driver
Deleted @%systemroot%\system32\ssdpsrv.dll,-100 REG_NONE SSDP
Discovery
Deleted @%SystemRoot%\System32\drivers\storqosflt.sys,-101 REG_NONE
Storage QoS Filter Driver
Deleted @%SystemRoot%\system32\svsvc.dll,-101 REG_NONE Spot Verifier
Deleted @%SystemRoot%\System32\swprv.dll,-103 REG_NONE Microsoft
Software Shadow Copy Provider
Deleted @%SystemRoot%\system32\tapisrv.dll,-10100 REG_NONE Telephony
Deleted @%SystemRoot%\system32\drivers\tcpip.sys,-10001 REG_NONE
TCP/IP Protocol Driver
Deleted @%SystemRoot%\system32\tcpipcfg.dll,-50004 REG_NONE NetIO
Legacy TDI Support Driver
Deleted @%SystemRoot%\System32\termsrv.dll,-268 REG_NONE Remote
Desktop Services
Deleted @%SystemRoot%\system32\TieringEngineService.exe,-702 REG_NONE
Storage Tiers Management
Deleted @%SystemRoot%\system32\MitigationClient.dll,-103 REG_NONE
Recommended Troubleshooting Service
Deleted @%SystemRoot%\system32\drivers\tsusbflt.sys,-1000 REG_NONE
Remote Desktop USB Hub Class Filter Driver
Deleted @%SystemRoot%\System32\drivers\tunnel.sys,-500 REG_NONE
Microsoft Tunnel Miniport Adapter Driver
Deleted @%SystemRoot%\system32\tzautoupdate.dll,-200 REG_NONE Auto
Time Zone Updater
Deleted @%SystemRoot%\system32\umrdp.dll,-1000 REG_NONE Remote Desktop
Services UserMode Port Redirector
User Data Storage
Deleted @%systemroot%\system32\upnphost.dll,-213 REG_NONE UPnP Device
Host
User Data Access
Deleted @%SystemRoot%\system32\vac.dll,-200 REG_NONE Volumetric Audio
Compositor Service
Deleted @%SystemRoot%\system32\vds.exe,-100 REG_NONE Virtual Disk
Deleted @%SystemRoot%\System32\drivers\VerifierExt.sys,-1000 REG_NONE
Driver Verifier Extension
Deleted @%SystemRoot%\system32\drivers\vmbusr.sys,-1001 REG_NONE
Virtual Machine Bus Provider
Deleted @%systemroot%\system32\vmcompute.exe,-100 REG_NONE Hyper-V
Host Compute Service
Deleted @%systemroot%\system32\icsvc.dll,-801 REG_NONE Hyper-V Guest
Service Interface
Deleted @%systemroot%\system32\icsvc.dll,-101 REG_NONE Hyper-V
Heartbeat Service
Deleted @%systemroot%\system32\icsvc.dll,-201 REG_NONE Hyper-V Data
Exchange Service
Deleted @%systemroot%\system32\icsvcext.dll,-601 REG_NONE Hyper-V
Remote Desktop Virtualization Service
Deleted @%systemroot%\system32\icsvc.dll,-301 REG_NONE Hyper-V Guest
Shutdown Service
Deleted @%systemroot%\system32\icsvc.dll,-401 REG_NONE Hyper-V Time
Synchronization Service
Deleted @%systemroot%\system32\icsvc.dll,-901 REG_NONE Hyper-V
PowerShell Direct Service
Deleted @%systemroot%\system32\icsvcvss.dll,-101 REG_NONE Hyper-V
Volume Shadow Copy Requestor
Deleted @%SystemRoot%\system32\drivers\volmgrx.sys,-100 REG_NONE
Dynamic Volume Manager
Deleted @%SystemRoot%\system32\drivers\volsnap.sys,-100 REG_NONE
Volume Shadow Copy driver
Deleted @%systemroot%\system32\vssvc.exe,-102 REG_NONE Volume Shadow
Copy
Deleted @%SystemRoot%\System32\drivers\vwifibus.sys,-257 REG_NONE
Virtual Wireless Bus Driver
Deleted @%SystemRoot%\System32\drivers\vwififlt.sys,-259 REG_NONE
Virtual WiFi Filter Driver
Deleted @%SystemRoot%\System32\drivers\vwifimp.sys,-261 REG_NONE
Virtual WiFi Miniport Service
Deleted @%SystemRoot%\system32\w32time.dll,-200 REG_NONE Windows Time
Deleted @%SystemRoot%\System32\WalletService.dll,-1000 REG_NONE
WalletService
Access IP ARP Driver
Access IPv6 ARP Driver
Deleted @%SystemRoot%\System32\Windows.WARP.JITService.dll,-100 REG_NONE
Warp JIT Service
Deleted @%systemroot%\system32\wbengine.exe,-104 REG_NONE Block Level
Backup Engine Service
Deleted @%systemroot%\system32\drivers\wcifs.sys,-100 REG_NONE Windows
Container Isolation
Deleted @%SystemRoot%\system32\wcncsvc.dll,-3 REG_NONE Windows Connect
Now - Config Registrar
Deleted @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-390 REG_NONE
Microsoft Defender Antivirus Boot Driver
Deleted @%SystemRoot%\system32\drivers\Wdf01000.sys,-1000 REG_NONE
Kernel Mode Driver Frameworks service
Microsoft Defender Antivirus Mini-Filter Driver
Deleted @%systemroot%\system32\wdi.dll,-502 REG_NONE Diagnostic
Service Host
Deleted @%systemroot%\system32\wdi.dll,-500 REG_NONE Diagnostic System
Host
