Wdebuglog

9/5/2019 8:28:18 ***********************************************************
9/5/2019 8:28:18 1. DebugLevel in Registry entry :3

9/5/2019 8:28:18 2. DebugType in Registry entry :0
9/5/2019 8:28:18 Start of CService Cunstructor
9/5/2019 8:28:18 End of CService Cunstructor
9/5/2019 8:28:18 End of WinMain()
9/5/2019 8:28:18 ^^^^^^^^ after reghanex()
9/5/2019 8:28:18 Start of CService::SetStatus
9/5/2019 8:28:18 End of CService::SetStatus
9/5/2019 8:28:18 The MAC retrieved from Registry is 008064FB707A
9/5/2019 8:28:18 MAC found using Method 1. MAC: 008064FB707A
9/5/2019 8:28:18 Start of CService::Run()
9/5/2019 8:28:18 HAgent_UI launched successfully!
9/5/2019 8:28:18 Launched HAgent_UI. Return Code 1
9/5/2019 8:28:18 Start up delay 20 seconds...
9/5/2019 8:28:38 Start of CCI::GetOSVersion()
9/5/2019 8:28:38 OS Version 6.2.9200
9/5/2019 8:28:38 OS Version 6.2.9200
9/5/2019 8:28:38 Major version 6
9/5/2019 8:28:38 Minor version 2
9/5/2019 8:28:38 MAJOR VERSION 6 MINOR VERSION 2
9/5/2019 8:28:38 Major version 6, Minor version 2
9/5/2019 8:28:38 WE8Sx operating system!
9/5/2019 8:28:38 WE8S 64 bit Operating System!
9/5/2019 8:28:38 Device Info: OS is `�*
9/5/2019 8:28:38 End of CCI::GetOSVersion()
9/5/2019 8:28:38 The image has UWF
9/5/2019 8:28:38 Start of CCI::GetDriveParams()
9/5/2019 8:28:38 Device Info: Media type: 12
9/5/2019 8:28:38 Device Info: Media size: 30529
9/5/2019 8:28:38 Flash Size - Last absolute value supported 8192
9/5/2019 8:28:38 End of CCI::GetDriveParams()
9/5/2019 8:28:38 Start of CService::WriteFilterStat
9/5/2019 8:28:38 End of CService::WriteFilterStat
9/5/2019 8:28:38 Start of CService::WriteFilterStatXP
9/5/2019 8:28:38 WRITE FILTER UWF 1
9/5/2019 8:28:38 Setting UWF Mgr!
9/5/2019 8:28:38 UWF exists and is on!
9/5/2019 8:28:38 End of CService::WriteFilterStatXP
9/5/2019 8:28:38 Device Info: WriteFilter EXISTS and is ON
9/5/2019 8:28:38 Start of CService::ReadRegDiscoveryFlags
9/5/2019 8:28:38 ReadRegDiscoveryFlags 1
9/5/2019 8:28:38 Empty Key in ini file: SOFTWARE\RAPPORT\HAGENT : DISCDNS
9/5/2019 8:28:38 Empty Key in ini file: SOFTWARE\RAPPORT\HAGENT : DISCSRV
9/5/2019 8:28:38 Empty Key in ini file: SOFTWARE\RAPPORT\HAGENT : DISCDHCP
9/5/2019 8:28:38 Empty Key in ini file: SOFTWARE\RAPPORT\HAGENT : DISCMAN
9/5/2019 8:28:38 fn GetBAandBUParDetails enter
9/5/2019 8:28:38 Disk offset 659554304
9/5/2019 8:28:38 Disk offset =1048576
9/5/2019 8:28:38 Disk layout is of type GPT
9/5/2019 8:28:39 PartitionType - BASIC DATA Name :Basic data partition
9/5/2019 8:28:39 PARTITION ID {2E3D264F-A5F2-4B12-A5AA-366414082254}
9/5/2019 8:28:39 File System Name :FAT32
9/5/2019 8:28:39 fn GetBAandBUParDetails szBPB=�X�MerBA###

9/5/2019 8:28:39 fn GetBAandBUParDetails Merlin BA version=354
9/5/2019 8:28:39 Disk offset =105906176
9/5/2019 8:28:39 fn GetBAandBUParDetails szBPB=�R�NTFS
9/5/2019 8:28:39 Disk offset =420478976
9/5/2019 8:28:39 fn GetBAandBUParDetails szBPB=�X�MSDOS5.0
9/5/2019 8:28:39 Disk offset =525336576
9/5/2019 8:28:39 fn GetBAandBUParDetails szBPB=
9/5/2019 8:28:39 Disk offset =659554304
9/5/2019 8:28:39 PARTITION ID {21B2801F-76F2-4CDA-87BB-CC62B535AB6A}
9/5/2019 8:28:39 File System Name :NTFS

9/5/2019 8:28:39 StartUp MerlinBA Present.drv=0,par=1,Ver=354
9/5/2019 8:28:39 StartUp BackUP partition not found
9/5/2019 8:28:39 IOCTL_STORAGE_GET_DEVICE_NUMBER returned failure for drive
'Z:\',error=1
9/5/2019 8:28:39 StartUp bMerlinBAMounted=False
9/5/2019 8:28:39 FQDN to be resolved WES008064FB707A
9/5/2019 8:28:39 getaddrinfo returned success
9/5/2019 8:28:39 AF_INET (IPv4)
9/5/2019 8:28:39 IPv4 address 169.254.150.182
9/5/2019 8:28:39 IPv4 DWORD server IP -1231618391
9/5/2019 8:28:39 Valid IP Found

9/5/2019 8:28:39 Start of CHListen::HTTPListen()
9/5/2019 8:28:39 HTTPListen :: Port 80
9/5/2019 8:28:39 Waiting for events...
9/5/2019 8:28:39 Listening On Port 80
9/5/2019 8:28:39 Neither master nor peer!
9/5/2019 8:28:39 Find if client is upgraded! Else process if continuation
scripts!
9/5/2019 8:28:39 Wait for the installer (upgradeWDA.exe) to get over!
9/5/2019 8:28:39 Failed to open handle to the Installer Event! This is not
upgrade scenario!
9/5/2019 8:28:39 Reading from ini if there are any continuation scripts to be
processed!
9/5/2019 8:28:39 Empty Key in ini file: SOFTWARE\RAPPORT\HAGENT : CONT
9/5/2019 8:28:39 continuation scripts 0!
9/5/2019 8:28:39 Set the state to REGISTERING in WDAAgentState.xml!
9/5/2019 8:28:39 The file to open is C:\Program
Files\Wyse\WDA\Config\WDAAgentState.xml
9/5/2019 8:28:39 Start of CService::InitializeServer
9/5/2019 8:28:39 Start of CService::GetServerAddress
Files\Wyse\WDA\Config\WDMProtocolConfig.xml
9/5/2019 8:28:39 Data recieved from xmlquery "10.20.15.151" "" 443
9/5/2019 8:28:39 Cached server address is: IP: 10.20.15.151, port: , securePort:
443
9/5/2019 8:28:39 End of CService::GetServerAddress
9/5/2019 8:28:39 Start of CService::SetServer
9/5/2019 8:28:39 SetServer Saving server info: IP: 10.20.15.151, port: ,
securePort: 443
9/5/2019 8:28:39 everything is good
9/5/2019 8:28:39 End of CService::InitializeServer
9/5/2019 8:28:39 Reading HA Supported
9/5/2019 8:28:39 HA Supported
9/5/2019 8:28:39 szIniFilePath is C:\Program
Files\Wyse\WDA\Config\HAgentSettings.ini
9/5/2019 8:28:39 dwHSListCount = 1
9/5/2019 8:28:39 Secondary IP Address = 10.20.15.151
9/5/2019 8:28:39 Secondary Node Name = WDM
9/5/2019 8:28:39 Secondary Port Number = 0
9/5/2019 8:28:39 Secondary Secure Port Number = 443
9/5/2019 8:28:39 prior to TestConnection
9/5/2019 8:28:39 Start of ConfirmAndSetConnection
9/5/2019 8:28:39 Start of CCommLink::ConfirmAndSetConnection()
9/5/2019 8:28:39 0 == dwIP || ((0 == dwPort) && (0 == dwSecurePort) Calling
GetServerAddress
443
9/5/2019 8:28:39 Find IP for hostname 10.20.15.151
9/5/2019 8:28:39 Empty Key in ini file: SOFTWARE\RAPPORT\HAGENT :
HuntForAltLocalIP
9/5/2019 8:28:39 GetIP :: 1 != dwHuntForAltIP
9/5/2019 8:28:39 GetIP -- IP String is 169.254.150.182 Proper address for
IN_ADDR : -1231618391
9/5/2019 8:28:39 Start of CCommLink::ServerIPMatchesALocalIP()
9/5/2019 8:28:39 End of CCommLink::ServerIPMatchesALocalIP()
9/5/2019 8:28:39 ip RETRIVED ��-
9/5/2019 8:28:39 strcmp(ssLocalIP 0.0.0.0 !=0
9/5/2019 8:28:39 if(0 != ntohs(dwSecurePort))
9/5/2019 8:28:39 Try HTTPS first, verifying server connection at IP:
10.20.15.151, SecurePort: 443
9/5/2019 8:28:39 localAddr.sin_addr.s_addr = 3063348905
9/5/2019 8:28:39 localAddr.sin_port = 0
9/5/2019 8:28:39 Binding Succedded
9/5/2019 8:28:39 Entered CSock::Connect
9/5/2019 8:28:39 Trying to connect using IP = 2534347786 , Port = 47873
9/5/2019 8:28:44 ***** Could not establish secure socket connection with HServer
9/5/2019 8:28:44 Now try HTTP, verifying server connection at IP: 10.20.15.151,
Port: 0
9/5/2019 8:28:44 Failed to Bind
9/5/2019 8:28:44 Could not establish socket connection with HServer, sleeping 5
ms
9/5/2019 8:28:44 ***** Could not establish socket connection with HServer
9/5/2019 8:28:44 +++++ File Commit in UpdateIniFile
9/5/2019 8:28:45 +++++ File Commit UWF in UpdateIniFile:0
9/5/2019 8:28:45 Empty Key in ini file: SOFTWARE\RAPPORT\HAGENT : OnlyVPN
9/5/2019 8:28:45 Hunt for alt IP is set to value 1
9/5/2019 8:28:45 **** Hunting for alternate local IP. Number of interfaces
reported: 28
9/5/2019 8:28:45 Will go through the adapter list!
9/5/2019 8:28:45 GetAdaptersInfo returned 0
9/5/2019 8:28:45 Trying connect to HServer via IP 0.0.0.0 on adapter
Description=Bluetooth Device (Personal Area Network), AdapterName={09788E12-
9/5/2019 8:28:45 C80B-4C42-8011-32B62020ACA3}, Type=6
9/5/2019 8:28:45 ip WAS NULL! SO did not try!
9/5/2019 8:28:45 connection unsuccessful, go to next adapter!
Description=Intel(R) Dual Band Wireless-AC 7260, AdapterName={51276593-95B4-
9/5/2019 8:28:45 476A-8590-E6333C53F805}, Type=71
Description=Inventec PCIe GBE Family Controller #2, AdapterName={F1C924B
9/5/2019 8:28:45 6-FC2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
9/5/2019 8:28:45 Connection Successful
9/5/2019 8:28:45 Connect to HServer via IP 10.28.0.201 successful.
9/5/2019 8:28:45 CCommLink::SetConnection - connection set to 10.20.15.151:0 or
secure port 443
9/5/2019 8:28:45 Start of CCommLink::FormatVerbKey()
9/5/2019 8:28:45 End of CCommLink::FormatVerbKey()
9/5/2019 8:28:45 Start of CCommLink::SendAndProcess()
9/5/2019 8:28:45 SendAndProcess: bCAValidation=0
9/5/2019 8:28:45 SendAndProcess: LocalIP = 10.28.0.201, ServerIP = 10.20.15.151,
Port = 0, SecurePort = 47873
9/5/2019 8:28:45 SendAndProcess: Attempting to send via HTTPS first...
9/5/2019 8:28:45 Start of CCommLink::AppendBoiler()
9/5/2019 8:28:45 End of CCommLink::AppendBoiler()
9/5/2019 8:28:45 SendAndProcess: Https: Command to send =hserver.dll?&V99|
&IMAC=008064FB707A|CID=71||WFE=1|WF=1|HTTPHEADSUPP=2|
9/5/2019 8:28:45 send 2. sCommand length = 70
9/5/2019 8:28:45 Sent Msg to AgentGUI:-MsgToTray 2019/5/9 8:28:45 Client-
>Server: Sending the Check Server Command [V99]
9/5/2019 8:28:46 Num Bytes Received = 7, xNum = 0
9/5/2019 8:28:46 No of bytes received recv API *len = 7
9/5/2019 8:28:46 tempbuff = &Error|, num=0
9/5/2019 8:28:46 Bytes Rcvd = 0, nRet = 0, iResult = 1
9/5/2019 8:28:46 Msg recd from AgentGUI:&Error|
9/5/2019 8:28:46 Got response from server 2019|5|9|8|28|36|-300|
9/5/2019 8:28:46 Pipe not found
9/5/2019 8:28:46 The count is 7
9/5/2019 8:28:46 bCheckServer is 1
9/5/2019 8:28:46 bSet is 1
9/5/2019 8:28:46 prior to setServer
9/5/2019 8:28:46 Setting the server IP
9/5/2019 8:28:46 SetServer Saving server info: IP: 10.20.15.151, port: 0,
securePort: 443
9/5/2019 8:28:46 Saving server info: IP: 10.20.15.151, port: 0, securePort: 443
9/5/2019 8:28:46 End of CService::SetServer
9/5/2019 8:28:46 End of CCommLink::ConfirmAndSetConnection()
9/5/2019 8:28:46 If bConnect, continue with pending scripts if any...
9/5/2019 8:28:46 bConnect true, check if pending scripts...
9/5/2019 8:28:46 Value of nContinuationReturn = 0
9/5/2019 8:28:46 Inside nContinuationReturn
9/5/2019 8:28:46 InitializeServer success in ProcessIP()...so Calling
SendLastScriptStatus
9/5/2019 8:28:46 b4 Calling SendLastScriptStatus acqd lock
9/5/2019 8:28:46 SendLastScriptStatus enter
9/5/2019 8:28:46 StartUp backupPar not present
9/5/2019 8:28:46 Calling FullUpdateRequest
9/5/2019 8:28:46 Start of CCommLink::FullUpdateRequest()
9/5/2019 8:28:46 Processing full update request
9/5/2019 8:28:46 Calling V01
9/5/2019 8:28:46 Merlin version 354
9/5/2019 8:28:46 Signature 354
9/5/2019 8:28:46 Merlin version 354 supports PAD
9/5/2019 8:28:46 HTTP Server does not exist!
9/5/2019 8:28:47 Wyse Flag value 0011
9/5/2019 8:28:47 Wyse Flag value for NIST supported BIOS 0
9/5/2019 8:28:47 Wyse Flag value for NIST pull push supported BIOS 0
9/5/2019 8:28:47 Query TPM and Bitlocker status
9/5/2019 8:28:48 Closing handle to hprocess & hThread
9/5/2019 8:28:48 The iBLP value -1
9/5/2019 8:28:48 Start of CCommLink::AppendOSAndVersion()
9/5/2019 8:28:48 End of CCommLink::AppendOSAndVersion()
9/5/2019 8:28:48 Start of CCommLink::AppendTZ()
9/5/2019 8:28:48 TZ Queried
9/5/2019 8:28:48 Timezone name SA Pacific Standard Time
9/5/2019 8:28:48 End of CCommLink::AppendTZ()
9/5/2019 8:28:48 Start of CCommLink::AppendSerialAndManufactureDate()
9/5/2019 8:28:48 *************Trimming off the spaces and tab from Serial Number
9/5/2019 8:28:48 Device Serial Number: 631AF9FLCF2, Manufacturer Date: 2006-09
9/5/2019 8:28:48 End of CCommLink::AppendSerialAndManufactureDate()
9/5/2019 8:28:48 FUR : GetCI() 1
9/5/2019 8:28:48 IP picked from registry!
9/5/2019 8:28:49 Start of ListAllNics
9/5/2019 8:28:49 IP matched!
9/5/2019 8:28:49 Subnet �(
9/5/2019 8:28:49 Gateway ��(
9/5/2019 8:28:49 DS 0�(
9/5/2019 8:28:49 Looking for service matching IP: 10.28.0.201
9/5/2019 8:28:49 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�)-
9/5/2019 8:28:49 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�)-
9/5/2019 8:28:49 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�)-
9/5/2019 8:28:49 Match found, using service key:
SYSTEM\CurrentControlSet\Services\TcpIP\Parameters\Interfaces\{F1C924B6-FC2F-42D4-
83FF-9A7F0B2B2
9/5/2019 8:28:49 E1E}
9/5/2019 8:28:49 Before sending GetDisplayInfo to AgentUI
9/5/2019 8:28:49 Sent Msg to AgentGUI:-GetDisplay
9/5/2019 8:28:49 tempbuff = AMD Radeon(TM) HD 8330E
Width: 1440 Height: 900 Refresh: 60 Color Depth: 32, num=0
9/5/2019 8:28:49 Msg recd from AgentGUI:AMD Radeon(TM) HD 8330E
Width: 1440 Height: 900 Refresh: 60 Color Depth: 32
9/5/2019 8:28:49 Got reply from AgentUI=�Q-
9/5/2019 8:28:49 add only adapter.
9/5/2019 8:28:49 GetDisplayInfo() return=0e,
9/5/2019 8:28:49 Get Contact: CO=, Location: LO=|
9/5/2019 8:28:49 Disk offset 659554304
9/5/2019 8:28:49 Number of partitions : 5
9/5/2019 8:28:49 GUID {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}
9/5/2019 8:28:49 PartitionType - Name :Basic data partition
9/5/2019 8:28:49 Disk 0 Part 1 TYPE 260

9/5/2019 8:28:49 GUID {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}
9/5/2019 8:28:49 Windows recovery partition
9/5/2019 8:28:49 GUID {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}
9/5/2019 8:28:49 PartitionType - Name :EFI system partition
9/5/2019 8:28:49 GUID {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}
9/5/2019 8:28:49 PartitionType - Name :Microsoft reserved partition
9/5/2019 8:28:49 Disk 0 Part 5 TYPE 261

9/5/2019 8:28:49 Windows was installed using UEFI BIOS
9/5/2019 8:28:49 Secure boot = 1

9/5/2019 8:28:49 TruncateFullCheckin is false..so send NIC Info
9/5/2019 8:28:49 Before sending ListAllApps to AgentUI
9/5/2019 8:28:49 Sent Msg to AgentGUI:-ListAllApps
9/5/2019 8:28:49 tempbuff = |WIN0=Instalaci�n del dispositivo|, num=0
9/5/2019 8:28:49 Msg recd from AgentGUI:|WIN0=Instalaci�n del dispositivo|
9/5/2019 8:28:49 Got reply from AgentUI=0�.
9/5/2019 8:28:49 return from ListAllApps=#/
9/5/2019 8:28:49 LIST RETURNED BY GETADAPTERINFO
9/5/2019 8:28:49 Comparison pass!
9/5/2019 8:28:49 Start of CCI::GetDisplaySettings()
9/5/2019 8:28:49 Start of CCI::GetQFEList()
9/5/2019 8:29:6 End of CCI::GetQFEList()
9/5/2019 8:29:6 size of qfe list 64
9/5/2019 8:29:6 End of CCI::GetDisplaySettings()
9/5/2019 8:29:6 File not found at the above path!
9/5/2019 8:29:6 Found Reg Keg WDA Installed Path
9/5/2019 8:29:6 C:\Program Files\Wyse\WDA\\Config\WCMProtocolConfig.xml
9/5/2019 8:29:6 WCM Prtocol config xml loaded successfully
9/5/2019 8:29:6 Value found for LocalXMLPath = ��-
9/5/2019 8:29:6 tstrWDAPath = C:\program files\Wyse\WDA\bin\hagent.exe
9/5/2019 8:29:6 WDAVersion = 12.1.1.25
9/5/2019 8:29:6 GetCI() done
'Z:\',error=1
9/5/2019 8:29:6 StartUp bmerlinbaMounted=False
9/5/2019 8:29:6 fn SendLastScriptStatus MountPartition for drive 'A' Success
9/5/2019 8:29:6 Cached server address is: IP: 10.20.15.151, port: 0, securePort:
443
9/5/2019 8:29:6 MakeMerlinBAActive. Unmount partition for drive 'A' Success
9/5/2019 8:29:6 GetCI() 2 done
9/5/2019 8:29:6 FUR :Before S&P done
9/5/2019 8:29:6 SendAndProcess: Https: V01 or V03 check-in is being sent
&IMAC=008064FB707A|CID=71||WFE=1|WF=1|HTTPHEADSUPP=2|iniRep=1|EncAES=1|
9/5/2019 8:29:6 HTTPRepositorySupported=1|RollingKeysSupported=1|
CIFSSupported=1|RWOL=1|PeerCap=1|RepCap=0|NST=0|IME=N/A|TPA=0|TPE=0|TPI=0|BLP=-
9/5/2019 8:29:6 1|BLE=-1|BLC=-1|OS=35|VI=1|AL=c:\programüfiles\wyse\wda\bin\|
AV=12.1.1.25|P1=70|HWR=1241|TZO=-300|TZ=SAüPacificüStandardüTim
9/5/2019 8:29:6 e|SN#=631AF9FLCF2|MD=2006-09|BA=1|BAV=354|BUIS=0|BUPS=0|BUIX=0|
CN=WES008064FB707A|IP=10.28.0.201|ED=1|DS=10.28.24.2|GW=10.28.0.1
9/5/2019 8:29:6 |SM=255.255.252.0|SN=10.28.3.255|DM=udistrital.edu.co|0D=1|
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
9/5/2019 8:29:6 0GB|RM=7973126|CP=AuthenticAMDüAMDüGX-
415GAüSOCüwithüRadeon(tm)üHDüGraphicsüüü|CPS=1497|B1=1.0F|PD2=AMDüRadeon(TM)üH
9/5/2019 8:29:6 Dü8330E.|PD1=AMDüHighüDefinitionüAudioüDevice|CO=|LO=|OSDSK=0||
Disk0=0|DiskSize0=32012789760|D0PAR1SZ=104857600|D0PAR1STOFF
9/5/2019 8:29:6 =1048576|D0PAR1TYPE=260|D0PARBOOT=5|D0PAR2SZ=314572800|
D0PAR2STOFF=105906176|D0PAR2TYPE=257|D0PARBOOT=5|D0PAR3SZ=104857600|D0PAR
9/5/2019 8:29:6 3STOFF=420478976|D0PAR3TYPE=258|D0PARBOOT=5|D0PAR4SZ=134217728|
D0PAR4STOFF=525336576|D0PAR4TYPE=259|D0PARBOOT=5|D0PAR5SZ=3070859
9/5/2019 8:29:6 6736|D0PAR5STOFF=659554304|D0PAR5TYPE=261|D0PARBOOT=5||
UEFISEC=1|DRV0=C:|TB0=30708592640|TFB0=16456429568|DRV1=Z:|TB1=1073643520
9/5/2019 8:29:6 |TFB1=1073479680||PRC0=smss.exe|PRC1=csrss.exe|PRC2=wininit.exe|
PRC3=csrss.exe|PRC4=winlogon.exe|PRC5=services.exe|PRC6=lsass.ex
9/5/2019 8:29:6 e|PRC7=svchost.exe|PRC8=svchost.exe|PRC9=atiesrxx.exe|
PRC10=svchost.exe|PRC11=svchost.exe|PRC12=svchost.exe|PRC13=svchost.exe|PR
9/5/2019 8:29:6 C14=dwm.exe|PRC15=svchost.exe|PRC16=svchost.exe|
PRC17=atieclxx.exe|PRC18=DtcPlatformSvc.exe|PRC19=Explorer.EXE|PRC20=spoolsv.exe
9/5/2019 8:29:6 |PRC21=svchost.exe|PRC22=taskhostex.exe|PRC23=GoogleUpdate.exe|
PRC24=svchost.exe|PRC25=svchost.exe|PRC26=mqsvc.exe|PRC27=NetXCle
9/5/2019 8:29:6 an.exe|PRC28=pnusbvirtualhubwssrv.exe|PRC29=tcpsvcs.exe|
PRC30=snmp.exe|PRC31=tvnserver.exe|PRC32=UWFSvc.exe|PRC33=MsMpEng.exe|PR
9/5/2019 8:29:6 C34=wsnm.exe|PRC35=DtcWDAService.exe|PRC36=mqtgsvc.exe|
PRC37=wmiprvse.exe|PRC38=vmware-usbarbitrator64.exe|PRC39=GoogleUpdate.ex
9/5/2019 8:29:6 e|PRC40=vmware-view-usbd.exe|PRC41=svchost.exe|
PRC42=wmiprvse.exe|PRC43=SearchIndexer.exe|PRC44=msiexec.exe|PRC45=vssvc.exe|PRC4
9/5/2019 8:29:6 6=SearchProtocolHost.exe|PRC47=svchost.exe|
PRC48=SearchFilterHost.exe|PRC49=DtcWdaUi.exe|PRC50=hagent.exe|PRC51=HAgent_UI.exe|
PR
9/5/2019 8:29:6 C52=tvnserver.exe|PRC53=RAVCpl64.exe|PRC54=concentr.exe|
PRC55=redirector.exe|PRC56=PNUSBCLITRAY.exe|PRC57=PNTray.exe|PRC58=Recei
9/5/2019 8:29:6 ver.exe|PRC59=SelfServicePlugin.exe|PRC60=wfcrun32.exe|
PRC61=DsmUserTask.Exe|PRC62=DrvInst.exe||WIN0=Instalaci�nüdelüdispositi
9/5/2019 8:29:6 vo||PMIU=33|TBPM=7786256|FBPM=5143564|TBPF=7786256|FBPF=5090908|
TBVM=8589934464|FKVM=8589864352|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28
9/5/2019 8:29:6 .0.201|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=673|SENDP0=418|MIBSP0=1000üMbps
9/5/2019 8:29:6 ||NIC1IP=0.0.0.0|
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|
RECP1=0|SENDP1=0|MIBSP1=3ü
9/5/2019 8:29:6 Mbps||NIC2IP=0.0.0.0|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|
SENDP2=0|MIBSP2=0üM
9/5/2019 8:29:6 bps|
QFEL=KB2727528,KB2729462,KB2737084,KB2753842,KB2756872,KB2757638,KB2761465,KB276916
5,KB2769166,KB2770917,KB2777294,KB2778344
9/5/2019 8:29:6
,KB2778930,KB2779562,KB2779768,KB2780541,KB2781197,KB2785094,KB2785220,KB2789649,KB
2789650,KB2790655,KB2790907,KB2792100,KB27932
9/5/2019 8:29:6
10,KB2794119,KB2794599,KB2795944,KB2798162,KB2798802,KB2798804,KB2798805,KB2799494,
KB2800033,KB2804583,KB2804584,KB2805222,KB280
9/5/2019 8:29:6
5227,KB2807986,KB2808679,KB2808735,KB2809289,KB2811660,KB2812822,KB2813170,KB281343
0,KB2817183,KB2818604,KB2820330,KB2821895,KB2
9/5/2019 8:29:6
947,KB2836988,KB2838727,KB2839894,KB2845533,K
9/5/2019 8:29:6 B2845690,|AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\Mo
9/5/2019 8:29:6 zillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffi
9/5/2019 8:29:6 ce|15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=Micros
9/5/2019 8:29:6 oftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||
9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilt
9/5/2019 8:29:6 erüDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005
9/5/2019 8:29:6 üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüCl
9/5/2019 8:29:6 ient|C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Appl
9/5/2019 8:29:6 ication\chrome.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-basedüw
9/5/2019 8:29:6 riteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüF
9/5/2019 8:29:6 iles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüShare
9/5/2019 8:29:6 d\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|
15.0.4420.1017|AP17
9/5/2019 8:29:6 =TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwf
9/5/2019 8:29:6 mgr.EXE|2.0.127.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Microsoftü(R)üContactsüI
9/5/2019 8:29:6 mportüTool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|
6.2.9200.16384|AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD
9/5/2019 8:29:6 .EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|
WCMJSONSupp=1|
>Server: Sending full Check-in[V01]
9/5/2019 8:29:6 Start of CCommLink::ProcessMsg()
9/5/2019 8:29:6 Found HS Tag
9/5/2019 8:29:6 Store the value for hserver to vector
9/5/2019 8:29:6 calling SaveHSValues
9/5/2019 8:29:6 Store the value for hserver to ini file 1
9/5/2019 8:29:6 Set the state to REGISTER in WDAAgentState.xml from ProcessMsg!
9/5/2019 8:29:6 Possibly clear rolling key, if this was a response to check-in
then clear it here
9/5/2019 8:29:6 Rolling key not received! Clear previous rolling key.
9/5/2019 8:29:6 DISCDNS=0,DISCSRV=0,DISCDHCP=0,DISCMAN=0,DISCFALLBK=15
9/5/2019 8:29:6 Start of CService::SetDiscoveryFlags
9/5/2019 8:29:6 Discovery options: DHCP 0 DNS SRV 0 DNS HOST 0 MANUAL 0
9/5/2019 8:29:6 Server Sent 5
9/5/2019 8:29:6 Enhanced QU : QUM :
9/5/2019 8:29:6 Enhanced QU : QUC :
9/5/2019 8:29:6 Enhanced QU : QUD :
9/5/2019 8:29:6 Start of CScriptProcess::SetQUParms()
9/5/2019 8:29:6 Enhanced QU :Command : 1 120
9/5/2019 8:29:6 SetQUParms m_nQUButtons =1, m_nQUTimeout = 120
9/5/2019 8:29:6 End of CScriptProcess::SetQUParms()
9/5/2019 8:29:6 Server Sent 6
9/5/2019 8:29:6 LOOKING FOR &04
9/5/2019 8:29:6 FUR :After S&P done
9/5/2019 8:29:6 End of CCommLink::FullUpdateRequest()
9/5/2019 8:29:6 Connection to HServer OK
9/5/2019 8:29:6 Set the state to REGISTER in WDAAgentState.xml!
9/5/2019 8:30:30 Start of CService::HandlerMember
9/5/2019 8:30:30 End of CService::HandlerMember
GetServerAddress
9/5/2019 9:30:25 Cached server address is: IP: 10.20.15.151, port: 0,
securePort: 443
9/5/2019 9:30:25 GetIP :: *** PPP
9/5/2019 9:30:25 GetIP -- IP String is 10.28.0.201 Proper address for IN_ADDR :
-922739702
9/5/2019 9:30:25 ip RETRIVED #�.
10.20.15.151, SecurePort: 443
9/5/2019 9:30:25 SETTING REG TO VALUE #�.
reported: 28
9/5/2019 9:30:25 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
9/5/2019 9:30:25 Pipe not found
9/5/2019 9:30:25 The count is 7
9/5/2019 9:30:25 bSet is 1
securePort: 443
9/5/2019 9:30:25 Saving server info: IP: 10.20.15.151, port: , securePort: 443
9/5/2019 9:30:26 Start of CCommLink::PartialUpdateRequest()
9/5/2019 9:30:26 Value found for LocalXMLPath =
9/5/2019 9:30:26 WDAVersion = 12.1.1.25
9/5/2019 9:30:27 The iBLP value -1
9/5/2019 9:30:27 Start of CCommLink::AppendHeartBeat()
9/5/2019 9:30:27 End of CCommLink::AppendHeartBeat()
9/5/2019 9:30:27 End of CCommLink::PartialUpdateRequest()
&IMAC=008064FB707A|CID=71||WFE=1|WF=1|HTTPHEADSUPP=2|HTTPRepositorySupp
9/5/2019 9:30:27 orted=1|RollingKeysSupported=1|CPRMS0=17,17,17|WCM_CFG_HASH=0|
WDA=1|WCMSupp=1|WCMJSONSupp=1|TPA=0|TPE=0|TPI=0|BLP=-1|BLE=-1|BLC=
9/5/2019 9:30:27 -1|VI=1|
>Server: Sending Partial Check-in (Heart-beat)[V03]
9/5/2019 9:30:28 Found HS Tag
then clear it here
9/5/2019 9:30:28 Disc flags not found
9/5/2019 9:30:28 Server Sent 5
9/5/2019 9:30:28 Enhanced QU : QUM :
9/5/2019 9:30:28 Enhanced QU : QUC :
9/5/2019 9:30:28 Enhanced QU : QUD :
9/5/2019 9:30:28 Server Sent 6
9/5/2019 9:30:28 LOOKING FOR &04
GetServerAddress
443
9/5/2019 10:31:2 GetIP :: *** PPP
-922739702
9/5/2019 10:31:2 ip RETRIVED ��.
10.20.15.151, SecurePort: 443
9/5/2019 10:31:2 SETTING REG TO VALUE ��.
reported: 28
9/5/2019 10:31:2 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
9/5/2019 10:31:2 Pipe not found
9/5/2019 10:31:2 The count is 7
9/5/2019 10:31:2 bSet is 1
securePort: 443
9/5/2019 10:31:3 WDAVersion = 12.1.1.25
9/5/2019 10:31:3 The iBLP value -1
WDA=1|WCMSupp=1|WCMJSONSupp=1|TPA=0|TPE=0|TPI=0|BLP=-1|BLE=-1|BLC=-
9/5/2019 10:31:4 1|VI=1|
9/5/2019 10:31:4 Found HS Tag
then clear it here
9/5/2019 10:31:4 Server Sent 5
9/5/2019 10:31:4 Enhanced QU : QUM :
9/5/2019 10:31:4 Enhanced QU : QUC :
9/5/2019 10:31:4 Enhanced QU : QUD :
9/5/2019 10:31:4 Server Sent 6
9/5/2019 10:31:4 LOOKING FOR &04
GetServerAddress
9/5/2019 11:31:50 Cached server address is: IP: 10.20.15.151, port: ,
securePort: 443
9/5/2019 11:31:50 GetIP :: *** PPP
-922739702
9/5/2019 11:31:50 ip RETRIVED �.
10.20.15.151, SecurePort: 443
9/5/2019 11:31:50 SETTING REG TO VALUE �.
reported: 28
9/5/2019 11:31:50 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
9/5/2019 11:31:50 SendAndProcess: LocalIP = 10.28.0.201, ServerIP =
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 11:31:50 Pipe not found
9/5/2019 11:31:50 The count is 7
9/5/2019 11:31:50 bSet is 1
securePort: 443
9/5/2019 11:31:50 Value found for LocalXMLPath = ��-
9/5/2019 11:31:51 WDAVersion = 12.1.1.25
9/5/2019 11:31:52 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 11:31:52 1|VI=1|
9/5/2019 11:31:52 Found HS Tag
9/5/2019 11:31:52 Set the state to REGISTER in WDAAgentState.xml from
ProcessMsg!
then clear it here
9/5/2019 11:31:52 Server Sent 5
9/5/2019 11:31:52 Enhanced QU : QUM :
9/5/2019 11:31:52 Enhanced QU : QUC :
9/5/2019 11:31:52 Enhanced QU : QUD :
9/5/2019 11:31:52 Server Sent 6
9/5/2019 11:31:52 LOOKING FOR &04
9/5/2019 12:18:44 Received something
9/5/2019 12:18:44 BIM Received data: G
9/5/2019 12:18:44 Rolling key not present!
9/5/2019 12:18:44 Received data: �?*
9/5/2019 12:18:44 Start of CHListen::ProcessRequest()
9/5/2019 12:18:44 Received: GET / HTTP/1.1
Accept-Encoding: gzip,identity
Accept: */*
User-Agent: WWW-Mechanize/1.0.0 (http://rubyforge.org/pro
9/5/2019 12:18:44 jects/mechanize/)
Connection: close
Accept-Language: en-us,en;q=0.5
Host: wes008064fb707a
Accept-Charset: ISO-8859-1,utf-8;q
9/5/2019 12:18:44 =0.7,*;q=0.7
9/5/2019 12:18:44 Invalid Command Sent:GET / HTTP/1.1

Accept: */*
User-Agent: WWW-Mechanize/1.0.0 (http://rubyfo
9/5/2019 12:18:44 rge.org/projects/mechanize/)
Connection: close
Accept-Charset: ISO-885
9/5/2019 12:18:44 9-1,utf-8;q=0.7,*;q=0.7
9/5/2019 12:18:44 Although command was invalid, we do a check-in event to

refresh settings!
9/5/2019 12:18:44 Start of CService::NeedsConnection
9/5/2019 12:18:44 End of CService::NeedsConnection. Return false.
9/5/2019 12:18:44 Return value from ProcessRequest -1
GetServerAddress
securePort: 443
9/5/2019 12:18:45 GetIP :: *** PPP
-922739702
9/5/2019 12:18:45 ip RETRIVED �.
10.20.15.151, SecurePort: 443
reported: 28
9/5/2019 12:18:45 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 12:18:45 Pipe not found
9/5/2019 12:18:45 The count is 7
9/5/2019 12:18:45 bSet is 1
securePort: 443
9/5/2019 12:18:45 Calling V01
9/5/2019 12:18:45 Merlin version 354
9/5/2019 12:18:45 Signature 354
9/5/2019 12:18:46 Wyse Flag value 0011
9/5/2019 12:18:47 The iBLP value -1
9/5/2019 12:18:47 TZ Queried
9/5/2019 12:18:47 *************Trimming off the spaces and tab from Serial
Number
9/5/2019 12:18:47 FUR : GetCI() 1
9/5/2019 12:18:47 IP matched!
9/5/2019 12:18:47 Subnet �(
9/5/2019 12:18:47 Gateway ��(
9/5/2019 12:18:47 DS 0�(
9/5/2019 12:18:47 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�)-
9/5/2019 12:18:47 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�)-
9/5/2019 12:18:47 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�)-
83FF-9A7F0B2B2
9/5/2019 12:18:47 E1E}
9/5/2019 12:18:47 Got reply from AgentUI=`?0
9/5/2019 12:18:47 GetDisplayInfo() return=�G-
9/5/2019 12:18:47 Disk offset 659554304
9/5/2019 12:18:47 Disk 0 Part 1 TYPE 260

9/5/2019 12:18:47 Disk 0 Part 5 TYPE 261

9/5/2019 12:18:47 Secure boot = 1

9/5/2019 12:18:47 tempbuff = |WIN0=Sitio Web BIBLIOTECA UD - Portal Web Sistema
de Bibliotecas - Google Chrome|WIN1=Program Manager|, num=0
9/5/2019 12:18:47 Msg recd from AgentGUI:|WIN0=Sitio Web BIBLIOTECA UD - Portal
Web Sistema de Bibliotecas - Google Chrome|WIN1=Program Manager|
9/5/2019 12:18:47 Got reply from AgentUI=��-
9/5/2019 12:18:47 return from ListAllApps=##0
9/5/2019 12:18:53 size of qfe list 64
9/5/2019 12:18:53 Value found for LocalXMLPath = p�/
9/5/2019 12:18:53 WDAVersion = 12.1.1.25
9/5/2019 12:18:53 GetCI() done
9/5/2019 12:18:53 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 12:18:53 e|SN#=631AF9FLCF2|MD=2006-09|BA=1|BAV=354|BUIS=0|BUPS=0|
BUIX=0|CN=WES008064FB707A|IP=10.28.0.201|ED=1|DS=10.28.24.2|GW=10.28.0.1
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
9/5/2019 12:18:53 Dü8330E.|PD1=AMDüHighüDefinitionüAudioüDevice|CO=|LO=|
OSDSK=0||Disk0=0|DiskSize0=32012789760|D0PAR1SZ=104857600|D0PAR1STOFF
9/5/2019 12:18:53 3STOFF=420478976|D0PAR3TYPE=258|D0PARBOOT=5|
D0PAR4SZ=134217728|D0PAR4STOFF=525336576|D0PAR4TYPE=259|D0PARBOOT=5|
D0PAR5SZ=3070859
9/5/2019 12:18:53 |TFB1=1069645824||PRC0=smss.exe|PRC1=csrss.exe|
PRC2=wininit.exe|PRC3=csrss.exe|PRC4=winlogon.exe|PRC5=services.exe|PRC6=lsass.ex
PRC10=svchost.exe|PRC11=svchost.exe|PRC12=svchost.exe|PRC13=dwm.exe|PRC14=
9/5/2019 12:18:53 svchost.exe|PRC15=svchost.exe|PRC16=atieclxx.exe|
PRC17=DtcPlatformSvc.exe|PRC18=Explorer.EXE|PRC19=spoolsv.exe|PRC20=svchost.exe
9/5/2019 12:18:53 |PRC21=taskhostex.exe|PRC22=svchost.exe|PRC23=svchost.exe|
PRC24=mqsvc.exe|PRC25=NetXClean.exe|PRC26=pnusbvirtualhubwssrv.exe|PRC
9/5/2019 12:18:53 27=tcpsvcs.exe|PRC28=snmp.exe|PRC29=tvnserver.exe|
PRC30=UWFSvc.exe|PRC31=MsMpEng.exe|PRC32=wsnm.exe|PRC33=DtcWDAService.exe|PRC3
9/5/2019 12:18:53 4=mqtgsvc.exe|PRC35=vmware-usbarbitrator64.exe|PRC36=vmware-
view-usbd.exe|PRC37=svchost.exe|PRC38=wmiprvse.exe|PRC39=SearchIndex
9/5/2019 12:18:53 er.exe|PRC40=DtcWdaUi.exe|PRC41=hagent.exe|
PRC42=HAgent_UI.exe|PRC43=tvnserver.exe|PRC44=RAVCpl64.exe|PRC45=concentr.exe|
PRC46=r
9/5/2019 12:18:53 edirector.exe|PRC47=PNUSBCLITRAY.exe|PRC48=PNTray.exe|
PRC49=Receiver.exe|PRC50=SelfServicePlugin.exe|PRC51=wfcrun32.exe|PRC52=sv
9/5/2019 12:18:53 chost.exe|PRC53=CcmExec.exe|PRC54=wmiprvse.exe|
PRC55=wmiprvse.exe|PRC56=TrustedInstaller.exe|PRC57=TiWorker.exe|PRC58=chrome.exe
9/5/2019 12:18:53 |PRC59=chrome.exe|PRC60=chrome.exe|PRC61=chrome.exe|
PRC62=chrome.exe|PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe|PRC66=wm
9/5/2019 12:18:53 iprvse.exe||WIN0=SitioüWebüBIBLIOTECAüUDü-
üPortalüWebüSistemaüdeüBibliotecasü-üGoogleüChrome|WIN1=ProgramüManager||
9/5/2019 12:18:53 PMIU=40|TBPM=7786256|FBPM=4614528|TBPF=7786256|FBPF=4452392|
TBVM=8589934464|FKVM=8589865384|FKEM=0|CPRMS0=54,7,21|NIC0IP=10.28.0
9/5/2019 12:18:53 .201|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=203847|SENDP0=100128|MIBSP0=1000ü
9/5/2019 12:18:53 Mbps||NIC1IP=0.0.0.0|
RECP1=0|SENDP1=0|MIBSP1
9/5/2019 12:18:53 =3üMbps||NIC2IP=0.0.0.0|
SENDP2=0|MIBSP2=
9/5/2019 12:18:53 0üMbps|
5,KB2769166,KB2770917,KB2777294,KB277
9/5/2019 12:18:53
9,KB2789650,KB2790655,KB2790907,KB2792100,KB2
9/5/2019 12:18:53
494,KB2800033,KB2804583,KB2804584,KB2805222,K
9/5/2019 12:18:53
B2805227,KB2807986,KB2808679,KB2808735,KB2809289,KB2811660,KB2812822,KB2813170,KB28
13430,KB2817183,KB2818604,KB2820330,KB2821895
9/5/2019 12:18:53
2836947,KB2836988,KB2838727,KB2839894,KB28455
9/5/2019 12:18:53 33,KB2845690,|AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|
18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFile
9/5/2019 12:18:53 s\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||
61.0.2|AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\Microsoftü
9/5/2019 12:18:53 Office|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|
15.0.4420.1017|AP5=Mi
9/5/2019 12:18:53 crosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||
9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKeyboardü
9/5/2019 12:18:53 FilterüDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC++ü
9/5/2019 12:18:53 2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüView
9/5/2019 12:18:53 üClient|C:\ProgramüFiles\VMware\VMwareüView\Client\|
5.4.0.1219906|AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\
9/5/2019 12:18:53 Application\chrome.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-base
9/5/2019 12:18:53 düwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|
2.0.449.0|AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\Progra
9/5/2019 12:18:53 müFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüS
9/5/2019 12:18:53 hared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
15.0.4420.1017|
9/5/2019 12:18:53 AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32
9/5/2019 12:18:53 \Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Microsoftü(R)üContact
9/5/2019 12:18:53 süImportüTool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|
6.2.9200.16384|AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WIN
9/5/2019 12:18:53 WORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|
WCMJSONSupp=1|
9/5/2019 12:18:54 Found HS Tag
ProcessMsg!
then clear it here
9/5/2019 12:18:54 Server Sent 5
9/5/2019 12:18:54 Enhanced QU : QUM :
9/5/2019 12:18:54 Enhanced QU : QUC :
9/5/2019 12:18:54 Enhanced QU : QUD :
9/5/2019 12:18:54 Server Sent 6
9/5/2019 12:18:54 LOOKING FOR &04
9/5/2019 12:18:54 FUR :After S&P done
GetServerAddress
securePort: 443
9/5/2019 13:19:35 GetIP :: *** PPP
-922739702
9/5/2019 13:19:35 ip RETRIVED 0�.
10.20.15.151, SecurePort: 443
9/5/2019 13:19:35 SETTING REG TO VALUE 0�.
reported: 28
9/5/2019 13:19:35 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 13:19:35 Pipe not found
9/5/2019 13:19:35 The count is 7
9/5/2019 13:19:35 bSet is 1
securePort: 443
9/5/2019 13:19:35 Value found for LocalXMLPath = ��/
9/5/2019 13:19:35 WDAVersion = 12.1.1.25
9/5/2019 13:19:36 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 13:19:36 1|VI=1|
9/5/2019 13:19:37 Found HS Tag
ProcessMsg!
then clear it here
9/5/2019 13:19:37 Server Sent 5
9/5/2019 13:19:37 Enhanced QU : QUM :
9/5/2019 13:19:37 Enhanced QU : QUC :
9/5/2019 13:19:37 Enhanced QU : QUD :
9/5/2019 13:19:37 Server Sent 6
9/5/2019 13:19:37 LOOKING FOR &04
GetServerAddress
securePort: 443
9/5/2019 14:21:37 GetIP :: *** PPP
-922739702
9/5/2019 14:21:37 ip RETRIVED 0�.
10.20.15.151, SecurePort: 443
reported: 28
9/5/2019 14:21:37 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 14:21:37 Pipe not found
9/5/2019 14:21:37 The count is 7
9/5/2019 14:21:37 bSet is 1
securePort: 443
9/5/2019 14:21:37 Value found for LocalXMLPath = `�/
9/5/2019 14:21:37 WDAVersion = 12.1.1.25
9/5/2019 14:21:38 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 14:21:38 1|VI=1|
9/5/2019 14:21:39 Found HS Tag
ProcessMsg!
then clear it here
9/5/2019 14:21:39 Server Sent 5
9/5/2019 14:21:39 Enhanced QU : QUM :
9/5/2019 14:21:39 Enhanced QU : QUC :
9/5/2019 14:21:39 Enhanced QU : QUD :
9/5/2019 14:21:39 Server Sent 6
9/5/2019 14:21:39 LOOKING FOR &04
GetServerAddress
443
9/5/2019 15:25:2 GetIP :: *** PPP
-922739702
9/5/2019 15:25:3 ip RETRIVED ��.
10.20.15.151, SecurePort: 443
reported: 28
9/5/2019 15:25:3 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
9/5/2019 15:25:3 Pipe not found
9/5/2019 15:25:3 The count is 7
9/5/2019 15:25:3 bSet is 1
securePort: 443
9/5/2019 15:25:3 WDAVersion = 12.1.1.25
9/5/2019 15:25:4 The iBLP value -1
9/5/2019 15:25:4 1|VI=1|
9/5/2019 15:25:5 Found HS Tag
then clear it here
9/5/2019 15:25:5 Server Sent 5
9/5/2019 15:25:5 Enhanced QU : QUM :
9/5/2019 15:25:5 Enhanced QU : QUC :
9/5/2019 15:25:5 Enhanced QU : QUD :
9/5/2019 15:25:5 Server Sent 6
9/5/2019 15:25:5 LOOKING FOR &04
9/5/2019 16:25:1 Windows logon: Launching HAgent_UI
9/5/2019 16:25:1 Launching HAgent_UI
GetServerAddress
443
9/5/2019 16:28:9 GetIP :: *** PPP
-922739702
9/5/2019 16:28:9 ip RETRIVED 0�.
10.20.15.151, SecurePort: 443
reported: 28
9/5/2019 16:28:9 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
9/5/2019 16:28:9 Pipe not found
9/5/2019 16:28:9 The count is 7
9/5/2019 16:28:9 bSet is 1
securePort: 443
9/5/2019 16:28:9 WDAVersion = 12.1.1.25
9/5/2019 16:28:10 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 16:28:11 1|VI=1|
9/5/2019 16:28:11 Found HS Tag
ProcessMsg!
then clear it here
9/5/2019 16:28:11 Server Sent 5
9/5/2019 16:28:11 Enhanced QU : QUM :
9/5/2019 16:28:11 Enhanced QU : QUC :
9/5/2019 16:28:11 Enhanced QU : QUD :
9/5/2019 16:28:11 Server Sent 6
9/5/2019 16:28:11 LOOKING FOR &04
GetServerAddress
securePort: 443
9/5/2019 17:30:53 GetIP :: *** PPP
-922739702
9/5/2019 17:30:53 ip RETRIVED
10.20.15.151, SecurePort: 443
9/5/2019 17:30:53 SETTING REG TO VALUE
reported: 28
9/5/2019 17:30:53 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 17:30:53 Pipe not found
9/5/2019 17:30:53 The count is 7
9/5/2019 17:30:53 bSet is 1
securePort: 443
9/5/2019 17:30:53 WDAVersion = 12.1.1.25
9/5/2019 17:30:54 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 17:30:54 1|VI=1|
9/5/2019 17:30:54 Found HS Tag
ProcessMsg!
then clear it here
9/5/2019 17:30:54 Server Sent 5
9/5/2019 17:30:54 Enhanced QU : QUM :
9/5/2019 17:30:54 Enhanced QU : QUC :
9/5/2019 17:30:54 Enhanced QU : QUD :
9/5/2019 17:30:54 Server Sent 6
9/5/2019 17:30:54 LOOKING FOR &04
9/5/2019 17:41:7 IP Address chagned!
GetServerAddress
443
9/5/2019 17:41:8 GetIP :: *** PPP
-922739702
9/5/2019 17:41:8 ip RETRIVED �.
10.20.15.151, SecurePort: 443
9/5/2019 17:41:13 ***** Could not establish secure socket connection with
HServer
Port: 0
9/5/2019 17:41:13 No connection - Sock: 10049
ms
reported: 28
9/5/2019 17:41:13 C80B-4C42-8011-32B62020ACA3}, Type=6
9/5/2019 17:41:13 476A-8590-E6333C53F805}, Type=71
9/5/2019 17:41:18 SERVER CONNECTION UNSUCCESSFUL
9/5/2019 17:41:19 Confirm server connection error: timeout
9/5/2019 17:41:19 Connect failed
9/5/2019 17:41:19 Failed checkin count=1
9/5/2019 17:41:19 Wait for 0 ms and try again
9/5/2019 17:41:19 processip...server ip retrieved in failed check-in =
10.20.15.151
9/5/2019 17:41:19 Failed checkin but Server IP length is not zero!
GetServerAddress
securePort: 443
HuntForAltLocalIP
-922739702
9/5/2019 17:41:19 ip RETRIVED �.
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
9/5/2019 17:41:24 C80B-4C42-8011-32B62020ACA3}, Type=6
9/5/2019 17:41:24 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
-922739702
9/5/2019 18:44:28 ip RETRIVED
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
9/5/2019 18:44:28 Pipe not found
9/5/2019 18:44:28 The count is 7
9/5/2019 18:44:28 bSet is 1
securePort: 443
9/5/2019 18:44:28 Calling V01
9/5/2019 18:44:28 Merlin version 354
9/5/2019 18:44:28 Signature 354
9/5/2019 18:44:29 Wyse Flag value 0011
9/5/2019 18:44:29 The iBLP value -1
9/5/2019 18:44:30 TZ Queried
Number
9/5/2019 18:44:30 FUR : GetCI() 1
9/5/2019 18:44:30 IP matched!
9/5/2019 18:44:30 Subnet �(
9/5/2019 18:44:30 Gateway ��(
9/5/2019 18:44:30 DS 0�(
9/5/2019 18:44:30 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=p+-
9/5/2019 18:44:30 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=p+-
9/5/2019 18:44:30 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=p+-
83FF-9A7F0B2B2
9/5/2019 18:44:30 E1E}
9/5/2019 18:44:30 Got reply from AgentUI=`30
9/5/2019 18:44:30 GetDisplayInfo() return=�m4
9/5/2019 18:44:30 Disk offset 659554304
9/5/2019 18:44:30 Disk 0 Part 1 TYPE 260

9/5/2019 18:44:30 Disk 0 Part 5 TYPE 261

9/5/2019 18:44:30 Secure boot = 1

9/5/2019 18:44:30 tempbuff = |WIN0=My Drive - Google Drive - Google Chrome|
WIN1=Program Manager|, num=0
9/5/2019 18:44:30 Msg recd from AgentGUI:|WIN0=My Drive - Google Drive - Google
Chrome|WIN1=Program Manager|
9/5/2019 18:44:30 Got reply from AgentUI=�4
9/5/2019 18:44:30 return from ListAllApps= �4
9/5/2019 18:44:37 size of qfe list 64
9/5/2019 18:44:38 Value found for LocalXMLPath = Ì2
9/5/2019 18:44:38 WDAVersion = 12.1.1.25
9/5/2019 18:44:38 GetCI() done
9/5/2019 18:44:38 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC2=wininit.exe|PRC3=services.exe|PRC4=lsass.exe|PRC5=svchost.exe|PRC6=svchost.e
9/5/2019 18:44:38 xe|PRC7=atiesrxx.exe|PRC8=svchost.exe|PRC9=svchost.exe|
PRC10=svchost.exe|PRC11=svchost.exe|PRC12=svchost.exe|PRC13=DtcPlatformSv
9/5/2019 18:44:38 c.exe|PRC14=spoolsv.exe|PRC15=svchost.exe|PRC16=svchost.exe|
PRC17=svchost.exe|PRC18=mqsvc.exe|PRC19=NetXClean.exe|PRC20=pnusbvir
9/5/2019 18:44:38 tualhubwssrv.exe|PRC21=tcpsvcs.exe|PRC22=snmp.exe|
PRC23=tvnserver.exe|PRC24=UWFSvc.exe|PRC25=MsMpEng.exe|PRC26=wsnm.exe|PRC27=Dt
9/5/2019 18:44:38 cWDAService.exe|PRC28=mqtgsvc.exe|PRC29=vmware-
usbarbitrator64.exe|PRC30=vmware-view-usbd.exe|PRC31=svchost.exe|PRC32=wmiprvse.e
9/5/2019 18:44:38 xe|PRC33=SearchIndexer.exe|PRC34=hagent.exe|PRC35=svchost.exe|
PRC36=CcmExec.exe|PRC37=wmiprvse.exe|PRC38=wmiprvse.exe|PRC39=csrs
9/5/2019 18:44:38 s.exe|PRC40=winlogon.exe|PRC41=dwm.exe|PRC42=atieclxx.exe|
PRC43=taskhostex.exe|PRC44=HAgent_UI.exe|PRC45=DtcWdaUi.exe|PRC46=expl
9/5/2019 18:44:38 orer.exe|PRC47=tvnserver.exe|PRC48=UWFTray.exe|
PRC49=RAVCpl64.exe|PRC50=concentr.exe|PRC51=redirector.exe|PRC52=PNUSBCLITRAY.exe
9/5/2019 18:44:38 |PRC53=PNTray.exe|PRC54=Receiver.exe|PRC55=wfcrun32.exe|
PRC56=SelfServicePlugin.exe|PRC57=chrome.exe|PRC58=chrome.exe|PRC59=chro
9/5/2019 18:44:38 me.exe|PRC60=chrome.exe|PRC61=chrome.exe|PRC62=chrome.exe|
PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe|PRC66=chrome.exe|PR
9/5/2019 18:44:38 C67=chrome.exe|PRC68=SearchProtocolHost.exe|
PRC69=SearchFilterHost.exe|PRC70=wmiprvse.exe||WIN0=MyüDriveü-üGoogleüDriveü-ü
9/5/2019 18:44:38 GoogleüChrome|WIN1=ProgramüManager||PMIU=47|TBPM=7786256|
FBPM=4111808|TBPF=7786256|FBPF=3790120|TBVM=8589934464|FKVM=858986333
9/5/2019 18:44:38 6|FKEM=0|CPRMS0=127,5,50|NIC0IP=10.28.0.201|
NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|R
9/5/2019 18:44:38 ECP0=979077|SENDP0=348856|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1M
9/5/2019 18:44:38 AC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||
NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MA
9/5/2019 18:44:38 C=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|
9/5/2019 18:44:38
,KB2781197,KB2785094,KB2785220,KB2789649,KB27
9/5/2019 18:44:38
62,KB2798802,KB2798804,KB2798805,KB2799494,KB
9/5/2019 18:44:38
9289,KB2811660,KB2812822,KB2813170,KB2813430,
9/5/2019 18:44:38
KB2817183,KB2818604,KB2820330,KB2821895,KB2822241,KB2829069,KB2829254,KB2829361,KB2
829530,KB2830290,KB2832450,KB2836946,KB283694
9/5/2019 18:44:38 7,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefox
9/5/2019 18:44:38 ü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncü
9/5/2019 18:44:38 Vdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\M
9/5/2019 18:44:38 icrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|AP6=M
9/5/2019 18:44:38 icrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|5
9/5/2019 18:44:38 .1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WD
9/5/2019 18:44:38 A\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
9/5/2019 18:44:38 C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|
68.0.3440.106|AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\
9/5/2019 18:44:38 EXCEL.EXE|15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=Diagnosticsüuti
9/5/2019 18:44:38 lityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\Pr
9/5/2019 18:44:38
ogramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~
9/5/2019 18:44:38 1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=UnifiedüWriteüFilte
9/5/2019 18:44:38 rüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.
9/5/2019 18:44:38 9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=Microsoft�
9/5/2019 18:44:38 �Word|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|
15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
9/5/2019 18:44:38 Found HS Tag
ProcessMsg!
then clear it here
9/5/2019 18:44:38 Server Sent 5
9/5/2019 18:44:38 Enhanced QU : QUM :
9/5/2019 18:44:38 Enhanced QU : QUC :
9/5/2019 18:44:38 Enhanced QU : QUD :
9/5/2019 18:44:38 Server Sent 6
9/5/2019 18:44:38 LOOKING FOR &04
9/5/2019 18:44:38 FUR :After S&P done
10/5/2019 8:12:33 ***********************************************************
10/5/2019 8:12:33 End of WinMain()
10/5/2019 8:12:33 ^^^^^^^^ after reghanex()
10/5/2019 8:12:54 OS Version 6.2.9200
10/5/2019 8:12:54 OS Version 6.2.9200
10/5/2019 8:12:54 Major version 6
10/5/2019 8:12:54 Minor version 2
10/5/2019 8:12:54 Device Info: OS is �6
10/5/2019 8:12:54 WRITE FILTER UWF 1
10/5/2019 8:12:54 Setting UWF Mgr!
10/5/2019 8:12:54 Disk offset 659554304
10/5/2019 8:12:54 Disk offset =1048576

10/5/2019 8:12:54 Disk offset =105906176
10/5/2019 8:12:54 Disk offset =420478976
10/5/2019 8:12:54 Disk offset =525336576
10/5/2019 8:12:54 Disk offset =659554304

'Z:\',error=1
10/5/2019 8:12:54 AF_INET (IPv4)

10/5/2019 8:12:54 IPv4 address 169.254.150.182
10/5/2019 8:12:54 Valid IP Found

10/5/2019 8:12:54 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
10/5/2019 8:12:54 HA Supported
10/5/2019 8:12:54 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1231618391
10/5/2019 8:12:54 ip RETRIVED �49
10.20.15.151, SecurePort: 443
HServer
Port: 0
10/5/2019 8:13:0 Failed to Bind
ms
reported: 28
10/5/2019 8:13:0 C80B-4C42-8011-32B62020ACA3}, Type=6
10/5/2019 8:13:0 476A-8590-E6333C53F805}, Type=71
secure port 443
10/5/2019 8:13:1 Pipe not found
10/5/2019 8:13:1 The count is 7
10/5/2019 8:13:1 bSet is 1
securePort: 443
10/5/2019 8:13:2 Calling V01
10/5/2019 8:13:2 Merlin version 354
10/5/2019 8:13:2 Signature 354
10/5/2019 8:13:3 Wyse Flag value 0011
10/5/2019 8:13:4 The iBLP value -1
10/5/2019 8:13:4 TZ Queried
10/5/2019 8:13:4 FUR : GetCI() 1
10/5/2019 8:13:4 IP matched!
10/5/2019 8:13:4 Subnet �4
10/5/2019 8:13:4 Gateway ��4
10/5/2019 8:13:4 DS p�4
10/5/2019 8:13:4 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�':
10/5/2019 8:13:4 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�':
10/5/2019 8:13:4 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�':
83FF-9A7F0B2B2
10/5/2019 8:13:4 E1E}
10/5/2019 8:13:4 Got reply from AgentUI=��:
10/5/2019 8:13:4 GetDisplayInfo() return= �7
10/5/2019 8:13:4 Disk offset 659554304
10/5/2019 8:13:4 Disk 0 Part 1 TYPE 260
10/5/2019 8:13:4 Disk 0 Part 5 TYPE 261

10/5/2019 8:13:4 Secure boot = 1

10/5/2019 8:13:4 tempbuff = |WIN0=sistemadebibliotecas.udistrital.edu.co -
Google Chrome|WIN1=Program Manager|, num=0
10/5/2019 8:13:4 Msg recd from AgentGUI:|
WIN0=sistemadebibliotecas.udistrital.edu.co - Google Chrome|WIN1=Program Manager|
10/5/2019 8:13:4 Got reply from AgentUI= &7
10/5/2019 8:13:4 return from ListAllApps=pn;
10/5/2019 8:13:14 size of qfe list 64
10/5/2019 8:13:14 Value found for LocalXMLPath = ##;
10/5/2019 8:13:14 WDAVersion = 12.1.1.25
10/5/2019 8:13:14 GetCI() done
'Z:\',error=1
securePort: 443
10/5/2019 8:13:14 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
10/5/2019 8:13:14 svchost.exe|PRC15=svchost.exe|PRC16=svchost.exe|
10/5/2019 8:13:14 |PRC21=svchost.exe|PRC22=svchost.exe|PRC23=svchost.exe|
PRC24=mqsvc.exe|PRC25=taskhostex.exe|PRC26=GoogleUpdate.exe|PRC27=NetXCle
PRC37=wmiprvse.exe|PRC38=vmware-usbarbitrator64.exe|PRC39=vmware-view-usb
10/5/2019 8:13:14 d.exe|PRC40=GoogleUpdate.exe|PRC41=svchost.exe|
PRC42=wmiprvse.exe|PRC43=SearchIndexer.exe|PRC44=vssvc.exe|PRC45=svchost.exe|PRC4
10/5/2019 8:13:14 6=SearchProtocolHost.exe|PRC47=SearchFilterHost.exe|
PRC48=msiexec.exe|PRC49=chrome.exe|PRC50=chrome.exe|PRC51=DtcWdaUi.exe|PRC52
10/5/2019 8:13:14 =hagent.exe|PRC53=chrome.exe|PRC54=chrome.exe|
PRC55=HAgent_UI.exe|PRC56=chrome.exe|PRC57=chrome.exe|PRC58=tvnserver.exe|PRC59=RA
10/5/2019 8:13:14 VCpl64.exe|PRC60=concentr.exe|PRC61=redirector.exe|
PRC62=PNUSBCLITRAY.exe|PRC63=PNTray.exe|PRC64=Receiver.exe|PRC65=SelfServiceP
10/5/2019 8:13:14 lugin.exe|PRC66=wfcrun32.exe||
WIN0=sistemadebibliotecas.udistrital.edu.coü-üGoogleüChrome|WIN1=ProgramüManager||
PMIU=35|TBPM
10/5/2019 8:13:14 =7786256|FBPM=4997148|TBPF=7786256|FBPF=4910688|
TBVM=8589934464|FKVM=8589864352|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28.0.201|NIC0DESC=
10/5/2019 8:13:14 Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=791|SENDP0=411|MIBSP0=1000üMbps||NIC1IP=0.0.0.0
10/5/2019 8:13:14 |NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0
10/5/2019 8:13:14 .0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=KB27275
10/5/2019 8:13:14
KB2770917,KB2777294,KB2778344,KB2778930,KB277
10/5/2019 8:13:14
5,KB2790907,KB2792100,KB2793210,KB2794119,KB2
10/5/2019 8:13:14
583,KB2804584,KB2805222,KB2805227,KB2807986,K
10/5/2019 8:13:14
18604,KB2820330,KB2821895,KB2822241,KB2829069
10/5/2019 8:13:14
2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
10/5/2019 8:13:14 Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|6
10/5/2019 8:13:14 1.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.101
10/5/2019 8:13:14 7|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC++
10/5/2019 8:13:14 ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||A
10/5/2019 8:13:14 P7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributabl
10/5/2019 8:13:14 eü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\Program�
10/5/2019 8:13:14 �Files\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.e
10/5/2019 8:13:14 xe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterüma
10/5/2019 8:13:14 nager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\InternetüE
10/5/2019 8:13:14 xplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXM
10/5/2019 8:13:14 LED.EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|C:\Pro
10/5/2019 8:13:14 gramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.
10/5/2019 8:13:14 0|AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\P
10/5/2019 8:13:14 rogramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1
10/5/2019 8:13:14 017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
10/5/2019 8:13:14 Found HS Tag
ProcessMsg!
then clear it here
10/5/2019 8:13:15 Server Sent 5
10/5/2019 8:13:15 Enhanced QU : QUM :
10/5/2019 8:13:15 Enhanced QU : QUC :
10/5/2019 8:13:15 Enhanced QU : QUD :
10/5/2019 8:13:15 Server Sent 6
10/5/2019 8:13:15 LOOKING FOR &04
10/5/2019 8:13:15 FUR :After S&P done
GetServerAddress
securePort: 443
10/5/2019 9:13:54 GetIP :: *** PPP
-922739702
10/5/2019 9:13:54 ip RETRIVED `�:
10.20.15.151, SecurePort: 443
10/5/2019 9:13:54 SETTING REG TO VALUE `�:
reported: 28
10/5/2019 9:13:54 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 9:13:54 Pipe not found
10/5/2019 9:13:54 The count is 7
10/5/2019 9:13:54 bSet is 1
securePort: 443
10/5/2019 9:13:55 Value found for LocalXMLPath = 0�9
10/5/2019 9:13:55 WDAVersion = 12.1.1.25
10/5/2019 9:13:56 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 9:13:56 -1|VI=1|
10/5/2019 9:13:57 Found HS Tag
ProcessMsg!
then clear it here
10/5/2019 9:13:57 Server Sent 5
10/5/2019 9:13:57 Enhanced QU : QUM :
10/5/2019 9:13:57 Enhanced QU : QUC :
10/5/2019 9:13:57 Enhanced QU : QUD :
10/5/2019 9:13:57 Server Sent 6
10/5/2019 9:13:57 LOOKING FOR &04
GetServerAddress
securePort: 443
10/5/2019 10:15:10 GetIP :: *** PPP
IN_ADDR : -922739702
10/5/2019 10:15:10 ip RETRIVED ��:
10.20.15.151, SecurePort: 443
10/5/2019 10:15:10 SETTING REG TO VALUE ��:
reported: 28
10/5/2019 10:15:10 C80B-4C42-8011-32B62020ACA3}, Type=6
10/5/2019 10:15:10 CCommLink::SetConnection - connection set to 10.20.15.151:0
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 10:15:10 Sent Msg to AgentGUI:-MsgToTray 2019/5/10 10:15:10
Client->Server: Sending the Check Server Command [V99]
10/5/2019 10:15:10 Pipe not found
10/5/2019 10:15:10 The count is 7
10/5/2019 10:15:10 bCheckServer is 1
10/5/2019 10:15:10 bSet is 1
securePort: 443
10/5/2019 10:15:10 WDAVersion = 12.1.1.25
10/5/2019 10:15:11 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 10:15:12 1|VI=1|
Client->Server: Sending Partial Check-in (Heart-beat)[V03]
10/5/2019 10:15:12 Found HS Tag
ProcessMsg!
10/5/2019 10:15:12 Possibly clear rolling key, if this was a response to check-
in then clear it here
10/5/2019 10:15:12 Server Sent 5
10/5/2019 10:15:12 Enhanced QU : QUM :
10/5/2019 10:15:12 Enhanced QU : QUC :
10/5/2019 10:15:12 Enhanced QU : QUD :
10/5/2019 10:15:12 Server Sent 6
10/5/2019 10:15:12 LOOKING FOR &04
GetServerAddress
securePort: 443
10/5/2019 11:18:2 GetIP :: *** PPP
-922739702
10/5/2019 11:18:2 ip RETRIVED �:
10.20.15.151, SecurePort: 443
10/5/2019 11:18:2 SETTING REG TO VALUE �:
reported: 28
10/5/2019 11:18:2 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 11:18:2 Pipe not found
10/5/2019 11:18:2 The count is 7
10/5/2019 11:18:2 bSet is 1
securePort: 443
10/5/2019 11:18:3 WDAVersion = 12.1.1.25
10/5/2019 11:18:4 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 11:18:4 1|VI=1|
10/5/2019 11:18:4 Found HS Tag
ProcessMsg!
then clear it here
10/5/2019 11:18:4 Server Sent 5
10/5/2019 11:18:4 Enhanced QU : QUM :
10/5/2019 11:18:4 Enhanced QU : QUC :
10/5/2019 11:18:4 Enhanced QU : QUD :
10/5/2019 11:18:4 Server Sent 6
10/5/2019 11:18:4 LOOKING FOR &04
GetServerAddress
securePort: 443
10/5/2019 12:21:25 GetIP :: *** PPP
IN_ADDR : -922739702
10/5/2019 12:21:25 ip RETRIVED `�:
10.20.15.151, SecurePort: 443
reported: 28
10/5/2019 12:21:25 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 12:21:25 Pipe not found
10/5/2019 12:21:25 The count is 7
10/5/2019 12:21:25 bCheckServer is 1
10/5/2019 12:21:25 bSet is 1
securePort: 443
10/5/2019 12:21:25 WDAVersion = 12.1.1.25
10/5/2019 12:21:26 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 12:21:27 1|VI=1|
10/5/2019 12:21:27 Found HS Tag
ProcessMsg!
10/5/2019 12:21:27 Server Sent 5
10/5/2019 12:21:27 Enhanced QU : QUM :
10/5/2019 12:21:27 Enhanced QU : QUC :
10/5/2019 12:21:27 Enhanced QU : QUD :
10/5/2019 12:21:27 Server Sent 6
10/5/2019 12:21:27 LOOKING FOR &04
GetServerAddress
securePort: 443
10/5/2019 13:24:39 GetIP :: *** PPP
IN_ADDR : -922739702
10/5/2019 13:24:39 ip RETRIVED ��:
10.20.15.151, SecurePort: 443
reported: 28
10/5/2019 13:24:39 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 13:24:39 Pipe not found
10/5/2019 13:24:39 The count is 7
10/5/2019 13:24:39 bCheckServer is 1
10/5/2019 13:24:39 bSet is 1
securePort: 443
10/5/2019 13:24:39 Value found for LocalXMLPath = 0�>
10/5/2019 13:24:40 WDAVersion = 12.1.1.25
10/5/2019 13:24:40 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 13:24:41 orted=1|RollingKeysSupported=1|CPRMS0=100,1,68|
WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|TPA=0|TPE=0|TPI=0|BLP=-1|BLE=-1|BLC=
10/5/2019 13:24:41 -1|VI=1|
10/5/2019 13:24:41 Found HS Tag
ProcessMsg!
10/5/2019 13:24:41 Server Sent 5
10/5/2019 13:24:41 Enhanced QU : QUM :
10/5/2019 13:24:41 Enhanced QU : QUC :
10/5/2019 13:24:41 Enhanced QU : QUD :
10/5/2019 13:24:41 Server Sent 6
10/5/2019 13:24:41 LOOKING FOR &04
GetServerAddress
securePort: 443
10/5/2019 14:25:32 GetIP :: *** PPP
IN_ADDR : -922739702
10/5/2019 14:25:32 ip RETRIVED �
10.20.15.151, SecurePort: 443
10/5/2019 14:25:32 SETTING REG TO VALUE �
reported: 28
10/5/2019 14:25:32 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 14:25:32 Pipe not found
10/5/2019 14:25:32 The count is 7
10/5/2019 14:25:32 bCheckServer is 1
10/5/2019 14:25:32 bSet is 1
securePort: 443
10/5/2019 14:25:32 WDAVersion = 12.1.1.25
10/5/2019 14:25:33 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 14:25:34 -1|VI=1|
10/5/2019 14:25:34 Found HS Tag
ProcessMsg!
10/5/2019 14:25:34 Server Sent 5
10/5/2019 14:25:34 Enhanced QU : QUM :
10/5/2019 14:25:34 Enhanced QU : QUC :
10/5/2019 14:25:34 Enhanced QU : QUD :
10/5/2019 14:25:34 Server Sent 6
10/5/2019 14:25:34 LOOKING FOR &04
GetServerAddress
securePort: 443
10/5/2019 15:26:6 GetIP :: *** PPP
-922739702
10/5/2019 15:26:6 ip RETRIVED �:
10.20.15.151, SecurePort: 443
10/5/2019 15:26:6 SETTING REG TO VALUE �:
reported: 28
10/5/2019 15:26:6 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 15:26:6 Pipe not found
10/5/2019 15:26:6 The count is 7
10/5/2019 15:26:6 bSet is 1
securePort: 443
10/5/2019 15:26:6 Value found for LocalXMLPath = P�>
10/5/2019 15:26:6 WDAVersion = 12.1.1.25
10/5/2019 15:26:7 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 15:26:8 -1|VI=1|
10/5/2019 15:26:8 Found HS Tag
ProcessMsg!
then clear it here
10/5/2019 15:26:8 Server Sent 5
10/5/2019 15:26:8 Enhanced QU : QUM :
10/5/2019 15:26:8 Enhanced QU : QUC :
10/5/2019 15:26:8 Enhanced QU : QUD :
10/5/2019 15:26:8 Server Sent 6
10/5/2019 15:26:8 LOOKING FOR &04
10/5/2019 16:22:52 Received data: p�9
Accept: */*
10/5/2019 16:22:52 jects/mechanize/)
Connection: close
10/5/2019 16:22:52 =0.7,*;q=0.7

Accept: */*
Connection: close
10/5/2019 16:22:52 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
10/5/2019 16:22:52 GetIP :: *** PPP
IN_ADDR : -922739702
10/5/2019 16:22:52 ip RETRIVED ��:
10.20.15.151, SecurePort: 443
reported: 28
10/5/2019 16:22:52 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 16:22:52 Pipe not found
10/5/2019 16:22:52 The count is 7
10/5/2019 16:22:52 bCheckServer is 1
10/5/2019 16:22:52 bSet is 1
securePort: 443
10/5/2019 16:22:52 Calling V01
10/5/2019 16:22:52 Merlin version 354
10/5/2019 16:22:52 Signature 354
10/5/2019 16:22:53 Wyse Flag value 0011
10/5/2019 16:22:53 The iBLP value -1
10/5/2019 16:22:54 TZ Queried
Number
10/5/2019 16:22:54 FUR : GetCI() 1
10/5/2019 16:22:54 IP matched!
10/5/2019 16:22:54 Subnet �4
10/5/2019 16:22:54 Gateway ��4
10/5/2019 16:22:54 DS p�4
10/5/2019 16:22:54 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�*:
10/5/2019 16:22:54 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�*:
10/5/2019 16:22:54 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�*:
83FF-9A7F0B2B2
10/5/2019 16:22:54 E1E}
10/5/2019 16:22:55 Got reply from AgentUI=p�;
10/5/2019 16:22:55 add only adapter.
10/5/2019 16:22:55 GetDisplayInfo() return=`<@
10/5/2019 16:22:55 Disk offset 659554304
10/5/2019 16:22:55 Disk 0 Part 1 TYPE 260

10/5/2019 16:22:55 Disk 0 Part 5 TYPE 261

10/5/2019 16:22:55 Secure boot = 1

10/5/2019 16:22:55 tempbuff = |WIN0=Cono (geometr�a) - Wikipedia, la
enciclopedia libre - Mozilla Firefox|WIN1=Program Manager|, num=0
10/5/2019 16:22:55 Msg recd from AgentGUI:|WIN0=Cono (geometr�a) - Wikipedia, la
enciclopedia libre - Mozilla Firefox|WIN1=Program Manager|
10/5/2019 16:22:55 Got reply from AgentUI=�k?
10/5/2019 16:22:55 return from ListAllApps=pL@
10/5/2019 16:23:0 size of qfe list 64
10/5/2019 16:23:1 Value found for LocalXMLPath = p�>
10/5/2019 16:23:1 WDAVersion = 12.1.1.25
10/5/2019 16:23:1 GetCI() done
10/5/2019 16:23:1 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC10=svchost.exe|PRC11=svchost.exe|PRC12=dwm.exe|PRC13=svchost.exe|PRC14=
10/5/2019 16:23:1 |PRC21=svchost.exe|PRC22=svchost.exe|PRC23=mqsvc.exe|
PRC24=taskhostex.exe|PRC25=NetXClean.exe|PRC26=pnusbvirtualhubwssrv.exe|PRC
PRC46=r
PRC49=Receiver.exe|PRC50=SelfServicePlugin.exe|PRC51=wfcrun32.exe|PRC52=Cc
10/5/2019 16:23:1 mExec.exe|PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|
PRC55=svchost.exe|PRC56=DllHost.exe|PRC57=TrustedInstaller.exe|PRC58=TiWorker.ex
10/5/2019 16:23:1 e|PRC59=makecab.exe|PRC60=conhost.exe|PRC61=firefox.exe|
PRC62=firefox.exe|PRC63=firefox.exe|PRC64=firefox.exe|PRC65=firefox.exe|
10/5/2019 16:23:1 PRC66=firefox.exe|PRC67=svchost.exe|PRC68=firefox.exe|
PRC69=wmiprvse.exe||WIN0=Conoü(geometr�a)ü-üWikipedia,ülaüenciclopedi
10/5/2019 16:23:1 aülibreü-üMozillaüFirefox|WIN1=ProgramüManager||PMIU=40|
TBPM=7786256|FBPM=4633580|TBPF=7786256|FBPF=4338656|TBVM=8589934464
10/5/2019 16:23:1 |FKVM=8589864360|FKEM=0|CPRMS0=133,1,68|NIC0IP=10.28.0.201|
NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC
10/5/2019 16:23:1 =008064FB707A|RECP0=1055042|SENDP0=329399|MIBSP0=1000üMbps||
NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüArea
10/5/2019 16:23:1 üNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless
10/5/2019 16:23:1 -ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|
QFEL=KB2727528,KB2729462,KB2737084,KB2753842,KB2756872,KB2757638,
10/5/2019 16:23:1
779768,KB2780541,KB2781197,KB2785094,KB278522
10/5/2019 16:23:1
0,KB2789649,KB2789650,KB2790655,KB2790907,KB2792100,KB2793210,KB2794119,KB2794599,K
B2795944,KB2798162,KB2798802,KB2798804,KB2798
10/5/2019 16:23:1
,KB2808735,KB2809289,KB2811660,KB2812822,KB28
10/5/2019 16:23:1
54,KB2829361,KB2829530,KB2830290,KB2832450,KB
10/5/2019 16:23:1
2836946,KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=
10/5/2019 16:23:1 MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=M
10/5/2019 16:23:1 icrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|
15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\
10/5/2019 16:23:1 ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|
AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.
10/5/2019 16:23:1 30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\Microsoft
10/5/2019 16:23:1 üSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|C:\Progra
10/5/2019 16:23:1 müFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|AP11
10/5/2019 16:23:1 =GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|
AP12=MicrosoftüExcel|C:\PROGRA~1\MI
10/5/2019 16:23:1 CROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=
10/5/2019 16:23:1 DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXM
10/5/2019 16:23:1 LüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:\
10/5/2019 16:23:1 PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|
AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=Unifi
10/5/2019 16:23:1 edüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüM
10/5/2019 16:23:1 ail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|
6.2.9200.16384
10/5/2019 16:23:1 |AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|
WCMSupp=1|WCMJSONSupp=1|
10/5/2019 16:23:1 Found HS Tag
ProcessMsg!
then clear it here
10/5/2019 16:23:1 Server Sent 5
10/5/2019 16:23:1 Enhanced QU : QUM :
10/5/2019 16:23:1 Enhanced QU : QUC :
10/5/2019 16:23:1 Enhanced QU : QUD :
10/5/2019 16:23:1 Server Sent 6
10/5/2019 16:23:1 LOOKING FOR &04
10/5/2019 16:23:1 FUR :After S&P done
GetServerAddress
securePort: 443
10/5/2019 17:26:37 GetIP :: *** PPP
IN_ADDR : -922739702
10/5/2019 17:26:37 ip RETRIVED `�:
10.20.15.151, SecurePort: 443
reported: 28
10/5/2019 17:26:37 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 17:26:37 Pipe not found
10/5/2019 17:26:37 The count is 7
10/5/2019 17:26:37 bCheckServer is 1
10/5/2019 17:26:37 bSet is 1
securePort: 443
10/5/2019 17:26:37 Value found for LocalXMLPath = P�>
10/5/2019 17:26:38 WDAVersion = 12.1.1.25
10/5/2019 17:26:39 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 17:26:39 -1|VI=1|
10/5/2019 17:26:39 Found HS Tag
ProcessMsg!
10/5/2019 17:26:39 Server Sent 5
10/5/2019 17:26:39 Enhanced QU : QUM :
10/5/2019 17:26:39 Enhanced QU : QUC :
10/5/2019 17:26:39 Enhanced QU : QUD :
10/5/2019 17:26:39 Server Sent 6
10/5/2019 17:26:39 LOOKING FOR &04
GetServerAddress
securePort: 443
10/5/2019 18:30:18 GetIP :: *** PPP
IN_ADDR : -922739702
10/5/2019 18:30:18 ip RETRIVED `�:
10.20.15.151, SecurePort: 443
reported: 28
10/5/2019 18:30:18 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 18:30:18 Pipe not found
10/5/2019 18:30:18 The count is 7
10/5/2019 18:30:18 bCheckServer is 1
10/5/2019 18:30:18 bSet is 1
securePort: 443
10/5/2019 18:30:18 Value found for LocalXMLPath = #�>
10/5/2019 18:30:18 WDAVersion = 12.1.1.25
10/5/2019 18:30:19 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
10/5/2019 18:30:20 -1|VI=1|
10/5/2019 18:30:20 Found HS Tag
ProcessMsg!
10/5/2019 18:30:20 Server Sent 5
10/5/2019 18:30:20 Enhanced QU : QUM :
10/5/2019 18:30:20 Enhanced QU : QUC :
10/5/2019 18:30:20 Enhanced QU : QUD :
10/5/2019 18:30:20 Server Sent 6
10/5/2019 18:30:20 LOOKING FOR &04
13/5/2019 7:42:2 ***********************************************************
13/5/2019 7:42:2 End of WinMain()
13/5/2019 7:42:2 ^^^^^^^^ after reghanex()
13/5/2019 7:42:23 OS Version 6.2.9200
13/5/2019 7:42:23 OS Version 6.2.9200
13/5/2019 7:42:23 Major version 6
13/5/2019 7:42:23 Minor version 2
13/5/2019 7:42:23 Device Info: OS is �1
13/5/2019 7:42:23 WRITE FILTER UWF 1
13/5/2019 7:42:23 Setting UWF Mgr!
13/5/2019 7:42:23 Disk offset 659554304
13/5/2019 7:42:23 Disk offset =1048576

