From 6ec2eb61a02f9e55ef5b8d22a5ca61ca53ca05e7 Mon Sep 17 00:00:00 2001 From: heqnx Date: Fri, 11 Jul 2025 21:55:20 +0300 Subject: added initial setup for domain controller --- ansible/files/software/BgInfo.bgi | Bin 0 -> 1174 bytes ansible/files/software/BgInfo.exe | Bin 0 -> 2198952 bytes ansible/files/software/PsExec64.exe | Bin 0 -> 833472 bytes ansible/files/software/Sysmon64.exe | Bin 0 -> 4545344 bytes .../googlechromestandaloneenterprise64.msi | Bin 0 -> 119250944 bytes ansible/files/software/npp.exe | Bin 0 -> 4840120 bytes ansible/files/software/sysmonconfig-export.xml | 1200 ++++++++++++++++++++ 7 files changed, 1200 insertions(+) create mode 100644 ansible/files/software/BgInfo.bgi create mode 100644 ansible/files/software/BgInfo.exe create mode 100644 ansible/files/software/PsExec64.exe create mode 100644 ansible/files/software/Sysmon64.exe create mode 100644 ansible/files/software/googlechromestandaloneenterprise64.msi create mode 100644 ansible/files/software/npp.exe create mode 100644 ansible/files/software/sysmonconfig-export.xml (limited to 'ansible/files/software') diff --git a/ansible/files/software/BgInfo.bgi b/ansible/files/software/BgInfo.bgi new file mode 100644 index 0000000..ecd219f Binary files /dev/null and b/ansible/files/software/BgInfo.bgi differ diff --git a/ansible/files/software/BgInfo.exe b/ansible/files/software/BgInfo.exe new file mode 100644 index 0000000..76d3d31 Binary files /dev/null and b/ansible/files/software/BgInfo.exe differ diff --git a/ansible/files/software/PsExec64.exe b/ansible/files/software/PsExec64.exe new file mode 100644 index 0000000..db94608 Binary files /dev/null and b/ansible/files/software/PsExec64.exe differ diff --git a/ansible/files/software/Sysmon64.exe b/ansible/files/software/Sysmon64.exe new file mode 100644 index 0000000..8d72282 Binary files /dev/null and b/ansible/files/software/Sysmon64.exe differ diff --git a/ansible/files/software/googlechromestandaloneenterprise64.msi b/ansible/files/software/googlechromestandaloneenterprise64.msi new file mode 100644 index 0000000..b958b6f Binary files /dev/null and b/ansible/files/software/googlechromestandaloneenterprise64.msi differ diff --git a/ansible/files/software/npp.exe b/ansible/files/software/npp.exe new file mode 100644 index 0000000..3ca17fa Binary files /dev/null and b/ansible/files/software/npp.exe differ diff --git a/ansible/files/software/sysmonconfig-export.xml b/ansible/files/software/sysmonconfig-export.xml new file mode 100644 index 0000000..028d373 --- /dev/null +++ b/ansible/files/software/sysmonconfig-export.xml @@ -0,0 +1,1200 @@ + + + + + md5,sha256,IMPHASH + + + + + + + + + + + + + + + + + "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" + C:\Windows\system32\DllHost.exe /Processid + C:\Windows\system32\wbem\wmiprvse.exe -Embedding + C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding + C:\Windows\system32\wermgr.exe -upload + C:\Windows\system32\SearchIndexer.exe /Embedding + C:\windows\system32\wermgr.exe -queuereporting + \??\C:\Windows\system32\autochk.exe * + \SystemRoot\System32\smss.exe + C:\Windows\System32\RuntimeBroker.exe -Embedding + C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe + C:\Windows\System32\TokenBrokerCookies.exe + C:\Windows\System32\plasrv.exe + C:\Windows\System32\wifitask.exe + C:\Windows\system32\CompatTelRunner.exe + C:\Windows\system32\PrintIsolationHost.exe + C:\Windows\system32\SppExtComObj.Exe + C:\Windows\system32\audiodg.exe + C:\Windows\system32\conhost.exe + C:\Windows\system32\mobsync.exe + C:\Windows\system32\musNotification.exe + C:\Windows\system32\musNotificationUx.exe + C:\Windows\system32\powercfg.exe + C:\Windows\system32\sndVol.exe + C:\Windows\system32\sppsvc.exe + C:\Windows\system32\wbem\WmiApSrv.exe + AppContainer + %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows + C:\windows\system32\wermgr.exe -queuereporting + C:\WINDOWS\system32\devicecensus.exe UserCxt + C:\Windows\System32\usocoreworker.exe -Embedding + C:\Windows\system32\SearchIndexer.exe + + C:\Windows\system32\svchost.exe -k appmodel -s StateRepository + C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc + C:\Windows\system32\svchost.exe -k appmodel + C:\Windows\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc + C:\Windows\system32\svchost.exe -k camera -s FrameServer + C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM + C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay + C:\Windows\system32\svchost.exe -k defragsvc + C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc + C:\Windows\system32\svchost.exe -k imgsvc + C:\Windows\system32\svchost.exe -k localService -s EventSystem + C:\Windows\system32\svchost.exe -k localService -s bthserv + C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc + C:\Windows\system32\svchost.exe -k localService -s nsi + C:\Windows\system32\svchost.exe -k localService -s w32Time + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc + C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -s BTAGService + C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p -s SSDPSRV + C:\Windows\system32\svchost.exe -k localServiceNoNetwork + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s NgcSvc + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -p -s NgcCtnrSvc + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SCardSvr + C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv + C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost + C:\Windows\System32\svchost.exe -k localSystemNetworkRestricted -p -s WdiSystemHost + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted + C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc + C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc + C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC + C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC + C:\Windows\system32\svchost.exe -k netsvcs -p -s BITS + C:\Windows\system32\svchost.exe -k netsvcs -s BITS + C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc + C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc + C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo + C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc + C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc + C:\Windows\system32\svchost.exe -k netsvcs -s SENS + C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv + C:\Windows\system32\svchost.exe -k netsvcs -s Themes + C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt + C:\Windows\system32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc + C:\Windows\system32\svchost.exe -k networkService -s Dnscache + C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation + C:\Windows\system32\svchost.exe -k networkService -s NlaSvc + C:\Windows\system32\svchost.exe -k networkService -s TermService + C:\Windows\system32\svchost.exe -k networkService + C:\Windows\system32\svchost.exe -k networkService -p + C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k rPCSS + C:\Windows\system32\svchost.exe -k secsvcs + C:\Windows\system32\svchost.exe -k swprv + C:\Windows\system32\svchost.exe -k unistackSvcGroup + C:\Windows\system32\svchost.exe -k utcsvc + C:\Windows\system32\svchost.exe -k wbioSvcGroup + C:\Windows\system32\svchost.exe -k werSvcGroup + C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc + C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC + C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc + C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC + C:\Windows\system32\svchost.exe -k wsappx + C:\Windows\system32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted + C:\Windows\system32\deviceenroller.exe /c /AutoEnrollMDM + + "C:\Program Files (x86)\Microsoft\Edge Dev\Application\msedge.exe" --type= + + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe + C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe + C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe + + C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE + C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE + C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE + C:\Program Files\Microsoft Office\Office16\msoia.exe + C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + + C:\Program Files\Windows Media Player\wmpnscfg.exe + + "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= + "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= + + + + + + + + + + C:\Users + .exe + \Device\HarddiskVolumeShadowCopy + + + + + + OneDrive.exe + C:\Windows\system32\backgroundTaskHost.exe + setup + install + Update\ + redist.exe + msiexec.exe + TrustedInstaller.exe + \NVIDIA\NvBackend\ApplicationOntology\ + + + + + + + + + + + + + + + + + C:\Users + C:\Recycle + C:\ProgramData + C:\Windows\Temp + \ + C:\perflogs + C:\intel + C:\Windows\fonts + C:\Windows\system32\config + + at.exe + certutil.exe + cmd.exe + cmstp.exe + cscript.exe + driverquery.exe + dsquery.exe + hh.exe + infDefaultInstall.exe + java.exe + javaw.exe + javaws.exe + mmc.exe + msbuild.exe + mshta.exe + msiexec.exe + nbtstat.exe + net.exe + net1.exe + notepad.exe + nslookup.exe + powershell.exe + powershell_ise.exe + qprocess.exe + qwinsta.exe + qwinsta.exe + reg.exe + regsvcs.exe + regsvr32.exe + rundll32.exe + rwinsta.exe + sc.exe + schtasks.exe + taskkill.exe + tasklist.exe + wmic.exe + wscript.exe + + bitsadmin.exe + esentutl.exe + expand.exe + extrac32.exe + findstr.exe + GfxDownloadWrapper.exe + ieexec.exe + makecab.exe + replace.exe + Excel.exe + Powerpnt.exe + Winword.exe + squirrel.exe + + nc.exe + ncat.exe + psexec.exe + psexesvc.exe + tor.exe + vnc.exe + vncservice.exe + vncviewer.exe + winexesvc.exe + nmap.exe + psinfo.exe + + 22 + 23 + 25 + 143 + 3389 + 5800 + 5900 + 4444 + + 1080 + 3128 + 8080 + + 1723 + 9001 + 9030 + + + + + + + C:\ProgramData\Microsoft\Windows Defender\Platform\ + AppData\Local\Microsoft\Teams\current\Teams.exe + .microsoft.com + microsoft.com.akadns.net + microsoft.com.nsatc.net + + 23.4.43.27 + 72.21.91.29 + + 127.0.0.1 + fe80:0:0:0 + + + + + + + + + + + + + + + C:\Users + \ + + + + + + + + + + + + + + + + microsoft + windows + Intel + + + + + + + + + + + + + + + + + + + + + + C:\Windows\system32\wbem\WmiPrvSE.exe + C:\Windows\system32\svchost.exe + C:\Windows\system32\wininit.exe + C:\Windows\system32\csrss.exe + C:\Windows\system32\services.exe + C:\Windows\system32\winlogon.exe + C:\Windows\system32\audiodg.exe + C:\Windows\system32\kernel32.dll + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \Start Menu + \Startup\ + \Content.Outlook\ + \Downloads\ + .application + .appref-ms + .bat + .chm + .cmd + .cmdline + .crx + .dmp + .docm + .dll + .exe + .exe.log + .jar + .jnlp + .jse + .hta + .job + .pptm + .ps1 + .sct + .sys + .scr + .vbe + .vbs + .wsc + .wsf + .xlsm + .ocx + proj + .sln + .xls + C:\Users\Default + C:\Windows\system32\Drivers + C:\Windows\SysWOW64\Drivers + C:\Windows\system32\GroupPolicy\Machine\Scripts + C:\Windows\system32\GroupPolicy\User\Scripts + C:\Windows\system32\Wbem + C:\Windows\SysWOW64\Wbem + C:\Windows\system32\WindowsPowerShell + C:\Windows\SysWOW64\WindowsPowerShell + C:\Windows\Tasks\ + C:\Windows\system32\Tasks + C:\Windows\SysWOW64\Tasks + \Device\HarddiskVolumeShadowCopy + + C:\Windows\AppPatch\Custom + VirtualStore + + .xls + .ppt + .rtf + + + + + + + C:\Program Files (x86)\EMET 5.5\EMET_Service.exe + + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + + C:\Windows\system32\smss.exe + C:\Windows\system32\CompatTelRunner.exe + \\?\C:\Windows\system32\wbem\WMIADAP.EXE + C:\Windows\system32\mobsync.exe + C:\Windows\system32\DriverStore\Temp\ + C:\Windows\system32\wbem\Performance\ + C:\Windows\Installer\ + + C:\$WINDOWS.~BT\Sources\ + C:\Windows\winsxs\amd64_microsoft-windows + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + CurrentVersion\Run + Policies\Explorer\Run + Group Policy\Scripts + Windows\System\Scripts + CurrentVersion\Windows\Load + CurrentVersion\Windows\Run + CurrentVersion\Winlogon\Shell + CurrentVersion\Winlogon\System + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit + HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + UserInitMprLogonScript + user shell folders\startup + + \ServiceDll + \ServiceManifest + \ImagePath + \Start + + Control\Terminal Server\WinStations\RDP-Tcp\PortNumber + Control\Terminal Server\fSingleSessionPerUser + fDenyTSConnections + LastLoggedOnUser + RDP-tcp\PortNumber + Services\PortProxy\v4tov4 + + \command\ + \ddeexec\ + {86C86720-42A0-1069-A2E8-08002B30309D} + exefile + + \InprocServer32\(Default) + + \Hidden + \ShowSuperHidden + \HideFileExt + + Classes\*\ + Classes\AllFilesystemObjects\ + Classes\Directory\ + Classes\Drive\ + Classes\Folder\ + Classes\PROTOCOLS\ + ContextMenuHandlers\ + CurrentVersion\Shell + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + + HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ + + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + + HKLM\SYSTEM\CurrentControlSet\Services\WinSock + \ProxyServer + + HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders + HKLM\Software\Microsoft\Netsh + Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable + + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + \EnableFirewall + \DoNotAllowExceptions + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + + Microsoft\Office\Outlook\Addins\ + Office Test\ + Security\Trusted Documents\TrustRecords + \EnableBHO + + Internet Explorer\Toolbar\ + Internet Explorer\Extensions\ + Browser Helper Objects\ + \DisableSecuritySettingsCheck + \3\1206 + \3\2500 + \3\1809 + + HKLM\Software\Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\ + HKLM\Software\Classes\WOW6432Node\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\ + HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\ + HKLM\Software\Classes\WOW6432Node\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\ + + \UrlUpdateInfo + \InstallSource + \EulaAccepted + + \DisableAntiSpyware + \DisableAntiVirus + \SpynetReporting + DisableRealtimeMonitoring + \SubmitSamplesConsent + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\ + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + + HKLM\Software\Microsoft\Security Center\ + SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + VirtualStore + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\ + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \FriendlyName + HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\Software\Microsoft\Tracing\RASAPI32 + HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\ + \Keyboard Layout\Preload + \Keyboard Layout\Substitutes + + \LowerCaseLongPath + \Publisher + \BinProductVersion + \DriverVersion + \DriverVerVersion + \LinkDate + Compatibility Assistant\Store\ + + regedit.exe + \ + + + + + + + + \{CAFEEFAC- + CreateKey + HKLM\COMPONENTS + + HKLM\Software\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache + + Toolbar\WebBrowser + Browser\ITBar7Height + Browser\ITBar7Layout + Internet Explorer\Toolbar\Locked + Toolbar\WebBrowser\{47833539-D0C5-4125-9FA8-0819E2EAAC93} + }\PreviousPolicyAreas + \Control\WMI\Autologger\ + HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start + \Lsa\OfflineJoin\CurrentValue + HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ + _Classes\AppX + HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LsaPid + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains + + \Services\BITS\Start + \services\clr_optimization_v2.0.50727_32\Start + \services\clr_optimization_v2.0.50727_64\Start + \services\clr_optimization_v4.0.30319_32\Start + \services\clr_optimization_v4.0.30319_64\Start + \services\deviceAssociationService\Start + \services\fhsvc\Start + \services\nal\Start + \services\trustedInstaller\Start + \services\tunnel\Start + \services\usoSvc\Start + + \UserChoice\ProgId + \UserChoice\Hash + \OpenWithList\MRUList + Shell Extentions\Cached + + HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\PSScriptOrder + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\SOM-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\GPO-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\IsPowershell + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\ExecTime + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\PSScriptOrder + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\SOM-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\GPO-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\IsPowershell + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\ExecTime + \safer\codeidentifiers\0\HASHES\{ + + VirtualStore\MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\ + HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ + + C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe + HKCR\VLC. + HKCR\iTunes. + + HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{945a8954-c147-4acd-923f-40c45405a658} + + + + + + + + + + + Downloads + Temp\7z + Startup + .bat + .cmd + .doc + .hta + .jse + .lnk + .ppt + .ps1 + .ps2 + .reg + .sct + .vb + .vbe + .vbs + .wsc + .wsf + + + + + + + + + + + + + + + + + + + + + + + + + + paexec;remcom;csexec + + \lsadump;\cachedump;\wceservicepipe + + \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\svcctl;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + + MSSE-;-server + \postex_ + \postex_ssh_ + \status_ + \msagent_ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + .arpa. + .arpa + .msftncsi.com + ..localmachine + localhost + + -pushp.svc.ms + .b-msedge.net + .bing.com + .hotmail.com + .live.com + .live.net + .s-microsoft.com + .microsoft.com + .microsoftonline.com + .microsoftstore.com + .ms-acdc.office.com + .msedge.net + .msn.com + .msocdn.com + .skype.com + .skype.net + .windows.com + .windows.net.nsatc.net + .windowsupdate.com + .xboxlive.com + login.windows.net + C:\ProgramData\Microsoft\Windows Defender\Platform\ + + .activedirectory.windowsazure.com + .aria.microsoft.com + .msauth.net + .msftauth.net + .office.net + .opinsights.azure.com + .res.office365.com + acdc-direct.office.com + atm-fp-direct.office.com + loki.delve.office.com + management.azure.com + messaging.office.com + outlook.office365.com + portal.azure.com + protection.outlook.com + substrate.office.com + .measure.office.com + + .adobe.com + .adobe.io + .mozaws.net + .mozilla.com + .mozilla.net + .mozilla.org + .spotify.com + .spotify.map.fastly.net + .wbx2.com + .webex.com + clients1.google.com + clients2.google.com + clients3.google.com + clients4.google.com + clients5.google.com + clients6.google.com + safebrowsing.googleapis.com + + .akadns.net + .netflix.com + aspnetcdn.com + ajax.googleapis.com + cdnjs.cloudflare.com + fonts.googleapis.com + .typekit.net + cdnjs.cloudflare.com + .stackassets.com + .steamcontent.com + play.google.com + content-autofill.googleapis.com + + .disqus.com + .fontawesome.com + disqus.com + + .1rx.io + .2mdn.net + .3lift.com + .adadvisor.net + .adap.tv + .addthis.com + .adform.net + .adnxs.com + .adroll.com + .adrta.com + .adsafeprotected.com + .adsrvr.org + .adsymptotic.com + .advertising.com + .agkn.com + .amazon-adsystem.com + .amazon-adsystem.com + .analytics.yahoo.com + .aol.com + .betrad.com + .bidswitch.net + .casalemedia.com + .chartbeat.net + .cnn.com + .convertro.com + .criteo.com + .criteo.net + .crwdcntrl.net + .demdex.net + .domdex.com + .dotomi.com + .doubleclick.net + .doubleverify.com + .emxdgt.com + .everesttech.net + .exelator.com + .google-analytics.com + .googleadservices.com + .googlesyndication.com + .googletagmanager.com + .googlevideo.com + .gstatic.com + .gvt1.com + .gvt2.com + .ib-ibi.com + .jivox.com + .krxd.net + .lijit.com + .mathtag.com + .moatads.com + .moatpixel.com + .mookie1.com + .myvisualiq.net + .netmng.com + .nexac.com + .openx.net + .optimizely.com + .outbrain.com + .pardot.com + .phx.gbl + .pinterest.com + .pubmatic.com + .quantcount.com + .quantserve.com + .revsci.net + .rfihub.net + .rlcdn.com + .rubiconproject.com + .scdn.co + .scorecardresearch.com + .serving-sys.com + .sharethrough.com + .simpli.fi + .sitescout.com + .smartadserver.com + .snapads.com + .spotxchange.com + .taboola.com + .taboola.map.fastly.net + .tapad.com + .tidaltv.com + .trafficmanager.net + .tremorhub.com + .tribalfusion.com + .turn.com + .twimg.com + .tynt.com + .w55c.net + .ytimg.com + .zorosrv.com + 1rx.io + adservice.google.com + ampcid.google.com + clientservices.googleapis.com + googleadapis.l.google.com + imasdk.googleapis.com + l.google.com + ml314.com + mtalk.google.com + update.googleapis.com + www.googletagservices.com + + .pscp.tv + + .amazontrust.com + .digicert.com + .globalsign.com + .globalsign.net + .intel.com + .symcb.com + .symcd.com + .thawte.com + .usertrust.com + .verisign.com + ocsp.identrust.com + pki.goog + msocsp.com + ocsp.comodoca.com + ocsp.entrust.net + ocsp.godaddy.com + ocsp.int-x3.letsencrypt.org + ocsp.msocsp.com + pki.goog + ocsp.godaddy.com + amazontrust.com + ocsp.sectigo.com + pki-goog.l.google.com + .usertrust.com + ocsp.comodoca.com + ocsp.verisign.com + ocsp.entrust.net + ocsp.identrust.com + status.rapidssl.com + status.thawte.com + ocsp.int-x3.letsencrypt.org + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + -- cgit v1.2.3