Twice Shell

[ EDITING: ceb497ee0184aaa4681d2fb2ef242a5b8551eea8.xml ]

<?xml version="1.0" encoding="utf-16"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" manifestVersion="1.0">
  <memberships>
    <categoryMembership>
      <id name="Microsoft.Windows.Categories.Services" typeName="Service" version="10.0.17763.8641" publicKeyToken="31bf3856ad364e35" />
      <categoryInstance subcategory="WaaSMedicSvc">
        <serviceData dependOnService="rpcss" description="@WaaSMedicSvc.dll,-101" displayName="@WaaSMedicSvc.dll,-100" errorControl="normal" imagePath="%systemroot%\system32\svchost.exe -k wusvcs -p" launchProtected="windowsLight" name="WaaSMedicSvc" objectName="LocalSystem" requiredPrivileges="SeTcbPrivilege,SeChangeNotifyPrivilege,SeImpersonatePrivilege,SeTakeOwnershipPrivilege,SeSecurityPrivilege,SeRestorePrivilege" sidType="unrestricted" start="demand" startAfterInstall="none" type="win32ShareProcess">
          <securityDescriptor name="WAASMEDIC_SERVICE_SDDL" />
          <failureActions resetPeriod="900">
            <actions>
              <action delay="120000" type="restartService" />
              <action delay="300000" type="restartService" />
              <action delay="0" type="none" />
            </actions>
          </failureActions>
        </serviceData>
      </categoryInstance>
    </categoryMembership>
  </memberships>
  <trustInfo>
    <security>
      <accessControl>
        <securityDescriptorDefinitions>
          <securityDescriptorDefinition name="WAASMEDIC_SERVICE_SDDL" sddl="D:(A;;CCLCSWRPLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD)" />
        </securityDescriptorDefinitions>
      </accessControl>
    </security>
  </trustInfo>
</assembly>

[ CLOSE ]

Name	Size	Attr	Date	Action
[FILE] 14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml	4.11 KB	---A	26-07-15 09:12	DL REN ATTR DEL
[FILE] 20bbcadaff3e0543ef358ba4dd8b74bfe8e747c8.xml	3.20 KB	---A	24-07-12 01:50	DL REN ATTR DEL
[FILE] 2213703c9c64cc61ba900531652e23c84728d2a2.xml	4.01 KB	---A	22-02-27 15:01	DL REN ATTR DEL
[FILE] 315818c03ccc2b10070df2d4ebd09eb6c4c66e58.xml	3.50 KB	---A	24-07-12 01:50	DL REN ATTR DEL
[FILE] 43ee7b2a373632f9a701249fd96d0edec2ff1279.xml	3.72 KB	---A	22-02-27 15:01	DL REN ATTR DEL
[FILE] ceb497ee0184aaa4681d2fb2ef242a5b8551eea8.xml	3.60 KB	---A	26-04-15 06:50	DL REN ATTR DEL

TWICE

[ EDITING: ceb497ee0184aaa4681d2fb2ef242a5b8551eea8.xml ]