13/5/2019 7:42:23 Disk offset =105906176
13/5/2019 7:42:23 Disk offset =420478976
13/5/2019 7:42:23 Disk offset =525336576
13/5/2019 7:42:23 Disk offset =659554304

'Z:\',error=1
13/5/2019 7:42:23 AF_INET (IPv4)
13/5/2019 7:42:23 IPv4 address 169.254.150.182
13/5/2019 7:42:23 Valid IP Found

13/5/2019 7:42:23 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
13/5/2019 7:42:23 HA Supported
13/5/2019 7:42:23 dwHSListCount = 1
GetServerAddress
securePort: 443
13/5/2019 7:42:24 GetIP :: *** PPP
-922739702
13/5/2019 7:42:24 ip RETRIVED P64
10.20.15.151, SecurePort: 443
13/5/2019 7:42:24 Failed to Bind
HServer
Port: 0
13/5/2019 7:42:24 Failed to Bind
ms
reported: 28
13/5/2019 7:42:24 C80B-4C42-8011-32B62020ACA3}, Type=6
13/5/2019 7:42:24 476A-8590-E6333C53F805}, Type=71
Description=Inventec PCIe GBE Family Controller #2, AdapterName={F1C
13/5/2019 7:42:24 924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
13/5/2019 7:42:29 Failed to Bind
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
13/5/2019 7:42:30 ip RETRIVED �<3
10.20.15.151, SecurePort: 443
13/5/2019 7:42:30 SETTING REG TO VALUE �<3
HuntForAltLocalIP
secure port 443
13/5/2019 7:42:31 Pipe not found
13/5/2019 7:42:31 The count is 7
13/5/2019 7:42:31 bSet is 1
securePort: 443
13/5/2019 7:42:32 Calling V01
13/5/2019 7:42:32 Merlin version 354
13/5/2019 7:42:32 Signature 354
13/5/2019 7:42:32 Wyse Flag value 0011
13/5/2019 7:42:33 The iBLP value -1
13/5/2019 7:42:34 TZ Queried
Number
13/5/2019 7:42:34 FUR : GetCI() 1
13/5/2019 7:42:34 IP matched!
13/5/2019 7:42:34 Subnet д/
13/5/2019 7:42:34 Gateway �/
13/5/2019 7:42:34 DS ��/
13/5/2019 7:42:34 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP= B5
13/5/2019 7:42:34 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP= B5
13/5/2019 7:42:34 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP= B5
83FF-9A7F0B2B2
13/5/2019 7:42:34 E1E}
13/5/2019 7:42:34 Got reply from AgentUI=�
13/5/2019 7:42:34 GetDisplayInfo() return= U4
13/5/2019 7:42:34 Disk offset 659554304
13/5/2019 7:42:34 Disk 0 Part 1 TYPE 260

13/5/2019 7:42:34 Disk 0 Part 5 TYPE 261

13/5/2019 7:42:34 Secure boot = 1

13/5/2019 7:42:34 tempbuff = |WIN0=Program Manager|, num=0
13/5/2019 7:42:34 Msg recd from AgentGUI:|WIN0=Program Manager|
13/5/2019 7:42:34 Got reply from AgentUI=p'2
13/5/2019 7:42:34 return from ListAllApps=��4
13/5/2019 7:42:41 size of qfe list 64
13/5/2019 7:42:42 Value found for LocalXMLPath = �#1
13/5/2019 7:42:42 WDAVersion = 12.1.1.25
13/5/2019 7:42:42 GetCI() done
'Z:\',error=1
securePort: 443
13/5/2019 7:42:42 GetCI() 2 done
BUIX=0|CN=WES008064FB707A|IP=10.28.1.79|ED=1|DS=10.28.24.2|GW=10.28.0.1|
13/5/2019 7:42:42 SM=255.255.252.0|SN=10.28.3.255|DM=udistrital.edu.co|0D=1|
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
13/5/2019 7:42:42 GB|RM=7973126|CP=AuthenticAMDüAMDüGX-
415GAüSOCüwithüRadeon(tm)üHDüGraphicsüüü|CPS=1497|B1=1.0F|PD2=AMDüRadeon(TM)üHD
13/5/2019 7:42:42 ü8330E.|PD1=AMDüHighüDefinitionüAudioüDevice|CO=|LO=|OSDSK=0||
Disk0=0|DiskSize0=32012789760|D0PAR1SZ=104857600|D0PAR1STOFF=
13/5/2019 7:42:42 1048576|D0PAR1TYPE=260|D0PARBOOT=5|D0PAR2SZ=314572800|
D0PAR2STOFF=105906176|D0PAR2TYPE=257|D0PARBOOT=5|D0PAR3SZ=104857600|D0PAR3
13/5/2019 7:42:42 STOFF=420478976|D0PAR3TYPE=258|D0PARBOOT=5|D0PAR4SZ=134217728|
UEFISEC=1|DRV0=C:|TB0=30708592640|TFB0=16477470720|DRV1=Z:|TB1=1073643520|
13/5/2019 7:42:42 TFB1=1073479680||PRC0=smss.exe|PRC1=csrss.exe|
PRC2=wininit.exe|PRC3=csrss.exe|PRC4=services.exe|PRC5=winlogon.exe|PRC6=lsass.exe
13/5/2019 7:42:42 |PRC7=svchost.exe|PRC8=svchost.exe|PRC9=atiesrxx.exe|
PRC10=svchost.exe|PRC11=svchost.exe|PRC12=svchost.exe|PRC13=svchost.exe|PRC
13/5/2019 7:42:42 14=dwm.exe|PRC15=svchost.exe|PRC16=svchost.exe|
PRC17=atieclxx.exe|PRC18=DtcPlatformSvc.exe|PRC19=spoolsv.exe|PRC20=Explorer.EXE|
13/5/2019 7:42:42 PRC21=svchost.exe|PRC22=taskhostex.exe|PRC23=svchost.exe|
PRC24=svchost.exe|PRC25=mqsvc.exe|PRC26=NetXClean.exe|PRC27=pnusbvirtua
13/5/2019 7:42:42 lhubwssrv.exe|PRC28=tcpsvcs.exe|PRC29=snmp.exe|
PRC30=tvnserver.exe|PRC31=UWFSvc.exe|PRC32=MsMpEng.exe|PRC33=wsnm.exe|PRC34=DtcWD
13/5/2019 7:42:42 AService.exe|PRC35=wmiprvse.exe|PRC36=mqtgsvc.exe|
PRC37=vmware-usbarbitrator64.exe|PRC38=vmware-view-usbd.exe|PRC39=svchost.exe|
13/5/2019 7:42:42 PRC40=wmiprvse.exe|PRC41=SearchIndexer.exe|PRC42=vssvc.exe|
PRC43=svchost.exe|PRC44=SearchProtocolHost.exe|PRC45=SearchFilterHost
13/5/2019 7:42:42 .exe|PRC46=msiexec.exe|PRC47=DtcWdaUi.exe|PRC48=hagent.exe|
PRC49=HAgent_UI.exe|PRC50=tvnserver.exe|PRC51=RAVCpl64.exe|PRC52=conc
13/5/2019 7:42:42 entr.exe|PRC53=redirector.exe|PRC54=PNUSBCLITRAY.exe|
PRC55=PNTray.exe|PRC56=Receiver.exe|PRC57=SelfServicePlugin.exe|PRC58=wfcru
13/5/2019 7:42:42 n32.exe|PRC59=GoogleUpdateSetup.exe|PRC60=DllHost.exe|
PRC61=GoogleUpdate.exe||WIN0=ProgramüManager||PMIU=34|TBPM=7786256|FBPM=5
13/5/2019 7:42:42 135468|TBPF=7786256|FBPF=5075844|TBVM=8589934464|
FKVM=8589865384|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28.1.79|NIC0DESC=Ethernet,Invente
13/5/2019 7:42:42 cüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|
RECP0=1639|SENDP0=571|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ether
13/5/2019 7:42:42 net,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=E
13/5/2019 7:42:42 thernet,Intel(R)üDualüBandüWireless-ACü7260|
NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,KB2729462,KB
13/5/2019 7:42:42
7294,KB2778344,KB2778930,KB2779562,KB2779768,
13/5/2019 7:42:42
792100,KB2793210,KB2794119,KB2794599,KB279594
13/5/2019 7:42:42
B2805222,KB2805227,KB2807986,KB2808679,KB2808
13/5/2019 7:42:42
,KB2821895,KB2822241,KB2829069,KB2829254,KB28
13/5/2019 7:42:42
94,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x6
13/5/2019 7:42:42 4)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=Mozil
13/5/2019 7:42:42 laüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=Microsoft
13/5/2019 7:42:42 üOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistr
13/5/2019 7:42:42 ibutableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=MicrosoftüS
13/5/2019 7:42:42 ilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.6
13/5/2019 7:42:42 1000|AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|
12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\V
13/5/2019 7:42:42 MwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.10
13/5/2019 7:42:42 6|AP12=MicrosoftüExcel|
basedüwriteüfilterümanager|C:\Window
13/5/2019 7:42:42 s\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGC
13/5/2019 7:42:42 MD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.44
13/5/2019 7:42:42 20.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\Tig
13/5/2019 7:42:42 htVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=Windows�
13/5/2019 7:42:42 �Contacts|C:\ProgramüFiles\WindowsüMail\wab.exe|
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\W
13/5/2019 7:42:42 indowsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HAS
13/5/2019 7:42:42 H=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
13/5/2019 7:42:42 Found HS Tag
ProcessMsg!
then clear it here
13/5/2019 7:42:42 Server Sent 5
13/5/2019 7:42:42 Enhanced QU : QUM :
13/5/2019 7:42:42 Enhanced QU : QUC :
13/5/2019 7:42:42 Enhanced QU : QUD :
13/5/2019 7:42:42 Server Sent 6
13/5/2019 7:42:42 LOOKING FOR &04
13/5/2019 7:42:42 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
13/5/2019 8:44:18 ip RETRIVED @63
10.20.15.151, SecurePort: 443
13/5/2019 8:44:18 SETTING REG TO VALUE @63
HuntForAltLocalIP
secure port 443
13/5/2019 8:44:18 Pipe not found
13/5/2019 8:44:18 The count is 7
13/5/2019 8:44:18 bSet is 1
securePort: 443
13/5/2019 8:44:18 Calling V01
13/5/2019 8:44:18 Merlin version 354
13/5/2019 8:44:18 Signature 354
13/5/2019 8:44:19 Wyse Flag value 0011
13/5/2019 8:44:19 The iBLP value -1
13/5/2019 8:44:20 TZ Queried
Number
13/5/2019 8:44:20 FUR : GetCI() 1
13/5/2019 8:44:20 IP matched!
13/5/2019 8:44:20 Subnet д/
13/5/2019 8:44:20 Gateway �/
13/5/2019 8:44:20 DS ��/
13/5/2019 8:44:20 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=`@5
13/5/2019 8:44:20 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=`@5
13/5/2019 8:44:20 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=`@5
83FF-9A7F0B2B2
13/5/2019 8:44:20 E1E}
13/5/2019 8:44:20 Got reply from AgentUI=#�6
13/5/2019 8:44:20 GetDisplayInfo() return=
13/5/2019 8:44:20 Disk offset 659554304
13/5/2019 8:44:20 Disk 0 Part 1 TYPE 260

13/5/2019 8:44:20 Disk 0 Part 5 TYPE 261

13/5/2019 8:44:20 Secure boot = 1

13/5/2019 8:44:20 tempbuff = |WIN0=Excel - Crear histograma y pol�gono de
frecuencias en Excel. Tutorial en espa�ol HD - YouTube - Google Chrome|W
13/5/2019 8:44:20 IN1=Taller de Recuperaci�n PARCIAL 1ER CORTE - Excel|
13/5/2019 8:44:20 Msg recd from AgentGUI:|WIN0=Excel - Crear histograma y
pol�gono de frecuencias en Excel. Tutorial en espa�ol HD - YouTube - Goo
13/5/2019 8:44:20 gle Chrome|WIN1=Taller de Recuperaci�n PARCIAL 1ER CORTE -
Excel|WIN2=Program Manager|
13/5/2019 8:44:20 Got reply from AgentUI=��5
13/5/2019 8:44:20 return from ListAllApps=p�5
13/5/2019 8:44:26 size of qfe list 64
13/5/2019 8:44:27 Value found for LocalXMLPath = ��5
13/5/2019 8:44:27 WDAVersion = 12.1.1.25
13/5/2019 8:44:27 GetCI() done
13/5/2019 8:44:27 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
PRC10=svchost.exe|PRC11=svchost.exe|PRC12=svchost.exe|PRC13=dwm.exe|PRC14=s
13/5/2019 8:44:27 vchost.exe|PRC15=svchost.exe|PRC16=atieclxx.exe|
PRC17=DtcPlatformSvc.exe|PRC18=spoolsv.exe|PRC19=Explorer.EXE|PRC20=svchost.exe|
13/5/2019 8:44:27 PRC21=taskhostex.exe|PRC22=svchost.exe|PRC23=svchost.exe|
PRC24=mqsvc.exe|PRC25=NetXClean.exe|PRC26=pnusbvirtualhubwssrv.exe|PRC2
13/5/2019 8:44:27 =mqtgsvc.exe|PRC35=vmware-usbarbitrator64.exe|PRC36=vmware-
view-usbd.exe|PRC37=svchost.exe|PRC38=wmiprvse.exe|PRC39=SearchIndexe
13/5/2019 8:44:27 r.exe|PRC40=DtcWdaUi.exe|PRC41=hagent.exe|PRC42=HAgent_UI.exe|
PRC43=tvnserver.exe|PRC44=RAVCpl64.exe|PRC45=concentr.exe|PRC46=re
13/5/2019 8:44:27 director.exe|PRC47=PNUSBCLITRAY.exe|PRC48=PNTray.exe|
PRC49=Receiver.exe|PRC50=SelfServicePlugin.exe|PRC51=wfcrun32.exe|PRC52=chr
13/5/2019 8:44:27 ome.exe|PRC53=chrome.exe|PRC54=chrome.exe|PRC55=chrome.exe|
PRC56=chrome.exe|PRC57=chrome.exe|PRC58=chrome.exe|PRC59=CcmExec.exe|
13/5/2019 8:44:27 PRC60=wmiprvse.exe|PRC61=wmiprvse.exe|PRC62=EXCEL.EXE|
PRC63=chrome.exe|PRC64=chrome.exe|PRC65=wmiprvse.exe||WIN0=Excelü-üCrear
13/5/2019 8:44:27
ühistogramaüyüpol�gonoüdeüfrecuenciasüenüExcel.üTutorialüenüespa�olüHDü-üYouTubeü-
üGoogleüChrome|WIN1=Tallerüde
13/5/2019 8:44:27 üRecuperaci�nüPARCIALü1ERüCORTEü-üExcel|WIN2=ProgramüManager||
PMIU=39|TBPM=7786256|FBPM=4744152|TBPF=7786256|FBPF=4504668
13/5/2019 8:44:27 |TBVM=8589934464|FKVM=8589865384|FKEM=0|CPRMS0=16,16,16|
NIC0IP=10.28.1.79|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControl
13/5/2019 8:44:27 lerü#2|NIC0MAC=008064FB707A|RECP0=81749|SENDP0=23501|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(Pe
13/5/2019 8:44:27 rsonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBa
13/5/2019 8:44:27 ndüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|
MIBSP2=0üMbps|QFEL=KB2727528,KB2729462,KB2737084,KB2753842,KB275687
13/5/2019 8:44:27
B2779562,KB2779768,KB2780541,KB2781197,KB2785
13/5/2019 8:44:27
,KB2794599,KB2795944,KB2798162,KB2798802,KB27
13/5/2019 8:44:27
86,KB2808679,KB2808735,KB2809289,KB2811660,KB
13/5/2019 8:44:27
9069,KB2829254,KB2829361,KB2829530,KB2830290,
13/5/2019 8:44:27
KB2832450,KB2836946,KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|
AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip
13/5/2019 8:44:27 \|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||
13/5/2019 8:44:27 61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPl
13/5/2019 8:44:27 usü2013|C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|
AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.3072
13/5/2019 8:44:27 9.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüFil
13/5/2019 8:44:27 es\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAge
13/5/2019 8:44:27 nt|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.
13/5/2019 8:44:27 1219906|AP11=GoogleüChrome|
AP12=MicrosoftüExcel|C:
13/5/2019 8:44:27 \PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|
AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0
13/5/2019 8:44:27 .449.0|AP14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP1
13/5/2019 8:44:27 5=OfficeüXMLüHandler|
15.0.4420.1017|AP16=MicrosoftüPo
13/5/2019 8:44:27 werPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|
15.0.4420.1017|AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.
13/5/2019 8:44:27 0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\ProgramüFile
13/5/2019 8:44:27 s\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.
13/5/2019 8:44:27 2.9200.16384|AP21=MicrosoftüWord|
WCMSupp=1|WCMJSO
13/5/2019 8:44:27 NSupp=1|
13/5/2019 8:44:27 Found HS Tag
ProcessMsg!
then clear it here
13/5/2019 8:44:27 Server Sent 5
13/5/2019 8:44:27 Enhanced QU : QUM :
13/5/2019 8:44:27 Enhanced QU : QUC :
13/5/2019 8:44:27 Enhanced QU : QUD :
13/5/2019 8:44:27 Server Sent 6
13/5/2019 8:44:27 LOOKING FOR &04
13/5/2019 8:44:27 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
13/5/2019 9:46:19 ip RETRIVED
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
13/5/2019 9:46:19 Pipe not found
13/5/2019 9:46:19 The count is 7
13/5/2019 9:46:19 bSet is 1
securePort: 443
13/5/2019 9:46:19 Value found for LocalXMLPath = p�5
13/5/2019 9:46:19 WDAVersion = 12.1.1.25
13/5/2019 9:46:19 The iBLP value -1
13/5/2019 9:46:20 -1|VI=1|
13/5/2019 9:46:20 Found HS Tag
ProcessMsg!
then clear it here
13/5/2019 9:46:20 Server Sent 5
13/5/2019 9:46:20 Enhanced QU : QUM :
13/5/2019 9:46:20 Enhanced QU : QUC :
13/5/2019 9:46:20 Enhanced QU : QUD :
13/5/2019 9:46:20 Server Sent 6
13/5/2019 9:46:20 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
13/5/2019 10:48:30 ip RETRIVED �P3
10.20.15.151, SecurePort: 443
13/5/2019 10:48:30 SETTING REG TO VALUE �P3
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 10:48:30 Pipe not found
13/5/2019 10:48:30 The count is 7
13/5/2019 10:48:30 bCheckServer is 1
13/5/2019 10:48:30 bSet is 1
securePort: 443
13/5/2019 10:48:30 WDAVersion = 12.1.1.25
13/5/2019 10:48:31 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 10:48:32 -1|VI=1|
13/5/2019 10:48:32 Found HS Tag
ProcessMsg!
13/5/2019 10:48:32 Server Sent 5
13/5/2019 10:48:32 Enhanced QU : QUM :
13/5/2019 10:48:32 Enhanced QU : QUC :
13/5/2019 10:48:32 Enhanced QU : QUD :
13/5/2019 10:48:32 Server Sent 6
13/5/2019 10:48:32 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
13/5/2019 11:50:22 ip RETRIVED @63
10.20.15.151, SecurePort: 443
13/5/2019 11:50:22 SETTING REG TO VALUE @63
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 11:50:22 Pipe not found
13/5/2019 11:50:22 The count is 7
13/5/2019 11:50:22 bCheckServer is 1
13/5/2019 11:50:22 bSet is 1
securePort: 443
13/5/2019 11:50:22 WDAVersion = 12.1.1.25
13/5/2019 11:50:22 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 11:50:23 -1|VI=1|
13/5/2019 11:50:23 Found HS Tag
ProcessMsg!
13/5/2019 11:50:23 Server Sent 5
13/5/2019 11:50:23 Enhanced QU : QUM :
13/5/2019 11:50:23 Enhanced QU : QUC :
13/5/2019 11:50:23 Enhanced QU : QUD :
13/5/2019 11:50:23 Server Sent 6
13/5/2019 11:50:23 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
13/5/2019 12:52:12 ip RETRIVED �P3
10.20.15.151, SecurePort: 443
13/5/2019 12:52:12 SETTING REG TO VALUE �P3
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 12:52:12 Pipe not found
13/5/2019 12:52:12 The count is 7
13/5/2019 12:52:12 bCheckServer is 1
13/5/2019 12:52:12 bSet is 1
securePort: 443
13/5/2019 12:52:12 WDAVersion = 12.1.1.25
13/5/2019 12:52:12 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 12:52:13 1|VI=1|
13/5/2019 12:52:13 Found HS Tag
ProcessMsg!
13/5/2019 12:52:13 Server Sent 5
13/5/2019 12:52:13 Enhanced QU : QUM :
13/5/2019 12:52:13 Enhanced QU : QUC :
13/5/2019 12:52:13 Enhanced QU : QUD :
13/5/2019 12:52:13 Server Sent 6
13/5/2019 12:52:13 LOOKING FOR &04
13/5/2019 13:38:50 Service Stopping
13/5/2019 13:38:51 Listener Shutting Down
13/5/2019 13:38:51 End of CHListen::HTTPListen()
13/5/2019 13:38:54 End of CService::Run()
13/5/2019 13:38:54 Stopping
13/5/2019 13:38:54 Start of ~CService()
13/5/2019 13:39:36 ***********************************************************
13/5/2019 13:39:36 End of WinMain()
13/5/2019 13:39:36 ^^^^^^^^ after reghanex()
13/5/2019 13:39:56 OS Version 6.2.9200
13/5/2019 13:39:56 OS Version 6.2.9200
13/5/2019 13:39:56 Major version 6
13/5/2019 13:39:56 Minor version 2
13/5/2019 13:39:56 Device Info: OS is �+
13/5/2019 13:39:56 The image has UWF
13/5/2019 13:39:56 WRITE FILTER UWF 1
13/5/2019 13:39:56 Setting UWF Mgr!
13/5/2019 13:39:56 Disk offset 659554304
13/5/2019 13:39:56 Disk offset =1048576

13/5/2019 13:39:56 Disk offset =105906176
13/5/2019 13:39:56 Disk offset =420478976
13/5/2019 13:39:56 Disk offset =525336576
13/5/2019 13:39:56 Disk offset =659554304

'Z:\',error=1
13/5/2019 13:39:56 AF_INET (IPv4)
13/5/2019 13:39:56 IPv4 address 169.254.150.182
13/5/2019 13:39:56 Valid IP Found

13/5/2019 13:39:56 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
13/5/2019 13:39:56 HA Supported
13/5/2019 13:39:56 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1231618391
13/5/2019 13:39:57 ip RETRIVED p�.
10.20.15.151, SecurePort: 443
HServer
Port: 0
13/5/2019 13:40:2 Failed to Bind
ms
reported: 28
13/5/2019 13:40:2 C80B-4C42-8011-32B62020ACA3}, Type=6
13/5/2019 13:40:2 476A-8590-E6333C53F805}, Type=71
Description=Inventec PCIe GBE Family Controller #2, AdapterName={F1C924B6
13/5/2019 13:40:2 -FC2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
secure port 443
13/5/2019 13:40:3 Pipe not found
13/5/2019 13:40:3 The count is 7
13/5/2019 13:40:3 bSet is 1
securePort: 443
13/5/2019 13:40:4 Calling V01
13/5/2019 13:40:4 Merlin version 354
13/5/2019 13:40:4 Signature 354
13/5/2019 13:40:5 Wyse Flag value 0011
13/5/2019 13:40:5 The iBLP value -1
13/5/2019 13:40:6 TZ Queried
Number
13/5/2019 13:40:6 FUR : GetCI() 1
13/5/2019 13:40:6 IP matched!
13/5/2019 13:40:6 Subnet #�)
13/5/2019 13:40:6 Gateway �)
13/5/2019 13:40:6 DS #�)
13/5/2019 13:40:6 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�7-
13/5/2019 13:40:6 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�7-
13/5/2019 13:40:6 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�7-
83FF-9A7F0B2B2
13/5/2019 13:40:6 E1E}
13/5/2019 13:40:6 Got reply from AgentUI=`�-
13/5/2019 13:40:6 GetDisplayInfo() return=��/
13/5/2019 13:40:6 Disk offset 659554304
13/5/2019 13:40:6 Disk 0 Part 1 TYPE 260

13/5/2019 13:40:6 Disk 0 Part 5 TYPE 261

13/5/2019 13:40:6 Secure boot = 1

13/5/2019 13:40:6 tempbuff = |, num=0
13/5/2019 13:40:6 Got reply from AgentUI=�Q0
13/5/2019 13:40:6 return from ListAllApps=�#+
13/5/2019 13:40:13 size of qfe list 64
13/5/2019 13:40:14 Value found for LocalXMLPath = 05/
13/5/2019 13:40:14 WDAVersion = 12.1.1.25
13/5/2019 13:40:14 GetCI() done
'Z:\',error=1
securePort: 443
13/5/2019 13:40:14 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
13/5/2019 13:40:14 ü8330E.|PD1=AMDüHighüDefinitionüAudioüDevice|CO=|LO=|
OSDSK=0||Disk0=0|DiskSize0=32012789760|D0PAR1SZ=104857600|D0PAR1STOFF=
13/5/2019 13:40:14 STOFF=420478976|D0PAR3TYPE=258|D0PARBOOT=5|
D0PAR5SZ=30708596
13/5/2019 13:40:14 vchost.exe|PRC15=svchost.exe|PRC16=svchost.exe|
PRC17=atieclxx.exe|PRC18=DtcPlatformSvc.exe|PRC19=Explorer.EXE|PRC20=spoolsv.exe|
13/5/2019 13:40:14 PRC21=svchost.exe|PRC22=taskhostex.exe|
PRC23=GoogleUpdate.exe|PRC24=svchost.exe|PRC25=svchost.exe|PRC26=mqsvc.exe|
PRC27=NetXClea
13/5/2019 13:40:14 n.exe|PRC28=pnusbvirtualhubwssrv.exe|PRC29=tcpsvcs.exe|
PRC30=snmp.exe|PRC31=tvnserver.exe|PRC32=UWFSvc.exe|PRC33=MsMpEng.exe|PRC
13/5/2019 13:40:14 34=wsnm.exe|PRC35=DtcWDAService.exe|PRC36=GoogleUpdate.exe|
PRC37=mqtgsvc.exe|PRC38=wmiprvse.exe|PRC39=vmware-usbarbitrator64.exe
13/5/2019 13:40:14 |PRC40=vmware-view-usbd.exe|PRC41=svchost.exe|
13/5/2019 13:40:14 =SearchProtocolHost.exe|PRC47=SearchFilterHost.exe|
PRC48=msiexec.exe|PRC49=DtcWdaUi.exe|PRC50=hagent.exe|PRC51=HAgent_UI.exe|PRC
13/5/2019 13:40:14 52=tvnserver.exe|PRC53=RAVCpl64.exe|PRC54=concentr.exe|
PRC55=redirector.exe|PRC56=PNUSBCLITRAY.exe|PRC57=PNTray.exe|PRC58=Receiv
13/5/2019 13:40:14 er.exe|PRC59=SelfServicePlugin.exe|PRC60=wfcrun32.exe|||
PMIU=33|TBPM=7786256|FBPM=5172716|TBPF=7786256|FBPF=5104160|TBVM=8589934
13/5/2019 13:40:14 464|FKVM=8589864352|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28.1.79|
NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=
13/5/2019 13:40:14 008064FB707A|RECP0=975|SENDP0=598|MIBSP0=1000üMbps||
NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwor
13/5/2019 13:40:14 k)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||
NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü726
13/5/2019 13:40:14 0|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|
QFEL=KB2727528,KB2729462,KB2737084,KB2753842,KB2756872,KB2757638,KB276146
13/5/2019 13:40:14
B2780541,KB2781197,KB2785094,KB2785220,KB2789
13/5/2019 13:40:14
,KB2798162,KB2798802,KB2798804,KB2798805,KB27
13/5/2019 13:40:14
35,KB2809289,KB2811660,KB2812822,KB2813170,KB
13/5/2019 13:40:14
9361,KB2829530,KB2830290,KB2832450,KB2836946,
13/5/2019 13:40:14 KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|
AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=Mozilla�
13/5/2019 13:40:14 �Firefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|
61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|AP3=Microsoft
13/5/2019 13:40:14 üLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|
15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\Program�
13/5/2019 13:40:14 �Files\MicrosoftüOffice\|15.0.4420.1017|
AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.41
13/5/2019 13:40:14 48|AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilver
13/5/2019 13:40:14 light\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|C:\ProgramüFiles
13/5/2019 13:40:14 \Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|AP11=Google�
13/5/2019 13:40:14 �Chrome|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\O
13/5/2019 13:40:14 ffice15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=Diagnost
13/5/2019 13:40:14 icsüutilityüforüInternetüExplorer|
AP15=OfficeüXMLüHandl
13/5/2019 13:40:14 er|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:\PROGRA~1
13/5/2019 13:40:14 \MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=UnifiedüWrit
13/5/2019 13:40:14 eüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|
2.0.127.0|AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.
13/5/2019 13:40:14 exe|6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=Mi
13/5/2019 13:40:14 crosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|
Client->Server: Sending full Check-in[V01]
13/5/2019 13:40:14 Found HS Tag
ProcessMsg!
13/5/2019 13:40:14 Server Sent 5
13/5/2019 13:40:14 Enhanced QU : QUM :
13/5/2019 13:40:14 Enhanced QU : QUC :
13/5/2019 13:40:14 Enhanced QU : QUD :
13/5/2019 13:40:14 Server Sent 6
13/5/2019 13:40:14 LOOKING FOR &04
13/5/2019 13:40:14 FUR :After S&P done
GetServerAddress
securePort: 443
13/5/2019 14:41:21 GetIP :: *** PPP
1325472778
13/5/2019 14:41:21 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
13/5/2019 14:41:21 SETTING REG TO VALUE ��/
reported: 28
13/5/2019 14:41:21 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 14:41:21 Pipe not found
13/5/2019 14:41:21 The count is 7
13/5/2019 14:41:21 bCheckServer is 1
13/5/2019 14:41:21 bSet is 1
securePort: 443
13/5/2019 14:41:22 Value found for LocalXMLPath = 0#)
13/5/2019 14:41:22 WDAVersion = 12.1.1.25
13/5/2019 14:41:22 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 14:41:23 -1|VI=1|
13/5/2019 14:41:23 Found HS Tag
ProcessMsg!
13/5/2019 14:41:23 Server Sent 5
13/5/2019 14:41:23 Enhanced QU : QUM :
13/5/2019 14:41:23 Enhanced QU : QUC :
13/5/2019 14:41:23 Enhanced QU : QUD :
13/5/2019 14:41:23 Server Sent 6
13/5/2019 14:41:23 LOOKING FOR &04
GetServerAddress
securePort: 443
13/5/2019 15:41:53 GetIP :: *** PPP
1325472778
13/5/2019 15:41:53 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
13/5/2019 15:41:53 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 15:41:53 Pipe not found
13/5/2019 15:41:53 The count is 7
13/5/2019 15:41:53 bCheckServer is 1
13/5/2019 15:41:53 bSet is 1
securePort: 443
13/5/2019 15:41:53 Value found for LocalXMLPath = @--
13/5/2019 15:41:53 WDAVersion = 12.1.1.25
13/5/2019 15:41:54 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 15:41:54 -1|VI=1|
13/5/2019 15:41:55 Found HS Tag
ProcessMsg!
13/5/2019 15:41:55 Server Sent 5
13/5/2019 15:41:55 Enhanced QU : QUM :
13/5/2019 15:41:55 Enhanced QU : QUC :
13/5/2019 15:41:55 Enhanced QU : QUD :
13/5/2019 15:41:55 Server Sent 6
13/5/2019 15:41:55 LOOKING FOR &04
13/5/2019 16:22:36 Received data: o.
Accept: */*
13/5/2019 16:22:36 jects/mechanize/)
Connection: close
13/5/2019 16:22:36 =0.7,*;q=0.7

Accept: */*
Connection: close
13/5/2019 16:22:36 9-1,utf-8;q=0.7,*;q=0.7
refresh settings!
GetServerAddress
securePort: 443
13/5/2019 16:22:36 GetIP :: *** PPP
1325472778
13/5/2019 16:22:36 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
13/5/2019 16:22:36 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 16:22:37 Pipe not found
13/5/2019 16:22:37 The count is 7
13/5/2019 16:22:37 bCheckServer is 1
13/5/2019 16:22:37 bSet is 1
securePort: 443
13/5/2019 16:22:37 Calling V01
13/5/2019 16:22:37 Merlin version 354
13/5/2019 16:22:37 Signature 354
13/5/2019 16:22:37 Wyse Flag value 0011
13/5/2019 16:22:38 The iBLP value -1
13/5/2019 16:22:39 TZ Queried
Number
13/5/2019 16:22:39 FUR : GetCI() 1
13/5/2019 16:22:39 IP matched!
13/5/2019 16:22:39 Subnet #�)
13/5/2019 16:22:39 Gateway �)
13/5/2019 16:22:39 DS #�)
83FF-9A7F0B2B2
13/5/2019 16:22:39 E1E}
13/5/2019 16:22:39 Got reply from AgentUI=`#1
13/5/2019 16:22:39 add only adapter.
13/5/2019 16:22:39 GetDisplayInfo() return=��3
13/5/2019 16:22:39 Disk offset 659554304
13/5/2019 16:22:39 Disk 0 Part 1 TYPE 260

13/5/2019 16:22:39 Disk 0 Part 5 TYPE 261

13/5/2019 16:22:39 Secure boot = 1

13/5/2019 16:22:39 tempbuff = |WIN0=TRUEorFALSE S.C.A - Excel|WIN1=civil shoes
- Excel|WIN2=Chayanne - Y T� Te Vas (Video Oficial) - YouTube - Goo
13/5/2019 16:22:39 gle Chrome|WIN3=Contabilidad|WIN4=Program Manager|, num=0
13/5/2019 16:22:39 Msg recd from AgentGUI:|WIN0=TRUEorFALSE S.C.A - Excel|
WIN1=civil shoes - Excel|WIN2=Chayanne - Y T� Te Vas (Video Oficial) - Y
13/5/2019 16:22:39 ouTube - Google Chrome|WIN3=Contabilidad|WIN4=Program
Manager|
13/5/2019 16:22:39 Got reply from AgentUI=�.
13/5/2019 16:22:39 return from ListAllApps= �0
13/5/2019 16:22:45 size of qfe list 64
13/5/2019 16:22:45 Value found for LocalXMLPath = ,0
13/5/2019 16:22:45 WDAVersion = 12.1.1.25
13/5/2019 16:22:45 GetCI() done
13/5/2019 16:22:45 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
D0PAR5SZ=30708596
UEFISEC=1|DRV0=C:|TB0=30708592640|TFB0=16146702336|DRV1=D:|TB1=8034717696|
13/5/2019 16:22:45 TFB1=7999098880|DRV2=Z:|TB2=1073643520|TFB2=1071677440||
PRC0=smss.exe|PRC1=csrss.exe|PRC2=wininit.exe|PRC3=csrss.exe|PRC4=servic
13/5/2019 16:22:45 es.exe|PRC5=winlogon.exe|PRC6=lsass.exe|PRC7=svchost.exe|
PRC8=svchost.exe|PRC9=atiesrxx.exe|PRC10=svchost.exe|PRC11=svchost.exe|
13/5/2019 16:22:45 PRC12=dwm.exe|PRC13=svchost.exe|PRC14=svchost.exe|
PRC15=svchost.exe|PRC16=atieclxx.exe|PRC17=DtcPlatformSvc.exe|PRC18=Explorer.E
13/5/2019 16:22:45 XE|PRC19=spoolsv.exe|PRC20=svchost.exe|PRC21=taskhostex.exe|
PRC22=svchost.exe|PRC23=svchost.exe|PRC24=mqsvc.exe|PRC25=NetXClean.
13/5/2019 16:22:45 exe|PRC26=pnusbvirtualhubwssrv.exe|PRC27=tcpsvcs.exe|
PRC28=snmp.exe|PRC29=tvnserver.exe|PRC30=UWFSvc.exe|PRC31=MsMpEng.exe|PRC32
13/5/2019 16:22:45 =wsnm.exe|PRC33=DtcWDAService.exe|PRC34=mqtgsvc.exe|
PRC35=vmware-usbarbitrator64.exe|PRC36=vmware-view-usbd.exe|PRC37=svchost.ex
13/5/2019 16:22:45 e|PRC38=wmiprvse.exe|PRC39=SearchIndexer.exe|
PRC40=DtcWdaUi.exe|PRC41=hagent.exe|PRC42=HAgent_UI.exe|PRC43=tvnserver.exe|PRC44=R
13/5/2019 16:22:45 AVCpl64.exe|PRC45=concentr.exe|PRC46=redirector.exe|
PRC47=PNUSBCLITRAY.exe|PRC48=PNTray.exe|PRC49=Receiver.exe|PRC50=SelfService
13/5/2019 16:22:45 Plugin.exe|PRC51=wfcrun32.exe|PRC52=CcmExec.exe|
PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|PRC55=EXCEL.EXE|PRC56=chrome.exe|PRC57=chr
PRC61=chrome.exe|PRC62=chrome.exe|PRC63=chrome.exe|PRC64=wmiprvse.exe
13/5/2019 16:22:45 ||WIN0=TRUEorFALSEüüS.C.Aü-üExcel|WIN1=civilüshoesü-üExcel|
WIN2=Chayanneü-üYüT�üTeüVasü(VideoüOficial)ü-üYouTube
13/5/2019 16:22:45 ü-üGoogleüChrome|WIN3=Contabilidad|WIN4=ProgramüManager||
13/5/2019 16:22:45 89934464|FKVM=8589865384|FKEM=0|CPRMS0=62,16,25|
NIC0IP=10.28.1.79|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
13/5/2019 16:22:45 NIC0MAC=008064FB707A|RECP0=293952|SENDP0=93785|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(Personal�
13/5/2019 16:22:45 �AreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWir
13/5/2019 16:22:45 eless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|
MIBSP2=0üMbps|QFEL=KB2727528,KB2729462,KB2737084,KB2753842,KB2756872,KB275
13/5/2019 16:22:45
2,KB2779768,KB2780541,KB2781197,KB2785094,KB2
13/5/2019 16:22:45
599,KB2795944,KB2798162,KB2798802,KB2798804,K
13/5/2019 16:22:45
08679,KB2808735,KB2809289,KB2811660,KB2812822
13/5/2019 16:22:45
2829254,KB2829361,KB2829530,KB2830290,KB28324
13/5/2019 16:22:45
50,KB2836946,KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05
13/5/2019 16:22:45 |AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
13/5/2019 16:22:45 AP3=MicrosoftüLyncüVdiü2013|
AP4=MicrosoftüOfficeüProfessionalüPlusü201
13/5/2019 16:22:45 3|C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|
AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148|
13/5/2019 16:22:45 |9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\Micr
13/5/2019 16:22:45 osoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|C:\P
13/5/2019 16:22:45 rogramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Client\|
5.4.0.1219906
13/5/2019 16:22:45 |AP11=GoogleüChrome|
AP12=MicrosoftüExcel|C:\PROGRA
13/5/2019 16:22:45 ~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
13/5/2019 16:22:45 AP14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=Offic
13/5/2019 16:22:45 eüXMLüHandler|
15.0.4420.1017|AP16=MicrosoftüPowerPoin
13/5/2019 16:22:45 t|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|
AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=
13/5/2019 16:22:45 UnifiedüWriteüFilterüManagerüManager|
C:\ProgramüFiles\Windo
13/5/2019 16:22:45 wsüMail\wab.exe|6.2.9200.16384|
6.2.9200.
13/5/2019 16:22:45 16384|AP21=MicrosoftüWord|
WCMSupp=1|WCMJSONSupp=1
13/5/2019 16:22:45 |
13/5/2019 16:22:45 Found HS Tag
ProcessMsg!
13/5/2019 16:22:45 Server Sent 5
13/5/2019 16:22:45 Enhanced QU : QUM :
13/5/2019 16:22:45 Enhanced QU : QUC :
13/5/2019 16:22:45 Enhanced QU : QUD :
13/5/2019 16:22:45 Server Sent 6
13/5/2019 16:22:45 LOOKING FOR &04
13/5/2019 16:22:45 FUR :After S&P done
GetServerAddress
securePort: 443
13/5/2019 17:23:14 GetIP :: *** PPP
1325472778
13/5/2019 17:23:14 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
13/5/2019 17:23:14 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 17:23:14 Pipe not found
13/5/2019 17:23:14 The count is 7
13/5/2019 17:23:14 bCheckServer is 1
13/5/2019 17:23:14 bSet is 1
securePort: 443
13/5/2019 17:23:15 WDAVersion = 12.1.1.25
13/5/2019 17:23:15 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 17:23:16 1|VI=1|
13/5/2019 17:23:16 Found HS Tag
ProcessMsg!
13/5/2019 17:23:16 Server Sent 5
13/5/2019 17:23:16 Enhanced QU : QUM :
13/5/2019 17:23:16 Enhanced QU : QUC :
13/5/2019 17:23:16 Enhanced QU : QUD :
13/5/2019 17:23:16 Server Sent 6
13/5/2019 17:23:16 LOOKING FOR &04
GetServerAddress
securePort: 443
13/5/2019 18:23:46 GetIP :: *** PPP
1325472778
13/5/2019 18:23:46 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
13/5/2019 18:23:46 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 18:23:46 Pipe not found
13/5/2019 18:23:46 The count is 7
13/5/2019 18:23:46 bCheckServer is 1
13/5/2019 18:23:46 bSet is 1
securePort: 443
13/5/2019 18:23:46 WDAVersion = 12.1.1.25
13/5/2019 18:23:47 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 18:23:47 1|VI=1|
13/5/2019 18:23:47 Found HS Tag
ProcessMsg!
13/5/2019 18:23:47 Server Sent 5
13/5/2019 18:23:47 Enhanced QU : QUM :
13/5/2019 18:23:47 Enhanced QU : QUC :
13/5/2019 18:23:47 Enhanced QU : QUD :
13/5/2019 18:23:47 Server Sent 6
13/5/2019 18:23:47 LOOKING FOR &04
GetServerAddress
securePort: 443
13/5/2019 19:24:16 GetIP :: *** PPP
1325472778
13/5/2019 19:24:16 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
13/5/2019 19:24:16 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 19:24:16 Pipe not found
13/5/2019 19:24:16 The count is 7
13/5/2019 19:24:16 bCheckServer is 1
13/5/2019 19:24:16 bSet is 1
securePort: 443
13/5/2019 19:24:16 WDAVersion = 12.1.1.25
13/5/2019 19:24:17 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 19:24:18 1|VI=1|
13/5/2019 19:24:18 Found HS Tag
ProcessMsg!
13/5/2019 19:24:18 Server Sent 5
13/5/2019 19:24:18 Enhanced QU : QUM :
13/5/2019 19:24:18 Enhanced QU : QUC :
13/5/2019 19:24:18 Enhanced QU : QUD :
13/5/2019 19:24:18 Server Sent 6
13/5/2019 19:24:18 LOOKING FOR &04
13/5/2019 20:22:56 Received data: o.
Accept: */*
13/5/2019 20:22:56 jects/mechanize/)
Connection: close
13/5/2019 20:22:56 =0.7,*;q=0.7

Accept: */*
Connection: close
13/5/2019 20:22:56 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
13/5/2019 20:22:56 GetIP :: *** PPP
1325472778
13/5/2019 20:22:56 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
13/5/2019 20:22:56 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 20:22:56 Pipe not found
13/5/2019 20:22:56 The count is 7
13/5/2019 20:22:56 bCheckServer is 1
13/5/2019 20:22:56 bSet is 1
securePort: 443
13/5/2019 20:22:57 Calling V01
13/5/2019 20:22:57 Merlin version 354
13/5/2019 20:22:57 Signature 354
13/5/2019 20:22:57 Wyse Flag value 0011
13/5/2019 20:22:58 The iBLP value -1
13/5/2019 20:22:58 TZ Queried
Number
13/5/2019 20:22:58 FUR : GetCI() 1
13/5/2019 20:22:58 IP matched!
13/5/2019 20:22:58 Subnet #�)
13/5/2019 20:22:58 Gateway �)
13/5/2019 20:22:59 DS #�)
13/5/2019 20:22:59 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=#3-
13/5/2019 20:22:59 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=#3-
13/5/2019 20:22:59 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=#3-
83FF-9A7F0B2B2
13/5/2019 20:22:59 E1E}
13/5/2019 20:22:59 Got reply from AgentUI=0�4
13/5/2019 20:22:59 add only adapter.
13/5/2019 20:22:59 Disk offset 659554304
13/5/2019 20:22:59 Disk 0 Part 1 TYPE 260

13/5/2019 20:22:59 Disk 0 Part 5 TYPE 261

13/5/2019 20:22:59 Secure boot = 1

13/5/2019 20:22:59 Got reply from AgentUI=# 6
13/5/2019 20:23:4 size of qfe list 64
13/5/2019 20:23:4 WDAVersion = 12.1.1.25
13/5/2019 20:23:4 GetCI() done
13/5/2019 20:23:4 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
PRC10=svchost.exe|PRC11=svchost.exe|PRC12=dwm.exe|PRC13=svchost.exe|PRC14=s
PRC17=DtcPlatformSvc.exe|PRC18=Explorer.EXE|PRC19=spoolsv.exe|PRC20=svchost.exe|
PRC49=Receiver.exe|PRC50=SelfServicePlugin.exe|PRC51=wfcrun32.exe|PRC52=Ccm
13/5/2019 20:23:4 Exec.exe|PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|
PRC55=taskhostex.exe|PRC56=taskhost.exe|PRC57=TrustedInstaller.exe|PRC58=TiWorker
13/5/2019 20:23:4 .exe|PRC59=wmiprvse.exe||WIN0=ProgramüManager||PMIU=37|
TBPM=7786256|FBPM=4878972|TBPF=7786256|FBPF=4799436|TBVM=8589934464|FKVM
13/5/2019 20:23:4 =8589865384|FKEM=0|CPRMS0=81,13,25|NIC0IP=10.28.1.79|
NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=00806
NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwo
13/5/2019 20:23:4 rk)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||
13/5/2019 20:23:4
KB2780541,KB2781197,KB2785094,KB2785220,KB278
13/5/2019 20:23:4
4,KB2798162,KB2798802,KB2798804,KB2798805,KB2
13/5/2019 20:23:4
735,KB2809289,KB2811660,KB2812822,KB2813170,K
13/5/2019 20:23:4
29361,KB2829530,KB2830290,KB2832450,KB2836946
13/5/2019 20:23:4 ,KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|
AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=Mozilla
13/5/2019 20:23:4 üFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|
61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|AP3=Microsof
13/5/2019 20:23:4 tüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|
15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\Program
13/5/2019 20:23:4 üFiles\MicrosoftüOffice\|15.0.4420.1017|
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilve
13/5/2019 20:23:4 rlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|C:\ProgramüFile
13/5/2019 20:23:4 s\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|AP11=Google
13/5/2019 20:23:4 üChrome|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\
13/5/2019 20:23:4 Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=Diagnos
13/5/2019 20:23:4 ticsüutilityüforüInternetüExplorer|
AP15=OfficeüXMLüHand
13/5/2019 20:23:4 ler|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:\PROGRA~
13/5/2019 20:23:4 1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=UnifiedüWri
13/5/2019 20:23:4 teüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|
2.0.127.0|AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab
13/5/2019 20:23:4 .exe|6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=M
13/5/2019 20:23:4 icrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|
13/5/2019 20:23:5 Found HS Tag
ProcessMsg!
then clear it here
13/5/2019 20:23:5 Server Sent 5
13/5/2019 20:23:5 Enhanced QU : QUM :
13/5/2019 20:23:5 Enhanced QU : QUC :
13/5/2019 20:23:5 Enhanced QU : QUD :
13/5/2019 20:23:5 Server Sent 6
13/5/2019 20:23:5 LOOKING FOR &04
13/5/2019 20:23:5 FUR :After S&P done
GetServerAddress
securePort: 443
13/5/2019 21:26:37 GetIP :: *** PPP
1325472778
13/5/2019 21:26:37 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
13/5/2019 21:26:37 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 21:26:37 Pipe not found
13/5/2019 21:26:37 The count is 7
13/5/2019 21:26:37 bCheckServer is 1
13/5/2019 21:26:37 bSet is 1
securePort: 443
13/5/2019 21:26:37 WDAVersion = 12.1.1.25
13/5/2019 21:26:37 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 21:26:38 1|VI=1|
13/5/2019 21:26:38 Found HS Tag
ProcessMsg!
13/5/2019 21:26:38 Server Sent 5
13/5/2019 21:26:38 Enhanced QU : QUM :
13/5/2019 21:26:38 Enhanced QU : QUC :
13/5/2019 21:26:38 Enhanced QU : QUD :
13/5/2019 21:26:38 Server Sent 6
13/5/2019 21:26:38 LOOKING FOR &04
GetServerAddress
securePort: 443
13/5/2019 22:29:58 GetIP :: *** PPP
1325472778
13/5/2019 22:29:58 ip RETRIVED #�/
10.20.15.151, SecurePort: 443
13/5/2019 22:29:58 SETTING REG TO VALUE #�/
reported: 28
13/5/2019 22:29:59 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 22:29:59 Pipe not found
13/5/2019 22:29:59 The count is 7
13/5/2019 22:29:59 bCheckServer is 1
13/5/2019 22:29:59 bSet is 1
securePort: 443
13/5/2019 22:29:59 WDAVersion = 12.1.1.25
13/5/2019 22:29:59 The iBLP value -1
13/5/2019 22:30:0 1|VI=1|
13/5/2019 22:30:0 Found HS Tag
ProcessMsg!
then clear it here
13/5/2019 22:30:0 Server Sent 5
13/5/2019 22:30:0 Enhanced QU : QUM :
13/5/2019 22:30:0 Enhanced QU : QUC :
13/5/2019 22:30:0 Enhanced QU : QUD :
13/5/2019 22:30:0 Server Sent 6
13/5/2019 22:30:0 LOOKING FOR &04
GetServerAddress
securePort: 443
13/5/2019 23:33:21 GetIP :: *** PPP
1325472778
13/5/2019 23:33:21 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
13/5/2019 23:33:21 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 23:33:21 Pipe not found
13/5/2019 23:33:21 The count is 7
13/5/2019 23:33:21 bCheckServer is 1
13/5/2019 23:33:21 bSet is 1
securePort: 443
13/5/2019 23:33:21 Value found for LocalXMLPath = а0
13/5/2019 23:33:21 WDAVersion = 12.1.1.25
13/5/2019 23:33:22 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
13/5/2019 23:33:22 1|VI=1|
13/5/2019 23:33:22 Found HS Tag
ProcessMsg!
13/5/2019 23:33:23 Server Sent 5
13/5/2019 23:33:23 Enhanced QU : QUM :
13/5/2019 23:33:23 Enhanced QU : QUC :
13/5/2019 23:33:23 Enhanced QU : QUD :
13/5/2019 23:33:23 Server Sent 6
13/5/2019 23:33:23 LOOKING FOR &04
14/5/2019 0:21:10 Received data: o.
Accept: */*
Connection: close
14/5/2019 0:21:11 =0.7,*;q=0.7

Accept: */*
Connection: close
14/5/2019 0:21:11 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
14/5/2019 0:21:11 GetIP :: *** PPP
1325472778
14/5/2019 0:21:11 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
14/5/2019 0:21:11 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 0:21:12 Pipe not found
14/5/2019 0:21:12 The count is 7
14/5/2019 0:21:12 bSet is 1
securePort: 443
14/5/2019 0:21:12 Calling V01
14/5/2019 0:21:12 Merlin version 354
14/5/2019 0:21:12 Signature 354
14/5/2019 0:21:12 Wyse Flag value 0011
14/5/2019 0:21:13 The iBLP value -1
14/5/2019 0:21:13 TZ Queried
Number
14/5/2019 0:21:13 FUR : GetCI() 1
14/5/2019 0:21:13 IP matched!
14/5/2019 0:21:14 Subnet #�)
14/5/2019 0:21:14 Gateway �)
14/5/2019 0:21:14 DS #�)
14/5/2019 0:21:14 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=04-
14/5/2019 0:21:14 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=04-
14/5/2019 0:21:14 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=04-
83FF-9A7F0B2B2
14/5/2019 0:21:14 E1E}
14/5/2019 0:21:14 Disk offset 659554304
14/5/2019 0:21:14 Disk 0 Part 1 TYPE 260

14/5/2019 0:21:14 Disk 0 Part 5 TYPE 261

14/5/2019 0:21:14 Secure boot = 1

14/5/2019 0:21:14 Got reply from AgentUI= #6
14/5/2019 0:21:14 return from ListAllApps=
14/5/2019 0:21:19 size of qfe list 64
14/5/2019 0:21:19 Value found for LocalXMLPath = P�0
14/5/2019 0:21:19 WDAVersion = 12.1.1.25
14/5/2019 0:21:19 GetCI() done
14/5/2019 0:21:19 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
PRC55=taskhostex.exe|PRC56=wmiprvse.exe||WIN0=ProgramüManager||PMIU=36|TBPM=7786
14/5/2019 0:21:19 256|FBPM=4963288|TBPF=7786256|FBPF=4887660|TBVM=8589934464|
FKVM=8589865384|FKEM=0|CPRMS0=99,18,25|NIC0IP=10.28.1.79|NIC0DESC=Eth
14/5/2019 0:21:19 ernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=313009|SENDP0=102408|MIBSP0=1000üMbps||NIC1IP=0.0.
14/5/2019 0:21:19 0.0|
RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=
14/5/2019 0:21:19 0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
14/5/2019 0:21:19
66,KB2770917,KB2777294,KB2778344,KB2778930,KB
14/5/2019 0:21:19
0655,KB2790907,KB2792100,KB2793210,KB2794119,
14/5/2019 0:21:19
804583,KB2804584,KB2805222,KB2805227,KB280798
14/5/2019 0:21:19
B2818604,KB2820330,KB2821895,KB2822241,KB2829
14/5/2019 0:21:19
,KB2838727,KB2839894,KB2845533,KB2845690,|AP0
14/5/2019 0:21:19 =7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefo
14/5/2019 0:21:19 x|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.
14/5/2019 0:21:19 1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualü
14/5/2019 0:21:19 C++ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|
14/5/2019 0:21:19 ||AP7=MicrosoftüSilverlight|
+ü2005üRedistribut
14/5/2019 0:21:19 ableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\Progr
14/5/2019 0:21:19 amüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrom
14/5/2019 0:21:19 e.exe|68.0.3440.106|AP12=MicrosoftüExcel|
basedüwriteüfilter�
14/5/2019 0:21:19 �manager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\Internet
14/5/2019 0:21:19 üExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MS
14/5/2019 0:21:19 OXMLED.EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|C:\
14/5/2019 0:21:19 ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.1
14/5/2019 0:21:19 27.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C
14/5/2019 0:21:19 :\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.442
14/5/2019 0:21:19 0.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
14/5/2019 0:21:19 Found HS Tag
ProcessMsg!
then clear it here
14/5/2019 0:21:20 Server Sent 5
14/5/2019 0:21:20 Enhanced QU : QUM :
14/5/2019 0:21:20 Enhanced QU : QUC :
14/5/2019 0:21:20 Enhanced QU : QUD :
14/5/2019 0:21:20 Server Sent 6
14/5/2019 0:21:20 LOOKING FOR &04
14/5/2019 0:21:20 FUR :After S&P done
GetServerAddress
securePort: 443
14/5/2019 1:24:39 GetIP :: *** PPP
1325472778
14/5/2019 1:24:39 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
14/5/2019 1:24:39 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 1:24:40 Pipe not found
14/5/2019 1:24:40 The count is 7
14/5/2019 1:24:40 bSet is 1
securePort: 443
14/5/2019 1:24:40 WDAVersion = 12.1.1.25
14/5/2019 1:24:40 The iBLP value -1
14/5/2019 1:24:41 1|VI=1|
14/5/2019 1:24:41 Found HS Tag
ProcessMsg!
then clear it here
14/5/2019 1:24:41 Server Sent 5
14/5/2019 1:24:41 Enhanced QU : QUM :
14/5/2019 1:24:41 Enhanced QU : QUC :
14/5/2019 1:24:41 Enhanced QU : QUD :
14/5/2019 1:24:41 Server Sent 6
14/5/2019 1:24:41 LOOKING FOR &04
GetServerAddress
443
14/5/2019 2:28:2 GetIP :: *** PPP
1325472778
14/5/2019 2:28:2 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
14/5/2019 2:28:2 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 2:28:2 Pipe not found
14/5/2019 2:28:2 The count is 7
14/5/2019 2:28:2 bSet is 1
securePort: 443
14/5/2019 2:28:2 Value found for LocalXMLPath = �0
14/5/2019 2:28:2 WDAVersion = 12.1.1.25
14/5/2019 2:28:3 The iBLP value -1
14/5/2019 2:28:4 1|VI=1|
14/5/2019 2:28:4 Found HS Tag
then clear it here
14/5/2019 2:28:4 Server Sent 5
14/5/2019 2:28:4 Enhanced QU : QUM :
14/5/2019 2:28:4 Enhanced QU : QUC :
14/5/2019 2:28:4 Enhanced QU : QUD :
14/5/2019 2:28:4 Server Sent 6
14/5/2019 2:28:4 LOOKING FOR &04
GetServerAddress
securePort: 443
14/5/2019 3:31:26 GetIP :: *** PPP
1325472778
14/5/2019 3:31:26 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
14/5/2019 3:31:26 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 3:31:27 Pipe not found
14/5/2019 3:31:27 The count is 7
14/5/2019 3:31:27 bSet is 1
securePort: 443
14/5/2019 3:31:27 WDAVersion = 12.1.1.25
14/5/2019 3:31:28 The iBLP value -1
14/5/2019 3:31:28 1|VI=1|
14/5/2019 3:31:28 Found HS Tag
ProcessMsg!
then clear it here
14/5/2019 3:31:28 Server Sent 5
14/5/2019 3:31:28 Enhanced QU : QUM :
14/5/2019 3:31:28 Enhanced QU : QUC :
14/5/2019 3:31:28 Enhanced QU : QUD :
14/5/2019 3:31:28 Server Sent 6
14/5/2019 3:31:28 LOOKING FOR &04
GetServerAddress
securePort: 443
14/5/2019 4:34:49 GetIP :: *** PPP
1325472778
14/5/2019 4:34:49 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
14/5/2019 4:34:49 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 4:34:49 Pipe not found
14/5/2019 4:34:49 The count is 7
14/5/2019 4:34:49 bSet is 1
securePort: 443
14/5/2019 4:34:49 Value found for LocalXMLPath = @e,
14/5/2019 4:34:49 WDAVersion = 12.1.1.25
14/5/2019 4:34:50 The iBLP value -1
14/5/2019 4:34:51 1|VI=1|
14/5/2019 4:34:51 Found HS Tag
ProcessMsg!
then clear it here
14/5/2019 4:34:51 Server Sent 5
14/5/2019 4:34:51 Enhanced QU : QUM :
14/5/2019 4:34:51 Enhanced QU : QUC :
14/5/2019 4:34:51 Enhanced QU : QUD :
14/5/2019 4:34:51 Server Sent 6
14/5/2019 4:34:51 LOOKING FOR &04
GetServerAddress
securePort: 443
14/5/2019 5:38:11 GetIP :: *** PPP
1325472778
14/5/2019 5:38:11 ip RETRIVED p�/
10.20.15.151, SecurePort: 443
14/5/2019 5:38:12 SETTING REG TO VALUE p�/
reported: 28
14/5/2019 5:38:12 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 5:38:12 Pipe not found
14/5/2019 5:38:12 The count is 7
14/5/2019 5:38:12 bSet is 1
securePort: 443
14/5/2019 5:38:12 Value found for LocalXMLPath = �@,
14/5/2019 5:38:12 WDAVersion = 12.1.1.25
14/5/2019 5:38:12 The iBLP value -1
14/5/2019 5:38:13 1|VI=1|
14/5/2019 5:38:13 Found HS Tag
ProcessMsg!
then clear it here
14/5/2019 5:38:13 Server Sent 5
14/5/2019 5:38:13 Enhanced QU : QUM :
14/5/2019 5:38:13 Enhanced QU : QUC :
14/5/2019 5:38:13 Enhanced QU : QUD :
14/5/2019 5:38:13 Server Sent 6
14/5/2019 5:38:13 LOOKING FOR &04
GetServerAddress
securePort: 443
14/5/2019 6:41:31 GetIP :: *** PPP
1325472778
14/5/2019 6:41:31 ip RETRIVED P�/
10.20.15.151, SecurePort: 443
14/5/2019 6:41:31 SETTING REG TO VALUE P�/
reported: 28
14/5/2019 6:41:31 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 6:41:31 Pipe not found
14/5/2019 6:41:31 The count is 7
14/5/2019 6:41:31 bSet is 1
securePort: 443
14/5/2019 6:41:31 Value found for LocalXMLPath = ],
14/5/2019 6:41:31 WDAVersion = 12.1.1.25
14/5/2019 6:41:32 The iBLP value -1
14/5/2019 6:41:32 1|VI=1|
14/5/2019 6:41:32 Found HS Tag
ProcessMsg!
then clear it here
14/5/2019 6:41:32 Server Sent 5
14/5/2019 6:41:32 Enhanced QU : QUM :
14/5/2019 6:41:32 Enhanced QU : QUC :
14/5/2019 6:41:32 Enhanced QU : QUD :
14/5/2019 6:41:32 Server Sent 6
14/5/2019 6:41:32 LOOKING FOR &04
GetServerAddress
securePort: 443
14/5/2019 7:44:47 GetIP :: *** PPP
1325472778
14/5/2019 7:44:47 ip RETRIVED P�/
10.20.15.151, SecurePort: 443
reported: 28
14/5/2019 7:44:47 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 7:44:47 Pipe not found
14/5/2019 7:44:47 The count is 7
14/5/2019 7:44:47 bSet is 1
securePort: 443
14/5/2019 7:44:48 Value found for LocalXMLPath = �P,
14/5/2019 7:44:48 WDAVersion = 12.1.1.25
14/5/2019 7:44:48 The iBLP value -1
14/5/2019 7:44:49 1|VI=1|
14/5/2019 7:44:49 Found HS Tag
ProcessMsg!
then clear it here
14/5/2019 7:44:49 Server Sent 5
14/5/2019 7:44:49 Enhanced QU : QUM :
14/5/2019 7:44:49 Enhanced QU : QUC :
14/5/2019 7:44:49 Enhanced QU : QUD :
14/5/2019 7:44:49 Server Sent 6
14/5/2019 7:44:49 LOOKING FOR &04
14/5/2019 8:26:52 Received data: o.
Accept: */*
Connection: close
14/5/2019 8:26:52 =0.7,*;q=0.7

Accept: */*
Connection: close
14/5/2019 8:26:52 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
14/5/2019 8:26:53 GetIP :: *** PPP
1325472778
14/5/2019 8:26:53 ip RETRIVED P�/
10.20.15.151, SecurePort: 443
reported: 28
14/5/2019 8:26:53 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 8:26:53 Pipe not found
14/5/2019 8:26:53 The count is 7
14/5/2019 8:26:53 bSet is 1
securePort: 443
14/5/2019 8:26:53 Calling V01
14/5/2019 8:26:53 Merlin version 354
14/5/2019 8:26:53 Signature 354
14/5/2019 8:26:53 Wyse Flag value 0011
14/5/2019 8:26:54 The iBLP value -1
14/5/2019 8:26:54 TZ Queried
Number
14/5/2019 8:26:54 FUR : GetCI() 1
14/5/2019 8:26:54 IP matched!
14/5/2019 8:26:54 Subnet #�)
14/5/2019 8:26:54 Gateway �)
14/5/2019 8:26:54 DS #�)
14/5/2019 8:26:54 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=P8-
14/5/2019 8:26:54 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=P8-
14/5/2019 8:26:54 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=P8-
83FF-9A7F0B2B2
14/5/2019 8:26:54 E1E}
14/5/2019 8:26:54 Disk offset 659554304
14/5/2019 8:26:54 Disk 0 Part 1 TYPE 260

14/5/2019 8:26:54 Disk 0 Part 5 TYPE 261
14/5/2019 8:26:54 Secure boot = 1

14/5/2019 8:26:55 tempbuff = |WIN0=Luna Nahomby Preciado Quiroga - Google
Chrome|WIN1=Nueva pesta�a - Google Chrome|WIN2=Program Manager|, num=0
14/5/2019 8:26:55 Msg recd from AgentGUI:|WIN0=Luna Nahomby Preciado Quiroga -
Google Chrome|WIN1=Nueva pesta�a - Google Chrome|WIN2=Program Manag
14/5/2019 8:26:55 er|
14/5/2019 8:26:55 Got reply from AgentUI=`X5
14/5/2019 8:26:55 return from ListAllApps=@96
14/5/2019 8:27:0 size of qfe list 64
14/5/2019 8:27:1 Value found for LocalXMLPath = @e,
14/5/2019 8:27:1 WDAVersion = 12.1.1.25
14/5/2019 8:27:1 GetCI() done
14/5/2019 8:27:1 GetCI() 2 done
CN=WES008064FB707A|IP=10.28.1.79|ED=1|DS=10.28.24.2|GW=10.28.0.1|
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
14/5/2019 8:27:1 TFB1=1062666240||PRC0=smss.exe|PRC1=csrss.exe|PRC2=wininit.exe|
PRC3=csrss.exe|PRC4=services.exe|PRC5=winlogon.exe|PRC6=lsass.exe
PRC55=chrome.exe|PRC56=chrome.exe|PRC57=chrome.exe|PRC58=chrome.exe|PRC59=chrome.
14/5/2019 8:27:1 exe|PRC60=chrome.exe|PRC61=chrome.exe|PRC62=chrome.exe|
PRC63=chrome.exe|PRC64=chrome.exe|PRC65=wmiprvse.exe|PRC66=taskeng.exe|PR
14/5/2019 8:27:1 C67=chrome.exe|PRC68=chrome.exe|PRC69=chrome.exe|
PRC70=chrome.exe||WIN0=LunaüNahombyüPreciadoüQuirogaü-üGoogleüChrome|WIN1
14/5/2019 8:27:1 =Nuevaüpesta�aü-üGoogleüChrome|WIN2=ProgramüManager||PMIU=46|
14/5/2019 8:27:1 34464|FKVM=8589864360|FKEM=0|CPRMS0=112,13,25|
NIC0IP=10.28.1.79|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|NI
14/5/2019 8:27:1 C0MAC=008064FB707A|RECP0=336580|SENDP0=111924|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(Personalü
14/5/2019 8:27:1 AreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWire
14/5/2019 8:27:1 less-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|
14/5/2019 8:27:1
,KB2779768,KB2780541,KB2781197,KB2785094,KB27
14/5/2019 8:27:1
99,KB2795944,KB2798162,KB2798802,KB2798804,KB
14/5/2019 8:27:1
8679,KB2808735,KB2809289,KB2811660,KB2812822,
14/5/2019 8:27:1
829254,KB2829361,KB2829530,KB2830290,KB283245
14/5/2019 8:27:1
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
14/5/2019 8:27:1 AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|A
14/5/2019 8:27:1 P3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|
15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013
14/5/2019 8:27:1 |C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|
AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||
14/5/2019 8:27:1 9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\Micro
14/5/2019 8:27:1 softüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|C:\Pr
14/5/2019 8:27:1 ogramüFiles\Wyse\WDA\|12.1.1.25|
5.4.0.1219906|
14/5/2019 8:27:1 AP11=GoogleüChrome|
AP12=MicrosoftüExcel|C:\PROGRA~
14/5/2019 8:27:1 1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|A
14/5/2019 8:27:1 P14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=Office
14/5/2019 8:27:1 üXMLüHandler|
15.0.4420.1017|AP16=MicrosoftüPowerPoint
14/5/2019 8:27:1 |C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|
AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=U
14/5/2019 8:27:1 nifiedüWriteüFilterüManagerüManager|
C:\ProgramüFiles\Window
14/5/2019 8:27:1 süMail\wab.exe|6.2.9200.16384|
6.2.9200.1
14/5/2019 8:27:1 Found HS Tag
then clear it here
14/5/2019 8:27:1 Server Sent 5
14/5/2019 8:27:1 Enhanced QU : QUM :
14/5/2019 8:27:1 Enhanced QU : QUC :
14/5/2019 8:27:1 Enhanced QU : QUD :
14/5/2019 8:27:1 Server Sent 6
14/5/2019 8:27:1 LOOKING FOR &04
14/5/2019 8:27:1 FUR :After S&P done
GetServerAddress
securePort: 443
14/5/2019 9:27:34 GetIP :: *** PPP
1325472778
14/5/2019 9:27:34 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
14/5/2019 9:27:34 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 9:27:34 Pipe not found
14/5/2019 9:27:34 The count is 7
14/5/2019 9:27:34 bSet is 1
securePort: 443
14/5/2019 9:27:34 Value found for LocalXMLPath = �H,
14/5/2019 9:27:34 WDAVersion = 12.1.1.25
14/5/2019 9:27:35 The iBLP value -1
14/5/2019 9:27:36 -1|VI=1|
14/5/2019 9:27:36 Found HS Tag
ProcessMsg!
then clear it here
14/5/2019 9:27:36 Server Sent 5
14/5/2019 9:27:36 Enhanced QU : QUM :
14/5/2019 9:27:36 Enhanced QU : QUC :
14/5/2019 9:27:36 Enhanced QU : QUD :
14/5/2019 9:27:36 Server Sent 6
14/5/2019 9:27:36 LOOKING FOR &04
14/5/2019 9:46:30 ^^^^^^^^ POWEREVENT Signal recieved : Going into sleep
14/5/2019 9:46:30 Sending SLEEP V05
14/5/2019 9:46:30 Start of CCommLink::FormatVerbKey02()
14/5/2019 9:46:30 End of CCommLink::FormatVerbKey02()
14/5/2019 9:46:30 Sending THIS hserver.dll?&V05|&IMAC=008064FB707A|CID=71|
HTTPHEADSUPP=2|SleepMode=1|
GetServerAddress
securePort: 443
14/5/2019 9:46:30 GetIP :: *** PPP
1325472778
14/5/2019 9:46:30 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
reported: 28
14/5/2019 9:46:30 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
14/5/2019 9:46:30 bSet is 0
14/5/2019 9:46:30 Got the server working/
&IMAC=008064FB707A|CID=71|HTTPHEADSUPP=2|SleepMode=1|
14/5/2019 9:46:34 Cleared the HS Values!
ProcessMsg!
then clear it here
14/5/2019 9:46:34 Server Sent 5
14/5/2019 9:46:34 Server Sent 6
14/5/2019 9:46:34 LOOKING FOR &04
GetServerAddress
securePort: 443
14/5/2019 9:46:40 GetIP :: *** PPP
1325472778
14/5/2019 9:46:40 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
14/5/2019 9:46:46 ^^^^^^^^ POWEREVENT Signal recieved : Resume from sleep ... so
signalling for checkin
HServer
Port: 0
ms
reported: 28
14/5/2019 9:46:50 C80B-4C42-8011-32B62020ACA3}, Type=6
14/5/2019 9:46:50 476A-8590-E6333C53F805}, Type=71
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 9:46:56 ip RETRIVED �/
10.20.15.151, SecurePort: 443
Port: 0
ms
reported: 28
14/5/2019 9:47:1 C80B-4C42-8011-32B62020ACA3}, Type=6
14/5/2019 9:47:1 476A-8590-E6333C53F805}, Type=71
GetServerAddress
443
HuntForAltLocalIP
1325472778
14/5/2019 9:47:7 ip RETRIVED �/
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
14/5/2019 9:47:13 C80B-4C42-8011-32B62020ACA3}, Type=6
14/5/2019 9:47:13 476A-8590-E6333C53F805}, Type=71
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 9:47:19 ip RETRIVED �/
10.20.15.151, SecurePort: 443
14/5/2019 9:47:22 SETTING REG TO VALUE �/
HuntForAltLocalIP
secure port 443
14/5/2019 9:47:22 Pipe not found
14/5/2019 9:47:22 The count is 7
14/5/2019 9:47:22 bSet is 1
securePort: 443
14/5/2019 9:47:22 Calling V01
14/5/2019 9:47:22 Merlin version 354
14/5/2019 9:47:22 Signature 354
14/5/2019 9:47:23 Wyse Flag value 0011
14/5/2019 9:47:24 The iBLP value -1
14/5/2019 9:47:24 TZ Queried
Number
14/5/2019 9:47:24 FUR : GetCI() 1
14/5/2019 9:47:24 IP matched!
14/5/2019 9:47:24 Subnet #�)
14/5/2019 9:47:24 Gateway �)
14/5/2019 9:47:24 DS #�)
83FF-9A7F0B2B2
14/5/2019 9:47:24 E1E}
14/5/2019 9:47:24 GetDisplayInfo() return=@96
14/5/2019 9:47:24 Disk offset 659554304
14/5/2019 9:47:24 Disk 0 Part 1 TYPE 260

14/5/2019 9:47:24 Disk 0 Part 5 TYPE 261

14/5/2019 9:47:24 Secure boot = 1

14/5/2019 9:47:24 tempbuff = |WIN0=Haga clic aqu� para obtener m�s informaci�n.|
WIN1=YouTube - Google Chrome|WIN2=Program Manager|, num=0
14/5/2019 9:47:24 Msg recd from AgentGUI:|WIN0=Haga clic aqu� para obtener m�s
informaci�n.|WIN1=YouTube - Google Chrome|WIN2=Program Manager|
14/5/2019 9:47:24 Got reply from AgentUI=`X5
14/5/2019 9:47:24 return from ListAllApps=�x5
14/5/2019 9:47:31 size of qfe list 64
14/5/2019 9:47:32 Value found for LocalXMLPath = �D5
14/5/2019 9:47:32 WDAVersion = 12.1.1.25
14/5/2019 9:47:32 GetCI() done
14/5/2019 9:47:32 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe|PRC66=chrome.exe|PRC67
14/5/2019 9:47:32 =wmiprvse.exe|PRC68=SelfService.exe|PRC69=svchost.exe|
PRC70=chrome.exe|PRC71=chrome.exe|PRC72=chrome.exe|PRC73=chrome.exe||WIN0=
14/5/2019 9:47:32 Hagaüclicüaqu�üparaüobtenerüm�süinformaci�n.|WIN1=YouTubeü-
üGoogleüChrome|WIN2=ProgramüManager||PMIU=45|TBPM=7786256|F
14/5/2019 9:47:32 BPM=4205036|TBPF=7786256|FBPF=3865708|TBVM=8589934464|
FKVM=8589863328|FKEM=0|CPRMS0=190,78,78|NIC0IP=10.28.1.79|NIC0DESC=Etherne
14/5/2019 9:47:32 t,InventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|
RECP0=1692|SENDP0=140826|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NI
14/5/2019 9:47:32 C1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.
14/5/2019 9:47:32 0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,
14/5/2019 9:47:32
770917,KB2777294,KB2778344,KB2778930,KB277956
14/5/2019 9:47:32
B2790907,KB2792100,KB2793210,KB2794119,KB2794
14/5/2019 9:47:32
,KB2804584,KB2805222,KB2805227,KB2807986,KB28
14/5/2019 9:47:32
04,KB2820330,KB2821895,KB2822241,KB2829069,KB
14/5/2019 9:47:32
8727,KB2839894,KB2845533,KB2845690,|AP0=7-Zip
14/5/2019 9:47:32 ü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0
14/5/2019 9:47:32 .2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|A
14/5/2019 9:47:32 P4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2
14/5/2019 9:47:32 008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=
14/5/2019 9:47:32 MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü
14/5/2019 9:47:32 (x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\ProgramüFi
14/5/2019 9:47:32 les\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|
14/5/2019 9:47:32 68.0.3440.106|AP12=MicrosoftüExcel|
basedüwriteüfilterümanag
14/5/2019 9:47:32 er|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\InternetüExpl
14/5/2019 9:47:32 orer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED
14/5/2019 9:47:32 .EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|C:\Progra
14/5/2019 9:47:32 müFiles\TightVNC\tvnserver.exe|2.6.4.0|
A
14/5/2019 9:47:32 P19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\Prog
14/5/2019 9:47:32 ramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
14/5/2019 9:47:32 |WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
14/5/2019 9:47:32 Found HS Tag
ProcessMsg!
then clear it here
14/5/2019 9:47:36 Server Sent 5
14/5/2019 9:47:36 Enhanced QU : QUM :
14/5/2019 9:47:36 Enhanced QU : QUC :
14/5/2019 9:47:36 Enhanced QU : QUD :
14/5/2019 9:47:36 Server Sent 6
14/5/2019 9:47:36 LOOKING FOR &04
14/5/2019 9:47:36 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 10:48:50 ip RETRIVED #�/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 10:48:50 Pipe not found
14/5/2019 10:48:50 The count is 7
14/5/2019 10:48:50 bCheckServer is 1
14/5/2019 10:48:50 bSet is 1
securePort: 443
14/5/2019 10:48:50 Calling V01
14/5/2019 10:48:50 Merlin version 354
14/5/2019 10:48:51 Signature 354
14/5/2019 10:48:51 Wyse Flag value 0011
14/5/2019 10:48:52 The iBLP value -1
14/5/2019 10:48:52 TZ Queried
Number
14/5/2019 10:48:52 FUR : GetCI() 1
14/5/2019 10:48:52 IP matched!
14/5/2019 10:48:52 Subnet #�)
14/5/2019 10:48:52 Gateway �)
14/5/2019 10:48:52 DS #�)
83FF-9A7F0B2B2
14/5/2019 10:48:52 E1E}
14/5/2019 10:48:52 Got reply from AgentUI=
14/5/2019 10:48:52 add only adapter.
14/5/2019 10:48:53 Disk offset 659554304
14/5/2019 10:48:53 Disk 0 Part 1 TYPE 260
14/5/2019 10:48:53 Disk 0 Part 5 TYPE 261

