package compat import ( "fmt" "strings" "testing" ) func TestWFPState(t *testing.T) { t.Parallel() w, err := parseWFPState(wfpTestData) if err != nil { t.Fatal(err) } output := w.simplified().AsTable() fmt.Println(output) outputLines := strings.Count(output, "\n") if outputLines != 10 { t.Errorf("Expected 10 output lines, not %d", outputLines) } } var wfpTestData = []byte(` FWPM_LAYER_INBOUND_IPPACKET_V4 Inbound IP Packet v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 0 {05c55149-4732-4857-8d10-f178f3a06f8c} PortmasterInboundV4Callout This callout is used by the Portmaster to intercept inbound IPv4 traffic. FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_INBOUND_IPPACKET_V4 290 {fb2f56c5-3883-475a-8c78-047d1f93b5a9} PortmasterInboundV4Filter This filter is used by the Portmaster to intercept inbound IPv4 traffic. FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT FWPM_LAYER_INBOUND_IPPACKET_V4 {a87fb472-fc68-4805-8559-c6ae774773e0} FWP_UINT8 15 FWP_ACTION_CALLOUT_TERMINATING {05c55149-4732-4857-8d10-f178f3a06f8c} 0 68136 FWP_UINT64 17293822569102704640 FWPM_LAYER_INBOUND_IPPACKET_V4_DISCARD Inbound IP Packet v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 1 FWPM_LAYER_INBOUND_IPPACKET_V6 Inbound IP Packet v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 2 {ceff1df7-2baa-44c5-a6e5-73a95849bcff} PortmasterInboundV6Callout This callout is used by the Portmaster to intercept inbound IPv6 traffic. FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_INBOUND_IPPACKET_V6 292 {778afeeb-9680-4a59-82d5-abc33b3fb183} PortmasterInboundV6Filter This filter is used by the Portmaster to intercept inbound IPv6 traffic. FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT FWPM_LAYER_INBOUND_IPPACKET_V6 {a87fb472-fc68-4805-8559-c6ae774773e0} FWP_UINT8 15 FWP_ACTION_CALLOUT_TERMINATING {ceff1df7-2baa-44c5-a6e5-73a95849bcff} 0 68138 FWP_UINT64 17293822569102704640 FWPM_LAYER_INBOUND_IPPACKET_V6_DISCARD Inbound IP Packet v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 3 FWPM_LAYER_OUTBOUND_IPPACKET_V4 Outbound IP Packet v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 4 {41162b9e-8473-4b88-a5eb-04cf1d276b06} PortmasterOutboundV4Callout This callout is used by the Portmaster to intercept outbound IPv4 traffic. FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_OUTBOUND_IPPACKET_V4 291 {609b24b3-7b9a-48e1-8994-c72a42bbd319} PortmasterOutboundV4Filter This filter is used by the Portmaster to intercept outbound IPv4 traffic. FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT FWPM_LAYER_OUTBOUND_IPPACKET_V4 {a87fb472-fc68-4805-8559-c6ae774773e0} FWP_UINT8 15 FWP_ACTION_CALLOUT_TERMINATING {41162b9e-8473-4b88-a5eb-04cf1d276b06} 0 68137 FWP_UINT64 17293822569102704640 FWPM_LAYER_OUTBOUND_IPPACKET_V4_DISCARD Outbound IP Packet v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 5 FWPM_LAYER_OUTBOUND_IPPACKET_V6 Outbound IP Packet v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 6 {32bad112-6af4-4109-809b-c07570ba01b4} PortmasterOutboundV6Callout This callout is used by the Portmaster to intercept outbound IPv6 traffic. FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_OUTBOUND_IPPACKET_V6 293 {23ae199a-7949-4059-b799-67e7a1a57fcb} PortmasterOutboundV6Filter This filter is used by the Portmaster to intercept outbound IPv6 traffic. FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT FWPM_LAYER_OUTBOUND_IPPACKET_V6 {a87fb472-fc68-4805-8559-c6ae774773e0} FWP_UINT8 15 FWP_ACTION_CALLOUT_TERMINATING {32bad112-6af4-4109-809b-c07570ba01b4} 0 68139 FWP_UINT64 17293822569102704640 FWPM_LAYER_OUTBOUND_IPPACKET_V6_DISCARD Outbound IP Packet v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 7 FWPM_LAYER_IPFORWARD_V4 IP Forward v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_SOURCE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_FORWARD_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_SOURCE_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DESTINATION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 8 FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4 WFP Built-in IPsec Forward Inbound Tunnel v4 Layer Callout Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000020 FWPM_LAYER_IPFORWARD_V4 9 FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4 WFP Built-in IPsec Forward Outbound Tunnel v4 Layer Callout Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000020 FWPM_LAYER_IPFORWARD_V4 11 {935b7f48-0ede-44dd-9bc2-e00bb635cda3} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_IPFORWARD_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 0 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 786432 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66238 FWP_UINT64 4 FWPM_LAYER_IPFORWARD_V4_DISCARD IP Forward v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_SOURCE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_FORWARD_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_SOURCE_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DESTINATION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 9 FWPM_LAYER_IPFORWARD_V6 IP Forward v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_SOURCE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_FORWARD_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_SOURCE_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DESTINATION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 10 FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6 WFP Built-in IPsec Forward Inbound Tunnel v6 Layer Callout Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000020 FWPM_LAYER_IPFORWARD_V6 10 FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6 WFP Built-in IPsec Forward Outbound Tunnel v6 Layer Callout Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000020 FWPM_LAYER_IPFORWARD_V6 12 {941dad9d-7b1a-4354-997b-00cf1aa9b35c} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_IPFORWARD_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 0 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 786432 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66239 FWP_UINT64 4 FWPM_LAYER_IPFORWARD_V6_DISCARD IP Forward v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_SOURCE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_FORWARD_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_SOURCE_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DESTINATION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 11 FWPM_LAYER_INBOUND_TRANSPORT_V4 Inbound Transport v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 12 FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4 WFP Built-in IPsec Inbound Transport v4 Layer Callout Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely. FWPM_CALLOUT_FLAG_REGISTERED 00000260 FWPM_LAYER_INBOUND_TRANSPORT_V4 1 FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4 WFP Built-in IPsec Inbound Tunnel v4 Layer Callout Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000020 FWPM_LAYER_INBOUND_TRANSPORT_V4 5 FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD Inbound Transport v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 13 FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP WFP Built-in Silent Drop Transport v4 Discard Layer Callout Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint. FWP_CALLOUT_FLAG_ALLOW_OFFLOAD FWPM_CALLOUT_FLAG_REGISTERED 00000240 FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD 17 {03c67493-1802-44a0-ad5f-3ae741e25c15} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68060 FWP_UINT64 18446744073709551615 {29ccd323-aecf-4990-b96a-c5384222b0c9} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68062 FWP_UINT64 18446744073709551615 {92ff43ac-9df0-49e9-b3b3-d6f8421edcca} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68064 FWP_UINT64 18446744073709551615 {b2a53430-2096-4b30-ae54-260f96a82028} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 12 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 3 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68066 FWP_UINT64 13835058055349272576 FWPM_LAYER_INBOUND_TRANSPORT_V6 Inbound Transport v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 14 FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6 WFP Built-in IPsec Inbound Transport v6 Layer Callout Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely. FWPM_CALLOUT_FLAG_REGISTERED 00000260 FWPM_LAYER_INBOUND_TRANSPORT_V6 2 FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6 WFP Built-in IPsec Inbound Tunnel v6 Layer Callout Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000020 FWPM_LAYER_INBOUND_TRANSPORT_V6 6 FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD Inbound Transport v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 15 FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP WFP Built-in Silent Drop Transport v6 Discard Layer Callout Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint. FWP_CALLOUT_FLAG_ALLOW_OFFLOAD FWPM_CALLOUT_FLAG_REGISTERED 00000240 FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD 18 {57175e0d-0212-4ddd-b229-559795b43af7} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68061 FWP_UINT64 18446744073709551615 {d979d760-083e-489d-9360-1f377b606ef1} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68063 FWP_UINT64 18446744073709551615 {22b3ef06-6428-47ac-868f-b4a968fe995c} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68065 FWP_UINT64 18446744073709551615 {f3ecd3f5-9498-4dce-a76d-da32be01382f} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 12 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 3 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68067 FWP_UINT64 13835058055298940928 FWPM_LAYER_OUTBOUND_TRANSPORT_V4 Outbound Transport v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 16 FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4 WFP Built-in IPsec Outbound Transport v4 Layer Callout Indicates to IPsec the outbound traffic that must be secured over transport mode security associations. FWPM_CALLOUT_FLAG_REGISTERED 00000260 FWPM_LAYER_OUTBOUND_TRANSPORT_V4 3 FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4 WFP Built-in IPsec Outbound Tunnel v4 Layer Callout Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000020 FWPM_LAYER_OUTBOUND_TRANSPORT_V4 7 FWPM_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD Outbound Transport v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 17 FWPM_LAYER_OUTBOUND_TRANSPORT_V6 Outbound Transport v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 18 FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6 WFP Built-in IPsec Outbound Transport v6 Layer Callout Indicates to IPsec the outbound traffic that must be secured over transport mode security associations. FWPM_CALLOUT_FLAG_REGISTERED 00000260 FWPM_LAYER_OUTBOUND_TRANSPORT_V6 4 FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6 WFP Built-in IPsec Outbound Tunnel v6 Layer Callout Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000020 FWPM_LAYER_OUTBOUND_TRANSPORT_V6 8 FWPM_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD Outbound Transport v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 19 FWPM_LAYER_STREAM_V4 Stream v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_LAYER_FLAG_BUFFERED FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 20 {c3dbed20-0bb6-4bf3-828d-96732e1e0414} Windows Firewall: callout Connection-oriented protocol packet inspection. FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW FWPM_CALLOUT_FLAG_REGISTERED FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_STREAM_V4 288 {d67b238d-d80c-4ba7-96df-4a0c83464fa7} windefend_stream_v4 windefend FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_STREAM_V4 294 {821997be-23bb-4240-87a2-2615caec3d1f} Deep Protocol Inspection Filter This filter implements deep inspection for FTP protocols. FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_STREAM_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e0414} 0 68050 FWP_UINT64 18446744073709551615 {42e67750-e0ae-4ec7-aa42-97c6605b1c96} windefend_stream_v4 windefend FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED FWPM_LAYER_STREAM_V4 {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} FWP_EMPTY FWP_ACTION_CALLOUT_TERMINATING {d67b238d-d80c-4ba7-96df-4a0c83464fa7} 0 68276 FWP_UINT64 0 FWPM_LAYER_STREAM_V4_DISCARD Stream v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_LAYER_FLAG_BUFFERED FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 21 FWPM_LAYER_STREAM_V6 Stream v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_LAYER_FLAG_BUFFERED FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 22 {c3dbed20-0bb6-4bf3-828d-96732e1e0416} Windows Firewall: callout Connection-oriented protocol packet inspection. FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW FWPM_CALLOUT_FLAG_REGISTERED FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_STREAM_V6 289 {36d4cf95-fd3a-4bb8-90a9-ffdb3749237f} windefend_stream_v6 windefend FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_STREAM_V6 295 {ecdc6e7a-8981-4a13-92d7-fb12f8d0ea9f} Deep Protocol Inspection Filter This filter implements deep inspection for FTP protocols. FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_STREAM_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e0416} 0 68051 FWP_UINT64 18446744073709551615 {094b9bb6-e451-4069-ac23-5fe695ec9662} windefend_stream_v6 windefend FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED FWPM_LAYER_STREAM_V6 {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} FWP_EMPTY FWP_ACTION_CALLOUT_TERMINATING {36d4cf95-fd3a-4bb8-90a9-ffdb3749237f} 0 68277 FWP_UINT64 0 FWPM_LAYER_STREAM_V6_DISCARD Stream v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_LAYER_FLAG_BUFFERED FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 23 FWPM_LAYER_DATAGRAM_DATA_V4 Datagram Data v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 24 {b2d11c73-b4ef-47d1-b665-58e6ba9fe200} windefend_datagram_v4 windefend FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_DATAGRAM_DATA_V4 300 {67dc47f0-7a3b-4705-a4e7-bb8756a3e69f} windefend_datagram_v4 windefend FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED FWPM_LAYER_DATAGRAM_DATA_V4 {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} FWP_EMPTY FWP_ACTION_CALLOUT_TERMINATING {b2d11c73-b4ef-47d1-b665-58e6ba9fe200} 0 68282 FWP_UINT64 0 FWPM_LAYER_DATAGRAM_DATA_V4_DISCARD Datagram Data v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 25 FWPM_LAYER_DATAGRAM_DATA_V6 Datagram Data v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 26 {80cece9d-0b53-4672-ac43-4524416c0353} windefend_datagram_v6 windefend FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_DATAGRAM_DATA_V6 301 {f875d7d9-b132-436d-a729-479ef4e4ef08} windefend_datagram_v6 windefend FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED FWPM_LAYER_DATAGRAM_DATA_V6 {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} FWP_EMPTY FWP_ACTION_CALLOUT_TERMINATING {80cece9d-0b53-4672-ac43-4524416c0353} 0 68283 FWP_UINT64 0 FWPM_LAYER_DATAGRAM_DATA_V6_DISCARD Datagram Data v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 27 FWPM_LAYER_INBOUND_ICMP_ERROR_V4 Inbound ICMP Error v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_EMBEDDED_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_EMBEDDED_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_EMBEDDED_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 28 {0c41d586-9c19-4e01-9d66-b5b98a97576e} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66212 FWP_UINT64 18446744073709551615 {4d9581d2-aef8-4993-84cd-b986ced80d42} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66216 FWP_UINT64 18446744073709551615 {074f7f68-ee10-428a-89d1-ba78f6c327ca} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 0 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66224 FWP_UINT64 0 {91ffecf0-0a9e-4572-95f1-a7111af86967} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 0 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66228 FWP_UINT64 0 {08f09e8d-2754-4cc2-b595-7260f3a8df9d} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_BLOCK {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67629 FWP_UINT64 9223372036854775812 {b8b57642-80b0-49d5-b5d6-34834967743d} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWP_ACTION_BLOCK {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67637 FWP_UINT64 3458764513820540928 FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD Inbound ICMP Error v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_EMBEDDED_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_EMBEDDED_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_EMBEDDED_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 29 {c3dbed20-0bb6-4bf3-828d-96732e1e011d} Windows Firewall: callout Performs logging. FWPM_CALLOUT_FLAG_REGISTERED 00000200 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD 276 FWPM_LAYER_INBOUND_ICMP_ERROR_V6 Inbound ICMP Error v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_EMBEDDED_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_EMBEDDED_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_EMBEDDED_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 30 {12c38916-82ac-4737-8f38-b6957ffebad6} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66213 FWP_UINT64 18446744073709551615 {be7cbdf4-b192-4aa5-94f8-1fb5c5ee07bc} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66217 FWP_UINT64 18446744073709551615 {c016105c-eb34-4519-a5fd-5f4e4ad4d18e} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 0 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66225 FWP_UINT64 0 {64e55933-15a5-495d-a928-ccca43d44875} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 0 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66229 FWP_UINT64 0 {cc44ca04-e1d0-42ef-8fd1-ffe89f6ed166} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_BLOCK {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67633 FWP_UINT64 9223372036854775812 {49ec4b6a-348d-41ae-8777-f7c59ec17f26} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_INBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWP_ACTION_BLOCK {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67641 FWP_UINT64 3458764513820540928 FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD Inbound ICMP Error v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_EMBEDDED_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_EMBEDDED_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_EMBEDDED_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 31 {c3dbed20-0bb6-4bf3-828d-96732e1e011f} Windows Firewall: callout Performs logging. FWPM_CALLOUT_FLAG_REGISTERED 00000200 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD 277 FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 Outbound ICMP Error v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 32 {07a24961-a760-4e80-b263-6d275e1b09cb} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66220 FWP_UINT64 18446744073709551615 {b308b233-cd6c-401d-9f09-3a80217f778e} Default Outbound This is the default outbound filter which blocks or permits traffic based on user configured default settings FWPM_PROVIDER_MPSSVC_WF 9500000000000000 ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67643 FWP_UINT64 9223372036854775812 {bfe4943b-6e61-4ae6-a187-d62d68351430} Default Outbound This is the default outbound filter which blocks or permits traffic based on user configured default settings FWPM_PROVIDER_MPSSVC_WF 9500000000000000 ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWP_ACTION_PERMIT 0 67647 FWP_UINT64 3458764513820540928 {c313817b-32a7-4160-95b2-4673a26e0cab} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 0 FWP_UINT16 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68068 FWP_UINT64 9223372586040164364 {3228da2c-00c2-4f05-8f8c-682315fe7530} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 5 FWP_UINT16 12 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68069 FWP_UINT64 9223372585771728908 {a2fd53b1-e627-4962-aede-c508dac25267} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 14 FWP_UINT16 255 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68070 FWP_UINT64 9223372584463106060 {2260bd8b-6481-4879-93f1-9435d24d2528} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 0 FWP_UINT16 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68073 FWP_UINT64 9223372586040164364 {7224a028-a279-4c7b-b136-40f7516b88cc} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 5 FWP_UINT16 12 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68074 FWP_UINT64 9223372585771728908 {3339fd71-a0e9-4714-87f6-e9ec698fab6b} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 14 FWP_UINT16 255 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68075 FWP_UINT64 9223372584463106060 {9eaf6f7b-ed11-48fb-b3c5-592921db1103} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 0 FWP_UINT16 3 FWP_ACTION_BLOCK {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68078 FWP_UINT64 18446744073709551615 {ef4ccd1e-f08d-4199-85e1-3ef56963f09e} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744069414584322 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 5 FWP_UINT16 12 FWP_ACTION_BLOCK {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68079 FWP_UINT64 18446744069414584322 {0365edae-cbe6-4657-8943-2d16058c98c2} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744069414584322 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 14 FWP_UINT16 255 FWP_ACTION_BLOCK {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68080 FWP_UINT64 18446744069414584322 {c2b8dc84-bfca-4c6d-ba88-5325839ea39f} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 0 FWP_UINT16 3 FWP_ACTION_BLOCK {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68083 FWP_UINT64 18446744073709551615 {d5afb3be-9eb2-40c3-8fa9-3e8ee38948c5} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744069414584322 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 5 FWP_UINT16 12 FWP_ACTION_BLOCK {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68084 FWP_UINT64 18446744069414584322 {4c7ffc63-9f38-44b9-8624-b85abd89b7a6} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744069414584322 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 14 FWP_UINT16 255 FWP_ACTION_BLOCK {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68085 FWP_UINT64 18446744069414584322 FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD Outbound ICMP Error v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 33 {c3dbed20-0bb6-4bf3-828d-96732e1e0121} Windows Firewall: callout Performs logging. FWPM_CALLOUT_FLAG_REGISTERED 00000200 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD 272 FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 Outbound ICMP Error v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 34 {5b0cb2e2-ab87-4974-9f1c-2f22a654eeb9} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66221 FWP_UINT64 18446744073709551615 {da00b2e8-656f-40cc-9a37-444f32c5e58a} Default Outbound This is the default outbound filter which blocks or permits traffic based on user configured default settings FWPM_PROVIDER_MPSSVC_WF 9500000000000000 ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67645 FWP_UINT64 9223372036854775812 {70fb0d21-2477-44bc-967b-494c061e96eb} Default Outbound This is the default outbound filter which blocks or permits traffic based on user configured default settings FWPM_PROVIDER_MPSSVC_WF 9500000000000000 ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWP_ACTION_PERMIT 0 67649 FWP_UINT64 3458764513820540928 {b9b272fb-b866-4e48-9385-c1bee91957da} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68071 FWP_UINT64 9223372070677643276 {331a54f2-38e6-43de-943b-9742b565db8c} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 4 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 0 FWP_UINT16 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68072 FWP_UINT64 9223372071155793932 {722d30ec-406b-423a-b027-d7dd8a306836} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68076 FWP_UINT64 9223372070677643276 {c6a5f146-bbad-4cad-8de4-0c3a4d349f77} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 4 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 0 FWP_UINT16 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68077 FWP_UINT64 9223372071155793932 {a6c63b22-fa8c-4afc-88ab-3f0a8faf213a} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744069414584322 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 1 FWP_ACTION_BLOCK {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68081 FWP_UINT64 18446744069414584322 {45648f6f-4589-44e3-8959-75b391aa0038} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744069414584322 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 4 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 0 FWP_UINT16 2 FWP_ACTION_BLOCK {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68082 FWP_UINT64 18446744069414584322 {dd1e0820-fc15-4492-9403-ef2c61e329bb} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744069414584322 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 1 FWP_ACTION_BLOCK {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68086 FWP_UINT64 18446744069414584322 {4d5e5002-239a-4d48-a681-d7c3c49517d1} Port Scanning Prevention Filter This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744069414584322 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 4 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 0 FWP_UINT16 2 FWP_ACTION_BLOCK {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68087 FWP_UINT64 18446744069414584322 FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD Outbound ICMP Error v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 35 {c3dbed20-0bb6-4bf3-828d-96732e1e0123} Windows Firewall: callout Performs logging. FWPM_CALLOUT_FLAG_REGISTERED 00000200 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD 273 FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 ALE Resource Assignment v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_ALE_PROMISCUOUS_MODE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 36 FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 WFP Built-in Edge Traversal ALE Resource Assignment v4 Layer Callout Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic. FWPM_CALLOUT_FLAG_REGISTERED 00000014 FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 27 {c3dbed20-0bb6-4bf3-828d-96732e1e0024} Windows Firewall: callout Notifies the user. FWPM_CALLOUT_FLAG_REGISTERED FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 268 {58d7275b-2fd2-4b6c-b93a-30037e577d7e} windefend_resource_assignment_v4 windefend FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 296 {fec997ae-7462-4ec1-b9af-99c4751fd489} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 9 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e0024} {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67628 FWP_UINT64 9223442268161048576 {e71db8d0-e58f-45fa-8d34-6e66c5ec8cc1} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 9 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e0024} {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67636 FWP_UINT64 3458834745126813696 {cd49bc81-9428-4bfe-9fad-d20504a480a2} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67663 FWP_UINT64 11529003905476198400 {d0db3fd9-fa82-4abf-aa82-87a9645636de} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 0 67664 FWP_UINT64 11529003905476198400 {69f35305-c344-4543-891f-28168fbd3f31} Core Networking - Dynamic Host Configuration Protocol (DHCP-In) Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration. FWPM_PROVIDER_MPSSVC_WF 9f00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 68 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67677 FWP_UINT64 11529003905476198400 {77c9fe79-5402-402e-8226-c8b570fd6388} Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In) Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration. FWPM_PROVIDER_MPSSVC_WF a000000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 546 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67681 FWP_UINT64 11529003905476198400 {8235388e-e851-4838-a33f-fb98db5a3e5a} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 0 67773 FWP_UINT64 10376363875846062080 {eeb93afc-0f8e-4b50-b378-4517aeacf07a} XING XING FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 0 67785 FWP_UINT64 10376363875846062080 {8bbc020b-4c16-4c42-9147-0c7f61f2a27b} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 0 67797 FWP_UINT64 10376363875846062080 {a2b54f0b-3d87-462c-bfe7-5aff5618a7b3} Xbox Game Bar Xbox Game Bar FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 0 67809 FWP_UINT64 10376363875846062080 {8db0f20c-e041-4c94-93c3-2acdf0380dc4} Microsoft Teams Microsoft Teams FWPM_PROVIDER_MPSSVC_WF b800000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67824 FWP_UINT64 10376363841486323712 {2d6dcea9-f654-406c-bad0-c12935683e86} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 0 67829 FWP_UINT64 10376363875846062080 {c5f25e64-ac27-4d08-ac2e-fc083d790752} Cortana Cortana FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 0 67841 FWP_UINT64 10376363875846062080 {68ce3ad4-d6a7-4f3b-94bf-9d7ddbbfd856} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_PROVIDER_MPSSVC_WF bb00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67852 FWP_UINT64 11529003871116460032 {1e498170-bf78-40d0-8534-89420cdeb047} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_PROVIDER_MPSSVC_WF bd00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67868 FWP_UINT64 11529003871116460032 {965c8ce5-bb4c-4ece-9b94-fbab1f02bd61} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_PROVIDER_MPSSVC_WF be00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67872 FWP_UINT64 11529003871116460032 {1663d17f-13ac-4339-a87d-0b8177c6a161} Microsoft Media Foundation Network Source IN [UDP 5004-5009] InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP FWPM_PROVIDER_MPSSVC_WF 1f01000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 5000 FWP_UINT16 5020 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68214 FWP_UINT64 11212626031653421056 {2c0936a0-ca0e-45fd-8ca2-f7a00123be5c} WFD ASP Coordination Protocol (UDP-In) Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] FWPM_PROVIDER_MPSSVC_WF 2201000000000000 "....... FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68234 FWP_UINT64 11529003905476198400 {d89bb141-b39a-4088-96b4-558cb5f9f818} mDNS (UDP-In) Inbound rule for mDNS traffic [UDP] FWPM_PROVIDER_MPSSVC_WF 2601000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68246 FWP_UINT64 11529003905476198400 {26501d40-8df2-4445-9f4b-a8a19f2afeb8} windefend_resource_assignment_v4 windefend FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} FWP_EMPTY FWP_ACTION_CALLOUT_INSPECTION {58d7275b-2fd2-4b6c-b93a-30037e577d7e} 0 68278 FWP_UINT64 0 {ba25c88a-4995-4529-bbd9-095462c2ab55} Microsoft Store Microsoft Store FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 0 68285 FWP_UINT64 10376363875846062080 FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD ALE Resource Assignment v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_ALE_PROMISCUOUS_MODE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 37 FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 ALE Resource Assignment v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_ALE_PROMISCUOUS_MODE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 38 FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 WFP Built-in Edge Traversal ALE Resource Assignment v6 Layer Callout Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic. FWPM_CALLOUT_FLAG_REGISTERED 00000014 FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 28 {c3dbed20-0bb6-4bf3-828d-96732e1e0026} Windows Firewall: callout Notifies the user. FWPM_CALLOUT_FLAG_REGISTERED FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 269 {ced78e5f-1dd1-485a-9d35-7e44cc9d784d} windefend_resource_assignment_v6 windefend FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 297 {233dc13e-f91d-4576-8c0a-c258350a7620} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 9 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e0026} {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67632 FWP_UINT64 9223511674839891968 {d6ac0d0d-5259-4e91-b3da-6dd38df859a0} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 9 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e0026} {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67640 FWP_UINT64 3458904151805657088 {cb5e3e43-13f9-4f37-a3d8-c0a6ee6a157b} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67668 FWP_UINT64 11528792558725496832 {9c5b7174-b5ba-4ebe-87f3-49d42065c090} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 0 67669 FWP_UINT64 11528792558725496832 {ccb39a7c-ffcc-41e1-b3d5-5508c22d7ae8} Core Networking - Dynamic Host Configuration Protocol (DHCP-In) Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration. FWPM_PROVIDER_MPSSVC_WF 9f00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 68 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67679 FWP_UINT64 11528792558725496832 {6bfcb550-a334-493c-bfa9-0fd5778762d3} Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In) Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration. FWPM_PROVIDER_MPSSVC_WF a000000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 546 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67683 FWP_UINT64 11528792558725496832 {f1d77b93-024f-4ced-96fa-583e3777c094} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 0 67778 FWP_UINT64 10376434004072071168 {4ad1f317-75d8-4c41-b699-586bdc947b61} XING XING FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 0 67790 FWP_UINT64 10376434004072071168 {5856855b-110b-411a-9edb-c83af7970e2a} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 0 67802 FWP_UINT64 10376434004072071168 {449e8fbb-acaf-4cfe-a93c-01c8b5a04e2f} Xbox Game Bar Xbox Game Bar FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 0 67814 FWP_UINT64 10376434004072071168 {b0f609a0-8de9-4641-93e8-322951f06806} Microsoft Teams Microsoft Teams FWPM_PROVIDER_MPSSVC_WF b800000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67826 FWP_UINT64 10376433729194164224 {efbc5936-c530-4944-a424-354d0f15516f} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 0 67834 FWP_UINT64 10376434004072071168 {65a89691-b6bc-453a-ba4f-60b8f2f5afce} Cortana Cortana FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 0 67846 FWP_UINT64 10376434004072071168 {2429f54d-a7e7-428b-8b99-db319e9fbeec} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_PROVIDER_MPSSVC_WF bb00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67854 FWP_UINT64 11528792283847589888 {6f59015a-2f44-4527-95c2-ef891e2ee42e} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_PROVIDER_MPSSVC_WF bd00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67870 FWP_UINT64 11528792283847589888 {4373e6d8-0cba-416a-8957-5346f3a3810f} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_PROVIDER_MPSSVC_WF be00000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67874 FWP_UINT64 11528792283847589888 {e4be4ec1-3874-4bb7-91f4-ef1252a96e4a} Microsoft Media Foundation Network Source IN [UDP 5004-5009] InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP FWPM_PROVIDER_MPSSVC_WF 1f01000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 5000 FWP_UINT16 5020 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68217 FWP_UINT64 11212414684902719488 {95d5968b-f1ce-43f6-8edd-f24b0776f8b0} WFD ASP Coordination Protocol (UDP-In) Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] FWPM_PROVIDER_MPSSVC_WF 2201000000000000 "....... FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68237 FWP_UINT64 11528792558725496832 {c98871d1-4f49-4853-9a6e-35cae1fa3f17} mDNS (UDP-In) Inbound rule for mDNS traffic [UDP] FWPM_PROVIDER_MPSSVC_WF 2601000000000000 ........ FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68249 FWP_UINT64 11528792558725496832 {8c0045d4-35b0-4a88-bf37-3c5bbe7a37bc} windefend_resource_assignment_v6 windefend FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} FWP_EMPTY FWP_ACTION_CALLOUT_INSPECTION {ced78e5f-1dd1-485a-9d35-7e44cc9d784d} 0 68279 FWP_UINT64 0 {16dfd892-4fa5-4dc8-bf0f-2e94ffe6f1ba} Microsoft Store Microsoft Store FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 0 68290 FWP_UINT64 10376434004072071168 FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD ALE Resource Assignment v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_ALE_PROMISCUOUS_MODE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 39 FWPM_LAYER_ALE_AUTH_LISTEN_V4 ALE Listen v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 40 FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 WFP Built-in Edge Traversal ALE Listen v4 Layer Callout Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic. FWPM_CALLOUT_FLAG_REGISTERED 00000014 FWPM_LAYER_ALE_AUTH_LISTEN_V4 29 {c3dbed20-0bb6-4bf3-828d-96732e1e0028} Windows Firewall: callout Notifies the user. FWPM_CALLOUT_FLAG_REGISTERED FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_LISTEN_V4 270 {93f12f2b-665e-44f2-a229-f5af613fe690} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e0028} {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67627 FWP_UINT64 9223372036854775840 {8f1a4c58-25f3-4358-84e9-4aaec8ab1398} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e0028} {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67635 FWP_UINT64 3458764513820540960 {85bce91c-5ad3-4c13-978f-edfd66523835} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWP_ACTION_PERMIT 0 67696 FWP_UINT64 10376293542535364544 {18f77a24-0d44-4919-98e7-f42eb1002af3} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 0 67697 FWP_UINT64 10376293542535364544 {1a3b3a34-55b4-4791-aa77-28e1c9f4f78a} Wireless Display Infrastructure Back Channel (TCP-In) Inbound rule for Wireless Display Infrastructure back channel [TCP] FWPM_PROVIDER_MPSSVC_WF a500000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000 \device\harddiskvolume3\windows\system32\castsrv.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7250 FWP_ACTION_PERMIT 0 67709 FWP_UINT64 10376293542535364480 {7fb5698e-c641-4fbc-b851-13c666f5e3aa} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 0 67772 FWP_UINT64 10376293541461622976 {c3711cf1-9bff-4f13-abcb-3ffdc68015d3} XING XING FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 0 67784 FWP_UINT64 10376293541461622976 {fa41fb18-1600-4eb8-a46e-b1e892bdc894} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 0 67796 FWP_UINT64 10376293541461622976 {0ee2b732-6452-42b4-9a5e-bdb97e3a925a} Xbox Game Bar Xbox Game Bar FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 0 67808 FWP_UINT64 10376293541461622976 {a11e4118-9942-4da1-bdbf-698fde8b5697} Microsoft Teams Microsoft Teams FWPM_PROVIDER_MPSSVC_WF b700000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe FWP_ACTION_PERMIT 0 67820 FWP_UINT64 10376293541461622912 {066a6860-5fb4-4dd2-bbc9-8bac48b6a4d4} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 0 67828 FWP_UINT64 10376293541461622976 {185af45b-b8b0-4110-a5a3-9732ccf1a36a} Cortana Cortana FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 0 67840 FWP_UINT64 10376293541461622976 {6ed9f2bc-535f-4575-a1b3-56e98dfc52ad} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 554 FWP_ACTION_PERMIT 0 68220 FWP_UINT64 10376293542535364544 {86edf865-f5c6-4b10-9eaa-63371a7287a1} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 8554 FWP_UINT16 8558 FWP_ACTION_PERMIT 0 68223 FWP_UINT64 10376293542379542720 {a8c97be3-77f0-4ea7-b5f8-10d91d382e1e} Microsoft Store Microsoft Store FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 0 68284 FWP_UINT64 10376293541461622976 FWPM_LAYER_ALE_AUTH_LISTEN_V4_DISCARD ALE Listen v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 41 FWPM_LAYER_ALE_AUTH_LISTEN_V6 ALE Listen v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 42 FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 WFP Built-in Edge Traversal ALE Listen v6 Layer Callout Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic. FWPM_CALLOUT_FLAG_REGISTERED 00000014 FWPM_LAYER_ALE_AUTH_LISTEN_V6 30 {c3dbed20-0bb6-4bf3-828d-96732e1e002a} Windows Firewall: callout Notifies the user. FWPM_CALLOUT_FLAG_REGISTERED FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_LISTEN_V6 271 {a8568747-7e3e-4077-adc4-4ad699d10d4b} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e002a} {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67631 FWP_UINT64 9223372036854775840 {9412dbc5-7e4a-4296-9b6b-309a61de48b4} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e002a} {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67639 FWP_UINT64 3458764513820540960 {05a88866-6122-4377-9ca8-432cbe8f64c2} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWP_ACTION_PERMIT 0 67701 FWP_UINT64 10376293541528731584 {8b44e0b3-d691-4d4b-a7ff-4ab5c957d05e} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 0 67702 FWP_UINT64 10376293541528731584 {9d45f132-f86f-4c7b-8f71-32000ba2136a} Wireless Display Infrastructure Back Channel (TCP-In) Inbound rule for Wireless Display Infrastructure back channel [TCP] FWPM_PROVIDER_MPSSVC_WF a500000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000 \device\harddiskvolume3\windows\system32\castsrv.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7250 FWP_ACTION_PERMIT 0 67711 FWP_UINT64 10376293541528731520 {89449f5a-57ae-4ae5-ac86-e4b758669e07} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 0 67777 FWP_UINT64 10376293541461622976 {aedc9943-eac8-497d-acc6-0e7175b5074b} XING XING FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 0 67789 FWP_UINT64 10376293541461622976 {8a3fa42a-2fab-485a-afad-8bcfbf876471} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 0 67801 FWP_UINT64 10376293541461622976 {09bda0cc-b7d7-4eea-84a5-587667ae638a} Xbox Game Bar Xbox Game Bar FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 0 67813 FWP_UINT64 10376293541461622976 {72f3c3d1-c6ff-4dc5-a385-a4cb9aad45f3} Microsoft Teams Microsoft Teams FWPM_PROVIDER_MPSSVC_WF b700000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe FWP_ACTION_PERMIT 0 67822 FWP_UINT64 10376293541461622912 {f4ed1f0f-7a1a-4025-89e2-38e6bebc3db8} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 0 67833 FWP_UINT64 10376293541461622976 {b452f283-2ec7-44cd-92aa-7b832d56e019} Cortana Cortana FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 0 67845 FWP_UINT64 10376293541461622976 {109e4154-56f4-4c4f-92d4-40cd1dc644ce} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 554 FWP_ACTION_PERMIT 0 68226 FWP_UINT64 10376293541528731584 {ea58a6ce-9d6b-46f2-9d4c-a1977a154b5b} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 8554 FWP_UINT16 8558 FWP_ACTION_PERMIT 0 68229 FWP_UINT64 10376293541518992832 {e65cf284-71bb-4869-b2ba-c9a7051d20fc} Microsoft Store Microsoft Store FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_CALLOUT_TERMINATING FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 0 68289 FWP_UINT64 10376293541461622976 FWPM_LAYER_ALE_AUTH_LISTEN_V6_DISCARD ALE Listen v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 43 FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 ALE Receive/Accept v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_NAP_CONTEXT FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_REAUTHORIZE_REASON FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 44 FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V4 WFP Built-in IPsec Inbound Initiate Secure v4 Layer Callout Verifies that each incoming connection that is supposed to arrive secure arrives securely. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 13 FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V4 WFP Built-in TCP Chimney Offload ALE Receive/Accept v4 Layer Callout Enables or disables TCP Chimney Offload for each incoming connection. FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 21 FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V4 WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v4 Layer Callout Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer. FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 25 FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V4 WFP Built-in TCP Templates ALE Receive/Accept v4 Layer Callout Applies TCP Template for each incoming connection. FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 35 FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4 WFP Built-in Set Option ALE Receive/Accept v4 Layer Callout Sets classify options on inbound flows. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 39 FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_RECV_ACCEPT_LAYER_V4 WFP Built-in Policy Silent Mode ALE Receive/Accept v4 Layer Callout Audit and log policy for incoming connection. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 43 {c3dbed20-0bb6-4bf3-828d-96732e1e022c} Windows Firewall: callout Allows secondary connections. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 284 {c970a45d-57f9-4e32-a5bd-886a9662641e} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 8388608 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-0-0 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66214 FWP_UINT64 18446744073709551615 {716b48eb-0a35-4a76-92ab-1d987230d288} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 8388608 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-0-0 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66218 FWP_UINT64 18446744073709551615 {a47525e2-725b-4888-8af1-ba5a60c04f4d} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 0 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66226 FWP_UINT64 0 {13bfd422-6f75-4408-8924-9400ec0cb19c} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 0 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66230 FWP_UINT64 0 {c42f1cd6-3a95-4ae2-a513-793c3ae610c7} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 0 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66235 FWP_UINT64 35165044736 {3697a558-3ed3-49be-a4c1-c1a4448653b4} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 0 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66237 FWP_UINT64 35165044736 {d870c96c-75ee-46a6-8a02-8e4401a73423} Quarantine Default Inbound Block This filter blocks any inbound non-loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 0 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_BLOCK {30433c31-b05f-421f-8fde-018ea4c68af4} 66241 FWP_UINT64 34359738368 {4137b143-2770-43d4-91a2-55bb0a069830} Quarantine Default Inbound Tunnel Exception This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 1 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66247 FWP_UINT64 1152921539503456256 {17043d46-fac2-4561-bca1-0c7a05e95f5f} Quarantine Default Inbound Next Hop Tunnel Exception This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 1 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66249 FWP_UINT64 1152921539503456256 {4e718c57-c397-4221-9fbb-14fd51701d6a} Quarantine Default Inbound DHCP Exception This filter allows for DHCP connections when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 68 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 67 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66251 FWP_UINT64 1154899560384954368 {916c0dbf-7cec-40f9-9dd9-a5e68b904510} Quarantine Default Inbound Loopback Exception This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66599 FWP_UINT64 18446744073709551615 {89a89b7c-b5ab-4ed6-bf05-d3059281a5c5} AppContainerBoottimeFilter Boottime filter for App Containers FWPM_FILTER_FLAG_BOOTTIME FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4194304 FWP_ACTION_PERMIT 0 66995 FWP_UINT64 18446744073709551615 {e72646bc-7d3f-4c5c-a679-b3716f8c6cc8} AppContainerBoottimeFilter Boottime filter for App Containers FWPM_FILTER_FLAG_PERSISTENT FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4194304 FWP_ACTION_PERMIT 0 66997 FWP_UINT64 18446744073709551615 {21c48193-9ccd-4faf-9590-99b6e4c8af2c} AppContainerLoopback This filter allows non-AppContainers to receive loopback traffic from other non-AppContainers FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 8388608 FWP_ACTION_PERMIT {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67190 FWP_UINT64 18446744073709551615 {7a5bb72c-0e75-4ad6-ae8a-9ffd591bb744} AppContainerLoopback This filter allows non-AppContainers to receive loopback traffic from by policy allowed AppContainers FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 16777216 FWP_ACTION_PERMIT {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67192 FWP_UINT64 18446744073709551615 {19a19270-e1ff-433e-a9a7-c2fd8fb46bcb} AppContainerLoopback This filter allows an AppContainer to receive loopback traffic from itself FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4194304 FWP_ACTION_PERMIT {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67194 FWP_UINT64 18446744073709551615 {1ea45d61-721b-47aa-9b19-81422ba8fdec} AppContainerLoopback This filter blocks AppContainer loopback traffic FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551614 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_BLOCK {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67200 FWP_UINT64 18446744073709551614 {558d57ba-cc4e-4bde-8ea0-8120605580b4} Interface Un-quarantine filter FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 0 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWP_MATCH_EQUAL FWP_UINT64 0 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWP_MATCH_EQUAL FWP_UINT64 6755399441055744 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_PERMIT 0 67453 FWP_UINT64 4503633987108866 {4ff11138-2d2f-4fcf-a884-d0be3936bc57} Interface Un-quarantine filter FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 0 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWP_MATCH_EQUAL FWP_UINT64 0 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWP_MATCH_EQUAL FWP_UINT64 6755399441055744 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67454 FWP_UINT64 4503633987108866 {b1686938-d80f-429d-b7d8-735a34b3605b} Interface Un-quarantine filter FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 0 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWP_MATCH_EQUAL FWP_UINT64 10000001 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWP_MATCH_EQUAL FWP_UINT64 1689399632855040 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_PERMIT 0 67457 FWP_UINT64 4503633987108866 {f708e179-0005-47bc-9659-9c9af4525161} Interface Un-quarantine filter FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 0 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWP_MATCH_EQUAL FWP_UINT64 10000001 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWP_MATCH_EQUAL FWP_UINT64 1689399632855040 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67458 FWP_UINT64 4503633987108866 {3668a51e-18e1-4b90-a348-1b26820075ee} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_BLOCK {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67630 FWP_UINT64 9223372036854776704 {996c5681-e762-4131-ba41-a4b2ba434af4} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWP_ACTION_BLOCK {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67638 FWP_UINT64 3458764513820540928 {e4bf8fce-257a-409d-82a9-c1d0de1706ef} UWP Default Inbound Block Rule This is the UWP Default Inbound Block filter. This filter blocks any inbound packets to UWP apps that do not have the correct capability tokens for listening to a resource. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_APP_ISOLATION 9900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_EMPTY FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_NOT_EQUAL FWP_SID S-1-0-0 FWP_ACTION_BLOCK {b36473ef-bf42-49b9-ac24-adba245e825c} 67657 FWP_UINT64 549755813888 {f6ac8f41-9cbd-478e-97ca-93406509632b} Core Networking - IPv6 (IPv6-In) Inbound rule required to permit IPv6 traffic for ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) and 6to4 tunnelling services. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9b00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 41 FWP_ACTION_PERMIT 0 67661 FWP_UINT64 10377982941077700608 {46ea0820-54e9-4671-9ee4-b5efa03e7fb2} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67665 FWP_UINT64 10378264690932318208 {9ed57c1d-5a7c-4821-85c1-bb4d5b005495} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67666 FWP_UINT64 10378264691737624576 {20aa0d80-0876-40ab-9060-81fa4852b804} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67667 FWP_UINT64 10378264726097362944 {1d948ce2-c67e-4612-9a13-a86146c93899} Core Networking - Destination Unreachable Fragmentation Needed (ICMPv4-In) Destination Unreachable Fragmentation Needed error messages are sent from any node that a packet traverses which is unable to forward the packet because fragmentation was needed and the don't fragment bit was set. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9e00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 4 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 1 FWP_ACTION_PERMIT 0 67676 FWP_UINT64 10378272112635805696 {4a6c385c-4d41-422e-80e2-a0a8ed98e329} Core Networking - Dynamic Host Configuration Protocol (DHCP-In) Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9f00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 68 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 67 FWP_ACTION_PERMIT 0 67678 FWP_UINT64 10378272387513712640 {9858d0f0-9bcd-4854-b300-54482931a983} Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In) Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a000000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 546 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 547 FWP_ACTION_PERMIT 0 67682 FWP_UINT64 10378272387513712640 {d864789f-7916-44d6-92d2-89c3cb3339ce} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67698 FWP_UINT64 10378264690932318208 {fa6ddfcb-e0e4-4e81-851e-bcc403c08a55} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67699 FWP_UINT64 10378264691737624576 {626051d7-734b-4953-9c98-0b07643b6ca2} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67700 FWP_UINT64 10378264726097362944 {db7d8fea-b0d0-47b8-ac4c-926e2d6fa47f} Wireless Display Infrastructure Back Channel (TCP-In) Inbound rule for Wireless Display Infrastructure back channel [TCP] FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000 \device\harddiskvolume3\windows\system32\castsrv.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7250 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67710 FWP_UINT64 10378264416054411264 {be661f2c-e574-4046-8c33-f35b7d29a7e4} Core Networking - Internet Group Management Protocol (IGMP-In) IGMP messages are sent and received by nodes to create, join and depart multicast groups. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ac00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 2 FWP_ACTION_PERMIT 0 67747 FWP_UINT64 10377982941077700608 {ead521c1-9552-4d43-8a5c-ceb57aca1dc8} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67774 FWP_UINT64 10376294366095343616 {1c30209e-d2ce-4392-9e8f-f377efb005e5} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67775 FWP_UINT64 10376294366900649984 {22519d4f-2ea3-4e42-8963-d6f0b7733aa2} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67776 FWP_UINT64 10376294401260388352 {29c7768e-567b-4383-9274-88ce90b281c8} XING XING FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67786 FWP_UINT64 10376294366095343616 {d6953602-d25c-44c8-89be-32af54554764} XING XING FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67787 FWP_UINT64 10376294366900649984 {1d52280a-5200-4f1b-b9f2-ff576ef4721e} XING XING FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67788 FWP_UINT64 10376294401260388352 {22d44aac-6653-4e7b-aa73-9e3f59633d4f} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67798 FWP_UINT64 10376294366095343616 {d6346862-1e03-4aeb-ba63-df5639ea6fec} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67799 FWP_UINT64 10376294366900649984 {6f8d75fc-f3b5-4016-81e2-4f2df77168cf} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67800 FWP_UINT64 10376294401260388352 {c041bcbc-c3b0-4002-9e12-424d925ac610} Xbox Game Bar Xbox Game Bar FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67810 FWP_UINT64 10376294366095343616 {ed0b7196-2d26-4cf8-8de9-ae943554347d} Xbox Game Bar Xbox Game Bar FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67811 FWP_UINT64 10376294366900649984 {d45600c9-f182-43ae-b1ea-40ebdeea9b99} Xbox Game Bar Xbox Game Bar FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67812 FWP_UINT64 10376294401260388352 {b6cc72ea-22a1-483e-9636-090bb5302940} Microsoft Teams Microsoft Teams FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b700000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67821 FWP_UINT64 10377982941077700608 {5bd7313e-64c8-4956-a5d5-a598afeeaea0} Microsoft Teams Microsoft Teams FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b800000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67825 FWP_UINT64 10377982941077700608 {ec36ba3d-18ff-43c9-a323-bd61ebf5cdf9} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67830 FWP_UINT64 10376294366095343616 {50aedebf-9228-41e5-826c-880c0dfeeeb9} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67831 FWP_UINT64 10376294366900649984 {fce876c5-0650-4cf0-a8e5-32763f4572db} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67832 FWP_UINT64 10376294401260388352 {8075d897-3b61-4b0d-a1b7-8cf360304598} Cortana Cortana FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67842 FWP_UINT64 10376294366095343616 {e2918c6c-304d-4dba-a100-4c19a688541d} Cortana Cortana FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67843 FWP_UINT64 10376294366900649984 {41000d2a-eba0-40b3-93b1-42d9352f0b1f} Cortana Cortana FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67844 FWP_UINT64 10376294401260388352 {e7abd6b3-64e1-456b-9de4-80bd51c45892} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF bb00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67853 FWP_UINT64 10378264416054411264 {3474e056-188f-44cd-bf0e-f2b9395d00b1} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF bd00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67869 FWP_UINT64 10378264416054411264 {3bba491b-aba5-4198-9599-0560f76b1c4d} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF be00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67873 FWP_UINT64 10378264416054411264 {6236913c-4c2a-430b-817d-4c4fcde825ee} Allow inbound UDP traffic to CDPSvc port 5050 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c200000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5050 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67878 FWP_UINT64 1971149470695424 {66924806-dccf-403e-97a9-14fcc9d64f9a} Allow inbound TCP traffic to CDPSvc from any port to port 5160 (Wi-Fi Direct Transport) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c700000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5160 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67888 FWP_UINT64 1971149470695424 {1cf98e43-5bb6-4020-8666-ff5dc7a76123} Allow inbound TCP traffic to CDPSvc from any port to port 5040 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5040 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67892 FWP_UINT64 1971149470695424 {215327fd-5d26-4b42-9e18-ee1e1f871285} Block inbound traffic to omadmclient.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH ca00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 \device\harddiskvolume3\windows\system32\omadmclient.exe FWP_ACTION_BLOCK {a8b55da6-3aba-41f3-b7ba-443233f64fce} 67894 FWP_UINT64 549755813888 {9bce6a19-81a8-4ff2-8fe8-e63940b2f706} Block inbound traffic to deviceenroller.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH cb00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 \device\harddiskvolume3\windows\system32\deviceenroller.exe FWP_ACTION_BLOCK {c4e61e5c-3e66-4efb-b22b-87f8e56cf9c2} 67896 FWP_UINT64 549755813888 {2ea83abb-f047-4edc-857d-4776be7ddb86} Block inbound traffic to dmcertinst.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH d000000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\dmcertinst.exe FWP_ACTION_BLOCK {616fdcf3-1169-46b5-8224-cffc7276af2e} 67906 FWP_UINT64 549755813888 {dd658fab-9acd-48c8-9faf-a0e67d88ca4c} DhcpFirewallPolicy DhcpFirewallPolicy FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 68 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 67 FWP_ACTION_PERMIT 0 67916 FWP_UINT64 1978846052089856 {38119412-b39e-48a6-8fcd-1e7dedc4be5e} DhcpFirewallPolicy DhcpFirewallPolicy FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 546 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 547 FWP_ACTION_PERMIT 0 67918 FWP_UINT64 1978846052089856 {f4e952f7-52be-4ea6-abb2-90f88debea25} Allow RPC/TCP traffic to EventLog FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67924 FWP_UINT64 1689691673853952 {c76886bf-c4ec-4208-8833-3b243baba297} Allow inbound UDP traffic to fdphost port 3702 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH da00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67926 FWP_UINT64 1971149470695424 {01569aae-88e0-4cfd-98c5-714f5a86ee63} Allow inbound UDP traffic to fdphost port 1900 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH dc00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 1900 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67930 FWP_UINT64 1971149470695424 {4e359e41-d670-4727-a4df-48984e785c40} Allow inbound TCP traffic to AJRouter FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 9955 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67940 FWP_UINT64 1971149470695424 {88e8faac-2f47-487a-a93f-709d1cb0bf7b} Allow inbound UDP traffic to AJRouter FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e200000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67942 FWP_UINT64 1689674493984768 {ac4aaa1b-a5f2-41fa-b624-39f34a249fe4} Allow Grouping to receive from port 3587 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3587 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67948 FWP_UINT64 1971149470695424 {1f67d6c0-f1de-4524-a4a7-8a93b03238b2} Allow PNRP to send to port 3540 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e700000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3540 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67952 FWP_UINT64 1971149470695424 {c68ac2bf-ad79-4aaf-a764-a9de591a17f3} IPsec Policy Agent service hardening - Remote Management Allow IPsec Policy Agent inbound RPC/TCP traffic for Remote Management FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH eb00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67960 FWP_UINT64 1689691673853952 {9b2018aa-486c-4b5e-9a4c-a1b96ecf2cbc} Block all inbound traffic to SearchFilterHost FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH ec00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\searchfilterhost.exe FWP_ACTION_BLOCK {3a5e8a34-82df-4083-a6ed-87ea8ed3507a} 67962 FWP_UINT64 549755813888 {27db903a-7e87-41ff-8a17-31ca20c9fb16} Block all inbound traffic to SearchProtocolHost FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH ef00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\searchprotocolhost.exe FWP_ACTION_BLOCK {c0cedbe2-34f4-4491-bd19-152a55b1b6e0} 67968 FWP_UINT64 549755813888 {bd84fe34-f5b3-48c8-90f7-3f647e9bebe3} Allow inbound UDP traffic to SNMPTRAP service FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f000000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006e006d00700074007200610070002e006500780065000000 \device\harddiskvolume3\windows\system32\snmptrap.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67970 FWP_UINT64 1689674493984768 {c718ce9d-2f72-430c-beeb-789fa9d7c5ea} Allow all inbound TCP and RPC to SPPEXTCOMOBJ FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000 \device\harddiskvolume3\windows\system32\sppextcomobj.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67972 FWP_UINT64 1689674493984768 {bdc0147f-ebdd-4b25-a20a-5c3ed10cbd3f} TermServiceLOM FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67976 FWP_UINT64 1689674493984768 {3ddc2b0e-33e3-417b-a578-019a4df4b502} TermServiceLOM FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_UINT64 18446744073709551615 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_INSPECTION FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4 {2ea412db-5c9d-4bbd-9af2-4914d2dbfe17} 67977 FWP_UINT64 18446744073709551615 {d9a39ed3-698d-434e-83e1-f8a75a5b6a31} Allow incoming RPC traffic to VDS FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007600640073002e006500780065000000 \device\harddiskvolume3\windows\system32\vds.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67980 FWP_UINT64 1689691673853952 {ff843ce9-c5e3-49a0-84d2-cdfa59928fc7} Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 389 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67982 FWP_UINT64 1971149470695424 {810b03cc-8f67-4991-bf02-fe78e19477c2} Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 636 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67983 FWP_UINT64 1971149470695424 {4e788a24-1c9a-4fe2-bfbc-a7c10bd5bd7e} Allow inbound UDP traffic to NTP port 123 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f700000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 123 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67988 FWP_UINT64 1971149470695424 {b14b6b1e-1bfe-4dfd-8a8e-393da4d4b226} Allow inbound RPC traffic to the Block Level Backup service (wbengine) over TCP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007700620065006e00670069006e0065002e006500780065000000 \device\harddiskvolume3\windows\system32\wbengine.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67992 FWP_UINT64 1689691673853952 {865a8428-bb5e-4b7b-8473-b06bf1b69edb} Cast to Device streaming server hardening rules for RTSP Allow incoming RTSP connections to the Cast to Device streaming server FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0201000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 \device\harddiskvolume3\windows\system32\mdeserver.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 23554 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68014 FWP_UINT64 1970874592788480 {d12a44b6-3150-4214-997f-0735fad61441} Cast to Device streaming server hardening rules for RTSP Allow incoming RTSP connections to the Cast to Device streaming server FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0201000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 \device\harddiskvolume3\windows\system32\mdeserver.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 23555 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68015 FWP_UINT64 1970874592788480 {690e53fb-c3c2-4e74-a58a-b627852bff69} Cast to Device streaming server hardening rules for RTSP Allow incoming RTSP connections to the Cast to Device streaming server FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0201000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 \device\harddiskvolume3\windows\system32\mdeserver.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 23556 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68016 FWP_UINT64 1970874592788480 {c3b150a5-0e63-4acf-99d8-93fa101c9f4c} Allow incoming TCP to PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0301000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68020 FWP_UINT64 1689674493984768 {cc829f3a-8ac5-461d-bf9e-b53fa92bf4a6} Windows Media Player Network Sharing Service service hardening - RTSP Allow incoming RTSP connections to the Windows Media Player Network Sharing Service FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0901000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000 \device\harddiskvolume3\program files\windows media player\wmpnetwk.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 554 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68040 FWP_UINT64 1971149470695424 {81b5a3ad-8373-4dda-8234-524b6d6411f7} Windows Media Player Network Sharing Service service hardening - RTSP Allow incoming RTSP connections to the Windows Media Player Network Sharing Service FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0901000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000 \device\harddiskvolume3\program files\windows media player\wmpnetwk.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 8554 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68041 FWP_UINT64 1971149470695424 {6c2e5205-ac93-4a93-945a-9d07d7f97ff7} WSH Default Inbound Block Blocks all inbound traffic for services who have been network hardened FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3914275374-678031271-1603343729-3906112567-2888048264)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL FWP_ACTION_BLOCK {de04f4bd-a953-47f6-b1b6-eb6e24a546d6} 68047 FWP_UINT64 274877906944 {36e4f41f-09b7-4858-a3f7-1f07b2f62dcf} FTP Inspection Filter This filter enables inspection of FTP. FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 1024 FWP_UINT16 65535 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e022c} 0 68052 FWP_UINT64 18446744073709551615 {52c05a69-b7bd-471e-90f6-b4165265dee2} InternetClientServer Inbound Default Rule InternetClientServer Inbound Default Rule FWPM_PROVIDER_MPSSVC_APP_ISOLATION 1c01000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_EMPTY FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_NOT_EQUAL FWP_SID S-1-0-0 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 0.0.0.0 FWP_UINT32 255.255.255.255 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_PERMIT 0 68208 FWP_UINT64 824633721848 {de8c0919-fdae-4263-9186-3209ef7a9203} Microsoft Media Foundation Network Source IN [UDP 5004-5009] InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 1f01000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 5000 FWP_UINT16 5020 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68215 FWP_UINT64 10882588684629049344 {2f69ffa4-769a-4f40-a565-b54847821e5b} Microsoft Media Foundation Network Source IN [UDP 5004-5009] InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 1f01000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 5000 FWP_UINT16 5020 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68216 FWP_UINT64 10882588718988787712 {11dd8bd8-1210-4a7e-adb2-460cf2b6a1c1} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 554 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68221 FWP_UINT64 10882667849466249216 {d9e43dad-f679-4f2f-973d-26827bb8c8d3} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 554 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68222 FWP_UINT64 10882667883825987584 {9ce6ee0e-7cfb-4b36-bc70-a57d7a63f100} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 8554 FWP_UINT16 8558 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68224 FWP_UINT64 10882623869001138176 {80750116-2e93-43ec-8465-40d3dbf5c900} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 8554 FWP_UINT16 8558 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68225 FWP_UINT64 10882623903360876544 {e43d0b2d-6a0f-432b-91a1-504f070a7035} WFD ASP Coordination Protocol (UDP-In) Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2201000000000000 "....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWP_ACTION_PERMIT 0 68235 FWP_UINT64 10882675546047643648 {1c5d0851-defc-4241-8f7f-20f4ce925d56} WFD ASP Coordination Protocol (UDP-In) Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2201000000000000 "....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68236 FWP_UINT64 10882675580407382016 {353edb90-351b-439f-bb1a-499f3ee0d611} mDNS (UDP-In) Inbound rule for mDNS traffic [UDP] FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2601000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68247 FWP_UINT64 10882667849466249216 {acfb0f39-be2d-43a6-a260-1b6ea1aa107d} mDNS (UDP-In) Inbound rule for mDNS traffic [UDP] FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2601000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68248 FWP_UINT64 10882667883825987584 {9f4f259a-998a-4cad-b318-aeab2fccb2d1} Wi-Fi Direct ASP Coordination Protocol (UDP-In) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2701000000000000 '....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWP_ACTION_PERMIT 0 68252 FWP_UINT64 506382004586020864 {826bf713-3f53-422d-9ab6-f66251968bdf} Wi-Fi Direct ASP Coordination Protocol (UDP-In) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2701000000000000 '....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68253 FWP_UINT64 506382038945759232 {f7b10da2-52b3-4496-af84-a4141986b1fb} Allow incoming WSD to PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2901000000000000 )....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68260 FWP_UINT64 506374308004626432 {a2e9e943-0681-4a0e-8c58-485b3ceff496} Allow incoming WSD to PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2901000000000000 )....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68261 FWP_UINT64 506374342364364800 {0ae65187-1f62-4d22-9fde-4f60caac6393} Allow incoming WSD to PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2a01000000000000 *....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWP_ACTION_PERMIT 0 68264 FWP_UINT64 506100529609310208 {7184c665-64f2-476c-af5a-01cc74b700da} Allow incoming WSD to PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2a01000000000000 *....