Microsoft Defender Antivirus Network Inspection System Driver
Microsoft Defender Antivirus Network Inspection Service
Deleted @%systemroot%\system32\webclnt.dll,-100 REG_NONE WebClient
Deleted @%systemroot%\system32\webthreatdefusersvc.dll,-100 REG_NONE
Web Threat Defense User Service
Deleted @%SystemRoot%\system32\wecsvc.dll,-200 REG_NONE Windows Event
Collector
Deleted @%systemroot%\system32\wephostsvc.dll,-100 REG_NONE Windows
Encryption Provider Host Service
Deleted @%SystemRoot%\System32\wercplsupport.dll,-101 REG_NONE Problem
Reports Control Panel Support
Deleted @%SystemRoot%\System32\wersvc.dll,-100 REG_NONE Windows Error
Reporting Service
Deleted @%SystemRoot%\System32\wfdsconmgrsvc.dll,-9000 REG_NONE Wi-Fi
Direct Services Connection Manager Service
Deleted @%SystemRoot%\System32\drivers\wfplwfs.sys,-6000 REG_NONE
Microsoft Windows Filtering Platform
Deleted @%SystemRoot%\system32\wiarpc.dll,-2 REG_NONE Still Image
Acquisition Events
Deleted @%SystemRoot%\system32\drivers\wimmount.sys,-101 REG_NONE
WIMMount
Microsoft Defender Antivirus Service
Deleted @%SystemRoot%\system32\drivers\winnat.sys,-10001 REG_NONE
Windows NAT Driver
Deleted @%Systemroot%\system32\wsmsvc.dll,-101 REG_NONE Windows Remote
Management (WS-Management)
Deleted @%SystemRoot%\system32\flightsettings.dll,-103 REG_NONE
Windows Insider Service
Deleted @%SystemRoot%\system32\lpasvc.dll,-1000 REG_NONE Local Profile
Assistant Service
Deleted @%systemroot%\system32\Windows.Management.Service.dll,-100
REG_NONE Windows Management Service
Deleted @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 REG_NONE WMI
Performance Adapter
Deleted @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 REG_NONE
Windows Media Player Network Sharing Service
Deleted @%systemroot%\system32\workfolderssvc.dll,-102 REG_NONE Work
Folders
Deleted @%systemroot%\system32\WpcRefreshTask.dll,-100 REG_NONE
Parental Controls
Deleted @%systemroot%\System32\drivers\WpdUpFltr.sys,-100 REG_NONE WPD
Upper Class Filter Driver
Deleted @%systemroot%\System32\drivers\ws2ifsl.sys,-1000 REG_NONE
Winsock IFS Driver
Deleted @%SystemRoot%\system32\drivers\wtd.sys,-1000 REG_NONE WTD
Deleted @%SystemRoot%\system32\drivers\Wudfpf.sys,-1000 REG_NONE User
Mode Driver Frameworks Platform Driver
Deleted @%SystemRoot%\system32\drivers\WudfRd.sys,-1000 REG_NONE
Windows Driver Foundation - User-mode Driver Framework Reflector
Deleted @%SystemRoot%\System32\wwansvc.dll,-257 REG_NONE WWAN
AutoConfig
Deleted @%systemroot%\system32\XblAuthManager.dll,-100 REG_NONE Xbox
Live Auth Manager
Deleted @%systemroot%\system32\XblGameSave.dll,-100 REG_NONE Xbox Live
Game Save
Deleted @%systemroot%\system32\xboxgipsvc.dll,-100 REG_NONE Xbox
Accessory Management Service
Deleted @%systemroot%\system32\XboxNetApiSvc.dll,-100 REG_NONE Xbox
Live Networking Service
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d9\ Created
Created
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d9\52C64B7E\ Set
@%SystemRoot%\System32\ci.dll,-100 Isolated User Mode (IUM) REG_SZ
@%SystemRoot%\System32\ci.dll,-101 Enclave REG_SZ
@%SystemRoot%\system32\dnsapi.dll,-103 Domain Name System (DNS) Server Trust
REG_SZ
@%SystemRoot%\System32\fveui.dll,-843 BitLocker Drive Encryption REG_SZ
@%SystemRoot%\System32\fveui.dll,-844 BitLocker Data Recovery Agent REG_SZ
@%SystemRoot%\System32\wuaueng.dll,-400 Windows Update REG_SZ
@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 Document
Encryption REG_SZ
@%SystemRoot%\system32\NgcRecovery.dll,-100 Windows Hello Recovery Key
Encryption REG_SZ
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ZoneMap\ Set ProxyBypass 1 REG_DWORD 1
ZoneMap\ Set IntranetName 1 REG_DWORD 1
ZoneMap\ Set UNCAsIntranet 1 REG_DWORD 1
ZoneMap\ Set AutoDetect 0 REG_DWORD 0
HKEY_USERS\.DEFAULT\Software\ESET\ESET Security\CurrentVersion\Plugins\01000200\
Set ProxyLastPrecache 0 REG_QWORD 0

WireGuard Log - Registry Items

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

WireGuard Log - Registry Items

Uploaded by

Copyright:

Available Formats

Key Operation Value Data Type Old Data

You might also like