14/5/2019 10:48:53 Secure boot = 1

14/5/2019 10:48:53 tempbuff = |WIN0=Correo: Nicolas Forero - Outlook - Google
Chrome|WIN1=Program Manager|, num=0
14/5/2019 10:48:53 Msg recd from AgentGUI:|WIN0=Correo: Nicolas Forero - Outlook
- Google Chrome|WIN1=Program Manager|
14/5/2019 10:48:53 Got reply from AgentUI=85
14/5/2019 10:48:58 size of qfe list 64
14/5/2019 10:48:58 Value found for LocalXMLPath = �=3
14/5/2019 10:48:58 WDAVersion = 12.1.1.25
14/5/2019 10:48:58 GetCI() done
14/5/2019 10:48:58 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
D0PAR5SZ=30708596
14/5/2019 10:48:59 r.exe|PRC40=DtcWdaUi.exe|PRC41=hagent.exe|
PRC46=re
14/5/2019 10:48:59 =chrome.exe|PRC68=chrome.exe|PRC69=chrome.exe|
PRC70=chrome.exe|PRC71=wmiprvse.exe||WIN0=Correo:üNicolasüForeroü-üOutlookü-�
14/5/2019 10:48:59 �GoogleüChrome|WIN1=ProgramüManager||PMIU=48|TBPM=7786256|
14/5/2019 10:48:59 60|FKEM=0|CPRMS0=193,3,78|NIC0IP=10.28.1.79|
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MA
14/5/2019 10:48:59 C=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||
NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC
14/5/2019 10:48:59 =F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|
14/5/2019 10:48:59
KB2781197,KB2785094,KB2785220,KB2789649,KB278
14/5/2019 10:48:59
2,KB2798802,KB2798804,KB2798805,KB2799494,KB2
14/5/2019 10:48:59
289,KB2811660,KB2812822,KB2813170,KB2813430,K
14/5/2019 10:48:59
29530,KB2830290,KB2832450,KB2836946,KB2836947
14/5/2019 10:48:59 ,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefox�
14/5/2019 10:48:59 �61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüV
14/5/2019 10:48:59 diü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\Mi
14/5/2019 10:48:59 crosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|AP6=Mi
14/5/2019 10:48:59 crosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|5.
14/5/2019 10:48:59 1.20125.0|AP8=MicrosoftüVisualüC+
C:\ProgramüFiles\Wyse\WDA
14/5/2019 10:48:59 \|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|C
14/5/2019 10:48:59 :\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|
68.0.3440.106|AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\E
14/5/2019 10:48:59 XCEL.EXE|15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=Diagnosticsüutil
14/5/2019 10:48:59 ityüforüInternetüExplorer|
AP15=OfficeüXMLüHandler|C:\Pro
14/5/2019 10:48:59
gramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1
14/5/2019 10:48:59 \Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=UnifiedüWriteüFilter
14/5/2019 10:48:59 üManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=Microsoftü
14/5/2019 10:48:59 Word|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|
14/5/2019 10:48:59 Found HS Tag
ProcessMsg!
14/5/2019 10:48:59 Server Sent 5
14/5/2019 10:48:59 Enhanced QU : QUM :
14/5/2019 10:48:59 Enhanced QU : QUC :
14/5/2019 10:48:59 Enhanced QU : QUD :
14/5/2019 10:48:59 Server Sent 6
14/5/2019 10:48:59 LOOKING FOR &04
14/5/2019 10:48:59 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 11:49:41 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 11:49:41 Pipe not found
14/5/2019 11:49:41 The count is 7
14/5/2019 11:49:41 bCheckServer is 1
14/5/2019 11:49:41 bSet is 1
securePort: 443
14/5/2019 11:49:41 Value found for LocalXMLPath = �I3
14/5/2019 11:49:41 WDAVersion = 12.1.1.25
14/5/2019 11:49:42 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 11:49:42 -1|VI=1|
14/5/2019 11:49:43 Found HS Tag
ProcessMsg!
14/5/2019 11:49:43 Server Sent 5
14/5/2019 11:49:43 Enhanced QU : QUM :
14/5/2019 11:49:43 Enhanced QU : QUC :
14/5/2019 11:49:43 Enhanced QU : QUD :
14/5/2019 11:49:43 Server Sent 6
14/5/2019 11:49:43 LOOKING FOR &04
14/5/2019 12:24:13 Received data: o.
Accept: */*
14/5/2019 12:24:13 jects/mechanize/)
Connection: close
14/5/2019 12:24:13 =0.7,*;q=0.7

Accept: */*
Connection: close
14/5/2019 12:24:13 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 12:24:14 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 12:24:14 Pipe not found
14/5/2019 12:24:14 The count is 7
14/5/2019 12:24:14 bCheckServer is 1
14/5/2019 12:24:14 bSet is 1
securePort: 443
14/5/2019 12:24:14 Calling V01
14/5/2019 12:24:14 Merlin version 354
14/5/2019 12:24:14 Signature 354
14/5/2019 12:24:14 Wyse Flag value 0011
14/5/2019 12:24:15 The iBLP value -1
14/5/2019 12:24:16 TZ Queried
Number
14/5/2019 12:24:16 FUR : GetCI() 1
14/5/2019 12:24:16 IP matched!
14/5/2019 12:24:16 Subnet #�)
14/5/2019 12:24:16 Gateway �)
14/5/2019 12:24:16 DS #�)
83FF-9A7F0B2B2
14/5/2019 12:24:16 E1E}
14/5/2019 12:24:16 add only adapter.
14/5/2019 12:24:16 GetDisplayInfo() return=�x5
14/5/2019 12:24:16 Disk offset 659554304
14/5/2019 12:24:16 Disk 0 Part 1 TYPE 260

14/5/2019 12:24:16 Disk 0 Part 5 TYPE 261

14/5/2019 12:24:16 Secure boot = 1

14/5/2019 12:24:16 tempbuff = |WIN0=233. Transformada inversa de Laplace
completando trinomio cuadrado perfecto, con fracciones - YouTube - Google
14/5/2019 12:24:16 Chrome|WIN1=Program Manager|, num=0
14/5/2019 12:24:16 Msg recd from AgentGUI:|WIN0=233. Transformada inversa de
Laplace completando trinomio cuadrado perfecto, con fracciones - YouTu
14/5/2019 12:24:16 be - Google Chrome|WIN1=Program Manager|
14/5/2019 12:24:16 Got reply from AgentUI=0)6
14/5/2019 12:24:16 return from ListAllApps=`X5
14/5/2019 12:24:21 size of qfe list 64
14/5/2019 12:24:22 Value found for LocalXMLPath = �I3
14/5/2019 12:24:22 WDAVersion = 12.1.1.25
14/5/2019 12:24:22 GetCI() done
14/5/2019 12:24:22 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
D0PAR5SZ=30708596
14/5/2019 12:24:22 vchost.exe|PRC15=atieclxx.exe|PRC16=DtcPlatformSvc.exe|
PRC17=Explorer.EXE|PRC18=spoolsv.exe|PRC19=svchost.exe|PRC20=taskhostex.e
14/5/2019 12:24:22 xe|PRC21=svchost.exe|PRC22=svchost.exe|PRC23=mqsvc.exe|
PRC24=NetXClean.exe|PRC25=pnusbvirtualhubwssrv.exe|PRC26=tcpsvcs.exe|PRC2
14/5/2019 12:24:22 7=snmp.exe|PRC28=tvnserver.exe|PRC29=UWFSvc.exe|
PRC30=MsMpEng.exe|PRC31=wsnm.exe|PRC32=DtcWDAService.exe|PRC33=mqtgsvc.exe|PRC34
14/5/2019 12:24:22 =vmware-usbarbitrator64.exe|PRC35=vmware-view-usbd.exe|
PRC36=svchost.exe|PRC37=wmiprvse.exe|PRC38=SearchIndexer.exe|PRC39=DtcWda
14/5/2019 12:24:22 Ui.exe|PRC40=hagent.exe|PRC41=HAgent_UI.exe|
PRC42=tvnserver.exe|PRC43=RAVCpl64.exe|PRC44=concentr.exe|PRC45=redirector.exe|
PRC46
14/5/2019 12:24:22 =PNUSBCLITRAY.exe|PRC47=PNTray.exe|PRC48=Receiver.exe|
PRC49=SelfServicePlugin.exe|PRC50=wfcrun32.exe|PRC51=CcmExec.exe|PRC52=wmi
14/5/2019 12:24:22 prvse.exe|PRC53=wmiprvse.exe|PRC54=chrome.exe|
PRC55=chrome.exe|PRC56=chrome.exe|PRC57=chrome.exe|PRC58=chrome.exe|PRC59=chrome.e
14/5/2019 12:24:22 xe|PRC60=chrome.exe|PRC61=chrome.exe|PRC62=chrome.exe|
PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe|PRC66=chrome.exe|PRC67=
14/5/2019 12:24:22 chrome.exe|PRC68=chrome.exe|PRC69=svchost.exe|
PRC70=taskeng.exe|PRC71=wmiprvse.exe||WIN0=233.üTransformadaüinversaüdeüLaplac
14/5/2019 12:24:22 eücompletandoütrinomioücuadradoüperfecto,üconüfraccionesü-
üYouTubeü-üGoogleüChrome|WIN1=ProgramüManager||PMIU=49|TBP
14/5/2019 12:24:22 M=7786256|FBPM=3941540|TBPF=7786256|FBPF=3553796|
TBVM=8589934464|FKVM=8589863336|FKEM=0|CPRMS0=212,1,78|NIC0IP=10.28.1.79|NIC0DE
14/5/2019 12:24:22 SC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=213817|SENDP0=211046|MIBSP0=1000üMbps||NIC1I
14/5/2019 12:24:22 P=0.0.0.0|
RECP1=0|SENDP1=0|MIBSP1=3üMbps||N
14/5/2019 12:24:22 IC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-
ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFE
14/5/2019 12:24:22
L=KB2727528,KB2729462,KB2737084,KB2753842,KB2756872,KB2757638,KB2761465,KB2769165,K
B2769166,KB2770917,KB2777294,KB2778344,KB2778
14/5/2019 12:24:22
,KB2790655,KB2790907,KB2792100,KB2793210,KB27
14/5/2019 12:24:22
33,KB2804583,KB2804584,KB2805222,KB2805227,KB
14/5/2019 12:24:22
7183,KB2818604,KB2820330,KB2821895,KB2822241,
14/5/2019 12:24:22
836988,KB2838727,KB2839894,KB2845533,KB284569
14/5/2019 12:24:22 0,|AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\Mozillaü
14/5/2019 12:24:22 Firefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0
14/5/2019 12:24:22 .4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVi
14/5/2019 12:24:22 sualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||
9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDat
14/5/2019 12:24:22 abase|||AP7=MicrosoftüSilverlight|
+ü2005üRedis
14/5/2019 12:24:22 tributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:
14/5/2019 12:24:22 \ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application
14/5/2019 12:24:22 \chrome.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-basedüwriteüf
14/5/2019 12:24:22 ilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\In
14/5/2019 12:24:22 ternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFIC
14/5/2019 12:24:22 E15\MSOXMLED.EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightV
14/5/2019 12:24:22 NC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE
14/5/2019 12:24:22 |2.0.127.0|AP19=WindowsüContacts|
AP20=Microsoftü(R)üContactsüImportü
14/5/2019 12:24:22 Tool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15
14/5/2019 12:24:22 .0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
14/5/2019 12:24:22 Found HS Tag
ProcessMsg!
14/5/2019 12:24:22 Server Sent 5
14/5/2019 12:24:22 Enhanced QU : QUM :
14/5/2019 12:24:22 Enhanced QU : QUC :
14/5/2019 12:24:22 Enhanced QU : QUD :
14/5/2019 12:24:22 Server Sent 6
14/5/2019 12:24:22 LOOKING FOR &04
14/5/2019 12:24:22 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
14/5/2019 12:40:41 GetIP -- IP String is Proper address for IN_ADDR : 0
14/5/2019 12:40:41 ssLocalIP = INADDR_ANY
14/5/2019 12:40:41 ip RETRIVED `�/
10.20.15.151, SecurePort: 443
HServer
14/5/2019 12:40:46 Now try HTTP, verifying server connection at IP:
10.20.15.151, Port: 0
14/5/2019 12:40:46 Could not establish socket connection with HServer, sleeping
5 ms
reported: 28
14/5/2019 12:40:47 C80B-4C42-8011-32B62020ACA3}, Type=6
14/5/2019 12:40:47 476A-8590-E6333C53F805}, Type=71
Description=Inventec PCIe GBE Family Controller #2, AdapterName={F1C924B6-FC
14/5/2019 12:40:47 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
14/5/2019 12:40:48 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
14/5/2019 12:40:48 ip RETRIVED P�/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
14/5/2019 12:40:54 C80B-4C42-8011-32B62020ACA3}, Type=6
14/5/2019 12:40:54 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 13:41:46 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 13:41:46 Pipe not found
14/5/2019 13:41:46 The count is 7
14/5/2019 13:41:46 bCheckServer is 1
14/5/2019 13:41:46 bSet is 1
securePort: 443
14/5/2019 13:41:46 Calling V01
14/5/2019 13:41:46 Merlin version 354
14/5/2019 13:41:46 Signature 354
14/5/2019 13:41:47 Wyse Flag value 0011
14/5/2019 13:41:48 The iBLP value -1
14/5/2019 13:41:49 TZ Queried
Number
14/5/2019 13:41:49 FUR : GetCI() 1
14/5/2019 13:41:49 IP matched!
14/5/2019 13:41:49 Subnet #�)
14/5/2019 13:41:49 Gateway �)
14/5/2019 13:41:49 DS #�)
83FF-9A7F0B2B2
14/5/2019 13:41:49 E1E}
14/5/2019 13:41:49 add only adapter.
14/5/2019 13:41:49 GetDisplayInfo() return=0)6
14/5/2019 13:41:49 Disk offset 659554304
14/5/2019 13:41:49 Disk 0 Part 1 TYPE 260

14/5/2019 13:41:49 Disk 0 Part 5 TYPE 261

14/5/2019 13:41:49 Secure boot = 1

14/5/2019 13:41:49 tempbuff = |WIN0=103. Programaci�n en C++ || Listas ||
Concepto de Lista Enlazada - YouTube - Google Chrome|WIN1=Program Manager
14/5/2019 13:41:49 |, num=0
14/5/2019 13:41:49 Msg recd from AgentGUI:|WIN0=103. Programaci�n en C++ ||
Listas || Concepto de Lista Enlazada - YouTube - Google Chrome|WIN1=Pro
14/5/2019 13:41:49 gram Manager|
14/5/2019 13:41:55 size of qfe list 64
14/5/2019 13:41:56 Value found for LocalXMLPath = P#5
14/5/2019 13:41:56 WDAVersion = 12.1.1.25
14/5/2019 13:41:56 GetCI() done
14/5/2019 13:41:56 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
D0PAR5SZ=30708596
UEFISEC=1|DRV0=C:|TB0=30708592640|TFB0=16463126528|DRV1=D:|TB1=15783821312
14/5/2019 13:41:56 |TFB1=7647166464|DRV2=Z:|TB2=1073643520|TFB2=1061027840||
PRC0=smss.exe|PRC1=csrss.exe|PRC2=wininit.exe|PRC3=csrss.exe|PRC4=servi
14/5/2019 13:41:56 ces.exe|PRC5=winlogon.exe|PRC6=lsass.exe|PRC7=svchost.exe|
PRC8=svchost.exe|PRC9=atiesrxx.exe|PRC10=svchost.exe|PRC11=svchost.exe
14/5/2019 13:41:56 |PRC12=dwm.exe|PRC13=svchost.exe|PRC14=svchost.exe|
PRC15=atieclxx.exe|PRC16=DtcPlatformSvc.exe|PRC17=Explorer.EXE|PRC18=spoolsv.
14/5/2019 13:41:56 exe|PRC19=svchost.exe|PRC20=taskhostex.exe|PRC21=svchost.exe|
PRC22=svchost.exe|PRC23=mqsvc.exe|PRC24=NetXClean.exe|PRC25=pnusbvi
14/5/2019 13:41:56 rtualhubwssrv.exe|PRC26=tcpsvcs.exe|PRC27=snmp.exe|
PRC28=tvnserver.exe|PRC29=UWFSvc.exe|PRC30=MsMpEng.exe|PRC31=wsnm.exe|PRC32=D
14/5/2019 13:41:56 tcWDAService.exe|PRC33=mqtgsvc.exe|PRC34=vmware-
usbarbitrator64.exe|PRC35=vmware-view-usbd.exe|PRC36=svchost.exe|PRC37=wmiprvse.
14/5/2019 13:41:56 exe|PRC38=SearchIndexer.exe|PRC39=DtcWdaUi.exe|
PRC40=hagent.exe|PRC41=HAgent_UI.exe|PRC42=tvnserver.exe|PRC43=RAVCpl64.exe|PRC44
14/5/2019 13:41:56 =concentr.exe|PRC45=redirector.exe|PRC46=PNUSBCLITRAY.exe|
PRC47=PNTray.exe|PRC48=Receiver.exe|PRC49=SelfServicePlugin.exe|PRC50=
14/5/2019 13:41:56 wfcrun32.exe|PRC51=CcmExec.exe|PRC52=wmiprvse.exe|
PRC53=wmiprvse.exe|PRC54=svchost.exe|PRC55=chrome.exe|PRC56=chrome.exe|PRC57=c
14/5/2019 13:41:56 hrome.exe|PRC58=chrome.exe|PRC59=chrome.exe|PRC60=chrome.exe|
PRC61=chrome.exe|PRC62=chrome.exe|PRC63=WUDFHost.exe|PRC64=chrome.e
14/5/2019 13:41:56 xe|PRC65=chrome.exe|PRC66=chrome.exe|PRC67=wmiprvse.exe|
PRC68=svchost.exe||WIN0=103.üProgramaci�nüenüC++ü||üListasü||üCon
14/5/2019 13:41:56 ceptoüdeüListaüEnlazadaü-üYouTubeü-üGoogleüChrome|
WIN1=ProgramüManager||PMIU=48|TBPM=7786256|FBPM=3999884|TBPF=7786256|
14/5/2019 13:41:56 FBPF=3731024|TBVM=8589934464|FKVM=8589863336|FKEM=0|
CPRMS0=244,1,78|NIC0IP=10.28.1.79|NIC0DESC=Ethernet,InventecüPCIeüGBEüFam
14/5/2019 13:41:56 ilyüControllerü#2|NIC0MAC=008064FB707A|RECP0=384568|
SENDP0=264784|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,Bluetoot
14/5/2019 13:41:56 hüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|
RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Inte
14/5/2019 13:41:56 l(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|
SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,KB2729462,KB2737084,KB27
14/5/2019 13:41:56
44,KB2778930,KB2779562,KB2779768,KB2780541,KB
14/5/2019 13:41:56
3210,KB2794119,KB2794599,KB2795944,KB2798162,
14/5/2019 13:41:56
805227,KB2807986,KB2808679,KB2808735,KB280928
14/5/2019 13:41:56
B2822241,KB2829069,KB2829254,KB2829361,KB2829
14/5/2019 13:41:56
,KB2845690,|AP0=7-Zipü18.05ü(x64)|C:\Progra
14/5/2019 13:41:56 müFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintena
14/5/2019 13:41:56 nceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOfficeüPr
14/5/2019 13:41:56 ofessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|
15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-�
14/5/2019 13:41:56 �x64ü9.0.30729.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c
14/5/2019 13:41:56 :\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|AP9=Wys
14/5/2019 13:41:56 eüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\
14/5/2019 13:41:56 Client\|5.4.0.1219906|AP11=GoogleüChrome|
AP12=Micro
14/5/2019 13:41:56 softüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|
15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\f
14/5/2019 13:41:56 bwfmgr.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.
14/5/2019 13:41:56 9200.16384|AP15=OfficeüXMLüHandler|
15.0.4420.1017|AP16
14/5/2019 13:41:56 =MicrosoftüPowerPoint|
C:\ProgramüFiles\TightVNC\tvnser
14/5/2019 13:41:56 ver.exe|2.6.4.0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:
14/5/2019 13:41:56 \ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüMail
14/5/2019 13:41:56 \wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WC
14/5/2019 13:41:56 MSupp=1|WCMJSONSupp=1|
14/5/2019 13:41:56 Found HS Tag
ProcessMsg!
14/5/2019 13:41:56 Server Sent 5
14/5/2019 13:41:56 Enhanced QU : QUM :
14/5/2019 13:41:56 Enhanced QU : QUC :
14/5/2019 13:41:56 Enhanced QU : QUD :
14/5/2019 13:41:56 Server Sent 6
14/5/2019 13:41:56 LOOKING FOR &04
14/5/2019 13:41:56 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 14:44:40 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 14:44:40 Pipe not found
14/5/2019 14:44:40 The count is 7
14/5/2019 14:44:40 bCheckServer is 1
14/5/2019 14:44:40 bSet is 1
securePort: 443
14/5/2019 14:44:40 Value found for LocalXMLPath = �&5
14/5/2019 14:44:40 WDAVersion = 12.1.1.25
14/5/2019 14:44:41 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 14:44:42 -1|VI=1|
14/5/2019 14:44:42 Found HS Tag
ProcessMsg!
14/5/2019 14:44:42 Server Sent 5
14/5/2019 14:44:42 Enhanced QU : QUM :
14/5/2019 14:44:42 Enhanced QU : QUC :
14/5/2019 14:44:42 Enhanced QU : QUD :
14/5/2019 14:44:42 Server Sent 6
14/5/2019 14:44:42 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 15:48:20 ip RETRIVED #�/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 15:48:20 Pipe not found
14/5/2019 15:48:20 The count is 7
14/5/2019 15:48:20 bCheckServer is 1
14/5/2019 15:48:20 bSet is 1
securePort: 443
14/5/2019 15:48:20 Value found for LocalXMLPath = #K5
14/5/2019 15:48:20 WDAVersion = 12.1.1.25
14/5/2019 15:48:21 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 15:48:22 -1|VI=1|
14/5/2019 15:48:22 Found HS Tag
ProcessMsg!
14/5/2019 15:48:22 Server Sent 5
14/5/2019 15:48:22 Enhanced QU : QUM :
14/5/2019 15:48:22 Enhanced QU : QUC :
14/5/2019 15:48:22 Enhanced QU : QUD :
14/5/2019 15:48:22 Server Sent 6
14/5/2019 15:48:22 LOOKING FOR &04
14/5/2019 16:31:27 Received data: o.
Accept: */*
14/5/2019 16:31:27 jects/mechanize/)
Connection: close
14/5/2019 16:31:27 =0.7,*;q=0.7

Accept: */*
Connection: close
14/5/2019 16:31:27 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 16:31:27 ip RETRIVED #�/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 16:31:28 Pipe not found
14/5/2019 16:31:28 The count is 7
14/5/2019 16:31:28 bCheckServer is 1
14/5/2019 16:31:28 bSet is 1
securePort: 443
14/5/2019 16:31:28 Calling V01
14/5/2019 16:31:28 Merlin version 354
14/5/2019 16:31:28 Signature 354
14/5/2019 16:31:28 Wyse Flag value 0011
14/5/2019 16:31:29 The iBLP value -1
14/5/2019 16:31:30 TZ Queried
Number
14/5/2019 16:31:30 FUR : GetCI() 1
14/5/2019 16:31:30 IP matched!
14/5/2019 16:31:30 Subnet #�)
14/5/2019 16:31:30 Gateway �)
14/5/2019 16:31:30 DS #�)
14/5/2019 16:31:30 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=p8-
14/5/2019 16:31:30 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=p8-
14/5/2019 16:31:30 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=p8-
83FF-9A7F0B2B2
14/5/2019 16:31:30 E1E}
14/5/2019 16:31:30 add only adapter.
14/5/2019 16:31:30 GetDisplayInfo() return=0)6
14/5/2019 16:31:30 Disk offset 659554304
14/5/2019 16:31:30 Disk 0 Part 1 TYPE 260

14/5/2019 16:31:30 Disk 0 Part 5 TYPE 261

14/5/2019 16:31:30 Secure boot = 1

14/5/2019 16:31:30 tempbuff = |WIN0=WhatsApp - Mozilla Firefox|WIN1=Descargas|
14/5/2019 16:31:30 Msg recd from AgentGUI:|WIN0=WhatsApp - Mozilla Firefox|
WIN1=Descargas|WIN2=Program Manager|
14/5/2019 16:31:30 Got reply from AgentUI= #6
14/5/2019 16:31:30 return from ListAllApps=@96
14/5/2019 16:31:36 size of qfe list 64
14/5/2019 16:31:36 Value found for LocalXMLPath = @#5
14/5/2019 16:31:36 WDAVersion = 12.1.1.25
14/5/2019 16:31:36 GetCI() done
14/5/2019 16:31:36 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
D0PAR5SZ=30708596
14/5/2019 16:31:36 vchost.exe|PRC15=atieclxx.exe|PRC16=DtcPlatformSvc.exe|
PRC17=Explorer.EXE|PRC18=spoolsv.exe|PRC19=svchost.exe|PRC20=taskhostex.e
14/5/2019 16:31:36 xe|PRC21=svchost.exe|PRC22=svchost.exe|PRC23=mqsvc.exe|
14/5/2019 16:31:36 =vmware-usbarbitrator64.exe|PRC35=vmware-view-usbd.exe|
PRC36=svchost.exe|PRC37=wmiprvse.exe|PRC38=SearchIndexer.exe|PRC39=DtcWda
14/5/2019 16:31:36 Ui.exe|PRC40=hagent.exe|PRC41=HAgent_UI.exe|
PRC46
14/5/2019 16:31:36 =PNUSBCLITRAY.exe|PRC47=PNTray.exe|PRC48=Receiver.exe|
PRC49=SelfServicePlugin.exe|PRC50=wfcrun32.exe|PRC51=CcmExec.exe|PRC52=wmi
14/5/2019 16:31:36 prvse.exe|PRC53=wmiprvse.exe|PRC54=svchost.exe|
PRC55=firefox.exe|PRC56=firefox.exe|PRC57=firefox.exe|PRC58=firefox.exe|PRC59=fir
14/5/2019 16:31:36 efox.exe|PRC60=wmiprvse.exe|PRC61=svchost.exe||
WIN0=WhatsAppü-üMozillaüFirefox|WIN1=Descargas|WIN2=ProgramüManager||PMIU=41|
14/5/2019 16:31:36 TBPM=7786256|FBPM=4518848|TBPF=7786256|FBPF=4272828|
TBVM=8589934464|FKVM=8589863336|FKEM=0|CPRMS0=258,1,78|NIC0IP=10.28.1.79|NIC
14/5/2019 16:31:36 0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=589483|SENDP0=330991|MIBSP0=1000üMbps||NI
14/5/2019 16:31:36 C1IP=0.0.0.0|
RECP1=0|SENDP1=0|MIBSP1=3üMbps
14/5/2019 16:31:36 ||NIC2IP=0.0.0.0|
SENDP2=0|MIBSP2=0üMbps|
14/5/2019 16:31:36
5,KB2769166,KB2770917,KB2777294,KB2778344,KB2
14/5/2019 16:31:36
650,KB2790655,KB2790907,KB2792100,KB2793210,K
14/5/2019 16:31:36
00033,KB2804583,KB2804584,KB2805222,KB2805227
14/5/2019 16:31:36
2817183,KB2818604,KB2820330,KB2821895,KB28222
14/5/2019 16:31:36
KB2836988,KB2838727,KB2839894,KB2845533,KB284
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\Mozill
14/5/2019 16:31:36 aüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|1
14/5/2019 16:31:36 5.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=Microsoft�
14/5/2019 16:31:36 �VisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||
9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterü
14/5/2019 16:31:36 Database|||AP7=MicrosoftüSilverlight|
+ü2005üRe
14/5/2019 16:31:36 distributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient
14/5/2019 16:31:36 |C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Applicat
14/5/2019 16:31:36 ion\chrome.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-basedüwrite
14/5/2019 16:31:36 üfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles
14/5/2019 16:31:36 \InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OF
14/5/2019 16:31:36 FICE15\MSOXMLED.EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=Tig
14/5/2019 16:31:36 htVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.
14/5/2019 16:31:36 EXE|2.0.127.0|AP19=WindowsüContacts|
AP20=Microsoftü(R)üContactsüImpor
14/5/2019 16:31:36 tüTool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|
6.2.9200.16384|AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE
14/5/2019 16:31:36 |15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
14/5/2019 16:31:36 Found HS Tag
ProcessMsg!
14/5/2019 16:31:36 Server Sent 5
14/5/2019 16:31:36 Enhanced QU : QUM :
14/5/2019 16:31:36 Enhanced QU : QUC :
14/5/2019 16:31:36 Enhanced QU : QUD :
14/5/2019 16:31:36 Server Sent 6
14/5/2019 16:31:36 LOOKING FOR &04
14/5/2019 16:31:36 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 17:35:15 ip RETRIVED #�/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 17:35:15 Pipe not found
14/5/2019 17:35:15 The count is 7
14/5/2019 17:35:15 bCheckServer is 1
14/5/2019 17:35:15 bSet is 1
securePort: 443
14/5/2019 17:35:15 Value found for LocalXMLPath = 0#5
14/5/2019 17:35:15 WDAVersion = 12.1.1.25
14/5/2019 17:35:16 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 17:35:16 -1|VI=1|
14/5/2019 17:35:17 Found HS Tag
ProcessMsg!
14/5/2019 17:35:17 Server Sent 5
14/5/2019 17:35:17 Enhanced QU : QUM :
14/5/2019 17:35:17 Enhanced QU : QUC :
14/5/2019 17:35:17 Enhanced QU : QUD :
14/5/2019 17:35:17 Server Sent 6
14/5/2019 17:35:17 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 18:38:52 ip RETRIVED ��/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 18:38:52 Pipe not found
14/5/2019 18:38:52 The count is 7
14/5/2019 18:38:52 bCheckServer is 1
14/5/2019 18:38:52 bSet is 1
securePort: 443
14/5/2019 18:38:52 Value found for LocalXMLPath = p"5
14/5/2019 18:38:52 WDAVersion = 12.1.1.25
14/5/2019 18:38:53 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 18:38:54 -1|VI=1|
14/5/2019 18:38:54 Found HS Tag
ProcessMsg!
14/5/2019 18:38:54 Server Sent 5
14/5/2019 18:38:54 Enhanced QU : QUM :
14/5/2019 18:38:54 Enhanced QU : QUC :
14/5/2019 18:38:54 Enhanced QU : QUD :
14/5/2019 18:38:54 Server Sent 6
14/5/2019 18:38:54 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
14/5/2019 19:42:33 ip RETRIVED #�/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 19:42:33 Pipe not found
14/5/2019 19:42:33 The count is 7
14/5/2019 19:42:33 bCheckServer is 1
14/5/2019 19:42:33 bSet is 1
securePort: 443
14/5/2019 19:42:33 WDAVersion = 12.1.1.25
14/5/2019 19:42:34 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
14/5/2019 19:42:34 -1|VI=1|
14/5/2019 19:42:34 Found HS Tag
ProcessMsg!
14/5/2019 19:42:35 Server Sent 5
14/5/2019 19:42:35 Enhanced QU : QUM :
14/5/2019 19:42:35 Enhanced QU : QUC :
14/5/2019 19:42:35 Enhanced QU : QUD :
14/5/2019 19:42:35 Server Sent 6
14/5/2019 19:42:35 LOOKING FOR &04
14/5/2019 19:43:4 Stopping
15/5/2019 7:15:35 ***********************************************************
15/5/2019 7:15:35 End of WinMain()
15/5/2019 7:15:35 ^^^^^^^^ after reghanex()
15/5/2019 7:15:56 OS Version 6.2.9200
15/5/2019 7:15:56 OS Version 6.2.9200
15/5/2019 7:15:56 Major version 6
15/5/2019 7:15:56 Minor version 2
15/5/2019 7:15:56 Device Info: OS is ��+
15/5/2019 7:15:56 WRITE FILTER UWF 1
15/5/2019 7:15:56 Setting UWF Mgr!
15/5/2019 7:15:56 Disk offset 659554304
15/5/2019 7:15:56 Disk offset =1048576

15/5/2019 7:15:56 Disk offset =105906176
15/5/2019 7:15:56 Disk offset =420478976
15/5/2019 7:15:56 Disk offset =525336576
15/5/2019 7:15:56 Disk offset =659554304

'Z:\',error=1
15/5/2019 7:15:56 AF_INET (IPv4)
15/5/2019 7:15:56 IPv4 address 10.28.1.79
15/5/2019 7:15:56 IPv4 DWORD server IP 1325472778
15/5/2019 7:15:56 Valid IP Found

15/5/2019 7:15:56 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
15/5/2019 7:15:56 HA Supported
15/5/2019 7:15:56 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
15/5/2019 7:15:56 ip RETRIVED ��.
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
15/5/2019 7:15:57 Pipe not found
15/5/2019 7:15:57 The count is 7
15/5/2019 7:15:57 bSet is 1
securePort: 443
15/5/2019 7:15:58 Calling V01
15/5/2019 7:15:58 Merlin version 354
15/5/2019 7:15:58 Signature 354
15/5/2019 7:15:58 Wyse Flag value 0011
15/5/2019 7:15:59 The iBLP value -1
15/5/2019 7:15:59 TZ Queried
Number
15/5/2019 7:15:59 FUR : GetCI() 1
15/5/2019 7:16:0 IP matched!
15/5/2019 7:16:0 Subnet
15/5/2019 7:16:0 Gateway #�)
15/5/2019 7:16:0 DS ��)
15/5/2019 7:16:0 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP= �/
15/5/2019 7:16:0 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP= �/
15/5/2019 7:16:0 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP= �/
83FF-9A7F0B2B2
15/5/2019 7:16:0 E1E}
15/5/2019 7:16:0 Got reply from AgentUI= �,
15/5/2019 7:16:0 Error: GetDisplayInfo() didn't recv data
15/5/2019 7:16:0 Disk offset 659554304
15/5/2019 7:16:0 Disk 0 Part 1 TYPE 260

15/5/2019 7:16:0 Disk 0 Part 5 TYPE 261

15/5/2019 7:16:0 Secure boot = 1

15/5/2019 7:16:0 tempbuff = |, num=0
15/5/2019 7:16:0 Got reply from AgentUI=�#0
15/5/2019 7:16:0 return from ListAllApps=��/
15/5/2019 7:16:6 size of qfe list 64
15/5/2019 7:16:7 Value found for LocalXMLPath = �
-
15/5/2019 7:16:7 WDAVersion = 12.1.1.25
15/5/2019 7:16:7 GetCI() done
'Z:\',error=1
443
15/5/2019 7:16:7 GetCI() 2 done
CN=WES008064FB707A|IP=10.28.1.79|ED=1|DS=10.28.24.2|GW=10.28.0.1|
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
415GAüSOCüwithüRadeon(tm)üHDüGraphicsüüü|CPS=1497|B1=1.0F|PD2=|PD1=AMDüHighüDef
15/5/2019 7:16:7 initionüAudioüDevice|CO=|LO=|OSDSK=0||Disk0=0|
DiskSize0=32012789760|D0PAR1SZ=104857600|D0PAR1STOFF=1048576|D0PAR1TYPE=260|D0PA
15/5/2019 7:16:7 RBOOT=5|D0PAR2SZ=314572800|D0PAR2STOFF=105906176|
D0PAR2TYPE=257|D0PARBOOT=5|D0PAR3SZ=104857600|D0PAR3STOFF=420478976|D0PAR3TYPE=
15/5/2019 7:16:7 258|D0PARBOOT=5|D0PAR4SZ=134217728|D0PAR4STOFF=525336576|
D0PAR4TYPE=259|D0PARBOOT=5|D0PAR5SZ=30708596736|D0PAR5STOFF=659554304|D
15/5/2019 7:16:7 0PAR5TYPE=261|D0PARBOOT=5||UEFISEC=1|DRV0=C:|TB0=30708592640|
TFB0=16442212352|DRV1=Z:|TB1=1073643520|TFB1=1073479680||PRC0=smss.
15/5/2019 7:16:7 exe|PRC1=csrss.exe|PRC2=wininit.exe|PRC3=csrss.exe|
PRC4=winlogon.exe|PRC5=services.exe|PRC6=lsass.exe|PRC7=svchost.exe|PRC8=svch
15/5/2019 7:16:7 ost.exe|PRC9=atiesrxx.exe|PRC10=svchost.exe|PRC11=svchost.exe|
PRC12=svchost.exe|PRC13=svchost.exe|PRC14=dwm.exe|PRC15=svchost.ex
15/5/2019 7:16:7 e|PRC16=svchost.exe|PRC17=DtcPlatformSvc.exe|
PRC18=Explorer.EXE|PRC19=spoolsv.exe|PRC20=svchost.exe|PRC21=taskhostex.exe|PRC22=G
15/5/2019 7:16:7 oogleUpdate.exe|PRC23=svchost.exe|PRC24=svchost.exe|
PRC25=mqsvc.exe|PRC26=NetXClean.exe|PRC27=pnusbvirtualhubwssrv.exe|PRC28=tcp
15/5/2019 7:16:7 svcs.exe|PRC29=snmp.exe|PRC30=tvnserver.exe|PRC31=UWFSvc.exe|
PRC32=MsMpEng.exe|PRC33=wsnm.exe|PRC34=DtcWDAService.exe|PRC35=mqtg
15/5/2019 7:16:7 svc.exe|PRC36=GoogleUpdate.exe|PRC37=vmware-
usbarbitrator64.exe|PRC38=wmiprvse.exe|PRC39=vmware-view-usbd.exe|
PRC40=svchost.exe|
15/5/2019 7:16:7 PRC41=wmiprvse.exe|PRC42=svchost.exe|PRC43=msiexec.exe|
PRC44=SearchIndexer.exe|PRC45=vssvc.exe|PRC46=svchost.exe|PRC47=SearchPro
15/5/2019 7:16:7 tocolHost.exe|PRC48=SearchFilterHost.exe|PRC49=DtcWdaUi.exe|
PRC50=hagent.exe|PRC51=HAgent_UI.exe|PRC52=tvnserver.exe|PRC53=UWFTr
15/5/2019 7:16:7 ay.exe|PRC54=RAVCpl64.exe|PRC55=concentr.exe|
PRC56=redirector.exe|PRC57=PNUSBCLITRAY.exe|PRC58=PNTray.exe|PRC59=Receiver.exe|PRC
15/5/2019 7:16:7 60=SelfServicePlugin.exe|PRC61=wfcrun32.exe|PRC62=WOWReg32.exe|
PRC63=WOWReg32.exe|PRC64=WOWReg32.exe|PRC65=DllHost.exe|||PMIU=34
15/5/2019 7:16:7 |TBPM=7786256|FBPM=5103296|TBPF=7786256|FBPF=5081668|
TBVM=8589934464|FKVM=8589865384|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28.1.79|NIC0D
15/5/2019 7:16:7 ESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=682|SENDP0=423|MIBSP0=1000üMbps||NIC1IP=0.0
15/5/2019 7:16:7 .0.0|
RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP
15/5/2019 7:16:7 =0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
15/5/2019 7:16:7
166,KB2770917,KB2777294,KB2778344,KB2778930,K
15/5/2019 7:16:7
90655,KB2790907,KB2792100,KB2793210,KB2794119
15/5/2019 7:16:7
2804583,KB2804584,KB2805222,KB2805227,KB28079
15/5/2019 7:16:7
KB2818604,KB2820330,KB2821895,KB2822241,KB282
15/5/2019 7:16:7
8,KB2838727,KB2839894,KB2845533,KB2845690,|AP
15/5/2019 7:16:7 0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFiref
15/5/2019 7:16:7 ox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420
15/5/2019 7:16:7 .1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisual�
15/5/2019 7:16:7 �C++ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase
15/5/2019 7:16:7 |||AP7=MicrosoftüSilverlight|
+ü2005üRedistribu
15/5/2019 7:16:7 tableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\Prog
15/5/2019 7:16:7 ramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application\chro
15/5/2019 7:16:7 me.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-basedüwriteüfilter
15/5/2019 7:16:7 ümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\Interne
15/5/2019 7:16:7 tüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\M
15/5/2019 7:16:7 SOXMLED.EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|C:
15/5/2019 7:16:7 \ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.
15/5/2019 7:16:7 127.0|AP19=WindowsüContacts|
AP20=Microsoftü(R)üContactsüImportüTool|
15/5/2019 7:16:7 C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.44
15/5/2019 7:16:7 Found HS Tag
then clear it here
15/5/2019 7:16:7 Server Sent 5
15/5/2019 7:16:7 Enhanced QU : QUM :
15/5/2019 7:16:7 Enhanced QU : QUC :
15/5/2019 7:16:7 Enhanced QU : QUD :
15/5/2019 7:16:7 Server Sent 6
15/5/2019 7:16:7 LOOKING FOR &04
15/5/2019 7:16:7 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
15/5/2019 8:19:33 ip RETRIVED �;,
10.20.15.151, SecurePort: 443
15/5/2019 8:19:34 SETTING REG TO VALUE �;,
HuntForAltLocalIP
secure port 443
15/5/2019 8:19:34 Pipe not found
15/5/2019 8:19:34 The count is 7
15/5/2019 8:19:34 bSet is 1
securePort: 443
15/5/2019 8:19:34 Value found for LocalXMLPath = 0#/
15/5/2019 8:19:34 WDAVersion = 12.1.1.25
15/5/2019 8:19:34 The iBLP value -1
WDA=1|WCMSupp=1|WCMJSONSupp=1|TPA=0|TPE=0|TPI=0|BLP=-1|BLE=-1|BLC=-1|
15/5/2019 8:19:35 VI=1|
15/5/2019 8:19:35 Found HS Tag
ProcessMsg!
then clear it here
15/5/2019 8:19:35 Server Sent 5
15/5/2019 8:19:35 Enhanced QU : QUM :
15/5/2019 8:19:35 Enhanced QU : QUC :
15/5/2019 8:19:35 Enhanced QU : QUD :
15/5/2019 8:19:35 Server Sent 6
15/5/2019 8:19:35 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
15/5/2019 8:20:39 ip RETRIVED �(,
10.20.15.151, SecurePort: 443
15/5/2019 8:20:39 SETTING REG TO VALUE �(,
HuntForAltLocalIP
secure port 443
15/5/2019 8:20:39 Pipe not found
15/5/2019 8:20:39 The count is 7
15/5/2019 8:20:39 bSet is 1
securePort: 443
15/5/2019 8:20:39 Calling V01
15/5/2019 8:20:39 Merlin version 354
15/5/2019 8:20:39 Signature 354
15/5/2019 8:20:40 Wyse Flag value 0011
15/5/2019 8:20:41 The iBLP value -1
15/5/2019 8:20:41 TZ Queried
Number
15/5/2019 8:20:41 FUR : GetCI() 1
15/5/2019 8:20:41 IP matched!
15/5/2019 8:20:41 Subnet
15/5/2019 8:20:41 Gateway #�)
15/5/2019 8:20:41 DS ��)
15/5/2019 8:20:41 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=
15/5/2019 8:20:41 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=
15/5/2019 8:20:41 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=
83FF-9A7F0B2B2
15/5/2019 8:20:41 E1E}
15/5/2019 8:20:41 GetDisplayInfo() return= l,
15/5/2019 8:20:41 Disk offset 659554304
15/5/2019 8:20:41 Disk 0 Part 1 TYPE 260

15/5/2019 8:20:41 Disk 0 Part 5 TYPE 261

15/5/2019 8:20:41 Secure boot = 1

15/5/2019 8:20:41 tempbuff = |WIN0=Internet Explorer is not your default browser
- Internet Explorer provided by Dell Inc.|WIN1=Program Manager|,
15/5/2019 8:20:41 num=0
15/5/2019 8:20:41 Msg recd from AgentGUI:|WIN0=Internet Explorer is not your
default browser - Internet Explorer provided by Dell Inc.|WIN1=Progra
15/5/2019 8:20:41 m Manager|
15/5/2019 8:20:41 Got reply from AgentUI=�~.
15/5/2019 8:20:41 return from ListAllApps=�,
15/5/2019 8:20:48 size of qfe list 64
15/5/2019 8:20:48 Value found for LocalXMLPath = �v-
15/5/2019 8:20:48 WDAVersion = 12.1.1.25
15/5/2019 8:20:48 GetCI() done
15/5/2019 8:20:48 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
PRC2=wininit.exe|PRC3=csrss.exe|PRC4=winlogon.exe|PRC5=services.exe|PRC6=lsass.exe
15/5/2019 8:20:48 vchost.exe|PRC15=svchost.exe|PRC16=DtcPlatformSvc.exe|
PRC17=Explorer.EXE|PRC18=spoolsv.exe|PRC19=svchost.exe|PRC20=taskhostex.ex
15/5/2019 8:20:48 e|PRC21=svchost.exe|PRC22=svchost.exe|PRC23=mqsvc.exe|
15/5/2019 8:20:48 =snmp.exe|PRC28=tvnserver.exe|PRC29=UWFSvc.exe|
PRC30=MsMpEng.exe|PRC31=wsnm.exe|PRC32=DtcWDAService.exe|PRC33=mqtgsvc.exe|PRC34=
15/5/2019 8:20:48 vmware-usbarbitrator64.exe|PRC35=vmware-view-usbd.exe|
PRC36=svchost.exe|PRC37=wmiprvse.exe|PRC38=SearchIndexer.exe|PRC39=DtcWdaU
15/5/2019 8:20:48 i.exe|PRC40=hagent.exe|PRC41=HAgent_UI.exe|
PRC46=
15/5/2019 8:20:48 PNUSBCLITRAY.exe|PRC47=PNTray.exe|PRC48=Receiver.exe|
PRC49=SelfServicePlugin.exe|PRC50=wfcrun32.exe|PRC51=CcmExec.exe|PRC52=wmip
15/5/2019 8:20:48 rvse.exe|PRC53=wmiprvse.exe|PRC54=iexplore.exe|
PRC55=IEXPLORE.EXE|PRC56=FlashUtil64_11_7_700_169_ActiveX.exe|PRC57=IEXPLORE.EXE|
15/5/2019 8:20:48 PRC58=svchost.exe|PRC59=wmiprvse.exe|
PRC60=SelfServicePlugin.exe|PRC61=wfcrun32.exe||
WIN0=InternetüExplorerüisünotüyourüdef
15/5/2019 8:20:48 aultübrowserü-üInternetüExplorerüprovidedübyüDellüInc.|
WIN1=ProgramüManager||PMIU=36|TBPM=7786256|FBPM=4972520|TBPF=778
15/5/2019 8:20:48 6256|FBPF=4791636|TBVM=8589934464|FKVM=8589865384|FKEM=0|
CPRMS0=7,0,7|NIC0IP=10.28.1.79|NIC0DESC=Ethernet,InventecüPCIeüGBEüF
15/5/2019 8:20:48 amilyüControllerü#2|NIC0MAC=008064FB707A|RECP0=41713|
SENDP0=7592|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,Bluetooth
15/5/2019 8:20:48 üDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|
SENDP1=0|MIBSP1=3üMbps||NIC2IP=10.28.69.135|NIC2DESC=Ethernet,
15/5/2019 8:20:48 Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|
RECP2=108|SENDP2=56|MIBSP2=29üMbps|QFEL=KB2727528,KB2729462,KB2737
15/5/2019 8:20:48
,KB2778344,KB2778930,KB2779562,KB2779768,KB27
15/5/2019 8:20:48
00,KB2793210,KB2794119,KB2794599,KB2795944,KB
15/5/2019 8:20:48
5222,KB2805227,KB2807986,KB2808679,KB2808735,
15/5/2019 8:20:48
821895,KB2822241,KB2829069,KB2829254,KB282936
15/5/2019 8:20:48
B2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|C
15/5/2019 8:20:48 :\ProgramüFiles\7-Zip\|18.05|
AP2=Mozillaü
15/5/2019 8:20:48 MaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOf
15/5/2019 8:20:48 ficeüProfessionalüPlusü2013|
15/5/2019 8:20:48 ableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=MicrosoftüSilve
15/5/2019 8:20:48 rlight|c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000
15/5/2019 8:20:48 |AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwar
15/5/2019 8:20:48 eüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|AP
15/5/2019 8:20:48 12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|
15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|C:\Windows\Sy
15/5/2019 8:20:48 stem32\fbwfmgr.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.E
15/5/2019 8:20:48 XE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1
15/5/2019 8:20:48 017|AP16=MicrosoftüPowerPoint|
C:\ProgramüFiles\TightVN
15/5/2019 8:20:48 C\tvnserver.exe|2.6.4.0|
AP19=WindowsüCon
15/5/2019 8:20:48 tacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\Windo
15/5/2019 8:20:48 wsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|
15/5/2019 8:20:48 WDA=1|WCMSupp=1|WCMJSONSupp=1|
15/5/2019 8:20:48 Found HS Tag
ProcessMsg!
then clear it here
15/5/2019 8:20:48 Server Sent 5
15/5/2019 8:20:48 Enhanced QU : QUM :
15/5/2019 8:20:48 Enhanced QU : QUC :
15/5/2019 8:20:48 Enhanced QU : QUD :
15/5/2019 8:20:48 Server Sent 6
15/5/2019 8:20:48 LOOKING FOR &04
15/5/2019 8:20:48 FUR :After S&P done
15/5/2019 8:23:36 Received data: �*.
Accept: */*
Connection: close
15/5/2019 8:23:36 =0.7,*;q=0.7

Accept: */*
Connection: close
15/5/2019 8:23:36 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
15/5/2019 8:23:37 ip RETRIVED p7,
10.20.15.151, SecurePort: 443
15/5/2019 8:23:37 SETTING REG TO VALUE p7,
HuntForAltLocalIP
secure port 443
15/5/2019 8:23:37 Pipe not found
15/5/2019 8:23:37 The count is 7
15/5/2019 8:23:37 bSet is 1
securePort: 443
15/5/2019 8:23:37 Calling V01
15/5/2019 8:23:37 Merlin version 354
15/5/2019 8:23:37 Signature 354
15/5/2019 8:23:37 Wyse Flag value 0011
15/5/2019 8:23:38 The iBLP value -1
15/5/2019 8:23:38 TZ Queried
Number
15/5/2019 8:23:38 FUR : GetCI() 1
15/5/2019 8:23:38 IP matched!
15/5/2019 8:23:38 Subnet
15/5/2019 8:23:38 Gateway #�)
15/5/2019 8:23:38 DS ��)
15/5/2019 8:23:38 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=@�/
15/5/2019 8:23:38 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=@�/
15/5/2019 8:23:38 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=@�/
83FF-9A7F0B2B2
15/5/2019 8:23:38 E1E}
15/5/2019 8:23:38 GetDisplayInfo() return=�70
15/5/2019 8:23:38 Disk offset 659554304
15/5/2019 8:23:38 Disk 0 Part 1 TYPE 260
15/5/2019 8:23:39 Disk 0 Part 5 TYPE 261

15/5/2019 8:23:39 Secure boot = 1

15/5/2019 8:23:39 tempbuff = |WIN0=1 - problemas-resueltos-equilibrio-
termico.pdf - Mozilla Firefox|WIN1=Program Manager|, num=0
15/5/2019 8:23:39 Msg recd from AgentGUI:|WIN0=1 - problemas-resueltos-
equilibrio-termico.pdf - Mozilla Firefox|WIN1=Program Manager|
15/5/2019 8:23:44 size of qfe list 64
15/5/2019 8:23:44 Value found for LocalXMLPath = `#)
15/5/2019 8:23:44 WDAVersion = 12.1.1.25
15/5/2019 8:23:44 GetCI() done
15/5/2019 8:23:44 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
15/5/2019 8:23:44 vchost.exe|PRC15=svchost.exe|PRC16=DtcPlatformSvc.exe|
PRC17=Explorer.EXE|PRC18=spoolsv.exe|PRC19=svchost.exe|PRC20=taskhostex.ex
15/5/2019 8:23:44 e|PRC21=svchost.exe|PRC22=svchost.exe|PRC23=mqsvc.exe|
15/5/2019 8:23:44 =snmp.exe|PRC28=tvnserver.exe|PRC29=UWFSvc.exe|
PRC30=MsMpEng.exe|PRC31=wsnm.exe|PRC32=DtcWDAService.exe|PRC33=mqtgsvc.exe|PRC34=
15/5/2019 8:23:44 vmware-usbarbitrator64.exe|PRC35=vmware-view-usbd.exe|
PRC36=svchost.exe|PRC37=wmiprvse.exe|PRC38=SearchIndexer.exe|PRC39=DtcWdaU
15/5/2019 8:23:44 i.exe|PRC40=hagent.exe|PRC41=HAgent_UI.exe|
PRC46=
15/5/2019 8:23:44 PNUSBCLITRAY.exe|PRC47=PNTray.exe|PRC48=Receiver.exe|
PRC49=SelfServicePlugin.exe|PRC50=wfcrun32.exe|PRC51=CcmExec.exe|PRC52=wmip
15/5/2019 8:23:44 rvse.exe|PRC53=wmiprvse.exe|PRC54=svchost.exe|
PRC55=wmiprvse.exe|PRC56=firefox.exe|PRC57=firefox.exe|PRC58=firefox.exe|PRC59=fir
15/5/2019 8:23:44 efox.exe|PRC60=firefox.exe|PRC61=taskeng.exe||WIN0=1ü-
üproblemas-resueltos-equilibrio-termico.pdfü-üMozillaüFirefox|WIN1=Pr
15/5/2019 8:23:44 ogramüManager||PMIU=40|TBPM=7786256|FBPM=4650472|TBPF=7786256|
FBPF=4419408|TBVM=8589934464|FKVM=8589865384|FKEM=0|CPRMS0=9,2,7|
15/5/2019 8:23:44 NIC0IP=10.28.1.79|
NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|
RECP0=52253|SENDP0=12533|MI
15/5/2019 8:23:44 BSP0=1000üMbps||NIC1IP=0.0.0.0|
RECP1=0|SEND
15/5/2019 8:23:44 P1=0|MIBSP1=3üMbps||NIC2IP=10.28.69.135|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=29
15/5/2019 8:23:44 9|SENDP2=149|MIBSP2=24üMbps|
5,KB2769166,KB27
15/5/2019 8:23:44
94,KB2785220,KB2789649,KB2789650,KB2790655,KB
15/5/2019 8:23:44
8804,KB2798805,KB2799494,KB2800033,KB2804583,
15/5/2019 8:23:44
812822,KB2813170,KB2813430,KB2817183,KB281860
15/5/2019 8:23:44
B2832450,KB2836946,KB2836947,KB2836988,KB2838
15/5/2019 8:23:44 727,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües
15/5/2019 8:23:44 -ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|C:\Progr
15/5/2019 8:23:44 amüFiles\MicrosoftüOffice|15.0.4420.1017|
15/5/2019 8:23:44 15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-
üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWindows�
15/5/2019 8:23:44 �EmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=Mic
15/5/2019 8:23:44 rosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|
AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=
15/5/2019 8:23:44 VMwareüHorizonüViewüClient|
C:\ProgramüFiles�
15/5/2019 8:23:44 �(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.442
15/5/2019 8:23:44 0.1017|AP13=File-basedüwriteüfilterümanager|
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=DiagnosticsüutilityüforüInterne
15/5/2019 8:23:44 tüExplorer|C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|
10.0.9200.16384|AP15=OfficeüXMLüHandler|C:\ProgramüFiles\Commo
15/5/2019 8:23:44 nüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPN
15/5/2019 8:23:44 T.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManage
15/5/2019 8:23:44 r|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Mi
15/5/2019 8:23:44 crosoftü(R)üContactsüImportüTool|
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\
15/5/2019 8:23:44 MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|
WDA=1|WCMSupp=1|WCMJSONSupp=1|
15/5/2019 8:23:44 Found HS Tag
ProcessMsg!
then clear it here
15/5/2019 8:23:45 Server Sent 5
15/5/2019 8:23:45 Enhanced QU : QUM :
15/5/2019 8:23:45 Enhanced QU : QUC :
15/5/2019 8:23:45 Enhanced QU : QUD :
15/5/2019 8:23:45 Server Sent 6
15/5/2019 8:23:45 LOOKING FOR &04
15/5/2019 8:23:45 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
15/5/2019 9:27:22 ip RETRIVED p&,
10.20.15.151, SecurePort: 443
15/5/2019 9:27:22 SETTING REG TO VALUE p&,
HuntForAltLocalIP
secure port 443
15/5/2019 9:27:22 Pipe not found
15/5/2019 9:27:22 The count is 7
15/5/2019 9:27:22 bSet is 1
securePort: 443
15/5/2019 9:27:22 WDAVersion = 12.1.1.25
15/5/2019 9:27:23 The iBLP value -1
WDA=1|WCMSupp=1|WCMJSONSupp=1|TPA=0|TPE=0|TPI=0|BLP=-1|BLE=-1|BLC=-1
15/5/2019 9:27:24 |VI=1|
15/5/2019 9:27:24 Found HS Tag
ProcessMsg!
then clear it here
15/5/2019 9:27:24 Server Sent 5
15/5/2019 9:27:24 Enhanced QU : QUM :
15/5/2019 9:27:24 Enhanced QU : QUC :
15/5/2019 9:27:24 Enhanced QU : QUD :
15/5/2019 9:27:24 Server Sent 6
15/5/2019 9:27:24 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
15/5/2019 10:31:1 ip RETRIVED #B,
10.20.15.151, SecurePort: 443
15/5/2019 10:31:2 SETTING REG TO VALUE #B,
HuntForAltLocalIP
secure port 443
15/5/2019 10:31:2 Pipe not found
15/5/2019 10:31:2 The count is 7
15/5/2019 10:31:2 bSet is 1
securePort: 443
15/5/2019 10:31:2 WDAVersion = 12.1.1.25
15/5/2019 10:31:2 The iBLP value -1
WDA=1|WCMSupp=1|WCMJSONSupp=1|TPA=0|TPE=0|TPI=0|BLP=-1|BLE=-1|BLC=-1
15/5/2019 10:31:3 |VI=1|
15/5/2019 10:31:3 Found HS Tag
ProcessMsg!
then clear it here
15/5/2019 10:31:3 Server Sent 5
15/5/2019 10:31:3 Enhanced QU : QUM :
15/5/2019 10:31:3 Enhanced QU : QUC :
15/5/2019 10:31:3 Enhanced QU : QUD :
15/5/2019 10:31:3 Server Sent 6
15/5/2019 10:31:3 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
15/5/2019 11:30:19 ip RETRIVED �(,
10.20.15.151, SecurePort: 443
15/5/2019 11:30:19 SETTING REG TO VALUE �(,
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
15/5/2019 11:30:19 Error: Unable To Connect To AgentUIFor Message
15/5/2019 11:30:19 Pipe not found
15/5/2019 11:30:19 The count is 7
15/5/2019 11:30:19 bCheckServer is 1
15/5/2019 11:30:19 bSet is 1
securePort: 443
15/5/2019 11:30:19 Calling V01
15/5/2019 11:30:19 Merlin version 354
15/5/2019 11:30:19 Signature 354
15/5/2019 11:30:20 Wyse Flag value 0011
15/5/2019 11:30:17 The iBLP value -1
15/5/2019 11:30:18 TZ Queried
Number
15/5/2019 11:30:18 FUR : GetCI() 1
15/5/2019 11:30:18 IP matched!
15/5/2019 11:30:18 Subnet
15/5/2019 11:30:18 Gateway #�)
15/5/2019 11:30:18 DS ��)
15/5/2019 11:30:18 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=`�/
15/5/2019 11:30:18 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=`�/
15/5/2019 11:30:18 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=`�/
83FF-9A7F0B2B2
15/5/2019 11:30:18 E1E}
15/5/2019 11:30:18 Disk offset 659554304
15/5/2019 11:30:18 Disk 0 Part 1 TYPE 260

15/5/2019 11:30:18 Disk 0 Part 5 TYPE 261

15/5/2019 11:30:18 Secure boot = 1

15/5/2019 11:30:19 Got reply from AgentUI=�'5
15/5/2019 11:30:19 Error: ListAllApps() didn't recv data
15/5/2019 11:30:21 size of qfe list 0
15/5/2019 11:30:21 Failed to retrieve QFE list.
15/5/2019 11:30:21 Value found for LocalXMLPath = �v-
15/5/2019 11:30:21 WDAVersion = 12.1.1.25
15/5/2019 11:30:21 GetCI() done
15/5/2019 11:30:21 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
15/5/2019 11:30:21 ost.exe|PRC9=atiesrxx.exe|PRC10=svchost.exe|
PRC11=svchost.exe|PRC12=svchost.exe|PRC13=dwm.exe|PRC14=svchost.exe|
PRC15=svchost.ex
15/5/2019 11:30:21 e|PRC16=DtcPlatformSvc.exe|PRC17=spoolsv.exe|
PRC18=svchost.exe|PRC19=svchost.exe|PRC20=svchost.exe|PRC21=mqsvc.exe|PRC22=NetXCle
PRC32=vmware-usbarbitrator64.exe|PRC33=vmware-view-usbd.exe|PRC34=svchost
15/5/2019 11:30:21 .exe|PRC35=wmiprvse.exe|PRC36=SearchIndexer.exe|
PRC37=hagent.exe|PRC38=CcmExec.exe|PRC39=wmiprvse.exe|PRC40=wmiprvse.exe|PRC41=t
15/5/2019 11:30:21 askeng.exe|PRC42=LogonUI.exe|PRC43=SearchProtocolHost.exe|
PRC44=SearchFilterHost.exe|PRC45=wmiprvse.exe|PRC46=CcmExec.exe|PRC47=
15/5/2019 11:30:21 wmiprvse.exe|PRC48=wmiprvse.exe||PMIU=35|TBPM=7786256|
FBPM=5012228|TBPF=7786256|FBPF=4855964|TBVM=8589934464|FKVM=8589864360|FKE
15/5/2019 11:30:21 M=0|CPRMS0=16,0,7|NIC0IP=10.28.1.79|
RECP0=121
15/5/2019 11:30:21 082|SENDP0=42246|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421C
15/5/2019 11:30:21 ED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CE
15/5/2019 11:30:21 D66F6|RECP2=1275|SENDP2=1165|MIBSP2=24üMbps||AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.
15/5/2019 11:30:21 2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü20
15/5/2019 11:30:21 13|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\Microsof
15/5/2019 11:30:21 tüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|AP6=Microsof
15/5/2019 11:30:21 tüWindowsüEmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.2012
15/5/2019 11:30:21 5.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||
8.0.61000|AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1
15/5/2019 11:30:21 .1.25|AP10=VMwareüHorizonüViewüClient|
C:\Prog
15/5/2019 11:30:21 ramüFilesü(x86)\Google\Chrome\Application\chrome.exe|
68.0.3440.106|AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.E
15/5/2019 11:30:21 XE|15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=Diagnosticsüutilityüf
15/5/2019 11:30:21 orüInternetüExplorer|
AP15=OfficeüXMLüHandler|C:\Programü
15/5/2019 11:30:21 Files\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Offic
15/5/2019 11:30:21 e15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=UnifiedüWriteüFilterüMana
15/5/2019 11:30:21 gerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16
15/5/2019 11:30:21 384|AP20=Microsoftü(R)üContactsüImportüTool|
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|C
15/5/2019 11:30:21 :\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|
WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
15/5/2019 11:30:21 Found HS Tag
ProcessMsg!
15/5/2019 11:30:21 Server Sent 5
15/5/2019 11:30:21 Enhanced QU : QUM :
15/5/2019 11:30:21 Enhanced QU : QUC :
15/5/2019 11:30:21 Enhanced QU : QUD :
15/5/2019 11:30:21 Server Sent 6
15/5/2019 11:30:21 LOOKING FOR &04
15/5/2019 11:30:21 FUR :After S&P done
15/5/2019 11:30:25 Stopping
15/5/2019 16:24:34 ***********************************************************
15/5/2019 16:24:34 End of WinMain()
15/5/2019 16:24:34 ^^^^^^^^ after reghanex()
15/5/2019 16:24:54 OS Version 6.2.9200
15/5/2019 16:24:54 OS Version 6.2.9200
15/5/2019 16:24:54 Major version 6
15/5/2019 16:24:54 Minor version 2
15/5/2019 16:24:54 Device Info: OS is p�5
15/5/2019 16:24:54 The image has UWF
15/5/2019 16:24:54 WRITE FILTER UWF 1
15/5/2019 16:24:54 Setting UWF Mgr!
15/5/2019 16:24:55 Disk offset 659554304
15/5/2019 16:24:55 Disk offset =1048576

15/5/2019 16:24:55 Disk offset =105906176
15/5/2019 16:24:55 Disk offset =420478976
15/5/2019 16:24:55 Disk offset =525336576
15/5/2019 16:24:55 Disk offset =659554304

'Z:\',error=1
15/5/2019 16:24:55 AF_INET (IPv4)
15/5/2019 16:24:55 IPv4 address 169.254.150.182

15/5/2019 16:24:55 Valid IP Found

15/5/2019 16:24:55 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
15/5/2019 16:24:55 HA Supported
15/5/2019 16:24:55 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1231618391
15/5/2019 16:24:55 ip RETRIVED
10.20.15.151, SecurePort: 443
HServer
Port: 0
15/5/2019 16:25:0 Failed to Bind
ms
reported: 28
15/5/2019 16:25:1 C80B-4C42-8011-32B62020ACA3}, Type=6
15/5/2019 16:25:1 476A-8590-E6333C53F805}, Type=71
secure port 443
15/5/2019 16:25:2 Pipe not found
15/5/2019 16:25:2 The count is 7
15/5/2019 16:25:2 bSet is 1
securePort: 443
15/5/2019 16:25:3 Calling V01
15/5/2019 16:25:3 Merlin version 354
15/5/2019 16:25:3 Signature 354
15/5/2019 16:25:3 Wyse Flag value 0011
15/5/2019 16:25:4 The iBLP value -1
15/5/2019 16:25:5 TZ Queried
Number
15/5/2019 16:25:5 FUR : GetCI() 1
15/5/2019 16:25:5 IP matched!
15/5/2019 16:25:5 Subnet `�3
15/5/2019 16:25:5 Gateway �3
15/5/2019 16:25:5 DS P�3
15/5/2019 16:25:5 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=��8
15/5/2019 16:25:5 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=��8
15/5/2019 16:25:5 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=��8
83FF-9A7F0B2B2
15/5/2019 16:25:5 E1E}
15/5/2019 16:25:5 Got reply from AgentUI=�#;
15/5/2019 16:25:5 GetDisplayInfo() return=P
5
15/5/2019 16:25:5 Disk offset 659554304
15/5/2019 16:25:5 Disk 0 Part 1 TYPE 260

15/5/2019 16:25:5 Disk 0 Part 5 TYPE 261

15/5/2019 16:25:5 Secure boot = 1

15/5/2019 16:25:5 tempbuff = |WIN0=Libro1 - Excel|WIN1=Program Manager|, num=0
15/5/2019 16:25:5 Msg recd from AgentGUI:|WIN0=Libro1 - Excel|WIN1=Program
Manager|
15/5/2019 16:25:5 Got reply from AgentUI=`�:
15/5/2019 16:25:12 size of qfe list 64
15/5/2019 16:25:13 Value found for LocalXMLPath = Ѕ8
15/5/2019 16:25:13 WDAVersion = 12.1.1.25
15/5/2019 16:25:13 GetCI() done
'Z:\',error=1
securePort: 443
15/5/2019 16:25:13 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
D0PAR5SZ=30708596
15/5/2019 16:25:13 PRC21=svchost.exe|PRC22=taskhostex.exe|PRC23=svchost.exe|
PRC24=GoogleUpdate.exe|PRC25=svchost.exe|PRC26=mqsvc.exe|PRC27=NetXClea
15/5/2019 16:25:13 34=wsnm.exe|PRC35=DtcWDAService.exe|PRC36=wmiprvse.exe|
PRC37=mqtgsvc.exe|PRC38=vmware-usbarbitrator64.exe|PRC39=GoogleUpdate.exe
15/5/2019 16:25:13 =SearchFilterHost.exe|PRC47=msiexec.exe|PRC48=EXCEL.EXE|
PRC49=DtcWdaUi.exe|PRC50=hagent.exe|PRC51=HAgent_UI.exe|PRC52=tvnserver.
15/5/2019 16:25:13 exe|PRC53=RAVCpl64.exe|PRC54=concentr.exe|
PRC55=redirector.exe|PRC56=PNUSBCLITRAY.exe|PRC57=PNTray.exe|PRC58=Receiver.exe|
PRC59=
15/5/2019 16:25:13 SelfServicePlugin.exe|PRC60=wfcrun32.exe||WIN0=Libro1ü-
üExcel|WIN1=ProgramüManager||PMIU=34|TBPM=7786256|FBPM=5097536|TBPF=77
CPRMS0=0,0,0|NIC0IP=10.28.1.79|NIC0DESC=Ethernet,InventecüPCIeüGBEü
15/5/2019 16:25:13 FamilyüControllerü#2|NIC0MAC=008064FB707A|RECP0=879|
SENDP0=549|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,Bluetoothü
15/5/2019 16:25:13 Deviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|
SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R
15/5/2019 16:25:13 )üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|
15/5/2019 16:25:13
KB2778930,KB2779562,KB2779768,KB2780541,KB278
15/5/2019 16:25:13
0,KB2794119,KB2794599,KB2795944,KB2798162,KB2
15/5/2019 16:25:13
227,KB2807986,KB2808679,KB2808735,KB2809289,K
15/5/2019 16:25:13
22241,KB2829069,KB2829254,KB2829361,KB2829530
15/5/2019 16:25:13
2845690,|AP0=7-Zipü18.05ü(x64)|C:\Programü
15/5/2019 16:25:13 Files\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenance
15/5/2019 16:25:13 üService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOfficeüProfe
15/5/2019 16:25:13 ssionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|
15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx6
15/5/2019 16:25:13 4ü9.0.30729.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\P
15/5/2019 16:25:13 rogramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|AP9=Wyseü
15/5/2019 16:25:13 DeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Cli
15/5/2019 16:25:13 ent\|5.4.0.1219906|AP11=GoogleüChrome|
AP12=Microsof
15/5/2019 16:25:13 tüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|
15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\fbwf
15/5/2019 16:25:13 mgr.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.920
15.0.4420.1017|AP16=Mi
15/5/2019 16:25:13 crosoftüPowerPoint|
C:\ProgramüFiles\TightVNC\tvnserver
15/5/2019 16:25:13 .exe|2.6.4.0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\Pr
15/5/2019 16:25:13 ogramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüMail\wa
15/5/2019 16:25:13 bmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSu
15/5/2019 16:25:13 pp=1|WCMJSONSupp=1|
15/5/2019 16:25:13 Found HS Tag
ProcessMsg!
15/5/2019 16:25:13 Server Sent 5
15/5/2019 16:25:13 Enhanced QU : QUM :
15/5/2019 16:25:13 Enhanced QU : QUC :
15/5/2019 16:25:13 Enhanced QU : QUD :
15/5/2019 16:25:13 Server Sent 6
15/5/2019 16:25:13 LOOKING FOR &04
15/5/2019 16:25:13 FUR :After S&P done
GetServerAddress
securePort: 443
15/5/2019 17:28:40 GetIP :: *** PPP
1325472778
15/5/2019 17:28:40 ip RETRIVED �-9
10.20.15.151, SecurePort: 443
15/5/2019 17:28:40 SETTING REG TO VALUE �-9
reported: 28
15/5/2019 17:28:40 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
15/5/2019 17:28:40 Pipe not found
15/5/2019 17:28:40 The count is 7
15/5/2019 17:28:40 bCheckServer is 1
15/5/2019 17:28:40 bSet is 1
securePort: 443
15/5/2019 17:28:41 Value found for LocalXMLPath = `�8
15/5/2019 17:28:41 WDAVersion = 12.1.1.25
15/5/2019 17:28:42 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
15/5/2019 17:28:42 VI=1|
15/5/2019 17:28:42 Found HS Tag
ProcessMsg!
15/5/2019 17:28:42 Server Sent 5
15/5/2019 17:28:42 Enhanced QU : QUM :
15/5/2019 17:28:42 Enhanced QU : QUC :
15/5/2019 17:28:42 Enhanced QU : QUD :
15/5/2019 17:28:43 Server Sent 6
15/5/2019 17:28:43 LOOKING FOR &04
15/5/2019 17:41:18 Stopping
15/5/2019 18:6:6 ***********************************************************
15/5/2019 18:6:6 End of WinMain()
15/5/2019 18:6:6 ^^^^^^^^ after reghanex()
15/5/2019 18:6:26 OS Version 6.2.9200
15/5/2019 18:6:26 OS Version 6.2.9200
15/5/2019 18:6:26 Major version 6
15/5/2019 18:6:26 Minor version 2
15/5/2019 18:6:26 Device Info: OS is ��*
15/5/2019 18:6:26 WRITE FILTER UWF 1
15/5/2019 18:6:26 Setting UWF Mgr!
15/5/2019 18:6:27 Disk offset 659554304
15/5/2019 18:6:27 Disk offset =1048576

15/5/2019 18:6:27 Disk offset =105906176
15/5/2019 18:6:27 Disk offset =420478976
15/5/2019 18:6:27 Disk offset =525336576
15/5/2019 18:6:27 Disk offset =659554304

'Z:\',error=1
15/5/2019 18:6:27 AF_INET (IPv4)
15/5/2019 18:6:27 IPv4 address 169.254.150.182
15/5/2019 18:6:27 Valid IP Found

15/5/2019 18:6:27 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
15/5/2019 18:6:27 HA Supported
15/5/2019 18:6:27 dwHSListCount = 1
GetServerAddress
securePort: 443
15/5/2019 18:6:27 GetIP :: *** PPP
1325472778
15/5/2019 18:6:27 ip RETRIVED ��-
10.20.15.151, SecurePort: 443
15/5/2019 18:6:27 Failed to Bind
HServer
Port: 0
15/5/2019 18:6:27 Failed to Bind
ms
reported: 28
15/5/2019 18:6:27 C80B-4C42-8011-32B62020ACA3}, Type=6
15/5/2019 18:6:27 476A-8590-E6333C53F805}, Type=71
15/5/2019 18:6:32 Failed to Bind
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
15/5/2019 18:6:33 ip RETRIVED �.
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
15/5/2019 18:6:34 Pipe not found
15/5/2019 18:6:34 The count is 7
15/5/2019 18:6:34 bSet is 1
securePort: 443
15/5/2019 18:6:34 Calling V01
15/5/2019 18:6:34 Merlin version 354
15/5/2019 18:6:34 Signature 354
15/5/2019 18:6:35 Wyse Flag value 0011
15/5/2019 18:6:36 The iBLP value -1
15/5/2019 18:6:36 TZ Queried
Number
15/5/2019 18:6:36 FUR : GetCI() 1
15/5/2019 18:6:36 IP matched!
15/5/2019 18:6:36 Subnet ��(
15/5/2019 18:6:36 Gateway
15/5/2019 18:6:36 DS ��(
15/5/2019 18:6:36 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=p�*
15/5/2019 18:6:36 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=p�*
15/5/2019 18:6:36 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=p�*
83FF-9A7F0B2B2
15/5/2019 18:6:36 E1E}
15/5/2019 18:6:36 Got reply from AgentUI=��/
15/5/2019 18:6:36 GetDisplayInfo() return=�Y.
15/5/2019 18:6:36 Disk offset 659554304
15/5/2019 18:6:36 Disk 0 Part 1 TYPE 260

15/5/2019 18:6:36 Disk 0 Part 5 TYPE 261

15/5/2019 18:6:36 Secure boot = 1

15/5/2019 18:6:37 Got reply from AgentUI=�|+
15/5/2019 18:6:37 return from ListAllApps=�L+
15/5/2019 18:6:48 size of qfe list 64
15/5/2019 18:6:49 Value found for LocalXMLPath = @�+
15/5/2019 18:6:49 WDAVersion = 12.1.1.25
15/5/2019 18:6:49 GetCI() done
'Z:\',error=1
securePort: 443
15/5/2019 18:6:49 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
15/5/2019 18:6:49 PRC21=svchost.exe|PRC22=taskhostex.exe|PRC23=GoogleUpdate.exe|
PRC24=svchost.exe|PRC25=svchost.exe|PRC26=mqsvc.exe|PRC27=NetXClea
15/5/2019 18:6:49 34=wsnm.exe|PRC35=DtcWDAService.exe|PRC36=GoogleUpdate.exe|
PRC37=mqtgsvc.exe|PRC38=wmiprvse.exe|PRC39=vmware-usbarbitrator64.exe
PRC42=wmiprvse.exe|PRC43=vssvc.exe|PRC44=SearchIndexer.exe|PRC45=svchost.exe|PRC46
15/5/2019 18:6:49 =SearchFilterHost.exe|PRC47=msiexec.exe|PRC48=DtcWdaUi.exe|
PRC49=hagent.exe|PRC50=HAgent_UI.exe|PRC51=tvnserver.exe|PRC52=RAVCpl
15/5/2019 18:6:49 64.exe|PRC53=concentr.exe|PRC54=redirector.exe|
PRC55=PNUSBCLITRAY.exe|PRC56=PNTray.exe|PRC57=Receiver.exe|PRC58=SelfServicePlugi
15/5/2019 18:6:49 n.exe|PRC59=wfcrun32.exe|PRC60=DllHost.exe|PRC61=chrome.exe|
PRC62=chrome.exe||WIN0=ProgramüManager||PMIU=33|TBPM=7786256|FBPM=5
15/5/2019 18:6:49 154976|TBPF=7786256|FBPF=5083804|TBVM=8589934464|
FKVM=8589864352|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28.1.79|NIC0DESC=Ethernet,Invente
15/5/2019 18:6:49 cüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|
RECP0=1358|SENDP0=788|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ether
15/5/2019 18:6:49 net,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=E
15/5/2019 18:6:49 thernet,Intel(R)üDualüBandüWireless-ACü7260|
NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,KB2729462,KB
15/5/2019 18:6:49
7294,KB2778344,KB2778930,KB2779562,KB2779768,
15/5/2019 18:6:49
792100,KB2793210,KB2794119,KB2794599,KB279594
15/5/2019 18:6:49
B2805222,KB2805227,KB2807986,KB2808679,KB2808
15/5/2019 18:6:49
,KB2821895,KB2822241,KB2829069,KB2829254,KB28
15/5/2019 18:6:49
94,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x6
15/5/2019 18:6:49 4)|C:\ProgramüFiles\7-Zip\|18.05|
AP2=Mozil
15/5/2019 18:6:49 laüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=Microsoft
15/5/2019 18:6:49 üOfficeüProfessionalüPlusü2013|
+ü2008üRedistr
15/5/2019 18:6:49 ibutableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=MicrosoftüS
15/5/2019 18:6:49 ilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.6
12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\V
15/5/2019 18:6:49 MwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.10
basedüwriteüfilterümanager|C:\Window
15/5/2019 18:6:49 s\System32\fbwfmgr.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IEDIAGC
15/5/2019 18:6:49 MD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\Tig
15/5/2019 18:6:49 htVNC\tvnserver.exe|2.6.4.0|
AP19=Windows�
15/5/2019 18:6:49 �Contacts|C:\ProgramüFiles\WindowsüMail\wab.exe|
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\W
15/5/2019 18:6:49 indowsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HAS
15/5/2019 18:6:49 H=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
15/5/2019 18:6:49 Found HS Tag
ProcessMsg!
then clear it here
15/5/2019 18:6:50 Server Sent 5
15/5/2019 18:6:50 Enhanced QU : QUM :
15/5/2019 18:6:50 Enhanced QU : QUC :
15/5/2019 18:6:50 Enhanced QU : QUD :
15/5/2019 18:6:50 Server Sent 6
15/5/2019 18:6:50 LOOKING FOR &04
15/5/2019 18:6:50 FUR :After S&P done
GetServerAddress
443
HuntForAltLocalIP
1325472778
15/5/2019 19:8:7 ip RETRIVED P~.
10.20.15.151, SecurePort: 443
15/5/2019 19:8:7 SETTING REG TO VALUE P~.
HuntForAltLocalIP
secure port 443
15/5/2019 19:8:7 Pipe not found
15/5/2019 19:8:7 The count is 7
15/5/2019 19:8:7 bSet is 1
securePort: 443
15/5/2019 19:8:7 Calling V01
15/5/2019 19:8:7 Merlin version 354
15/5/2019 19:8:7 Signature 354
15/5/2019 19:8:8 Wyse Flag value 0011
15/5/2019 19:8:8 The iBLP value -1
15/5/2019 19:8:9 TZ Queried
15/5/2019 19:8:9 FUR : GetCI() 1
15/5/2019 19:8:9 IP matched!
15/5/2019 19:8:9 Subnet ��(
15/5/2019 19:8:9 Gateway
15/5/2019 19:8:9 DS ��(
83FF-9A7F0B2B2
15/5/2019 19:8:9 E1E}
15/5/2019 19:8:9 Got reply from AgentUI=0S0
15/5/2019 19:8:9 GetDisplayInfo() return=�L+
15/5/2019 19:8:9 Disk offset 659554304
15/5/2019 19:8:9 Disk 0 Part 1 TYPE 260

