iMxLIB3+ImFW7cPamC4wxuBDypIL4e9d7Kjj/aA41WU= 16ZmppS4IZ3hjoUXu5MXS+ukqRwCbw32yMhbUE3KOyI= O776epkCa/8Eg/u0DAGzhIZ6zeQ/JN3GxllbNIYOJXg= GaHo6Qb0kHlPGFs3rWNdrvkpxKhzf10xnDuC3SMW6KA= FuW9GqTXMVLxga7EF2xanVU+8jYiPF5bhyqefJen85w= HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\* [*] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Provider [{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Provider [{4b153735-1049-4480-aab4-d1b9bdc03710}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Provider [{a90296f7-46b8-4457-8f84-b05e05d3c622}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\SubLayer [{b3cdd441-af90-41ba-a745-7c6008ff2300}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\SubLayer [{b3cdd441-af90-41ba-a745-7c6008ff2301}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\SubLayer [{b3cdd441-af90-41ba-a745-7c6008ff2302}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\SubLayer [{09a47e38-fa97-471b-b123-18bcd7e65071}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\* [*] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Provider [{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Provider [{4b153735-1049-4480-aab4-d1b9bdc03710}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Provider [{a90296f7-46b8-4457-8f84-b05e05d3c622}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\SubLayer [{b3cdd441-af90-41ba-a745-7c6008ff2300}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\SubLayer [{b3cdd441-af90-41ba-a745-7c6008ff2301}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\SubLayer [{b3cdd441-af90-41ba-a745-7c6008ff2302}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\SubLayer [{09a47e38-fa97-471b-b123-18bcd7e65071}] HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\* [*] \Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange $(@%SystemRoot%\system32\bfe.dll,-2001) $(@%SystemRoot%\system32\bfe.dll,-2002) S-1-5-18 <QueryList><Query Id="0" Path="System"><Select Path="System">*/System/Provider[@Name='Service Control Manager'] and */System/EventID='7040' and */EventData/Data[@Name='param4']='BFE'</Select></Query></QueryList> false false false false false true false false 7 Queue true %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange