Twice Shell

[ EDITING: dnsetw.mof ]

#pragma autorecover
#pragma classflags(64)
#pragma namespace("\\\\.\\Root\\WMI")

[Dynamic,Guid("{57840c25-fa99-4f0d-928d-d81d1851e3dd}"),locale("MS\\0x409")] 
class MSDNSSRV_Trace : EventTrace
{
};

[Dynamic,Guid("{62664813-e82f-4ce6-8d6d-264c0d415d99}"),locale("MS\\0x409"),EventVersion(0)] 
class MSDNSSRV_Query : MSDNSSRV_Trace
{
};

[Dynamic,locale("MS\\0x409"),EventType(9)] 
class MSDNSSRV_v4QueryEventBasic : MSDNSSRV_Query
{
  [WmiDataId(1),StringTermination("NullTerminated"),read] string PacketDirection;
  [WmiDataId(2),read] uint32 QueryTime;
  [WmiDataId(3),read] uint32 QueuingTime;
  [WmiDataId(4),read] uint32 ExpiryTime;
  [WmiDataId(5),StringTermination("NullTerminated"),read] string TransportProtocol;
  [WmiDataId(6),read] uint16 RemotePort;
  [WmiDataId(7),extension("IPAddr"),read] object RemoteAddress;
  [WmiDataId(8),read] uint32 pad1;
  [WmiDataId(9),read] uint32 pad2;
  [WmiDataId(10),read] uint32 pad3;
  [WmiDataId(11),read] uint16 Xid;
  [WmiDataId(12),read] sint8 QueryOpCode;
  [WmiDataId(13),read] sint8 ResponseOpCode;
  [WmiDataId(14),StringTermination("NullTerminated"),read] string Flags;
  [WmiDataId(15),read] uint16 NumQuestions;
  [WmiDataId(16),read] uint16 NumAnswerRRs;
  [WmiDataId(17),read] uint16 NumAuthRRs;
  [WmiDataId(18),read] uint16 NumAdditionalRRs;
  [WmiDataId(19),read] uint16 QueryType;
  [WmiDataId(20),read] uint16 QueryClass;
  [WmiDataId(21),StringTermination("NullTerminated"),read] string Question;
};

[Dynamic,locale("MS\\0x409"),EventType(10)] 
class MSDNSSRV_v6QueryEventBasic : MSDNSSRV_Query
{
  [WmiDataId(1),StringTermination("NullTerminated"),read] string PacketDirection;
  [WmiDataId(2),read] uint32 QueryTime;
  [WmiDataId(3),read] uint32 QueuingTime;
  [WmiDataId(4),read] uint32 ExpiryTime;
  [WmiDataId(5),StringTermination("NullTerminated"),read] string TransportProtocol;
  [WmiDataId(6),read] uint16 RemotePort;
  [WmiDataId(7),extension("TDIAddr"),read] object RemoteAddress;
  [WmiDataId(8),read] uint16 Xid;
  [WmiDataId(9),read] sint8 QueryOpCode;
  [WmiDataId(10),read] sint8 ResponseOpCode;
  [WmiDataId(11),StringTermination("NullTerminated"),read] string Flags;
  [WmiDataId(12),read] uint16 NumQuestions;
  [WmiDataId(13),read] uint16 NumAnswerRRs;
  [WmiDataId(14),read] uint16 NumAuthRRs;
  [WmiDataId(15),read] uint16 NumAdditionalRRs;
  [WmiDataId(16),read] uint16 QueryType;
  [WmiDataId(17),read] uint16 QueryClass;
  [WmiDataId(18),StringTermination("NullTerminated"),read] string Question;
};

[Dynamic,Locale("MS\\0x409"),EventType(11)] 
class MSDNSSRV_v4QueryEventFull : MSDNSSRV_Query
{
  [WmiDataId(1),StringTermination("NullTerminated"),read] string PacketDirection;
  [WmiDataId(2),read] uint32 QueryTime;
  [WmiDataId(3),read] uint32 QueuingTime;
  [WmiDataId(4),read] uint32 ExpiryTime;
  [WmiDataId(5),StringTermination("NullTerminated"),read] string TransportProtocol;
  [WmiDataId(6),read] uint16 RemotePort;
  [WmiDataId(7),extension("IPAddr"),read] object RemoteAddress;
  [WmiDataId(8),read] uint32 pad1;
  [WmiDataId(9),read] uint32 pad2;
  [WmiDataId(10),read] uint32 pad3;
  [WmiDataId(11),read] uint16 Xid;
  [WmiDataId(12),read] sint8 QueryOpCode;
  [WmiDataId(13),read] sint8 ResponseOpCode;
  [WmiDataId(14),StringTermination("NullTerminated"),read] string Flags;
  [WmiDataId(15),read] uint16 NumQuestions;
  [WmiDataId(16),read] uint16 NumAnswerRRs;
  [WmiDataId(17),read] uint16 NumAuthRRs;
  [WmiDataId(18),read] uint16 NumAdditionalRRs;
  [WmiDataId(19),StringTermination("NullTerminated"),read] string PacketContents;
};

[Dynamic,locale("MS\\0x409"),EventType(12)] 
class MSDNSSRV_v6QueryEventFull : MSDNSSRV_Query
{
  [WmiDataId(1),StringTermination("NullTerminated"),read] string PacketDirection;
  [WmiDataId(2),read] uint32 QueryTime;
  [WmiDataId(3),read] uint32 QueuingTime;
  [WmiDataId(4),read] uint32 ExpiryTime;
  [WmiDataId(5),StringTermination("NullTerminated"),read] string TransportProtocol;
  [WmiDataId(6),read] uint16 RemotePort;
  [WmiDataId(7),extension("TDIAddr"),read] object RemoteAddress;
  [WmiDataId(8),read] uint16 Xid;
  [WmiDataId(9),read] sint8 QueryOpCode;
  [WmiDataId(10),read] sint8 ResponseOpCode;
  [WmiDataId(11),StringTermination("NullTerminated"),read] string Flags;
  [WmiDataId(12),read] uint16 NumQuestions;
  [WmiDataId(13),read] uint16 NumAnswerRRs;
  [WmiDataId(14),read] uint16 NumAuthRRs;
  [WmiDataId(15),read] uint16 NumAdditionalRRs;
  [WmiDataId(16),StringTermination("NullTerminated"),read] string PacketContents;
};

[Dynamic,Guid("{982a041a-49d0-4146-bc4a-a45ab395bdd5}"),locale("MS\\0x409"),EventVersion(0)] 
class MSDNSSRV_Response : MSDNSSRV_Trace
{
};

[Dynamic,locale("MS\\0x409"),EventType(9)] 
class MSDNSSRV_v4ResponseEventBasic : MSDNSSRV_Response
{
  [WmiDataId(1),StringTermination("NullTerminated"),read] string PacketDirection;
  [WmiDataId(2),read] uint32 QueryTime;
  [WmiDataId(3),read] uint32 QueuingTime;
  [WmiDataId(4),read] uint32 ExpiryTime;
  [WmiDataId(5),StringTermination("NullTerminated"),read] string TransportProtocol;
  [WmiDataId(6),read] uint16 RemotePort;
  [WmiDataId(7),extension("IPAddr"),read] object RemoteAddress;
  [WmiDataId(8),read] uint32 pad1;
  [WmiDataId(9),read] uint32 pad2;
  [WmiDataId(10),read] uint32 pad3;
  [WmiDataId(11),read] uint16 Xid;
  [WmiDataId(12),read] sint8 QueryOpCode;
  [WmiDataId(13),read] sint8 ResponseOpCode;
  [WmiDataId(14),StringTermination("NullTerminated"),read] string Flags;
  [WmiDataId(15),read] uint16 NumQuestions;
  [WmiDataId(16),read] uint16 NumAnswerRRs;
  [WmiDataId(17),read] uint16 NumAuthRRs;
  [WmiDataId(18),read] uint16 NumAdditionalRRs;
};