15/5/2019 19:8:9 Disk 0 Part 5 TYPE 261

15/5/2019 19:8:9 Secure boot = 1

15/5/2019 19:8:9 tempbuff = |WIN0=Correo: Camilo Pe�a - Outlook - Google Chrome|
15/5/2019 19:8:9 Msg recd from AgentGUI:|WIN0=Correo: Camilo Pe�a - Outlook -
Google Chrome|WIN1=Program Manager|
15/5/2019 19:8:9 Got reply from AgentUI=��/
15/5/2019 19:8:9 return from ListAllApps=p�.
15/5/2019 19:8:15 size of qfe list 64
15/5/2019 19:8:15 Value found for LocalXMLPath = 0#(
15/5/2019 19:8:15 WDAVersion = 12.1.1.25
15/5/2019 19:8:15 GetCI() done
15/5/2019 19:8:15 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
UEFISEC=1|DRV0=C:|TB0=30708592640|TFB0=16200671232|DRV1=D:|TB1=7739080704|
15/5/2019 19:8:15 TFB1=7447597056|DRV2=Z:|TB2=1073643520|TFB2=1061584896||
PRC0=smss.exe|PRC1=csrss.exe|PRC2=wininit.exe|PRC3=csrss.exe|PRC4=winlog
15/5/2019 19:8:15 on.exe|PRC5=services.exe|PRC6=lsass.exe|PRC7=svchost.exe|
15/5/2019 19:8:15 PRC12=svchost.exe|PRC13=dwm.exe|PRC14=svchost.exe|
PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|PRC55=chrome.exe|PRC56=chrome.exe|PRC57=ch
15/5/2019 19:8:15 rome.exe|PRC58=chrome.exe|PRC59=chrome.exe|PRC60=chrome.exe|
PRC61=chrome.exe|PRC62=chrome.exe|PRC63=chrome.exe|PRC64=chrome.exe|
15/5/2019 19:8:15 PRC65=chrome.exe|PRC66=chrome.exe|PRC67=chrome.exe|
PRC68=chrome.exe|PRC69=chrome.exe|PRC70=WUDFHost.exe|PRC71=chrome.exe|PRC72=c
PRC76=chrome.exe|PRC77=chrome.exe|PRC78=taskhostex.exe|PRC79=MpCmdR
15/5/2019 19:8:15 un.exe|PRC80=conhost.exe|PRC81=taskhost.exe|
PRC82=TrustedInstaller.exe|PRC83=TiWorker.exe|PRC84=msiexec.exe|
PRC85=wmiprvse.exe||
15/5/2019 19:8:15 WIN0=Correo:üCamiloüPe�aü-üOutlookü-üGoogleüChrome|
WIN1=ProgramüManager||PMIU=47|TBPM=7786256|FBPM=4079168|TBPF=7786256|
15/5/2019 19:8:15 FBPF=3591984|TBVM=8589934464|FKVM=8589865384|FKEM=0|
CPRMS0=55,55,55|NIC0IP=10.28.1.79|NIC0DESC=Ethernet,InventecüPCIeüGBEüFam
15/5/2019 19:8:15 ilyüControllerü#2|NIC0MAC=008064FB707A|RECP0=243557|
SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel
15/5/2019 19:8:15 (R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|
15/5/2019 19:8:15
4,KB2778930,KB2779562,KB2779768,KB2780541,KB2
15/5/2019 19:8:15
210,KB2794119,KB2794599,KB2795944,KB2798162,K
15/5/2019 19:8:15
05227,KB2807986,KB2808679,KB2808735,KB2809289
15/5/2019 19:8:15
2822241,KB2829069,KB2829254,KB2829361,KB28295
15/5/2019 19:8:15
KB2845690,|AP0=7-Zipü18.05ü(x64)|C:\Program
15/5/2019 19:8:15 üFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenan
15/5/2019 19:8:15 ceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOfficeüPro
15/5/2019 19:8:15 fessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|
15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-ü
15/5/2019 19:8:15 x64ü9.0.30729.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:
15/5/2019 19:8:15 \ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|AP9=Wyse
15/5/2019 19:8:15 üDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\C
15/5/2019 19:8:15 lient\|5.4.0.1219906|AP11=GoogleüChrome|
AP12=Micros
15/5/2019 19:8:15 oftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|
15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\fb
15/5/2019 19:8:15 wfmgr.EXE|2.0.449.0|
15.0.4420.1017|AP16=
15/5/2019 19:8:15 MicrosoftüPowerPoint|
C:\ProgramüFiles\TightVNC\tvnserv
15/5/2019 19:8:15 er.exe|2.6.4.0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\
15/5/2019 19:8:15 ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüMail\
15/5/2019 19:8:15 wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCM
15/5/2019 19:8:15 Supp=1|WCMJSONSupp=1|
15/5/2019 19:8:15 Found HS Tag
ProcessMsg!
then clear it here
15/5/2019 19:8:15 Server Sent 5
15/5/2019 19:8:15 Enhanced QU : QUM :
15/5/2019 19:8:15 Enhanced QU : QUC :
15/5/2019 19:8:15 Enhanced QU : QUD :
15/5/2019 19:8:15 Server Sent 6
15/5/2019 19:8:15 LOOKING FOR &04
15/5/2019 19:8:15 FUR :After S&P done
16/5/2019 7:21:33 ***********************************************************
16/5/2019 7:21:33 End of WinMain()
16/5/2019 7:21:33 ^^^^^^^^ after reghanex()
16/5/2019 7:21:53 OS Version 6.2.9200
16/5/2019 7:21:53 OS Version 6.2.9200
16/5/2019 7:21:53 Major version 6
16/5/2019 7:21:53 Minor version 2
16/5/2019 7:21:53 Device Info: OS is @�/
16/5/2019 7:21:53 WRITE FILTER UWF 1
16/5/2019 7:21:53 Setting UWF Mgr!
16/5/2019 7:21:54 Disk offset 659554304
16/5/2019 7:21:54 Disk offset =1048576

16/5/2019 7:21:54 Disk offset =105906176
16/5/2019 7:21:54 Disk offset =420478976
16/5/2019 7:21:54 Disk offset =525336576
16/5/2019 7:21:54 Disk offset =659554304

'Z:\',error=1
16/5/2019 7:21:54 AF_INET (IPv4)
16/5/2019 7:21:54 IPv4 address 169.254.150.182
16/5/2019 7:21:54 Valid IP Found

16/5/2019 7:21:54 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
16/5/2019 7:21:54 HA Supported
16/5/2019 7:21:54 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1231618391
16/5/2019 7:21:54 ip RETRIVED @#2
10.20.15.151, SecurePort: 443
HServer
Port: 0
16/5/2019 7:21:59 Failed to Bind
ms
reported: 28
16/5/2019 7:22:0 C80B-4C42-8011-32B62020ACA3}, Type=6
16/5/2019 7:22:0 476A-8590-E6333C53F805}, Type=71
secure port 443
16/5/2019 7:22:1 Pipe not found
16/5/2019 7:22:1 The count is 7
16/5/2019 7:22:1 bSet is 1
securePort: 443
16/5/2019 7:22:1 Calling V01
16/5/2019 7:22:1 Merlin version 354
16/5/2019 7:22:1 Signature 354
16/5/2019 7:22:2 Wyse Flag value 0011
16/5/2019 7:22:3 The iBLP value -1
16/5/2019 7:22:3 TZ Queried
16/5/2019 7:22:3 FUR : GetCI() 1
16/5/2019 7:22:3 IP matched!
16/5/2019 7:22:3 Subnet @�-
16/5/2019 7:22:3 Gateway ��-
16/5/2019 7:22:3 DS 0�-
16/5/2019 7:22:3 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=P63
16/5/2019 7:22:3 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=P63
16/5/2019 7:22:3 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=P63
83FF-9A7F0B2B2
16/5/2019 7:22:3 E1E}
16/5/2019 7:22:3 Got reply from AgentUI=�#/
16/5/2019 7:22:3 Disk offset 659554304
16/5/2019 7:22:3 Disk 0 Part 1 TYPE 260

16/5/2019 7:22:4 Disk 0 Part 5 TYPE 261

16/5/2019 7:22:4 Secure boot = 1

16/5/2019 7:22:4 tempbuff = |, num=0
16/5/2019 7:22:4 Got reply from AgentUI=p�3
16/5/2019 7:22:4 return from ListAllApps=`�3
16/5/2019 7:22:11 size of qfe list 64
16/5/2019 7:22:11 Value found for LocalXMLPath = p#4
16/5/2019 7:22:11 WDAVersion = 12.1.1.25
16/5/2019 7:22:11 GetCI() done
'Z:\',error=1
securePort: 443
16/5/2019 7:22:11 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
16/5/2019 7:22:11 ost.exe|PRC9=atiesrxx.exe|PRC10=svchost.exe|PRC11=svchost.exe|
PRC12=svchost.exe|PRC13=svchost.exe|PRC14=dwm.exe|PRC15=svchost.ex
16/5/2019 7:22:11 e|PRC16=svchost.exe|PRC17=DtcPlatformSvc.exe|
PRC18=spoolsv.exe|PRC19=svchost.exe|PRC20=Explorer.EXE|PRC21=svchost.exe|PRC22=svch
16/5/2019 7:22:11 ost.exe|PRC23=mqsvc.exe|PRC24=NetXClean.exe|
PRC25=pnusbvirtualhubwssrv.exe|PRC26=taskhostex.exe|PRC27=tcpsvcs.exe|
PRC28=GoogleUp
16/5/2019 7:22:11 date.exe|PRC29=snmp.exe|PRC30=tvnserver.exe|PRC31=UWFSvc.exe|
PRC32=MsMpEng.exe|PRC33=wsnm.exe|PRC34=DtcWDAService.exe|PRC35=mqtg
16/5/2019 7:22:11 svc.exe|PRC36=wmiprvse.exe|PRC37=vmware-usbarbitrator64.exe|
PRC38=vmware-view-usbd.exe|PRC39=svchost.exe|PRC40=GoogleUpdate.exe|
16/5/2019 7:22:11 PRC41=wmiprvse.exe|PRC42=svchost.exe|PRC43=vssvc.exe|
PRC44=SearchIndexer.exe|PRC45=svchost.exe|PRC46=SearchFilterHost.exe|PRC47=
16/5/2019 7:22:11 msiexec.exe|PRC48=DtcWdaUi.exe|PRC49=hagent.exe|
PRC50=HAgent_UI.exe|PRC51=tvnserver.exe|PRC52=RAVCpl64.exe|PRC53=concentr.exe|PR
16/5/2019 7:22:11 C54=redirector.exe|PRC55=PNUSBCLITRAY.exe|PRC56=PNTray.exe|
PRC57=Receiver.exe|PRC58=SelfServicePlugin.exe|PRC59=wfcrun32.exe|PRC
16/5/2019 7:22:11 60=WOWReg32.exe|PRC61=WOWReg32.exe|PRC62=WOWReg32.exe|||
NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=
16/5/2019 7:22:11
B2780541,KB2781197,KB2785094,KB2785220,KB2789
16/5/2019 7:22:11
,KB2798162,KB2798802,KB2798804,KB2798805,KB27
16/5/2019 7:22:11
35,KB2809289,KB2811660,KB2812822,KB2813170,KB
16/5/2019 7:22:11
9361,KB2829530,KB2830290,KB2832450,KB2836946,
16/5/2019 7:22:11 KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|
16/5/2019 7:22:11 �Chrome|
16/5/2019 7:22:11 er|
16/5/2019 7:22:12 Found HS Tag
ProcessMsg!
then clear it here
16/5/2019 7:22:12 Server Sent 5
16/5/2019 7:22:12 Enhanced QU : QUM :
16/5/2019 7:22:12 Enhanced QU : QUC :
16/5/2019 7:22:12 Enhanced QU : QUD :
16/5/2019 7:22:12 Server Sent 6
16/5/2019 7:22:12 LOOKING FOR &04
16/5/2019 7:22:12 FUR :After S&P done
16/5/2019 7:24:22 Stopping
16/5/2019 7:27:0 ***********************************************************
16/5/2019 7:27:0 End of WinMain()
16/5/2019 7:27:0 ^^^^^^^^ after reghanex()
16/5/2019 7:27:21 OS Version 6.2.9200
16/5/2019 7:27:21 OS Version 6.2.9200
16/5/2019 7:27:21 Major version 6
16/5/2019 7:27:21 Minor version 2
16/5/2019 7:27:21 Device Info: OS is 0�.
16/5/2019 7:27:21 WRITE FILTER UWF 1
16/5/2019 7:27:21 Setting UWF Mgr!
16/5/2019 7:27:21 Disk offset 659554304
16/5/2019 7:27:21 Disk offset =1048576

16/5/2019 7:27:21 Disk offset =105906176
16/5/2019 7:27:21 Disk offset =420478976
16/5/2019 7:27:21 Disk offset =525336576
16/5/2019 7:27:21 Disk offset =659554304

'Z:\',error=1
16/5/2019 7:27:21 AF_INET (IPv4)
16/5/2019 7:27:21 IPv4 address 169.254.150.182

16/5/2019 7:27:21 Valid IP Found

16/5/2019 7:27:21 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
16/5/2019 7:27:21 Data recieved from xmlquery "10.20.15.151" "0" 443
securePort: 443
securePort: 443
16/5/2019 7:27:21 HA Supported
16/5/2019 7:27:21 dwHSListCount = 1
GetServerAddress
securePort: 443
16/5/2019 7:27:21 GetIP :: *** PPP
1325472778
16/5/2019 7:27:21 ip RETRIVED @�1
10.20.15.151, SecurePort: 443
16/5/2019 7:27:21 Failed to Bind
HServer
Port: 0
16/5/2019 7:27:22 Failed to Bind
ms
reported: 28
16/5/2019 7:27:22 C80B-4C42-8011-32B62020ACA3}, Type=6
16/5/2019 7:27:22 476A-8590-E6333C53F805}, Type=71
16/5/2019 7:27:27 Failed to Bind
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
16/5/2019 7:27:27 ip RETRIVED p�2
10.20.15.151, SecurePort: 443
16/5/2019 7:27:27 SETTING REG TO VALUE p�2
HuntForAltLocalIP
secure port 443
16/5/2019 7:27:28 Pipe not found
16/5/2019 7:27:28 The count is 7
16/5/2019 7:27:28 bSet is 1
securePort: 443
16/5/2019 7:27:29 Calling V01
16/5/2019 7:27:29 Merlin version 354
16/5/2019 7:27:29 Signature 354
16/5/2019 7:27:30 Wyse Flag value 0011
16/5/2019 7:27:30 The iBLP value -1
16/5/2019 7:27:31 TZ Queried
Number
16/5/2019 7:27:31 FUR : GetCI() 1
16/5/2019 7:27:31 IP matched!
16/5/2019 7:27:31 Subnet ��,
16/5/2019 7:27:31 Gateway `�,
16/5/2019 7:27:31 DS �,
16/5/2019 7:27:31 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=#�.
16/5/2019 7:27:31 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=#�.
16/5/2019 7:27:31 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=#�.
83FF-9A7F0B2B2
16/5/2019 7:27:31 E1E}
16/5/2019 7:27:31 GetDisplayInfo() return=�q4
16/5/2019 7:27:31 Disk offset 659554304
16/5/2019 7:27:31 Disk 0 Part 1 TYPE 260

16/5/2019 7:27:31 Disk 0 Part 5 TYPE 261

16/5/2019 7:27:31 Secure boot = 1

16/5/2019 7:27:31 tempbuff = |, num=0
16/5/2019 7:27:31 Got reply from AgentUI=`#4
16/5/2019 7:27:31 return from ListAllApps=�!4
16/5/2019 7:27:38 size of qfe list 64
16/5/2019 7:27:39 WDAVersion = 12.1.1.25
16/5/2019 7:27:39 GetCI() done
'Z:\',error=1
securePort: 443
16/5/2019 7:27:39 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
16/5/2019 7:27:39 34=wsnm.exe|PRC35=DtcWDAService.exe|PRC36=mqtgsvc.exe|
PRC37=vmware-usbarbitrator64.exe|PRC38=wmiprvse.exe|PRC39=GoogleUpdate.exe
16/5/2019 7:27:39 =SearchFilterHost.exe|PRC47=msiexec.exe|PRC48=DtcWdaUi.exe|
16/5/2019 7:27:39 n.exe|PRC59=wfcrun32.exe|||PMIU=33|TBPM=7786256|FBPM=5174852|
TBPF=7786256|FBPF=5110900|TBVM=8589934464|FKVM=8589864352|FKEM=0|CP
16/5/2019 7:27:39 RMS0=0,0,0|NIC0IP=10.28.1.79|
RECP0=611|SENDP0
16/5/2019 7:27:39 =388|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|
RECP1
16/5/2019 7:27:39 =0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=
16/5/2019 7:27:39 0|SENDP2=0|MIBSP2=0üMbps|
5,KB2769166,KB27709
16/5/2019 7:27:39
KB2785220,KB2789649,KB2789650,KB2790655,KB279
16/5/2019 7:27:39
4,KB2798805,KB2799494,KB2800033,KB2804583,KB2
16/5/2019 7:27:39
822,KB2813170,KB2813430,KB2817183,KB2818604,K
16/5/2019 7:27:39
32450,KB2836946,KB2836947,KB2836988,KB2838727
16/5/2019 7:27:39 ,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES
16/5/2019 7:27:39 )|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|C:\Program�
16/5/2019 7:27:39 �Files\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|15.
16/5/2019 7:27:39 0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-
üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWindowsüEm
16/5/2019 7:27:39 beddedüKeyboardüFilterüDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=Micros
16/5/2019 7:27:39 oftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|
AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMw
16/5/2019 7:27:39 areüHorizonüViewüClient|
C:\ProgramüFilesü(x
16/5/2019 7:27:39 86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1
16/5/2019 7:27:39 017|AP13=File-basedüwriteüfilterümanager|
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=DiagnosticsüutilityüforüInternetü
16/5/2019 7:27:39 Explorer|C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|
10.0.9200.16384|AP15=OfficeüXMLüHandler|C:\ProgramüFiles\Commonü
16/5/2019 7:27:39 Files\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.E
16/5/2019 7:27:39 XE|15.0.4420.1017|AP17=TightVNC|
AP18=UnifiedüWriteüFilterüManagerüManager|C
16/5/2019 7:27:39 :\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Micro
16/5/2019 7:27:39 softü(R)üContactsüImportüTool|
C:\PROGRA~1\MIC
16/5/2019 7:27:39 ROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|
16/5/2019 7:27:39 Found HS Tag
ProcessMsg!
then clear it here
16/5/2019 7:27:39 Server Sent 5
16/5/2019 7:27:39 Enhanced QU : QUM :
16/5/2019 7:27:39 Enhanced QU : QUC :
16/5/2019 7:27:39 Enhanced QU : QUD :
16/5/2019 7:27:39 Server Sent 6
16/5/2019 7:27:39 LOOKING FOR &04
16/5/2019 7:27:39 FUR :After S&P done
16/5/2019 8:17:4 Received data: ��1
Accept: */*
Connection: close
16/5/2019 8:17:4 =0.7,*;q=0.7

Accept: */*
Connection: close
16/5/2019 8:17:4 9-1,utf-8;q=0.7,*;q=0.7
16/5/2019 8:17:4 Although command was invalid, we do a check-in event to refresh

settings!
16/5/2019 8:17:4 End of CService::NeedsConnection. Return true.
16/5/2019 8:17:4 Setting ServerFound Event
GetServerAddress
443
HuntForAltLocalIP
1325472778
16/5/2019 8:17:5 ip RETRIVED �2
10.20.15.151, SecurePort: 443
16/5/2019 8:17:5 SETTING REG TO VALUE �2
HuntForAltLocalIP
secure port 443
16/5/2019 8:17:5 Pipe not found
16/5/2019 8:17:5 The count is 7
16/5/2019 8:17:5 bSet is 1
securePort: 443
16/5/2019 8:17:5 Calling V01
16/5/2019 8:17:5 Merlin version 354
16/5/2019 8:17:5 Signature 354
16/5/2019 8:17:6 Wyse Flag value 0011
16/5/2019 8:17:7 The iBLP value -1
16/5/2019 8:17:7 TZ Queried
16/5/2019 8:17:7 FUR : GetCI() 1
16/5/2019 8:17:7 IP matched!
16/5/2019 8:17:7 Subnet ��,
16/5/2019 8:17:7 Gateway `�,
16/5/2019 8:17:7 DS �,
16/5/2019 8:17:7 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�#3
16/5/2019 8:17:7 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�#3
16/5/2019 8:17:7 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�#3
83FF-9A7F0B2B2
16/5/2019 8:17:7 E1E}
16/5/2019 8:17:7 Got reply from AgentUI=�F/
16/5/2019 8:17:8 Disk offset 659554304
16/5/2019 8:17:8 Disk 0 Part 1 TYPE 260

16/5/2019 8:17:8 Disk 0 Part 5 TYPE 261

16/5/2019 8:17:8 Secure boot = 1

16/5/2019 8:17:8 tempbuff = |WIN0=taller de ecuaciones e inecuaciones lineal-
cuadrada y raiz (Solo lectura) [Modo de compatibilidad] - Word|WIN1=
16/5/2019 8:17:8 Curso: CALCULO DIFERENCIAL GRUPO 287, Tema: Talleres - Mozilla
Firefox|WIN2=Program Manager|, num=0
16/5/2019 8:17:8 Msg recd from AgentGUI:|WIN0=taller de ecuaciones e
inecuaciones lineal-cuadrada y raiz (Solo lectura) [Modo de compatibilidad]
16/5/2019 8:17:8 - Word|WIN1=Curso: CALCULO DIFERENCIAL GRUPO 287, Tema:
Talleres - Mozilla Firefox|WIN2=Program Manager|
16/5/2019 8:17:8 Got reply from AgentUI=�q4
16/5/2019 8:17:8 return from ListAllApps=p#4
16/5/2019 8:17:14 size of qfe list 64
16/5/2019 8:17:14 Value found for LocalXMLPath = P�/
16/5/2019 8:17:14 WDAVersion = 12.1.1.25
16/5/2019 8:17:14 GetCI() done
16/5/2019 8:17:14 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
16/5/2019 8:17:14 efox.exe|PRC60=firefox.exe|PRC61=firefox.exe|
PRC62=WINWORD.EXE|PRC63=wmiprvse.exe||WIN0=tallerüdeüecuacionesüeüinecuaciones�
16/5/2019 8:17:14 �lineal-
cuadradaüyüraizü(Soloülectura)ü[Modoüdeücompatibilidad]ü-üWord|
WIN1=Curso:üCALCULOüDIFERENCIALüGRUPOü287,ü
16/5/2019 8:17:14 Tema:üTalleresü-üMozillaüFirefox|WIN2=ProgramüManager||
16/5/2019 8:17:14 9934464|FKVM=8589865384|FKEM=0|CPRMS0=22,22,22|
NIC0IP=10.28.1.79|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|N
16/5/2019 8:17:14 IC0MAC=008064FB707A|RECP0=75439|SENDP0=18838|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüA
16/5/2019 8:17:14 reaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWirel
16/5/2019 8:17:14 ess-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|
16/5/2019 8:17:14
KB2779768,KB2780541,KB2781197,KB2785094,KB278
16/5/2019 8:17:14
9,KB2795944,KB2798162,KB2798802,KB2798804,KB2
16/5/2019 8:17:14
679,KB2808735,KB2809289,KB2811660,KB2812822,K
16/5/2019 8:17:14
29254,KB2829361,KB2829530,KB2830290,KB2832450
16/5/2019 8:17:14
,KB2836946,KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|A
16/5/2019 8:17:14 P1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|AP
16/5/2019 8:17:14 3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|
15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
16/5/2019 8:17:14 C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|
AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||9
16/5/2019 8:17:14 .0.30729.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\Micros
16/5/2019 8:17:14 oftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|C:\Pro
16/5/2019 8:17:14 gramüFiles\Wyse\WDA\|12.1.1.25|
5.4.0.1219906|A
16/5/2019 8:17:14 P11=GoogleüChrome|
AP12=MicrosoftüExcel|C:\PROGRA~1
16/5/2019 8:17:14 \MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP
16/5/2019 8:17:14 14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=Office�
16/5/2019 8:17:14 �XMLüHandler|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|
16/5/2019 8:17:14 C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|
AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=Un
16/5/2019 8:17:14 ifiedüWriteüFilterüManagerüManager|
C:\ProgramüFiles\Windows
16/5/2019 8:17:14 üMail\wab.exe|6.2.9200.16384|
6.2.9200.16
16/5/2019 8:17:14 Found HS Tag
ProcessMsg!
then clear it here
16/5/2019 8:17:14 Server Sent 5
16/5/2019 8:17:14 Enhanced QU : QUM :
16/5/2019 8:17:14 Enhanced QU : QUC :
16/5/2019 8:17:14 Enhanced QU : QUD :
16/5/2019 8:17:14 Server Sent 6
16/5/2019 8:17:14 LOOKING FOR &04
16/5/2019 8:17:14 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
16/5/2019 9:20:53 ip RETRIVED `�2
10.20.15.151, SecurePort: 443
16/5/2019 9:20:53 SETTING REG TO VALUE `�2
HuntForAltLocalIP
secure port 443
16/5/2019 9:20:53 Pipe not found
16/5/2019 9:20:53 The count is 7
16/5/2019 9:20:53 bSet is 1
securePort: 443
16/5/2019 9:20:53 WDAVersion = 12.1.1.25
16/5/2019 9:20:54 The iBLP value -1
16/5/2019 9:20:54 -1|VI=1|
16/5/2019 9:20:55 Found HS Tag
ProcessMsg!
then clear it here
16/5/2019 9:20:55 Server Sent 5
16/5/2019 9:20:55 Enhanced QU : QUM :
16/5/2019 9:20:55 Enhanced QU : QUC :
16/5/2019 9:20:55 Enhanced QU : QUD :
16/5/2019 9:20:55 Server Sent 6
16/5/2019 9:20:55 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
16/5/2019 10:24:28 ip RETRIVED
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
16/5/2019 10:24:28 Pipe not found
16/5/2019 10:24:28 The count is 7
16/5/2019 10:24:28 bCheckServer is 1
16/5/2019 10:24:28 bSet is 1
securePort: 443
16/5/2019 10:24:28 WDAVersion = 12.1.1.25
16/5/2019 10:24:29 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
16/5/2019 10:24:29 -1|VI=1|
16/5/2019 10:24:29 Found HS Tag
ProcessMsg!
16/5/2019 10:24:29 Server Sent 5
16/5/2019 10:24:29 Enhanced QU : QUM :
16/5/2019 10:24:29 Enhanced QU : QUC :
16/5/2019 10:24:29 Enhanced QU : QUD :
16/5/2019 10:24:29 Server Sent 6
16/5/2019 10:24:29 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
16/5/2019 11:27:35 ip RETRIVED ��2
10.20.15.151, SecurePort: 443
16/5/2019 11:27:35 SETTING REG TO VALUE ��2
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
16/5/2019 11:27:35 Pipe not found
16/5/2019 11:27:35 The count is 7
16/5/2019 11:27:35 bCheckServer is 1
16/5/2019 11:27:35 bSet is 1
securePort: 443
16/5/2019 11:27:35 WDAVersion = 12.1.1.25
16/5/2019 11:27:35 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
16/5/2019 11:27:36 -1|VI=1|
16/5/2019 11:27:36 Found HS Tag
ProcessMsg!
16/5/2019 11:27:36 Server Sent 5
16/5/2019 11:27:36 Enhanced QU : QUM :
16/5/2019 11:27:36 Enhanced QU : QUC :
16/5/2019 11:27:36 Enhanced QU : QUD :
16/5/2019 11:27:36 Server Sent 6
16/5/2019 11:27:36 LOOKING FOR &04
16/5/2019 12:5:3 Stopping
16/5/2019 12:5:43 ***********************************************************
16/5/2019 12:5:44 End of WinMain()
16/5/2019 12:5:44 ^^^^^^^^ after reghanex()
16/5/2019 12:6:4 OS Version 6.2.9200
16/5/2019 12:6:4 OS Version 6.2.9200
16/5/2019 12:6:4 Major version 6
16/5/2019 12:6:4 Minor version 2
16/5/2019 12:6:4 Device Info: OS is @�&
16/5/2019 12:6:4 Setting UWF Mgr!
16/5/2019 12:6:4 Disk offset 659554304
16/5/2019 12:6:4 Disk offset =1048576

16/5/2019 12:6:4 Disk offset =105906176
16/5/2019 12:6:4 Disk offset =420478976
16/5/2019 12:6:4 Disk offset =525336576
16/5/2019 12:6:4 Disk offset =659554304

'Z:\',error=1
16/5/2019 12:6:4 AF_INET (IPv4)
16/5/2019 12:6:4 IPv4 address 169.254.150.182
16/5/2019 12:6:4 Valid IP Found

16/5/2019 12:6:4 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
443
securePort: 443
16/5/2019 12:6:4 HA Supported
16/5/2019 12:6:4 dwHSListCount = 1
GetServerAddress
443
HuntForAltLocalIP
IN_ADDR : -1231618391
16/5/2019 12:6:4 ip RETRIVED ��*
10.20.15.151, SecurePort: 443
HServer
Port: 0
16/5/2019 12:6:10 Failed to Bind
ms
reported: 28
16/5/2019 12:6:10 C80B-4C42-8011-32B62020ACA3}, Type=6
16/5/2019 12:6:10 476A-8590-E6333C53F805}, Type=71
secure port 443
16/5/2019 12:6:11 Pipe not found
16/5/2019 12:6:11 The count is 7
16/5/2019 12:6:11 bSet is 1
securePort: 443
16/5/2019 12:6:12 Calling V01
16/5/2019 12:6:12 Merlin version 354
16/5/2019 12:6:12 Signature 354
16/5/2019 12:6:13 Wyse Flag value 0011
16/5/2019 12:6:14 The iBLP value -1
16/5/2019 12:6:14 TZ Queried
Number
16/5/2019 12:6:14 FUR : GetCI() 1
16/5/2019 12:6:14 IP matched!
16/5/2019 12:6:14 Subnet #�$
16/5/2019 12:6:14 Gateway
16/5/2019 12:6:14 DS `�$
16/5/2019 12:6:14 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=`j(
16/5/2019 12:6:14 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=`j(
16/5/2019 12:6:14 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=`j(
83FF-9A7F0B2B2
16/5/2019 12:6:14 E1E}
16/5/2019 12:6:14 Got reply from AgentUI=#�,
16/5/2019 12:6:14 GetDisplayInfo() return=�p*
16/5/2019 12:6:14 Disk offset 659554304
16/5/2019 12:6:14 Disk 0 Part 1 TYPE 260

16/5/2019 12:6:14 Disk 0 Part 5 TYPE 261

16/5/2019 12:6:14 Secure boot = 1
16/5/2019 12:6:14 Got reply from AgentUI=#�)
16/5/2019 12:6:14 return from ListAllApps=P0*
16/5/2019 12:6:22 size of qfe list 64
16/5/2019 12:6:22 Value found for LocalXMLPath = �#&
16/5/2019 12:6:22 WDAVersion = 12.1.1.25
16/5/2019 12:6:22 GetCI() done
'Z:\',error=1
securePort: 443
16/5/2019 12:6:22 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
16/5/2019 12:6:22 vchost.exe|PRC15=svchost.exe|PRC16=svchost.exe|
PRC37=GoogleUpdate.exe|PRC38=wmiprvse.exe|PRC39=vmware-usbarbitrator64.exe
16/5/2019 12:6:22 =SearchProtocolHost.exe|PRC47=SearchFilterHost.exe|
PRC48=msiexec.exe|PRC49=DtcWdaUi.exe|PRC50=hagent.exe|PRC51=HAgent_UI.exe|PRC
16/5/2019 12:6:22 52=tvnserver.exe|PRC53=RAVCpl64.exe|PRC54=concentr.exe|
PRC55=redirector.exe|PRC56=PNUSBCLITRAY.exe|PRC57=PNTray.exe|PRC58=Receiv
16/5/2019 12:6:22 er.exe|PRC59=SelfServicePlugin.exe|PRC60=wfcrun32.exe||
WIN0=ProgramüManager||PMIU=33|TBPM=7786256|FBPM=5140064|TBPF=7786256|FBP
16/5/2019 12:6:22 F=5078596|TBVM=8589934464|FKVM=8589864352|FKEM=0|CPRMS0=0,0,0|
NIC0IP=10.28.1.79|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüC
16/5/2019 12:6:22 ontrollerü#2|NIC0MAC=008064FB707A|RECP0=752|SENDP0=456|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(
16/5/2019 12:6:22 PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualü
16/5/2019 12:6:22 BandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|
16/5/2019 12:6:22
,KB2779562,KB2779768,KB2780541,KB2781197,KB27
16/5/2019 12:6:22
19,KB2794599,KB2795944,KB2798162,KB2798802,KB
16/5/2019 12:6:22
7986,KB2808679,KB2808735,KB2809289,KB2811660,
16/5/2019 12:6:22
829069,KB2829254,KB2829361,KB2829530,KB283029
16/5/2019 12:6:22
0,KB2832450,KB2836946,KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|
AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Z
16/5/2019 12:6:22 ip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService
16/5/2019 12:6:22 ||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalü
16/5/2019 12:6:22 Plusü2013|C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|
16/5/2019 12:6:22 729.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüF
16/5/2019 12:6:22 iles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüA
16/5/2019 12:6:22 gent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.
16/5/2019 12:6:22 0.1219906|AP11=GoogleüChrome|
AP12=MicrosoftüExcel|
16/5/2019 12:6:22 C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|
AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2
16/5/2019 12:6:22 .0.449.0|AP14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|A
16/5/2019 12:6:22 P15=OfficeüXMLüHandler|
15.0.4420.1017|AP16=Microsoftü
16/5/2019 12:6:22 PowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|
15.0.4420.1017|AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.
16/5/2019 12:6:22 4.0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\ProgramüFi
16/5/2019 12:6:22 les\WindowsüMail\wab.exe|6.2.9200.16384|
16/5/2019 12:6:22 6.2.9200.16384|AP21=MicrosoftüWord|
WCMSupp=1|WCMJ
16/5/2019 12:6:22 SONSupp=1|
16/5/2019 12:6:22 Found HS Tag
ProcessMsg!
then clear it here
16/5/2019 12:6:22 Server Sent 5
16/5/2019 12:6:22 Enhanced QU : QUM :
16/5/2019 12:6:22 Enhanced QU : QUC :
16/5/2019 12:6:22 Enhanced QU : QUD :
16/5/2019 12:6:22 Server Sent 6
16/5/2019 12:6:22 LOOKING FOR &04
16/5/2019 12:6:22 FUR :After S&P done
GetServerAddress
securePort: 443
16/5/2019 13:7:43 GetIP :: *** PPP
1325472778
16/5/2019 13:7:43 ip RETRIVED �b+
10.20.15.151, SecurePort: 443
16/5/2019 13:7:43 SETTING REG TO VALUE �b+
reported: 28
16/5/2019 13:7:43 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
16/5/2019 13:7:43 Pipe not found
16/5/2019 13:7:43 The count is 7
16/5/2019 13:7:43 bSet is 1
securePort: 443
16/5/2019 13:7:44 Value found for LocalXMLPath = @�'
16/5/2019 13:7:44 WDAVersion = 12.1.1.25
16/5/2019 13:7:44 The iBLP value -1
16/5/2019 13:7:45 -1|VI=1|
16/5/2019 13:7:45 Found HS Tag
ProcessMsg!
then clear it here
16/5/2019 13:7:45 Server Sent 5
16/5/2019 13:7:45 Enhanced QU : QUM :
16/5/2019 13:7:45 Enhanced QU : QUC :
16/5/2019 13:7:45 Enhanced QU : QUD :
16/5/2019 13:7:45 Server Sent 6
16/5/2019 13:7:45 LOOKING FOR &04
GetServerAddress
securePort: 443
16/5/2019 14:8:15 GetIP :: *** PPP
1325472778
16/5/2019 14:8:15 ip RETRIVED �v+
10.20.15.151, SecurePort: 443
16/5/2019 14:8:15 SETTING REG TO VALUE �v+
reported: 28
16/5/2019 14:8:15 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
16/5/2019 14:8:15 Pipe not found
16/5/2019 14:8:15 The count is 7
16/5/2019 14:8:15 bSet is 1
securePort: 443
16/5/2019 14:8:15 Value found for LocalXMLPath = @�'
16/5/2019 14:8:15 WDAVersion = 12.1.1.25
16/5/2019 14:8:16 The iBLP value -1
16/5/2019 14:8:17 -1|VI=1|
16/5/2019 14:8:17 Found HS Tag
ProcessMsg!
then clear it here
16/5/2019 14:8:17 Server Sent 5
16/5/2019 14:8:17 Enhanced QU : QUM :
16/5/2019 14:8:17 Enhanced QU : QUC :
16/5/2019 14:8:17 Enhanced QU : QUD :
16/5/2019 14:8:17 Server Sent 6
16/5/2019 14:8:17 LOOKING FOR &04
GetServerAddress
securePort: 443
16/5/2019 15:9:42 GetIP :: *** PPP
1325472778
16/5/2019 15:9:42 ip RETRIVED �u+
10.20.15.151, SecurePort: 443
16/5/2019 15:9:42 SETTING REG TO VALUE �u+
reported: 28
16/5/2019 15:9:42 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
16/5/2019 15:9:42 Pipe not found
16/5/2019 15:9:42 The count is 7
16/5/2019 15:9:42 bSet is 1
securePort: 443
16/5/2019 15:9:42 Value found for LocalXMLPath = 0#$
16/5/2019 15:9:42 WDAVersion = 12.1.1.25
16/5/2019 15:9:43 The iBLP value -1
16/5/2019 15:9:44 -1|VI=1|
16/5/2019 15:9:44 Found HS Tag
ProcessMsg!
then clear it here
16/5/2019 15:9:44 Server Sent 5
16/5/2019 15:9:44 Enhanced QU : QUM :
16/5/2019 15:9:44 Enhanced QU : QUC :
16/5/2019 15:9:44 Enhanced QU : QUD :
16/5/2019 15:9:44 Server Sent 6
16/5/2019 15:9:44 LOOKING FOR &04
16/5/2019 16:7:35 Stopping
16/5/2019 16:8:51 ***********************************************************
16/5/2019 16:8:51 End of WinMain()
16/5/2019 16:8:51 ^^^^^^^^ after reghanex()
16/5/2019 16:9:11 OS Version 6.2.9200
16/5/2019 16:9:11 OS Version 6.2.9200
16/5/2019 16:9:11 Major version 6
16/5/2019 16:9:11 Minor version 2
16/5/2019 16:9:11 Device Info: OS is ��,
16/5/2019 16:9:11 WRITE FILTER UWF 1
16/5/2019 16:9:11 Setting UWF Mgr!
16/5/2019 16:9:11 Disk offset 659554304
16/5/2019 16:9:12 Disk offset =1048576

16/5/2019 16:9:12 Disk offset =105906176
16/5/2019 16:9:12 Disk offset =420478976
16/5/2019 16:9:12 Disk offset =525336576
16/5/2019 16:9:12 Disk offset =659554304

'Z:\',error=1
16/5/2019 16:9:12 AF_INET (IPv4)
16/5/2019 16:9:12 IPv4 address 169.254.150.182

16/5/2019 16:9:12 Valid IP Found
16/5/2019 16:9:12 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
16/5/2019 16:9:12 HA Supported
16/5/2019 16:9:12 dwHSListCount = 1
GetServerAddress
securePort: 443
16/5/2019 16:9:12 GetIP :: *** PPP
1325472778
16/5/2019 16:9:12 ip RETRIVED @4.
10.20.15.151, SecurePort: 443
16/5/2019 16:9:12 Failed to Bind
HServer
Port: 0
16/5/2019 16:9:12 Failed to Bind
ms
reported: 28
16/5/2019 16:9:12 C80B-4C42-8011-32B62020ACA3}, Type=6
16/5/2019 16:9:12 476A-8590-E6333C53F805}, Type=71
16/5/2019 16:9:17 Failed to Bind
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
16/5/2019 16:9:18 ip RETRIVED ��0
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
16/5/2019 16:9:19 Pipe not found
16/5/2019 16:9:19 The count is 7
16/5/2019 16:9:19 bSet is 1
securePort: 443
16/5/2019 16:9:19 Calling V01
16/5/2019 16:9:19 Merlin version 354
16/5/2019 16:9:19 Signature 354
16/5/2019 16:9:20 Wyse Flag value 0011
16/5/2019 16:9:20 The iBLP value -1
16/5/2019 16:9:21 TZ Queried
Number
16/5/2019 16:9:21 FUR : GetCI() 1
16/5/2019 16:9:21 IP matched!
16/5/2019 16:9:21 Subnet `�*
16/5/2019 16:9:21 Gateway 8*
16/5/2019 16:9:21 DS �*
83FF-9A7F0B2B2
16/5/2019 16:9:21 E1E}
16/5/2019 16:9:21 Got reply from AgentUI=�E1
16/5/2019 16:9:21 GetDisplayInfo() return=�K0
16/5/2019 16:9:21 Disk offset 659554304
16/5/2019 16:9:21 Disk 0 Part 1 TYPE 260

16/5/2019 16:9:21 Disk 0 Part 5 TYPE 261

16/5/2019 16:9:21 Secure boot = 1

16/5/2019 16:9:21 tempbuff = |WIN0=sistemadebibliotecas.udistrital.edu.co -
Google Chrome|WIN1=Program Manager|, num=0
WIN0=sistemadebibliotecas.udistrital.edu.co - Google Chrome|WIN1=Program Manager|
16/5/2019 16:9:21 return from ListAllApps=�O/
16/5/2019 16:9:29 size of qfe list 64
16/5/2019 16:9:29 Value found for LocalXMLPath = p�-
16/5/2019 16:9:29 WDAVersion = 12.1.1.25
16/5/2019 16:9:29 GetCI() done
'Z:\',error=1
securePort: 443
16/5/2019 16:9:29 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
16/5/2019 16:9:29 34=wsnm.exe|PRC35=GoogleUpdate.exe|PRC36=DtcWDAService.exe|
PRC37=wmiprvse.exe|PRC38=mqtgsvc.exe|PRC39=vmware-usbarbitrator64.exe
PRC42=wmiprvse.exe|PRC43=SearchIndexer.exe|PRC44=vssvc.exe|PRC45=msiexec.exe|PRC46
16/5/2019 16:9:29 =svchost.exe|PRC47=SearchFilterHost.exe|PRC48=DtcWdaUi.exe|
16/5/2019 16:9:29 n.exe|PRC59=wfcrun32.exe|PRC60=chrome.exe|PRC61=chrome.exe|
PRC62=chrome.exe|PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe|P
16/5/2019 16:9:29 RC66=chrome.exe||WIN0=sistemadebibliotecas.udistrital.edu.coü-
üGoogleüChrome|WIN1=ProgramüManager||PMIU=36|TBPM=7786256|FBPM
16/5/2019 16:9:29 =4960332|TBPF=7786256|FBPF=4842476|TBVM=8589934464|
FKVM=8589864352|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28.1.79|NIC0DESC=Ethernet,Inven
16/5/2019 16:9:29 tecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|
RECP0=1062|SENDP0=604|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Eth
16/5/2019 16:9:29 ernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC
16/5/2019 16:9:29 =Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,KB2729462,
16/5/2019 16:9:29
777294,KB2778344,KB2778930,KB2779562,KB277976
16/5/2019 16:9:29
B2792100,KB2793210,KB2794119,KB2794599,KB2795
16/5/2019 16:9:29
,KB2805222,KB2805227,KB2807986,KB2808679,KB28
16/5/2019 16:9:29
30,KB2821895,KB2822241,KB2829069,KB2829254,KB
16/5/2019 16:9:29
9894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(
16/5/2019 16:9:29 x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP2=Moz
16/5/2019 16:9:29 illaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=Microso
16/5/2019 16:9:29 ftüOfficeüProfessionalüPlusü2013|
+ü2008üRedis
16/5/2019 16:9:29 tributableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=Microsoft�
16/5/2019 16:9:29 �Silverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0
16/5/2019 16:9:29 .61000|AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|
12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware
16/5/2019 16:9:29 \VMwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.
basedüwriteüfilterümanager|C:\Wind
16/5/2019 16:9:29 ows\System32\fbwfmgr.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IEDIA
16/5/2019 16:9:29 GCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.
C:\ProgramüFiles\T
16/5/2019 16:9:29 ightVNC\tvnserver.exe|2.6.4.0|
AP19=Window
16/5/2019 16:9:29 süContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles
16/5/2019 16:9:29 \WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_H
16/5/2019 16:9:29 ASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
16/5/2019 16:9:29 Found HS Tag
ProcessMsg!
then clear it here
16/5/2019 16:9:30 Server Sent 5
16/5/2019 16:9:30 Enhanced QU : QUM :
16/5/2019 16:9:30 Enhanced QU : QUC :
16/5/2019 16:9:30 Enhanced QU : QUD :
16/5/2019 16:9:30 Server Sent 6
16/5/2019 16:9:30 LOOKING FOR &04
16/5/2019 16:9:30 FUR :After S&P done
16/5/2019 16:20:31 Received data: ��-
Accept: */*
16/5/2019 16:20:31 jects/mechanize/)
Connection: close
16/5/2019 16:20:31 =0.7,*;q=0.7

Accept: */*
Connection: close
16/5/2019 16:20:31 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
16/5/2019 16:20:31 End of CService::NeedsConnection. Return true.
16/5/2019 16:20:31 Setting ServerFound Event
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
16/5/2019 16:20:31 ip RETRIVED К0
10.20.15.151, SecurePort: 443
16/5/2019 16:20:31 SETTING REG TO VALUE К0
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
16/5/2019 16:20:32 Pipe not found
16/5/2019 16:20:32 The count is 7
16/5/2019 16:20:32 bCheckServer is 1
16/5/2019 16:20:32 bSet is 1
securePort: 443
16/5/2019 16:20:32 Calling V01
16/5/2019 16:20:32 Merlin version 354
16/5/2019 16:20:32 Signature 354
16/5/2019 16:20:32 Wyse Flag value 0011
16/5/2019 16:20:32 The iBLP value -1
16/5/2019 16:20:33 TZ Queried
Number
16/5/2019 16:20:33 FUR : GetCI() 1
16/5/2019 16:20:33 IP matched!
16/5/2019 16:20:33 Subnet `�*
16/5/2019 16:20:33 Gateway 8*
16/5/2019 16:20:33 DS �*
16/5/2019 16:20:33 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=0a.
16/5/2019 16:20:33 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=0a.
16/5/2019 16:20:33 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=0a.
83FF-9A7F0B2B2
16/5/2019 16:20:33 E1E}
16/5/2019 16:20:33 Got reply from AgentUI=P�1
16/5/2019 16:20:33 add only adapter.
16/5/2019 16:20:33 Disk offset 659554304
16/5/2019 16:20:33 Disk 0 Part 1 TYPE 260

16/5/2019 16:20:33 Disk 0 Part 5 TYPE 261

16/5/2019 16:20:33 Secure boot = 1

16/5/2019 16:20:33 tempbuff = |WIN0=Ejemplo de una Cadena de Markov en Tiempo
Discreto - Google Chrome|WIN1=Program Manager|, num=0
16/5/2019 16:20:33 Msg recd from AgentGUI:|WIN0=Ejemplo de una Cadena de Markov
en Tiempo Discreto - Google Chrome|WIN1=Program Manager|
16/5/2019 16:20:33 Got reply from AgentUI=##2
16/5/2019 16:20:39 size of qfe list 64
16/5/2019 16:20:39 Value found for LocalXMLPath = �a0
16/5/2019 16:20:39 WDAVersion = 12.1.1.25
16/5/2019 16:20:39 GetCI() done
16/5/2019 16:20:39 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
D0PAR5SZ=30708596
16/5/2019 16:20:39 =wmiprvse.exe|PRC35=mqtgsvc.exe|PRC36=vmware-
usbarbitrator64.exe|PRC37=vmware-view-usbd.exe|PRC38=svchost.exe|PRC39=wmiprvse.exe
16/5/2019 16:20:39 |PRC40=SearchIndexer.exe|PRC41=DtcWdaUi.exe|PRC42=hagent.exe|
PRC43=HAgent_UI.exe|PRC44=tvnserver.exe|PRC45=RAVCpl64.exe|PRC46=co
16/5/2019 16:20:39 ncentr.exe|PRC47=redirector.exe|PRC48=PNUSBCLITRAY.exe|
PRC49=PNTray.exe|PRC50=Receiver.exe|PRC51=SelfServicePlugin.exe|PRC52=wfc
16/5/2019 16:20:39 run32.exe|PRC53=chrome.exe|PRC54=chrome.exe|PRC55=chrome.exe|
PRC56=chrome.exe|PRC57=chrome.exe|PRC58=chrome.exe|PRC59=CcmExec.ex
16/5/2019 16:20:39 e|PRC60=wmiprvse.exe|PRC61=wmiprvse.exe|PRC62=taskeng.exe|
PRC63=chrome.exe||WIN0=EjemploüdeüunaüCadenaüdeüMarkovüenüTiemp
16/5/2019 16:20:39 oüDiscretoü-üGoogleüChrome|WIN1=ProgramüManager||PMIU=34|
NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC
16/5/2019 16:20:39 =008064FB707A|RECP0=28085|SENDP0=9331|MIBSP0=1000üMbps||
NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNe
16/5/2019 16:20:39 twork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||
NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-AC�
16/5/2019 16:20:39 �7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|
16/5/2019 16:20:39
68,KB2780541,KB2781197,KB2785094,KB2785220,KB
16/5/2019 16:20:39
5944,KB2798162,KB2798802,KB2798804,KB2798805,
16/5/2019 16:20:39
808735,KB2809289,KB2811660,KB2812822,KB281317
16/5/2019 16:20:39
B2829361,KB2829530,KB2830290,KB2832450,KB2836
16/5/2019 16:20:39
946,KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=Mozi
16/5/2019 16:20:39 llaüFirefoxü61.0.2ü(x64ües-ES)|
AP3=Micro
16/5/2019 16:20:39 softüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|
15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\Prog
16/5/2019 16:20:39 ramüFiles\MicrosoftüOffice\|15.0.4420.1017|
AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.3072
16/5/2019 16:20:39 9.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSi
16/5/2019 16:20:39 lverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|C:\ProgramüF
16/5/2019 16:20:39 iles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|AP11=Goo
16/5/2019 16:20:39 gleüChrome|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS
16/5/2019 16:20:39 ~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=Diag
16/5/2019 16:20:39 nosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüH
16/5/2019 16:20:39 andler|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:\PROG
16/5/2019 16:20:39 RA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|
AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=Unifiedü
16/5/2019 16:20:39 WriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|
2.0.127.0|AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\
16/5/2019 16:20:39 wab.exe|6.2.9200.16384|
6.2.9200.16384|AP2
16/5/2019 16:20:39 1=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|
16/5/2019 16:20:39 Found HS Tag
ProcessMsg!
16/5/2019 16:20:39 Server Sent 5
16/5/2019 16:20:39 Enhanced QU : QUM :
16/5/2019 16:20:39 Enhanced QU : QUC :
16/5/2019 16:20:39 Enhanced QU : QUD :
16/5/2019 16:20:39 Server Sent 6
16/5/2019 16:20:39 LOOKING FOR &04
16/5/2019 16:20:39 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
16/5/2019 17:21:11 ip RETRIVED P�0
10.20.15.151, SecurePort: 443
16/5/2019 17:21:11 SETTING REG TO VALUE P�0
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
16/5/2019 17:21:11 Pipe not found
16/5/2019 17:21:11 The count is 7
16/5/2019 17:21:11 bCheckServer is 1
16/5/2019 17:21:11 bSet is 1
securePort: 443
16/5/2019 17:21:11 WDAVersion = 12.1.1.25
16/5/2019 17:21:12 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
16/5/2019 17:21:13 -1|VI=1|
16/5/2019 17:21:13 Found HS Tag
ProcessMsg!
16/5/2019 17:21:13 Server Sent 5
16/5/2019 17:21:13 Enhanced QU : QUM :
16/5/2019 17:21:13 Enhanced QU : QUC :
16/5/2019 17:21:13 Enhanced QU : QUD :
16/5/2019 17:21:13 Server Sent 6
16/5/2019 17:21:13 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
16/5/2019 18:23:0 ip RETRIVED �0
10.20.15.151, SecurePort: 443
16/5/2019 18:23:0 SETTING REG TO VALUE �0
HuntForAltLocalIP
secure port 443
16/5/2019 18:23:0 Pipe not found
16/5/2019 18:23:0 The count is 7
16/5/2019 18:23:0 bSet is 1
securePort: 443
16/5/2019 18:23:0 WDAVersion = 12.1.1.25
16/5/2019 18:23:1 The iBLP value -1
16/5/2019 18:23:1 1|VI=1|
16/5/2019 18:23:1 Found HS Tag
ProcessMsg!
then clear it here
16/5/2019 18:23:1 Server Sent 5
16/5/2019 18:23:1 Enhanced QU : QUM :
16/5/2019 18:23:1 Enhanced QU : QUC :
16/5/2019 18:23:1 Enhanced QU : QUD :
16/5/2019 18:23:1 Server Sent 6
16/5/2019 18:23:1 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
16/5/2019 19:26:17 ip RETRIVED ��0
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
16/5/2019 19:26:17 Pipe not found
16/5/2019 19:26:17 The count is 7
16/5/2019 19:26:17 bCheckServer is 1
16/5/2019 19:26:17 bSet is 1
securePort: 443
16/5/2019 19:26:17 Value found for LocalXMLPath = �a0
16/5/2019 19:26:17 WDAVersion = 12.1.1.25
16/5/2019 19:26:18 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
16/5/2019 19:26:18 1|VI=1|
16/5/2019 19:26:18 Found HS Tag
ProcessMsg!
16/5/2019 19:26:19 Server Sent 5
16/5/2019 19:26:19 Enhanced QU : QUM :
16/5/2019 19:26:19 Enhanced QU : QUC :
16/5/2019 19:26:19 Enhanced QU : QUD :
16/5/2019 19:26:19 Server Sent 6
16/5/2019 19:26:19 LOOKING FOR &04
17/5/2019 7:19:27 ***********************************************************
17/5/2019 7:19:27 End of WinMain()
17/5/2019 7:19:27 ^^^^^^^^ after reghanex()
17/5/2019 7:19:47 OS Version 6.2.9200
17/5/2019 7:19:47 OS Version 6.2.9200
17/5/2019 7:19:47 Major version 6
17/5/2019 7:19:47 Minor version 2
17/5/2019 7:19:47 Device Info: OS is 0�#
17/5/2019 7:19:47 WRITE FILTER UWF 1
17/5/2019 7:19:47 Setting UWF Mgr!
17/5/2019 7:19:47 Disk offset 659554304
17/5/2019 7:19:47 Disk offset =1048576

17/5/2019 7:19:47 Disk offset =105906176
17/5/2019 7:19:47 Disk offset =420478976
17/5/2019 7:19:47 Disk offset =525336576
17/5/2019 7:19:47 Disk offset =659554304

'Z:\',error=1
17/5/2019 7:19:47 AF_INET (IPv4)
17/5/2019 7:19:47 IPv4 address 169.254.150.182
17/5/2019 7:19:47 Valid IP Found

17/5/2019 7:19:47 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
17/5/2019 7:19:48 HA Supported
17/5/2019 7:19:48 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1231618391
17/5/2019 7:19:48 ip RETRIVED �~
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
17/5/2019 7:19:53 C80B-4C42-8011-32B62020ACA3}, Type=6
17/5/2019 7:19:53 476A-8590-E6333C53F805}, Type=71
17/5/2019 7:19:58 Failed to Bind
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
17/5/2019 7:19:59 ip RETRIVED
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
17/5/2019 7:20:1 Pipe not found
17/5/2019 7:20:1 The count is 7
17/5/2019 7:20:1 bSet is 1
securePort: 443
17/5/2019 7:20:1 Calling V01
17/5/2019 7:20:1 Merlin version 354
17/5/2019 7:20:1 Signature 354
17/5/2019 7:20:1 Wyse Flag value 0011
17/5/2019 7:20:2 The iBLP value -1
17/5/2019 7:20:3 TZ Queried
17/5/2019 7:20:3 FUR : GetCI() 1
17/5/2019 7:20:3 IP matched!
17/5/2019 7:20:3 Subnet �#
17/5/2019 7:20:3 Gateway 5#
17/5/2019 7:20:3 DS ��#
17/5/2019 7:20:3 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�d"
17/5/2019 7:20:3 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�d"
17/5/2019 7:20:3 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�d"
83FF-9A7F0B2B2
17/5/2019 7:20:3 E1E}
17/5/2019 7:20:3 GetDisplayInfo() return=PX#
17/5/2019 7:20:3 Disk offset 659554304
17/5/2019 7:20:3 Disk 0 Part 1 TYPE 260

17/5/2019 7:20:3 Disk 0 Part 5 TYPE 261

17/5/2019 7:20:3 Secure boot = 1

17/5/2019 7:20:3 tempbuff = |, num=0
17/5/2019 7:20:3 Got reply from AgentUI=�#
17/5/2019 7:20:3 return from ListAllApps=ì"
17/5/2019 7:20:10 size of qfe list 64
17/5/2019 7:20:11 Value found for LocalXMLPath = ��#
17/5/2019 7:20:11 WDAVersion = 12.1.1.25
17/5/2019 7:20:11 GetCI() done
'Z:\',error=1
securePort: 443
17/5/2019 7:20:11 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
17/5/2019 7:20:11 34=wsnm.exe|PRC35=DtcWDAService.exe|PRC36=wmiprvse.exe|
PRC37=GoogleUpdate.exe|PRC38=mqtgsvc.exe|PRC39=vmware-usbarbitrator64.exe
PRC42=wmiprvse.exe|PRC43=SearchIndexer.exe|PRC44=vssvc.exe|PRC45=msiexec.exe|PRC46
17/5/2019 7:20:11 =svchost.exe|PRC47=SearchFilterHost.exe|PRC48=DtcWdaUi.exe|
17/5/2019 7:20:11 n.exe|PRC59=wfcrun32.exe|PRC60=GoogleUpdate.exe|||PMIU=32|
TBPM=7786256|FBPM=5274164|TBPF=7786256|FBPF=5106588|TBVM=8589934464|FK
17/5/2019 7:20:11 VM=8589864352|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28.1.79|
17/5/2019 7:20:11 FB707A|RECP0=783|SENDP0=436|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC
17/5/2019 7:20:11 1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||
NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2
17/5/2019 7:20:11 MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|
17/5/2019 7:20:11
41,KB2781197,KB2785094,KB2785220,KB2789649,KB
17/5/2019 7:20:11
8162,KB2798802,KB2798804,KB2798805,KB2799494,
17/5/2019 7:20:11
809289,KB2811660,KB2812822,KB2813170,KB281343
17/5/2019 7:20:11
B2829530,KB2830290,KB2832450,KB2836946,KB2836
17/5/2019 7:20:11 947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFiref
17/5/2019 7:20:11 oxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLync
17/5/2019 7:20:11 üVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles
17/5/2019 7:20:11 \MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|AP6
17/5/2019 7:20:11 =MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\
17/5/2019 7:20:11 |5.1.20125.0|AP8=MicrosoftüVisualüC+
C:\ProgramüFiles\Wyse\
17/5/2019 7:20:11 WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrom
17/5/2019 7:20:11 e|C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|
68.0.3440.106|AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office1
17/5/2019 7:20:11 5\EXCEL.EXE|15.0.4420.1017|AP13=File-
AP14=Diagnosticsüu
17/5/2019 7:20:11 tilityüforüInternetüExplorer|
AP15=OfficeüXMLüHandler|C:\
17/5/2019 7:20:11
ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICRO
17/5/2019 7:20:11 S~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=UnifiedüWriteüFil
17/5/2019 7:20:11 terüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.
17/5/2019 7:20:11 2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=Microsof
17/5/2019 7:20:11 tüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|
17/5/2019 7:20:11 Found HS Tag
ProcessMsg!
then clear it here
17/5/2019 7:20:12 Server Sent 5
17/5/2019 7:20:12 Enhanced QU : QUM :
17/5/2019 7:20:12 Enhanced QU : QUC :
17/5/2019 7:20:12 Enhanced QU : QUD :
17/5/2019 7:20:12 Server Sent 6
17/5/2019 7:20:12 LOOKING FOR &04
17/5/2019 7:20:12 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
17/5/2019 8:23:35 ip RETRIVED #�"
10.20.15.151, SecurePort: 443
17/5/2019 8:23:35 SETTING REG TO VALUE #�"
HuntForAltLocalIP
secure port 443
17/5/2019 8:23:35 Pipe not found
17/5/2019 8:23:35 The count is 7
17/5/2019 8:23:35 bSet is 1
securePort: 443
17/5/2019 8:23:35 Calling V01
17/5/2019 8:23:35 Merlin version 354
17/5/2019 8:23:35 Signature 354
17/5/2019 8:23:35 Wyse Flag value 0011
17/5/2019 8:23:36 The iBLP value -1
17/5/2019 8:23:37 TZ Queried
Number
17/5/2019 8:23:37 FUR : GetCI() 1
17/5/2019 8:23:37 IP matched!
17/5/2019 8:23:37 Subnet �#
17/5/2019 8:23:37 Gateway 5#
17/5/2019 8:23:37 DS ��#
17/5/2019 8:23:37 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=pe"
17/5/2019 8:23:37 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=pe"
17/5/2019 8:23:37 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=pe"
83FF-9A7F0B2B2
17/5/2019 8:23:37 E1E}
17/5/2019 8:23:37 Got reply from AgentUI=��
17/5/2019 8:23:37 GetDisplayInfo() return=��#
17/5/2019 8:23:37 Disk offset 659554304
17/5/2019 8:23:37 Disk 0 Part 1 TYPE 260

17/5/2019 8:23:37 Disk 0 Part 5 TYPE 261

17/5/2019 8:23:37 Secure boot = 1

17/5/2019 8:23:37 tempbuff = |WIN0=COMPOSICI�N DE FUNCIONES - Mozilla Firefox|
17/5/2019 8:23:37 Msg recd from AgentGUI:|WIN0=COMPOSICI�N DE FUNCIONES -
Mozilla Firefox|WIN1=Program Manager|
17/5/2019 8:23:37 Got reply from AgentUI=p�&
17/5/2019 8:23:37 return from ListAllApps=�H#
17/5/2019 8:23:43 size of qfe list 64
17/5/2019 8:23:44 Value found for LocalXMLPath = �#
17/5/2019 8:23:44 WDAVersion = 12.1.1.25
17/5/2019 8:23:44 GetCI() done
17/5/2019 8:23:44 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
PRC62=DllHost.exe|PRC63=taskeng.exe|PRC64=wmiprvse.exe||WIN0=COMPOSICI�NüDEüFUNCI
17/5/2019 8:23:44 ONESü-üMozillaüFirefox|WIN1=ProgramüManager||PMIU=45|
TBPM=7786256|FBPM=4242152|TBPF=7786256|FBPF=4005772|TBVM=8589934464|FKV
17/5/2019 8:23:44 M=8589865384|FKEM=0|CPRMS0=14,14,14|NIC0IP=10.28.1.79|
17/5/2019 8:23:44
B2780541,KB2781197,KB2785094,KB2785220,KB2789
17/5/2019 8:23:44
,KB2798162,KB2798802,KB2798804,KB2798805,KB27
17/5/2019 8:23:44
35,KB2809289,KB2811660,KB2812822,KB2813170,KB
17/5/2019 8:23:44
9361,KB2829530,KB2830290,KB2832450,KB2836946,
17/5/2019 8:23:44 KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|
17/5/2019 8:23:44 �Chrome|
17/5/2019 8:23:44 er|
17/5/2019 8:23:44 Found HS Tag
ProcessMsg!
then clear it here
17/5/2019 8:23:44 Server Sent 5
17/5/2019 8:23:44 Enhanced QU : QUM :
17/5/2019 8:23:44 Enhanced QU : QUC :
17/5/2019 8:23:44 Enhanced QU : QUD :
17/5/2019 8:23:44 Server Sent 6
17/5/2019 8:23:44 LOOKING FOR &04
17/5/2019 8:23:44 FUR :After S&P done
17/5/2019 8:25:15 Received data: #�!
Accept: */*
Connection: close
17/5/2019 8:25:15 =0.7,*;q=0.7

Accept: */*
Connection: close
17/5/2019 8:25:15 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
17/5/2019 8:25:15 ip RETRIVED н"
10.20.15.151, SecurePort: 443
17/5/2019 8:25:15 SETTING REG TO VALUE н"
HuntForAltLocalIP
secure port 443
17/5/2019 8:25:16 Pipe not found
17/5/2019 8:25:16 The count is 7
17/5/2019 8:25:16 bSet is 1
securePort: 443
17/5/2019 8:25:16 Calling V01
17/5/2019 8:25:16 Merlin version 354
17/5/2019 8:25:16 Signature 354
17/5/2019 8:25:16 Wyse Flag value 0011
17/5/2019 8:25:16 The iBLP value -1
17/5/2019 8:25:17 TZ Queried
Number
17/5/2019 8:25:17 FUR : GetCI() 1
17/5/2019 8:25:17 IP matched!
17/5/2019 8:25:17 Subnet �#
17/5/2019 8:25:17 Gateway 5#
17/5/2019 8:25:17 DS ��#
17/5/2019 8:25:17 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�g"
17/5/2019 8:25:17 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�g"
17/5/2019 8:25:17 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�g"
83FF-9A7F0B2B2
17/5/2019 8:25:17 E1E}
17/5/2019 8:25:17 Got reply from AgentUI=@G'
17/5/2019 8:25:17 Disk offset 659554304
17/5/2019 8:25:17 Disk 0 Part 1 TYPE 260

17/5/2019 8:25:17 Disk 0 Part 5 TYPE 261

17/5/2019 8:25:17 Secure boot = 1

17/5/2019 8:25:17 tempbuff = |WIN0=QUITZ TRES DE MATEM�TICA B�SICA - Mozilla
17/5/2019 8:25:17 Msg recd from AgentGUI:|WIN0=QUITZ TRES DE MATEM�TICA B�SICA -
17/5/2019 8:25:17 Got reply from AgentUI=p!'
17/5/2019 8:25:17 return from ListAllApps=`d#
17/5/2019 8:25:23 size of qfe list 64
17/5/2019 8:25:23 Value found for LocalXMLPath = 0G"
17/5/2019 8:25:23 WDAVersion = 12.1.1.25
17/5/2019 8:25:23 GetCI() done
17/5/2019 8:25:23 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
PRC62=DllHost.exe|PRC63=taskeng.exe|PRC64=wmiprvse.exe|PRC65=TrustedInstaller.exe|P
17/5/2019 8:25:23 RC66=TiWorker.exe||WIN0=QUITZüTRESüDEüMATEM�TICAüB�SICAü-
üMozillaüFirefox|WIN1=ProgramüManager||PMIU=45|TBPM=7786256|FBP
17/5/2019 8:25:23 M=4234436|TBPF=7786256|FBPF=3997780|TBVM=8589934464|
FKVM=8589864360|FKEM=0|CPRMS0=23,9,14|NIC0IP=10.28.1.79|NIC0DESC=Ethernet,In
17/5/2019 8:25:23 ventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|
RECP0=85527|SENDP0=24349|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DE
17/5/2019 8:25:23 SC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NI
17/5/2019 8:25:23 C2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,KB27
17/5/2019 8:25:23
17,KB2777294,KB2778344,KB2778930,KB2779562,KB
17/5/2019 8:25:23
0907,KB2792100,KB2793210,KB2794119,KB2794599,
17/5/2019 8:25:23
804584,KB2805222,KB2805227,KB2807986,KB280867
17/5/2019 8:25:23
B2820330,KB2821895,KB2822241,KB2829069,KB2829
17/5/2019 8:25:23
,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18
17/5/2019 8:25:23 .05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|A
17/5/2019 8:25:23 P2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=M
17/5/2019 8:25:23 icrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008�
17/5/2019 8:25:23 �Redistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=Micr
17/5/2019 8:25:23 osoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64
17/5/2019 8:25:23 )||8.0.61000|AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|
12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\
17/5/2019 8:25:23 VMware\VMwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0
17/5/2019 8:25:23 .3440.106|AP12=MicrosoftüExcel|
basedüwriteüfilterümanager|C
17/5/2019 8:25:23 :\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\InternetüExplorer
17/5/2019 8:25:23 \IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE
17/5/2019 8:25:23 |15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\ProgramüF
17/5/2019 8:25:23 iles\TightVNC\tvnserver.exe|2.6.4.0|
AP19=
17/5/2019 8:25:23 WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\Program�
17/5/2019 8:25:23 �Files\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM
17/5/2019 8:25:23 _CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
17/5/2019 8:25:23 Found HS Tag
ProcessMsg!
then clear it here
17/5/2019 8:25:23 Server Sent 5
17/5/2019 8:25:23 Enhanced QU : QUM :
17/5/2019 8:25:23 Enhanced QU : QUC :
17/5/2019 8:25:23 Enhanced QU : QUD :
17/5/2019 8:25:23 Server Sent 6
17/5/2019 8:25:23 LOOKING FOR &04
17/5/2019 8:25:23 FUR :After S&P done
GetServerAddress
443
HuntForAltLocalIP
1325472778
17/5/2019 9:29:0 ip RETRIVED Ь"
10.20.15.151, SecurePort: 443
17/5/2019 9:29:0 SETTING REG TO VALUE Ь"
HuntForAltLocalIP
secure port 443
17/5/2019 9:29:1 Pipe not found
17/5/2019 9:29:1 The count is 7
17/5/2019 9:29:1 bSet is 1
securePort: 443
17/5/2019 9:29:1 Value found for LocalXMLPath = 0##
17/5/2019 9:29:1 WDAVersion = 12.1.1.25
17/5/2019 9:29:2 The iBLP value -1
17/5/2019 9:29:2 1|VI=1|
17/5/2019 9:29:2 Found HS Tag
then clear it here
17/5/2019 9:29:3 Server Sent 5
17/5/2019 9:29:3 Enhanced QU : QUM :
17/5/2019 9:29:3 Enhanced QU : QUC :
17/5/2019 9:29:3 Enhanced QU : QUD :
17/5/2019 9:29:3 Server Sent 6
17/5/2019 9:29:3 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
17/5/2019 10:31:53 ip RETRIVED Ь"
10.20.15.151, SecurePort: 443
17/5/2019 10:31:53 SETTING REG TO VALUE Ь"
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
17/5/2019 10:31:53 Pipe not found
17/5/2019 10:31:53 The count is 7
17/5/2019 10:31:53 bCheckServer is 1
17/5/2019 10:31:53 bSet is 1
securePort: 443
17/5/2019 10:31:53 WDAVersion = 12.1.1.25
17/5/2019 10:31:54 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
17/5/2019 10:31:55 1|VI=1|
17/5/2019 10:31:55 Found HS Tag
ProcessMsg!
17/5/2019 10:31:55 Server Sent 5
17/5/2019 10:31:55 Enhanced QU : QUM :
17/5/2019 10:31:55 Enhanced QU : QUC :
17/5/2019 10:31:55 Enhanced QU : QUD :
17/5/2019 10:31:55 Server Sent 6
17/5/2019 10:31:55 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
17/5/2019 11:34:31 ip RETRIVED P�"
10.20.15.151, SecurePort: 443
17/5/2019 11:34:31 SETTING REG TO VALUE P�"
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
17/5/2019 11:34:31 Pipe not found
17/5/2019 11:34:31 The count is 7
17/5/2019 11:34:31 bCheckServer is 1
17/5/2019 11:34:31 bSet is 1
securePort: 443
17/5/2019 11:34:32 WDAVersion = 12.1.1.25
17/5/2019 11:34:32 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
17/5/2019 11:34:33 1|VI=1|
17/5/2019 11:34:33 Found HS Tag
ProcessMsg!
17/5/2019 11:34:33 Server Sent 5
17/5/2019 11:34:33 Enhanced QU : QUM :
17/5/2019 11:34:33 Enhanced QU : QUC :
17/5/2019 11:34:33 Enhanced QU : QUD :
17/5/2019 11:34:33 Server Sent 6
17/5/2019 11:34:33 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
17/5/2019 12:13:46 ip RETRIVED Ь"
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
17/5/2019 12:13:52 C80B-4C42-8011-32B62020ACA3}, Type=6
17/5/2019 12:13:52 476A-8590-E6333C53F805}, Type=71
17/5/2019 12:13:58 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
17/5/2019 12:13:58 ip RETRIVED Ь"
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
17/5/2019 12:14:4 C80B-4C42-8011-32B62020ACA3}, Type=6
17/5/2019 12:14:4 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
1325472778
17/5/2019 13:17:47 ip RETRIVED ��"
10.20.15.151, SecurePort: 443
17/5/2019 13:17:47 SETTING REG TO VALUE ��"
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
17/5/2019 13:17:48 Pipe not found
17/5/2019 13:17:48 The count is 7
17/5/2019 13:17:48 bCheckServer is 1
17/5/2019 13:17:48 bSet is 1
securePort: 443
17/5/2019 13:17:48 Calling V01
17/5/2019 13:17:48 Merlin version 354
17/5/2019 13:17:48 Signature 354
17/5/2019 13:17:48 Wyse Flag value 0011
17/5/2019 13:17:49 The iBLP value -1
17/5/2019 13:17:50 TZ Queried
Number
17/5/2019 13:17:50 FUR : GetCI() 1
17/5/2019 13:17:50 IP matched!
17/5/2019 13:17:50 Subnet �#
17/5/2019 13:17:50 Gateway 5#
17/5/2019 13:17:50 DS ��#
17/5/2019 13:17:50 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=0b"
17/5/2019 13:17:50 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=0b"
17/5/2019 13:17:50 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=0b"
83FF-9A7F0B2B2
17/5/2019 13:17:50 E1E}
17/5/2019 13:17:50 Got reply from AgentUI=@C'
17/5/2019 13:17:50 add only adapter.
17/5/2019 13:17:50 GetDisplayInfo() return=��(
17/5/2019 13:17:50 Disk offset 659554304
17/5/2019 13:17:50 Disk 0 Part 1 TYPE 260

17/5/2019 13:17:50 Disk 0 Part 5 TYPE 261

17/5/2019 13:17:50 Secure boot = 1

17/5/2019 13:17:50 tempbuff = |WIN0=srytfc1.pdf|WIN1=srytfc1.pdf - Mozilla
17/5/2019 13:17:50 Msg recd from AgentGUI:|WIN0=srytfc1.pdf|WIN1=srytfc1.pdf -
17/5/2019 13:17:50 Got reply from AgentUI=��'
17/5/2019 13:17:50 return from ListAllApps=#<(
17/5/2019 13:17:55 size of qfe list 64
17/5/2019 13:17:56 WDAVersion = 12.1.1.25
17/5/2019 13:17:56 GetCI() done
17/5/2019 13:17:56 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.30
D0PAR5SZ=30708596
17/5/2019 13:17:56 r.exe|PRC40=DtcWdaUi.exe|PRC41=hagent.exe|
PRC46=re
PRC55=DllHost.exe|PRC56=firefox.exe|PRC57=firefox.exe|PRC58=firefox.exe|PRC59=fir
17/5/2019 13:17:56 efox.exe|PRC60=firefox.exe|PRC61=wmiprvse.exe|
PRC62=DllHost.exe||WIN0=srytfc1.pdf|WIN1=srytfc1.pdfü-üMozillaüFirefox|WIN2=Pro
17/5/2019 13:17:56 gramüManager||PMIU=45|TBPM=7786256|FBPM=4216324|TBPF=7786256|
FBPF=4034732|TBVM=8589934464|FKVM=8589864360|FKEM=0|CPRMS0=70,7,15
17/5/2019 13:17:56 |NIC0IP=10.28.1.79|
RECP0=482262|SENDP0=149387
17/5/2019 13:17:56 |MIBSP0=1000üMbps||NIC1IP=0.0.0.0|
RECP1=0|S
17/5/2019 13:17:56 ENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
SE
17/5/2019 13:17:56 NDP2=0|MIBSP2=0üMbps|
5,KB2769166,KB2770917,K
17/5/2019 13:17:56
85220,KB2789649,KB2789650,KB2790655,KB2790907
17/5/2019 13:17:56
2798805,KB2799494,KB2800033,KB2804583,KB28045
17/5/2019 13:17:56
KB2813170,KB2813430,KB2817183,KB2818604,KB282
17/5/2019 13:17:56
0,KB2836946,KB2836947,KB2836988,KB2838727,KB2
17/5/2019 13:17:56 839894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:
17/5/2019 13:17:56 \ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFil
17/5/2019 13:17:56 es\MicrosoftüOffice|15.0.4420.1017|
15.0.44
17/5/2019 13:17:56 20.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-
üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWindowsüEmbedd
17/5/2019 13:17:56 edüKeyboardüFilterüDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=Microsoft�
17/5/2019 13:17:56 �VisualüC++ü2005üRedistributableü(x64)||8.0.61000|
AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMware�
17/5/2019 13:17:56 �HorizonüViewüClient|
C:\ProgramüFilesü(x86)\
17/5/2019 13:17:56 Google\Chrome\Application\chrome.exe|68.0.3440.106|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|
17/5/2019 13:17:56 AP13=File-basedüwriteüfilterümanager|
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExpl
17/5/2019 13:17:56 orer|C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|
10.0.9200.16384|AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFile
17/5/2019 13:17:56 s\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|1
17/5/2019 13:17:56 5.0.4420.1017|AP17=TightVNC|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Wi
17/5/2019 13:17:56 ndows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Microsoft
17/5/2019 13:17:56 ü(R)üContactsüImportüTool|
C:\PROGRA~1\MICROS~
17/5/2019 13:17:56 1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|
17/5/2019 13:17:56 Found HS Tag
ProcessMsg!
17/5/2019 13:17:56 Server Sent 5
17/5/2019 13:17:56 Enhanced QU : QUM :
17/5/2019 13:17:56 Enhanced QU : QUC :
17/5/2019 13:17:56 Enhanced QU : QUD :
17/5/2019 13:17:56 Server Sent 6
17/5/2019 13:17:56 LOOKING FOR &04
17/5/2019 13:17:56 FUR :After S&P done
20/5/2019 7:17:11 ***********************************************************
20/5/2019 7:17:11 End of WinMain()
20/5/2019 7:17:11 ^^^^^^^^ after reghanex()
20/5/2019 7:17:31 OS Version 6.2.9200
20/5/2019 7:17:31 OS Version 6.2.9200
20/5/2019 7:17:31 Major version 6
20/5/2019 7:17:31 Minor version 2
20/5/2019 7:17:31 Device Info: OS is �"
20/5/2019 7:17:31 WRITE FILTER UWF 1
20/5/2019 7:17:31 Setting UWF Mgr!
20/5/2019 7:17:31 Disk offset 659554304
20/5/2019 7:17:31 Disk offset =1048576

20/5/2019 7:17:31 Disk offset =105906176
20/5/2019 7:17:31 Disk offset =420478976
20/5/2019 7:17:31 Disk offset =525336576
20/5/2019 7:17:31 Disk offset =659554304

'Z:\',error=1
20/5/2019 7:17:31 AF_INET (IPv4)

20/5/2019 7:17:31 IPv4 address 169.254.150.182
20/5/2019 7:17:31 Valid IP Found

20/5/2019 7:17:31 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
20/5/2019 7:17:31 HA Supported
20/5/2019 7:17:31 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1231618391
20/5/2019 7:17:32 ip RETRIVED �#&
10.20.15.151, SecurePort: 443
HServer
Port: 0
20/5/2019 7:17:37 Failed to Bind
ms
reported: 28
20/5/2019 7:17:37 C80B-4C42-8011-32B62020ACA3}, Type=6
20/5/2019 7:17:37 476A-8590-E6333C53F805}, Type=71
20/5/2019 7:17:38 ConfirmAndSetConnection :: Setting the checkin event!
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 7:17:39 Pipe not found
20/5/2019 7:17:39 The count is 7
20/5/2019 7:17:39 bSet is 1
securePort: 443
20/5/2019 7:17:40 Calling V01
20/5/2019 7:17:40 Merlin version 354
20/5/2019 7:17:40 Signature 354
20/5/2019 7:17:40 Wyse Flag value 0011
20/5/2019 7:17:41 The iBLP value -1
20/5/2019 7:17:42 TZ Queried
Number
20/5/2019 7:17:42 FUR : GetCI() 1
20/5/2019 7:17:42 IP matched!
20/5/2019 7:17:42 Subnet з
20/5/2019 7:17:42 Gateway �
20/5/2019 7:17:42 DS �
&
&
&
83FF-9A7F0B2B2
20/5/2019 7:17:42 E1E}
20/5/2019 7:17:42 Got reply from AgentUI=�&#
20/5/2019 7:17:42 GetDisplayInfo() return=#;"
20/5/2019 7:17:42 Disk offset 659554304
20/5/2019 7:17:42 Disk 0 Part 1 TYPE 260

