Twice Shell

[ EDITING: WMI-Core-Replacement.man ]

<?xml version='1.0' encoding='utf-8' standalone='yes'?>
<assembly
    xmlns="urn:schemas-microsoft-com:asm.v3"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    manifestVersion="1.0"
    >
  <assemblyIdentity
      language="neutral"
      name="Microsoft-Windows-WMI-Core"
      processorArchitecture="*"
      publicKeyToken="$(Build.WindowsPublicKeyToken)"
      version="0.0.0.0"
      versionScope="nonSxS"
      />
  <migration 
      replacementSettingsVersionRange="0"
      settingsVersion="1"
      >
    <migXml xmlns="">
      <plugin
          classId="{401F8281-A9B6-49F9-9F71-8AEA167EEEFD}"
          file="%windir%\system32\migration\WMIMigrationPlugin.dll"
          offlineApply="yes"
          />
      <rules context="system">
        <include>
          <objectSet>
            <pattern type="File">%windir%\system32\wbem\* [*]</pattern>
            <pattern type="File">%windir%\sysWow64\wbem\* [*]</pattern>
            <pattern type="Registry">HKLM\Software\Microsoft\WBEM\CIMOM [Autorecover MOFs]</pattern>
            <pattern type="Registry">HKLM\Software\Microsoft\WBEM\CIMOM\SecuredHostProviders [*]</pattern>
            <pattern type="Registry">HKLM\Software\Microsoft\WBEM\CIMOM\CompatibleHostProviders [*]</pattern>
            <pattern type="Registry">HKLM\Software\Microsoft\WBEM\CIMOM [DefaultSecuredHost]</pattern>
            <pattern type="Registry">HKLM\Software\Microsoft\WBEM\CIMOM [AutoRestoreEnabled]</pattern>
            <pattern type="Registry">HKLM\Software\Wow6432Node\Microsoft\WBEM\CIMOM\SecuredHostProviders [*]</pattern>
            <pattern type="Registry">HKLM\Software\Wow6432Node\Microsoft\WBEM\CIMOM\CompatibleHostProviders [*]</pattern>
            <pattern type="Registry">HKLM\Software\Wow6432Node\Microsoft\WBEM\CIMOM [DefaultSecuredHost]</pattern>
          </objectSet>
        </include>
        <exclude>
          <objectSet>
            <pattern type="File">%windir%\system32\wbem\AutoRecover\* [*]</pattern>
            <pattern type="File">%windir%\system32\wbem\logs [*]</pattern>
            <pattern type="File">%windir%\system32\wbem\Repository [*]</pattern>
            <pattern type="File">%windir%\system32\wbem\xml [*]</pattern>
            <pattern type="File">%windir%\sysWow64\wbem\AutoRecover\* [*]</pattern>
            <pattern type="File">%windir%\sysWow64\wbem\logs [*]</pattern>
            <pattern type="File">%windir%\sysWow64\wbem\Repository [*]</pattern>
            <pattern type="File">%windir%\sysWow64\wbem\xml [*]</pattern>
          </objectSet>
        </exclude>
      </rules>
    </migXml>
  </migration>
</assembly>

[ CLOSE ]

Name	Size	Attr	Date	Action
[FILE] UPnPDeviceHost-Server-Replacement.man	2.40 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] UPnPSSDP-Replacement.man	2.27 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] UPnPSSDP-Server-Replacement.man	2.27 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] UsbMigration-Replacement.man	1.65 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] virtualdiskservice-repl.man	1.74 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] volsnap-repl.man	2.89 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] vssservice-repl.man	4.02 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] WCF-HTTP-Activation-Replacement.man	850 B	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] WCF-NonHTTP-Activation-Replacement.man	860 B	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] win32k-settings-Replacement.man	12.68 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] WindowsPushNotifications-Platform-Library-Replacement.man	1.36 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] WindowsSearchEngine-replacement.man	5.97 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] Winlogon-Replacement.man	12.18 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] winmde-migration-replacement.man	1016 B	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] WMI-Core-Replacement.man	2.68 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] WMPNSService-migration-replacement.man	1.47 KB	---A	18-09-15 12:42	DL REN ATTR DEL

TWICE

[ EDITING: WMI-Core-Replacement.man ]