[Dynamic,locale("MS\\0x409"),EventType(10)] 
class MSDNSSRV_v6ResponseEventBasic : MSDNSSRV_Response
{
  [WmiDataId(1),StringTermination("NullTerminated"),read] string PacketDirection;
  [WmiDataId(2),read] uint32 QueryTime;
  [WmiDataId(3),read] uint32 QueuingTime;
  [WmiDataId(4),read] uint32 ExpiryTime;
  [WmiDataId(5),StringTermination("NullTerminated"),read] string TransportProtocol;
  [WmiDataId(6),read] uint16 RemotePort;
  [WmiDataId(7),extension("TDIAddr"),read] object RemoteAddress;
  [WmiDataId(8),read] uint16 Xid;
  [WmiDataId(9),read] sint8 QueryOpCode;
  [WmiDataId(10),read] sint8 ResponseOpCode;
  [WmiDataId(11),StringTermination("NullTerminated"),read] string Flags;
  [WmiDataId(12),read] uint16 NumQuestions;
  [WmiDataId(13),read] uint16 NumAnswerRRs;
  [WmiDataId(14),read] uint16 NumAuthRRs;
  [WmiDataId(15),read] uint16 NumAdditionalRRs;
};

[Dynamic,Locale("MS\\0x409"),EventType(11)] 
class MSDNSSRV_v4ResponseEventFull : MSDNSSRV_Response
{
  [WmiDataId(1),StringTermination("NullTerminated"),read] string PacketDirection;
  [WmiDataId(2),read] uint32 QueryTime;
  [WmiDataId(3),read] uint32 QueuingTime;
  [WmiDataId(4),read] uint32 ExpiryTime;
  [WmiDataId(5),StringTermination("NullTerminated"),read] string TransportProtocol;
  [WmiDataId(6),read] uint16 RemotePort;
  [WmiDataId(7),extension("IPAddr"),read] object RemoteAddress;
  [WmiDataId(8),read] uint32 pad1;
  [WmiDataId(9),read] uint32 pad2;
  [WmiDataId(10),read] uint32 pad3;
  [WmiDataId(11),read] uint16 Xid;
  [WmiDataId(12),read] sint8 QueryOpCode;
  [WmiDataId(13),read] sint8 ResponseOpCode;
  [WmiDataId(14),StringTermination("NullTerminated"),read] string Flags;
  [WmiDataId(15),read] uint16 NumQuestions;
  [WmiDataId(16),read] uint16 NumAnswerRRs;
  [WmiDataId(17),read] uint16 NumAuthRRs;
  [WmiDataId(18),read] uint16 NumAdditionalRRs;
  [WmiDataId(19),StringTermination("NullTerminated"),read] string PacketContents;
};

[Dynamic,locale("MS\\0x409"),EventType(12)] 
class MSDNSSRV_v6ResponseEventFull : MSDNSSRV_Response
{
  [WmiDataId(1),StringTermination("NullTerminated"),read] string PacketDirection;
  [WmiDataId(2),read] uint32 QueryTime;
  [WmiDataId(3),read] uint32 QueuingTime;
  [WmiDataId(4),read] uint32 ExpiryTime;
  [WmiDataId(5),StringTermination("NullTerminated"),read] string TransportProtocol;
  [WmiDataId(6),read] uint16 RemotePort;
  [WmiDataId(7),extension("TDIAddr"),read] object RemoteAddress;
  [WmiDataId(8),read] uint16 Xid;
  [WmiDataId(9),read] sint8 QueryOpCode;
  [WmiDataId(10),read] sint8 ResponseOpCode;
  [WmiDataId(11),StringTermination("NullTerminated"),read] string Flags;
  [WmiDataId(12),read] uint16 NumQuestions;
  [WmiDataId(13),read] uint16 NumAnswerRRs;
  [WmiDataId(14),read] uint16 NumAuthRRs;
  [WmiDataId(15),read] uint16 NumAdditionalRRs;
  [WmiDataId(16),StringTermination("NullTerminated"),read] string PacketContents;
};