20/5/2019 7:17:42 Disk 0 Part 5 TYPE 261

20/5/2019 7:17:42 Secure boot = 1

20/5/2019 7:17:42 tempbuff = |, num=0
20/5/2019 7:17:42 Got reply from AgentUI=�#
20/5/2019 7:17:49 size of qfe list 64
20/5/2019 7:17:50 Value found for LocalXMLPath = �=$
20/5/2019 7:17:50 WDAVersion = 12.1.1.25
20/5/2019 7:17:50 GetCI() done
'Z:\',error=1
securePort: 443
20/5/2019 7:17:50 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC2=wininit.exe|PRC3=csrss.exe|PRC4=services.exe|PRC5=winlogon.exe|PRC6=lsass.ex
20/5/2019 7:17:50 |PRC21=svchost.exe|PRC22=taskhostex.exe|
PRC27=NetXCle
20/5/2019 7:17:50 C34=wsnm.exe|PRC35=DtcWDAService.exe|PRC36=GoogleUpdate.exe|
PRC37=wmiprvse.exe|PRC38=mqtgsvc.exe|PRC39=vmware-usbarbitrator64.ex
20/5/2019 7:17:50 6=msiexec.exe|PRC47=SearchFilterHost.exe|PRC48=DtcWdaUi.exe|
PRC49=hagent.exe|PRC50=HAgent_UI.exe|PRC51=tvnserver.exe|PRC52=RAVCp
20/5/2019 7:17:50 l64.exe|PRC53=concentr.exe|PRC54=redirector.exe|
PRC55=PNUSBCLITRAY.exe|PRC56=PNTray.exe|PRC57=Receiver.exe|PRC58=SelfServicePlug
20/5/2019 7:17:50 in.exe|PRC59=wfcrun32.exe|||PMIU=33|TBPM=7786256|FBPM=5174128|
TBPF=7786256|FBPF=5107120|TBVM=8589934464|FKVM=8589864352|FKEM=0|C
20/5/2019 7:17:50 PRMS0=0,0,0|NIC0IP=10.28.0.144|
RECP0=632|SEND
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|REC
20/5/2019 7:17:50 P1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP
20/5/2019 7:17:50 2=0|SENDP2=0|MIBSP2=0üMbps|
5,KB2769166,KB277
20/5/2019 7:17:50
4,KB2785220,KB2789649,KB2789650,KB2790655,KB2
20/5/2019 7:17:50
804,KB2798805,KB2799494,KB2800033,KB2804583,K
20/5/2019 7:17:50
12822,KB2813170,KB2813430,KB2817183,KB2818604
20/5/2019 7:17:50
2832450,KB2836946,KB2836947,KB2836988,KB28387
20/5/2019 7:17:50 27,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-
20/5/2019 7:17:50 ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|C:\Progra
20/5/2019 7:17:50 müFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|1
üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWindowsü
20/5/2019 7:17:50 EmbeddedüKeyboardüFilterüDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=Micr
20/5/2019 7:17:50 osoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|
AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=V
20/5/2019 7:17:50 MwareüHorizonüViewüClient|
C:\ProgramüFilesü
20/5/2019 7:17:50 (x86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|
20/5/2019 7:17:50 .1017|AP13=File-basedüwriteüfilterümanager|
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=DiagnosticsüutilityüforüInternet
20/5/2019 7:17:50 üExplorer|C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|
10.0.9200.16384|AP15=OfficeüXMLüHandler|C:\ProgramüFiles\Common
20/5/2019 7:17:50 üFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT
20/5/2019 7:17:50 .EXE|15.0.4420.1017|AP17=TightVNC|
AP18=UnifiedüWriteüFilterüManagerüManager
20/5/2019 7:17:50 |C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Mic
20/5/2019 7:17:50 rosoftü(R)üContactsüImportüTool|
C:\PROGRA~1\M
20/5/2019 7:17:50 ICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|
20/5/2019 7:17:50 Found HS Tag
ProcessMsg!
then clear it here
20/5/2019 7:17:50 Server Sent 5
20/5/2019 7:17:50 Enhanced QU : QUM :
20/5/2019 7:17:50 Enhanced QU : QUC :
20/5/2019 7:17:50 Enhanced QU : QUD :
20/5/2019 7:17:50 Server Sent 6
20/5/2019 7:17:50 LOOKING FOR &04
20/5/2019 7:17:50 FUR :After S&P done
GetServerAddress
securePort: 443
20/5/2019 7:17:50 GetIP :: *** PPP
-1879041014
20/5/2019 7:17:50 ip RETRIVED �u'
10.20.15.151, SecurePort: 443
20/5/2019 7:17:50 SETTING REG TO VALUE �u'
reported: 28
20/5/2019 7:17:50 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 7:17:50 Pipe not found
20/5/2019 7:17:50 The count is 7
20/5/2019 7:17:50 bSet is 1
securePort: 443
20/5/2019 7:17:51 Calling V01
20/5/2019 7:17:51 Merlin version 354
20/5/2019 7:17:51 Signature 354
20/5/2019 7:17:51 Wyse Flag value 0011
20/5/2019 7:17:52 The iBLP value -1
20/5/2019 7:17:52 TZ Queried
Number
20/5/2019 7:17:52 FUR : GetCI() 1
20/5/2019 7:17:52 IP matched!
20/5/2019 7:17:52 Subnet з
20/5/2019 7:17:52 Gateway �
20/5/2019 7:17:52 DS �
20/5/2019 7:17:52 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�&
20/5/2019 7:17:52 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�&
20/5/2019 7:17:52 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�&
83FF-9A7F0B2B2
20/5/2019 7:17:52 E1E}
20/5/2019 7:17:52 Got reply from AgentUI=0-(
20/5/2019 7:17:52 GetDisplayInfo() return=��&
20/5/2019 7:17:52 Disk offset 659554304
20/5/2019 7:17:52 Disk 0 Part 1 TYPE 260

20/5/2019 7:17:52 Disk 0 Part 5 TYPE 261

20/5/2019 7:17:52 Secure boot = 1

20/5/2019 7:17:52 tempbuff = |, num=0
20/5/2019 7:17:52 Got reply from AgentUI=�&
20/5/2019 7:17:52 return from ListAllApps=�#"
20/5/2019 7:17:58 size of qfe list 64
20/5/2019 7:17:58 Value found for LocalXMLPath = �=$
20/5/2019 7:17:58 WDAVersion = 12.1.1.25
20/5/2019 7:17:58 GetCI() done
20/5/2019 7:17:58 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC27=NetXCle
20/5/2019 7:17:58 C34=wsnm.exe|PRC35=DtcWDAService.exe|PRC36=GoogleUpdate.exe|
PRC37=wmiprvse.exe|PRC38=mqtgsvc.exe|PRC39=vmware-usbarbitrator64.ex
20/5/2019 7:17:58 in.exe|PRC59=wfcrun32.exe|PRC60=TrustedInstaller.exe|
PRC61=TiWorker.exe|||PMIU=32|TBPM=7786256|FBPM=5230856|TBPF=7786256|FBPF=50
20/5/2019 7:17:58 75696|TBVM=8589934464|FKVM=8589864352|FKEM=0|CPRMS0=34,34,34|
NIC0IP=10.28.0.144|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüC
20/5/2019 7:17:58 ontrollerü#2|NIC0MAC=008064FB707A|RECP0=652|SENDP0=420|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(
20/5/2019 7:17:58 PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualü
20/5/2019 7:17:58 BandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|
20/5/2019 7:17:58
,KB2779562,KB2779768,KB2780541,KB2781197,KB27
20/5/2019 7:17:58
19,KB2794599,KB2795944,KB2798162,KB2798802,KB
20/5/2019 7:17:58
7986,KB2808679,KB2808735,KB2809289,KB2811660,
20/5/2019 7:17:58
829069,KB2829254,KB2829361,KB2829530,KB283029
20/5/2019 7:17:58
0,KB2832450,KB2836946,KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|
AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Z
20/5/2019 7:17:58 ip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService
20/5/2019 7:17:58 ||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalü
20/5/2019 7:17:58 Plusü2013|C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|
20/5/2019 7:17:58 729.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüF
20/5/2019 7:17:58 iles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüA
20/5/2019 7:17:58 gent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.
20/5/2019 7:17:58 0.1219906|AP11=GoogleüChrome|
AP12=MicrosoftüExcel|
20/5/2019 7:17:58 C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|
AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2
20/5/2019 7:17:58 .0.449.0|AP14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|A
20/5/2019 7:17:58 P15=OfficeüXMLüHandler|
15.0.4420.1017|AP16=Microsoftü
20/5/2019 7:17:58 PowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|
15.0.4420.1017|AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.
20/5/2019 7:17:58 4.0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\ProgramüFi
20/5/2019 7:17:58 les\WindowsüMail\wab.exe|6.2.9200.16384|
20/5/2019 7:17:58 6.2.9200.16384|AP21=MicrosoftüWord|
WCMSupp=1|WCMJ
20/5/2019 7:17:58 SONSupp=1|
20/5/2019 7:17:59 Found HS Tag
ProcessMsg!
then clear it here
20/5/2019 7:17:59 Server Sent 5
20/5/2019 7:17:59 Enhanced QU : QUM :
20/5/2019 7:17:59 Enhanced QU : QUC :
20/5/2019 7:17:59 Enhanced QU : QUD :
20/5/2019 7:17:59 Server Sent 6
20/5/2019 7:17:59 LOOKING FOR &04
20/5/2019 7:17:59 FUR :After S&P done
20/5/2019 8:18:59 Received data: 0 &
Accept: */*
Connection: close
20/5/2019 8:18:59 =0.7,*;q=0.7

Accept: */*
Connection: close
20/5/2019 8:18:59 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
443
20/5/2019 8:19:0 GetIP :: *** PPP
-1879041014
20/5/2019 8:19:0 ip RETRIVED @|'
10.20.15.151, SecurePort: 443
20/5/2019 8:19:0 SETTING REG TO VALUE @|'
reported: 28
20/5/2019 8:19:0 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
20/5/2019 8:19:0 Pipe not found
20/5/2019 8:19:0 The count is 7
20/5/2019 8:19:0 bSet is 1
securePort: 443
20/5/2019 8:19:0 Calling V01
20/5/2019 8:19:0 Merlin version 354
20/5/2019 8:19:0 Signature 354
20/5/2019 8:19:1 Wyse Flag value 0011
20/5/2019 8:19:1 The iBLP value -1
20/5/2019 8:19:2 TZ Queried
20/5/2019 8:19:2 FUR : GetCI() 1
20/5/2019 8:19:2 IP matched!
20/5/2019 8:19:2 Subnet з
20/5/2019 8:19:2 Gateway �
20/5/2019 8:19:2 DS �
&
&
&
83FF-9A7F0B2B2
20/5/2019 8:19:2 E1E}
20/5/2019 8:19:2 Got reply from AgentUI=0#(
20/5/2019 8:19:2 GetDisplayInfo() return=�K&
20/5/2019 8:19:2 Disk offset 659554304
20/5/2019 8:19:2 Disk 0 Part 1 TYPE 260
20/5/2019 8:19:2 Disk 0 Part 5 TYPE 261

20/5/2019 8:19:2 Secure boot = 1

20/5/2019 8:19:2 tempbuff = |WIN0=Parcial de costos - Hojas de c�lculo de Google
- Mozilla Firefox (Navegaci�n privada)|WIN1=TABLA (Solo lectura)
20/5/2019 8:19:2 [Modo de compatibilidad] - Word|WIN2=Program Manager|, num=0
20/5/2019 8:19:2 Msg recd from AgentGUI:|WIN0=Parcial de costos - Hojas de
c�lculo de Google - Mozilla Firefox (Navegaci�n privada)|WIN1=TABLA (S
20/5/2019 8:19:2 olo lectura) [Modo de compatibilidad] - Word|WIN2=Program
Manager|
20/5/2019 8:19:2 Got reply from AgentUI=`N+
20/5/2019 8:19:2 return from ListAllApps=��(
20/5/2019 8:19:9 size of qfe list 64
20/5/2019 8:19:9 Value found for LocalXMLPath = �(
20/5/2019 8:19:9 WDAVersion = 12.1.1.25
20/5/2019 8:19:9 GetCI() done
20/5/2019 8:19:9 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
20/5/2019 8:19:9 er.exe|PRC40=DtcWdaUi.exe|PRC41=hagent.exe|PRC42=HAgent_UI.exe|
PRC43=tvnserver.exe|PRC44=RAVCpl64.exe|PRC45=concentr.exe|PRC46=r
PRC55=firefox.exe|PRC56=firefox.exe|PRC57=firefox.exe|PRC58=firefox.exe|PRC59=fi
20/5/2019 8:19:9 refox.exe|PRC60=firefox.exe|PRC61=firefox.exe|
PRC62=WINWORD.EXE|PRC63=SearchProtocolHost.exe|PRC64=SearchFilterHost.exe|PRC65=wm
20/5/2019 8:19:9 iprvse.exe||WIN0=Parcialüdeücostosü-
üHojasüdeüc�lculoüdeüGoogleü-üMozillaüFirefoxü(Navegaci�nüprivada)|WIN1=TABLAü
20/5/2019 8:19:9 (Soloülectura)ü[Modoüdeücompatibilidad]ü-üWord|
WIN2=ProgramüManager||PMIU=58|TBPM=7786256|FBPM=3229532|TBPF=7786256|FBPF=
NIC0IP=10.28.0.144|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamily�
20/5/2019 8:19:9 �Controllerü#2|NIC0MAC=008064FB707A|RECP0=132313|SENDP0=32691|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDe
20/5/2019 8:19:9 viceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|
SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)�
20/5/2019 8:19:9 �DualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|
20/5/2019 8:19:9
2778930,KB2779562,KB2779768,KB2780541,KB27811
20/5/2019 8:19:9
KB2794119,KB2794599,KB2795944,KB2798162,KB279
20/5/2019 8:19:9
7,KB2807986,KB2808679,KB2808735,KB2809289,KB2
20/5/2019 8:19:9
241,KB2829069,KB2829254,KB2829361,KB2829530,K
20/5/2019 8:19:9
45690,|AP0=7-Zipü18.05ü(x64)|C:\ProgramüFi
20/5/2019 8:19:9 les\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceü
20/5/2019 8:19:9 Service||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOfficeüProfess
20/5/2019 8:19:9 ionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|
15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64�
20/5/2019 8:19:9 �9.0.30729.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\Pro
20/5/2019 8:19:9 gramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDe
20/5/2019 8:19:9 viceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Clien
20/5/2019 8:19:9 t\|5.4.0.1219906|AP11=GoogleüChrome|
AP12=Microsoft�
20/5/2019 8:19:9 �Excel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|
AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\fbwfmg
20/5/2019 8:19:9 r.EXE|2.0.449.0|AP14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.
20/5/2019 8:19:9 16384|AP15=OfficeüXMLüHandler|
15.0.4420.1017|AP16=Micr
20/5/2019 8:19:9 osoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|
15.0.4420.1017|AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.e
20/5/2019 8:19:9 xe|2.6.4.0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\Prog
20/5/2019 8:19:9 ramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüMail\wabm
20/5/2019 8:19:9 ig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
WCMSupp
20/5/2019 8:19:9 =1|WCMJSONSupp=1|
20/5/2019 8:19:9 Found HS Tag
then clear it here
20/5/2019 8:19:10 Server Sent 5
20/5/2019 8:19:10 Enhanced QU : QUM :
20/5/2019 8:19:10 Enhanced QU : QUC :
20/5/2019 8:19:10 Enhanced QU : QUD :
20/5/2019 8:19:10 Server Sent 6
20/5/2019 8:19:10 LOOKING FOR &04
20/5/2019 8:19:10 FUR :After S&P done
GetServerAddress
securePort: 443
20/5/2019 9:22:49 GetIP :: *** PPP
-1879041014
20/5/2019 9:22:49 ip RETRIVED i'
10.20.15.151, SecurePort: 443
20/5/2019 9:22:49 SETTING REG TO VALUE i'
reported: 28
20/5/2019 9:22:49 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 9:22:49 Pipe not found
20/5/2019 9:22:49 The count is 7
20/5/2019 9:22:49 bSet is 1
securePort: 443
20/5/2019 9:22:49 Value found for LocalXMLPath = ��(
20/5/2019 9:22:49 WDAVersion = 12.1.1.25
20/5/2019 9:22:50 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 9:22:51 1|VI=1|
20/5/2019 9:22:51 Found HS Tag
ProcessMsg!
then clear it here
20/5/2019 9:22:51 Server Sent 5
20/5/2019 9:22:51 Enhanced QU : QUM :
20/5/2019 9:22:51 Enhanced QU : QUC :
20/5/2019 9:22:51 Enhanced QU : QUD :
20/5/2019 9:22:51 Server Sent 6
20/5/2019 9:22:51 LOOKING FOR &04
GetServerAddress
securePort: 443
20/5/2019 10:25:49 GetIP :: *** PPP
IN_ADDR : -1879041014
20/5/2019 10:25:49 ip RETRIVED #h'
10.20.15.151, SecurePort: 443
20/5/2019 10:25:49 SETTING REG TO VALUE #h'
reported: 28
20/5/2019 10:25:49 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 10:25:49 Pipe not found
20/5/2019 10:25:49 The count is 7
20/5/2019 10:25:49 bCheckServer is 1
20/5/2019 10:25:49 bSet is 1
securePort: 443
20/5/2019 10:25:49 Value found for LocalXMLPath = ��(
20/5/2019 10:25:50 WDAVersion = 12.1.1.25
20/5/2019 10:25:50 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 10:25:51 1|VI=1|
20/5/2019 10:25:51 Found HS Tag
ProcessMsg!
20/5/2019 10:25:51 Server Sent 5
20/5/2019 10:25:51 Enhanced QU : QUM :
20/5/2019 10:25:51 Enhanced QU : QUC :
20/5/2019 10:25:51 Enhanced QU : QUD :
20/5/2019 10:25:51 Server Sent 6
20/5/2019 10:25:51 LOOKING FOR &04
GetServerAddress
securePort: 443
20/5/2019 11:26:16 GetIP :: *** PPP
IN_ADDR : -1879041014
20/5/2019 11:26:16 ip RETRIVED �c'
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
20/5/2019 11:26:21 C80B-4C42-8011-32B62020ACA3}, Type=6
20/5/2019 11:26:21 476A-8590-E6333C53F805}, Type=71
20/5/2019 11:26:21 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
20/5/2019 11:26:21 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
20/5/2019 11:26:22 ip RETRIVED �v'
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
20/5/2019 11:26:27 C80B-4C42-8011-32B62020ACA3}, Type=6
20/5/2019 11:26:27 476A-8590-E6333C53F805}, Type=71
20/5/2019 11:26:27 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 11:27:18 ip RETRIVED �v'
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
20/5/2019 11:27:24 C80B-4C42-8011-32B62020ACA3}, Type=6
20/5/2019 11:27:24 476A-8590-E6333C53F805}, Type=71
20/5/2019 11:27:30 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 11:27:30 ip RETRIVED Pl'
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
20/5/2019 11:27:35 C80B-4C42-8011-32B62020ACA3}, Type=6
20/5/2019 11:27:35 476A-8590-E6333C53F805}, Type=71
20/5/2019 12:23:21 Received data: 0 &
Accept: */*
20/5/2019 12:23:21 jects/mechanize/)
Connection: close
20/5/2019 12:23:21 =0.7,*;q=0.7

Accept: */*
Connection: close
20/5/2019 12:23:21 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 12:23:21 ip RETRIVED �c'
10.20.15.151, SecurePort: 443
20/5/2019 12:23:21 SETTING REG TO VALUE �c'
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 12:23:22 Pipe not found
20/5/2019 12:23:22 The count is 7
20/5/2019 12:23:22 bCheckServer is 1
20/5/2019 12:23:22 bSet is 1
securePort: 443
20/5/2019 12:23:22 Calling V01
20/5/2019 12:23:22 Merlin version 354
20/5/2019 12:23:22 Signature 354
20/5/2019 12:23:22 Wyse Flag value 0011
20/5/2019 12:23:23 The iBLP value -1
20/5/2019 12:23:24 TZ Queried
Number
20/5/2019 12:23:24 FUR : GetCI() 1
20/5/2019 12:23:24 IP matched!
20/5/2019 12:23:24 Subnet з
20/5/2019 12:23:24 Gateway �
20/5/2019 12:23:24 DS �
83FF-9A7F0B2B2
20/5/2019 12:23:24 E1E}
20/5/2019 12:23:24 Got reply from AgentUI=�e-
20/5/2019 12:23:24 add only adapter.
20/5/2019 12:23:24 GetDisplayInfo() return=�O,
20/5/2019 12:23:24 Disk offset 659554304
20/5/2019 12:23:24 Disk 0 Part 1 TYPE 260

20/5/2019 12:23:24 Disk 0 Part 5 TYPE 261

20/5/2019 12:23:24 Secure boot = 1

20/5/2019 12:23:24 tempbuff = |WIN0=Que es un flex�metro y para que sirve? -
Ingenier�a Mecafenix - Google Chrome|WIN1=Program Manager|, num=0
20/5/2019 12:23:24 Msg recd from AgentGUI:|WIN0=Que es un flex�metro y para que
sirve? - Ingenier�a Mecafenix - Google Chrome|WIN1=Program Manager|
20/5/2019 12:23:24 Got reply from AgentUI=`#-
20/5/2019 12:23:24 return from ListAllApps=p -
20/5/2019 12:23:30 size of qfe list 64
20/5/2019 12:23:30 Value found for LocalXMLPath = �7,
20/5/2019 12:23:30 WDAVersion = 12.1.1.25
20/5/2019 12:23:30 GetCI() done
20/5/2019 12:23:30 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC46=r
PRC55=chrome.exe|PRC56=chrome.exe|PRC57=chrome.exe|PRC58=chrome.exe|PRC59=chrome
20/5/2019 12:23:30 .exe|PRC60=chrome.exe|PRC61=chrome.exe|PRC62=chrome.exe|
20/5/2019 12:23:30 7=chrome.exe|PRC68=chrome.exe|PRC69=SelfService.exe|
PRC70=svchost.exe|PRC71=chrome.exe|PRC72=taskeng.exe|PRC73=chrome.exe|PRC74=
20/5/2019 12:23:30 chrome.exe|PRC75=chrome.exe|PRC76=chrome.exe|
PRC77=chrome.exe|PRC78=chrome.exe|PRC79=wmiprvse.exe||WIN0=Queüesüunüflex�metro�
20/5/2019 12:23:30 �yüparaüqueüsirve?ü-üIngenier�aüMecafenixü-üGoogleüChrome|
WIN1=ProgramüManager||PMIU=49|TBPM=7786256|FBPM=3903860|TBPF
20/5/2019 12:23:30 =7786256|FBPF=3424464|TBVM=8589934464|FKVM=8589863336|FKEM=0|
CPRMS0=134,4,52|NIC0IP=10.28.0.144|NIC0DESC=Ethernet,InventecüPCIe
20/5/2019 12:23:30 üGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|RECP0=725518|
SENDP0=273823|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Etherne
20/5/2019 12:23:30 t,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Eth
20/5/2019 12:23:30 ernet,Intel(R)üDualüBandüWireless-ACü7260|
NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,KB2729462,KB27
20/5/2019 12:23:30
94,KB2778344,KB2778930,KB2779562,KB2779768,KB
20/5/2019 12:23:30
2100,KB2793210,KB2794119,KB2794599,KB2795944,
20/5/2019 12:23:30
805222,KB2805227,KB2807986,KB2808679,KB280873
20/5/2019 12:23:30
B2821895,KB2822241,KB2829069,KB2829254,KB2829
20/5/2019 12:23:30
,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)
20/5/2019 12:23:30 |C:\ProgramüFiles\7-Zip\|18.05|
AP2=Mozilla
20/5/2019 12:23:30 üMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=Microsoftü
20/5/2019 12:23:30 OfficeüProfessionalüPlusü2013|
+ü2008üRedistrib
20/5/2019 12:23:30 utableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=MicrosoftüSil
20/5/2019 12:23:30 verlight|c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMw
20/5/2019 12:23:30 areüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
20/5/2019 12:23:30 AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|
15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|C:\Windows\
20/5/2019 12:23:30 System32\fbwfmgr.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD
20/5/2019 12:23:30 .EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
20/5/2019 12:23:30 .1017|AP16=MicrosoftüPowerPoint|
C:\ProgramüFiles\Tight
20/5/2019 12:23:30 VNC\tvnserver.exe|2.6.4.0|
AP19=WindowsüC
20/5/2019 12:23:30 ontacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\Win
20/5/2019 12:23:30 dowsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=
20/5/2019 12:23:30 0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
20/5/2019 12:23:30 Found HS Tag
ProcessMsg!
20/5/2019 12:23:30 Server Sent 5
20/5/2019 12:23:30 Enhanced QU : QUM :
20/5/2019 12:23:31 Enhanced QU : QUC :
20/5/2019 12:23:31 Enhanced QU : QUD :
20/5/2019 12:23:31 Server Sent 6
20/5/2019 12:23:31 LOOKING FOR &04
20/5/2019 12:23:31 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 13:24:43 ip RETRIVED Pl'
10.20.15.151, SecurePort: 443
20/5/2019 13:24:43 SETTING REG TO VALUE Pl'
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 13:24:43 Pipe not found
20/5/2019 13:24:43 The count is 7
20/5/2019 13:24:43 bCheckServer is 1
20/5/2019 13:24:43 bSet is 1
securePort: 443
20/5/2019 13:24:43 Value found for LocalXMLPath = �;,
20/5/2019 13:24:43 WDAVersion = 12.1.1.25
20/5/2019 13:24:44 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 13:24:44 -1|VI=1|
20/5/2019 13:24:44 Found HS Tag
ProcessMsg!
20/5/2019 13:24:44 Server Sent 5
20/5/2019 13:24:44 Enhanced QU : QUM :
20/5/2019 13:24:44 Enhanced QU : QUC :
20/5/2019 13:24:44 Enhanced QU : QUD :
20/5/2019 13:24:44 Server Sent 6
20/5/2019 13:24:44 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 14:26:38 ip RETRIVED �v'
10.20.15.151, SecurePort: 443
20/5/2019 14:26:38 SETTING REG TO VALUE �v'
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 14:26:38 Pipe not found
20/5/2019 14:26:38 The count is 7
20/5/2019 14:26:38 bCheckServer is 1
20/5/2019 14:26:38 bSet is 1
securePort: 443
20/5/2019 14:26:38 WDAVersion = 12.1.1.25
20/5/2019 14:26:39 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 14:26:39 -1|VI=1|
20/5/2019 14:26:40 Found HS Tag
ProcessMsg!
20/5/2019 14:26:40 Server Sent 5
20/5/2019 14:26:40 Enhanced QU : QUM :
20/5/2019 14:26:40 Enhanced QU : QUC :
20/5/2019 14:26:40 Enhanced QU : QUD :
20/5/2019 14:26:40 Server Sent 6
20/5/2019 14:26:40 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 15:29:48 ip RETRIVED �c'
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 15:29:48 Pipe not found
20/5/2019 15:29:48 The count is 7
20/5/2019 15:29:48 bCheckServer is 1
20/5/2019 15:29:49 bSet is 1
securePort: 443
20/5/2019 15:29:49 WDAVersion = 12.1.1.25
20/5/2019 15:29:49 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 15:29:50 -1|VI=1|
20/5/2019 15:29:50 Found HS Tag
ProcessMsg!
20/5/2019 15:29:50 Server Sent 5
20/5/2019 15:29:50 Enhanced QU : QUM :
20/5/2019 15:29:50 Enhanced QU : QUC :
20/5/2019 15:29:50 Enhanced QU : QUD :
20/5/2019 15:29:50 Server Sent 6
20/5/2019 15:29:50 LOOKING FOR &04
20/5/2019 16:17:53 Received data: 0 &
Accept: */*
20/5/2019 16:17:53 jects/mechanize/)
Connection: close
20/5/2019 16:17:53 =0.7,*;q=0.7

Accept: */*
Connection: close
20/5/2019 16:17:53 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 16:17:53 ip RETRIVED �u'
10.20.15.151, SecurePort: 443
20/5/2019 16:17:53 SETTING REG TO VALUE �u'
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 16:17:53 Pipe not found
20/5/2019 16:17:53 The count is 7
20/5/2019 16:17:53 bCheckServer is 1
20/5/2019 16:17:53 bSet is 1
securePort: 443
20/5/2019 16:17:53 Calling V01
20/5/2019 16:17:53 Merlin version 354
20/5/2019 16:17:53 Signature 354
20/5/2019 16:17:54 Wyse Flag value 0011
20/5/2019 16:17:55 The iBLP value -1
20/5/2019 16:17:55 TZ Queried
Number
20/5/2019 16:17:55 FUR : GetCI() 1
20/5/2019 16:17:55 IP matched!
20/5/2019 16:17:55 Subnet з
20/5/2019 16:17:55 Gateway �
20/5/2019 16:17:55 DS �
20/5/2019 16:17:55 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=��&
20/5/2019 16:17:55 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=��&
20/5/2019 16:17:55 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=��&
83FF-9A7F0B2B2
20/5/2019 16:17:55 E1E}
20/5/2019 16:17:56 Got reply from AgentUI=�c-
20/5/2019 16:17:56 add only adapter.
20/5/2019 16:17:56 Disk offset 659554304
20/5/2019 16:17:56 Disk 0 Part 1 TYPE 260

20/5/2019 16:17:56 Disk 0 Part 5 TYPE 261

20/5/2019 16:17:56 Secure boot = 1

20/5/2019 16:17:56 tempbuff = |WIN0=Din�mica de estructuras - Google Chrome|
WIN1=Libros Dinamica - copia|WIN2=Program Manager|, num=0
20/5/2019 16:17:56 Msg recd from AgentGUI:|WIN0=Din�mica de estructuras - Google
Chrome|WIN1=Libros Dinamica - copia|WIN2=Program Manager|
20/5/2019 16:17:56 Got reply from AgentUI=�O,
20/5/2019 16:17:56 return from ListAllApps=P
20/5/2019 16:18:1 size of qfe list 64
20/5/2019 16:18:1 Value found for LocalXMLPath = Џ+
20/5/2019 16:18:1 WDAVersion = 12.1.1.25
20/5/2019 16:18:1 GetCI() done
20/5/2019 16:18:1 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
20/5/2019 16:18:1 |TFB1=842629120|DRV2=Z:|TB2=1073643520|TFB2=1064534016||
PRC0=smss.exe|PRC1=csrss.exe|PRC2=wininit.exe|PRC3=csrss.exe|PRC4=servic
20/5/2019 16:18:1 es.exe|PRC5=winlogon.exe|PRC6=lsass.exe|PRC7=svchost.exe|
PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|PRC55=chrome.exe|PRC56=chrome.exe|PRC57=ch
PRC61=chrome.exe|PRC62=WUDFHost.exe|PRC63=chrome.exe|PRC64=chrome.ex
20/5/2019 16:18:1 e|PRC65=chrome.exe|PRC66=chrome.exe|PRC67=chrome.exe|
PRC68=chrome.exe|PRC69=chrome.exe|PRC70=chrome.exe|PRC71=chrome.exe|PRC72=c
PRC76=chrome.exe|PRC77=wmiprvse.exe||WIN0=Din�micaüdeüestructuras
20/5/2019 16:18:1 ü-üGoogleüChrome|WIN1=LibrosüDinamicaü-ücopia|
WIN2=ProgramüManager||PMIU=46|TBPM=7786256|FBPM=4158284|TBPF=7786256|FBPF=3
NIC0IP=10.28.0.144|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyü
20/5/2019 16:18:1 Controllerü#2|NIC0MAC=008064FB707A|RECP0=795911|SENDP0=317115|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDe
20/5/2019 16:18:1 viceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|
SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)�
20/5/2019 16:18:1 �DualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|
20/5/2019 16:18:1
2778930,KB2779562,KB2779768,KB2780541,KB27811
20/5/2019 16:18:1
KB2794119,KB2794599,KB2795944,KB2798162,KB279
20/5/2019 16:18:1
7,KB2807986,KB2808679,KB2808735,KB2809289,KB2
20/5/2019 16:18:1
241,KB2829069,KB2829254,KB2829361,KB2829530,K
20/5/2019 16:18:1
45690,|AP0=7-Zipü18.05ü(x64)|C:\ProgramüFi
20/5/2019 16:18:1 les\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceü
20/5/2019 16:18:1 Service||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOfficeüProfess
20/5/2019 16:18:1 ionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|
15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64�
20/5/2019 16:18:1 �9.0.30729.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\Pro
20/5/2019 16:18:1 gramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDe
20/5/2019 16:18:1 viceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Clien
20/5/2019 16:18:1 t\|5.4.0.1219906|AP11=GoogleüChrome|
AP12=Microsoft�
20/5/2019 16:18:1 �Excel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|
AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\fbwfmg
20/5/2019 16:18:1 r.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.
15.0.4420.1017|AP16=Micr
20/5/2019 16:18:1 osoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|
15.0.4420.1017|AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.e
20/5/2019 16:18:1 xe|2.6.4.0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\Prog
20/5/2019 16:18:1 ramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüMail\wabm
20/5/2019 16:18:1 ig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
WCMSupp
20/5/2019 16:18:1 =1|WCMJSONSupp=1|
20/5/2019 16:18:1 Found HS Tag
ProcessMsg!
then clear it here
20/5/2019 16:18:1 Server Sent 5
20/5/2019 16:18:1 Enhanced QU : QUM :
20/5/2019 16:18:1 Enhanced QU : QUC :
20/5/2019 16:18:1 Enhanced QU : QUD :
20/5/2019 16:18:2 Server Sent 6
20/5/2019 16:18:2 LOOKING FOR &04
20/5/2019 16:18:2 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 17:20:53 ip RETRIVED �c'
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 17:20:54 Pipe not found
20/5/2019 17:20:54 The count is 7
20/5/2019 17:20:54 bCheckServer is 1
20/5/2019 17:20:54 bSet is 1
securePort: 443
20/5/2019 17:20:54 Value found for LocalXMLPath = �{+
20/5/2019 17:20:54 WDAVersion = 12.1.1.25
20/5/2019 17:20:54 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 17:20:55 -1|VI=1|
20/5/2019 17:20:55 Found HS Tag
ProcessMsg!
20/5/2019 17:20:55 Server Sent 5
20/5/2019 17:20:55 Enhanced QU : QUM :
20/5/2019 17:20:55 Enhanced QU : QUC :
20/5/2019 17:20:55 Enhanced QU : QUD :
20/5/2019 17:20:55 Server Sent 6
20/5/2019 17:20:55 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 18:23:40 ip RETRIVED i'
10.20.15.151, SecurePort: 443
20/5/2019 18:23:40 SETTING REG TO VALUE i'
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 18:23:40 Pipe not found
20/5/2019 18:23:40 The count is 7
20/5/2019 18:23:40 bCheckServer is 1
20/5/2019 18:23:40 bSet is 1
securePort: 443
20/5/2019 18:23:41 Value found for LocalXMLPath = �=(
20/5/2019 18:23:41 WDAVersion = 12.1.1.25
20/5/2019 18:23:41 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 18:23:42 -1|VI=1|
20/5/2019 18:23:42 Found HS Tag
ProcessMsg!
20/5/2019 18:23:42 Server Sent 5
20/5/2019 18:23:42 Enhanced QU : QUM :
20/5/2019 18:23:42 Enhanced QU : QUC :
20/5/2019 18:23:42 Enhanced QU : QUD :
20/5/2019 18:23:42 Server Sent 6
20/5/2019 18:23:42 LOOKING FOR &04
20/5/2019 19:9:27 Stopping
20/5/2019 19:10:14 ***********************************************************
20/5/2019 19:10:15 End of WinMain()
20/5/2019 19:10:15 ^^^^^^^^ after reghanex()
20/5/2019 19:10:35 OS Version 6.2.9200
20/5/2019 19:10:35 OS Version 6.2.9200
20/5/2019 19:10:35 Major version 6
20/5/2019 19:10:35 Minor version 2
20/5/2019 19:10:35 Device Info: OS is �#
20/5/2019 19:10:35 The image has UWF
20/5/2019 19:10:35 WRITE FILTER UWF 1
20/5/2019 19:10:35 Setting UWF Mgr!
20/5/2019 19:10:35 Disk offset 659554304
20/5/2019 19:10:35 Disk offset =1048576

20/5/2019 19:10:35 Disk offset =105906176
20/5/2019 19:10:35 Disk offset =420478976
20/5/2019 19:10:35 Disk offset =525336576
20/5/2019 19:10:35 Disk offset =659554304

'Z:\',error=1
20/5/2019 19:10:35 AF_INET (IPv4)
20/5/2019 19:10:35 IPv4 address 169.254.150.182
20/5/2019 19:10:35 Valid IP Found

20/5/2019 19:10:35 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
20/5/2019 19:10:35 HA Supported
20/5/2019 19:10:35 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 19:10:36 ip RETRIVED pe#
10.20.15.151, SecurePort: 443
20/5/2019 19:10:36 SETTING REG TO VALUE pe#
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 19:10:37 Pipe not found
20/5/2019 19:10:37 The count is 7
20/5/2019 19:10:37 bCheckServer is 1
20/5/2019 19:10:37 bSet is 1
securePort: 443
20/5/2019 19:10:37 Calling V01
20/5/2019 19:10:37 Merlin version 354
20/5/2019 19:10:37 Signature 354
20/5/2019 19:10:37 Wyse Flag value 0011
20/5/2019 19:10:38 The iBLP value -1
20/5/2019 19:10:39 TZ Queried
Number
20/5/2019 19:10:39 FUR : GetCI() 1
20/5/2019 19:10:39 IP matched!
20/5/2019 19:10:39 Subnet P�#
20/5/2019 19:10:39 Gateway �#
20/5/2019 19:10:39 DS к#
20/5/2019 19:10:39 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=P�#
20/5/2019 19:10:39 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=P�#
20/5/2019 19:10:39 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=P�#
83FF-9A7F0B2B2
20/5/2019 19:10:39 E1E}
20/5/2019 19:10:39 Got reply from AgentUI=#u#
20/5/2019 19:10:39 add only adapter.
20/5/2019 19:10:39 GetDisplayInfo() return=�D#
20/5/2019 19:10:39 Disk offset 659554304
20/5/2019 19:10:39 Disk 0 Part 1 TYPE 260

20/5/2019 19:10:39 Disk 0 Part 5 TYPE 261

20/5/2019 19:10:39 Secure boot = 1

20/5/2019 19:10:39 tempbuff = |, num=0
20/5/2019 19:10:39 Got reply from AgentUI=�d#
20/5/2019 19:10:39 return from ListAllApps=�T#
20/5/2019 19:10:49 size of qfe list 64
20/5/2019 19:10:50 Value found for LocalXMLPath = � #
20/5/2019 19:10:50 WDAVersion = 12.1.1.25
20/5/2019 19:10:50 GetCI() done
'Z:\',error=1
securePort: 443
20/5/2019 19:10:50 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC27=NetXCle
PRC37=vmware-usbarbitrator64.exe|PRC38=wmiprvse.exe|PRC39=vmware-view-usb
20/5/2019 19:10:50 d.exe|PRC40=svchost.exe|PRC41=wmiprvse.exe|
PRC42=SearchIndexer.exe|PRC43=vssvc.exe|PRC44=SearchProtocolHost.exe|
PRC45=svchost.ex
20/5/2019 19:10:50 e|PRC46=SearchFilterHost.exe|PRC47=msiexec.exe|
PRC48=DtcWdaUi.exe|PRC49=hagent.exe|PRC50=HAgent_UI.exe|PRC51=tvnserver.exe|PRC52
20/5/2019 19:10:50 =UWFTray.exe|PRC53=RAVCpl64.exe|PRC54=concentr.exe|
PRC55=redirector.exe|PRC56=GoogleUpdate.exe|PRC57=PNUSBCLITRAY.exe|PRC58=PNTr
20/5/2019 19:10:50 ay.exe|PRC59=Receiver.exe|PRC60=SelfServicePlugin.exe|
PRC61=wfcrun32.exe|PRC62=DllHost.exe|PRC63=GoogleUpdateSetup.exe|||PMIU=33
20/5/2019 19:10:50 |TBPM=7786256|FBPM=5148084|TBPF=7786256|FBPF=5093136|
TBVM=8589934464|FKVM=8589865384|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28.0.144|NIC0
20/5/2019 19:10:50 DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=1346|SENDP0=392|MIBSP0=1000üMbps||NIC1IP=0
20/5/2019 19:10:50 .0.0.0|
RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2
20/5/2019 19:10:50 IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-
ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=K
20/5/2019 19:10:50
69166,KB2770917,KB2777294,KB2778344,KB2778930
20/5/2019 19:10:50
2790655,KB2790907,KB2792100,KB2793210,KB27941
20/5/2019 19:10:50
KB2804583,KB2804584,KB2805222,KB2805227,KB280
20/5/2019 19:10:50
3,KB2818604,KB2820330,KB2821895,KB2822241,KB2
20/5/2019 19:10:50
988,KB2838727,KB2839894,KB2845533,KB2845690,|
20/5/2019 19:10:50 AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFir
20/5/2019 19:10:50 efox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
20/5/2019 19:10:50 20.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisua
20/5/2019 19:10:50 lüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||
9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDataba
20/5/2019 19:10:50 se|||AP7=MicrosoftüSilverlight|
+ü2005üRedistri
20/5/2019 19:10:50 butableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\Pr
20/5/2019 19:10:50 ogramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application\ch
20/5/2019 19:10:50 rome.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-basedüwriteüfilt
20/5/2019 19:10:50 erümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\Inter
20/5/2019 19:10:50 netüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15
20/5/2019 19:10:50 \MSOXMLED.EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
20/5/2019 19:10:50 C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.
20/5/2019 19:10:50 0.127.0|AP19=WindowsüContacts|
AP20=Microsoftü(R)üContactsüImportüToo
20/5/2019 19:10:50 l|C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.
20/5/2019 19:10:50 Found HS Tag
ProcessMsg!
20/5/2019 19:10:50 Server Sent 5
20/5/2019 19:10:50 Enhanced QU : QUM :
20/5/2019 19:10:50 Enhanced QU : QUC :
20/5/2019 19:10:50 Enhanced QU : QUD :
20/5/2019 19:10:50 Server Sent 6
20/5/2019 19:10:50 LOOKING FOR &04
20/5/2019 19:10:50 FUR :After S&P done
20/5/2019 19:21:43 Received data: P�#
Host: wes008064fb707a.udistrital.edu.co
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accep
20/5/2019 19:21:43 t-Language: es-CO,en,*
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, def
20/5/2019 19:21:43 late
Accept-Language: es-CO,en,*

refresh settings!
20/5/2019 19:21:43 Received data: P�#
Accep

20/5/2019 19:21:43 late

refresh settings!
20/5/2019 19:21:43 Received data: P�#
Accep

20/5/2019 19:21:43 late

refresh settings!
20/5/2019 19:21:43 Received data: P�#
Accep

20/5/2019 19:21:43 late

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
20/5/2019 19:21:43 ip RETRIVED
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
20/5/2019 19:21:43 Pipe not found
20/5/2019 19:21:43 The count is 7
20/5/2019 19:21:43 bCheckServer is 1
20/5/2019 19:21:43 bSet is 1
securePort: 443
20/5/2019 19:21:43 Calling V01
20/5/2019 19:21:43 Merlin version 354
20/5/2019 19:21:43 Signature 354
20/5/2019 19:21:44 Wyse Flag value 0011
20/5/2019 19:21:44 The iBLP value -1
20/5/2019 19:21:45 TZ Queried
Number
20/5/2019 19:21:45 FUR : GetCI() 1
20/5/2019 19:21:45 IP matched!
20/5/2019 19:21:45 Subnet P�#
20/5/2019 19:21:45 Gateway �#
20/5/2019 19:21:45 DS к#
20/5/2019 19:21:45 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=p�#
20/5/2019 19:21:45 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=p�#
20/5/2019 19:21:45 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=p�#
83FF-9A7F0B2B2
20/5/2019 19:21:45 E1E}
20/5/2019 19:21:45 Got reply from AgentUI=p*#
20/5/2019 19:21:45 add only adapter.
20/5/2019 19:21:45 GetDisplayInfo() return=�t#
20/5/2019 19:21:45 Disk offset 659554304
20/5/2019 19:21:45 Disk 0 Part 1 TYPE 260

20/5/2019 19:21:45 Disk 0 Part 5 TYPE 261

20/5/2019 19:21:45 Secure boot = 1

20/5/2019 19:21:45 tempbuff = |WIN0=PRUEBA DE VACIO Y CORTOCIRCUITO (1).pdf -
Google Chrome|WIN1=Sitio Web BIBLIOTECA UD - Portal Web Sistema de Bi
20/5/2019 19:21:45 bliotecas - Google Chrome|WIN2=Program Manager|, num=0
20/5/2019 19:21:45 Msg recd from AgentGUI:|WIN0=PRUEBA DE VACIO Y CORTOCIRCUITO
(1).pdf - Google Chrome|WIN1=Sitio Web BIBLIOTECA UD - Portal Web S
20/5/2019 19:21:45 istema de Bibliotecas - Google Chrome|WIN2=Program Manager|
20/5/2019 19:21:45 Got reply from AgentUI=�##
20/5/2019 19:21:45 return from ListAllApps=�##
20/5/2019 19:21:51 size of qfe list 64
20/5/2019 19:21:51 Value found for LocalXMLPath = ` #
20/5/2019 19:21:51 WDAVersion = 12.1.1.25
20/5/2019 19:21:51 GetCI() done
20/5/2019 19:21:51 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
20/5/2019 19:21:51 |PRC21=svchost.exe|PRC22=taskhostex.exe|PRC23=svchost.exe|
PRC24=svchost.exe|PRC25=mqsvc.exe|PRC26=NetXClean.exe|PRC27=pnusbvirtu
20/5/2019 19:21:51 alhubwssrv.exe|PRC28=tcpsvcs.exe|PRC29=snmp.exe|
PRC30=tvnserver.exe|PRC31=UWFSvc.exe|PRC32=MsMpEng.exe|PRC33=wsnm.exe|PRC34=DtcW
20/5/2019 19:21:51 DAService.exe|PRC35=mqtgsvc.exe|PRC36=vmware-
usbarbitrator64.exe|PRC37=wmiprvse.exe|PRC38=vmware-view-usbd.exe|PRC39=svchost.exe
20/5/2019 19:21:51 |PRC40=wmiprvse.exe|PRC41=SearchIndexer.exe|
PRC42=DtcWdaUi.exe|PRC43=hagent.exe|PRC44=HAgent_UI.exe|PRC45=tvnserver.exe|
PRC46=RA
20/5/2019 19:21:51 VCpl64.exe|PRC47=concentr.exe|PRC48=redirector.exe|
PRC49=PNUSBCLITRAY.exe|PRC50=PNTray.exe|PRC51=Receiver.exe|PRC52=SelfServiceP
20/5/2019 19:21:51 lugin.exe|PRC53=wfcrun32.exe|PRC54=chrome.exe|
PRC55=chrome.exe|PRC56=chrome.exe|PRC57=chrome.exe|PRC58=chrome.exe|PRC59=chrome.e
20/5/2019 19:21:51 xe|PRC60=chrome.exe|PRC61=chrome.exe|PRC62=CcmExec.exe|
PRC63=wmiprvse.exe|PRC64=wmiprvse.exe|PRC65=chrome.exe|PRC66=chrome.exe|P
20/5/2019 19:21:51 RC67=chrome.exe|PRC68=chrome.exe|PRC69=chrome.exe|
PRC70=msiexec.exe|PRC71=taskeng.exe||WIN0=PRUEBAüDEüVACIOüYüCORTOCIRCUITO�
20/5/2019 19:21:51 �(1).pdfü-üGoogleüChrome|WIN1=SitioüWebüBIBLIOTECAüUDü-
üPortalüWebüSistemaüdeüBibliotecasü-üGoogleüChrome|WIN2=Pr
20/5/2019 19:21:51 ogramüManager||PMIU=38|TBPM=7786256|FBPM=4768068|
TBPF=7786256|FBPF=4385556|TBVM=8589934464|FKVM=8589865384|FKEM=0|CPRMS0=6,6,6|
20/5/2019 19:21:51 NIC0IP=10.28.0.144|
RECP0=61571|SENDP0=21101|M
20/5/2019 19:21:51 IBSP0=1000üMbps||NIC1IP=0.0.0.0|
RECP1=0|SEN
20/5/2019 19:21:51 DP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
SEND
20/5/2019 19:21:51 P2=0|MIBSP2=0üMbps|
5,KB2769166,KB2770917,KB2
20/5/2019 19:21:51
220,KB2789649,KB2789650,KB2790655,KB2790907,K
20/5/2019 19:21:51
98805,KB2799494,KB2800033,KB2804583,KB2804584
20/5/2019 19:21:51
2813170,KB2813430,KB2817183,KB2818604,KB28203
20/5/2019 19:21:51
KB2836946,KB2836947,KB2836988,KB2838727,KB283
20/5/2019 19:21:51 9894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\P
20/5/2019 19:21:51 rogramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles
20/5/2019 19:21:51 \MicrosoftüOffice|15.0.4420.1017|
15.0.4420
20/5/2019 19:21:51 .1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-
üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWindowsüEmbedded
20/5/2019 19:21:51 üKeyboardüFilterüDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüV
20/5/2019 19:21:51 isualüC++ü2005üRedistributableü(x64)||8.0.61000|
AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüH
20/5/2019 19:21:51 orizonüViewüClient|
C:\ProgramüFilesü(x86)\Go
20/5/2019 19:21:51 ogle\Chrome\Application\chrome.exe|68.0.3440.106|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP
20/5/2019 19:21:51 13=File-basedüwriteüfilterümanager|
AP14=DiagnosticsüutilityüforüInternetüExplor
20/5/2019 19:21:51 er|C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|
10.0.9200.16384|AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\
20/5/2019 19:21:51 MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.
20/5/2019 19:21:51 0.4420.1017|AP17=TightVNC|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Wind
20/5/2019 19:21:51 ows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Microsoftü
20/5/2019 19:21:51 (R)üContactsüImportüTool|
C:\PROGRA~1\MICROS~1\
20/5/2019 19:21:51 Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|
20/5/2019 19:21:51 Found HS Tag
ProcessMsg!
20/5/2019 19:21:51 Server Sent 5
20/5/2019 19:21:51 Enhanced QU : QUM :
20/5/2019 19:21:51 Enhanced QU : QUC :
20/5/2019 19:21:51 Enhanced QU : QUD :
20/5/2019 19:21:51 Server Sent 6
20/5/2019 19:21:51 LOOKING FOR &04
20/5/2019 19:21:51 FUR :After S&P done
20/5/2019 19:53:59 Stopping
21/5/2019 8:8:1 ***********************************************************
21/5/2019 8:8:1 End of WinMain()
21/5/2019 8:8:1 ^^^^^^^^ after reghanex()
21/5/2019 8:8:21 OS Version 6.2.9200
21/5/2019 8:8:21 OS Version 6.2.9200
21/5/2019 8:8:21 Major version 6
21/5/2019 8:8:21 Minor version 2
21/5/2019 8:8:21 Device Info: OS is �#
21/5/2019 8:8:21 Setting UWF Mgr!
21/5/2019 8:8:21 Disk offset 659554304
21/5/2019 8:8:21 Disk offset =1048576

21/5/2019 8:8:21 Disk offset =105906176
21/5/2019 8:8:21 Disk offset =420478976
21/5/2019 8:8:21 Disk offset =525336576
21/5/2019 8:8:21 Disk offset =659554304

'Z:\',error=1
21/5/2019 8:8:21 AF_INET (IPv4)
21/5/2019 8:8:21 IPv4 address 169.254.150.182
21/5/2019 8:8:21 Valid IP Found

21/5/2019 8:8:21 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
443
securePort: 443
21/5/2019 8:8:22 HA Supported
21/5/2019 8:8:22 dwHSListCount = 1
GetServerAddress
443
HuntForAltLocalIP
IN_ADDR : -1231618391
21/5/2019 8:8:22 ip RETRIVED �##
10.20.15.151, SecurePort: 443
Port: 0
21/5/2019 8:8:27 Failed to Bind
ms
reported: 28
21/5/2019 8:8:28 C80B-4C42-8011-32B62020ACA3}, Type=6
21/5/2019 8:8:28 476A-8590-E6333C53F805}, Type=71
secure port 443
21/5/2019 8:8:29 Pipe not found
21/5/2019 8:8:29 The count is 7
21/5/2019 8:8:29 bSet is 1
securePort: 443
21/5/2019 8:8:29 Calling V01
21/5/2019 8:8:29 Merlin version 354
21/5/2019 8:8:29 Signature 354
21/5/2019 8:8:30 Wyse Flag value 0011
21/5/2019 8:8:31 The iBLP value -1
21/5/2019 8:8:31 TZ Queried
21/5/2019 8:8:32 FUR : GetCI() 1
21/5/2019 8:8:32 IP matched!
21/5/2019 8:8:32 Subnet @�#
21/5/2019 8:8:32 Gateway
21/5/2019 8:8:32 DS ��#
21/5/2019 8:8:32 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�
21/5/2019 8:8:32 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�
21/5/2019 8:8:32 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�
83FF-9A7F0B2B2
21/5/2019 8:8:32 E1E}
21/5/2019 8:8:32 Got reply from AgentUI=p�!
21/5/2019 8:8:32 GetDisplayInfo() return=�?#
21/5/2019 8:8:32 Disk offset 659554304
21/5/2019 8:8:32 Disk 0 Part 1 TYPE 260

21/5/2019 8:8:32 Disk 0 Part 5 TYPE 261

21/5/2019 8:8:32 Secure boot = 1
21/5/2019 8:8:32 tempbuff = |, num=0
21/5/2019 8:8:32 Got reply from AgentUI=#;#
21/5/2019 8:8:32 return from ListAllApps=@�
21/5/2019 8:8:39 size of qfe list 64
21/5/2019 8:8:39 Value found for LocalXMLPath = #�!
21/5/2019 8:8:39 WDAVersion = 12.1.1.25
21/5/2019 8:8:39 GetCI() done
'Z:\',error=1
securePort: 443
21/5/2019 8:8:40 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
21/5/2019 8:8:40 DAService.exe|PRC35=mqtgsvc.exe|PRC36=wmiprvse.exe|
PRC37=vmware-usbarbitrator64.exe|PRC38=vmware-view-usbd.exe|PRC39=svchost.exe
21/5/2019 8:8:40 |PRC40=wmiprvse.exe|PRC41=SearchIndexer.exe|PRC42=vssvc.exe|
PRC43=svchost.exe|PRC44=msiexec.exe|PRC45=SearchFilterHost.exe|PRC46
21/5/2019 8:8:40 =DtcWdaUi.exe|PRC47=hagent.exe|PRC48=HAgent_UI.exe|
PRC49=tvnserver.exe|PRC50=RAVCpl64.exe|PRC51=concentr.exe|PRC52=redirector.ex
21/5/2019 8:8:40 e|PRC53=PNUSBCLITRAY.exe|PRC54=PNTray.exe|PRC55=Receiver.exe|
PRC56=SelfServicePlugin.exe|PRC57=wfcrun32.exe|PRC58=GoogleUpdateSe
21/5/2019 8:8:40 tup.exe|PRC59=GoogleUpdate.exe|||PMIU=33|TBPM=7786256|
FBPM=5149608|TBPF=7786256|FBPF=5097644|TBVM=8589934464|FKVM=8589864352|FKE
21/5/2019 8:8:40 M=0|CPRMS0=0,0,0|NIC0IP=10.28.0.144|
RECP0=164
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66
21/5/2019 8:8:40 FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F
21/5/2019 8:8:40 6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|
5,KB2769166
21/5/2019 8:8:40
2785094,KB2785220,KB2789649,KB2789650,KB27906
21/5/2019 8:8:40
KB2798804,KB2798805,KB2799494,KB2800033,KB280
21/5/2019 8:8:40
0,KB2812822,KB2813170,KB2813430,KB2817183,KB2
21/5/2019 8:8:40
290,KB2832450,KB2836946,KB2836947,KB2836988,K
21/5/2019 8:8:40 B2838727,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x6
21/5/2019 8:8:40 4ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|C:\
21/5/2019 8:8:40 ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOff
21/5/2019 8:8:40 ice\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWin
21/5/2019 8:8:40 dowsüEmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP
21/5/2019 8:8:40 8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|
AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
21/5/2019 8:8:40 AP10=VMwareüHorizonüViewüClient|
C:\ProgramüF
21/5/2019 8:8:40 ilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.
21/5/2019 8:8:40 0.4420.1017|AP13=File-basedüwriteüfilterümanager|
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=DiagnosticsüutilityüforüIn
21/5/2019 8:8:40 ternetüExplorer|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\
21/5/2019 8:8:40 CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\PO
21/5/2019 8:8:40 WERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=UnifiedüWriteüFilterüManagerüM
21/5/2019 8:8:40 anager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP
21/5/2019 8:8:40 20=Microsoftü(R)üContactsüImportüTool|
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|C:\PROG
21/5/2019 8:8:40 RA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|
21/5/2019 8:8:40 Found HS Tag
then clear it here
21/5/2019 8:8:40 Server Sent 5
21/5/2019 8:8:40 Enhanced QU : QUM :
21/5/2019 8:8:40 Enhanced QU : QUC :
21/5/2019 8:8:40 Enhanced QU : QUD :
21/5/2019 8:8:40 Server Sent 6
21/5/2019 8:8:40 LOOKING FOR &04
21/5/2019 8:8:40 FUR :After S&P done
GetServerAddress
securePort: 443
21/5/2019 9:11:26 GetIP :: *** PPP
-1879041014
21/5/2019 9:11:26 ip RETRIVED # !
10.20.15.151, SecurePort: 443
21/5/2019 9:11:26 SETTING REG TO VALUE # !
reported: 28
21/5/2019 9:11:26 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 9:11:26 Pipe not found
21/5/2019 9:11:26 The count is 7
21/5/2019 9:11:26 bSet is 1
securePort: 443
21/5/2019 9:11:27 Value found for LocalXMLPath = 0<#
21/5/2019 9:11:27 WDAVersion = 12.1.1.25
21/5/2019 9:11:28 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 9:11:29 -1|VI=1|
21/5/2019 9:11:29 Found HS Tag
ProcessMsg!
then clear it here
21/5/2019 9:11:29 Server Sent 5
21/5/2019 9:11:29 Enhanced QU : QUM :
21/5/2019 9:11:29 Enhanced QU : QUC :
21/5/2019 9:11:29 Enhanced QU : QUD :
21/5/2019 9:11:29 Server Sent 6
21/5/2019 9:11:29 LOOKING FOR &04
21/5/2019 9:46:8 Received data: �#
User-Agent: HomeNet/1.0
Host: 10.28.0.144
Content-Length: 0
Cache-C
21/5/2019 9:46:8 ontrol: no-cache
Connection: keep-alive

Host: 10.28.0.144
Content-Length: 0
Accept-Encoding: gzip, defla
21/5/2019 9:46:8 te
Cache-Control: no-cache
21/5/2019 9:46:8 Although command was invalid, we do a check-in event to refresh

settings!
GetServerAddress
443
21/5/2019 9:46:8 GetIP :: *** PPP
-1879041014
21/5/2019 9:46:8 ip RETRIVED �#!
10.20.15.151, SecurePort: 443
21/5/2019 9:46:8 SETTING REG TO VALUE �#!
reported: 28
21/5/2019 9:46:8 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
21/5/2019 9:46:8 Pipe not found
21/5/2019 9:46:8 The count is 7
21/5/2019 9:46:8 bSet is 1
securePort: 443
21/5/2019 9:46:8 Calling V01
21/5/2019 9:46:8 Merlin version 354
21/5/2019 9:46:8 Signature 354
21/5/2019 9:46:9 Wyse Flag value 0011
21/5/2019 9:46:9 The iBLP value -1
21/5/2019 9:46:10 TZ Queried
Number
21/5/2019 9:46:10 FUR : GetCI() 1
21/5/2019 9:46:10 IP matched!
21/5/2019 9:46:10 Subnet @�#
21/5/2019 9:46:10 Gateway
21/5/2019 9:46:10 DS ��#
21/5/2019 9:46:10 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�!
21/5/2019 9:46:10 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�!
21/5/2019 9:46:10 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�!
83FF-9A7F0B2B2
21/5/2019 9:46:10 E1E}
21/5/2019 9:46:10 Got reply from AgentUI=�d#
21/5/2019 9:46:10 GetDisplayInfo() return=��$
21/5/2019 9:46:10 Disk offset 659554304
21/5/2019 9:46:10 Disk 0 Part 1 TYPE 260

21/5/2019 9:46:10 Disk 0 Part 5 TYPE 261

21/5/2019 9:46:10 Secure boot = 1

21/5/2019 9:46:10 tempbuff = |WIN0=Microsoft PowerPoint - TRANSMISION DE
POTENCIA - Modo de compatibilidad - Google Chrome|WIN1=Disco extra�ble (D
21/5/2019 9:46:10 :)|WIN2=Sitio Web BIBLIOTECA UD - Portal Web Sistema de
Bibliotecas - Mozilla Firefox|WIN3=Program Manager|, num=0
21/5/2019 9:46:10 Msg recd from AgentGUI:|WIN0=Microsoft PowerPoint -
TRANSMISION DE POTENCIA - Modo de compatibilidad - Google Chrome|WIN1=Disco
21/5/2019 9:46:10 extra�ble (D:)|WIN2=Sitio Web BIBLIOTECA UD - Portal Web
Sistema de Bibliotecas - Mozilla Firefox|WIN3=Program Manager|
21/5/2019 9:46:10 Got reply from AgentUI=��!
21/5/2019 9:46:10 return from ListAllApps=0Z$
21/5/2019 9:46:16 size of qfe list 64
21/5/2019 9:46:16 WDAVersion = 12.1.1.25
21/5/2019 9:46:16 GetCI() done
21/5/2019 9:46:16 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
21/5/2019 9:46:16 |TFB1=2399449088|DRV2=Z:|TB2=1073643520|TFB2=1063813120||
21/5/2019 9:46:16 |PRC12=svchost.exe|PRC13=dwm.exe|PRC14=svchost.exe|
PRC15=svchost.exe|PRC16=atieclxx.exe|PRC17=DtcPlatformSvc.exe|PRC18=Explorer.
21/5/2019 9:46:16 EXE|PRC19=spoolsv.exe|PRC20=svchost.exe|PRC21=taskhostex.exe|
PRC22=svchost.exe|PRC23=svchost.exe|PRC24=mqsvc.exe|PRC25=NetXClean
21/5/2019 9:46:16 .exe|PRC26=pnusbvirtualhubwssrv.exe|PRC27=tcpsvcs.exe|
PRC35=vmware-usbarbitrator64.exe|PRC36=vmware-view-usbd.exe|PRC37=svchost.e
21/5/2019 9:46:16 xe|PRC38=wmiprvse.exe|PRC39=SearchIndexer.exe|
PRC40=DtcWdaUi.exe|PRC41=hagent.exe|PRC42=HAgent_UI.exe|PRC43=tvnserver.exe|PRC44=
21/5/2019 9:46:16 RAVCpl64.exe|PRC45=concentr.exe|PRC46=redirector.exe|
PRC47=PNUSBCLITRAY.exe|PRC48=PNTray.exe|PRC49=Receiver.exe|PRC50=SelfServic
21/5/2019 9:46:16 ePlugin.exe|PRC51=wfcrun32.exe|PRC52=CcmExec.exe|
PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|PRC55=firefox.exe|PRC56=firefox.exe|PRC57
21/5/2019 9:46:16 =firefox.exe|PRC58=firefox.exe|PRC59=chrome.exe|
PRC68=firefox.exe|PRC69=chrome.exe|PRC70=chrome.exe|PRC71=wmiprvse.exe||
21/5/2019 9:46:16 WIN0=MicrosoftüPowerPointü-üTRANSMISIONüDEüPOTENCIAü-
üModoüdeücompatibilidadü-üGoogleüChrome|WIN1=Discoüextra�bleü
21/5/2019 9:46:16 (D:)|WIN2=SitioüWebüBIBLIOTECAüUDü-
üPortalüWebüSistemaüdeüBibliotecasü-üMozillaüFirefox|WIN3=ProgramüManager||PMIU=
21/5/2019 9:46:16 39|TBPM=7786256|FBPM=4709184|TBPF=7786256|FBPF=4143168|
TBVM=8589934464|FKVM=8589865384|FKEM=0|CPRMS0=66,14,52|NIC0IP=10.28.0.144
21/5/2019 9:46:16 |NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=73660|SENDP0=31860|MIBSP0=1000üMbps||
21/5/2019 9:46:16 NIC1IP=0.0.0.0|
RECP1=0|SENDP1=0|MIBSP1=3üMb
21/5/2019 9:46:16 ps||NIC2IP=0.0.0.0|
SENDP2=0|MIBSP2=0üMbp
21/5/2019 9:46:16 s|
5,KB2769166,KB2770917,KB2777294,KB2778344,K
21/5/2019 9:46:16
89650,KB2790655,KB2790907,KB2792100,KB2793210
21/5/2019 9:46:16
2800033,KB2804583,KB2804584,KB2805222,KB28052
21/5/2019 9:46:16
KB2817183,KB2818604,KB2820330,KB2821895,KB282
21/5/2019 9:46:16
7,KB2836988,KB2838727,KB2839894,KB2845533,KB2
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\Mozi
21/5/2019 9:46:16 llaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice
21/5/2019 9:46:16 |15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=Microsof
21/5/2019 9:46:16 tüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||
9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilter
21/5/2019 9:46:16 üDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005ü
21/5/2019 9:46:16 Redistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClie
21/5/2019 9:46:16 nt|C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Applic
21/5/2019 9:46:16 ation\chrome.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-basedüwri
21/5/2019 9:46:16 teüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFil
21/5/2019 9:46:16 es\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\
21/5/2019 9:46:16 OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
15.0.4420.1017|AP17=T
21/5/2019 9:46:16 ightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmg
21/5/2019 9:46:16 r.EXE|2.0.127.0|AP19=WindowsüContacts|
AP20=Microsoftü(R)üContactsüImp
21/5/2019 9:46:16 ortüTool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|
6.2.9200.16384|AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.E
21/5/2019 9:46:16 XE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|
WCMJSONSupp=1|
21/5/2019 9:46:16 Found HS Tag
ProcessMsg!
then clear it here
21/5/2019 9:46:16 Server Sent 5
21/5/2019 9:46:16 Enhanced QU : QUM :
21/5/2019 9:46:16 Enhanced QU : QUC :
21/5/2019 9:46:16 Enhanced QU : QUD :
21/5/2019 9:46:16 Server Sent 6
21/5/2019 9:46:16 LOOKING FOR &04
21/5/2019 9:46:16 FUR :After S&P done
21/5/2019 10:11:12 Received data: �#
Host: 10.28.0.144
Content-Length: 0
Cache-C
21/5/2019 10:11:12 ontrol: no-cache

Host: 10.28.0.144
Content-Length: 0
21/5/2019 10:11:12 te

refresh settings!
GetServerAddress
securePort: 443
21/5/2019 10:11:13 GetIP :: *** PPP
IN_ADDR : -1879041014
21/5/2019 10:11:13 ip RETRIVED �#!
10.20.15.151, SecurePort: 443
reported: 28
21/5/2019 10:11:13 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 10:11:13 Pipe not found
21/5/2019 10:11:13 The count is 7
21/5/2019 10:11:13 bCheckServer is 1
21/5/2019 10:11:13 bSet is 1
securePort: 443
21/5/2019 10:11:13 Calling V01
21/5/2019 10:11:13 Merlin version 354
21/5/2019 10:11:13 Signature 354
21/5/2019 10:11:14 Wyse Flag value 0011
21/5/2019 10:11:14 The iBLP value -1
21/5/2019 10:11:15 TZ Queried
Number
21/5/2019 10:11:15 FUR : GetCI() 1
21/5/2019 10:11:15 IP matched!
21/5/2019 10:11:15 Subnet @�#
21/5/2019 10:11:15 Gateway
21/5/2019 10:11:15 DS ��#
21/5/2019 10:11:15 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�$
21/5/2019 10:11:15 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�$
21/5/2019 10:11:15 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�$
83FF-9A7F0B2B2
21/5/2019 10:11:15 E1E}
21/5/2019 10:11:15 Got reply from AgentUI=�\#
21/5/2019 10:11:15 add only adapter.
21/5/2019 10:11:15 GetDisplayInfo() return=`|#
21/5/2019 10:11:15 Disk offset 659554304
21/5/2019 10:11:15 Disk 0 Part 1 TYPE 260

21/5/2019 10:11:15 Disk 0 Part 5 TYPE 261

21/5/2019 10:11:15 Secure boot = 1

de Bibliotecas - Mozilla Firefox|WIN1=Program Manager|, num=0
Web Sistema de Bibliotecas - Mozilla Firefox|WIN1=Program Manager|
21/5/2019 10:11:15 return from ListAllApps=0Z$
21/5/2019 10:11:20 size of qfe list 64
21/5/2019 10:11:21 Value found for LocalXMLPath = #?$
21/5/2019 10:11:21 WDAVersion = 12.1.1.25
21/5/2019 10:11:21 GetCI() done
21/5/2019 10:11:21 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC46=r
21/5/2019 10:11:21 refox.exe|PRC60=taskhostex.exe|PRC61=taskhost.exe|
PRC62=TrustedInstaller.exe|PRC63=TiWorker.exe|PRC64=wmiprvse.exe|PRC65=firefox
21/5/2019 10:11:21 .exe||WIN0=SitioüWebüBIBLIOTECAüUDü-
üPortalüWebüSistemaüdeüBibliotecasü-üMozillaüFirefox|WIN1=ProgramüManager||PMIU
21/5/2019 10:11:21 =39|TBPM=7786256|FBPM=4728808|TBPF=7786256|FBPF=4513120|
TBVM=8589934464|FKVM=8589865384|FKEM=0|CPRMS0=78,12,52|NIC0IP=10.28.0.14
21/5/2019 10:11:21 4|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=102286|SENDP0=42860|MIBSP0=1000üMbps
21/5/2019 10:11:21 ||NIC1IP=0.0.0.0|
RECP1=0|SENDP1=0|MIBSP1=3ü
21/5/2019 10:11:21 Mbps||NIC2IP=0.0.0.0|
SENDP2=0|MIBSP2=0üM
21/5/2019 10:11:21 bps|
5,KB2769166,KB2770917,KB2777294,KB2778344
21/5/2019 10:11:21
2789650,KB2790655,KB2790907,KB2792100,KB27932
21/5/2019 10:11:21
KB2800033,KB2804583,KB2804584,KB2805222,KB280
21/5/2019 10:11:21
0,KB2817183,KB2818604,KB2820330,KB2821895,KB2
21/5/2019 10:11:21
947,KB2836988,KB2838727,KB2839894,KB2845533,K
21/5/2019 10:11:21 B2845690,|AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|
18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\Mo
21/5/2019 10:11:21 zillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffi
21/5/2019 10:11:21 ce|15.0.4420.1017|
15.0.4420.1017|AP5=Micros
21/5/2019 10:11:21 oftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||
9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilt
21/5/2019 10:11:21 erüDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005
21/5/2019 10:11:21 üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüCl
21/5/2019 10:11:21 ient|C:\ProgramüFiles\VMware\VMwareüView\Client\|
5.4.0.1219906|AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Appl
21/5/2019 10:11:21 ication\chrome.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-basedüw
21/5/2019 10:11:21 riteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|
2.0.449.0|AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüF
21/5/2019 10:11:21 iles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüShare
21/5/2019 10:11:21 d\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
15.0.4420.1017|AP17
21/5/2019 10:11:21 =TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwf
21/5/2019 10:11:21 mgr.EXE|2.0.127.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Microsoftü(R)üContactsüI
21/5/2019 10:11:21 mportüTool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|
6.2.9200.16384|AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD
21/5/2019 10:11:21 .EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|
WCMJSONSupp=1|
21/5/2019 10:11:21 Found HS Tag
ProcessMsg!
21/5/2019 10:11:21 Server Sent 5
21/5/2019 10:11:21 Enhanced QU : QUM :
21/5/2019 10:11:21 Enhanced QU : QUC :
21/5/2019 10:11:21 Enhanced QU : QUD :
21/5/2019 10:11:21 Server Sent 6
21/5/2019 10:11:21 LOOKING FOR &04
21/5/2019 10:11:21 FUR :After S&P done
GetServerAddress
securePort: 443
21/5/2019 11:12:57 GetIP :: *** PPP
IN_ADDR : -1879041014
21/5/2019 11:12:57 ip RETRIVED �#!
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
21/5/2019 11:13:2 C80B-4C42-8011-32B62020ACA3}, Type=6
21/5/2019 11:13:2 476A-8590-E6333C53F805}, Type=71
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
21/5/2019 11:13:8 ip RETRIVED �#!
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
21/5/2019 11:13:14 C80B-4C42-8011-32B62020ACA3}, Type=6
21/5/2019 11:13:14 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
21/5/2019 12:16:56 ip RETRIVED ##!
10.20.15.151, SecurePort: 443
21/5/2019 12:16:56 SETTING REG TO VALUE ##!
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 12:16:56 Pipe not found
21/5/2019 12:16:56 The count is 7
21/5/2019 12:16:56 bCheckServer is 1
21/5/2019 12:16:56 bSet is 1
securePort: 443
21/5/2019 12:16:56 Calling V01
21/5/2019 12:16:56 Merlin version 354
21/5/2019 12:16:56 Signature 354
21/5/2019 12:16:57 Wyse Flag value 0011
21/5/2019 12:16:58 The iBLP value -1
21/5/2019 12:16:58 TZ Queried
Number
21/5/2019 12:16:58 FUR : GetCI() 1
21/5/2019 12:16:58 IP matched!
21/5/2019 12:16:58 Subnet @�#
21/5/2019 12:16:58 Gateway
21/5/2019 12:16:58 DS ��#
21/5/2019 12:16:58 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�'
21/5/2019 12:16:58 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�'
21/5/2019 12:16:58 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�'
83FF-9A7F0B2B2
21/5/2019 12:16:58 E1E}
21/5/2019 12:16:58 Got reply from AgentUI=�`#
21/5/2019 12:16:58 add only adapter.
21/5/2019 12:16:58 GetDisplayInfo() return=�c'
21/5/2019 12:16:58 Disk offset 659554304
21/5/2019 12:16:58 Disk 0 Part 1 TYPE 260

21/5/2019 12:16:58 Disk 0 Part 5 TYPE 261

21/5/2019 12:16:58 Secure boot = 1

de Bibliotecas - Mozilla Firefox|WIN1=Program Manager|, num=0
Web Sistema de Bibliotecas - Mozilla Firefox|WIN1=Program Manager|
21/5/2019 12:16:59 Got reply from AgentUI=�3'
21/5/2019 12:16:59 return from ListAllApps=�s'
21/5/2019 12:17:4 size of qfe list 64
21/5/2019 12:17:4 Value found for LocalXMLPath = �Z$
21/5/2019 12:17:4 WDAVersion = 12.1.1.25
21/5/2019 12:17:4 GetCI() done
21/5/2019 12:17:4 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC46=r
21/5/2019 12:17:4 refox.exe|PRC60=wmiprvse.exe|PRC61=firefox.exe||
WIN0=SitioüWebüBIBLIOTECAüUDü-üPortalüWebüSistemaüdeüBibliotecasü-üMo
21/5/2019 12:17:4 zillaüFirefox|WIN1=ProgramüManager||PMIU=38|TBPM=7786256|
21/5/2019 12:17:4 4|FKEM=0|CPRMS0=95,12,52|NIC0IP=10.28.0.144|
21/5/2019 12:17:4 C=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC
21/5/2019 12:17:4
KB2781197,KB2785094,KB2785220,KB2789649,KB278
21/5/2019 12:17:4
2,KB2798802,KB2798804,KB2798805,KB2799494,KB2
21/5/2019 12:17:4
289,KB2811660,KB2812822,KB2813170,KB2813430,K
21/5/2019 12:17:4
29530,KB2830290,KB2832450,KB2836946,KB2836947
21/5/2019 12:17:4 ,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
21/5/2019 12:17:4
21/5/2019 12:17:4 Word|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|
21/5/2019 12:17:5 Found HS Tag
ProcessMsg!
then clear it here
21/5/2019 12:17:5 Server Sent 5
21/5/2019 12:17:5 Enhanced QU : QUM :
21/5/2019 12:17:5 Enhanced QU : QUC :
21/5/2019 12:17:5 Enhanced QU : QUD :
21/5/2019 12:17:5 Server Sent 6
21/5/2019 12:17:5 LOOKING FOR &04
21/5/2019 12:17:5 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
21/5/2019 13:19:23 ip RETRIVED p !
10.20.15.151, SecurePort: 443
21/5/2019 13:19:23 SETTING REG TO VALUE p !
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 13:19:23 Pipe not found
21/5/2019 13:19:23 The count is 7
21/5/2019 13:19:23 bCheckServer is 1
21/5/2019 13:19:23 bSet is 1
securePort: 443
21/5/2019 13:19:24 Value found for LocalXMLPath = �Z$
21/5/2019 13:19:24 WDAVersion = 12.1.1.25
21/5/2019 13:19:24 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 13:19:25 1|VI=1|
21/5/2019 13:19:25 Found HS Tag
ProcessMsg!
21/5/2019 13:19:25 Server Sent 5
21/5/2019 13:19:25 Enhanced QU : QUM :
21/5/2019 13:19:25 Enhanced QU : QUC :
21/5/2019 13:19:25 Enhanced QU : QUD :
21/5/2019 13:19:25 Server Sent 6
21/5/2019 13:19:25 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
21/5/2019 14:20:59 ip RETRIVED �#!
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 14:21:0 Pipe not found
21/5/2019 14:21:0 The count is 7
21/5/2019 14:21:0 bSet is 1
securePort: 443
21/5/2019 14:21:0 Value found for LocalXMLPath = 0�$
21/5/2019 14:21:0 WDAVersion = 12.1.1.25
21/5/2019 14:21:0 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 14:21:1 -1|VI=1|
21/5/2019 14:21:1 Found HS Tag
ProcessMsg!
then clear it here
21/5/2019 14:21:1 Server Sent 5
21/5/2019 14:21:1 Enhanced QU : QUM :
21/5/2019 14:21:1 Enhanced QU : QUC :
21/5/2019 14:21:1 Enhanced QU : QUD :
21/5/2019 14:21:1 Server Sent 6
21/5/2019 14:21:1 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
21/5/2019 15:22:4 ip RETRIVED �#!
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 15:22:4 Pipe not found
21/5/2019 15:22:4 The count is 7
21/5/2019 15:22:4 bSet is 1
securePort: 443
21/5/2019 15:22:4 Value found for LocalXMLPath = �c&
21/5/2019 15:22:4 WDAVersion = 12.1.1.25
21/5/2019 15:22:5 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 15:22:6 -1|VI=1|
21/5/2019 15:22:6 Found HS Tag
ProcessMsg!
then clear it here
21/5/2019 15:22:6 Server Sent 5
21/5/2019 15:22:6 Enhanced QU : QUM :
21/5/2019 15:22:6 Enhanced QU : QUC :
21/5/2019 15:22:6 Enhanced QU : QUD :
21/5/2019 15:22:6 Server Sent 6
21/5/2019 15:22:6 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
21/5/2019 16:23:38 ip RETRIVED �#!
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 16:23:39 Pipe not found
21/5/2019 16:23:39 The count is 7
21/5/2019 16:23:39 bCheckServer is 1
21/5/2019 16:23:39 bSet is 1
securePort: 443
21/5/2019 16:23:39 Value found for LocalXMLPath = p�&
21/5/2019 16:23:39 WDAVersion = 12.1.1.25
21/5/2019 16:23:39 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 16:23:40 -1|VI=1|
21/5/2019 16:23:40 Found HS Tag
ProcessMsg!
21/5/2019 16:23:40 Server Sent 5
21/5/2019 16:23:40 Enhanced QU : QUM :
21/5/2019 16:23:40 Enhanced QU : QUC :
21/5/2019 16:23:40 Enhanced QU : QUD :
21/5/2019 16:23:40 Server Sent 6
21/5/2019 16:23:40 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
21/5/2019 17:24:40 ip RETRIVED ##!
10.20.15.151, SecurePort: 443
21/5/2019 17:24:40 SETTING REG TO VALUE ##!
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 17:24:40 Pipe not found
21/5/2019 17:24:40 The count is 7
21/5/2019 17:24:40 bCheckServer is 1
21/5/2019 17:24:40 bSet is 1
securePort: 443
21/5/2019 17:24:40 Value found for LocalXMLPath = p�&
21/5/2019 17:24:40 WDAVersion = 12.1.1.25
21/5/2019 17:24:41 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 17:24:41 -1|VI=1|
21/5/2019 17:24:41 Found HS Tag
ProcessMsg!
21/5/2019 17:24:41 Server Sent 5
21/5/2019 17:24:41 Enhanced QU : QUM :
21/5/2019 17:24:41 Enhanced QU : QUC :
21/5/2019 17:24:41 Enhanced QU : QUD :
21/5/2019 17:24:41 Server Sent 6
21/5/2019 17:24:41 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
21/5/2019 18:27:54 ip RETRIVED `#!
10.20.15.151, SecurePort: 443
21/5/2019 18:27:54 SETTING REG TO VALUE `#!
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 18:27:54 Pipe not found
21/5/2019 18:27:54 The count is 7
21/5/2019 18:27:54 bCheckServer is 1
21/5/2019 18:27:54 bSet is 1
securePort: 443
21/5/2019 18:27:54 WDAVersion = 12.1.1.25
21/5/2019 18:27:55 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
21/5/2019 18:27:55 -1|VI=1|
21/5/2019 18:27:55 Found HS Tag
ProcessMsg!
21/5/2019 18:27:55 Server Sent 5
21/5/2019 18:27:55 Enhanced QU : QUM :
21/5/2019 18:27:55 Enhanced QU : QUC :
21/5/2019 18:27:55 Enhanced QU : QUD :
21/5/2019 18:27:55 Server Sent 6
21/5/2019 18:27:55 LOOKING FOR &04
22/5/2019 7:49:51 ***********************************************************
22/5/2019 7:49:51 End of WinMain()
22/5/2019 7:49:51 ^^^^^^^^ after reghanex()
22/5/2019 7:50:11 OS Version 6.2.9200
22/5/2019 7:50:11 OS Version 6.2.9200
22/5/2019 7:50:11 Major version 6
22/5/2019 7:50:11 Minor version 2
22/5/2019 7:50:11 Device Info: OS is @�#
22/5/2019 7:50:11 WRITE FILTER UWF 1
22/5/2019 7:50:11 Setting UWF Mgr!
22/5/2019 7:50:11 Disk offset 659554304
22/5/2019 7:50:11 Disk offset =1048576

22/5/2019 7:50:11 Disk offset =105906176
22/5/2019 7:50:11 Disk offset =420478976
22/5/2019 7:50:12 Disk offset =525336576
22/5/2019 7:50:12 Disk offset =659554304

'Z:\',error=1
22/5/2019 7:50:12 AF_INET (IPv4)
22/5/2019 7:50:12 IPv4 address 10.28.0.144
22/5/2019 7:50:12 Valid IP Found

22/5/2019 7:50:12 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
22/5/2019 7:50:12 HA Supported
22/5/2019 7:50:12 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
22/5/2019 7:50:12 ip RETRIVED `X#
10.20.15.151, SecurePort: 443
22/5/2019 7:50:12 SETTING REG TO VALUE `X#
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 7:50:13 Pipe not found
22/5/2019 7:50:13 The count is 7
22/5/2019 7:50:13 bSet is 1
securePort: 443
22/5/2019 7:50:13 Calling V01
22/5/2019 7:50:13 Merlin version 354
22/5/2019 7:50:13 Signature 354
22/5/2019 7:50:14 Wyse Flag value 0011
22/5/2019 7:50:15 The iBLP value -1
22/5/2019 7:50:16 TZ Queried
Number
22/5/2019 7:50:16 FUR : GetCI() 1
22/5/2019 7:50:16 IP matched!
22/5/2019 7:50:16 Subnet P�#
22/5/2019 7:50:16 Gateway ��#
22/5/2019 7:50:16 DS �#
22/5/2019 7:50:16 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=��!
22/5/2019 7:50:16 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=��!
22/5/2019 7:50:16 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=��!
83FF-9A7F0B2B2
22/5/2019 7:50:16 E1E}
22/5/2019 7:50:16 Got reply from AgentUI=p�"
22/5/2019 7:50:16 GetDisplayInfo() return=P-#
22/5/2019 7:50:16 Disk offset 659554304
22/5/2019 7:50:16 Disk 0 Part 1 TYPE 260

22/5/2019 7:50:16 Disk 0 Part 5 TYPE 261

22/5/2019 7:50:16 Secure boot = 1

de Bibliotecas - Google Chrome|WIN1=Program Manager|, num=0
Web Sistema de Bibliotecas - Google Chrome|WIN1=Program Manager|
22/5/2019 7:50:16 Got reply from AgentUI= g"
22/5/2019 7:50:16 return from ListAllApps=�L"
22/5/2019 7:50:23 size of qfe list 64
22/5/2019 7:50:24 Value found for LocalXMLPath = �##
22/5/2019 7:50:24 WDAVersion = 12.1.1.25
22/5/2019 7:50:24 GetCI() done
'Z:\',error=1
securePort: 443
22/5/2019 7:50:24 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC17=atieclxx.exe|PRC18=DtcPlatformSvc.exe|PRC19=spoolsv.exe|PRC20=Explorer.EXE
PRC27=NetXCle
22/5/2019 7:50:24 C34=wsnm.exe|PRC35=DtcWDAService.exe|PRC36=wmiprvse.exe|
PRC37=GoogleUpdate.exe|PRC38=mqtgsvc.exe|PRC39=vmware-usbarbitrator64.ex
22/5/2019 7:50:24 59=SelfServicePlugin.exe|PRC60=wfcrun32.exe|PRC61=chrome.exe|
PRC62=chrome.exe|PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe
22/5/2019 7:50:24 |PRC66=chrome.exe|PRC67=chrome.exe|PRC68=DllHost.exe||
WIN0=SitioüWebüBIBLIOTECAüUDü-üPortalüWebüSistemaüdeüBibliotecas�
22/5/2019 7:50:24 �-üGoogleüChrome|WIN1=ProgramüManager||PMIU=37|TBPM=7786256|
22/5/2019 7:50:24 65384|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28.0.144|
22/5/2019 7:50:24 RECP0=1488|SENDP0=810|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F
22/5/2019 7:50:24 0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0
22/5/2019 7:50:24 421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|
5,
22/5/2019 7:50:24
781197,KB2785094,KB2785220,KB2789649,KB278965
22/5/2019 7:50:24
B2798802,KB2798804,KB2798805,KB2799494,KB2800
22/5/2019 7:50:24
,KB2811660,KB2812822,KB2813170,KB2813430,KB28
22/5/2019 7:50:24
30,KB2830290,KB2832450,KB2836946,KB2836947,KB
22/5/2019 7:50:24 2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61
22/5/2019 7:50:24 .0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdi�
22/5/2019 7:50:24 �2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\Micro
22/5/2019 7:50:24 softüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|AP6=Micro
22/5/2019 7:50:24 softüWindowsüEmbeddedüKeyboardüFilterüDatabase|||
8.0.61000|AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|1
22/5/2019 7:50:24 2.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|C:\P
22/5/2019 7:50:24 rogramüFilesü(x86)\Google\Chrome\Application\chrome.exe|
68.0.3440.106|AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCE
22/5/2019 7:50:24 L.EXE|15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=Diagnosticsüutility
22/5/2019 7:50:24 üforüInternetüExplorer|
AP15=OfficeüXMLüHandler|C:\Progra
22/5/2019 7:50:24 müFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Of
22/5/2019 7:50:24 fice15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=UnifiedüWriteüFilterüM
22/5/2019 7:50:24 anagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
22/5/2019 7:50:24 .16384|AP20=Microsoftü(R)üContactsüImportüTool|
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWor
22/5/2019 7:50:24 d|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|
22/5/2019 7:50:24 Found HS Tag
ProcessMsg!
then clear it here
22/5/2019 7:50:24 Server Sent 5
22/5/2019 7:50:24 Enhanced QU : QUM :
22/5/2019 7:50:24 Enhanced QU : QUC :
22/5/2019 7:50:24 Enhanced QU : QUD :
22/5/2019 7:50:24 Server Sent 6
22/5/2019 7:50:24 LOOKING FOR &04
22/5/2019 7:50:24 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
22/5/2019 8:28:43 ip RETRIVED �#!
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
22/5/2019 8:28:49 C80B-4C42-8011-32B62020ACA3}, Type=6
22/5/2019 8:28:49 476A-8590-E6333C53F805}, Type=71
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
22/5/2019 8:28:54 ip RETRIVED �"!
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
22/5/2019 8:29:0 C80B-4C42-8011-32B62020ACA3}, Type=6
22/5/2019 8:29:0 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
22/5/2019 8:29:32 ip RETRIVED �"!
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
22/5/2019 8:29:38 C80B-4C42-8011-32B62020ACA3}, Type=6
22/5/2019 8:29:38 476A-8590-E6333C53F805}, Type=71
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
22/5/2019 8:29:43 ip RETRIVED �"!
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
22/5/2019 8:29:49 C80B-4C42-8011-32B62020ACA3}, Type=6
22/5/2019 8:29:49 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
22/5/2019 9:31:24 ip RETRIVED `0!
10.20.15.151, SecurePort: 443
22/5/2019 9:31:24 SETTING REG TO VALUE `0!
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 9:31:24 Pipe not found
22/5/2019 9:31:24 The count is 7
22/5/2019 9:31:24 bSet is 1
securePort: 443
22/5/2019 9:31:24 Calling V01
22/5/2019 9:31:24 Merlin version 354
22/5/2019 9:31:24 Signature 354
22/5/2019 9:31:25 Wyse Flag value 0011
22/5/2019 9:31:26 The iBLP value -1
22/5/2019 9:31:26 TZ Queried
Number
22/5/2019 9:31:26 FUR : GetCI() 1
22/5/2019 9:31:26 IP matched!
22/5/2019 9:31:26 Subnet P�#
22/5/2019 9:31:26 Gateway ��#
22/5/2019 9:31:26 DS �#
22/5/2019 9:31:26 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP= �!
22/5/2019 9:31:26 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP= �!
22/5/2019 9:31:26 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP= �!
83FF-9A7F0B2B2
22/5/2019 9:31:26 E1E}
22/5/2019 9:31:26 Got reply from AgentUI=P?#
22/5/2019 9:31:26 GetDisplayInfo() return=��!
22/5/2019 9:31:26 Disk offset 659554304
22/5/2019 9:31:27 Disk 0 Part 1 TYPE 260

22/5/2019 9:31:27 Disk 0 Part 5 TYPE 261

22/5/2019 9:31:27 Secure boot = 1

22/5/2019 9:31:27 tempbuff = |WIN0=PR�CTICA No7 - Documentos de Google - Google
22/5/2019 9:31:27 Msg recd from AgentGUI:|WIN0=PR�CTICA No7 - Documentos de
Google - Google Chrome|WIN1=Program Manager|
22/5/2019 9:31:27 Got reply from AgentUI=P�&
22/5/2019 9:31:27 return from ListAllApps=#]!
22/5/2019 9:31:32 size of qfe list 64
22/5/2019 9:31:33 Value found for LocalXMLPath = p�
22/5/2019 9:31:33 WDAVersion = 12.1.1.25
22/5/2019 9:31:33 GetCI() done
22/5/2019 9:31:33 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC17=DtcPlatformSvc.exe|PRC18=spoolsv.exe|PRC19=Explorer.EXE|PRC20=svchost.exe
PRC46=r
PRC49=Receiver.exe|PRC50=SelfServicePlugin.exe|PRC51=wfcrun32.exe|PRC52=ch
PRC56=chrome.exe|PRC57=chrome.exe|PRC58=CcmExec.exe|PRC59=wmiprvse.e
22/5/2019 9:31:33 xe|PRC60=wmiprvse.exe|PRC61=chrome.exe|PRC62=chrome.exe|
PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe|PRC66=wmiprvse.exe||W
22/5/2019 9:31:33 IN0=PR�CTICAüNo7ü-üDocumentosüdeüGoogleü-üGoogleüChrome|
CPRMS0=0,0,0|NIC0IP=10.28.0.144|NIC0DESC=Ethernet,InventecüPCIeüGBE�
22/5/2019 9:31:33 �FamilyüControllerü#2|NIC0MAC=008064FB707A|RECP0=127304|
SENDP0=52287|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,Bluet
22/5/2019 9:31:33 oothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|
RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,I
22/5/2019 9:31:33 ntel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|
RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,KB2729462,KB2737084,K
22/5/2019 9:31:33
78344,KB2778930,KB2779562,KB2779768,KB2780541
22/5/2019 9:31:33
2793210,KB2794119,KB2794599,KB2795944,KB27981
22/5/2019 9:31:33
KB2805227,KB2807986,KB2808679,KB2808735,KB280
22/5/2019 9:31:33
5,KB2822241,KB2829069,KB2829254,KB2829361,KB2
22/5/2019 9:31:33
533,KB2845690,|AP0=7-Zipü18.05ü(x64)|C:\Pro
22/5/2019 9:31:33 gramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-
ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaint
22/5/2019 9:31:33 enanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOffice�
22/5/2019 9:31:33 �ProfessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|
15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributable�
22/5/2019 9:31:33 �-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=MicrosoftüSilverligh
22/5/2019 9:31:33 t|c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|AP9=
22/5/2019 9:31:33 WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüVi
22/5/2019 9:31:33 ew\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|AP12=Mi
22/5/2019 9:31:33 crosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|
15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|C:\Windows\System3
22/5/2019 9:31:33 2\fbwfmgr.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10
22/5/2019 9:31:33 .0.9200.16384|AP15=OfficeüXMLüHandler|
15.0.4420.1017|A
22/5/2019 9:31:33 P16=MicrosoftüPowerPoint|
C:\ProgramüFiles\TightVNC\tvn
22/5/2019 9:31:33 server.exe|2.6.4.0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts
22/5/2019 9:31:33 |C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüM
22/5/2019 9:31:33 ail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1
22/5/2019 9:31:33 |WCMSupp=1|WCMJSONSupp=1|
22/5/2019 9:31:33 Found HS Tag
ProcessMsg!
then clear it here
22/5/2019 9:31:33 Server Sent 5
22/5/2019 9:31:33 Enhanced QU : QUM :
22/5/2019 9:31:33 Enhanced QU : QUC :
22/5/2019 9:31:33 Enhanced QU : QUD :
22/5/2019 9:31:33 Server Sent 6
22/5/2019 9:31:33 LOOKING FOR &04
22/5/2019 9:31:33 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
22/5/2019 10:33:10 ip RETRIVED P/!
10.20.15.151, SecurePort: 443
22/5/2019 10:33:11 SETTING REG TO VALUE P/!
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 10:33:11 Pipe not found
22/5/2019 10:33:11 The count is 7
22/5/2019 10:33:11 bCheckServer is 1
22/5/2019 10:33:11 bSet is 1
securePort: 443
22/5/2019 10:33:11 Value found for LocalXMLPath = P�
22/5/2019 10:33:11 WDAVersion = 12.1.1.25
22/5/2019 10:33:12 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 10:33:12 -1|VI=1|
22/5/2019 10:33:12 Found HS Tag
ProcessMsg!
22/5/2019 10:33:12 Server Sent 5
22/5/2019 10:33:12 Enhanced QU : QUM :
22/5/2019 10:33:12 Enhanced QU : QUC :
22/5/2019 10:33:12 Enhanced QU : QUD :
22/5/2019 10:33:13 Server Sent 6
22/5/2019 10:33:13 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
22/5/2019 11:36:33 ip RETRIVED `0!
10.20.15.151, SecurePort: 443
22/5/2019 11:36:36 SETTING REG TO VALUE `0!
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 11:36:36 Pipe not found
22/5/2019 11:36:36 The count is 7
22/5/2019 11:36:36 bCheckServer is 1
22/5/2019 11:36:36 bSet is 1
securePort: 443
22/5/2019 11:36:36 Value found for LocalXMLPath = ��
22/5/2019 11:36:36 WDAVersion = 12.1.1.25
22/5/2019 11:36:37 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 11:36:37 1|VI=1|
22/5/2019 11:36:38 Found HS Tag
ProcessMsg!
22/5/2019 11:36:38 Server Sent 5
22/5/2019 11:36:38 Enhanced QU : QUM :
22/5/2019 11:36:38 Enhanced QU : QUC :
22/5/2019 11:36:38 Enhanced QU : QUD :
22/5/2019 11:36:38 Server Sent 6
22/5/2019 11:36:38 LOOKING FOR &04
22/5/2019 12:20:12 Received data: 0e#
Accept: */*
22/5/2019 12:20:12 jects/mechanize/)
Connection: close
22/5/2019 12:20:12 =0.7,*;q=0.7

Accept: */*
Connection: close
22/5/2019 12:20:12 9-1,utf-8;q=0.7,*;q=0.7
refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
22/5/2019 12:20:13 ip RETRIVED =!
10.20.15.151, SecurePort: 443
22/5/2019 12:20:13 SETTING REG TO VALUE =!
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 12:20:13 Pipe not found
22/5/2019 12:20:13 The count is 7
22/5/2019 12:20:13 bCheckServer is 1
22/5/2019 12:20:13 bSet is 1
securePort: 443
22/5/2019 12:20:13 Calling V01
22/5/2019 12:20:13 Merlin version 354
22/5/2019 12:20:13 Signature 354
22/5/2019 12:20:14 Wyse Flag value 0011
22/5/2019 12:20:14 The iBLP value -1
22/5/2019 12:20:15 TZ Queried
Number
22/5/2019 12:20:15 FUR : GetCI() 1
22/5/2019 12:20:15 IP matched!
22/5/2019 12:20:15 Subnet P�#
22/5/2019 12:20:15 Gateway ��#
22/5/2019 12:20:15 DS �#
22/5/2019 12:20:15 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=��!
22/5/2019 12:20:15 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=��!
22/5/2019 12:20:15 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=��!
83FF-9A7F0B2B2
22/5/2019 12:20:15 E1E}
22/5/2019 12:20:15 add only adapter.
22/5/2019 12:20:15 GetDisplayInfo() return=�(
22/5/2019 12:20:15 Disk offset 659554304
22/5/2019 12:20:15 Disk 0 Part 1 TYPE 260

22/5/2019 12:20:15 Disk 0 Part 5 TYPE 261

22/5/2019 12:20:15 Secure boot = 1

22/5/2019 12:20:15 tempbuff = |WIN0=TASTES ABOUT THE CINEMA - Formularios de
Google - Google Chrome|WIN1=Program Manager|, num=0
22/5/2019 12:20:15 Msg recd from AgentGUI:|WIN0=TASTES ABOUT THE CINEMA -
Formularios de Google - Google Chrome|WIN1=Program Manager|
22/5/2019 12:20:15 Got reply from AgentUI= �'
22/5/2019 12:20:15 return from ListAllApps=�#(
22/5/2019 12:20:21 size of qfe list 64
22/5/2019 12:20:21 Value found for LocalXMLPath = PI
22/5/2019 12:20:21 WDAVersion = 12.1.1.25
22/5/2019 12:20:21 GetCI() done
22/5/2019 12:20:21 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC17=DtcPlatformSvc.exe|PRC18=spoolsv.exe|PRC19=Explorer.EXE|PRC20=svchost.exe
PRC46=r
PRC63=chrome.exe|PRC64=wmiprvse.exe||WIN0=TASTESüABOUTüTHEüCINEMAü-�
22/5/2019 12:20:21 �FormulariosüdeüGoogleü-üGoogleüChrome|WIN1=ProgramüManager||
PMIU=42|TBPM=7786256|FBPM=4488928|TBPF=7786256|FBPF=4319180|T
22/5/2019 12:20:21 BVM=8589934464|FKVM=8589864360|FKEM=0|CPRMS0=15,0,15|
NIC0IP=10.28.0.144|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControlle
22/5/2019 12:20:21 rü#2|NIC0MAC=008064FB707A|RECP0=251640|SENDP0=118283|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(Pe
22/5/2019 12:20:21 rsonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBa
22/5/2019 12:20:21 ndüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|
22/5/2019 12:20:21
B2779562,KB2779768,KB2780541,KB2781197,KB2785
22/5/2019 12:20:21
,KB2794599,KB2795944,KB2798162,KB2798802,KB27
22/5/2019 12:20:21
86,KB2808679,KB2808735,KB2809289,KB2811660,KB
22/5/2019 12:20:21
9069,KB2829254,KB2829361,KB2829530,KB2830290,
22/5/2019 12:20:21
KB2832450,KB2836946,KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|
AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip
22/5/2019 12:20:21 \|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||
22/5/2019 12:20:21 61.0.2|AP3=MicrosoftüLyncüVdiü2013|
AP4=MicrosoftüOfficeüProfessionalüPl
22/5/2019 12:20:21 usü2013|C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|
22/5/2019 12:20:21 9.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüFil
22/5/2019 12:20:21 es\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAge
22/5/2019 12:20:21 nt|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.
AP12=MicrosoftüExcel|C:
22/5/2019 12:20:21 \PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|
AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0
22/5/2019 12:20:21 .449.0|AP14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP1
22/5/2019 12:20:21 5=OfficeüXMLüHandler|
15.0.4420.1017|AP16=MicrosoftüPo
22/5/2019 12:20:21 werPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|
15.0.4420.1017|AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.
22/5/2019 12:20:21 0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\ProgramüFile
22/5/2019 12:20:21 s\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.
22/5/2019 12:20:21 2.9200.16384|AP21=MicrosoftüWord|
WCMSupp=1|WCMJSO
22/5/2019 12:20:21 NSupp=1|
22/5/2019 12:20:21 Found HS Tag
ProcessMsg!
22/5/2019 12:20:21 Server Sent 5
22/5/2019 12:20:21 Enhanced QU : QUM :
22/5/2019 12:20:21 Enhanced QU : QUC :
22/5/2019 12:20:21 Enhanced QU : QUD :
22/5/2019 12:20:21 Server Sent 6
22/5/2019 12:20:21 LOOKING FOR &04
22/5/2019 12:20:21 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
22/5/2019 13:22:16 ip RETRIVED �!
10.20.15.151, SecurePort: 443
22/5/2019 13:22:16 SETTING REG TO VALUE �!
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 13:22:16 Pipe not found
22/5/2019 13:22:16 The count is 7
22/5/2019 13:22:16 bCheckServer is 1
22/5/2019 13:22:16 bSet is 1
securePort: 443
22/5/2019 13:22:16 Value found for LocalXMLPath = pQ
22/5/2019 13:22:16 WDAVersion = 12.1.1.25
22/5/2019 13:22:16 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 13:22:17 1|VI=1|
22/5/2019 13:22:17 Found HS Tag
ProcessMsg!
22/5/2019 13:22:17 Server Sent 5
22/5/2019 13:22:17 Enhanced QU : QUM :
22/5/2019 13:22:17 Enhanced QU : QUC :
22/5/2019 13:22:17 Enhanced QU : QUD :
22/5/2019 13:22:17 Server Sent 6
22/5/2019 13:22:17 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
22/5/2019 14:23:24 ip RETRIVED �6!
10.20.15.151, SecurePort: 443
22/5/2019 14:23:24 SETTING REG TO VALUE �6!
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 14:23:24 Pipe not found
22/5/2019 14:23:24 The count is 7
22/5/2019 14:23:24 bCheckServer is 1
22/5/2019 14:23:24 bSet is 1
securePort: 443
22/5/2019 14:23:24 Value found for LocalXMLPath = �U
22/5/2019 14:23:24 WDAVersion = 12.1.1.25
22/5/2019 14:23:25 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 14:23:25 1|VI=1|
22/5/2019 14:23:26 Found HS Tag
ProcessMsg!
22/5/2019 14:23:26 Server Sent 5
22/5/2019 14:23:26 Enhanced QU : QUM :
22/5/2019 14:23:26 Enhanced QU : QUC :
22/5/2019 14:23:26 Enhanced QU : QUD :
22/5/2019 14:23:26 Server Sent 6
22/5/2019 14:23:26 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
22/5/2019 15:23:56 ip RETRIVED �"!
10.20.15.151, SecurePort: 443
22/5/2019 15:23:56 SETTING REG TO VALUE �"!
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 15:23:56 Pipe not found
22/5/2019 15:23:56 The count is 7
22/5/2019 15:23:56 bCheckServer is 1
22/5/2019 15:23:56 bSet is 1
securePort: 443
22/5/2019 15:23:56 Value found for LocalXMLPath = �Y
22/5/2019 15:23:56 WDAVersion = 12.1.1.25
22/5/2019 15:23:57 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 15:23:58 1|VI=1|
22/5/2019 15:23:58 Found HS Tag
ProcessMsg!
22/5/2019 15:23:58 Server Sent 5
22/5/2019 15:23:58 Enhanced QU : QUM :
22/5/2019 15:23:58 Enhanced QU : QUC :
22/5/2019 15:23:58 Enhanced QU : QUD :
22/5/2019 15:23:58 Server Sent 6
22/5/2019 15:23:58 LOOKING FOR &04
22/5/2019 16:19:29 Received data: 0e#
Accept: */*
22/5/2019 16:19:29 jects/mechanize/)
Connection: close
22/5/2019 16:19:29 =0.7,*;q=0.7

Accept: */*
Connection: close
22/5/2019 16:19:29 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
22/5/2019 16:19:30 ip RETRIVED �9!
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 16:19:30 Pipe not found
22/5/2019 16:19:30 The count is 7
22/5/2019 16:19:30 bCheckServer is 1
22/5/2019 16:19:30 bSet is 1
securePort: 443
22/5/2019 16:19:30 Calling V01
22/5/2019 16:19:30 Merlin version 354
22/5/2019 16:19:30 Signature 354
22/5/2019 16:19:31 Wyse Flag value 0011
22/5/2019 16:19:31 The iBLP value -1
22/5/2019 16:19:32 TZ Queried
Number
22/5/2019 16:19:32 FUR : GetCI() 1
22/5/2019 16:19:32 IP matched!
22/5/2019 16:19:32 Subnet P�#
22/5/2019 16:19:32 Gateway ��#
22/5/2019 16:19:32 DS �#
83FF-9A7F0B2B2
22/5/2019 16:19:32 E1E}
22/5/2019 16:19:32 Got reply from AgentUI= �(
22/5/2019 16:19:32 add only adapter.
22/5/2019 16:19:32 GetDisplayInfo() return=`�'
22/5/2019 16:19:32 Disk offset 659554304
22/5/2019 16:19:32 Disk 0 Part 1 TYPE 260

22/5/2019 16:19:32 Disk 0 Part 5 TYPE 261

22/5/2019 16:19:32 Secure boot = 1

22/5/2019 16:19:32 tempbuff = |WIN0=funciones logar�tmicas y exponenciales -
Online LaTeX Editor Overleaf - Google Chrome|WIN1=Program Manager|, nu
22/5/2019 16:19:32 m=0
22/5/2019 16:19:32 Msg recd from AgentGUI:|WIN0=funciones logar�tmicas y
exponenciales - Online LaTeX Editor Overleaf - Google Chrome|WIN1=Program
22/5/2019 16:19:32 Manager|
22/5/2019 16:19:32 Got reply from AgentUI=�5(
22/5/2019 16:19:32 return from ListAllApps=�#(
22/5/2019 16:19:39 size of qfe list 64
22/5/2019 16:19:39 Value found for LocalXMLPath = �m
22/5/2019 16:19:39 WDAVersion = 12.1.1.25
22/5/2019 16:19:39 GetCI() done
22/5/2019 16:19:39 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC10=svchost.exe|PRC11=svchost.exe|PRC12=dwm.exe|PRC13=svchost.exe|PRC14=
22/5/2019 16:19:39 svchost.exe|PRC15=atieclxx.exe|PRC16=DtcPlatformSvc.exe|
PRC17=spoolsv.exe|PRC18=Explorer.EXE|PRC19=svchost.exe|PRC20=taskhostex.
22/5/2019 16:19:39 exe|PRC21=svchost.exe|PRC22=svchost.exe|PRC23=mqsvc.exe|
PRC24=NetXClean.exe|PRC25=pnusbvirtualhubwssrv.exe|PRC26=tcpsvcs.exe|PRC
22/5/2019 16:19:39 4=vmware-usbarbitrator64.exe|PRC35=vmware-view-usbd.exe|
PRC36=svchost.exe|PRC37=wmiprvse.exe|PRC38=SearchIndexer.exe|PRC39=DtcWd
22/5/2019 16:19:39 aUi.exe|PRC40=hagent.exe|PRC41=HAgent_UI.exe|
PRC42=tvnserver.exe|PRC43=RAVCpl64.exe|PRC44=concentr.exe|PRC45=redirector.exe|PRC4
22/5/2019 16:19:39 6=PNUSBCLITRAY.exe|PRC47=PNTray.exe|PRC48=Receiver.exe|
PRC49=SelfServicePlugin.exe|PRC50=wfcrun32.exe|PRC51=CcmExec.exe|PRC52=wm
22/5/2019 16:19:39 iprvse.exe|PRC53=wmiprvse.exe|PRC54=svchost.exe|
22/5/2019 16:19:39 7=chrome.exe|PRC68=chrome.exe|PRC69=chrome.exe|
PRC78=wmiprvse.exe||WIN0=funcionesülogar�tmicasüyüexponencialesü-üOn
22/5/2019 16:19:39 lineüLaTeXüEditorüOverleafü-üGoogleüChrome|
NIC0IP=10.28.0.144|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüCont
22/5/2019 16:19:39 rollerü#2|NIC0MAC=008064FB707A|RECP0=490517|SENDP0=237956|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDevice
22/5/2019 16:19:39 ü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|
SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDua
22/5/2019 16:19:39 lüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|
SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,KB2729462,KB2737084,KB2753842,KB2
22/5/2019 16:19:39
930,KB2779562,KB2779768,KB2780541,KB2781197,K
22/5/2019 16:19:39
94119,KB2794599,KB2795944,KB2798162,KB2798802
22/5/2019 16:19:39
2807986,KB2808679,KB2808735,KB2809289,KB28116
22/5/2019 16:19:39
KB2829069,KB2829254,KB2829361,KB2829530,KB283
22/5/2019 16:19:39
0,|AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\
22/5/2019 16:19:39 7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüServ
22/5/2019 16:19:39 ice||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOfficeüProfessiona
22/5/2019 16:19:39 lüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|
15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0
22/5/2019 16:19:39 .30729.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\Program
22/5/2019 16:19:39 üFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDevice
22/5/2019 16:19:39 üAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Client\|5
22/5/2019 16:19:39 .4.0.1219906|AP11=GoogleüChrome|
AP12=MicrosoftüExc
22/5/2019 16:19:39 el|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|
AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EX
22/5/2019 16:19:39 E|2.0.449.0|AP14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.1638
15.0.4420.1017|AP16=Microsof
22/5/2019 16:19:39 tüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|
15.0.4420.1017|AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2
22/5/2019 16:19:39 .6.4.0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\Program�
22/5/2019 16:19:39 �Files\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüMail\wabmig.e
22/5/2019 16:19:39 xe|6.2.9200.16384|AP21=MicrosoftüWord|
WCMSupp=1|W
22/5/2019 16:19:39 CMJSONSupp=1|
22/5/2019 16:19:39 Found HS Tag
ProcessMsg!
22/5/2019 16:19:39 Server Sent 5
22/5/2019 16:19:39 Enhanced QU : QUM :
22/5/2019 16:19:39 Enhanced QU : QUC :
22/5/2019 16:19:39 Enhanced QU : QUD :
22/5/2019 16:19:39 Server Sent 6
22/5/2019 16:19:39 LOOKING FOR &04
22/5/2019 16:19:39 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
22/5/2019 17:21:44 ip RETRIVED �9!
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 17:21:45 Pipe not found
22/5/2019 17:21:45 The count is 7
22/5/2019 17:21:45 bCheckServer is 1
22/5/2019 17:21:45 bSet is 1
securePort: 443
22/5/2019 17:21:45 Value found for LocalXMLPath = �U
22/5/2019 17:21:45 WDAVersion = 12.1.1.25
22/5/2019 17:21:45 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 17:21:46 1|VI=1|
22/5/2019 17:21:46 Found HS Tag
ProcessMsg!
22/5/2019 17:21:46 Server Sent 5
22/5/2019 17:21:46 Enhanced QU : QUM :
22/5/2019 17:21:46 Enhanced QU : QUC :
22/5/2019 17:21:46 Enhanced QU : QUD :
22/5/2019 17:21:46 Server Sent 6
22/5/2019 17:21:46 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
22/5/2019 18:25:24 ip RETRIVED =!
10.20.15.151, SecurePort: 443
22/5/2019 18:25:24 SETTING REG TO VALUE =!
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 18:25:24 Pipe not found
22/5/2019 18:25:24 The count is 7
22/5/2019 18:25:24 bCheckServer is 1
22/5/2019 18:25:24 bSet is 1
securePort: 443
22/5/2019 18:25:24 Value found for LocalXMLPath = �a
22/5/2019 18:25:24 WDAVersion = 12.1.1.25
22/5/2019 18:25:25 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 18:25:26 -1|VI=1|
22/5/2019 18:25:26 Found HS Tag
ProcessMsg!
22/5/2019 18:25:26 Server Sent 5
22/5/2019 18:25:26 Enhanced QU : QUM :
22/5/2019 18:25:26 Enhanced QU : QUC :
22/5/2019 18:25:26 Enhanced QU : QUD :
22/5/2019 18:25:26 Server Sent 6
22/5/2019 18:25:26 LOOKING FOR &04
22/5/2019 19:10:48 ***********************************************************
22/5/2019 19:10:48 End of WinMain()
22/5/2019 19:10:48 ^^^^^^^^ after reghanex()
22/5/2019 19:11:8 OS Version 6.2.9200
22/5/2019 19:11:8 OS Version 6.2.9200
22/5/2019 19:11:8 Major version 6
22/5/2019 19:11:8 Minor version 2
22/5/2019 19:11:8 Device Info: OS is �"
22/5/2019 19:11:8 WRITE FILTER UWF 1
22/5/2019 19:11:8 Setting UWF Mgr!
22/5/2019 19:11:9 Disk offset 659554304
22/5/2019 19:11:9 Disk offset =1048576

22/5/2019 19:11:9 Disk offset =105906176
22/5/2019 19:11:9 Disk offset =420478976
22/5/2019 19:11:9 Disk offset =525336576
22/5/2019 19:11:9 Disk offset =659554304

'Z:\',error=1
22/5/2019 19:11:9 AF_INET (IPv4)
22/5/2019 19:11:9 IPv4 address 169.254.150.182
22/5/2019 19:11:9 Valid IP Found

22/5/2019 19:11:9 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
22/5/2019 19:11:9 HA Supported
22/5/2019 19:11:9 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
22/5/2019 19:11:9 ip RETRIVED p�
10.20.15.151, SecurePort: 443
22/5/2019 19:11:9 SETTING REG TO VALUE p�
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
22/5/2019 19:11:12 Pipe not found
22/5/2019 19:11:12 The count is 7
22/5/2019 19:11:12 bCheckServer is 1
22/5/2019 19:11:12 bSet is 1
securePort: 443
22/5/2019 19:11:13 Calling V01
22/5/2019 19:11:13 Merlin version 354
22/5/2019 19:11:13 Signature 354
22/5/2019 19:11:13 Wyse Flag value 0011
22/5/2019 19:11:13 The iBLP value -1
22/5/2019 19:11:14 TZ Queried
Number
22/5/2019 19:11:14 FUR : GetCI() 1
22/5/2019 19:11:14 IP matched!
22/5/2019 19:11:14 Subnet 5
22/5/2019 19:11:14 Gateway
22/5/2019 19:11:14 DS з
22/5/2019 19:11:14 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP= #'
22/5/2019 19:11:14 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP= #'
22/5/2019 19:11:14 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP= #'
83FF-9A7F0B2B2
22/5/2019 19:11:14 E1E}
22/5/2019 19:11:14 Got reply from AgentUI=@v$
22/5/2019 19:11:14 add only adapter.
22/5/2019 19:11:14 GetDisplayInfo() return=`}'
22/5/2019 19:11:14 Disk offset 659554304
22/5/2019 19:11:14 Disk 0 Part 1 TYPE 260

22/5/2019 19:11:14 Disk 0 Part 5 TYPE 261
22/5/2019 19:11:14 Secure boot = 1

22/5/2019 19:11:15 tempbuff = |WIN0=To continue using Dell.com, please upgrade
your browser. - Internet Explorer provided by Dell Inc.|WIN1=Program
22/5/2019 19:11:15 Manager|, num=0
22/5/2019 19:11:15 Msg recd from AgentGUI:|WIN0=To continue using Dell.com,
please upgrade your browser. - Internet Explorer provided by Dell Inc.|
22/5/2019 19:11:15 WIN1=Program Manager|
22/5/2019 19:11:15 Got reply from AgentUI= �&
22/5/2019 19:11:15 return from ListAllApps= �'
22/5/2019 19:11:23 size of qfe list 64
22/5/2019 19:11:24 WDAVersion = 12.1.1.25
22/5/2019 19:11:24 GetCI() done
'Z:\',error=1
securePort: 443
22/5/2019 19:11:24 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC17=DtcPlatformSvc.exe|PRC18=spoolsv.exe|PRC19=svchost.exe|PRC20=Explorer.EXE|
22/5/2019 19:11:24 PRC21=svchost.exe|PRC22=svchost.exe|PRC23=mqsvc.exe|
PRC24=NetXClean.exe|PRC25=pnusbvirtualhubwssrv.exe|PRC26=tcpsvcs.exe|PRC27=t
22/5/2019 19:11:24 askhostex.exe|PRC28=snmp.exe|PRC29=GoogleUpdate.exe|
PRC30=tvnserver.exe|PRC31=UWFSvc.exe|PRC32=MsMpEng.exe|PRC33=wsnm.exe|PRC34=
22/5/2019 19:11:24 iexplore.exe|PRC35=DtcWDAService.exe|PRC36=mqtgsvc.exe|
22/5/2019 19:11:24 d.exe|PRC40=svchost.exe|PRC41=svchost.exe|PRC42=wmiprvse.exe|
PRC43=GoogleUpdate.exe|PRC44=vssvc.exe|PRC45=SearchIndexer.exe|PRC4
22/5/2019 19:11:24 6=svchost.exe|PRC47=SearchProtocolHost.exe|
PRC48=SearchFilterHost.exe|PRC49=msiexec.exe|PRC50=DtcWdaUi.exe|PRC51=hagent.exe|
PRC5
22/5/2019 19:11:24 2=HAgent_UI.exe|PRC53=tvnserver.exe|PRC54=UWFTray.exe|
PRC55=RAVCpl64.exe|PRC56=concentr.exe|PRC57=redirector.exe|PRC58=PNUSBCLIT
22/5/2019 19:11:24 RAY.exe|PRC59=PNTray.exe|PRC60=Receiver.exe|
PRC61=SelfServicePlugin.exe|PRC62=wfcrun32.exe|PRC63=WOWReg32.exe|
PRC64=WOWReg32.exe
22/5/2019 19:11:24 |PRC65=WOWReg32.exe|PRC66=DllHost.exe|PRC67=IEXPLORE.EXE||
WIN0=ToücontinueüusingüDell.com,üpleaseüupgradeüyourübrowser.ü
22/5/2019 19:11:24 -üInternetüExplorerüprovidedübyüDellüInc.|
NIC0IP=10.28.0.144|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControl
22/5/2019 19:11:24 lerü#2|NIC0MAC=008064FB707A|RECP0=824|SENDP0=454|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(Person
22/5/2019 19:11:24 alüAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandü
22/5/2019 19:11:24 Wireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|
MIBSP2=0üMbps|QFEL=KB2727528,KB2729462,KB2737084,KB2753842,KB2756872,KB
22/5/2019 19:11:24
9562,KB2779768,KB2780541,KB2781197,KB2785094,
22/5/2019 19:11:24
794599,KB2795944,KB2798162,KB2798802,KB279880
22/5/2019 19:11:24
B2808679,KB2808735,KB2809289,KB2811660,KB2812
22/5/2019 19:11:24
,KB2829254,KB2829361,KB2829530,KB2830290,KB28
22/5/2019 19:11:24
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18
22/5/2019 19:11:24 .05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0
22/5/2019 19:11:24 .2|AP3=MicrosoftüLyncüVdiü2013|
AP4=MicrosoftüOfficeüProfessionalüPlusü
AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.41
22/5/2019 19:11:24 48||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\M
22/5/2019 19:11:24 icrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|C
22/5/2019 19:11:24 :\ProgramüFiles\Wyse\WDA\|12.1.1.25|
5.4.0.1219
AP12=MicrosoftüExcel|C:\PRO
22/5/2019 19:11:24 GRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449
22/5/2019 19:11:24 .0|AP14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=Of
22/5/2019 19:11:24 ficeüXMLüHandler|
15.0.4420.1017|AP16=MicrosoftüPowerP
22/5/2019 19:11:24 oint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|
15.0.4420.1017|AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP
22/5/2019 19:11:24 18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\ProgramüFiles\Wi
22/5/2019 19:11:24 ndowsüMail\wab.exe|6.2.9200.16384|
6.2.92
22/5/2019 19:11:24 00.16384|AP21=MicrosoftüWord|
WCMSupp=1|WCMJSONSup
22/5/2019 19:11:24 p=1|
22/5/2019 19:11:24 Found HS Tag
ProcessMsg!
22/5/2019 19:11:24 Server Sent 5
22/5/2019 19:11:24 Enhanced QU : QUM :
22/5/2019 19:11:24 Enhanced QU : QUC :
22/5/2019 19:11:24 Enhanced QU : QUD :
22/5/2019 19:11:24 Server Sent 6
22/5/2019 19:11:24 LOOKING FOR &04
22/5/2019 19:11:24 FUR :After S&P done
22/5/2019 19:42:28 Stopping
23/5/2019 8:4:14 ***********************************************************
23/5/2019 8:4:14 End of WinMain()
23/5/2019 8:4:14 ^^^^^^^^ after reghanex()
23/5/2019 8:4:34 OS Version 6.2.9200
23/5/2019 8:4:34 OS Version 6.2.9200
23/5/2019 8:4:34 Major version 6
23/5/2019 8:4:34 Minor version 2
23/5/2019 8:4:34 Device Info: OS is `�4
23/5/2019 8:4:34 Setting UWF Mgr!
23/5/2019 8:4:34 Disk offset 659554304
23/5/2019 8:4:34 Disk offset =1048576

23/5/2019 8:4:34 Disk offset =105906176
23/5/2019 8:4:34 Disk offset =420478976
23/5/2019 8:4:34 Disk offset =525336576
23/5/2019 8:4:34 Disk offset =659554304

'Z:\',error=1
23/5/2019 8:4:34 AF_INET (IPv4)
23/5/2019 8:4:34 IPv4 address 169.254.150.182
23/5/2019 8:4:34 Valid IP Found

23/5/2019 8:4:34 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
443
securePort: 443
23/5/2019 8:4:34 HA Supported
23/5/2019 8:4:34 dwHSListCount = 1
GetServerAddress
443
HuntForAltLocalIP
IN_ADDR : -1231618391
23/5/2019 8:4:35 ip RETRIVED �7
10.20.15.151, SecurePort: 443
Port: 0
23/5/2019 8:4:40 Failed to Bind
ms
reported: 28
23/5/2019 8:4:40 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 8:4:40 476A-8590-E6333C53F805}, Type=71
secure port 443
23/5/2019 8:4:41 Pipe not found
23/5/2019 8:4:41 The count is 7
23/5/2019 8:4:41 bSet is 1
securePort: 443
23/5/2019 8:4:42 Calling V01
23/5/2019 8:4:42 Merlin version 354
23/5/2019 8:4:42 Signature 354
23/5/2019 8:4:43 Wyse Flag value 0011
23/5/2019 8:4:43 The iBLP value -1
23/5/2019 8:4:44 TZ Queried
23/5/2019 8:4:44 FUR : GetCI() 1
23/5/2019 8:4:44 IP matched!
23/5/2019 8:4:44 Subnet к1
23/5/2019 8:4:44 Gateway з1
23/5/2019 8:4:44 DS
23/5/2019 8:4:44 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�e7
23/5/2019 8:4:44 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�e7
23/5/2019 8:4:44 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�e7
83FF-9A7F0B2B2
23/5/2019 8:4:44 E1E}
23/5/2019 8:4:44 Got reply from AgentUI=�\9
23/5/2019 8:4:44 GetDisplayInfo() return=pJ9
23/5/2019 8:4:44 Disk offset 659554304
23/5/2019 8:4:44 Disk 0 Part 1 TYPE 260

23/5/2019 8:4:44 Disk 0 Part 5 TYPE 261

23/5/2019 8:4:44 Secure boot = 1

23/5/2019 8:4:44 tempbuff = |, num=0
23/5/2019 8:4:44 Got reply from AgentUI= 67
23/5/2019 8:4:44 return from ListAllApps=0#9
23/5/2019 8:4:51 size of qfe list 64
23/5/2019 8:4:52 Value found for LocalXMLPath = #�9
23/5/2019 8:4:52 WDAVersion = 12.1.1.25
23/5/2019 8:4:52 GetCI() done
'Z:\',error=1
securePort: 443
23/5/2019 8:4:52 GetCI() 2 done
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
PRC24=svchost.exe|PRC25=mqsvc.exe|PRC26=GoogleUpdate.exe|PRC27=NetXCle
23/5/2019 8:4:52 d.exe|PRC40=svchost.exe|PRC41=GoogleUpdate.exe|
23/5/2019 8:4:52 6=SearchFilterHost.exe|PRC47=msiexec.exe|PRC48=DtcWdaUi.exe|
23/5/2019 8:4:52 PRMS0=0,0,0|NIC0IP=10.28.0.144|
RECP0=925|SEND
5,KB2769166,KB277
23/5/2019 8:4:52
4,KB2785220,KB2789649,KB2789650,KB2790655,KB2
23/5/2019 8:4:52
804,KB2798805,KB2799494,KB2800033,KB2804583,K
23/5/2019 8:4:52
12822,KB2813170,KB2813430,KB2817183,KB2818604
23/5/2019 8:4:52
2832450,KB2836946,KB2836947,KB2836988,KB28387
23/5/2019 8:4:52 27,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFilesü
23/5/2019 8:4:52 .EXE|15.0.4420.1017|AP17=TightVNC|
C:\PROGRA~1\M
23/5/2019 8:4:52 Found HS Tag
then clear it here
23/5/2019 8:4:52 Server Sent 5
23/5/2019 8:4:52 Enhanced QU : QUM :
23/5/2019 8:4:52 Enhanced QU : QUC :
23/5/2019 8:4:52 Enhanced QU : QUD :
23/5/2019 8:4:52 Server Sent 6
23/5/2019 8:4:52 LOOKING FOR &04
23/5/2019 8:4:52 FUR :After S&P done
GetServerAddress
securePort: 443
23/5/2019 9:5:26 GetIP :: *** PPP
-1879041014
23/5/2019 9:5:26 ip RETRIVED `<8
10.20.15.151, SecurePort: 443
23/5/2019 9:5:26 SETTING REG TO VALUE `<8
reported: 28
23/5/2019 9:5:26 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
23/5/2019 9:5:27 Pipe not found
23/5/2019 9:5:27 The count is 7
23/5/2019 9:5:27 bSet is 1
securePort: 443
23/5/2019 9:5:27 WDAVersion = 12.1.1.25
23/5/2019 9:5:28 The iBLP value -1
23/5/2019 9:5:29 -1|VI=1|
23/5/2019 9:5:29 Found HS Tag
then clear it here
23/5/2019 9:5:29 Server Sent 5
23/5/2019 9:5:29 Enhanced QU : QUM :
23/5/2019 9:5:29 Enhanced QU : QUC :
23/5/2019 9:5:29 Enhanced QU : QUD :
23/5/2019 9:5:29 Server Sent 6
23/5/2019 9:5:29 LOOKING FOR &04
GetServerAddress
securePort: 443
23/5/2019 10:6:15 GetIP :: *** PPP
-1879041014
23/5/2019 10:6:15 ip RETRIVED �.8
10.20.15.151, SecurePort: 443
23/5/2019 10:6:15 SETTING REG TO VALUE �.8
reported: 28
23/5/2019 10:6:15 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 10:6:15 Pipe not found
23/5/2019 10:6:15 The count is 7
23/5/2019 10:6:15 bSet is 1
securePort: 443
23/5/2019 10:6:15 Value found for LocalXMLPath = �_7
23/5/2019 10:6:15 WDAVersion = 12.1.1.25
23/5/2019 10:6:16 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 10:6:16 1|VI=1|
23/5/2019 10:6:17 Found HS Tag
ProcessMsg!
then clear it here
23/5/2019 10:6:17 Server Sent 5
23/5/2019 10:6:17 Enhanced QU : QUM :
23/5/2019 10:6:17 Enhanced QU : QUC :
23/5/2019 10:6:17 Enhanced QU : QUD :
23/5/2019 10:6:17 Server Sent 6
23/5/2019 10:6:17 LOOKING FOR &04
GetServerAddress
securePort: 443
23/5/2019 11:7:14 GetIP :: *** PPP
-1879041014
23/5/2019 11:7:14 ip RETRIVED �.8
10.20.15.151, SecurePort: 443
23/5/2019 11:7:14 SETTING REG TO VALUE �.8
reported: 28
23/5/2019 11:7:14 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 11:7:14 Pipe not found
23/5/2019 11:7:14 The count is 7
23/5/2019 11:7:14 bSet is 1
securePort: 443
23/5/2019 11:7:14 WDAVersion = 12.1.1.25
23/5/2019 11:7:15 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 11:7:15 -1|VI=1|
23/5/2019 11:7:15 Found HS Tag
ProcessMsg!
then clear it here
23/5/2019 11:7:15 Server Sent 5
23/5/2019 11:7:16 Enhanced QU : QUM :
23/5/2019 11:7:16 Enhanced QU : QUC :
23/5/2019 11:7:16 Enhanced QU : QUD :
23/5/2019 11:7:16 Server Sent 6
23/5/2019 11:7:16 LOOKING FOR &04
GetServerAddress
securePort: 443
23/5/2019 11:48:32 GetIP :: *** PPP
IN_ADDR : -1879041014
23/5/2019 11:48:32 ip RETRIVED �D8
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:48:38 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:48:38 476A-8590-E6333C53F805}, Type=71
23/5/2019 11:48:43 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 11:48:44 ip RETRIVED �D8
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:48:49 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:48:49 476A-8590-E6333C53F805}, Type=71
23/5/2019 11:48:49 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 11:48:54 ip RETRIVED �B8
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:49:0 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:49:0 476A-8590-E6333C53F805}, Type=71
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 11:49:6 ip RETRIVED �B8
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:49:11 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:49:11 476A-8590-E6333C53F805}, Type=71
23/5/2019 11:49:11 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 11:49:18 ip RETRIVED �48
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:49:24 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:49:24 476A-8590-E6333C53F805}, Type=71
23/5/2019 11:49:24 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
23/5/2019 11:49:24 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 11:49:24 ip RETRIVED �38
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:49:30 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:49:30 476A-8590-E6333C53F805}, Type=71
23/5/2019 11:49:30 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 11:49:43 ip RETRIVED #H8
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:49:49 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:49:49 476A-8590-E6333C53F805}, Type=71
23/5/2019 11:49:49 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
23/5/2019 11:49:49 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 11:49:49 ip RETRIVED p=8
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:49:55 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:49:55 476A-8590-E6333C53F805}, Type=71
23/5/2019 11:49:55 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
23/5/2019 11:50:6 ip RETRIVED p=8
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:50:11 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:50:11 476A-8590-E6333C53F805}, Type=71
23/5/2019 11:50:17 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 11:50:17 ip RETRIVED #H8
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:50:23 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:50:23 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 11:52:24 ip RETRIVED
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:52:30 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:52:30 476A-8590-E6333C53F805}, Type=71
23/5/2019 11:52:30 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
23/5/2019 11:52:31 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 11:52:31 ip RETRIVED
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:52:37 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:52:37 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 11:54:9 ip RETRIVED �B8
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:54:15 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:54:15 476A-8590-E6333C53F805}, Type=71
23/5/2019 11:54:20 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 11:54:21 ip RETRIVED 0J8
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 11:54:26 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 11:54:26 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 12:2:20 ip RETRIVED �38
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
23/5/2019 12:2:26 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 12:2:26 476A-8590-E6333C53F805}, Type=71
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
23/5/2019 12:2:31 ip RETRIVED 88
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
23/5/2019 12:2:37 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 12:2:37 476A-8590-E6333C53F805}, Type=71
23/5/2019 12:8:6 Stopping
23/5/2019 12:24:0 ***********************************************************
23/5/2019 12:24:0 End of WinMain()
23/5/2019 12:24:0 ^^^^^^^^ after reghanex()
23/5/2019 12:24:20 OS Version 6.2.9200
23/5/2019 12:24:20 OS Version 6.2.9200
23/5/2019 12:24:20 Major version 6
23/5/2019 12:24:20 Minor version 2
23/5/2019 12:24:20 Device Info: OS is �-
23/5/2019 12:24:20 The image has UWF
23/5/2019 12:24:20 WRITE FILTER UWF 1
23/5/2019 12:24:20 Setting UWF Mgr!
23/5/2019 12:24:21 Disk offset 659554304
23/5/2019 12:24:21 Disk offset =1048576

23/5/2019 12:24:21 Disk offset =105906176
23/5/2019 12:24:21 Disk offset =420478976
23/5/2019 12:24:21 Disk offset =525336576
23/5/2019 12:24:21 Disk offset =659554304

'Z:\',error=1
23/5/2019 12:24:21 AF_INET (IPv4)
23/5/2019 12:24:21 IPv4 address 169.254.150.182
23/5/2019 12:24:21 Valid IP Found

23/5/2019 12:24:21 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
23/5/2019 12:24:21 HA Supported
23/5/2019 12:24:21 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1231618391
23/5/2019 12:24:21 ip RETRIVED ��0
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
23/5/2019 12:24:26 Failed to Bind
5 ms
reported: 28
23/5/2019 12:24:27 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 12:24:27 476A-8590-E6333C53F805}, Type=71
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 12:24:28 Pipe not found
23/5/2019 12:24:28 The count is 7
23/5/2019 12:24:28 bCheckServer is 1
23/5/2019 12:24:28 bSet is 1
securePort: 443
23/5/2019 12:24:28 Saving server info: IP: 10.20.15.151, port: 0, securePort:
443
23/5/2019 12:24:29 Calling V01
23/5/2019 12:24:29 Merlin version 354
23/5/2019 12:24:29 Signature 354
23/5/2019 12:24:31 Wyse Flag value 0011
23/5/2019 12:24:31 The iBLP value -1
23/5/2019 12:24:32 TZ Queried
Number
23/5/2019 12:24:32 FUR : GetCI() 1
23/5/2019 12:24:32 IP matched!
23/5/2019 12:24:32 Subnet �+
23/5/2019 12:24:32 Gateway ��+
23/5/2019 12:24:32 DS ;+
23/5/2019 12:24:32 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=5.
23/5/2019 12:24:32 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=5.
23/5/2019 12:24:32 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=5.
83FF-9A7F0B2B2
23/5/2019 12:24:32 E1E}
23/5/2019 12:24:32 add only adapter.
23/5/2019 12:24:32 Disk offset 659554304
23/5/2019 12:24:32 Disk 0 Part 1 TYPE 260

23/5/2019 12:24:32 Disk 0 Part 5 TYPE 261

23/5/2019 12:24:32 Secure boot = 1

23/5/2019 12:24:32 tempbuff = |WIN0=facebook - Buscar con Google - Google
23/5/2019 12:24:32 Msg recd from AgentGUI:|WIN0=facebook - Buscar con Google -
Google Chrome|WIN1=Program Manager|
23/5/2019 12:24:32 Got reply from AgentUI=�?2
23/5/2019 12:24:32 return from ListAllApps=0�.
23/5/2019 12:24:40 size of qfe list 64
23/5/2019 12:24:41 Value found for LocalXMLPath = 0#/
23/5/2019 12:24:41 WDAVersion = 12.1.1.25
23/5/2019 12:24:41 GetCI() done
'Z:\',error=1
securePort: 443
23/5/2019 12:24:41 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC27=NetXCle
23/5/2019 12:24:41 d.exe|PRC40=svchost.exe|PRC41=wmiprvse.exe|
PRC42=SearchIndexer.exe|PRC43=SearchFilterHost.exe|PRC44=vssvc.exe|
PRC45=svchost.exe|
23/5/2019 12:24:41 PRC46=msiexec.exe|PRC47=DtcWdaUi.exe|PRC48=hagent.exe|
PRC49=HAgent_UI.exe|PRC50=chrome.exe|PRC51=chrome.exe|PRC52=tvnserver.exe|
23/5/2019 12:24:41 PRC53=RAVCpl64.exe|PRC54=concentr.exe|PRC55=redirector.exe|
PRC56=PNUSBCLITRAY.exe|PRC57=chrome.exe|PRC58=PNTray.exe|PRC59=chrome
23/5/2019 12:24:41 .exe|PRC60=Receiver.exe|PRC61=chrome.exe|
PRC62=SelfServicePlugin.exe|PRC63=wfcrun32.exe|PRC64=chrome.exe|
PRC65=GoogleUpdateSetup
23/5/2019 12:24:41 .exe||WIN0=facebookü-üBuscarüconüGoogleü-üGoogleüChrome|
CPRMS0=0,0,0|NIC0IP=10.28.0.144|NIC0DESC=Ethernet,InventecüPCIeüGBEü
23/5/2019 12:24:41 FamilyüControllerü#2|NIC0MAC=008064FB707A|RECP0=2816|
SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel
23/5/2019 12:24:41 (R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|
23/5/2019 12:24:41
4,KB2778930,KB2779562,KB2779768,KB2780541,KB2
23/5/2019 12:24:41
210,KB2794119,KB2794599,KB2795944,KB2798162,K
23/5/2019 12:24:41
05227,KB2807986,KB2808679,KB2808735,KB2809289
23/5/2019 12:24:41
2822241,KB2829069,KB2829254,KB2829361,KB28295
23/5/2019 12:24:41
KB2845690,|AP0=7-Zipü18.05ü(x64)|C:\Program
23/5/2019 12:24:41 üFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenan
23/5/2019 12:24:41 ceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOfficeüPro
23/5/2019 12:24:41 fessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|
15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-ü
23/5/2019 12:24:41 x64ü9.0.30729.4148||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:
23/5/2019 12:24:41 \ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|AP9=Wyse
23/5/2019 12:24:41 üDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\C
23/5/2019 12:24:41 lient\|5.4.0.1219906|AP11=GoogleüChrome|
AP12=Micros
23/5/2019 12:24:41 oftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|
15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|C:\Windows\System32\fb
23/5/2019 12:24:41 wfmgr.EXE|2.0.449.0|
15.0.4420.1017|AP16=
23/5/2019 12:24:41 MicrosoftüPowerPoint|
C:\ProgramüFiles\TightVNC\tvnserv
23/5/2019 12:24:41 er.exe|2.6.4.0|AP18=UnifiedüWriteüFilterüManagerüManager|
C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|C:\
23/5/2019 12:24:41 ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\WindowsüMail\
23/5/2019 12:24:41 wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCM
23/5/2019 12:24:41 Supp=1|WCMJSONSupp=1|
23/5/2019 12:24:41 Found HS Tag
ProcessMsg!
23/5/2019 12:24:41 Server Sent 5
23/5/2019 12:24:41 Enhanced QU : QUM :
23/5/2019 12:24:41 Enhanced QU : QUC :
23/5/2019 12:24:41 Enhanced QU : QUD :
23/5/2019 12:24:41 Server Sent 6
23/5/2019 12:24:41 LOOKING FOR &04
23/5/2019 12:24:41 FUR :After S&P done
GetServerAddress
securePort: 443
23/5/2019 13:26:54 GetIP :: *** PPP
IN_ADDR : -1879041014
23/5/2019 13:26:54 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
reported: 28
23/5/2019 13:26:54 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 13:26:54 Pipe not found
23/5/2019 13:26:54 The count is 7
23/5/2019 13:26:54 bCheckServer is 1
23/5/2019 13:26:54 bSet is 1
securePort: 443
23/5/2019 13:26:55 Value found for LocalXMLPath = f2
23/5/2019 13:26:56 WDAVersion = 12.1.1.25
23/5/2019 13:26:57 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 13:26:57 -1|VI=1|
23/5/2019 13:26:57 Found HS Tag
ProcessMsg!
23/5/2019 13:26:57 Server Sent 5
23/5/2019 13:26:57 Enhanced QU : QUM :
23/5/2019 13:26:57 Enhanced QU : QUC :
23/5/2019 13:26:57 Enhanced QU : QUD :
23/5/2019 13:26:57 Server Sent 6
23/5/2019 13:26:57 LOOKING FOR &04
GetServerAddress
securePort: 443
23/5/2019 13:44:17 GetIP :: *** PPP
IN_ADDR : -1879041014
23/5/2019 13:44:17 ip RETRIVED �1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 13:44:22 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 13:44:22 476A-8590-E6333C53F805}, Type=71
23/5/2019 13:44:28 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 13:44:28 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 13:44:34 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 13:44:34 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 13:44:48 ip RETRIVED #2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 13:44:54 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 13:44:54 476A-8590-E6333C53F805}, Type=71
23/5/2019 13:44:54 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
23/5/2019 13:44:54 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 13:44:54 ip RETRIVED `#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 13:45:0 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 13:45:0 476A-8590-E6333C53F805}, Type=71
23/5/2019 13:45:0 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 13:45:12 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 13:45:18 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 13:45:18 476A-8590-E6333C53F805}, Type=71
23/5/2019 13:45:24 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 13:45:24 ip RETRIVED �#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 13:45:30 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 13:45:30 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 14:48:55 ip RETRIVED #2
10.20.15.151, SecurePort: 443
23/5/2019 14:48:55 SETTING REG TO VALUE #2
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 14:48:55 Pipe not found
23/5/2019 14:48:55 The count is 7
23/5/2019 14:48:55 bCheckServer is 1
23/5/2019 14:48:55 bSet is 1
securePort: 443
23/5/2019 14:48:55 Calling V01
23/5/2019 14:48:55 Merlin version 354
23/5/2019 14:48:55 Signature 354
23/5/2019 14:48:56 Wyse Flag value 0011
23/5/2019 14:48:57 The iBLP value -1
23/5/2019 14:48:57 TZ Queried
Number
23/5/2019 14:48:57 FUR : GetCI() 1
23/5/2019 14:48:57 IP matched!
23/5/2019 14:48:57 Subnet �+
23/5/2019 14:48:57 Gateway ��+
23/5/2019 14:48:57 DS ;+
23/5/2019 14:48:57 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=��.
23/5/2019 14:48:57 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=��.
23/5/2019 14:48:57 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=��.
83FF-9A7F0B2B2
23/5/2019 14:48:57 E1E}
23/5/2019 14:48:57 add only adapter.
23/5/2019 14:48:57 GetDisplayInfo() return=P#1
23/5/2019 14:48:57 Disk offset 659554304
23/5/2019 14:48:57 Disk 0 Part 1 TYPE 260

23/5/2019 14:48:57 Disk 0 Part 5 TYPE 261

23/5/2019 14:48:57 Secure boot = 1

23/5/2019 14:48:58 tempbuff = |WIN0=Teclado en pantalla|WIN1=Program Manager|,
num=0
23/5/2019 14:48:58 Msg recd from AgentGUI:|WIN0=Teclado en pantalla|WIN1=Program
Manager|
23/5/2019 14:49:3 size of qfe list 64
23/5/2019 14:49:3 Value found for LocalXMLPath = #T-
23/5/2019 14:49:3 WDAVersion = 12.1.1.25
23/5/2019 14:49:3 GetCI() done
23/5/2019 14:49:3 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC46=r
23/5/2019 14:49:3 mExec.exe|PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|PRC55=osk.exe|
PRC56=ATBroker.exe|PRC57=svchost.exe|PRC58=wmiprvse.exe|PRC59=Rece
23/5/2019 14:49:3 iver.exe|PRC60=SelfServicePlugin.exe|PRC61=wfcrun32.exe||
WIN0=Tecladoüenüpantalla|WIN1=ProgramüManager||PMIU=32|TBPM=7786256|
23/5/2019 14:49:3 FBPM=5267492|TBPF=7786256|FBPF=5173372|TBVM=8589934464|
FKVM=8589865384|FKEM=0|CPRMS0=42,0,42|NIC0IP=10.28.0.144|NIC0DESC=Etherne
23/5/2019 14:49:3 t,InventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|
RECP0=146773|SENDP0=104932|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|
23/5/2019 14:49:3 NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.
23/5/2019 14:49:3 0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
23/5/2019 14:49:3
B2770917,KB2777294,KB2778344,KB2778930,KB2779
23/5/2019 14:49:3
,KB2790907,KB2792100,KB2793210,KB2794119,KB27
23/5/2019 14:49:3
83,KB2804584,KB2805222,KB2805227,KB2807986,KB
23/5/2019 14:49:3
8604,KB2820330,KB2821895,KB2822241,KB2829069,
23/5/2019 14:49:3
838727,KB2839894,KB2845533,KB2845690,|AP0=7-Z
23/5/2019 14:49:3 ipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61
23/5/2019 14:49:3 .0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017
23/5/2019 14:49:3 |AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC++�
23/5/2019 14:49:3 �2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP
23/5/2019 14:49:3 7=MicrosoftüSilverlight|
+ü2005üRedistributable
23/5/2019 14:49:3 ü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\Programü
23/5/2019 14:49:3 Files\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.ex
23/5/2019 14:49:3 e|68.0.3440.106|AP12=MicrosoftüExcel|
basedüwriteüfilterüman
23/5/2019 14:49:3 ager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\InternetüEx
23/5/2019 14:49:3 plorer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXML
23/5/2019 14:49:3 ED.EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|C:\Prog
23/5/2019 14:49:3 ramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0
23/5/2019 14:49:3 |AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\Pr
23/5/2019 14:49:3 ogramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
23/5/2019 14:49:3 17|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
23/5/2019 14:49:4 Found HS Tag
ProcessMsg!
then clear it here
23/5/2019 14:49:4 Server Sent 5
23/5/2019 14:49:4 Enhanced QU : QUM :
23/5/2019 14:49:4 Enhanced QU : QUC :
23/5/2019 14:49:4 Enhanced QU : QUD :
23/5/2019 14:49:4 Server Sent 6
23/5/2019 14:49:4 LOOKING FOR &04
23/5/2019 14:49:4 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:17:22 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:17:28 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:17:28 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:17:28 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
23/5/2019 15:17:29 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:17:29 ip RETRIVED �#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:17:34 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:17:34 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:17:42 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:17:48 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:17:48 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:17:48 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
23/5/2019 15:17:48 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:17:48 ip RETRIVED `#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:17:54 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:17:54 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:18:4 ip RETRIVED � 2
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
23/5/2019 15:18:10 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:18:10 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:18:15 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 15:18:15 ip RETRIVED `�1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:18:21 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:18:21 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 15:18:27 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:18:32 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:18:32 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:18:38 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 15:18:38 ip RETRIVED �#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:18:44 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:18:44 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:20:10 ip RETRIVED #2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:20:16 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:20:16 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:20:16 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
23/5/2019 15:20:16 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:20:17 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:20:22 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:20:22 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:20:48 ip RETRIVED �#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:20:54 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:20:54 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:20:54 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
23/5/2019 15:20:54 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:20:54 ip RETRIVED `#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:21:0 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:21:0 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:21:16 ip RETRIVED �#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:21:22 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:21:22 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:21:28 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 15:21:28 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:21:34 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:21:34 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:26:14 ip RETRIVED `#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:26:19 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:26:19 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:26:25 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:26:25 ip RETRIVED � 2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:26:31 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:26:31 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:26:31 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 15:26:39 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:26:44 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:26:44 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:26:50 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 15:26:50 ip RETRIVED #2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:26:56 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:26:56 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:27:2 ip RETRIVED #�1
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
23/5/2019 15:27:7 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:27:7 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:27:13 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 15:27:13 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:27:19 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:27:19 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:27:30 ip RETRIVED #2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:27:35 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:27:35 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:27:41 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:27:41 ip RETRIVED � 2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:27:47 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:27:47 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
23/5/2019 15:27:55 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
23/5/2019 15:28:1 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:28:1 476A-8590-E6333C53F805}, Type=71
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
23/5/2019 15:28:7 ip RETRIVED �#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:28:13 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:28:13 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:28:13 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 15:28:19 ip RETRIVED #2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:28:24 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:28:24 476A-8590-E6333C53F805}, Type=71
23/5/2019 15:28:30 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 15:28:30 ip RETRIVED �#2
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
23/5/2019 15:28:36 C80B-4C42-8011-32B62020ACA3}, Type=6
23/5/2019 15:28:36 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
-1879041014
23/5/2019 16:32:4 ip RETRIVED �#2
10.20.15.151, SecurePort: 443
23/5/2019 16:32:4 SETTING REG TO VALUE �#2
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 16:32:7 Pipe not found
23/5/2019 16:32:7 The count is 7
23/5/2019 16:32:7 bSet is 1
securePort: 443
23/5/2019 16:32:8 Calling V01
23/5/2019 16:32:8 Merlin version 354
23/5/2019 16:32:8 Signature 354
23/5/2019 16:32:8 Wyse Flag value 0011
23/5/2019 16:32:9 The iBLP value -1
23/5/2019 16:32:10 TZ Queried
Number
23/5/2019 16:32:10 FUR : GetCI() 1
23/5/2019 16:32:10 IP matched!
23/5/2019 16:32:10 Subnet �+
23/5/2019 16:32:10 Gateway ��+
23/5/2019 16:32:10 DS ;+
23/5/2019 16:32:10 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP= �.
23/5/2019 16:32:10 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP= �.
23/5/2019 16:32:10 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP= �.
83FF-9A7F0B2B2
23/5/2019 16:32:10 E1E}
23/5/2019 16:32:10 add only adapter.
23/5/2019 16:32:10 GetDisplayInfo() return=�#8
23/5/2019 16:32:10 Disk offset 659554304
23/5/2019 16:32:10 Disk 0 Part 1 TYPE 260

23/5/2019 16:32:10 Disk 0 Part 5 TYPE 261

23/5/2019 16:32:10 Secure boot = 1

23/5/2019 16:32:10 tempbuff = |WIN0=Teclado en pantalla|WIN1=Program Manager|,
num=0
23/5/2019 16:32:10 Msg recd from AgentGUI:|WIN0=Teclado en pantalla|WIN1=Program
Manager|
23/5/2019 16:32:10 return from ListAllApps=P�7
23/5/2019 16:32:16 size of qfe list 64
23/5/2019 16:32:16 WDAVersion = 12.1.1.25
23/5/2019 16:32:16 GetCI() done
23/5/2019 16:32:16 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC46=r
PRC55=osk.exe|PRC56=ATBroker.exe|PRC57=wmiprvse.exe|PRC58=Receiver.exe|PRC59=Sel
23/5/2019 16:32:16 fServicePlugin.exe|PRC60=wfcrun32.exe||
WIN0=Tecladoüenüpantalla|WIN1=ProgramüManager||PMIU=34|TBPM=7786256|FBPM=5135716|
TBPF=
CPRMS0=42,0,42|NIC0IP=10.28.0.144|NIC0DESC=Ethernet,InventecüPCIeü
23/5/2019 16:32:16 GBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|RECP0=197705|
23/5/2019 16:32:16 BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ether
23/5/2019 16:32:16 net,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|
23/5/2019 16:32:16
,KB2778344,KB2778930,KB2779562,KB2779768,KB27
23/5/2019 16:32:16
00,KB2793210,KB2794119,KB2794599,KB2795944,KB
23/5/2019 16:32:16
5222,KB2805227,KB2807986,KB2808679,KB2808735,
23/5/2019 16:32:16
821895,KB2822241,KB2829069,KB2829254,KB282936
23/5/2019 16:32:16
B2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|C
23/5/2019 16:32:16 :\ProgramüFiles\7-Zip\|18.05|
AP2=Mozillaü
23/5/2019 16:32:16 MaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOf
23/5/2019 16:32:16 ficeüProfessionalüPlusü2013|
23/5/2019 16:32:16 ableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=MicrosoftüSilve
23/5/2019 16:32:16 rlight|c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
23/5/2019 16:32:16 |AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMwar
23/5/2019 16:32:16 eüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|AP
23/5/2019 16:32:16 12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|
15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|C:\Windows\Sy
23/5/2019 16:32:16 stem32\fbwfmgr.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.E
23/5/2019 16:32:16 XE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\TightVN
23/5/2019 16:32:16 C\tvnserver.exe|2.6.4.0|
AP19=WindowsüCon
23/5/2019 16:32:16 tacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\Windo
23/5/2019 16:32:16 wsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|
23/5/2019 16:32:16 WDA=1|WCMSupp=1|WCMJSONSupp=1|
23/5/2019 16:32:16 Found HS Tag
ProcessMsg!
23/5/2019 16:32:16 Server Sent 5
23/5/2019 16:32:16 Enhanced QU : QUM :
23/5/2019 16:32:16 Enhanced QU : QUC :
23/5/2019 16:32:16 Enhanced QU : QUD :
23/5/2019 16:32:16 Server Sent 6
23/5/2019 16:32:16 LOOKING FOR &04
23/5/2019 16:32:16 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 17:35:50 ip RETRIVED ��1
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 17:35:50 Pipe not found
23/5/2019 17:35:50 The count is 7
23/5/2019 17:35:50 bCheckServer is 1
23/5/2019 17:35:50 bSet is 1
securePort: 443
23/5/2019 17:35:50 WDAVersion = 12.1.1.25
23/5/2019 17:35:51 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 17:35:52 1|VI=1|
23/5/2019 17:35:52 Found HS Tag
ProcessMsg!
23/5/2019 17:35:52 Server Sent 5
23/5/2019 17:35:52 Enhanced QU : QUM :
23/5/2019 17:35:52 Enhanced QU : QUC :
23/5/2019 17:35:52 Enhanced QU : QUD :
23/5/2019 17:35:52 Server Sent 6
23/5/2019 17:35:52 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1879041014
23/5/2019 18:39:12 ip RETRIVED �#2
10.20.15.151, SecurePort: 443
23/5/2019 18:39:12 SETTING REG TO VALUE �#2
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 18:39:12 Pipe not found
23/5/2019 18:39:12 The count is 7
23/5/2019 18:39:12 bCheckServer is 1
23/5/2019 18:39:12 bSet is 1
securePort: 443
23/5/2019 18:39:12 WDAVersion = 12.1.1.25
23/5/2019 18:39:13 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
23/5/2019 18:39:14 1|VI=1|
23/5/2019 18:39:14 Found HS Tag
ProcessMsg!
23/5/2019 18:39:14 Server Sent 5
23/5/2019 18:39:14 Enhanced QU : QUM :
23/5/2019 18:39:14 Enhanced QU : QUC :
23/5/2019 18:39:14 Enhanced QU : QUD :
23/5/2019 18:39:14 Server Sent 6
23/5/2019 18:39:14 LOOKING FOR &04
24/5/2019 7:41:57 ***********************************************************
24/5/2019 7:41:57 End of WinMain()
24/5/2019 7:41:57 ^^^^^^^^ after reghanex()
24/5/2019 7:42:17 OS Version 6.2.9200
24/5/2019 7:42:17 OS Version 6.2.9200
24/5/2019 7:42:17 Major version 6
24/5/2019 7:42:17 Minor version 2
24/5/2019 7:42:17 Device Info: OS is p�(
24/5/2019 7:42:17 WRITE FILTER UWF 1
24/5/2019 7:42:17 Setting UWF Mgr!
24/5/2019 7:42:17 Disk offset 659554304
24/5/2019 7:42:17 Disk offset =1048576

24/5/2019 7:42:17 Disk offset =105906176
24/5/2019 7:42:17 Disk offset =420478976
24/5/2019 7:42:17 Disk offset =525336576
24/5/2019 7:42:17 Disk offset =659554304

'Z:\',error=1
24/5/2019 7:42:17 AF_INET (IPv4)
24/5/2019 7:42:17 IPv4 address 169.254.150.182
24/5/2019 7:42:17 Valid IP Found

24/5/2019 7:42:17 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
24/5/2019 7:42:18 HA Supported
24/5/2019 7:42:18 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1231618391
24/5/2019 7:42:18 ip RETRIVED �#,
10.20.15.151, SecurePort: 443
HServer
Port: 0
24/5/2019 7:42:23 Failed to Bind
ms
reported: 28
24/5/2019 7:42:23 C80B-4C42-8011-32B62020ACA3}, Type=6
24/5/2019 7:42:23 476A-8590-E6333C53F805}, Type=71
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 7:42:24 Pipe not found
24/5/2019 7:42:24 The count is 7
24/5/2019 7:42:24 bSet is 1
securePort: 443
24/5/2019 7:42:25 Calling V01
24/5/2019 7:42:25 Merlin version 354
24/5/2019 7:42:25 Signature 354
24/5/2019 7:42:26 Wyse Flag value 0011
24/5/2019 7:42:27 The iBLP value -1
24/5/2019 7:42:27 TZ Queried
Number
24/5/2019 7:42:27 FUR : GetCI() 1
24/5/2019 7:42:27 IP matched!
24/5/2019 7:42:27 Subnet `�&
24/5/2019 7:42:27 Gateway ��&
24/5/2019 7:42:27 DS ��&
24/5/2019 7:42:27 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=��)
24/5/2019 7:42:27 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=��)
24/5/2019 7:42:27 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=��)
83FF-9A7F0B2B2
24/5/2019 7:42:27 E1E}
24/5/2019 7:42:27 Got reply from AgentUI=�#*
24/5/2019 7:42:27 GetDisplayInfo() return=0w-
24/5/2019 7:42:27 Disk offset 659554304
24/5/2019 7:42:27 Disk 0 Part 1 TYPE 260

24/5/2019 7:42:28 Disk 0 Part 5 TYPE 261

24/5/2019 7:42:28 Secure boot = 1

24/5/2019 7:42:28 tempbuff = |, num=0
24/5/2019 7:42:28 return from ListAllApps=�#,
24/5/2019 7:42:35 size of qfe list 64
24/5/2019 7:42:35 Value found for LocalXMLPath = #�+
24/5/2019 7:42:35 WDAVersion = 12.1.1.25
24/5/2019 7:42:35 GetCI() done
'Z:\',error=1
securePort: 443
24/5/2019 7:42:35 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC27=NetXCle
PRC37=wmiprvse.exe|PRC38=vmware-usbarbitrator64.exe|PRC39=GoogleUpdate.ex
24/5/2019 7:42:35 6=SearchFilterHost.exe|PRC47=msiexec.exe|PRC48=DtcWdaUi.exe|
24/5/2019 7:42:35 PRMS0=0,0,0|NIC0IP=10.28.0.144|
RECP0=607|SEND
5,KB2769166,KB277
24/5/2019 7:42:35
4,KB2785220,KB2789649,KB2789650,KB2790655,KB2
24/5/2019 7:42:35
804,KB2798805,KB2799494,KB2800033,KB2804583,K
24/5/2019 7:42:35
12822,KB2813170,KB2813430,KB2817183,KB2818604
24/5/2019 7:42:35
2832450,KB2836946,KB2836947,KB2836988,KB28387
24/5/2019 7:42:35 27,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFilesü
24/5/2019 7:42:35 .EXE|15.0.4420.1017|AP17=TightVNC|
C:\PROGRA~1\M
24/5/2019 7:42:36 Found HS Tag
ProcessMsg!
then clear it here
24/5/2019 7:42:36 Server Sent 5
24/5/2019 7:42:36 Enhanced QU : QUM :
24/5/2019 7:42:36 Enhanced QU : QUC :
24/5/2019 7:42:36 Enhanced QU : QUD :
24/5/2019 7:42:36 Server Sent 6
24/5/2019 7:42:36 LOOKING FOR &04
24/5/2019 7:42:36 FUR :After S&P done
24/5/2019 8:19:59 Received data:
Accept: */*
Connection: close
24/5/2019 8:19:59 =0.7,*;q=0.7

Accept: */*
Connection: close
24/5/2019 8:19:59 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
24/5/2019 8:20:0 GetIP :: *** PPP
-1879041014
24/5/2019 8:20:0 ip RETRIVED @�,
10.20.15.151, SecurePort: 443
24/5/2019 8:20:0 SETTING REG TO VALUE @�,
reported: 28
24/5/2019 8:20:0 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
24/5/2019 8:20:1 Pipe not found
24/5/2019 8:20:1 The count is 7
24/5/2019 8:20:1 bSet is 1
securePort: 443
24/5/2019 8:20:2 Calling V01
24/5/2019 8:20:2 Merlin version 354
24/5/2019 8:20:2 Signature 354
24/5/2019 8:20:2 Wyse Flag value 0011
24/5/2019 8:20:3 The iBLP value -1
24/5/2019 8:20:5 TZ Queried
24/5/2019 8:20:5 FUR : GetCI() 1
24/5/2019 8:20:5 IP matched!
24/5/2019 8:20:5 Subnet `�&
24/5/2019 8:20:5 Gateway ��&
24/5/2019 8:20:5 DS ��&
83FF-9A7F0B2B2
24/5/2019 8:20:5 E1E}
24/5/2019 8:20:5 Got reply from AgentUI=@z.
24/5/2019 8:20:5 GetDisplayInfo() return=�#,
24/5/2019 8:20:5 Disk offset 659554304
24/5/2019 8:20:5 Disk 0 Part 1 TYPE 260