[ CLOSE ]

Name	Size	Attr	Date	Action
[DIR] AutoRecover	-	----	26-09-03 09:02	REN ATTR DEL
[DIR] en	-	----	18-09-15 14:40	REN ATTR DEL
[DIR] en-US	-	----	24-07-12 02:55	REN ATTR DEL
[DIR] Logs	-	----	18-09-15 12:49	REN ATTR DEL
[DIR] MOF	-	----	22-02-28 02:21	REN ATTR DEL
[DIR] Performance	-	----	26-08-23 08:04	REN ATTR DEL
[DIR] Repository	-	----	26-08-22 17:18	REN ATTR DEL
[DIR] tmf	-	----	18-09-15 12:49	REN ATTR DEL
[DIR] xml	-	----	18-09-15 12:49	REN ATTR DEL
[FILE] aeinv.mof	2.79 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] AgentWmi.mof	17.10 KB	---A	18-09-15 14:40	DL REN ATTR DEL
[FILE] AgentWmiUninstall.mof	693 B	---A	18-09-15 12:43	DL REN ATTR DEL
[FILE] appbackgroundtask.dll	39.50 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] appbackgroundtask.mof	2.83 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] appbackgroundtask_uninstall.mof	852 B	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] AuditRsop.mof	1.68 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] authfwcfg.mof	1.07 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] bcd.mof	11.84 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] BthMtpEnum.mof	2.56 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] cimdmtf.mof	157.39 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] cimwin32.dll	2.02 MB	---A	26-08-12 09:10	DL REN ATTR DEL
[FILE] cimwin32.mof	2.59 MB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] CIWmi.mof	2.04 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] classlog.mof	4.85 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] cli.mof	31.86 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] cliegaliases.mof	2.68 MB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] dimsjob.mof	1.21 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] dimsroam.mof	1.25 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] DMWmiBridgeProv.dll	4.06 MB	---A	24-07-12 01:50	DL REN ATTR DEL
[FILE] DMWmiBridgeProv.mof	301.06 KB	---A	22-02-27 15:00	DL REN ATTR DEL
[FILE] DMWmiBridgeProv1.dll	804.00 KB	---A	24-07-12 01:50	DL REN ATTR DEL
[FILE] DMWmiBridgeProv1.mof	29.49 KB	---A	24-07-12 01:50	DL REN ATTR DEL
[FILE] DMWmiBridgeProv1_Uninstall.mof	4.18 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] DMWmiBridgeProv_Uninstall.mof	17.80 KB	---A	22-02-27 15:00	DL REN ATTR DEL
[FILE] dnsclientcim.dll	123.00 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] dnsclientcim.mof	61.98 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] dnsclientpsprovider.dll	185.50 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] dnsclientpsprovider.mof	14.30 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] dnsclientpsprovider_Uninstall.mof	1.25 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] dnsetw.mof	17.01 KB	---A	22-02-27 14:00	DL REN ATTR DEL
[FILE] dnsprov.dll	328.00 KB	---A	26-08-12 09:09	DL REN ATTR DEL
[FILE] dnsprov.mof	192.77 KB	---A	22-02-27 14:00	DL REN ATTR DEL
[FILE] dnsserverpsprovider.dll	2.00 MB	---A	26-08-12 09:09	DL REN ATTR DEL
[FILE] DnsServerPsProvider.mof	287.01 KB	---A	22-02-27 14:00	DL REN ATTR DEL
[FILE] DnsServerPsProvider_Uninstall.mof	17.31 KB	---A	22-02-27 14:00	DL REN ATTR DEL
[FILE] drvinst.mof	3.60 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] DscCore.mof	34.23 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] DscCoreConfProv.mof	6.52 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] dscproxy.mof	1.12 KB	---A	18-09-15 12:42	DL REN ATTR DEL
[FILE] Dscpspluginwkr.dll	19.00 KB	---A	18-09-15 12:42	DL REN ATTR DEL

TWICE

[ EDITING: dnsetw.mof ]