24/5/2019 8:20:6 Disk 0 Part 5 TYPE 261

24/5/2019 8:20:6 Secure boot = 1

24/5/2019 8:20:6 tempbuff = |WIN0=Microsoft Word - EAN_GRADO_P3.doc - Google
24/5/2019 8:20:6 Msg recd from AgentGUI:|WIN0=Microsoft Word - EAN_GRADO_P3.doc
- Google Chrome|WIN1=Program Manager|
24/5/2019 8:20:6 Got reply from AgentUI=��,
24/5/2019 8:20:6 return from ListAllApps=��,
24/5/2019 8:20:13 size of qfe list 64
24/5/2019 8:20:13 WDAVersion = 12.1.1.25
24/5/2019 8:20:13 GetCI() done
24/5/2019 8:20:13 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC46=r
24/5/2019 8:20:13 7=taskhostex.exe|PRC68=NGenTask.exe|PRC69=NGenTask.exe|
PRC70=conhost.exe|PRC71=conhost.exe|PRC72=ngen.exe|PRC73=ngen.exe|PRC74=w
24/5/2019 8:20:13 miprvse.exe|PRC75=taskhost.exe|PRC76=MpCmdRun.exe|
PRC77=conhost.exe|PRC78=MpCmdRun.exe|PRC79=conhost.exe|PRC80=MpCmdRun.exe|PRC8
24/5/2019 8:20:13 1=MpCmdRun.exe|PRC82=conhost.exe|PRC83=conhost.exe|
PRC84=ccmeval.exe|PRC85=SettingSyncHost.exe|PRC86=rundll32.exe|PRC87=NGenTask
24/5/2019 8:20:13 .exe|PRC88=conhost.exe|PRC89=NGenTask.exe|PRC90=conhost.exe|
PRC91=TrustedInstaller.exe|PRC92=msiexec.exe|PRC93=TiWorker.exe|PRC9
24/5/2019 8:20:13 4=makecab.exe|PRC95=conhost.exe|PRC96=wmiprvse.exe||
WIN0=MicrosoftüWordü-üEAN_GRADO_P3.docü-üGoogleüChrome|WIN1=ProgramüM
24/5/2019 8:20:13 anager||PMIU=44|TBPM=7786256|FBPM=4326768|TBPF=7786256|
FBPF=3977840|TBVM=8589934464|FKVM=8589865384|FKEM=0|CPRMS0=25,25,25|NIC0I
24/5/2019 8:20:13 P=10.28.0.144|
RECP0=64932|SENDP0=17904|MIBSP0
24/5/2019 8:20:13 =1000üMbps||NIC1IP=0.0.0.0|
RECP1=0|SENDP1=0
24/5/2019 8:20:13 |MIBSP1=3üMbps||NIC2IP=0.0.0.0|
SENDP2=0|
24/5/2019 8:20:13 MIBSP2=0üMbps|
5,KB2769166,KB2770917,KB277729
24/5/2019 8:20:13
B2789649,KB2789650,KB2790655,KB2790907,KB2792
24/5/2019 8:20:13
,KB2799494,KB2800033,KB2804583,KB2804584,KB28
24/5/2019 8:20:13
70,KB2813430,KB2817183,KB2818604,KB2820330,KB
24/5/2019 8:20:13
6946,KB2836947,KB2836988,KB2838727,KB2839894,
24/5/2019 8:20:13 KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-
Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\Progra
24/5/2019 8:20:13 müFiles\MozillaüFirefox|61.0.2|
C:\ProgramüFiles\Micr
24/5/2019 8:20:13 osoftüOffice|15.0.4420.1017|
15.0.4420.1017
24/5/2019 8:20:13 |AP5=MicrosoftüVisualüC++ü2008üRedistributableü-
üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKey
24/5/2019 8:20:13 boardüFilterüDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisual
24/5/2019 8:20:13 üC++ü2005üRedistributableü(x64)||8.0.61000|
AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizo
24/5/2019 8:20:13 nüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Client\|
5.4.0.1219906|AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\
24/5/2019 8:20:13 Chrome\Application\chrome.exe|68.0.3440.106|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=Fi
24/5/2019 8:20:13 le-basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|
2.0.449.0|AP14=DiagnosticsüutilityüforüInternetüExplorer|C:
24/5/2019 8:20:13 \ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|
10.0.9200.16384|AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\Micro
24/5/2019 8:20:13 softüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.442
24/5/2019 8:20:13 0.1017|AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|
2.6.4.0|AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\S
24/5/2019 8:20:13 ystem32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Microsoftü(R)ü
24/5/2019 8:20:13 ContactsüImportüTool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|
6.2.9200.16384|AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Offic
24/5/2019 8:20:13 e15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|
WCMJSONSupp=1|
24/5/2019 8:20:14 Found HS Tag
ProcessMsg!
then clear it here
24/5/2019 8:20:14 Server Sent 5
24/5/2019 8:20:14 Enhanced QU : QUM :
24/5/2019 8:20:14 Enhanced QU : QUC :
24/5/2019 8:20:14 Enhanced QU : QUD :
24/5/2019 8:20:14 Server Sent 6
24/5/2019 8:20:14 LOOKING FOR &04
24/5/2019 8:20:14 FUR :After S&P done
GetServerAddress
securePort: 443
24/5/2019 9:21:22 GetIP :: *** PPP
-1879041014
24/5/2019 9:21:22 ip RETRIVED #�,
10.20.15.151, SecurePort: 443
24/5/2019 9:21:22 SETTING REG TO VALUE #�,
reported: 28
24/5/2019 9:21:22 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 9:21:22 Pipe not found
24/5/2019 9:21:22 The count is 7
24/5/2019 9:21:22 bSet is 1
securePort: 443
24/5/2019 9:21:23 WDAVersion = 12.1.1.25
24/5/2019 9:21:23 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 9:21:24 -1|VI=1|
24/5/2019 9:21:24 Found HS Tag
ProcessMsg!
then clear it here
24/5/2019 9:21:24 Server Sent 5
24/5/2019 9:21:24 Enhanced QU : QUM :
24/5/2019 9:21:24 Enhanced QU : QUC :
24/5/2019 9:21:24 Enhanced QU : QUD :
24/5/2019 9:21:24 Server Sent 6
24/5/2019 9:21:24 LOOKING FOR &04
GetServerAddress
securePort: 443
24/5/2019 10:23:39 GetIP :: *** PPP
IN_ADDR : -1879041014
24/5/2019 10:23:39 ip RETRIVED а,
10.20.15.151, SecurePort: 443
24/5/2019 10:23:40 SETTING REG TO VALUE а,
reported: 28
24/5/2019 10:23:40 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 10:23:40 Pipe not found
24/5/2019 10:23:40 The count is 7
24/5/2019 10:23:40 bCheckServer is 1
24/5/2019 10:23:40 bSet is 1
securePort: 443
24/5/2019 10:23:40 WDAVersion = 12.1.1.25
24/5/2019 10:23:41 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 10:23:41 -1|VI=1|
24/5/2019 10:23:41 Found HS Tag
ProcessMsg!
24/5/2019 10:23:41 Server Sent 5
24/5/2019 10:23:41 Enhanced QU : QUM :
24/5/2019 10:23:41 Enhanced QU : QUC :
24/5/2019 10:23:41 Enhanced QU : QUD :
24/5/2019 10:23:41 Server Sent 6
24/5/2019 10:23:41 LOOKING FOR &04
GetServerAddress
securePort: 443
24/5/2019 11:26:19 GetIP :: *** PPP
IN_ADDR : -1879041014
24/5/2019 11:26:19 ip RETRIVED ��,
10.20.15.151, SecurePort: 443
24/5/2019 11:26:19 SETTING REG TO VALUE ��,
reported: 28
24/5/2019 11:26:19 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 11:26:19 Pipe not found
24/5/2019 11:26:19 The count is 7
24/5/2019 11:26:19 bCheckServer is 1
24/5/2019 11:26:19 bSet is 1
securePort: 443
24/5/2019 11:26:19 WDAVersion = 12.1.1.25
24/5/2019 11:26:20 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 11:26:20 1|VI=1|
24/5/2019 11:26:20 Found HS Tag
ProcessMsg!
24/5/2019 11:26:20 Server Sent 5
24/5/2019 11:26:20 Enhanced QU : QUM :
24/5/2019 11:26:20 Enhanced QU : QUC :
24/5/2019 11:26:20 Enhanced QU : QUD :
24/5/2019 11:26:20 Server Sent 6
24/5/2019 11:26:20 LOOKING FOR &04
24/5/2019 12:17:56 Received data:
Accept: */*
24/5/2019 12:17:56 jects/mechanize/)
Connection: close
24/5/2019 12:17:56 =0.7,*;q=0.7
Accept: */*
Connection: close
24/5/2019 12:17:56 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
24/5/2019 12:17:57 GetIP :: *** PPP
IN_ADDR : -1879041014
24/5/2019 12:17:57 ip RETRIVED #�,
10.20.15.151, SecurePort: 443
reported: 28
24/5/2019 12:17:57 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 12:17:57 Pipe not found
24/5/2019 12:17:57 The count is 7
24/5/2019 12:17:57 bCheckServer is 1
24/5/2019 12:17:57 bSet is 1
securePort: 443
24/5/2019 12:17:57 Calling V01
24/5/2019 12:17:57 Merlin version 354
24/5/2019 12:17:57 Signature 354
24/5/2019 12:17:57 Wyse Flag value 0011
24/5/2019 12:17:58 The iBLP value -1
24/5/2019 12:17:59 TZ Queried
Number
24/5/2019 12:17:59 FUR : GetCI() 1
24/5/2019 12:17:59 IP matched!
24/5/2019 12:17:59 Subnet `�&
24/5/2019 12:17:59 Gateway ��&
24/5/2019 12:17:59 DS ��&
83FF-9A7F0B2B2
24/5/2019 12:17:59 E1E}
24/5/2019 12:17:59 Got reply from AgentUI=@�.
24/5/2019 12:17:59 add only adapter.
24/5/2019 12:17:59 Disk offset 659554304
24/5/2019 12:17:59 Disk 0 Part 1 TYPE 260

24/5/2019 12:17:59 Disk 0 Part 5 TYPE 261

24/5/2019 12:17:59 Secure boot = 1

24/5/2019 12:17:59 tempbuff = |WIN0=Preguntas frecuentes | Universidad Distrital
Francisco Jos� de Caldas - Google Chrome|WIN1=Disco extra�ble (D:)
24/5/2019 12:17:59 |WIN2=Program Manager|, num=0
24/5/2019 12:17:59 Msg recd from AgentGUI:|WIN0=Preguntas frecuentes |
Universidad Distrital Francisco Jos� de Caldas - Google Chrome|WIN1=Disco ex
24/5/2019 12:17:59 tra�ble (D:)|WIN2=Program Manager|
24/5/2019 12:17:59 Got reply from AgentUI=PZ1
24/5/2019 12:18:6 size of qfe list 64
24/5/2019 12:18:7 Value found for LocalXMLPath = �(-
24/5/2019 12:18:7 WDAVersion = 12.1.1.25
24/5/2019 12:18:7 GetCI() done
24/5/2019 12:18:7 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
24/5/2019 12:18:7 |TFB1=2349461504|DRV2=Z:|TB2=1073643520|TFB2=1069580288||
24/5/2019 12:18:7 |PRC12=svchost.exe|PRC13=dwm.exe|PRC14=svchost.exe|
PRC15=svchost.exe|PRC16=atieclxx.exe|PRC17=DtcPlatformSvc.exe|PRC18=Explorer.
24/5/2019 12:18:7 EXE|PRC19=spoolsv.exe|PRC20=svchost.exe|PRC21=taskhostex.exe|
PRC22=svchost.exe|PRC23=svchost.exe|PRC24=mqsvc.exe|PRC25=NetXClean
24/5/2019 12:18:7 .exe|PRC26=pnusbvirtualhubwssrv.exe|PRC27=tcpsvcs.exe|
PRC35=vmware-usbarbitrator64.exe|PRC36=vmware-view-usbd.exe|PRC37=svchost.e
24/5/2019 12:18:7 xe|PRC38=wmiprvse.exe|PRC39=SearchIndexer.exe|
PRC40=DtcWdaUi.exe|PRC41=hagent.exe|PRC42=HAgent_UI.exe|PRC43=tvnserver.exe|PRC44=
24/5/2019 12:18:7 RAVCpl64.exe|PRC45=concentr.exe|PRC46=redirector.exe|
PRC47=PNUSBCLITRAY.exe|PRC48=PNTray.exe|PRC49=Receiver.exe|PRC50=SelfServic
24/5/2019 12:18:7 ePlugin.exe|PRC51=wfcrun32.exe|PRC52=CcmExec.exe|
PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|PRC55=chrome.exe|PRC56=chrome.exe|PRC57=c
PRC61=chrome.exe|PRC62=chrome.exe|PRC63=chrome.exe|PRC64=wmiprvse.e
24/5/2019 12:18:7 xe|PRC65=chrome.exe|PRC66=chrome.exe|PRC67=chrome.exe|
PRC68=chrome.exe|PRC69=chrome.exe|PRC70=chrome.exe|PRC71=chrome.exe|PRC72=
24/5/2019 12:18:7 chrome.exe||WIN0=Preguntasüfrecuentesü|
üUniversidadüDistritalüFranciscoüJos�üdeüCaldasü-üGoogleüChrome|WIN1=Discoüex
24/5/2019 12:18:7 tra�bleü(D:)|WIN2=ProgramüManager||PMIU=48|TBPM=7786256|
24/5/2019 12:18:7 |FKEM=0|CPRMS0=85,34,34|NIC0IP=10.28.0.144|
NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|RE
24/5/2019 12:18:7 CP0=260427|SENDP0=115465|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|
24/5/2019 12:18:7 C=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC
24/5/2019 12:18:7
KB2781197,KB2785094,KB2785220,KB2789649,KB278
24/5/2019 12:18:7
2,KB2798802,KB2798804,KB2798805,KB2799494,KB2
24/5/2019 12:18:7
289,KB2811660,KB2812822,KB2813170,KB2813430,K
24/5/2019 12:18:7
29530,KB2830290,KB2832450,KB2836946,KB2836947
24/5/2019 12:18:7 ,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
24/5/2019 12:18:7
24/5/2019 12:18:7 Word|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|
24/5/2019 12:18:7 Found HS Tag
ProcessMsg!
then clear it here
24/5/2019 12:18:7 Server Sent 5
24/5/2019 12:18:7 Enhanced QU : QUM :
24/5/2019 12:18:7 Enhanced QU : QUC :
24/5/2019 12:18:7 Enhanced QU : QUD :
24/5/2019 12:18:7 Server Sent 6
24/5/2019 12:18:7 LOOKING FOR &04
24/5/2019 12:18:7 FUR :After S&P done
GetServerAddress
securePort: 443
24/5/2019 13:21:11 GetIP :: *** PPP
IN_ADDR : -1879041014
24/5/2019 13:21:11 ip RETRIVED
10.20.15.151, SecurePort: 443
reported: 28
24/5/2019 13:21:11 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 13:21:11 Pipe not found
24/5/2019 13:21:11 The count is 7
24/5/2019 13:21:11 bCheckServer is 1
24/5/2019 13:21:11 bSet is 1
securePort: 443
24/5/2019 13:21:11 WDAVersion = 12.1.1.25
24/5/2019 13:21:12 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 13:21:12 1|VI=1|
24/5/2019 13:21:12 Found HS Tag
ProcessMsg!
24/5/2019 13:21:12 Server Sent 5
24/5/2019 13:21:12 Enhanced QU : QUM :
24/5/2019 13:21:12 Enhanced QU : QUC :
24/5/2019 13:21:12 Enhanced QU : QUD :
24/5/2019 13:21:12 Server Sent 6
24/5/2019 13:21:12 LOOKING FOR &04
GetServerAddress
securePort: 443
24/5/2019 14:24:28 GetIP :: *** PPP
IN_ADDR : -1879041014
24/5/2019 14:24:28 ip RETRIVED ��,
10.20.15.151, SecurePort: 443
24/5/2019 14:24:28 SETTING REG TO VALUE ��,
reported: 28
24/5/2019 14:24:28 C80B-4C42-8011-32B62020ACA3}, Type=6
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 14:24:28 Pipe not found
24/5/2019 14:24:28 The count is 7
24/5/2019 14:24:28 bCheckServer is 1
24/5/2019 14:24:28 bSet is 1
securePort: 443
24/5/2019 14:24:28 WDAVersion = 12.1.1.25
24/5/2019 14:24:29 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 14:24:29 1|VI=1|
24/5/2019 14:24:29 Found HS Tag
ProcessMsg!
24/5/2019 14:24:29 Server Sent 5
24/5/2019 14:24:29 Enhanced QU : QUM :
24/5/2019 14:24:29 Enhanced QU : QUC :
24/5/2019 14:24:29 Enhanced QU : QUD :
24/5/2019 14:24:29 Server Sent 6
24/5/2019 14:24:29 LOOKING FOR &04
GetServerAddress
securePort: 443
24/5/2019 14:26:10 GetIP :: *** PPP
IN_ADDR : -1879041014
24/5/2019 14:26:10 ip RETRIVED P�,
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
24/5/2019 14:26:15 C80B-4C42-8011-32B62020ACA3}, Type=6
24/5/2019 14:26:15 476A-8590-E6333C53F805}, Type=71
24/5/2019 14:26:15 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
24/5/2019 14:26:15 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
24/5/2019 14:26:16 ip RETRIVED P�,
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
24/5/2019 14:26:21 C80B-4C42-8011-32B62020ACA3}, Type=6
24/5/2019 14:26:21 476A-8590-E6333C53F805}, Type=71
24/5/2019 14:26:21 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
24/5/2019 14:59:19 GetIP -- IP String is 10.28.122.86 Proper address for IN_ADDR
: 1450843146
24/5/2019 14:59:19 ip RETRIVED #�,
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
24/5/2019 14:59:25 C80B-4C42-8011-32B62020ACA3}, Type=6
Description=Intel(R) Dual Band Wireless-AC 7260, AdapterName={51276593-
24/5/2019 14:59:25 95B4-476A-8590-E6333C53F805}, Type=71
24/5/2019 14:59:30 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
24/5/2019 14:59:31 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
: 1450843146
24/5/2019 14:59:31 ip RETRIVED P�,
10.20.15.151, SecurePort: 443
24/5/2019 14:59:35 SETTING REG TO VALUE P�,
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 14:59:35 Pipe not found
24/5/2019 14:59:35 The count is 7
24/5/2019 14:59:35 bCheckServer is 1
24/5/2019 14:59:35 bSet is 1
securePort: 443
24/5/2019 14:59:35 Calling V01
24/5/2019 14:59:35 Merlin version 354
24/5/2019 14:59:35 Signature 354
24/5/2019 14:59:35 Wyse Flag value 0011
24/5/2019 14:59:36 The iBLP value -1
24/5/2019 14:59:37 TZ Queried
Number
24/5/2019 14:59:37 FUR : GetCI() 1
24/5/2019 14:59:37 IP matched!
24/5/2019 14:59:37 Subnet `�&
24/5/2019 14:59:37 Gateway ��&
24/5/2019 14:59:37 DS ��&
SYSTEM\CurrentControlSet\Services\TcpIP\Parameters\Interfaces\{51276593-95B4-476A-
8590-E6333C53F
24/5/2019 14:59:37 805}
24/5/2019 14:59:37 Got reply from AgentUI=@�.
24/5/2019 14:59:37 add only adapter.
24/5/2019 14:59:37 GetDisplayInfo() return=pz1
24/5/2019 14:59:37 Disk offset 659554304
24/5/2019 14:59:37 Disk 0 Part 1 TYPE 260

24/5/2019 14:59:37 Disk 0 Part 5 TYPE 261

24/5/2019 14:59:37 Secure boot = 1

24/5/2019 14:59:37 tempbuff = |WIN0=Chrome no est� actualizado|WIN1=Sitio Web
BIBLIOTECA UD - Portal Web Sistema de Bibliotecas - Google Chrome|WIN
24/5/2019 14:59:37 2=Documento1 - Word|WIN3=Program Manager|, num=0
24/5/2019 14:59:37 Msg recd from AgentGUI:|WIN0=Chrome no est� actualizado|
WIN1=Sitio Web BIBLIOTECA UD - Portal Web Sistema de Bibliotecas - Googl
24/5/2019 14:59:37 e Chrome|WIN2=Documento1 - Word|WIN3=Program Manager|
24/5/2019 14:59:37 Got reply from AgentUI=`j1
24/5/2019 14:59:44 size of qfe list 64
24/5/2019 14:59:44 WDAVersion = 12.1.1.25
24/5/2019 14:59:44 GetCI() done
24/5/2019 14:59:44 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
BUIX=0|CN=WES008064FB707A|IP=10.28.122.86|ED=1|DS=10.28.24.2|GW=10.28.64
24/5/2019 14:59:44 .1|SM=255.255.192.0|SN=10.28.127.255|DM=udistrital.edu.co|
0D=1|1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es09
24/5/2019 14:59:44 07.30GB|RM=7973126|CP=AuthenticAMDüAMDüGX-
415GAüSOCüwithüRadeon(tm)üHDüGraphicsüüü|CPS=1497|B1=1.0F|PD2=AMDüRadeon(TM
24/5/2019 14:59:44 )üHDü8330E.|PD1=AMDüHighüDefinitionüAudioüDevice|CO=|LO=|
OSDSK=0||Disk0=0|DiskSize0=32012789760|D0PAR1SZ=104857600|D0PAR1S
24/5/2019 14:59:44 TOFF=1048576|D0PAR1TYPE=260|D0PARBOOT=5|D0PAR2SZ=314572800|
D0PAR2STOFF=105906176|D0PAR2TYPE=257|D0PARBOOT=5|D0PAR3SZ=104857600|D
24/5/2019 14:59:44 0PAR3STOFF=420478976|D0PAR3TYPE=258|D0PARBOOT=5|
D0PAR4SZ=134217728|D0PAR4STOFF=525336576|D0PAR4TYPE=259|D0PARBOOT=5|D0PAR5SZ=307
24/5/2019 14:59:44 3520|TFB1=1068498944||PRC0=smss.exe|PRC1=csrss.exe|
PRC2=wininit.exe|PRC3=csrss.exe|PRC4=services.exe|PRC5=winlogon.exe|PRC6=lsas
24/5/2019 14:59:44 s.exe|PRC7=svchost.exe|PRC8=svchost.exe|PRC9=atiesrxx.exe|
PRC10=svchost.exe|PRC11=svchost.exe|PRC12=svchost.exe|PRC13=dwm.exe|PR
24/5/2019 14:59:44 C14=svchost.exe|PRC15=svchost.exe|PRC16=atieclxx.exe|
PRC17=DtcPlatformSvc.exe|PRC18=Explorer.EXE|PRC19=spoolsv.exe|PRC20=svchost
24/5/2019 14:59:44 .exe|PRC21=taskhostex.exe|PRC22=svchost.exe|
PRC23=svchost.exe|PRC24=mqsvc.exe|PRC25=NetXClean.exe|
PRC26=pnusbvirtualhubwssrv.exe
24/5/2019 14:59:44 |PRC27=tcpsvcs.exe|PRC28=snmp.exe|PRC29=tvnserver.exe|
PRC30=UWFSvc.exe|PRC31=MsMpEng.exe|PRC32=wsnm.exe|PRC33=DtcWDAService.exe|
24/5/2019 14:59:44 PRC34=mqtgsvc.exe|PRC35=vmware-usbarbitrator64.exe|
PRC36=vmware-view-usbd.exe|PRC37=svchost.exe|PRC38=wmiprvse.exe|PRC39=SearchI
24/5/2019 14:59:44 ndexer.exe|PRC40=DtcWdaUi.exe|PRC41=hagent.exe|
PRC42=HAgent_UI.exe|PRC43=tvnserver.exe|PRC44=RAVCpl64.exe|PRC45=concentr.exe|PRC
24/5/2019 14:59:44 46=redirector.exe|PRC47=PNUSBCLITRAY.exe|PRC48=PNTray.exe|
PRC49=Receiver.exe|PRC50=SelfServicePlugin.exe|PRC51=wfcrun32.exe|PRC5
24/5/2019 14:59:44 2=CcmExec.exe|PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|
PRC55=WINWORD.EXE|PRC56=wmiprvse.exe|PRC57=chrome.exe|PRC58=chrome.exe|PRC59
24/5/2019 14:59:44 =chrome.exe|PRC60=chrome.exe|PRC61=chrome.exe|
PRC62=chrome.exe|PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe||WIN0=Chromeü
24/5/2019 14:59:44 noüest�üactualizado|WIN1=SitioüWebüBIBLIOTECAüUDü-
üPortalüWebüSistemaüdeüBibliotecasü-üGoogleüChrome|WIN2=Document
24/5/2019 14:59:44 o1ü-üWord|WIN3=ProgramüManager||PMIU=42|TBPM=7786256|
FBPM=4472620|TBPF=7786256|FBPF=4352880|TBVM=8589934464|FKVM=8589864352|F
24/5/2019 14:59:44 KEM=0|CPRMS0=131,46,46|NIC0IP=0.0.0.0|
RECP0=2
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421C
24/5/2019 14:59:44 ED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=10.28.122.86|
24/5/2019 14:59:44 421CED66F6|RECP2=400|SENDP2=308|MIBSP2=24üMbps|
24/5/2019 14:59:44
1,KB2781197,KB2785094,KB2785220,KB2789649,KB2
24/5/2019 14:59:44
162,KB2798802,KB2798804,KB2798805,KB2799494,K
24/5/2019 14:59:44
09289,KB2811660,KB2812822,KB2813170,KB2813430
24/5/2019 14:59:44
2829530,KB2830290,KB2832450,KB2836946,KB28369
24/5/2019 14:59:44 47,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefo
24/5/2019 14:59:44 xü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLync�
24/5/2019 14:59:44 �Vdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\
24/5/2019 14:59:44 MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|AP6=
24/5/2019 14:59:44 MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
24/5/2019 14:59:44 5.1.20125.0|AP8=MicrosoftüVisualüC+
C:\ProgramüFiles\Wyse\W
24/5/2019 14:59:44 DA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome
24/5/2019 14:59:44 |C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|
68.0.3440.106|AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15
24/5/2019 14:59:44 \EXCEL.EXE|15.0.4420.1017|AP13=File-
AP14=Diagnosticsüut
24/5/2019 14:59:44 ilityüforüInternetüExplorer|
AP15=OfficeüXMLüHandler|C:\P
24/5/2019 14:59:44
rogramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS
24/5/2019 14:59:44 ~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=UnifiedüWriteüFilt
24/5/2019 14:59:44 erüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2
24/5/2019 14:59:44 .9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=Microsoft
24/5/2019 14:59:44 üWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|
24/5/2019 14:59:44 Found HS Tag
ProcessMsg!
24/5/2019 14:59:45 Server Sent 5
24/5/2019 14:59:45 Enhanced QU : QUM :
24/5/2019 14:59:45 Enhanced QU : QUC :
24/5/2019 14:59:45 Enhanced QU : QUD :
24/5/2019 14:59:45 Server Sent 6
24/5/2019 14:59:45 LOOKING FOR &04
24/5/2019 14:59:45 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : 1450843146
24/5/2019 16:0:37 ip RETRIVED #�,
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 16:0:37 Pipe not found
24/5/2019 16:0:37 The count is 7
24/5/2019 16:0:37 bSet is 1
securePort: 443
24/5/2019 16:0:37 Calling V01
24/5/2019 16:0:38 Merlin version 354
24/5/2019 16:0:38 Signature 354
24/5/2019 16:0:38 Wyse Flag value 0011
24/5/2019 16:0:39 The iBLP value -1
24/5/2019 16:0:39 TZ Queried
Number
24/5/2019 16:0:39 FUR : GetCI() 1
24/5/2019 16:0:39 IP matched!
24/5/2019 16:0:39 Subnet `�&
24/5/2019 16:0:39 Gateway ��&
24/5/2019 16:0:39 DS ��&
SYSTEM\CurrentControlSet\Services\TcpIP\Parameters\Interfaces\{51276593-95B4-476A-
8590-E6333C53F
24/5/2019 16:0:39 805}
24/5/2019 16:0:39 Got reply from AgentUI=@x.
24/5/2019 16:0:39 Disk offset 659554304
24/5/2019 16:0:40 Disk 0 Part 1 TYPE 260

24/5/2019 16:0:40 Disk 0 Part 5 TYPE 261

24/5/2019 16:0:40 Secure boot = 1

24/5/2019 16:0:40 return from ListAllApps=PZ1
24/5/2019 16:0:45 size of qfe list 64
24/5/2019 16:0:45 WDAVersion = 12.1.1.25
24/5/2019 16:0:45 GetCI() done
24/5/2019 16:0:45 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
BUIX=0|CN=WES008064FB707A|IP=10.28.122.86|ED=1|DS=10.28.24.2|GW=10.28.64
24/5/2019 16:0:45 .1|SM=255.255.192.0|SN=10.28.127.255|DM=udistrital.edu.co|
0D=1|1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es09
24/5/2019 16:0:45 07.30GB|RM=7973126|CP=AuthenticAMDüAMDüGX-
415GAüSOCüwithüRadeon(tm)üHDüGraphicsüüü|CPS=1497|B1=1.0F|PD2=AMDüRadeon(TM
24/5/2019 16:0:45 )üHDü8330E.|PD1=AMDüHighüDefinitionüAudioüDevice|CO=|LO=|
OSDSK=0||Disk0=0|DiskSize0=32012789760|D0PAR1SZ=104857600|D0PAR1S
24/5/2019 16:0:45 TOFF=1048576|D0PAR1TYPE=260|D0PARBOOT=5|D0PAR2SZ=314572800|
D0PAR2STOFF=105906176|D0PAR2TYPE=257|D0PARBOOT=5|D0PAR3SZ=104857600|D
24/5/2019 16:0:45 0PAR3STOFF=420478976|D0PAR3TYPE=258|D0PARBOOT=5|
D0PAR4SZ=134217728|D0PAR4STOFF=525336576|D0PAR4TYPE=259|D0PARBOOT=5|D0PAR5SZ=307
24/5/2019 16:0:45 3520|TFB1=1068105728||PRC0=smss.exe|PRC1=csrss.exe|
PRC2=wininit.exe|PRC3=csrss.exe|PRC4=services.exe|PRC5=winlogon.exe|PRC6=lsas
24/5/2019 16:0:45 s.exe|PRC7=svchost.exe|PRC8=svchost.exe|PRC9=atiesrxx.exe|
PRC10=svchost.exe|PRC11=svchost.exe|PRC12=svchost.exe|PRC13=dwm.exe|PR
24/5/2019 16:0:45 C14=svchost.exe|PRC15=svchost.exe|PRC16=atieclxx.exe|
PRC17=DtcPlatformSvc.exe|PRC18=Explorer.EXE|PRC19=spoolsv.exe|PRC20=svchost
24/5/2019 16:0:45 .exe|PRC21=taskhostex.exe|PRC22=svchost.exe|PRC23=svchost.exe|
PRC24=mqsvc.exe|PRC25=NetXClean.exe|PRC26=pnusbvirtualhubwssrv.exe
24/5/2019 16:0:45 |PRC27=tcpsvcs.exe|PRC28=snmp.exe|PRC29=tvnserver.exe|
PRC30=UWFSvc.exe|PRC31=MsMpEng.exe|PRC32=wsnm.exe|PRC33=DtcWDAService.exe|
24/5/2019 16:0:45 PRC34=mqtgsvc.exe|PRC35=vmware-usbarbitrator64.exe|
PRC36=vmware-view-usbd.exe|PRC37=svchost.exe|PRC38=wmiprvse.exe|PRC39=SearchI
24/5/2019 16:0:45 ndexer.exe|PRC40=DtcWdaUi.exe|PRC41=hagent.exe|
PRC42=HAgent_UI.exe|PRC43=tvnserver.exe|PRC44=RAVCpl64.exe|PRC45=concentr.exe|PRC
24/5/2019 16:0:45 46=redirector.exe|PRC47=PNUSBCLITRAY.exe|PRC48=PNTray.exe|
PRC49=Receiver.exe|PRC50=SelfServicePlugin.exe|PRC51=wfcrun32.exe|PRC5
24/5/2019 16:0:45 2=CcmExec.exe|PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|
PRC55=wmiprvse.exe||WIN0=ProgramüManager||PMIU=38|TBPM=7786256|FBPM=4783048
24/5/2019 16:0:45 |TBPF=7786256|FBPF=4721252|TBVM=8589934464|FKVM=8589865384|
FKEM=0|CPRMS0=131,0,46|NIC0IP=0.0.0.0|NIC0DESC=Ethernet,InventecüPCI
24/5/2019 16:0:45 eüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|RECP0=267155|
24/5/2019 16:0:45 BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|
RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=10.28.122.86|NIC2DESC=
24/5/2019 16:0:45 Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
NIC2MAC=F0421CED66F6|RECP2=103202|SENDP2=44621|MIBSP2=58üMbps|QFEL=KB2727528,K
24/5/2019 16:0:45
70917,KB2777294,KB2778344,KB2778930,KB2779562
24/5/2019 16:0:45
2790907,KB2792100,KB2793210,KB2794119,KB27945
24/5/2019 16:0:45
KB2804584,KB2805222,KB2805227,KB2807986,KB280
24/5/2019 16:0:45
4,KB2820330,KB2821895,KB2822241,KB2829069,KB2
24/5/2019 16:0:45
727,KB2839894,KB2845533,KB2845690,|AP0=7-Zip�
24/5/2019 16:0:45 �18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.
24/5/2019 16:0:45 2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP
24/5/2019 16:0:45 4=MicrosoftüOfficeüProfessionalüPlusü2013|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=M
24/5/2019 16:0:45 icrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü(
24/5/2019 16:0:45 x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\ProgramüFil
24/5/2019 16:0:45 es\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|6
24/5/2019 16:0:45 8.0.3440.106|AP12=MicrosoftüExcel|
basedüwriteüfilterümanage
24/5/2019 16:0:45 r|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\InternetüExplo
24/5/2019 16:0:45 rer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.
24/5/2019 16:0:45 EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|C:\Program
24/5/2019 16:0:45 üFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP
24/5/2019 16:0:45 19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\Progr
24/5/2019 16:0:45 amüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|
24/5/2019 16:0:45 WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
24/5/2019 16:0:45 Found HS Tag
ProcessMsg!
then clear it here
24/5/2019 16:0:45 Server Sent 5
24/5/2019 16:0:45 Enhanced QU : QUM :
24/5/2019 16:0:45 Enhanced QU : QUC :
24/5/2019 16:0:45 Enhanced QU : QUD :
24/5/2019 16:0:46 Server Sent 6
24/5/2019 16:0:46 LOOKING FOR &04
24/5/2019 16:0:46 FUR :After S&P done
GetServerAddress
443
HuntForAltLocalIP
1450843146
24/5/2019 17:4:1 ip RETRIVED P�,
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 17:4:2 Pipe not found
24/5/2019 17:4:2 The count is 7
24/5/2019 17:4:2 bSet is 1
securePort: 443
24/5/2019 17:4:2 Value found for LocalXMLPath = �E,
24/5/2019 17:4:2 WDAVersion = 12.1.1.25
24/5/2019 17:4:3 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 17:4:3 -1|VI=1|
24/5/2019 17:4:3 Found HS Tag
then clear it here
24/5/2019 17:4:3 Server Sent 5
24/5/2019 17:4:3 Enhanced QU : QUM :
24/5/2019 17:4:3 Enhanced QU : QUC :
24/5/2019 17:4:3 Enhanced QU : QUD :
24/5/2019 17:4:3 Server Sent 6
24/5/2019 17:4:3 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : 1450843146
24/5/2019 18:7:20 ip RETRIVED P�,
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 18:7:20 Pipe not found
24/5/2019 18:7:20 The count is 7
24/5/2019 18:7:20 bSet is 1
securePort: 443
24/5/2019 18:7:20 Value found for LocalXMLPath = �E,
24/5/2019 18:7:20 WDAVersion = 12.1.1.25
24/5/2019 18:7:20 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
24/5/2019 18:7:21 -1|VI=1|
24/5/2019 18:7:21 Found HS Tag
ProcessMsg!
then clear it here
24/5/2019 18:7:21 Server Sent 5
24/5/2019 18:7:21 Enhanced QU : QUM :
24/5/2019 18:7:21 Enhanced QU : QUC :
24/5/2019 18:7:21 Enhanced QU : QUD :
24/5/2019 18:7:21 Server Sent 6
24/5/2019 18:7:21 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
: 1450843146
24/5/2019 19:10:38 ip RETRIVED P�,
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
24/5/2019 19:10:43 C80B-4C42-8011-32B62020ACA3}, Type=6
24/5/2019 19:10:44 95B4-476A-8590-E6333C53F805}, Type=71
24/5/2019 19:10:49 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
24/5/2019 19:10:49 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
: 1450843146
24/5/2019 19:10:49 ip RETRIVED а,
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
24/5/2019 19:10:55 C80B-4C42-8011-32B62020ACA3}, Type=6
24/5/2019 19:10:55 95B4-476A-8590-E6333C53F805}, Type=71
24/5/2019 19:11:0 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
27/5/2019 7:34:38 ***********************************************************
27/5/2019 7:34:38 End of WinMain()
27/5/2019 7:34:38 ^^^^^^^^ after reghanex()
27/5/2019 7:34:58 OS Version 6.2.9200
27/5/2019 7:34:58 OS Version 6.2.9200
27/5/2019 7:34:58 Major version 6
27/5/2019 7:34:58 Minor version 2
27/5/2019 7:34:58 Device Info: OS is ��"
27/5/2019 7:34:58 WRITE FILTER UWF 1
27/5/2019 7:34:58 Setting UWF Mgr!
27/5/2019 7:34:59 Disk offset 659554304
27/5/2019 7:34:59 Disk offset =1048576

27/5/2019 7:34:59 Disk offset =105906176
27/5/2019 7:34:59 Disk offset =420478976
27/5/2019 7:34:59 Disk offset =525336576
27/5/2019 7:34:59 Disk offset =659554304

'Z:\',error=1
27/5/2019 7:34:59 AF_INET (IPv4)

27/5/2019 7:34:59 IPv4 address 169.254.150.182
27/5/2019 7:34:59 Valid IP Found

27/5/2019 7:34:59 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
27/5/2019 7:34:59 HA Supported
27/5/2019 7:34:59 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -1231618391
27/5/2019 7:34:59 ip RETRIVED �@
10.20.15.151, SecurePort: 443
Port: 0
27/5/2019 7:35:4 Failed to Bind
ms
reported: 28
27/5/2019 7:35:5 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 7:35:5 476A-8590-E6333C53F805}, Type=71
27/5/2019 7:35:6 ConfirmAndSetConnection :: Setting the checkin event!
secure port 443
27/5/2019 7:35:7 Pipe not found
27/5/2019 7:35:7 The count is 7
27/5/2019 7:35:7 bSet is 1
securePort: 443
27/5/2019 7:35:7 Calling V01
27/5/2019 7:35:7 Merlin version 354
27/5/2019 7:35:7 Signature 354
27/5/2019 7:35:8 Wyse Flag value 0011
27/5/2019 7:35:9 The iBLP value -1
27/5/2019 7:35:9 TZ Queried
27/5/2019 7:35:9 FUR : GetCI() 1
27/5/2019 7:35:9 IP matched!
27/5/2019 7:35:9 Subnet ��
27/5/2019 7:35:9 Gateway д
27/5/2019 7:35:9 DS �
27/5/2019 7:35:9 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=@M&
27/5/2019 7:35:9 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=@M&
27/5/2019 7:35:9 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=@M&
83FF-9A7F0B2B2
27/5/2019 7:35:9 E1E}
27/5/2019 7:35:10 Got reply from AgentUI=�b$
27/5/2019 7:35:10 GetDisplayInfo() return=P�
27/5/2019 7:35:10 Disk offset 659554304
27/5/2019 7:35:10 Disk 0 Part 1 TYPE 260

27/5/2019 7:35:10 Disk 0 Part 5 TYPE 261

27/5/2019 7:35:10 Secure boot = 1

27/5/2019 7:35:10 tempbuff = |, num=0
27/5/2019 7:35:10 Got reply from AgentUI=#;"
27/5/2019 7:35:10 return from ListAllApps=Ò'
27/5/2019 7:35:17 size of qfe list 64
27/5/2019 7:35:17 Value found for LocalXMLPath = �'
27/5/2019 7:35:17 WDAVersion = 12.1.1.25
27/5/2019 7:35:17 GetCI() done
'Z:\',error=1
securePort: 443
27/5/2019 7:35:17 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC43=msiexec.exe|PRC44=svchost.exe|PRC45=SearchFilterHost.exe|PRC46
PRC56=SelfServicePlugin.exe|PRC57=wfcrun32.exe|||PMIU=33|TBPM=77862
27/5/2019 7:35:17 56|FBPM=5156228|TBPF=7786256|FBPF=5098440|TBVM=8589934464|
FKVM=8589864352|FKEM=0|CPRMS0=0,0,0|NIC0IP=10.28.0.130|NIC0DESC=Ethern
27/5/2019 7:35:17 et,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=1780|SENDP0=706|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1
27/5/2019 7:35:17 DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
27/5/2019 7:35:17 NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,KB
27/5/2019 7:35:17
0917,KB2777294,KB2778344,KB2778930,KB2779562,
27/5/2019 7:35:17
790907,KB2792100,KB2793210,KB2794119,KB279459
27/5/2019 7:35:17
B2804584,KB2805222,KB2805227,KB2807986,KB2808
27/5/2019 7:35:17
,KB2820330,KB2821895,KB2822241,KB2829069,KB28
27/5/2019 7:35:17
27,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü
27/5/2019 7:35:17 18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2
27/5/2019 7:35:17 |AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4
27/5/2019 7:35:17 =MicrosoftüOfficeüProfessionalüPlusü2013|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=Mi
27/5/2019 7:35:17 crosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x
27/5/2019 7:35:17 64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFile
27/5/2019 7:35:17 s\VMware\VMwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68
27/5/2019 7:35:17 .0.3440.106|AP12=MicrosoftüExcel|
basedüwriteüfilterümanager
27/5/2019 7:35:17 |C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\InternetüExplor
27/5/2019 7:35:17 er\IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.E
27/5/2019 7:35:17 XE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|C:\Program�
27/5/2019 7:35:17 �Files\TightVNC\tvnserver.exe|2.6.4.0|
AP1
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\Progra
27/5/2019 7:35:17 müFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|W
27/5/2019 7:35:17 CM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
27/5/2019 7:35:18 Found HS Tag
ProcessMsg!
then clear it here
27/5/2019 7:35:18 Server Sent 5
27/5/2019 7:35:18 Enhanced QU : QUM :
27/5/2019 7:35:18 Enhanced QU : QUC :
27/5/2019 7:35:18 Enhanced QU : QUD :
27/5/2019 7:35:18 Server Sent 6
27/5/2019 7:35:18 LOOKING FOR &04
27/5/2019 7:35:18 FUR :After S&P done
GetServerAddress
securePort: 443
27/5/2019 7:35:18 GetIP :: *** PPP
-2113922038
27/5/2019 7:35:18 ip RETRIVED #&
10.20.15.151, SecurePort: 443
27/5/2019 7:35:18 SETTING REG TO VALUE #&
reported: 28
27/5/2019 7:35:18 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 7:35:18 Pipe not found
27/5/2019 7:35:18 The count is 7
27/5/2019 7:35:18 bSet is 1
securePort: 443
27/5/2019 7:35:19 Calling V01
27/5/2019 7:35:19 Merlin version 354
27/5/2019 7:35:19 Signature 354
27/5/2019 7:35:19 Wyse Flag value 0011
27/5/2019 7:35:19 The iBLP value -1
27/5/2019 7:35:20 TZ Queried
Number
27/5/2019 7:35:20 FUR : GetCI() 1
27/5/2019 7:35:20 IP matched!
27/5/2019 7:35:20 Subnet ��
27/5/2019 7:35:20 Gateway д
27/5/2019 7:35:20 DS �
27/5/2019 7:35:20 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�J&
27/5/2019 7:35:20 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�J&
27/5/2019 7:35:20 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�J&
83FF-9A7F0B2B2
27/5/2019 7:35:20 E1E}
27/5/2019 7:35:20 Got reply from AgentUI=��#
27/5/2019 7:35:20 GetDisplayInfo() return=Ò'
27/5/2019 7:35:20 Disk offset 659554304
27/5/2019 7:35:20 Disk 0 Part 1 TYPE 260

27/5/2019 7:35:20 Disk 0 Part 5 TYPE 261

27/5/2019 7:35:20 Secure boot = 1

27/5/2019 7:35:20 tempbuff = |, num=0
27/5/2019 7:35:26 size of qfe list 64
27/5/2019 7:35:26 Value found for LocalXMLPath = `#&
27/5/2019 7:35:26 WDAVersion = 12.1.1.25
27/5/2019 7:35:26 GetCI() done
27/5/2019 7:35:26 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC43=msiexec.exe|PRC44=svchost.exe|PRC45=SearchFilterHost.exe|PRC46
PRC56=SelfServicePlugin.exe|PRC57=wfcrun32.exe|PRC58=TrustedInstall
27/5/2019 7:35:26 er.exe|PRC59=TiWorker.exe|||PMIU=28|TBPM=7786256|FBPM=5574864|
27/5/2019 7:35:26 PRMS0=28,28,28|NIC0IP=10.28.0.130|
RECP0=1824|
27/5/2019 7:35:26 SENDP0=752|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA
27/5/2019 7:35:26 |RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|
27/5/2019 7:35:26 RECP2=0|SENDP2=0|MIBSP2=0üMbps|
5,KB2769166,K
27/5/2019 7:35:26
85094,KB2785220,KB2789649,KB2789650,KB2790655
27/5/2019 7:35:26
2798804,KB2798805,KB2799494,KB2800033,KB28045
27/5/2019 7:35:26
KB2812822,KB2813170,KB2813430,KB2817183,KB281
27/5/2019 7:35:26
0,KB2832450,KB2836946,KB2836947,KB2836988,KB2
27/5/2019 7:35:26 838727,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64�
27/5/2019 7:35:26 �es-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|C:\Pr
27/5/2019 7:35:26 ogramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffic
27/5/2019 7:35:26 e\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWindo
27/5/2019 7:35:26 wsüEmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=
27/5/2019 7:35:26 MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|
AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP
27/5/2019 7:35:26 10=VMwareüHorizonüViewüClient|
C:\ProgramüFil
27/5/2019 7:35:26 esü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=DiagnosticsüutilityüforüInte
27/5/2019 7:35:26 rnetüExplorer|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\Co
27/5/2019 7:35:26 mmonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWE
27/5/2019 7:35:26 RPNT.EXE|15.0.4420.1017|AP17=TightVNC|
AP18=UnifiedüWriteüFilterüManagerüMan
27/5/2019 7:35:26 ager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20
27/5/2019 7:35:26 =Microsoftü(R)üContactsüImportüTool|
C:\PROGRA
27/5/2019 7:35:26 ~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|
27/5/2019 7:35:26 Found HS Tag
ProcessMsg!
then clear it here
27/5/2019 7:35:26 Server Sent 5
27/5/2019 7:35:26 Enhanced QU : QUM :
27/5/2019 7:35:26 Enhanced QU : QUC :
27/5/2019 7:35:26 Enhanced QU : QUD :
27/5/2019 7:35:26 Server Sent 6
27/5/2019 7:35:26 LOOKING FOR &04
27/5/2019 7:35:26 FUR :After S&P done
27/5/2019 7:37:25 Stopping
27/5/2019 10:2:10 ***********************************************************
27/5/2019 10:2:10 End of WinMain()
27/5/2019 10:2:10 ^^^^^^^^ after reghanex()
27/5/2019 10:2:30 OS Version 6.2.9200
27/5/2019 10:2:30 OS Version 6.2.9200
27/5/2019 10:2:30 Major version 6
27/5/2019 10:2:30 Minor version 2
27/5/2019 10:2:30 Device Info: OS is `�,
27/5/2019 10:2:30 WRITE FILTER UWF 1
27/5/2019 10:2:30 Setting UWF Mgr!
27/5/2019 10:2:31 Disk offset 659554304
27/5/2019 10:2:31 Disk offset =1048576

27/5/2019 10:2:31 Disk offset =105906176
27/5/2019 10:2:31 Disk offset =420478976
27/5/2019 10:2:31 Disk offset =525336576
27/5/2019 10:2:31 Disk offset =659554304

'Z:\',error=1
27/5/2019 10:2:31 AF_INET (IPv4)
27/5/2019 10:2:31 IPv4 address 10.28.0.130
27/5/2019 10:2:31 Valid IP Found

27/5/2019 10:2:31 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
27/5/2019 10:2:31 HA Supported
27/5/2019 10:2:31 dwHSListCount = 1
GetServerAddress
securePort: 443
27/5/2019 10:2:31 GetIP :: *** PPP
-2113922038
27/5/2019 10:2:31 ip RETRIVED `�/
10.20.15.151, SecurePort: 443
27/5/2019 10:2:31 SETTING REG TO VALUE `�/
reported: 28
27/5/2019 10:2:31 C80B-4C42-8011-32B62020ACA3}, Type=6
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 10:2:32 Pipe not found
27/5/2019 10:2:32 The count is 7
27/5/2019 10:2:32 bSet is 1
securePort: 443
27/5/2019 10:2:32 Calling V01
27/5/2019 10:2:32 Merlin version 354
27/5/2019 10:2:32 Signature 354
27/5/2019 10:2:33 Wyse Flag value 0011
27/5/2019 10:2:34 The iBLP value -1
27/5/2019 10:2:35 TZ Queried
Number
27/5/2019 10:2:35 FUR : GetCI() 1
27/5/2019 10:2:35 IP matched!
27/5/2019 10:2:35 Subnet �*
27/5/2019 10:2:35 Gateway ��*
27/5/2019 10:2:35 DS
27/5/2019 10:2:35 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP= �,
27/5/2019 10:2:35 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP= �,
27/5/2019 10:2:35 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP= �,
83FF-9A7F0B2B2
27/5/2019 10:2:35 E1E}
27/5/2019 10:2:35 Got reply from AgentUI=��.
27/5/2019 10:2:35 GetDisplayInfo() return=�#,
27/5/2019 10:2:35 Disk offset 659554304
27/5/2019 10:2:35 Disk 0 Part 1 TYPE 260

27/5/2019 10:2:35 Disk 0 Part 5 TYPE 261

27/5/2019 10:2:35 Secure boot = 1

27/5/2019 10:2:35 tempbuff = |WIN0=KENNETH 8GB (D:)|WIN1=Program Manager|, num=0
27/5/2019 10:2:35 Msg recd from AgentGUI:|WIN0=KENNETH 8GB (D:)|WIN1=Program
Manager|
27/5/2019 10:2:35 return from ListAllApps=0�0
27/5/2019 10:2:42 size of qfe list 64
27/5/2019 10:2:43 WDAVersion = 12.1.1.25
27/5/2019 10:2:43 GetCI() done
'Z:\',error=1
securePort: 443
27/5/2019 10:2:43 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
27/5/2019 10:2:43 |TFB1=409104384|DRV2=Z:|TB2=1073643520|TFB2=1073479680||
27/5/2019 10:2:43 PRC12=svchost.exe|PRC13=svchost.exe|PRC14=dwm.exe|
PRC15=svchost.exe|PRC16=svchost.exe|PRC17=atieclxx.exe|PRC18=DtcPlatformSvc.ex
27/5/2019 10:2:43 e|PRC19=Explorer.EXE|PRC20=spoolsv.exe|PRC21=svchost.exe|
PRC22=taskhostex.exe|PRC23=GoogleUpdate.exe|PRC24=svchost.exe|PRC25=svc
27/5/2019 10:2:43 host.exe|PRC26=mqsvc.exe|PRC27=NetXClean.exe|
PRC28=pnusbvirtualhubwssrv.exe|PRC29=tcpsvcs.exe|PRC30=snmp.exe|PRC31=tvnserver.exe
27/5/2019 10:2:43 |PRC32=UWFSvc.exe|PRC33=MsMpEng.exe|PRC34=wsnm.exe|
PRC35=DtcWDAService.exe|PRC36=GoogleUpdate.exe|PRC37=wmiprvse.exe|PRC38=mqtgs
27/5/2019 10:2:43 vc.exe|PRC39=vmware-usbarbitrator64.exe|PRC40=vmware-view-
usbd.exe|PRC41=svchost.exe|PRC42=msiexec.exe|PRC43=wmiprvse.exe|PRC44=
27/5/2019 10:2:43 SearchIndexer.exe|PRC45=vssvc.exe|PRC46=svchost.exe|
PRC47=SearchProtocolHost.exe|PRC48=SearchFilterHost.exe|PRC49=DtcWdaUi.exe|P
27/5/2019 10:2:43 RC50=tvnserver.exe|PRC51=RAVCpl64.exe|PRC52=concentr.exe|
PRC53=redirector.exe|PRC54=PNUSBCLITRAY.exe|PRC55=PNTray.exe|PRC56=Rece
27/5/2019 10:2:43 iver.exe|PRC57=SelfServicePlugin.exe|PRC58=wfcrun32.exe|
PRC59=hagent.exe|PRC60=WUDFHost.exe|PRC61=HAgent_UI.exe||WIN0=KENNETHü8
27/5/2019 10:2:43 GBü(D:)|WIN1=ProgramüManager||PMIU=33|TBPM=7786256|
FBPM=5154240|TBPF=7786256|FBPF=5006032|TBVM=8589934464|FKVM=8589865384|FKEM
27/5/2019 10:2:43 =0|CPRMS0=0,0,0|NIC0IP=10.28.0.130|
RECP0=806|
27/5/2019 10:2:43 SENDP0=487|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA
27/5/2019 10:2:43 |RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|
27/5/2019 10:2:43 RECP2=0|SENDP2=0|MIBSP2=0üMbps|
5,KB2769166,K
27/5/2019 10:2:43
85094,KB2785220,KB2789649,KB2789650,KB2790655
27/5/2019 10:2:43
2798804,KB2798805,KB2799494,KB2800033,KB28045
27/5/2019 10:2:43
KB2812822,KB2813170,KB2813430,KB2817183,KB281
27/5/2019 10:2:43
0,KB2832450,KB2836946,KB2836947,KB2836988,KB2
27/5/2019 10:2:43 838727,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64�
27/5/2019 10:2:43 �es-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|C:\Pr
27/5/2019 10:2:43 ogramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffic
27/5/2019 10:2:43 e\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWindo
27/5/2019 10:2:43 wsüEmbeddedüKeyboardüFilterüDatabase|||
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=
27/5/2019 10:2:43 MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|
AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP
27/5/2019 10:2:43 10=VMwareüHorizonüViewüClient|
C:\ProgramüFil
27/5/2019 10:2:43 esü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=DiagnosticsüutilityüforüInte
27/5/2019 10:2:43 rnetüExplorer|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\Co
27/5/2019 10:2:43 mmonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWE
27/5/2019 10:2:43 RPNT.EXE|15.0.4420.1017|AP17=TightVNC|
AP18=UnifiedüWriteüFilterüManagerüMan
27/5/2019 10:2:43 ager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20
27/5/2019 10:2:43 =Microsoftü(R)üContactsüImportüTool|
C:\PROGRA
27/5/2019 10:2:43 ~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|
27/5/2019 10:2:43 Found HS Tag
ProcessMsg!
then clear it here
27/5/2019 10:2:43 Server Sent 5
27/5/2019 10:2:43 Enhanced QU : QUM :
27/5/2019 10:2:43 Enhanced QU : QUC :
27/5/2019 10:2:43 Enhanced QU : QUD :
27/5/2019 10:2:43 Server Sent 6
27/5/2019 10:2:43 LOOKING FOR &04
27/5/2019 10:2:43 FUR :After S&P done
GetServerAddress
securePort: 443
27/5/2019 10:17:37 GetIP :: *** PPP
IN_ADDR : -2113922038
27/5/2019 10:17:37 ip RETRIVED p4/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:17:42 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:17:42 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:17:47 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 10:17:47 ip RETRIVED p4/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:17:53 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:17:53 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:21:42 ip RETRIVED P!/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:21:48 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:21:48 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:21:48 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
27/5/2019 10:21:48 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 10:21:49 ip RETRIVED p4/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:21:54 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:21:54 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:22:3 ip RETRIVED P!/
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
27/5/2019 10:22:9 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:22:9 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:22:14 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:22:15 ip RETRIVED `3/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:22:20 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:22:20 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:22:20 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 10:22:26 ip RETRIVED `3/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:22:32 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:22:32 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:22:37 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:22:37 ip RETRIVED p4/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:22:43 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:22:43 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:22:53 ip RETRIVED `3/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:22:59 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:22:59 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:22:59 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
27/5/2019 10:22:59 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:22:59 ip RETRIVED `3/
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
27/5/2019 10:23:5 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:23:5 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:23:13 ip RETRIVED @1/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:23:19 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:23:19 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:23:19 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
27/5/2019 10:23:19 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:23:19 ip RETRIVED @1/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:23:25 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:23:25 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:23:25 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:23:38 ip RETRIVED �6/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:23:43 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:23:43 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:23:43 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
27/5/2019 10:23:44 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:23:44 ip RETRIVED �;/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:23:50 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:23:50 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:23:50 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:31:29 ip RETRIVED �$/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:31:35 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:31:35 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:31:35 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
27/5/2019 10:31:35 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:31:35 ip RETRIVED �$/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:31:41 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:31:41 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:31:55 ip RETRIVED �$/
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
27/5/2019 10:32:1 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:32:1 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:32:1 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:32:1 ip RETRIVED P!/
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
27/5/2019 10:32:7 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:32:7 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:32:17 ip RETRIVED �:/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:32:22 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:32:22 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:32:28 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 10:32:28 ip RETRIVED �5/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:32:34 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:32:34 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 10:32:39 ip RETRIVED �9/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:32:45 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:32:45 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:32:51 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:32:51 ip RETRIVED P!/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:32:56 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:32:56 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:33:2 ip RETRIVED �5/
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
27/5/2019 10:33:8 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:33:8 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:33:8 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:33:9 ip RETRIVED p4/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:33:14 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:33:14 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:33:21 ip RETRIVED �5/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:33:27 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:33:27 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:33:27 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
27/5/2019 10:33:27 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
27/5/2019 10:33:28 ip RETRIVED �(/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:33:33 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:33:33 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:33:33 2F-42D4-83FF-9A7F0B2B2E1E}, Type=6
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 10:33:44 ip RETRIVED �5/
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
27/5/2019 10:33:50 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:33:50 476A-8590-E6333C53F805}, Type=71
27/5/2019 10:33:55 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 10:33:55 ip RETRIVED p4/
10.20.15.151, SecurePort: 443
HServer
Port: 0
ms
reported: 28
27/5/2019 10:34:1 C80B-4C42-8011-32B62020ACA3}, Type=6
27/5/2019 10:34:1 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 11:34:39 ip RETRIVED @1/
10.20.15.151, SecurePort: 443
27/5/2019 11:34:39 SETTING REG TO VALUE @1/
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 11:34:39 Pipe not found
27/5/2019 11:34:39 The count is 7
27/5/2019 11:34:39 bCheckServer is 1
27/5/2019 11:34:39 bSet is 1
securePort: 443
27/5/2019 11:34:39 Calling V01
27/5/2019 11:34:39 Merlin version 354
27/5/2019 11:34:39 Signature 354
27/5/2019 11:34:40 Wyse Flag value 0011
27/5/2019 11:34:40 The iBLP value -1
27/5/2019 11:34:41 TZ Queried
Number
27/5/2019 11:34:41 FUR : GetCI() 1
27/5/2019 11:34:41 IP matched!
27/5/2019 11:34:41 Subnet �*
27/5/2019 11:34:41 Gateway ��*
27/5/2019 11:34:41 DS
83FF-9A7F0B2B2
27/5/2019 11:34:41 E1E}
27/5/2019 11:34:41 add only adapter.
27/5/2019 11:34:41 GetDisplayInfo() return=� 5
27/5/2019 11:34:41 Disk offset 659554304
27/5/2019 11:34:41 Disk 0 Part 1 TYPE 260

27/5/2019 11:34:41 Disk 0 Part 5 TYPE 261

27/5/2019 11:34:41 Secure boot = 1

27/5/2019 11:34:41 tempbuff = |WIN0=Eurot�nel - PowerPoint|WIN1=Nueva pesta�a -
Google Chrome|WIN2=KENNETH 8GB (D:)|WIN3=Program Manager|, num=0
27/5/2019 11:34:41 Msg recd from AgentGUI:|WIN0=Eurot�nel - PowerPoint|
WIN1=Nueva pesta�a - Google Chrome|WIN2=KENNETH 8GB (D:)|WIN3=Program Manage
27/5/2019 11:34:41 r|
27/5/2019 11:34:41 return from ListAllApps=�
27/5/2019 11:34:47 size of qfe list 64
27/5/2019 11:34:47 Value found for LocalXMLPath = P�1
27/5/2019 11:34:47 WDAVersion = 12.1.1.25
27/5/2019 11:34:47 GetCI() done
27/5/2019 11:34:47 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
27/5/2019 11:34:47 |TFB1=409104384|DRV2=Z:|TB2=1073643520|TFB2=1067057152||
PRC40=DtcWdaUi.exe|PRC41=tvnserver.exe|PRC42=RAVCpl64.exe|PRC43=concentr.exe|PRC44=
27/5/2019 11:34:47 redirector.exe|PRC45=PNUSBCLITRAY.exe|PRC46=PNTray.exe|
PRC47=Receiver.exe|PRC48=SelfServicePlugin.exe|PRC49=wfcrun32.exe|PRC50=h
27/5/2019 11:34:47 agent.exe|PRC51=WUDFHost.exe|PRC52=HAgent_UI.exe|
PRC53=POWERPNT.EXE|PRC54=CcmExec.exe|PRC55=wmiprvse.exe|PRC56=chrome.exe|PRC57=
27/5/2019 11:34:47 chrome.exe|PRC58=chrome.exe|PRC59=chrome.exe|
PRC60=chrome.exe|PRC61=wmiprvse.exe|PRC62=chrome.exe|PRC63=chrome.exe|PRC64=chrome.
PRC68=chrome.exe|PRC69=svchost.exe|PRC70=chrome.exe|PRC71=wmiprvse.exe||W
27/5/2019 11:34:47 IN0=Eurot�nelü-üPowerPoint|WIN1=Nuevaüpesta�aü-
üGoogleüChrome|WIN2=KENNETHü8GBü(D:)|WIN3=ProgramüManager||PMIU=46|TBPM=
27/5/2019 11:34:47 7786256|FBPM=4166560|TBPF=7786256|FBPF=3667484|
TBVM=8589934464|FKVM=8589863336|FKEM=0|CPRMS0=13,13,13|NIC0IP=10.28.0.130|NIC0DES
27/5/2019 11:34:47 C=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=114691|SENDP0=50953|MIBSP0=100üMbps||NIC1IP=0
27/5/2019 11:34:47 .0.0.0|
RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2
27/5/2019 11:34:47 IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-
ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=K
27/5/2019 11:34:47
69166,KB2770917,KB2777294,KB2778344,KB2778930
27/5/2019 11:34:47
2790655,KB2790907,KB2792100,KB2793210,KB27941
27/5/2019 11:34:47
KB2804583,KB2804584,KB2805222,KB2805227,KB280
27/5/2019 11:34:47
3,KB2818604,KB2820330,KB2821895,KB2822241,KB2
27/5/2019 11:34:47
988,KB2838727,KB2839894,KB2845533,KB2845690,|
27/5/2019 11:34:47 AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFir
27/5/2019 11:34:47 efox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
27/5/2019 11:34:47 20.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisua
27/5/2019 11:34:47 lüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||
9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDataba
27/5/2019 11:34:47 se|||AP7=MicrosoftüSilverlight|
+ü2005üRedistri
27/5/2019 11:34:47 butableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\Pr
27/5/2019 11:34:47 ogramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application\ch
27/5/2019 11:34:47 rome.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-basedüwriteüfilt
27/5/2019 11:34:47 erümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\Inter
27/5/2019 11:34:47 netüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15
27/5/2019 11:34:47 \MSOXMLED.EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
27/5/2019 11:34:47 C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE|2.
27/5/2019 11:34:47 0.127.0|AP19=WindowsüContacts|
AP20=Microsoftü(R)üContactsüImportüToo
27/5/2019 11:34:47 l|C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.
27/5/2019 11:34:47 Found HS Tag
ProcessMsg!
27/5/2019 11:34:47 Server Sent 5
27/5/2019 11:34:47 Enhanced QU : QUM :
27/5/2019 11:34:47 Enhanced QU : QUC :
27/5/2019 11:34:47 Enhanced QU : QUD :
27/5/2019 11:34:47 Server Sent 6
27/5/2019 11:34:47 LOOKING FOR &04
27/5/2019 11:34:47 FUR :After S&P done
27/5/2019 12:34:25 Received data: �.
Host: 10.28.0.130
Content-Length: 0
Cache-C
27/5/2019 12:34:25 ontrol: no-cache

Host: 10.28.0.130
Content-Length: 0
27/5/2019 12:34:25 te

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 12:34:26 ip RETRIVED @1/
10.20.15.151, SecurePort: 443
27/5/2019 12:34:26 SETTING REG TO VALUE @1/
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 12:34:26 Pipe not found
27/5/2019 12:34:26 The count is 7
27/5/2019 12:34:26 bCheckServer is 1
27/5/2019 12:34:26 bSet is 1
securePort: 443
27/5/2019 12:34:26 Calling V01
27/5/2019 12:34:26 Merlin version 354
27/5/2019 12:34:26 Signature 354
27/5/2019 12:34:26 Wyse Flag value 0011
27/5/2019 12:34:27 The iBLP value -1
27/5/2019 12:34:28 TZ Queried
Number
27/5/2019 12:34:28 FUR : GetCI() 1
27/5/2019 12:34:28 IP matched!
27/5/2019 12:34:28 Subnet �*
27/5/2019 12:34:28 Gateway ��*
27/5/2019 12:34:28 DS
27/5/2019 12:34:28 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=`h0
27/5/2019 12:34:28 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=`h0
27/5/2019 12:34:28 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=`h0
83FF-9A7F0B2B2
27/5/2019 12:34:28 E1E}
27/5/2019 12:34:28 add only adapter.
27/5/2019 12:34:28 GetDisplayInfo() return= �4
27/5/2019 12:34:28 Disk offset 659554304
27/5/2019 12:34:28 Disk 0 Part 1 TYPE 260

27/5/2019 12:34:28 Disk 0 Part 5 TYPE 261

27/5/2019 12:34:28 Secure boot = 1

27/5/2019 12:34:28 tempbuff = |WIN0=Presentaci�n1 - PowerPoint|WIN1=fondos para
diapositivas grado - Buscar con Google - Google Chrome|WIN2=Nueva p
27/5/2019 12:34:28 esta�a - Google Chrome|WIN3=Program Manager|, num=0
27/5/2019 12:34:28 Msg recd from AgentGUI:|WIN0=Presentaci�n1 - PowerPoint|
WIN1=fondos para diapositivas grado - Buscar con Google - Google Chrome|
27/5/2019 12:34:28 WIN2=Nueva pesta�a - Google Chrome|WIN3=Program Manager|
27/5/2019 12:34:28 Got reply from AgentUI=�o4
27/5/2019 12:34:28 return from ListAllApps=� 5
27/5/2019 12:34:33 size of qfe list 64
27/5/2019 12:34:33 Value found for LocalXMLPath = �M0
27/5/2019 12:34:33 WDAVersion = 12.1.1.25
27/5/2019 12:34:33 GetCI() done
27/5/2019 12:34:33 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
27/5/2019 12:34:33 er.exe|PRC40=DtcWdaUi.exe|PRC41=tvnserver.exe|
PRC42=RAVCpl64.exe|PRC43=concentr.exe|PRC44=redirector.exe|PRC45=PNUSBCLITRAY.exe|
27/5/2019 12:34:33 PRC46=PNTray.exe|PRC47=Receiver.exe|
PRC48=SelfServicePlugin.exe|PRC49=wfcrun32.exe|PRC50=hagent.exe|
PRC51=HAgent_UI.exe|PRC52=Cc
PRC55=mip.exe|PRC56=chrome.exe|PRC57=chrome.exe|PRC58=chrome.exe|PRC59=chrome.ex
PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe|PRC66=chrome.exe|PRC67=P
27/5/2019 12:34:33 OWERPNT.EXE|PRC68=svchost.exe|PRC69=wmiprvse.exe||
WIN0=Presentaci�n1ü-üPowerPoint|WIN1=fondosüparaüdiapositivasügradoü-üB
27/5/2019 12:34:33 uscarüconüGoogleü-üGoogleüChrome|WIN2=Nuevaüpesta�aü-
üGoogleüChrome|WIN3=ProgramüManager||PMIU=42|TBPM=7786256|FBPM=44
27/5/2019 12:34:33 96560|TBPF=7786256|FBPF=4170152|TBVM=8589934464|
FKVM=8589863336|FKEM=0|CPRMS0=14,1,13|NIC0IP=10.28.0.130|NIC0DESC=Ethernet,Inven
RECP0=206017|SENDP0=80276|MIBSP0=100üMbps||NIC1IP=0.0.0.0|NIC1DESC=
27/5/2019 12:34:33 Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2D
27/5/2019 12:34:33 ESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
27/5/2019 12:34:33
KB2777294,KB2778344,KB2778930,KB2779562,KB277
27/5/2019 12:34:33
7,KB2792100,KB2793210,KB2794119,KB2794599,KB2
27/5/2019 12:34:33
584,KB2805222,KB2805227,KB2807986,KB2808679,K
27/5/2019 12:34:33
20330,KB2821895,KB2822241,KB2829069,KB2829254
27/5/2019 12:34:33
2839894,KB2845533,KB2845690,|AP0=7-Zipü18.05
27/5/2019 12:34:33 ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=
27/5/2019 12:34:33 MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=Micr
27/5/2019 12:34:33 osoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRe
27/5/2019 12:34:33 distributableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=Microso
27/5/2019 12:34:33 ftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||
27/5/2019 12:34:33 8.0.61000|AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|
12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMw
27/5/2019 12:34:33 are\VMwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.34
27/5/2019 12:34:33 40.106|AP12=MicrosoftüExcel|
basedüwriteüfilterümanager|C:\W
27/5/2019 12:34:33 indows\System32\fbwfmgr.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IE
27/5/2019 12:34:33 DIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|15
27/5/2019 12:34:33 .0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\ProgramüFile
27/5/2019 12:34:33 s\TightVNC\tvnserver.exe|2.6.4.0|
AP19=Win
27/5/2019 12:34:33 dowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFi
27/5/2019 12:34:33 les\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CF
27/5/2019 12:34:33 G_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
27/5/2019 12:34:34 Found HS Tag
ProcessMsg!
27/5/2019 12:34:34 Server Sent 5
27/5/2019 12:34:34 Enhanced QU : QUM :
27/5/2019 12:34:34 Enhanced QU : QUC :
27/5/2019 12:34:34 Enhanced QU : QUD :
27/5/2019 12:34:34 Server Sent 6
27/5/2019 12:34:34 LOOKING FOR &04
27/5/2019 12:34:34 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 13:36:33 ip RETRIVED p4/
10.20.15.151, SecurePort: 443
27/5/2019 13:36:33 SETTING REG TO VALUE p4/
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 13:36:33 Pipe not found
27/5/2019 13:36:33 The count is 7
27/5/2019 13:36:33 bCheckServer is 1
27/5/2019 13:36:33 bSet is 1
securePort: 443
27/5/2019 13:36:33 Value found for LocalXMLPath = 0#*
27/5/2019 13:36:34 WDAVersion = 12.1.1.25
27/5/2019 13:36:34 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 13:36:35 1|VI=1|
27/5/2019 13:36:35 Found HS Tag
ProcessMsg!
27/5/2019 13:36:35 Server Sent 5
27/5/2019 13:36:35 Enhanced QU : QUM :
27/5/2019 13:36:35 Enhanced QU : QUC :
27/5/2019 13:36:35 Enhanced QU : QUD :
27/5/2019 13:36:35 Server Sent 6
27/5/2019 13:36:35 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 14:39:33 ip RETRIVED �(/
10.20.15.151, SecurePort: 443
27/5/2019 14:39:33 SETTING REG TO VALUE �(/
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 14:39:33 Pipe not found
27/5/2019 14:39:33 The count is 7
27/5/2019 14:39:33 bCheckServer is 1
27/5/2019 14:39:33 bSet is 1
securePort: 443
27/5/2019 14:39:34 Value found for LocalXMLPath = @w/
27/5/2019 14:39:34 WDAVersion = 12.1.1.25
27/5/2019 14:39:34 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 14:39:35 1|VI=1|
27/5/2019 14:39:35 Found HS Tag
ProcessMsg!
27/5/2019 14:39:35 Server Sent 5
27/5/2019 14:39:35 Enhanced QU : QUM :
27/5/2019 14:39:35 Enhanced QU : QUC :
27/5/2019 14:39:35 Enhanced QU : QUD :
27/5/2019 14:39:35 Server Sent 6
27/5/2019 14:39:35 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 15:42:32 ip RETRIVED �9/
10.20.15.151, SecurePort: 443
27/5/2019 15:42:32 SETTING REG TO VALUE �9/
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 15:42:33 Pipe not found
27/5/2019 15:42:33 The count is 7
27/5/2019 15:42:33 bCheckServer is 1
27/5/2019 15:42:33 bSet is 1
securePort: 443
27/5/2019 15:42:33 Value found for LocalXMLPath = `
27/5/2019 15:42:33 WDAVersion = 12.1.1.25
27/5/2019 15:42:33 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 15:42:34 1|VI=1|
27/5/2019 15:42:34 Found HS Tag
ProcessMsg!
27/5/2019 15:42:34 Server Sent 5
27/5/2019 15:42:34 Enhanced QU : QUM :
27/5/2019 15:42:34 Enhanced QU : QUC :
27/5/2019 15:42:34 Enhanced QU : QUD :
27/5/2019 15:42:34 Server Sent 6
27/5/2019 15:42:34 LOOKING FOR &04
27/5/2019 16:22:54 Received data: �.
Accept: */*
27/5/2019 16:22:54 jects/mechanize/)
Connection: close
27/5/2019 16:22:54 =0.7,*;q=0.7

Accept: */*
Connection: close
27/5/2019 16:22:54 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 16:22:55 ip RETRIVED p4/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 16:22:55 Pipe not found
27/5/2019 16:22:55 The count is 7
27/5/2019 16:22:55 bCheckServer is 1
27/5/2019 16:22:55 bSet is 1
securePort: 443
27/5/2019 16:22:55 Calling V01
27/5/2019 16:22:55 Merlin version 354
27/5/2019 16:22:55 Signature 354
27/5/2019 16:22:56 Wyse Flag value 0011
27/5/2019 16:22:56 The iBLP value -1
27/5/2019 16:22:57 TZ Queried
Number
27/5/2019 16:22:57 FUR : GetCI() 1
27/5/2019 16:22:57 IP matched!
27/5/2019 16:22:57 Subnet �*
27/5/2019 16:22:57 Gateway ��*
27/5/2019 16:22:57 DS
27/5/2019 16:22:57 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=�l0
27/5/2019 16:22:57 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=�l0
27/5/2019 16:22:57 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=�l0
83FF-9A7F0B2B2
27/5/2019 16:22:57 E1E}
27/5/2019 16:22:57 add only adapter.
27/5/2019 16:22:57 GetDisplayInfo() return=�O4
27/5/2019 16:22:57 Disk offset 659554304
27/5/2019 16:22:57 Disk 0 Part 1 TYPE 260

27/5/2019 16:22:57 Disk 0 Part 5 TYPE 261

27/5/2019 16:22:57 Secure boot = 1

27/5/2019 16:22:57 tempbuff = |WIN0=AUTODESK INVENTOR COMO HACER PLANOS -
YouTube - Google Chrome|WIN1=Program Manager|, num=0
27/5/2019 16:22:57 Msg recd from AgentGUI:|WIN0=AUTODESK INVENTOR COMO HACER
PLANOS - YouTube - Google Chrome|WIN1=Program Manager|
27/5/2019 16:22:57 return from ListAllApps=p�4
27/5/2019 16:23:4 size of qfe list 64
27/5/2019 16:23:4 WDAVersion = 12.1.1.25
27/5/2019 16:23:4 GetCI() done
27/5/2019 16:23:4 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
27/5/2019 16:23:4 er.exe|PRC40=DtcWdaUi.exe|PRC41=tvnserver.exe|
PRC42=RAVCpl64.exe|PRC43=concentr.exe|PRC44=redirector.exe|PRC45=PNUSBCLITRAY.exe|
27/5/2019 16:23:4 PRC46=PNTray.exe|PRC47=Receiver.exe|
PRC48=SelfServicePlugin.exe|PRC49=wfcrun32.exe|PRC50=hagent.exe|
PRC51=HAgent_UI.exe|PRC52=Cc
27/5/2019 16:23:4 mExec.exe|PRC53=wmiprvse.exe|PRC54=wmiprvse.exe|PRC55=mip.exe|
PRC56=chrome.exe|PRC57=chrome.exe|PRC58=chrome.exe|PRC59=chrome.ex
PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe|PRC66=chrome.exe|PRC67=c
27/5/2019 16:23:4 hrome.exe|PRC68=wmiprvse.exe||
WIN0=AUTODESKüINVENTORüCOMOüHACERüPLANOSü-üYouTubeü-üGoogleüChrome|
WIN1=ProgramüManager|
27/5/2019 16:23:4 |PMIU=43|TBPM=7786256|FBPM=4437664|TBPF=7786256|FBPF=4194268|
TBVM=8589934464|FKVM=8589863336|FKEM=0|CPRMS0=43,13,13|NIC0IP=10.28
27/5/2019 16:23:4 .0.130|
RECP0=548462|SENDP0=187687|MIBSP0=100�
27/5/2019 16:23:4 �Mbps||NIC1IP=0.0.0.0|
RECP1=0|SENDP1=0|MIBSP
27/5/2019 16:23:4 1=3üMbps||NIC2IP=0.0.0.0|
SENDP2=0|MIBSP2
27/5/2019 16:23:4 =0üMbps|
5,KB2769166,KB2770917,KB2777294,KB27
27/5/2019 16:23:4
49,KB2789650,KB2790655,KB2790907,KB2792100,KB
27/5/2019 16:23:4
9494,KB2800033,KB2804583,KB2804584,KB2805222,
27/5/2019 16:23:4
813430,KB2817183,KB2818604,KB2820330,KB282189
27/5/2019 16:23:4
B2836947,KB2836988,KB2838727,KB2839894,KB2845
27/5/2019 16:23:4 533,KB2845690,|AP0=7-Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|
18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFil
27/5/2019 16:23:4 es\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||
61.0.2|AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\Microsoft�
27/5/2019 16:23:4 �Office|15.0.4420.1017|
15.0.4420.1017|AP5=M
27/5/2019 16:23:4 icrosoftüVisualüC++ü2008üRedistributableü-
üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKeyboard�
27/5/2019 16:23:4 �FilterüDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC++�
27/5/2019 16:23:4 �2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüVie
27/5/2019 16:23:4 wüClient|C:\ProgramüFiles\VMware\VMwareüView\Client\|
5.4.0.1219906|AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome
27/5/2019 16:23:4 \Application\chrome.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-bas
27/5/2019 16:23:4 edüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|
2.0.449.0|AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\Progr
27/5/2019 16:23:4 amüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\Microsoftü
27/5/2019 16:23:4 Shared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017
27/5/2019 16:23:4 |AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|
2.6.4.0|AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System3
27/5/2019 16:23:4 2\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Microsoftü(R)üContac
27/5/2019 16:23:4 tsüImportüTool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|
6.2.9200.16384|AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WI
27/5/2019 16:23:4 NWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|
WCMJSONSupp=1|
27/5/2019 16:23:4 Found HS Tag
ProcessMsg!
then clear it here
27/5/2019 16:23:4 Server Sent 5
27/5/2019 16:23:4 Enhanced QU : QUM :
27/5/2019 16:23:4 Enhanced QU : QUC :
27/5/2019 16:23:4 Enhanced QU : QUD :
27/5/2019 16:23:4 Server Sent 6
27/5/2019 16:23:4 LOOKING FOR &04
27/5/2019 16:23:4 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 17:23:44 ip RETRIVED �6/
10.20.15.151, SecurePort: 443
27/5/2019 17:23:44 SETTING REG TO VALUE �6/
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 17:23:44 Pipe not found
27/5/2019 17:23:44 The count is 7
27/5/2019 17:23:44 bCheckServer is 1
27/5/2019 17:23:44 bSet is 1
securePort: 443
27/5/2019 17:23:44 WDAVersion = 12.1.1.25
27/5/2019 17:23:45 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 17:23:45 1|VI=1|
27/5/2019 17:23:45 Found HS Tag
ProcessMsg!
27/5/2019 17:23:45 Server Sent 5
27/5/2019 17:23:45 Enhanced QU : QUM :
27/5/2019 17:23:45 Enhanced QU : QUC :
27/5/2019 17:23:45 Enhanced QU : QUD :
27/5/2019 17:23:45 Server Sent 6
27/5/2019 17:23:46 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
27/5/2019 18:25:24 ip RETRIVED p4/
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 18:25:24 Pipe not found
27/5/2019 18:25:24 The count is 7
27/5/2019 18:25:24 bCheckServer is 1
27/5/2019 18:25:24 bSet is 1
securePort: 443
27/5/2019 18:25:24 Value found for LocalXMLPath = `
27/5/2019 18:25:24 WDAVersion = 12.1.1.25
27/5/2019 18:25:25 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
27/5/2019 18:25:25 1|VI=1|
27/5/2019 18:25:25 Found HS Tag
ProcessMsg!
27/5/2019 18:25:25 Server Sent 5
27/5/2019 18:25:25 Enhanced QU : QUM :
27/5/2019 18:25:25 Enhanced QU : QUC :
27/5/2019 18:25:25 Enhanced QU : QUD :
27/5/2019 18:25:25 Server Sent 6
27/5/2019 18:25:25 LOOKING FOR &04
###################################################################################
###########################28/5/2019 7:53:10
***********************************************************
28/5/2019 7:53:10 End of WinMain()
28/5/2019 7:53:10 ^^^^^^^^ after reghanex()
28/5/2019 7:53:30 OS Version 6.2.9200
28/5/2019 7:53:30 OS Version 6.2.9200
28/5/2019 7:53:30 Major version 6
28/5/2019 7:53:30 Minor version 2
28/5/2019 7:53:30 Device Info: OS is �#
28/5/2019 7:53:30 WRITE FILTER UWF 1
28/5/2019 7:53:30 Setting UWF Mgr!
28/5/2019 7:53:30 Disk offset 659554304
28/5/2019 7:53:30 Disk offset =1048576

28/5/2019 7:53:30 Disk offset =105906176
28/5/2019 7:53:30 Disk offset =420478976
28/5/2019 7:53:30 Disk offset =525336576
28/5/2019 7:53:30 Disk offset =659554304

'Z:\',error=1
28/5/2019 7:53:31 AF_INET (IPv4)
28/5/2019 7:53:31 IPv4 address 10.28.0.130
28/5/2019 7:53:31 Valid IP Found

28/5/2019 7:53:31 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
28/5/2019 7:53:31 HA Supported
28/5/2019 7:53:31 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
-2113922038
28/5/2019 7:53:31 ip RETRIVED �#
10.20.15.151, SecurePort: 443
28/5/2019 7:53:31 SETTING REG TO VALUE �#
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 7:53:32 Pipe not found
28/5/2019 7:53:32 The count is 7
28/5/2019 7:53:32 bSet is 1
securePort: 443
28/5/2019 7:53:32 Calling V01
28/5/2019 7:53:32 Merlin version 354
28/5/2019 7:53:32 Signature 354
28/5/2019 7:53:33 Wyse Flag value 0011
28/5/2019 7:53:33 The iBLP value -1
28/5/2019 7:53:34 TZ Queried
Number
28/5/2019 7:53:34 FUR : GetCI() 1
28/5/2019 7:53:34 IP matched!
28/5/2019 7:53:34 Subnet ��#
28/5/2019 7:53:34 Gateway ��#
28/5/2019 7:53:34 DS �#
28/5/2019 7:53:34 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=��
28/5/2019 7:53:34 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=��
28/5/2019 7:53:34 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=��
83FF-9A7F0B2B2
28/5/2019 7:53:34 E1E}
28/5/2019 7:53:34 Got reply from AgentUI= �#
28/5/2019 7:53:34 GetDisplayInfo() return=#�!
28/5/2019 7:53:34 Disk offset 659554304
28/5/2019 7:53:34 Disk 0 Part 1 TYPE 260

28/5/2019 7:53:34 Disk 0 Part 5 TYPE 261

28/5/2019 7:53:34 Secure boot = 1

28/5/2019 7:53:34 tempbuff = |, num=0
28/5/2019 7:53:34 Got reply from AgentUI=`N!
28/5/2019 7:53:34 return from ListAllApps=��
28/5/2019 7:53:43 size of qfe list 64
28/5/2019 7:53:44 Value found for LocalXMLPath = �=#
28/5/2019 7:53:44 WDAVersion = 12.1.1.25
28/5/2019 7:53:44 GetCI() done
'Z:\',error=1
securePort: 443
28/5/2019 7:53:44 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC27=NetXCle
28/5/2019 7:53:44 C34=wsnm.exe|PRC35=DtcWDAService.exe|PRC36=wmiprvse.exe|
PRC37=mqtgsvc.exe|PRC38=vmware-usbarbitrator64.exe|PRC39=GoogleUpdate.ex
28/5/2019 7:53:44 e|PRC40=vmware-view-usbd.exe|PRC41=wmiprvse.exe|
PRC42=svchost.exe|PRC43=SearchIndexer.exe|PRC44=msiexec.exe|PRC45=vssvc.exe|PRC4
28/5/2019 7:53:44 6=svchost.exe|PRC47=SearchFilterHost.exe|PRC48=DtcWdaUi.exe|
28/5/2019 7:53:44 59=SelfServicePlugin.exe|PRC60=wfcrun32.exe|
PRC61=DllHost.exe|||PMIU=33|TBPM=7786256|FBPM=5170744|TBPF=7786256|FBPF=5092112|
TBVM
28/5/2019 7:53:44 =8589934464|FKVM=8589864352|FKEM=0|CPRMS0=0,0,0|
NIC0IP=10.28.0.130|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2
28/5/2019 7:53:44 |NIC0MAC=008064FB707A|RECP0=405|SENDP0=210|MIBSP0=1000üMbps||
NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAre
28/5/2019 7:53:44 aüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireles
28/5/2019 7:53:44 s-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|
QFEL=KB2727528,KB2729462,KB2737084,KB2753842,KB2756872,KB2757638
28/5/2019 7:53:44
2779768,KB2780541,KB2781197,KB2785094,KB27852
28/5/2019 7:53:44
KB2795944,KB2798162,KB2798802,KB2798804,KB279
28/5/2019 7:53:44
9,KB2808735,KB2809289,KB2811660,KB2812822,KB2
28/5/2019 7:53:44
254,KB2829361,KB2829530,KB2830290,KB2832450,K
28/5/2019 7:53:44
B2836946,KB2836947,KB2836988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1
28/5/2019 7:53:44 =MozillaüFirefoxü61.0.2ü(x64ües-ES)|
AP3=
28/5/2019 7:53:44 MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|
15.0.4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:
28/5/2019 7:53:44 \ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|
AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0
28/5/2019 7:53:44 .30729.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\Microsof
28/5/2019 7:53:44 tüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|C:\Progr
28/5/2019 7:53:44 amüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|AP1
28/5/2019 7:53:44 1=GoogleüChrome|
AP12=MicrosoftüExcel|C:\PROGRA~1\M
28/5/2019 7:53:44 ICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14
28/5/2019 7:53:44 =DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüX
28/5/2019 7:53:44 MLüHandler|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:
28/5/2019 7:53:44 \PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|
AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=Unif
28/5/2019 7:53:44 iedüWriteüFilterüManagerüManager|
C:\ProgramüFiles\Windowsü
28/5/2019 7:53:44 Mail\wab.exe|6.2.9200.16384|
6.2.9200.1638
28/5/2019 7:53:44 Found HS Tag
ProcessMsg!
then clear it here
28/5/2019 7:53:44 Server Sent 5
28/5/2019 7:53:44 Enhanced QU : QUM :
28/5/2019 7:53:44 Enhanced QU : QUC :
28/5/2019 7:53:44 Enhanced QU : QUD :
28/5/2019 7:53:44 Server Sent 6
28/5/2019 7:53:44 LOOKING FOR &04
28/5/2019 7:53:44 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
-2113922038
28/5/2019 8:55:33 ip RETRIVED #C#
10.20.15.151, SecurePort: 443
28/5/2019 8:55:33 SETTING REG TO VALUE #C#
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 8:55:34 Pipe not found
28/5/2019 8:55:34 The count is 7
28/5/2019 8:55:34 bSet is 1
securePort: 443
28/5/2019 8:55:34 WDAVersion = 12.1.1.25
28/5/2019 8:55:34 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 8:55:35 -1|VI=1|
28/5/2019 8:55:35 Found HS Tag
ProcessMsg!
then clear it here
28/5/2019 8:55:35 Server Sent 5
28/5/2019 8:55:35 Enhanced QU : QUM :
28/5/2019 8:55:35 Enhanced QU : QUC :
28/5/2019 8:55:35 Enhanced QU : QUD :
28/5/2019 8:55:35 Server Sent 6
28/5/2019 8:55:35 LOOKING FOR &04
28/5/2019 9:40:49 Received data: �'
Host: 10.28.0.130
Content-Length: 0
Cache-C
28/5/2019 9:40:49 ontrol: no-cache

Host: 10.28.0.130
Content-Length: 0
28/5/2019 9:40:49 te

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
-2113922038
28/5/2019 9:40:50 ip RETRIVED �J#
10.20.15.151, SecurePort: 443
28/5/2019 9:40:50 SETTING REG TO VALUE �J#
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 9:40:50 Pipe not found
28/5/2019 9:40:50 The count is 7
28/5/2019 9:40:50 bSet is 1
securePort: 443
28/5/2019 9:40:50 Calling V01
28/5/2019 9:40:50 Merlin version 354
28/5/2019 9:40:50 Signature 354
28/5/2019 9:40:51 Wyse Flag value 0011
28/5/2019 9:40:51 The iBLP value -1
28/5/2019 9:40:52 TZ Queried
Number
28/5/2019 9:40:52 FUR : GetCI() 1
28/5/2019 9:40:52 IP matched!
28/5/2019 9:40:52 Subnet ��#
28/5/2019 9:40:52 Gateway ��#
28/5/2019 9:40:52 DS �#
83FF-9A7F0B2B2
28/5/2019 9:40:52 E1E}
28/5/2019 9:40:52 Got reply from AgentUI=�r"
28/5/2019 9:40:52 Disk offset 659554304
28/5/2019 9:40:52 Disk 0 Part 1 TYPE 260

28/5/2019 9:40:52 Disk 0 Part 5 TYPE 261

28/5/2019 9:40:52 Secure boot = 1

28/5/2019 9:40:52 tempbuff = |WIN0=WhatsApp Image 2019-05-28 at 8.29.22 AM (2) -
Visualizador de fotos de Windows|WIN1=6 [Modo de compatibilidad]
28/5/2019 9:40:52 - Word|WIN2=Descargas|WIN3=(2) WhatsApp - Google Chrome|WIN4=5
- Word|WIN5=Documento3 - Word|WIN6=Program Manager|, num=0
28/5/2019 9:40:52 Msg recd from AgentGUI:|WIN0=WhatsApp Image 2019-05-28 at
8.29.22 AM (2) - Visualizador de fotos de Windows|WIN1=6 [Modo de comp
28/5/2019 9:40:52 atibilidad] - Word|WIN2=Descargas|WIN3=(2) WhatsApp - Google
Chrome|WIN4=5 - Word|WIN5=Documento3 - Word|WIN6=Program Manager|
28/5/2019 9:40:52 Got reply from AgentUI=�~
28/5/2019 9:40:52 return from ListAllApps=�n
28/5/2019 9:40:58 size of qfe list 64
28/5/2019 9:40:58 WDAVersion = 12.1.1.25
28/5/2019 9:40:58 GetCI() done
28/5/2019 9:40:58 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
view-usbd.exe|PRC37=wmiprvse.exe|PRC38=svchost.exe|PRC39=DtcWdaUi.ex
28/5/2019 9:40:58 e|PRC40=hagent.exe|PRC41=HAgent_UI.exe|PRC42=tvnserver.exe|
PRC43=RAVCpl64.exe|PRC44=concentr.exe|PRC45=redirector.exe|PRC46=PNUS
28/5/2019 9:40:58 BCLITRAY.exe|PRC47=PNTray.exe|PRC48=Receiver.exe|
PRC49=SelfServicePlugin.exe|PRC50=wfcrun32.exe|PRC51=chrome.exe|PRC52=chrome.ex
PRC56=chrome.exe|PRC57=CcmExec.exe|PRC58=wmiprvse.exe|PRC59=chrome.exe|PRC6
28/5/2019 9:40:58 0=wmiprvse.exe|PRC61=chrome.exe|PRC62=WINWORD.EXE|
PRC63=MendeleyWordPlugin.exe|PRC64=DllHost.exe|PRC65=wmiprvse.exe||WIN0=WhatsA
28/5/2019 9:40:58 ppüImageü2019-05-28üatü8.29.22üAMü(2)ü-
üVisualizadorüdeüfotosüdeüWindows|WIN1=6ü[Modoüdeücompatibilidad]ü-üWord
28/5/2019 9:40:58 |WIN2=Descargas|WIN3=(2)üWhatsAppü-üGoogleüChrome|WIN4=5ü-
üWord|WIN5=Documento3ü-üWord|WIN6=ProgramüManager||PMIU=54|TB
28/5/2019 9:40:58 PM=7786256|FBPM=3556780|TBPF=7786256|FBPF=3098832|
TBVM=8589934464|FKVM=8589864360|FKEM=0|CPRMS0=48,23,25|NIC0IP=10.28.0.130|NIC0
28/5/2019 9:40:58 DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
NIC0MAC=008064FB707A|RECP0=65474|SENDP0=17400|MIBSP0=1000üMbps||NIC1I
28/5/2019 9:40:58 P=0.0.0.0|
RECP1=0|SENDP1=0|MIBSP1=3üMbps||N
28/5/2019 9:40:58 IC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-
ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFE
28/5/2019 9:40:58
L=KB2727528,KB2729462,KB2737084,KB2753842,KB2756872,KB2757638,KB2761465,KB2769165,K
B2769166,KB2770917,KB2777294,KB2778344,KB2778
28/5/2019 9:40:58
,KB2790655,KB2790907,KB2792100,KB2793210,KB27
28/5/2019 9:40:58
33,KB2804583,KB2804584,KB2805222,KB2805227,KB
28/5/2019 9:40:58
7183,KB2818604,KB2820330,KB2821895,KB2822241,
28/5/2019 9:40:58
836988,KB2838727,KB2839894,KB2845533,KB284569
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\Mozillaü
28/5/2019 9:40:58 Firefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0
28/5/2019 9:40:58 .4420.1017|AP4=MicrosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVi
28/5/2019 9:40:58 sualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148||
9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDat
28/5/2019 9:40:58 abase|||AP7=MicrosoftüSilverlight|
+ü2005üRedis
28/5/2019 9:40:58 tributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:
28/5/2019 9:40:58 \ProgramüFiles\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application
28/5/2019 9:40:58 \chrome.exe|68.0.3440.106|AP12=MicrosoftüExcel|
C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-basedüwriteüf
28/5/2019 9:40:58 ilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\In
28/5/2019 9:40:58 ternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|
AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFIC
28/5/2019 9:40:58 E15\MSOXMLED.EXE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightV
28/5/2019 9:40:58 NC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Windows\System32\Uwfmgr.EXE
28/5/2019 9:40:58 |2.0.127.0|AP19=WindowsüContacts|
AP20=Microsoftü(R)üContactsüImportü
28/5/2019 9:40:58 Tool|C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15
28/5/2019 9:40:58 .0.4420.1017|WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
28/5/2019 9:40:58 Found HS Tag
ProcessMsg!
then clear it here
28/5/2019 9:40:58 Server Sent 5
28/5/2019 9:40:58 Enhanced QU : QUM :
28/5/2019 9:40:58 Enhanced QU : QUC :
28/5/2019 9:40:58 Enhanced QU : QUD :
28/5/2019 9:40:58 Server Sent 6
28/5/2019 9:40:58 LOOKING FOR &04
28/5/2019 9:40:58 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
28/5/2019 10:43:57 ip RETRIVED
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 10:43:57 Pipe not found
28/5/2019 10:43:57 The count is 7
28/5/2019 10:43:57 bCheckServer is 1
28/5/2019 10:43:57 bSet is 1
securePort: 443
28/5/2019 10:43:57 WDAVersion = 12.1.1.25
28/5/2019 10:43:58 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 10:43:59 -1|VI=1|
28/5/2019 10:43:59 Found HS Tag
ProcessMsg!
28/5/2019 10:43:59 Server Sent 5
28/5/2019 10:43:59 Enhanced QU : QUM :
28/5/2019 10:43:59 Enhanced QU : QUC :
28/5/2019 10:43:59 Enhanced QU : QUD :
28/5/2019 10:43:59 Server Sent 6
28/5/2019 10:43:59 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
28/5/2019 11:46:31 ip RETRIVED #C#
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 11:46:32 Pipe not found
28/5/2019 11:46:32 The count is 7
28/5/2019 11:46:32 bCheckServer is 1
28/5/2019 11:46:32 bSet is 1
securePort: 443
28/5/2019 11:46:32 WDAVersion = 12.1.1.25
28/5/2019 11:46:32 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|TPA=0|TPE=0|TPI=0|BLP=-1|BLE=-1|BLC
28/5/2019 11:46:33 =-1|VI=1|
28/5/2019 11:46:33 Found HS Tag
ProcessMsg!
28/5/2019 11:46:33 Server Sent 5
28/5/2019 11:46:33 Enhanced QU : QUM :
28/5/2019 11:46:33 Enhanced QU : QUC :
28/5/2019 11:46:33 Enhanced QU : QUD :
28/5/2019 11:46:33 Server Sent 6
28/5/2019 11:46:33 LOOKING FOR &04
28/5/2019 12:19:3 Received data: �'
Accept: */*
Connection: close
28/5/2019 12:19:3 =0.7,*;q=0.7

Accept: */*
Connection: close
28/5/2019 12:19:3 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
-2113922038
28/5/2019 12:19:4 ip RETRIVED
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 12:19:4 Pipe not found
28/5/2019 12:19:4 The count is 7
28/5/2019 12:19:4 bSet is 1
securePort: 443
28/5/2019 12:19:4 Calling V01
28/5/2019 12:19:4 Merlin version 354
28/5/2019 12:19:4 Signature 354
28/5/2019 12:19:5 Wyse Flag value 0011
28/5/2019 12:19:5 The iBLP value -1
28/5/2019 12:19:6 TZ Queried
Number
28/5/2019 12:19:6 FUR : GetCI() 1
28/5/2019 12:19:6 IP matched!
28/5/2019 12:19:6 Subnet ��#
28/5/2019 12:19:6 Gateway ��#
28/5/2019 12:19:6 DS �#
28/5/2019 12:19:6 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP= �
28/5/2019 12:19:6 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP= �
28/5/2019 12:19:6 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP= �
83FF-9A7F0B2B2
28/5/2019 12:19:6 E1E}
28/5/2019 12:19:6 Got reply from AgentUI=�^"
28/5/2019 12:19:6 GetDisplayInfo() return=��'
28/5/2019 12:19:6 Disk offset 659554304
28/5/2019 12:19:6 Disk 0 Part 1 TYPE 260

28/5/2019 12:19:6 Disk 0 Part 5 TYPE 261

28/5/2019 12:19:6 Secure boot = 1

28/5/2019 12:19:6 tempbuff = |WIN0=Microsoft Word|WIN1=Documento20 - Word|
WIN2=Documento19 - Word|WIN3=EXITO PLAZA BOLIVAR - Word|WIN4=Descargas|W
28/5/2019 12:19:6 IN5=(sin asunto) - julianbuitrago080@gmail.com - Gmail -
Google Chrome|WIN6=Equipo|WIN7=Convertidor PDF - Convierte archivos des
28/5/2019 12:19:6 de y hacia PDF gratis y online - Mozilla Firefox|
WIN8=Documento5 - Word|WIN9=Documento6 - Word|WIN10=Documento7 - Word|WIN11=Doc
28/5/2019 12:19:6 umento8 - Word|WIN12=Documento9 - Word|WIN13=Documento10 -
Word|WIN14=Documento11 - Word|WIN15=Documento12 - Word|WIN16=Document
28/5/2019 12:19:6 o13 - Word|WIN17=Documento14 - Word|WIN18=Documento15 - Word|
WIN19=Documento16 - Word|WIN20=Documento4 - Word|WIN21=BOSA - Word|
28/5/2019 12:19:6 WIN22=Program Manager|, num=0
28/5/2019 12:19:6 Msg recd from AgentGUI:|WIN0=Microsoft Word|WIN1=Documento20 -
Word|WIN2=Documento19 - Word|WIN3=EXITO PLAZA BOLIVAR - Word|WIN4
28/5/2019 12:19:6 =Descargas|WIN5=(sin asunto) - julianbuitrago080@gmail.com -
Gmail - Google Chrome|WIN6=Equipo|WIN7=Convertidor PDF - Convierte
28/5/2019 12:19:6 archivos desde y hacia PDF gratis y online - Mozilla Firefox|
WIN8=Documento5 - Word|WIN9=Documento6 - Word|WIN10=Documento7 - Wo
28/5/2019 12:19:6 rd|WIN11=Documento8 - Word|WIN12=Documento9 - Word|
WIN13=Documento10 - Word|WIN14=Documento11 - Word|WIN15=Documento12 - Word|WI
28/5/2019 12:19:6 N16=Documento13 - Word|WIN17=Documento14 - Word|
WIN18=Documento15 - Word|WIN19=Documento16 - Word|WIN20=Documento4 - Word|WIN21=
28/5/2019 12:19:6 BOSA - Word|WIN22=Program Manager|
28/5/2019 12:19:6 Got reply from AgentUI=��&
28/5/2019 12:19:6 return from ListAllApps=PV'
28/5/2019 12:19:12 size of qfe list 64
28/5/2019 12:19:13 Value found for LocalXMLPath = P�$
28/5/2019 12:19:13 WDAVersion = 12.1.1.25
28/5/2019 12:19:13 GetCI() done
28/5/2019 12:19:13 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
view-usbd.exe|PRC37=wmiprvse.exe|PRC38=svchost.exe|PRC39=DtcWdaUi.ex
28/5/2019 12:19:13 e|PRC40=hagent.exe|PRC41=HAgent_UI.exe|PRC42=tvnserver.exe|
PRC43=RAVCpl64.exe|PRC44=concentr.exe|PRC45=redirector.exe|PRC46=PNUS
28/5/2019 12:19:13 BCLITRAY.exe|PRC47=PNTray.exe|PRC48=Receiver.exe|
PRC49=SelfServicePlugin.exe|PRC50=wfcrun32.exe|PRC51=CcmExec.exe|PRC52=wmiprvse
28/5/2019 12:19:13 .exe|PRC53=wmiprvse.exe|PRC54=WINWORD.EXE|
PRC55=MendeleyWordPlugin.exe|PRC56=SearchIndexer.exe|PRC57=firefox.exe|
PRC58=firefox.e
28/5/2019 12:19:13 xe|PRC59=firefox.exe|PRC60=firefox.exe|PRC61=firefox.exe|
PRC62=chrome.exe|PRC63=chrome.exe|PRC64=chrome.exe|PRC65=chrome.exe|PRC
28/5/2019 12:19:13 66=chrome.exe|PRC67=chrome.exe|PRC68=chrome.exe|
PRC69=chrome.exe|PRC70=SearchProtocolHost.exe|PRC71=SearchFilterHost.exe|PRC72=s
28/5/2019 12:19:13 vchost.exe|PRC73=wmiprvse.exe||WIN0=MicrosoftüWord|
WIN1=Documento20ü-üWord|WIN2=Documento19ü-üWord|WIN3=EXITOüPLAZAüBOLIV
28/5/2019 12:19:13 ARü-üWord|WIN4=Descargas|WIN5=(sinüasunto)ü-
üjulianbuitrago080@gmail.comü-üGmailü-üGoogleüChrome|WIN6=Equipo|WIN7=Conv
28/5/2019 12:19:13 ertidorüPDFü-
üConvierteüarchivosüdesdeüyühaciaüPDFügratisüyüonlineü-üMozillaüFirefox|
WIN8=Documento5ü-üWord|WIN9
28/5/2019 12:19:13 =Documento6ü-üWord|WIN10=Documento7ü-üWord|WIN11=Documento8ü-
üWord|WIN12=Documento9ü-üWord|WIN13=Documento10ü-üWord|WI
28/5/2019 12:19:13 N14=Documento11ü-üWord|WIN15=Documento12ü-üWord|
WIN16=Documento13ü-üWord|WIN17=Documento14ü-üWord|WIN18=Documento15ü-ü
28/5/2019 12:19:13 Word|WIN19=Documento16ü-üWord|WIN20=Documento4ü-üWord|
WIN21=BOSAü-üWord|WIN22=ProgramüManager||PMIU=66|TBPM=7786256|FBPM=
28/5/2019 12:19:13 2612164|TBPF=7786256|FBPF=1907724|TBVM=8589934464|
FKVM=8589863336|FKEM=0|CPRMS0=119,14,34|NIC0IP=10.28.0.130|NIC0DESC=Ethernet,I
28/5/2019 12:19:13 nventecüPCIeüGBEüFamilyüControllerü#2|NIC0MAC=008064FB707A|
RECP0=223514|SENDP0=97530|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1
28/5/2019 12:19:13 DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
28/5/2019 12:19:13 NIC2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|QFEL=KB2727528,KB
28/5/2019 12:19:13
0917,KB2777294,KB2778344,KB2778930,KB2779562,
28/5/2019 12:19:13
790907,KB2792100,KB2793210,KB2794119,KB279459
28/5/2019 12:19:13
B2804584,KB2805222,KB2805227,KB2807986,KB2808
28/5/2019 12:19:13
,KB2820330,KB2821895,KB2822241,KB2829069,KB28
28/5/2019 12:19:13
27,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü
28/5/2019 12:19:13 18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2
28/5/2019 12:19:13 |AP2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4
28/5/2019 12:19:13 =MicrosoftüOfficeüProfessionalüPlusü2013|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=Mi
28/5/2019 12:19:13 crosoftüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x
28/5/2019 12:19:13 64)||8.0.61000|AP9=WyseüDeviceüAgent|
C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHorizonüViewüClient|
C:\ProgramüFile
28/5/2019 12:19:13 s\VMware\VMwareüView\Client\|5.4.0.1219906|
AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68
28/5/2019 12:19:13 .0.3440.106|AP12=MicrosoftüExcel|
basedüwriteüfilterümanager
28/5/2019 12:19:13 |C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\InternetüExplor
28/5/2019 12:19:13 er\IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.E
28/5/2019 12:19:13 XE|15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|C:\Program�
28/5/2019 12:19:13 �Files\TightVNC\tvnserver.exe|2.6.4.0|
AP1
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\Progra
28/5/2019 12:19:13 müFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|W
28/5/2019 12:19:13 CM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
28/5/2019 12:19:13 Found HS Tag
ProcessMsg!
28/5/2019 12:19:13 Server Sent 5
28/5/2019 12:19:13 Enhanced QU : QUM :
28/5/2019 12:19:13 Enhanced QU : QUC :
28/5/2019 12:19:13 Enhanced QU : QUD :
28/5/2019 12:19:13 Server Sent 6
28/5/2019 12:19:13 LOOKING FOR &04
28/5/2019 12:19:13 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
28/5/2019 13:21:24 ip RETRIVED #C#
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 13:21:24 Pipe not found
28/5/2019 13:21:24 The count is 7
28/5/2019 13:21:24 bCheckServer is 1
28/5/2019 13:21:24 bSet is 1
securePort: 443
28/5/2019 13:21:24 Value found for LocalXMLPath = `�$
28/5/2019 13:21:24 WDAVersion = 12.1.1.25
28/5/2019 13:21:25 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 13:21:26 -1|VI=1|
28/5/2019 13:21:26 Found HS Tag
ProcessMsg!
28/5/2019 13:21:26 Server Sent 5
28/5/2019 13:21:26 Enhanced QU : QUM :
28/5/2019 13:21:26 Enhanced QU : QUC :
28/5/2019 13:21:26 Enhanced QU : QUD :
28/5/2019 13:21:26 Server Sent 6
28/5/2019 13:21:26 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
28/5/2019 14:24:16 ip RETRIVED �K#
10.20.15.151, SecurePort: 443
28/5/2019 14:24:16 SETTING REG TO VALUE �K#
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 14:24:16 Pipe not found
28/5/2019 14:24:16 The count is 7
28/5/2019 14:24:16 bCheckServer is 1
28/5/2019 14:24:16 bSet is 1
securePort: 443
28/5/2019 14:24:16 Value found for LocalXMLPath = ��$
28/5/2019 14:24:17 WDAVersion = 12.1.1.25
28/5/2019 14:24:17 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 14:24:18 -1|VI=1|
28/5/2019 14:24:18 Found HS Tag
ProcessMsg!
28/5/2019 14:24:18 Server Sent 5
28/5/2019 14:24:18 Enhanced QU : QUM :
28/5/2019 14:24:18 Enhanced QU : QUC :
28/5/2019 14:24:18 Enhanced QU : QUD :
28/5/2019 14:24:18 Server Sent 6
28/5/2019 14:24:18 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
28/5/2019 15:27:11 ip RETRIVED #T#
10.20.15.151, SecurePort: 443
28/5/2019 15:27:11 SETTING REG TO VALUE #T#
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 15:27:11 Pipe not found
28/5/2019 15:27:11 The count is 7
28/5/2019 15:27:11 bCheckServer is 1
28/5/2019 15:27:11 bSet is 1
securePort: 443
28/5/2019 15:27:11 Value found for LocalXMLPath = ��$
28/5/2019 15:27:12 WDAVersion = 12.1.1.25
28/5/2019 15:27:12 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 15:27:13 -1|VI=1|
28/5/2019 15:27:13 Found HS Tag
ProcessMsg!
28/5/2019 15:27:13 Server Sent 5
28/5/2019 15:27:13 Enhanced QU : QUM :
28/5/2019 15:27:13 Enhanced QU : QUC :
28/5/2019 15:27:13 Enhanced QU : QUD :
28/5/2019 15:27:13 Server Sent 6
28/5/2019 15:27:13 LOOKING FOR &04
28/5/2019 16:19:54 Received data: �'
Accept: */*
28/5/2019 16:19:54 jects/mechanize/)
Connection: close
28/5/2019 16:19:54 =0.7,*;q=0.7

Accept: */*
Connection: close
28/5/2019 16:19:54 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
28/5/2019 16:19:54 ip RETRIVED
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 16:19:54 Pipe not found
28/5/2019 16:19:54 The count is 7
28/5/2019 16:19:54 bCheckServer is 1
28/5/2019 16:19:54 bSet is 1
securePort: 443
28/5/2019 16:19:54 Calling V01
28/5/2019 16:19:54 Merlin version 354
28/5/2019 16:19:54 Signature 354
28/5/2019 16:19:55 Wyse Flag value 0011
28/5/2019 16:19:56 The iBLP value -1
28/5/2019 16:19:56 TZ Queried
Number
28/5/2019 16:19:57 FUR : GetCI() 1
28/5/2019 16:19:57 IP matched!
28/5/2019 16:19:57 Subnet ��#
28/5/2019 16:19:57 Gateway ��#
28/5/2019 16:19:57 DS �#
28/5/2019 16:19:57 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=@�
28/5/2019 16:19:57 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=@�
28/5/2019 16:19:57 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=@�
83FF-9A7F0B2B2
28/5/2019 16:19:57 E1E}
28/5/2019 16:19:57 Got reply from AgentUI=�V"
28/5/2019 16:19:57 Disk offset 659554304
28/5/2019 16:19:57 Disk 0 Part 1 TYPE 260

28/5/2019 16:19:57 Disk 0 Part 5 TYPE 261

28/5/2019 16:19:57 Secure boot = 1

28/5/2019 16:19:57 Got reply from AgentUI=��&
28/5/2019 16:20:3 size of qfe list 64
28/5/2019 16:20:3 Value found for LocalXMLPath = P�$
28/5/2019 16:20:3 WDAVersion = 12.1.1.25
28/5/2019 16:20:3 GetCI() done
28/5/2019 16:20:3 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
415GAüSOCüwithüRadeon(tm)üHDüGraphicsüüü|CPS=1497|B1=1.0F|PD2=|PD1=AMDüHighüDe
28/5/2019 16:20:3 finitionüAudioüDevice|CO=|LO=|OSDSK=0||Disk0=0|
DiskSize0=32012789760|D0PAR1SZ=104857600|D0PAR1STOFF=1048576|D0PAR1TYPE=260|D0P
28/5/2019 16:20:3 ARBOOT=5|D0PAR2SZ=314572800|D0PAR2STOFF=105906176|
D0PAR2TYPE=257|D0PARBOOT=5|D0PAR3SZ=104857600|D0PAR3STOFF=420478976|D0PAR3TYPE
28/5/2019 16:20:3 =258|D0PARBOOT=5|D0PAR4SZ=134217728|D0PAR4STOFF=525336576|
D0PAR4TYPE=259|D0PARBOOT=5|D0PAR5SZ=30708596736|D0PAR5STOFF=659554304|
28/5/2019 16:20:3 D0PAR5TYPE=261|D0PARBOOT=5||UEFISEC=1|DRV0=C:|TB0=30708592640|
TFB0=15952740352|DRV1=Z:|TB1=1073643520|TFB1=1057226752||PRC0=smss
28/5/2019 16:20:3 .exe|PRC1=csrss.exe|PRC2=wininit.exe|PRC3=csrss.exe|
PRC4=winlogon.exe|PRC5=services.exe|PRC6=lsass.exe|PRC7=svchost.exe|PRC8=svc
28/5/2019 16:20:3 host.exe|PRC9=atiesrxx.exe|PRC10=svchost.exe|
PRC11=svchost.exe|PRC12=svchost.exe|PRC13=dwm.exe|PRC14=svchost.exe|PRC15=svchost.e
28/5/2019 16:20:3 xe|PRC16=DtcPlatformSvc.exe|PRC17=Explorer.EXE|
PRC18=spoolsv.exe|PRC19=svchost.exe|PRC20=taskhostex.exe|PRC21=svchost.exe|PRC22=
28/5/2019 16:20:3 svchost.exe|PRC23=mqsvc.exe|PRC24=NetXClean.exe|
PRC25=pnusbvirtualhubwssrv.exe|PRC26=tcpsvcs.exe|PRC27=snmp.exe|PRC28=tvnserver.
28/5/2019 16:20:3 exe|PRC29=UWFSvc.exe|PRC30=MsMpEng.exe|PRC31=wsnm.exe|
PRC32=DtcWDAService.exe|PRC33=mqtgsvc.exe|PRC34=vmware-usbarbitrator64.exe
28/5/2019 16:20:3 |PRC35=vmware-view-usbd.exe|PRC36=wmiprvse.exe|
PRC37=svchost.exe|PRC38=hagent.exe|PRC39=CcmExec.exe|PRC40=wmiprvse.exe|PRC41=wmi
28/5/2019 16:20:3 prvse.exe|PRC42=SearchIndexer.exe|PRC43=chrome.exe|
PRC44=chrome.exe|PRC45=chrome.exe|PRC46=chrome.exe|PRC47=chrome.exe|PRC48=chr
PRC52=chrome.exe|PRC53=chrome.exe|PRC54=EXCEL.EXE|PRC55=DllHost.exe|P
28/5/2019 16:20:3 RC56=TrustedInstaller.exe|PRC57=TiWorker.exe|
PRC58=makecab.exe|PRC59=conhost.exe|PRC60=wmiprvse.exe|PRC61=chrome.exe|PRC62=makec
28/5/2019 16:20:3 ab.exe||PMIU=45|TBPM=7786256|FBPM=4252848|TBPF=7786256|
FBPF=3848820|TBVM=8589934464|FKVM=8589863336|FKEM=0|CPRMS0=141,17,34|NIC0
28/5/2019 16:20:3 IP=10.28.0.130|
RECP0=439606|SENDP0=199761|MIB
28/5/2019 16:20:3 SP0=1000üMbps||NIC1IP=0.0.0.0|
RECP1=0|SENDP
28/5/2019 16:20:3 1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
SENDP2
28/5/2019 16:20:3 =0|MIBSP2=0üMbps|
5,KB2769166,KB2770917,KB277
28/5/2019 16:20:3
0,KB2789649,KB2789650,KB2790655,KB2790907,KB2
28/5/2019 16:20:3
805,KB2799494,KB2800033,KB2804583,KB2804584,K
28/5/2019 16:20:3
13170,KB2813430,KB2817183,KB2818604,KB2820330
28/5/2019 16:20:3
2836946,KB2836947,KB2836988,KB2838727,KB28398
28/5/2019 16:20:3 94,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\Pro
28/5/2019 16:20:3 gramüFiles\MozillaüFirefox|61.0.2|
C:\ProgramüFiles\M
28/5/2019 16:20:3 icrosoftüOffice|15.0.4420.1017|
15.0.4420.1
28/5/2019 16:20:3 017|AP5=MicrosoftüVisualüC++ü2008üRedistributableü-
üx64ü9.0.30729.4148||9.0.30729.4148|AP6=MicrosoftüWindowsüEmbeddedü
28/5/2019 16:20:3 KeyboardüFilterüDatabase|||AP7=MicrosoftüSilverlight|
c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVis
28/5/2019 16:20:3 ualüC++ü2005üRedistributableü(x64)||8.0.61000|
AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|AP10=VMwareüHor
28/5/2019 16:20:3 izonüViewüClient|C:\ProgramüFiles\VMware\VMwareüView\Client\|
5.4.0.1219906|AP11=GoogleüChrome|C:\ProgramüFilesü(x86)\Goog
28/5/2019 16:20:3 le\Chrome\Application\chrome.exe|68.0.3440.106|
AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13
28/5/2019 16:20:3 =File-basedüwriteüfilterümanager|
AP14=DiagnosticsüutilityüforüInternetüExplorer
28/5/2019 16:20:3 |C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|
10.0.9200.16384|AP15=OfficeüXMLüHandler|C:\ProgramüFiles\CommonüFiles\Mi
28/5/2019 16:20:3 crosoftüShared\OFFICE15\MSOXMLED.EXE|15.0.4420.1017|
AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.
28/5/2019 16:20:3 4420.1017|AP17=TightVNC|
AP18=UnifiedüWriteüFilterüManagerüManager|C:\Window
28/5/2019 16:20:3 s\System32\Uwfmgr.EXE|2.0.127.0|AP19=WindowsüContacts|
C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|AP20=Microsoftü(R
28/5/2019 16:20:3 )üContactsüImportüTool|
C:\PROGRA~1\MICROS~1\Of
28/5/2019 16:20:3 fice15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WDA=1|
28/5/2019 16:20:4 Found HS Tag
ProcessMsg!
then clear it here
28/5/2019 16:20:4 Server Sent 5
28/5/2019 16:20:4 Enhanced QU : QUM :
28/5/2019 16:20:4 Enhanced QU : QUC :
28/5/2019 16:20:4 Enhanced QU : QUD :
28/5/2019 16:20:4 Server Sent 6
28/5/2019 16:20:4 LOOKING FOR &04
28/5/2019 16:20:4 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
28/5/2019 16:24:20 ip RETRIVED �J#
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
28/5/2019 16:24:26 C80B-4C42-8011-32B62020ACA3}, Type=6
28/5/2019 16:24:26 476A-8590-E6333C53F805}, Type=71
28/5/2019 16:24:31 Connect failed
10.20.15.151
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
28/5/2019 16:24:31 ip RETRIVED �J#
10.20.15.151, SecurePort: 443
HServer
10.20.15.151, Port: 0
5 ms
reported: 28
28/5/2019 16:24:37 C80B-4C42-8011-32B62020ACA3}, Type=6
28/5/2019 16:24:37 476A-8590-E6333C53F805}, Type=71
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
28/5/2019 17:27:40 ip RETRIVED PX#
10.20.15.151, SecurePort: 443
28/5/2019 17:27:40 SETTING REG TO VALUE PX#
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 17:27:40 Pipe not found
28/5/2019 17:27:40 The count is 7
28/5/2019 17:27:40 bCheckServer is 1
28/5/2019 17:27:40 bSet is 1
securePort: 443
28/5/2019 17:27:40 Calling V01
28/5/2019 17:27:40 Merlin version 354
28/5/2019 17:27:40 Signature 354
28/5/2019 17:27:41 Wyse Flag value 0011
28/5/2019 17:27:42 The iBLP value -1
28/5/2019 17:27:42 TZ Queried
Number
28/5/2019 17:27:42 FUR : GetCI() 1
28/5/2019 17:27:42 IP matched!
28/5/2019 17:27:42 Subnet ��#
28/5/2019 17:27:42 Gateway ��#
28/5/2019 17:27:42 DS �#
83FF-9A7F0B2B2
28/5/2019 17:27:42 E1E}
28/5/2019 17:27:43 Disk offset 659554304
28/5/2019 17:27:43 Disk 0 Part 1 TYPE 260

28/5/2019 17:27:43 Disk 0 Part 5 TYPE 261

28/5/2019 17:27:43 Secure boot = 1

28/5/2019 17:27:48 size of qfe list 64
28/5/2019 17:27:49 Value found for LocalXMLPath = �U&
28/5/2019 17:27:49 WDAVersion = 12.1.1.25
28/5/2019 17:27:49 GetCI() done
28/5/2019 17:27:49 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
28/5/2019 17:27:49 D0PAR5TYPE=261|D0PARBOOT=5||UEFISEC=1|DRV0=C:|
TB0=30708592640|TFB0=15952592896|DRV1=Z:|TB1=1073643520|TFB1=1057193984||PRC0=smss
PRC52=chrome.exe|PRC53=chrome.exe|PRC54=EXCEL.EXE|PRC55=DllHost.exe|P
28/5/2019 17:27:49 RC56=taskhostex.exe|PRC57=taskhost.exe|
PRC58=TrustedInstaller.exe|PRC59=TiWorker.exe|PRC60=makecab.exe|PRC61=conhost.exe|
PRC62=t
28/5/2019 17:27:49 askeng.exe|PRC63=wmiprvse.exe||PMIU=45|TBPM=7786256|
FBPM=4242524|TBPF=7786256|FBPF=3811872|TBVM=8589934464|FKVM=8589863336|FKEM=
28/5/2019 17:27:49 0|CPRMS0=141,0,34|NIC0IP=10.28.0.130|
RECP0=44
NIC1DESC=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F042
28/5/2019 17:27:49 1CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|
28/5/2019 17:27:49 CED66F6|RECP2=0|SENDP2=0|MIBSP2=0üMbps|
5,KB2
28/5/2019 17:27:49
197,KB2785094,KB2785220,KB2789649,KB2789650,K
28/5/2019 17:27:49
98802,KB2798804,KB2798805,KB2799494,KB2800033
28/5/2019 17:27:49
2811660,KB2812822,KB2813170,KB2813430,KB28171
28/5/2019 17:27:49
KB2830290,KB2832450,KB2836946,KB2836947,KB283
28/5/2019 17:27:49 6988,KB2838727,KB2839894,KB2845533,KB2845690,|AP0=7-
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|AP1=MozillaüFirefoxü61.0.
28/5/2019 17:27:49 2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|
AP2=MozillaüMaintenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü20
28/5/2019 17:27:49 13|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|
AP4=MicrosoftüOfficeüProfessionalüPlusü2013|C:\ProgramüFiles\Microsof
28/5/2019 17:27:49 tüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC+
+ü2008üRedistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|AP6=Microsof
28/5/2019 17:27:49 tüWindowsüEmbeddedüKeyboardüFilterüDatabase|||
8.0.61000|AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1
28/5/2019 17:27:49 .1.25|AP10=VMwareüHorizonüViewüClient|
C:\Prog
28/5/2019 17:27:49 ramüFilesü(x86)\Google\Chrome\Application\chrome.exe|
68.0.3440.106|AP12=MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.E
28/5/2019 17:27:49 XE|15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|
C:\Windows\System32\fbwfmgr.EXE|2.0.449.0|AP14=Diagnosticsüutilityüf
28/5/2019 17:27:49 orüInternetüExplorer|
AP15=OfficeüXMLüHandler|C:\Programü
28/5/2019 17:27:49 Files\CommonüFiles\MicrosoftüShared\OFFICE15\MSOXMLED.EXE|
15.0.4420.1017|AP16=MicrosoftüPowerPoint|C:\PROGRA~1\MICROS~1\Offic
28/5/2019 17:27:49 e15\POWERPNT.EXE|15.0.4420.1017|AP17=TightVNC|
C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18=UnifiedüWriteüFilterüMana
28/5/2019 17:27:49 gerüManager|C:\Windows\System32\Uwfmgr.EXE|2.0.127.0|
AP19=WindowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16
28/5/2019 17:27:49 384|AP20=Microsoftü(R)üContactsüImportüTool|
C:\ProgramüFiles\WindowsüMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|C
28/5/2019 17:27:49 :\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|
28/5/2019 17:27:49 Found HS Tag
ProcessMsg!
28/5/2019 17:27:50 Server Sent 5
28/5/2019 17:27:50 Enhanced QU : QUM :
28/5/2019 17:27:50 Enhanced QU : QUC :
28/5/2019 17:27:50 Enhanced QU : QUD :
28/5/2019 17:27:50 Server Sent 6
28/5/2019 17:27:50 LOOKING FOR &04
28/5/2019 17:27:50 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
28/5/2019 18:30:47 ip RETRIVED PX#
10.20.15.151, SecurePort: 443
28/5/2019 18:30:47 SETTING REG TO VALUE PX#
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 18:30:47 Pipe not found
28/5/2019 18:30:48 The count is 7
28/5/2019 18:30:48 bCheckServer is 1
28/5/2019 18:30:48 bSet is 1
securePort: 443
28/5/2019 18:30:48 WDAVersion = 12.1.1.25
28/5/2019 18:30:48 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 18:30:49 -1|VI=1|
28/5/2019 18:30:49 Found HS Tag
ProcessMsg!
28/5/2019 18:30:49 Server Sent 5
28/5/2019 18:30:49 Enhanced QU : QUM :
28/5/2019 18:30:49 Enhanced QU : QUC :
28/5/2019 18:30:49 Enhanced QU : QUD :
28/5/2019 18:30:49 Server Sent 6
28/5/2019 18:30:49 LOOKING FOR &04
28/5/2019 19:14:50 Received data: �'

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
28/5/2019 19:14:51 ip RETRIVED
10.20.15.151, SecurePort: 443
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
28/5/2019 19:14:51 Pipe not found
28/5/2019 19:14:51 The count is 7
28/5/2019 19:14:51 bCheckServer is 1
28/5/2019 19:14:51 bSet is 1
securePort: 443
28/5/2019 19:14:51 Calling V01
28/5/2019 19:14:51 Merlin version 354
28/5/2019 19:14:51 Signature 354
28/5/2019 19:14:52 Wyse Flag value 0011
28/5/2019 19:14:53 The iBLP value -1
28/5/2019 19:14:53 TZ Queried
Number
28/5/2019 19:14:53 FUR : GetCI() 1
28/5/2019 19:14:53 IP matched!
28/5/2019 19:14:53 Subnet ��#
28/5/2019 19:14:53 Gateway ��#
28/5/2019 19:14:53 DS �#
28/5/2019 19:14:53 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=`�
28/5/2019 19:14:53 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=`�
28/5/2019 19:14:53 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=`�
83FF-9A7F0B2B2
28/5/2019 19:14:53 E1E}
28/5/2019 19:14:54 Disk offset 659554304
28/5/2019 19:14:54 Disk 0 Part 1 TYPE 260

28/5/2019 19:14:54 Disk 0 Part 5 TYPE 261

28/5/2019 19:14:54 Secure boot = 1

28/5/2019 19:15:0 size of qfe list 64
28/5/2019 19:15:0 Value found for LocalXMLPath = ~&
28/5/2019 19:15:0 WDAVersion = 12.1.1.25
28/5/2019 19:15:0 GetCI() done
28/5/2019 19:15:0 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
28/5/2019 19:15:0 D0PAR5TYPE=261|D0PARBOOT=5||UEFISEC=1|DRV0=C:|TB0=30708592640|
TFB0=16019787776|DRV1=Z:|TB1=1073643520|TFB1=1057193984||PRC0=smss
28/5/2019 19:15:0 ome.exe|PRC49=TrustedInstaller.exe|PRC50=TiWorker.exe|
PRC51=makecab.exe|PRC52=conhost.exe|PRC53=chrome.exe|PRC54=chrome.exe|PRC5
28/5/2019 19:15:0 5=wmiprvse.exe|PRC56=TrustedInstaller.exe|PRC57=TiWorker.exe|
PRC58=makecab.exe|PRC59=conhost.exe||PMIU=42|TBPM=7786256|FBPM=4486
28/5/2019 19:15:0 744|TBPF=7786256|FBPF=4228424|TBVM=8589934464|FKVM=8589863336|
FKEM=0|CPRMS0=158,17,34|NIC0IP=10.28.0.130|NIC0DESC=Ethernet,Inven
RECP0=570430|SENDP0=232255|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DES
28/5/2019 19:15:0 C=Ethernet,BluetoothüDeviceü(PersonalüAreaüNetwork)|
NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC
28/5/2019 19:15:0 2DESC=Ethernet,Intel(R)üDualüBandüWireless-ACü7260|
28/5/2019 19:15:0
7,KB2777294,KB2778344,KB2778930,KB2779562,KB2
28/5/2019 19:15:0
907,KB2792100,KB2793210,KB2794119,KB2794599,K
28/5/2019 19:15:0
04584,KB2805222,KB2805227,KB2807986,KB2808679
28/5/2019 19:15:0
2820330,KB2821895,KB2822241,KB2829069,KB28292
28/5/2019 19:15:0
KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18.
28/5/2019 19:15:0 05ü(x64)|C:\ProgramüFiles\7-Zip\|18.05|
AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP
28/5/2019 19:15:0 2=MozillaüMaintenanceüService||61.0.2|
AP3=MicrosoftüLyncüVdiü2013|C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=Mi
28/5/2019 19:15:0 crosoftüOfficeüProfessionalüPlusü2013|
C:\ProgramüFiles\MicrosoftüOffice\|15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008ü
28/5/2019 19:15:0 Redistributableü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=Micro
28/5/2019 19:15:0 softüSilverlight|c:\ProgramüFiles\MicrosoftüSilverlight\|
5.1.20125.0|AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)
28/5/2019 19:15:0 ||8.0.61000|AP9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|
12.1.1.25|AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\V
28/5/2019 19:15:0 Mware\VMwareüView\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.
28/5/2019 19:15:0 3440.106|AP12=MicrosoftüExcel|
basedüwriteüfilterümanager|C:
28/5/2019 19:15:0 \Windows\System32\fbwfmgr.EXE|2.0.449.0|
AP14=DiagnosticsüutilityüforüInternetüExplorer|C:\ProgramüFiles\InternetüExplorer\
28/5/2019 19:15:0 IEDIAGCMD.EXE|10.0.9200.16384|AP15=OfficeüXMLüHandler|
28/5/2019 19:15:0 15.0.4420.1017|AP16=MicrosoftüPowerPoint|
C:\ProgramüFi
28/5/2019 19:15:0 les\TightVNC\tvnserver.exe|2.6.4.0|
AP19=W
28/5/2019 19:15:0 indowsüContacts|C:\ProgramüFiles\WindowsüMail\wab.exe|
6.2.9200.16384|AP20=Microsoftü(R)üContactsüImportüTool|C:\Programü
28/5/2019 19:15:0 Files\WindowsüMail\wabmig.exe|6.2.9200.16384|
AP21=MicrosoftüWord|C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_
28/5/2019 19:15:0 CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|
28/5/2019 19:15:0 Found HS Tag
ProcessMsg!
then clear it here
28/5/2019 19:15:0 Server Sent 5
28/5/2019 19:15:0 Enhanced QU : QUM :
28/5/2019 19:15:0 Enhanced QU : QUC :
28/5/2019 19:15:0 Enhanced QU : QUD :
28/5/2019 19:15:0 Server Sent 6
28/5/2019 19:15:0 LOOKING FOR &04
28/5/2019 19:15:0 FUR :After S&P done
29/5/2019 8:29:57 ***********************************************************
29/5/2019 8:29:57 End of WinMain()
29/5/2019 8:29:57 ^^^^^^^^ after reghanex()
29/5/2019 8:30:21 OS Version 6.2.9200
29/5/2019 8:30:21 OS Version 6.2.9200
29/5/2019 8:30:21 Major version 6
29/5/2019 8:30:21 Minor version 2
29/5/2019 8:30:21 Device Info: OS is �#
29/5/2019 8:30:21 WRITE FILTER UWF 1
29/5/2019 8:30:21 Setting UWF Mgr!
29/5/2019 8:30:21 Disk offset 659554304
29/5/2019 8:30:21 Disk offset =1048576

29/5/2019 8:30:21 Disk offset =105906176
29/5/2019 8:30:21 Disk offset =420478976
29/5/2019 8:30:21 Disk offset =525336576
29/5/2019 8:30:21 Disk offset =659554304

'Z:\',error=1
29/5/2019 8:30:21 AF_INET (IPv4)
29/5/2019 8:30:21 IPv4 address 10.28.0.130
29/5/2019 8:30:21 Valid IP Found

29/5/2019 8:30:21 HTTPListen :: Port 80
scripts!
upgrade scenario!
processed!
securePort: 443
securePort: 443
29/5/2019 8:30:21 HA Supported
29/5/2019 8:30:21 dwHSListCount = 1
GetServerAddress
securePort: 443
HuntForAltLocalIP
-2113922038
29/5/2019 8:30:22 ip RETRIVED p�#
10.20.15.151, SecurePort: 443
29/5/2019 8:30:22 SETTING REG TO VALUE p�#
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
29/5/2019 8:30:23 Pipe not found
29/5/2019 8:30:23 The count is 7
29/5/2019 8:30:23 bSet is 1
securePort: 443
29/5/2019 8:30:23 Calling V01
29/5/2019 8:30:23 Merlin version 354
29/5/2019 8:30:23 Signature 354
29/5/2019 8:30:24 Wyse Flag value 0011
29/5/2019 8:30:24 The iBLP value -1
29/5/2019 8:30:25 TZ Queried
Number
29/5/2019 8:30:25 FUR : GetCI() 1
29/5/2019 8:30:25 IP matched!
29/5/2019 8:30:25 Subnet @�#
29/5/2019 8:30:25 Gateway `�#
29/5/2019 8:30:25 DS 5#
29/5/2019 8:30:25 Service Name: {09788E12-C80B-4C42-8011-32B62020ACA3}, IP=p�#
29/5/2019 8:30:25 Service Name: {51276593-95B4-476A-8590-E6333C53F805}, IP=p�#
29/5/2019 8:30:25 Service Name: {F1C924B6-FC2F-42D4-83FF-9A7F0B2B2E1E}, IP=p�#
83FF-9A7F0B2B2
29/5/2019 8:30:25 E1E}
29/5/2019 8:30:25 Got reply from AgentUI=@q#
29/5/2019 8:30:25 GetDisplayInfo() return=pN#
29/5/2019 8:30:25 Disk offset 659554304
29/5/2019 8:30:25 Disk 0 Part 1 TYPE 260

29/5/2019 8:30:25 Disk 0 Part 5 TYPE 261

29/5/2019 8:30:25 Secure boot = 1

29/5/2019 8:30:25 return from ListAllApps=0#
29/5/2019 8:30:32 size of qfe list 64
29/5/2019 8:30:33 WDAVersion = 12.1.1.25
29/5/2019 8:30:33 GetCI() done
'Z:\',error=1
securePort: 443
29/5/2019 8:30:33 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC24=GoogleUpdate.exe|PRC25=svchost.exe|PRC26=mqsvc.exe|PRC27=NetXCle
29/5/2019 8:30:33 d.exe|PRC40=svchost.exe|PRC41=wmiprvse.exe|PRC42=vssvc.exe|
PRC43=SearchIndexer.exe|PRC44=svchost.exe|PRC45=SearchFilterHost.exe|
29/5/2019 8:30:33 PRC46=msiexec.exe|PRC47=DtcWdaUi.exe|PRC48=hagent.exe|
PRC49=HAgent_UI.exe|PRC50=tvnserver.exe|PRC51=RAVCpl64.exe|PRC52=concentr.
29/5/2019 8:30:33 exe|PRC53=redirector.exe|PRC54=PNUSBCLITRAY.exe|
PRC55=PNTray.exe|PRC56=Receiver.exe|PRC57=SelfServicePlugin.exe|PRC58=wfcrun32.e
29/5/2019 8:30:33 xe||WIN0=ProgramüManager||PMIU=34|TBPM=7786256|FBPM=5127388|
TBPF=7786256|FBPF=5064072|TBVM=8589934464|FKVM=8589864352|FKEM=0|CP
29/5/2019 8:30:33 RMS0=0,0,0|NIC0IP=10.28.0.130|
RECP0=1790|SEND
5,KB2769166,KB277
29/5/2019 8:30:33
4,KB2785220,KB2789649,KB2789650,KB2790655,KB2
29/5/2019 8:30:33
804,KB2798805,KB2799494,KB2800033,KB2804583,K
29/5/2019 8:30:33
12822,KB2813170,KB2813430,KB2817183,KB2818604
29/5/2019 8:30:33
2832450,KB2836946,KB2836947,KB2836988,KB28387
29/5/2019 8:30:33 27,KB2839894,KB2845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|
C:\ProgramüFilesü
29/5/2019 8:30:33 .EXE|15.0.4420.1017|AP17=TightVNC|
C:\PROGRA~1\M
29/5/2019 8:30:33 Found HS Tag
ProcessMsg!
then clear it here
29/5/2019 8:30:33 Server Sent 5
29/5/2019 8:30:33 Enhanced QU : QUM :
29/5/2019 8:30:33 Enhanced QU : QUC :
29/5/2019 8:30:33 Enhanced QU : QUD :
29/5/2019 8:30:33 Server Sent 6
29/5/2019 8:30:33 LOOKING FOR &04
29/5/2019 8:30:33 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
-2113922038
29/5/2019 9:34:12 ip RETRIVED @G#
10.20.15.151, SecurePort: 443
29/5/2019 9:34:12 SETTING REG TO VALUE @G#
HuntForAltLocalIP
secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
29/5/2019 9:34:12 Pipe not found
29/5/2019 9:34:12 The count is 7
29/5/2019 9:34:12 bSet is 1
securePort: 443
29/5/2019 9:34:12 WDAVersion = 12.1.1.25
29/5/2019 9:34:13 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
29/5/2019 9:34:13 VI=1|
29/5/2019 9:34:13 Found HS Tag
ProcessMsg!
then clear it here
29/5/2019 9:34:13 Server Sent 5
29/5/2019 9:34:13 Enhanced QU : QUM :
29/5/2019 9:34:13 Enhanced QU : QUC :
29/5/2019 9:34:13 Enhanced QU : QUD :
29/5/2019 9:34:13 Server Sent 6
29/5/2019 9:34:13 LOOKING FOR &04
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
29/5/2019 10:37:44 ip RETRIVED �L#
10.20.15.151, SecurePort: 443
29/5/2019 10:37:44 SETTING REG TO VALUE �L#
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
29/5/2019 10:37:44 Pipe not found
29/5/2019 10:37:44 The count is 7
29/5/2019 10:37:44 bCheckServer is 1
29/5/2019 10:37:44 bSet is 1
securePort: 443
29/5/2019 10:37:45 WDAVersion = 12.1.1.25
29/5/2019 10:37:45 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
29/5/2019 10:37:46 1|VI=1|
29/5/2019 10:37:46 Found HS Tag
ProcessMsg!
29/5/2019 10:37:46 Server Sent 5
29/5/2019 10:37:46 Enhanced QU : QUM :
29/5/2019 10:37:46 Enhanced QU : QUC :
29/5/2019 10:37:46 Enhanced QU : QUD :
29/5/2019 10:37:46 Server Sent 6
29/5/2019 10:37:46 LOOKING FOR &04
29/5/2019 11:11:44 Received data:

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
29/5/2019 11:11:44 ip RETRIVED �=#
10.20.15.151, SecurePort: 443
29/5/2019 11:11:44 SETTING REG TO VALUE �=#
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
29/5/2019 11:11:45 Pipe not found
29/5/2019 11:11:45 The count is 7
29/5/2019 11:11:45 bCheckServer is 1
29/5/2019 11:11:45 bSet is 1
securePort: 443
29/5/2019 11:11:45 Calling V01
29/5/2019 11:11:45 Merlin version 354
29/5/2019 11:11:45 Signature 354
29/5/2019 11:11:45 Wyse Flag value 0011
29/5/2019 11:11:46 The iBLP value -1
29/5/2019 11:11:47 TZ Queried
Number
29/5/2019 11:11:47 FUR : GetCI() 1
29/5/2019 11:11:47 IP matched!
29/5/2019 11:11:47 Subnet @�#
29/5/2019 11:11:47 Gateway `�#
29/5/2019 11:11:47 DS 5#
83FF-9A7F0B2B2
29/5/2019 11:11:47 E1E}
29/5/2019 11:11:47 Got reply from AgentUI=�x#
29/5/2019 11:11:47 add only adapter.
29/5/2019 11:11:47 GetDisplayInfo() return=�!
29/5/2019 11:11:47 Disk offset 659554304
29/5/2019 11:11:47 Disk 0 Part 1 TYPE 260

29/5/2019 11:11:47 Disk 0 Part 5 TYPE 261

29/5/2019 11:11:47 Secure boot = 1

29/5/2019 11:11:47 tempbuff = |WIN0=Course: INTRODUCCI�N A LA ELECTRICIDAD GRUPO
223|WIN1=Ecuaci�n de la recta dados dos puntos. y=mx+b. Ejercicios
29/5/2019 11:11:47 1, 2 y 3 | Equation of the line #35 - YouTube - Mozilla
29/5/2019 11:11:47 Msg recd from AgentGUI:|WIN0=Course: INTRODUCCI�N A LA
ELECTRICIDAD GRUPO 223|WIN1=Ecuaci�n de la recta dados dos puntos. y=mx+b
29/5/2019 11:11:47 . Ejercicios 1, 2 y 3 | Equation of the line #35 - YouTube -
29/5/2019 11:11:47 Got reply from AgentUI=�_#
29/5/2019 11:11:47 return from ListAllApps=�O#
29/5/2019 11:11:53 size of qfe list 64
29/5/2019 11:11:53 WDAVersion = 12.1.1.25
29/5/2019 11:11:53 GetCI() done
29/5/2019 11:11:53 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC46=r
PRC55=WINWORD.EXE|PRC56=firefox.exe|PRC57=firefox.exe|PRC58=firefox.exe|PRC59=fi
PRC62=firefox.exe|PRC63=wmiprvse.exe||WIN0=Course:üINTRODUCCI�NüAüLAüELECTRICI
29/5/2019 11:11:53 DADüGRUPOü223|
WIN1=Ecuaci�nüdeülaürectaüdadosüdosüpuntos.üy=mx+b.üEjerciciosü1,ü2üyü3ü|
üEquationüofütheüline�
29/5/2019 11:11:53 �#35ü-üYouTubeü-üMozillaüFirefox|WIN2=ProgramüManager||
29/5/2019 11:11:53 89934464|FKVM=8589864360|FKEM=0|CPRMS0=98,4,67|
NIC0IP=10.28.0.130|NIC0DESC=Ethernet,InventecüPCIeüGBEüFamilyüControllerü#2|
29/5/2019 11:11:53 NIC0MAC=008064FB707A|RECP0=273118|SENDP0=110067|
MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,BluetoothüDeviceü(Personal
29/5/2019 11:11:53 üAreaüNetwork)|NIC1MAC=F0421CED66FA|RECP1=0|SENDP1=0|
MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Ethernet,Intel(R)üDualüBandüWi
29/5/2019 11:11:53 reless-ACü7260|NIC2MAC=F0421CED66F6|RECP2=0|SENDP2=0|
29/5/2019 11:11:53
62,KB2779768,KB2780541,KB2781197,KB2785094,KB
29/5/2019 11:11:53
4599,KB2795944,KB2798162,KB2798802,KB2798804,
29/5/2019 11:11:53
808679,KB2808735,KB2809289,KB2811660,KB281282
29/5/2019 11:11:53
B2829254,KB2829361,KB2829530,KB2830290,KB2832
29/5/2019 11:11:53
Zipü18.05ü(x64)|C:\ProgramüFiles\7-Zip\|18.0
29/5/2019 11:11:53 5|AP1=MozillaüFirefoxü61.0.2ü(x64ües-ES)|
C:\ProgramüFiles\MozillaüFirefox|61.0.2|AP2=MozillaüMaintenanceüService||61.0.2
29/5/2019 11:11:53 |AP3=MicrosoftüLyncüVdiü2013|
AP4=MicrosoftüOfficeüProfessionalüPlusü20
AP5=MicrosoftüVisualüC++ü2008üRedistributableü-üx64ü9.0.30729.4148
29/5/2019 11:11:53 ||9.0.30729.4148|
AP7=MicrosoftüSilverlight|c:\ProgramüFiles\Mic
29/5/2019 11:11:53 rosoftüSilverlight\|5.1.20125.0|AP8=MicrosoftüVisualüC+
+ü2005üRedistributableü(x64)||8.0.61000|AP9=WyseüDeviceüAgent|C:\
29/5/2019 11:11:53 ProgramüFiles\Wyse\WDA\|12.1.1.25|
5.4.0.121990
AP12=MicrosoftüExcel|C:\PROGR
29/5/2019 11:11:53 A~1\MICROS~1\Office15\EXCEL.EXE|15.0.4420.1017|AP13=File-
basedüwriteüfilterümanager|C:\Windows\System32\fbwfmgr.EXE|2.0.449.0
29/5/2019 11:11:53 |AP14=DiagnosticsüutilityüforüInternetüExplorer|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE|10.0.9200.16384|AP15=Offi
29/5/2019 11:11:53 ceüXMLüHandler|
15.0.4420.1017|AP16=MicrosoftüPowerPoi
29/5/2019 11:11:53 nt|C:\PROGRA~1\MICROS~1\Office15\POWERPNT.EXE|15.0.4420.1017|
AP17=TightVNC|C:\ProgramüFiles\TightVNC\tvnserver.exe|2.6.4.0|AP18
29/5/2019 11:11:53 =UnifiedüWriteüFilterüManagerüManager|
C:\ProgramüFiles\Wind
29/5/2019 11:11:53 owsüMail\wab.exe|6.2.9200.16384|
6.2.9200
29/5/2019 11:11:53 .16384|AP21=MicrosoftüWord|
WCMSupp=1|WCMJSONSupp=
29/5/2019 11:11:53 1|
29/5/2019 11:11:53 Found HS Tag
ProcessMsg!
29/5/2019 11:11:53 Server Sent 5
29/5/2019 11:11:53 Enhanced QU : QUM :
29/5/2019 11:11:53 Enhanced QU : QUC :
29/5/2019 11:11:53 Enhanced QU : QUD :
29/5/2019 11:11:53 Server Sent 6
29/5/2019 11:11:53 LOOKING FOR &04
29/5/2019 11:11:53 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
29/5/2019 12:15:29 ip RETRIVED �>#
10.20.15.151, SecurePort: 443
29/5/2019 12:15:29 SETTING REG TO VALUE �>#
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
29/5/2019 12:15:29 Pipe not found
29/5/2019 12:15:29 The count is 7
29/5/2019 12:15:29 bCheckServer is 1
29/5/2019 12:15:29 bSet is 1
securePort: 443
29/5/2019 12:15:30 WDAVersion = 12.1.1.25
29/5/2019 12:15:30 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
29/5/2019 12:15:31 -1|VI=1|
29/5/2019 12:15:31 Found HS Tag
ProcessMsg!
29/5/2019 12:15:31 Server Sent 5
29/5/2019 12:15:31 Enhanced QU : QUM :
29/5/2019 12:15:31 Enhanced QU : QUC :
29/5/2019 12:15:31 Enhanced QU : QUD :
29/5/2019 12:15:31 Server Sent 6
29/5/2019 12:15:31 LOOKING FOR &04
29/5/2019 12:21:45 Received data:
Accept: */*
29/5/2019 12:21:45 jects/mechanize/)
Connection: close
29/5/2019 12:21:45 =0.7,*;q=0.7

Accept: */*
Connection: close
29/5/2019 12:21:45 9-1,utf-8;q=0.7,*;q=0.7

refresh settings!
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
29/5/2019 12:21:45 ip RETRIVED �L#
10.20.15.151, SecurePort: 443
29/5/2019 12:21:45 SETTING REG TO VALUE �L#
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
29/5/2019 12:21:46 Pipe not found
29/5/2019 12:21:46 The count is 7
29/5/2019 12:21:46 bCheckServer is 1
29/5/2019 12:21:46 bSet is 1
securePort: 443
29/5/2019 12:21:46 Calling V01
29/5/2019 12:21:46 Merlin version 354
29/5/2019 12:21:46 Signature 354
29/5/2019 12:21:46 Wyse Flag value 0011
29/5/2019 12:21:47 The iBLP value -1
29/5/2019 12:21:48 TZ Queried
Number
29/5/2019 12:21:48 FUR : GetCI() 1
29/5/2019 12:21:48 IP matched!
29/5/2019 12:21:48 Subnet @�#
29/5/2019 12:21:48 Gateway `�#
29/5/2019 12:21:48 DS 5#
83FF-9A7F0B2B2
29/5/2019 12:21:48 E1E}
29/5/2019 12:21:48 Got reply from AgentUI=�~#
29/5/2019 12:21:48 add only adapter.
29/5/2019 12:21:48 GetDisplayInfo() return=�F#
29/5/2019 12:21:48 Disk offset 659554304
29/5/2019 12:21:48 Disk 0 Part 1 TYPE 260

29/5/2019 12:21:48 Disk 0 Part 5 TYPE 261

29/5/2019 12:21:48 Secure boot = 1

29/5/2019 12:21:48 tempbuff = |WIN0=la ecuacion de la recta es diferente a la
pendiente d euna recta? - Buscar con Google|WIN1=la ecuacion de la re
29/5/2019 12:21:48 cta es diferente a la pendiente d euna recta? - Buscar con
Google - Mozilla Firefox|WIN2=Program Manager|, num=0
29/5/2019 12:21:48 Msg recd from AgentGUI:|WIN0=la ecuacion de la recta es
diferente a la pendiente d euna recta? - Buscar con Google|WIN1=la ecuac
29/5/2019 12:21:48 ion de la recta es diferente a la pendiente d euna recta? -
Buscar con Google - Mozilla Firefox|WIN2=Program Manager|
29/5/2019 12:21:48 Got reply from AgentUI=��"
29/5/2019 12:21:48 return from ListAllApps=�##
29/5/2019 12:21:54 size of qfe list 64
29/5/2019 12:21:54 WDAVersion = 12.1.1.25
29/5/2019 12:21:54 GetCI() done
29/5/2019 12:21:54 GetCI() 2 done
10.20.15.151, Port = 0, SecurePort = 47873
1D=10.28.24.2|2D=10.20.100.18|0W=1|1W=|2W=|FS=30529|IM=10.01.Es0907.3
D0PAR5SZ=3070859
PRC46=r
PRC55=WINWORD.EXE|PRC56=firefox.exe|PRC57=firefox.exe|PRC58=firefox.exe|PRC59=fi
PRC62=firefox.exe|PRC63=wmiprvse.exe||WIN0=laüecuacionüdeülaürectaüesüdifere
29/5/2019 12:21:54 nteüaülaüpendienteüdüeunaürecta?ü-üBuscarüconüGoogle|
WIN1=laüecuacionüdeülaürectaüesüdiferenteüaülaüpendiente
29/5/2019 12:21:54 üdüeunaürecta?ü-üBuscarüconüGoogleü-üMozillaüFirefox|
CPRMS0=136,0,67|NIC0IP=10.28.0.130|NIC0DESC=Ethernet,InventecüPCIeüGB
29/5/2019 12:21:54 EüFamilyüControllerü#2|NIC0MAC=008064FB707A|RECP0=414969|
SENDP0=155692|MIBSP0=1000üMbps||NIC1IP=0.0.0.0|NIC1DESC=Ethernet,Bl
29/5/2019 12:21:54 uetoothüDeviceü(PersonalüAreaüNetwork)|NIC1MAC=F0421CED66FA|
RECP1=0|SENDP1=0|MIBSP1=3üMbps||NIC2IP=0.0.0.0|NIC2DESC=Etherne
29/5/2019 12:21:54 t,Intel(R)üDualüBandüWireless-ACü7260|NIC2MAC=F0421CED66F6|
29/5/2019 12:21:54
B2778344,KB2778930,KB2779562,KB2779768,KB2780
29/5/2019 12:21:54
,KB2793210,KB2794119,KB2794599,KB2795944,KB27
29/5/2019 12:21:54
22,KB2805227,KB2807986,KB2808679,KB2808735,KB
29/5/2019 12:21:54
1895,KB2822241,KB2829069,KB2829254,KB2829361,
29/5/2019 12:21:54
845533,KB2845690,|AP0=7-Zipü18.05ü(x64)|C:\
29/5/2019 12:21:54 ProgramüFiles\7-Zip\|18.05|
AP2=MozillaüMa
29/5/2019 12:21:54 intenanceüService||61.0.2|AP3=MicrosoftüLyncüVdiü2013|
C:\ProgramüFiles\MicrosoftüOffice|15.0.4420.1017|AP4=MicrosoftüOffi
29/5/2019 12:21:54 ceüProfessionalüPlusü2013|C:\ProgramüFiles\MicrosoftüOffice\|
15.0.4420.1017|AP5=MicrosoftüVisualüC++ü2008üRedistributab
29/5/2019 12:21:54 leü-üx64ü9.0.30729.4148||9.0.30729.4148|
AP6=MicrosoftüWindowsüEmbeddedüKeyboardüFilterüDatabase|||AP7=MicrosoftüSilverl
29/5/2019 12:21:54 ight|c:\ProgramüFiles\MicrosoftüSilverlight\|5.1.20125.0|
AP8=MicrosoftüVisualüC++ü2005üRedistributableü(x64)||8.0.61000|A
29/5/2019 12:21:54 P9=WyseüDeviceüAgent|C:\ProgramüFiles\Wyse\WDA\|12.1.1.25|
AP10=VMwareüHorizonüViewüClient|C:\ProgramüFiles\VMware\VMware�
29/5/2019 12:21:54 �View\Client\|5.4.0.1219906|AP11=GoogleüChrome|
C:\ProgramüFilesü(x86)\Google\Chrome\Application\chrome.exe|68.0.3440.106|AP12
29/5/2019 12:21:54 =MicrosoftüExcel|C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE|
15.0.4420.1017|AP13=File-basedüwriteüfilterümanager|C:\Windows\Syst
29/5/2019 12:21:54 em32\fbwfmgr.EXE|2.0.449.0|
C:\ProgramüFiles\InternetüExplorer\IEDIAGCMD.EXE
29/5/2019 12:21:54 |10.0.9200.16384|AP15=OfficeüXMLüHandler|
C:\ProgramüFiles\TightVNC\
29/5/2019 12:21:54 tvnserver.exe|2.6.4.0|
AP19=WindowsüConta
29/5/2019 12:21:54 cts|C:\ProgramüFiles\WindowsüMail\wab.exe|6.2.9200.16384|
AP20=Microsoftü(R)üContactsüImportüTool|C:\ProgramüFiles\Windows
29/5/2019 12:21:54 üMail\wabmig.exe|6.2.9200.16384|AP21=MicrosoftüWord|
C:\PROGRA~1\MICROS~1\Office15\WINWORD.EXE|15.0.4420.1017|WCM_CFG_HASH=0|WD
29/5/2019 12:21:54 A=1|WCMSupp=1|WCMJSONSupp=1|
29/5/2019 12:21:54 Found HS Tag
ProcessMsg!
29/5/2019 12:21:54 Server Sent 5
29/5/2019 12:21:54 Enhanced QU : QUM :
29/5/2019 12:21:54 Enhanced QU : QUC :
29/5/2019 12:21:54 Enhanced QU : QUD :
29/5/2019 12:21:54 Server Sent 6
29/5/2019 12:21:54 LOOKING FOR &04
29/5/2019 12:21:54 FUR :After S&P done
GetServerAddress
securePort: 443
HuntForAltLocalIP
IN_ADDR : -2113922038
29/5/2019 13:25:15 ip RETRIVED �=#
10.20.15.151, SecurePort: 443
29/5/2019 13:25:15 SETTING REG TO VALUE �=#
HuntForAltLocalIP
or secure port 443
10.20.15.151, Port = 0, SecurePort = 47873
29/5/2019 13:25:16 Pipe not found
29/5/2019 13:25:16 The count is 7
29/5/2019 13:25:16 bCheckServer is 1
29/5/2019 13:25:16 bSet is 1
securePort: 443
29/5/2019 13:25:16 WDAVersion = 12.1.1.25
29/5/2019 13:25:16 The iBLP value -1
10.20.15.151, Port = 0, SecurePort = 47873
WCM_CFG_HASH=0|WDA=1|WCMSupp=1|WCMJSONSupp=1|TPA=0|TPE=0|TPI=0|BLP=-1|BLE=-1|BLC
29/5/2019 13:25:17 =-1|VI=1|
29/5/2019 13:25:17 Found HS Tag
ProcessMsg!
29/5/2019 13:25:17 Server Sent 5
29/5/2019 13:25:17 Enhanced QU : QUM :
29/5/2019 13:25:17 Enhanced QU : QUC :
29/5/2019 13:25:17 Enhanced QU : QUD :
29/5/2019 13:25:17 Server Sent 6
29/5/2019 13:25:17 LOOKING FOR &04
29/5/2019 13:50:

Wdebuglog

Hochgeladen von

Dokumentinformationen

Originalbeschreibung:

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Wdebuglog

Hochgeladen von

Copyright:

Verfügbare Formate

9/5/2019 8:28:18 ***********************************************************

9/5/2019 8:28:18 1. DebugLevel in Registry entry :3

9/5/2019 8:28:39 fn GetBAandBUParDetails szBPB=�X�MerBA###

9/5/2019 8:28:39 fn GetBAandBUParDetails szBPB=�R�NTFS

9/5/2019 8:28:39 AF_INET (IPv4)

9/5/2019 8:28:39 IPv4 address 169.254.150.182

9/5/2019 8:28:39 IPv4 DWORD server IP -1231618391

9/5/2019 8:28:39 Valid IP Found

9/5/2019 8:28:49 Disk 0 Part 1 TYPE 260

9/5/2019 8:28:49 Disk 0 Part 5 TYPE 261

9/5/2019 8:28:49 Secure boot = 1

9/5/2019 12:18:44 Invalid Command Sent:GET / HTTP/1.1

9/5/2019 12:18:44 Although command was invalid, we do a check-in event to

9/5/2019 12:18:47 Disk 0 Part 1 TYPE 260

9/5/2019 12:18:47 Disk 0 Part 5 TYPE 261

9/5/2019 12:18:47 Secure boot = 1

9/5/2019 18:44:30 Disk 0 Part 1 TYPE 260

9/5/2019 18:44:30 Disk 0 Part 5 TYPE 261

9/5/2019 18:44:30 Secure boot = 1

10/5/2019 8:12:54 fn GetBAandBUParDetails szBPB=�X�MerBA###

10/5/2019 8:12:54 fn GetBAandBUParDetails szBPB=�R�NTFS

10/5/2019 8:12:54 AF_INET (IPv4)

10/5/2019 8:12:54 IPv4 DWORD server IP -1231618391

10/5/2019 8:12:54 Valid IP Found

10/5/2019 8:13:4 Disk 0 Part 5 TYPE 261

10/5/2019 8:13:4 Secure boot = 1

10/5/2019 16:22:52 Invalid Command Sent:GET / HTTP/1.1

10/5/2019 16:22:52 Although command was invalid, we do a check-in event to

10/5/2019 16:22:55 Disk 0 Part 1 TYPE 260

10/5/2019 16:22:55 Disk 0 Part 5 TYPE 261

10/5/2019 16:22:55 Secure boot = 1

13/5/2019 7:42:23 fn GetBAandBUParDetails szBPB=�X�MerBA###

13/5/2019 7:42:23 fn GetBAandBUParDetails szBPB=�R�NTFS

13/5/2019 7:42:23 AF_INET (IPv4)

13/5/2019 7:42:23 IPv4 address 169.254.150.182

13/5/2019 7:42:23 IPv4 DWORD server IP -1231618391

13/5/2019 7:42:23 Valid IP Found

13/5/2019 7:42:34 Disk 0 Part 1 TYPE 260

13/5/2019 7:42:34 Disk 0 Part 5 TYPE 261

13/5/2019 7:42:34 Secure boot = 1

13/5/2019 8:44:20 Disk 0 Part 1 TYPE 260

13/5/2019 8:44:20 Disk 0 Part 5 TYPE 261

13/5/2019 8:44:20 Secure boot = 1

13/5/2019 13:39:56 fn GetBAandBUParDetails szBPB=�X�MerBA###

13/5/2019 13:39:56 fn GetBAandBUParDetails szBPB=�R�NTFS

13/5/2019 13:39:56 AF_INET (IPv4)

13/5/2019 13:39:56 IPv4 address 169.254.150.182

13/5/2019 13:39:56 IPv4 DWORD server IP -1231618391

13/5/2019 13:39:56 Valid IP Found

13/5/2019 13:40:6 Disk 0 Part 1 TYPE 260

13/5/2019 13:40:6 Disk 0 Part 5 TYPE 261

13/5/2019 13:40:6 Secure boot = 1

13/5/2019 16:22:36 Invalid Command Sent:GET / HTTP/1.1

13/5/2019 16:22:39 Disk 0 Part 1 TYPE 260

13/5/2019 16:22:39 Disk 0 Part 5 TYPE 261

13/5/2019 16:22:39 Secure boot = 1

13/5/2019 20:22:56 Invalid Command Sent:GET / HTTP/1.1

13/5/2019 20:22:56 Although command was invalid, we do a check-in event to

13/5/2019 20:22:59 Disk 0 Part 1 TYPE 260

13/5/2019 20:22:59 Disk 0 Part 5 TYPE 261

13/5/2019 20:22:59 Secure boot = 1

14/5/2019 0:21:11 Invalid Command Sent:GET / HTTP/1.1