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68265 FWP_UINT64 506100563969048576 {d69d41e1-ee28-47d3-90a0-4e0eef6a868f} Microsoft Store Microsoft Store FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 68286 FWP_UINT64 10376294366095343616 {4442f710-abac-421f-9d4f-f02939d23c63} Microsoft Store Microsoft Store FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 68287 FWP_UINT64 10376294366900649984 {d68c9ba7-1425-44da-b537-7642ce5bbe9d} Microsoft Store Microsoft Store FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68288 FWP_UINT64 10376294401260388352 FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD ALE Receive/Accept v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_NAP_CONTEXT FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_REAUTHORIZE_REASON FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 45 {c3dbed20-0bb6-4bf3-828d-96732e1e012d} Windows Firewall: callout Performs logging. FWPM_CALLOUT_FLAG_REGISTERED 00000200 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD 278 FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 ALE Receive/Accept v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_NAP_CONTEXT FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_REAUTHORIZE_REASON FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 46 FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V6 WFP Built-in IPsec Inbound Initiate Secure v6 Layer Callout Verifies that each incoming connection that is supposed to arrive secure arrives securely. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 14 FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V6 WFP Built-in TCP Chimney Offload ALE Receive/Accept v6 Layer Callout Enables or disables TCP Chimney Offload for each incoming connection. FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 22 FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V6 WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v6 Layer Callout Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer. FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 26 FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V6 WFP Built-in TCP Templates ALE Receive/Accept v6 Layer Callout Applies TCP Template for each incoming connection. FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 36 FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6 WFP Built-in Set Option ALE Receive/Accept v6 Layer Callout Sets classify options on inbound flows. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 40 FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_RECV_ACCEPT_LAYER_V6 WFP Built-in Policy Silent Mode ALE Receive/Accept v6 Layer Callout Audit and log policy for incoming connection. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 44 {c3dbed20-0bb6-4bf3-828d-96732e1e022e} Windows Firewall: callout Allows secondary connections. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 285 {dc95b53e-01cf-4058-821d-350b3d0d4676} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66210 FWP_UINT64 1153167795211468800 {f444c576-6e60-4ea2-9faa-80d57ed12cd2} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66211 FWP_UINT64 1153167795211468800 {0c3be01b-fe70-4cc4-89dc-c07996b67e6d} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 8388608 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-0-0 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66215 FWP_UINT64 18446744073709551615 {1165065e-4996-4338-abaf-4b8556b4d431} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 8388608 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-0-0 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66219 FWP_UINT64 18446744073709551615 {0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 0 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66227 FWP_UINT64 0 {cbfb56db-3c85-4543-9bc2-76ea28cdd74e} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 0 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66231 FWP_UINT64 0 {2dd96961-5757-434f-b617-34e732517c0e} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 0 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66232 FWP_UINT64 8992587776 {375fb39b-08c6-40f2-bdf2-08fa63f970a2} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 0 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66233 FWP_UINT64 8992587776 {2db25e6c-f07a-44f4-b6c8-50a330d2790b} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_BOOTTIME FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 0 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66234 FWP_UINT64 8992587776 {b6fdab6b-dcc6-43e3-99ce-7aeca65063a4} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 0 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_BLOCK {93132c36-6e06-4e6f-a10b-218787cd49cf} 66236 FWP_UINT64 8992587776 {b02a4013-b6b5-4859-9168-1e3299e43b24} Quarantine Default Inbound Block This filter blocks any inbound non-loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 0 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_BLOCK {30433c31-b05f-421f-8fde-018ea4c68af4} 66240 FWP_UINT64 8589934592 {8b50e2ec-7cf0-4b71-b42e-5b0536f6cab8} Quarantine Default Inbound Tunnel Exception This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 1 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66246 FWP_UINT64 1152921513465217024 {3180114b-8338-4740-9a16-444134ad62f4} Quarantine Default Inbound Next Hop Tunnel Exception This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 1 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66248 FWP_UINT64 1152921513465217024 {567d3836-3f5b-4067-b9c4-952f677010a2} Quarantine Default Inbound Neighbor Discovery Exception This filter allows for Neighbor Discovery when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66250 FWP_UINT64 1153167795211468800 {3a90a266-1519-4d23-911b-e84cd0f02ab8} Quarantine Default Inbound DHCP Exception This filter allows for DHCP connections when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 546 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 547 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66252 FWP_UINT64 1153169727946752000 {0593d9b7-8e2b-44b1-9f9e-2831da1c9bd9} Quarantine Default Inbound Loopback Exception This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66598 FWP_UINT64 18446744073709551615 {70694559-714a-4a38-a0cd-51439e06f1d8} Quarantine Default Inbound ICMP Exception This filter allows for ICMP connections when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66602 FWP_UINT64 1225225526688350208 {84750a0c-b836-48e3-ab80-104985c857db} AppContainerBoottimeFilter Boottime filter for App Containers FWPM_FILTER_FLAG_BOOTTIME FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4194304 FWP_ACTION_PERMIT 0 66996 FWP_UINT64 18446744073709551615 {b98b75dc-17c0-4e84-bd4e-2080527ca6a6} AppContainerBoottimeFilter Boottime filter for App Containers FWPM_FILTER_FLAG_PERSISTENT FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4194304 FWP_ACTION_PERMIT 0 66998 FWP_UINT64 18446744073709551615 {5e48f4ad-9f6c-4c4e-a83a-d1ac10317436} Teredo socket option opt out block filter {c698301d-9129-450c-937c-f4b834bfb374} FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 {7b6b11f6-cbb5-433c-ae06-6a4f0076e49e} FWP_UINT64 18446744073709551615 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_BLOCK 0 67005 FWP_UINT64 18446744073709551615 {6109847e-3461-46a7-8bbb-58bd48643bf0} AppContainerLoopback This filter allows non-AppContainers to receive loopback traffic from other non-AppContainers FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 8388608 FWP_ACTION_PERMIT {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67191 FWP_UINT64 18446744073709551615 {1f1a43af-2fa5-4f1a-8d8e-395b07d53b24} AppContainerLoopback This filter allows non-AppContainers to receive loopback traffic from by policy allowed AppContainers FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 16777216 FWP_ACTION_PERMIT {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67193 FWP_UINT64 18446744073709551615 {a974e5b7-ff22-43d9-a813-01c5d1283b2e} AppContainerLoopback This filter allows an AppContainer to receive loopback traffic from itself FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4194304 FWP_ACTION_PERMIT {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67195 FWP_UINT64 18446744073709551615 {e3ac824d-4754-4603-80fb-48fe7450e46b} AppContainerLoopback This filter blocks AppContainer loopback traffic FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551614 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_BLOCK {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67201 FWP_UINT64 18446744073709551614 {36bb2266-0f81-4937-af6b-63086254e9df} Interface Un-quarantine filter FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 0 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWP_MATCH_EQUAL FWP_UINT64 0 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWP_MATCH_EQUAL FWP_UINT64 6755399441055744 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_PERMIT 0 67455 FWP_UINT64 562958543355906 {d3e85111-30f5-4ff0-850f-8622624aadcf} Interface Un-quarantine filter FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 0 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWP_MATCH_EQUAL FWP_UINT64 0 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWP_MATCH_EQUAL FWP_UINT64 6755399441055744 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67456 FWP_UINT64 562958543355906 {8c9a53ad-9d03-4280-9e0a-53754eb303bd} Interface Un-quarantine filter FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 0 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWP_MATCH_EQUAL FWP_UINT64 10000002 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWP_MATCH_EQUAL FWP_UINT64 1689399632855040 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_PERMIT 0 67459 FWP_UINT64 562958543355906 {8540bba7-40c4-4959-85fd-c082688a1176} Interface Un-quarantine filter FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT8 0 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWP_MATCH_EQUAL FWP_UINT64 10000002 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWP_MATCH_EQUAL FWP_UINT64 1689399632855040 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67460 FWP_UINT64 562958543355906 {6fc5fe31-8779-4b15-9576-3ba7ff0b0ce4} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_BLOCK {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67634 FWP_UINT64 9223372036854776768 {569702e8-0383-45e2-a938-743a0b269a89} Query User Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF 9400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWP_ACTION_BLOCK {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} 67642 FWP_UINT64 3458764513820540928 {c833a355-c4ff-4504-ba03-e56b2edcf0b2} UWP Default Inbound Block Rule This is the UWP Default Inbound Block filter. This filter blocks any inbound packets to UWP apps that do not have the correct capability tokens for listening to a resource. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_APP_ISOLATION 9900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_EMPTY FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_NOT_EQUAL FWP_SID S-1-0-0 FWP_ACTION_BLOCK {b36473ef-bf42-49b9-ac24-adba245e825c} 67658 FWP_UINT64 137438953472 {1c63c63e-acc4-4ef8-b31e-a3c7156292df} Core Networking - IPv6 (IPv6-In) Inbound rule required to permit IPv6 traffic for ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) and 6to4 tunnelling services. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9b00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 41 FWP_ACTION_PERMIT 0 67662 FWP_UINT64 10376504785133109248 {b9346349-afa6-45c1-875e-5e12437b1648} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67670 FWP_UINT64 10376540038224674816 {e0e890e5-0dbb-449d-926f-36ecc0d32307} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67671 FWP_UINT64 10376540038627328000 {79923371-5423-4aa7-9d60-86afaac5ce75} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67672 FWP_UINT64 10376540047217262592 {e67d1661-76e2-4fdf-bbab-5f1cd28e3ea4} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67673 FWP_UINT64 10376540038627328000 {72a57651-9ca9-4550-ba15-cb5c797b3281} Delivery Optimization (UDP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9c00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67674 FWP_UINT64 10376540047217262592 {9ee8af53-7d0c-48f1-892e-3038f67c8771} Core Networking - Router Advertisement (ICMPv6-In) Router Advertisement messages are sent by routers to other nodes for stateless auto-configuration. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9d00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 67675 FWP_UINT64 10664770345656909824 {269d6a27-dcd7-4d83-8e64-34e06f1fab75} Core Networking - Dynamic Host Configuration Protocol (DHCP-In) Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 9f00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 68 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 67 FWP_ACTION_PERMIT 0 67680 FWP_UINT64 10376541962370023424 {4f4f8d89-0d09-4170-91e5-b50e05fd12ba} Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In) Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a000000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 546 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 547 FWP_ACTION_PERMIT 0 67684 FWP_UINT64 10376541962370023424 {dc4fed41-3e88-48ec-8363-d1dabe968953} Core Networking - Neighbour Discovery Solicitation (ICMPv6-In) Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 67685 FWP_UINT64 10376539969505198080 {24a4ff08-78cb-425a-8412-de0c6eee513f} Core Networking - Neighbour Discovery Solicitation (ICMPv6-In) Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67686 FWP_UINT64 10376539969907851264 {925f3a0e-53c9-4c55-8506-1a50be54a688} Core Networking - Neighbour Discovery Solicitation (ICMPv6-In) Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67687 FWP_UINT64 10376539978497785856 {b0c5f46c-f20b-455a-94a5-ba616b03ba89} Core Networking - Neighbour Discovery Solicitation (ICMPv6-In) Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67688 FWP_UINT64 10376539969907851264 {7c5bf10d-2519-47ac-9864-28272c35ecd6} Core Networking - Neighbour Discovery Solicitation (ICMPv6-In) Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67689 FWP_UINT64 10376539978497785856 {b0a2ee9b-60e1-4c3a-a2e8-db6ffaec87e2} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67703 FWP_UINT64 10376540038224674816 {e5c30a1f-bd12-46f2-9eb5-0dfa08e13499} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67704 FWP_UINT64 10376540038627328000 {0921d09f-c82d-41d2-814f-6ac23cfb74f5} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67705 FWP_UINT64 10376540047217262592 {31d9ed8a-a509-4a04-a9fc-c09be2ae87af} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67706 FWP_UINT64 10376540038627328000 {78a6c883-2926-4fa7-82ed-335f51c3b5bd} Delivery Optimization (TCP-In) Inbound rule to allow Delivery Optimization to connect to remote endpoints FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7680 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67707 FWP_UINT64 10376540047217262592 {076c0bad-60b8-4a49-a4ce-83bdc9a879f0} Core Networking - Router Solicitation (ICMPv6-In) Router Solicitation messages are sent by nodes seeking routers to provide stateless auto-configuration. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 67708 FWP_UINT64 10376539969505198080 {45791038-5827-4a2e-993b-7ebfdccffa6a} Wireless Display Infrastructure Back Channel (TCP-In) Inbound rule for Wireless Display Infrastructure back channel [TCP] FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000 \device\harddiskvolume3\windows\system32\castsrv.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7250 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67712 FWP_UINT64 10376539969505198080 {0f24cc1b-3e3d-44e1-90a0-f20ac3e4462e} Core Networking - Neighbour Discovery Advertisement (ICMPv6-In) Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 67713 FWP_UINT64 10376539969505198080 {52dc6841-c31e-4d63-bc57-4e0e2b9b9671} Core Networking - Neighbour Discovery Advertisement (ICMPv6-In) Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67714 FWP_UINT64 10376539969907851264 {42f19b9f-5956-45b5-a51c-5b5267d5005a} Core Networking - Neighbour Discovery Advertisement (ICMPv6-In) Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67715 FWP_UINT64 10376539978497785856 {2d1be467-dab7-4309-89bc-0e16efbeb1e7} Core Networking - Neighbour Discovery Advertisement (ICMPv6-In) Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67716 FWP_UINT64 10376539969907851264 {c094b7da-b5e2-4cac-bf03-d3f8dd685948} Core Networking - Neighbour Discovery Advertisement (ICMPv6-In) Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67717 FWP_UINT64 10376539978497785856 {4aee5ef2-93d5-46e6-bee0-725d8e4cdc07} Core Networking - Parameter Problem (ICMPv6-In) Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a800000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 4 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 67730 FWP_UINT64 10376539969505198080 {4887adbb-3a7a-48f0-a6b1-9243969c1d1c} Core Networking - Parameter Problem (ICMPv6-In) Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a800000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 4 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67731 FWP_UINT64 10376539969907851264 {56a02554-23d2-4984-95a9-2f461cc4fa66} Core Networking - Parameter Problem (ICMPv6-In) Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a800000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 4 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67732 FWP_UINT64 10376539978497785856 {13668b24-1745-4eef-8097-a78f1683cf37} Core Networking - Parameter Problem (ICMPv6-In) Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a800000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 4 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67733 FWP_UINT64 10376539969907851264 {d9f3965a-d5ba-402c-be4b-fd46d258c1e8} Core Networking - Parameter Problem (ICMPv6-In) Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a800000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 4 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67734 FWP_UINT64 10376539978497785856 {630130e6-d0ee-4f95-917f-727386eef3d2} Core Networking - Packet Too Big (ICMPv6-In) Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 2 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 67735 FWP_UINT64 10376539969505198080 {24a965e8-7b7e-4248-b6fa-b4f93990c49a} Core Networking - Packet Too Big (ICMPv6-In) Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 2 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67736 FWP_UINT64 10376539969907851264 {1f160125-9b36-460c-a743-a7e17c45ed4f} Core Networking - Packet Too Big (ICMPv6-In) Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 2 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67737 FWP_UINT64 10376539978497785856 {5cdc61d6-8697-400d-91c3-ff55d00ff9a9} Core Networking - Packet Too Big (ICMPv6-In) Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 2 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67738 FWP_UINT64 10376539969907851264 {412c57e1-2038-40cf-a4eb-1006cc161782} Core Networking - Packet Too Big (ICMPv6-In) Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF a900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 2 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67739 FWP_UINT64 10376539978497785856 {33ea4c7f-33e0-4ebc-934e-5c4d8c6bb21e} Core Networking - Destination Unreachable (ICMPv6-In) Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ab00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 67742 FWP_UINT64 10376539969505198080 {5c2001c6-fed1-458f-a2e5-f05059ba33b3} Core Networking - Destination Unreachable (ICMPv6-In) Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ab00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67743 FWP_UINT64 10376539969907851264 {11917a18-01cd-4f40-94a2-c11700ffd140} Core Networking - Destination Unreachable (ICMPv6-In) Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ab00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67744 FWP_UINT64 10376539978497785856 {65a7e69a-8dda-48bf-8f7f-77f85ef66d4d} Core Networking - Destination Unreachable (ICMPv6-In) Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ab00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67745 FWP_UINT64 10376539969907851264 {0c139d5c-00c0-40fe-a291-119da3eb65a1} Core Networking - Destination Unreachable (ICMPv6-In) Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ab00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67746 FWP_UINT64 10376539978497785856 {d91c02d3-8acf-4ca8-b00e-c70abeb4e4f4} Core Networking - Internet Group Management Protocol (IGMP-In) IGMP messages are sent and received by nodes to create, join and depart multicast groups. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ac00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 2 FWP_ACTION_PERMIT 0 67748 FWP_UINT64 10376504785133109248 {8e67bf87-b3ab-4faa-966d-0374819472f1} Core Networking - Time Exceeded (ICMPv6-In) Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 67761 FWP_UINT64 10376539969505198080 {03d3765e-5cbb-482f-92e2-b1c2813d43a0} Core Networking - Time Exceeded (ICMPv6-In) Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67762 FWP_UINT64 10376539969907851264 {7e3d00b3-7372-4d01-9d99-0ad72294a64e} Core Networking - Time Exceeded (ICMPv6-In) Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67763 FWP_UINT64 10376539978497785856 {f4ad030a-de57-4da0-aae8-34007c10742c} Core Networking - Time Exceeded (ICMPv6-In) Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67764 FWP_UINT64 10376539969907851264 {db8b7e5e-dfe4-4a20-9ce2-94970713653f} Core Networking - Time Exceeded (ICMPv6-In) Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 3 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67765 FWP_UINT64 10376539978497785856 {6fe6052c-9f1b-449f-80e6-1933bd00c2bd} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67779 FWP_UINT64 10376293747620052992 {25113d41-4bfd-4f42-b8ed-0782825d5cef} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67780 FWP_UINT64 10376293748022706176 {e33d2046-cd76-4858-82c6-4604a02f215f} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67781 FWP_UINT64 10376293756612640768 {c67dd978-8cee-43a5-b7c5-7394d13639dd} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67782 FWP_UINT64 10376293748022706176 {577f1fbd-6697-4374-831d-ab4957b5d82a} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67783 FWP_UINT64 10376293756612640768 {497778bf-d906-447e-97c6-3d90e01faf13} XING XING FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67791 FWP_UINT64 10376293747620052992 {fa37a31f-edf8-45f1-a12a-3979b049b980} XING XING FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67792 FWP_UINT64 10376293748022706176 {7348c729-bea7-4ce3-9126-91bacbf060ab} XING XING FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67793 FWP_UINT64 10376293756612640768 {245b69e4-1a3a-4fe8-9121-f716a7758498} XING XING FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67794 FWP_UINT64 10376293748022706176 {06682e90-222d-41d9-a82a-c80c77bd5d24} XING XING FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67795 FWP_UINT64 10376293756612640768 {f8fe4921-4cac-4e53-9a94-6f3ba592041f} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67803 FWP_UINT64 10376293747620052992 {54e08d95-dd62-45d7-89d8-aaa4b6ef259b} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67804 FWP_UINT64 10376293748022706176 {219df051-7115-4bae-844c-ff5b93b401c5} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67805 FWP_UINT64 10376293756612640768 {bfec4abb-9fae-4382-9946-0f22c6cc800a} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67806 FWP_UINT64 10376293748022706176 {7951db55-918d-43fc-b66a-21a5f9c754e5} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67807 FWP_UINT64 10376293756612640768 {2743ed06-9818-463f-8aa4-b97a298ee1e3} Xbox Game Bar Xbox Game Bar FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67815 FWP_UINT64 10376293747620052992 {6e4a1c0a-729d-431d-9f8d-0a1df4f16f2f} Xbox Game Bar Xbox Game Bar FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67816 FWP_UINT64 10376293748022706176 {173e4b5d-3445-413c-a0a6-f1900681f228} Xbox Game Bar Xbox Game Bar FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67817 FWP_UINT64 10376293756612640768 {f5f65248-7c4f-4a2a-bf44-ef3d8385796f} Xbox Game Bar Xbox Game Bar FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67818 FWP_UINT64 10376293748022706176 {95150dd6-5f6b-4d72-a721-bd90f0f3e1e3} Xbox Game Bar Xbox Game Bar FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67819 FWP_UINT64 10376293756612640768 {5e458804-9d6b-4374-aeb0-0fab8ebfa394} Microsoft Teams Microsoft Teams FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b700000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67823 FWP_UINT64 10376504785133109248 {f767a292-c59e-40a5-a090-99dbd8574026} Microsoft Teams Microsoft Teams FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b800000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67827 FWP_UINT64 10376504785133109248 {5c28dd7c-af06-4a4c-876c-0dc6ab29ee70} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67835 FWP_UINT64 10376293747620052992 {559be0e2-e31c-4860-b8f4-f535b5f067ba} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67836 FWP_UINT64 10376293748022706176 {16aba0dc-3359-47fe-acf5-496ac83cbaa8} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67837 FWP_UINT64 10376293756612640768 {54f2e6d9-ec87-40ef-91a5-e48f51fbce78} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67838 FWP_UINT64 10376293748022706176 {c176404f-b6b6-470b-b3be-7c5db41a3c08} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF b900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67839 FWP_UINT64 10376293756612640768 {0bfafb37-da2b-4b57-96c4-dd5e14ef9b9b} Cortana Cortana FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 67847 FWP_UINT64 10376293747620052992 {2756a9a2-8940-469d-b0e4-d093e24b8737} Cortana Cortana FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 67848 FWP_UINT64 10376293748022706176 {0b19d824-b94d-4b8c-8eb0-fb82a74f4c5b} Cortana Cortana FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67849 FWP_UINT64 10376293756612640768 {ee6e661b-040e-43b2-9443-46047eaf059e} Cortana Cortana FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67850 FWP_UINT64 10376293748022706176 {42de4209-2a60-449b-81c9-feda0c9914be} Cortana Cortana FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF ba00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 67851 FWP_UINT64 10376293756612640768 {c808a57d-2fb7-4e7d-a772-5667a9bdbc70} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF bb00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67855 FWP_UINT64 10376539969505198080 {639e9c00-79c8-4dfb-a3f1-dd6713b27868} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF bd00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67871 FWP_UINT64 10376539969505198080 {1256e94d-6137-4f0d-b73a-f8f9ccb8d64a} Microsoft Edge (mDNS-In) Inbound rule for Microsoft Edge to allow mDNS traffic. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF be00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67875 FWP_UINT64 10376539969505198080 {5eb6cad8-1d8a-4c51-b026-807f3e3d92e0} Allow inbound UDP traffic to CDPSvc port 5050 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c200000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5050 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67879 FWP_UINT64 246496763052032 {211c67b6-5dec-468d-9bf9-564f606ad8be} Allow inbound TCP traffic to CDPSvc from any port to port 5160 (Wi-Fi Direct Transport) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c700000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5160 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67889 FWP_UINT64 246496763052032 {d9f11c8c-075e-4271-8012-655bb3f9dde1} Allow inbound TCP traffic to CDPSvc from any port to port 5040 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5040 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67893 FWP_UINT64 246496763052032 {42b88eb0-34e6-478f-908b-585607fbe41a} Block inbound traffic to omadmclient.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH ca00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 \device\harddiskvolume3\windows\system32\omadmclient.exe FWP_ACTION_BLOCK {a8b55da6-3aba-41f3-b7ba-443233f64fce} 67895 FWP_UINT64 137438953472 {475d5508-5d3a-46d5-9805-e407589473ec} Block inbound traffic to deviceenroller.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH cb00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 \device\harddiskvolume3\windows\system32\deviceenroller.exe FWP_ACTION_BLOCK {c4e61e5c-3e66-4efb-b22b-87f8e56cf9c2} 67897 FWP_UINT64 137438953472 {f0faf4fb-252e-47b9-af71-f9a81a7a650d} Block inbound traffic to dmcertinst.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH d000000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\dmcertinst.exe FWP_ACTION_BLOCK {616fdcf3-1169-46b5-8224-cffc7276af2e} 67907 FWP_UINT64 137438953472 {62af150d-b92a-423a-ab03-b55021e030ef} DhcpFirewallPolicy DhcpFirewallPolicy FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 68 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 67 FWP_ACTION_PERMIT 0 67917 FWP_UINT64 248420908400640 {e53b388f-16cd-408e-8e6b-1aa8dfdc1ccc} DhcpFirewallPolicy DhcpFirewallPolicy FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d600000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 546 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 547 FWP_ACTION_PERMIT 0 67919 FWP_UINT64 248420908400640 {388a863a-333e-4270-8ea8-3756df7eb475} Allow RPC/TCP traffic to EventLog FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67925 FWP_UINT64 211316685930496 {ac41a204-b76a-46b4-b943-a8c24d3c5336} Allow inbound UDP traffic to fdphost port 3702 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH da00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67927 FWP_UINT64 246496763052032 {cb0601b2-92ec-40b8-8422-c92875ed2d56} Allow inbound UDP traffic to fdphost port 1900 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH dc00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 1900 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67931 FWP_UINT64 246496763052032 {8e76e740-04c4-4d35-a298-11f7dc596749} Allow inbound TCP traffic to AJRouter FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 9955 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67941 FWP_UINT64 246496763052032 {19ed4871-1493-432b-8d8c-0ccc59f25f6d} Allow inbound UDP traffic to AJRouter FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e200000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67943 FWP_UINT64 211312390963200 {84c3250b-945e-4d9e-821e-09efa2c38757} Allow Grouping to receive from port 3587 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3587 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67949 FWP_UINT64 246496763052032 {75fe5296-4bc2-4582-a285-7442b870bf8e} Allow PNRP to send to port 3540 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e700000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3540 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67953 FWP_UINT64 246496763052032 {ad422266-d71d-4380-b44a-fb3e2e95868b} IPsec Policy Agent service hardening - Remote Management Allow IPsec Policy Agent inbound RPC/TCP traffic for Remote Management FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH eb00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67961 FWP_UINT64 211316685930496 {19682e8b-d911-49dc-900a-54cef7765f40} Block all inbound traffic to SearchFilterHost FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH ec00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\searchfilterhost.exe FWP_ACTION_BLOCK {3a5e8a34-82df-4083-a6ed-87ea8ed3507a} 67963 FWP_UINT64 137438953472 {2be90617-8637-421f-acca-fb35be82a866} Block all inbound traffic to SearchProtocolHost FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH ef00000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\searchprotocolhost.exe FWP_ACTION_BLOCK {c0cedbe2-34f4-4491-bd19-152a55b1b6e0} 67969 FWP_UINT64 137438953472 {8dba5a64-72a1-4fcd-bf10-7350fdfe0e60} Allow inbound UDP traffic to SNMPTRAP service FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f000000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006e006d00700074007200610070002e006500780065000000 \device\harddiskvolume3\windows\system32\snmptrap.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67971 FWP_UINT64 211312390963200 {031039e8-157e-4c49-a1b7-831802af44ea} Allow all inbound TCP and RPC to SPPEXTCOMOBJ FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f100000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000 \device\harddiskvolume3\windows\system32\sppextcomobj.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67973 FWP_UINT64 211312390963200 {0adc1095-75ad-4dbe-a1ff-a2cfa50c9182} TermServiceLOM FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67978 FWP_UINT64 211312390963200 {569847e2-c2ad-471a-a0aa-7db6eda39cce} TermServiceLOM FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f300000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_UINT64 18446744073709551615 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_INSPECTION FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6 {2ea412db-5c9d-4bbd-9af2-4914d2dbfe17} 67979 FWP_UINT64 18446744073709551615 {aeb06403-14b2-4f11-911c-d2e71406b781} Allow incoming RPC traffic to VDS FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f400000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007600640073002e006500780065000000 \device\harddiskvolume3\windows\system32\vds.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67981 FWP_UINT64 211316685930496 {06ec84e9-0aaf-4282-b849-ffe57c1b0d6a} Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 389 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67984 FWP_UINT64 246496763052032 {e32e6791-5d61-4ba0-a2c7-6b02831e6a45} Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f500000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 636 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67985 FWP_UINT64 246496763052032 {c6c6d63a-882b-4f39-8ceb-36c8f7555219} Allow inbound UDP traffic to NTP port 123 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f700000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 123 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67989 FWP_UINT64 246496763052032 {0c2c073b-bf6b-4c9f-9606-9ce2126c2f50} Allow inbound RPC traffic to the Block Level Backup service (wbengine) over TCP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f900000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007700620065006e00670069006e0065002e006500780065000000 \device\harddiskvolume3\windows\system32\wbengine.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67993 FWP_UINT64 211316685930496 {7414eaee-1713-4f1a-836e-a33cf8e7f5ee} Cast to Device streaming server hardening rules for RTSP Allow incoming RTSP connections to the Cast to Device streaming server FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0201000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 \device\harddiskvolume3\windows\system32\mdeserver.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 23554 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68017 FWP_UINT64 246428043575296 {74e34cf5-b726-4da8-b473-4740ac1dacfe} Cast to Device streaming server hardening rules for RTSP Allow incoming RTSP connections to the Cast to Device streaming server FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0201000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 \device\harddiskvolume3\windows\system32\mdeserver.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 23555 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68018 FWP_UINT64 246428043575296 {7e0a5145-d1e5-42f7-9d4e-d4dd9196b7b0} Cast to Device streaming server hardening rules for RTSP Allow incoming RTSP connections to the Cast to Device streaming server FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0201000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 \device\harddiskvolume3\windows\system32\mdeserver.exe FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 23556 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68019 FWP_UINT64 246428043575296 {54d6e8b9-dec2-46f8-a998-91264ad65362} Allow incoming TCP to PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0301000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68021 FWP_UINT64 211312390963200 {80d42d94-a6d0-4a5d-b8c6-20cdeda245cb} Windows Media Player Network Sharing Service service hardening - RTSP Allow incoming RTSP connections to the Windows Media Player Network Sharing Service FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0901000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000 \device\harddiskvolume3\program files\windows media player\wmpnetwk.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 554 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68042 FWP_UINT64 246496763052032 {b4aeacd5-c926-446e-addd-dc86b9979b64} Windows Media Player Network Sharing Service service hardening - RTSP Allow incoming RTSP connections to the Windows Media Player Network Sharing Service FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0901000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000 \device\harddiskvolume3\program files\windows media player\wmpnetwk.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 8554 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68043 FWP_UINT64 246496763052032 {ec51a54f-1281-48b4-9a56-386529896692} WSH Default Inbound Block Blocks all inbound traffic for services who have been network hardened FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3914275374-678031271-1603343729-3906112567-2888048264)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL FWP_ACTION_BLOCK {de04f4bd-a953-47f6-b1b6-eb6e24a546d6} 68046 FWP_UINT64 68719476736 {27d0382a-b7fd-4536-a470-71a5ea27cb99} FTP Inspection Filter This filter enables inspection of FTP. FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 1024 FWP_UINT16 65535 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e022e} 0 68053 FWP_UINT64 18446744073709551615 {58fd9e51-dfb2-4b8b-9f4e-fbe76618a080} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68088 FWP_UINT64 18446744073709551615 {98b70176-3bcc-4734-b93b-4eaeeeb6a37b} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68089 FWP_UINT64 18446744073709551615 {a300f22a-ae94-4b5f-aa5f-33ff9fbbfce7} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68090 FWP_UINT64 18446744073709551615 {d90cbaa3-eaf3-4021-a70a-c130bc327519} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68091 FWP_UINT64 18446744073709551615 {c364ce80-e89b-489f-b7ab-ba5da061dc31} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68092 FWP_UINT64 18446744073709551615 {941565df-dade-42f5-b5cb-ed48e857a508} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68093 FWP_UINT64 18446744073709551615 {00ea3695-8388-45b7-9aaf-49947f97dec5} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68094 FWP_UINT64 18446744073709551615 {73508c22-0149-461b-b1f2-3cdc929feea1} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68095 FWP_UINT64 18446744073709551615 {198ff4f2-5d0a-40bf-b43e-1d4684b11b65} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68096 FWP_UINT64 18446744073709551615 {7f8a98cc-cc4b-410d-ad3c-2d0dd1aebe0e} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68097 FWP_UINT64 18446744073709551615 {d2e40d8a-cc87-4ad1-b496-bd28937f886e} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68098 FWP_UINT64 18446744073709551615 {6c68a273-fac7-4be9-a9d1-fe56ffa5981d} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 135 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68099 FWP_UINT64 18446744073709551615 {5f7e61e7-2af6-4f12-9a07-5522f61f4b86} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68100 FWP_UINT64 18446744073709551615 {19590b9d-8cbb-42c2-9a7a-ab0775ecd93b} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68101 FWP_UINT64 18446744073709551615 {29f7b740-30f9-4972-adc7-cbfa92803082} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68102 FWP_UINT64 18446744073709551615 {6dfc4acb-0027-4d5a-b527-f452291ec069} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68103 FWP_UINT64 18446744073709551615 {b1e42ad1-a690-42c2-abf2-57ce5aded578} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68104 FWP_UINT64 18446744073709551615 {eb76a71a-600b-4489-be24-d5cf94512966} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68105 FWP_UINT64 18446744073709551615 {fed10772-760a-4002-a372-699758835bb5} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68106 FWP_UINT64 18446744073709551615 {0ce6b8ef-3f7b-44c7-b923-538b5c6f85cf} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68107 FWP_UINT64 18446744073709551615 {40e896f7-d6fa-48a0-8d3d-b89e5c480196} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68108 FWP_UINT64 18446744073709551615 {7bead13c-ef8a-406c-b796-15424030645a} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68109 FWP_UINT64 18446744073709551615 {0ef1dbc6-5f1c-46fa-a4be-7b601943da68} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68110 FWP_UINT64 18446744073709551615 {56610786-c7ca-41fc-abce-e661c467a692} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 134 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68111 FWP_UINT64 18446744073709551615 {0677b532-ed94-451f-a801-b69c51ae8932} InternetClientServer Inbound Default Rule InternetClientServer Inbound Default Rule FWPM_PROVIDER_MPSSVC_APP_ISOLATION 1c01000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_EMPTY FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_NOT_EQUAL FWP_SID S-1-0-0 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE :: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_PERMIT 0 68209 FWP_UINT64 206158431224 {1582a99d-c924-4a69-8c31-38c3e811b06e} Microsoft Media Foundation Network Source IN [UDP 5004-5009] InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 1f01000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 5000 FWP_UINT16 5020 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68218 FWP_UINT64 10700788216413290496 {77733464-f8b8-4139-82ce-d711bf56aa0c} Microsoft Media Foundation Network Source IN [UDP 5004-5009] InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 1f01000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 5000 FWP_UINT16 5020 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68219 FWP_UINT64 10700788225003225088 {b12e5bff-8fa5-42bd-a2d5-9904d7ca9d03} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 554 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68227 FWP_UINT64 10700799211529568256 {bb69d143-1985-454a-b089-308e8e8dc13e} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 554 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68228 FWP_UINT64 10700799220119502848 {5acc61db-fd65-4cb1-bc32-8ca12e976908} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 8554 FWP_UINT16 8558 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68230 FWP_UINT64 10700792614459801600 {aab1ec78-7ee4-49d1-98fc-8c3b631ae069} Microsoft Media Foundation Network Source IN [TCP 554] InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2001000000000000 ....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 8554 FWP_UINT16 8558 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68231 FWP_UINT64 10700792623049736192 {35a7aaa5-1838-4ae3-817a-69cb1c19cd18} Core Networking - Multicast Listener Done (ICMPv6-In) Multicast Listener Done messages inform local routers that there are no longer any members remaining for a specific multicast address on the subnet. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2101000000000000 !....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 132 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 68232 FWP_UINT64 10700799142810091520 {f93ea8eb-52e1-42c1-9ad4-7c36ffb021d6} Core Networking - Multicast Listener Done (ICMPv6-In) Multicast Listener Done messages inform local routers that there are no longer any members remaining for a specific multicast address on the subnet. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2101000000000000 !....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 132 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68233 FWP_UINT64 10700799151400026112 {a06c507e-0e22-4963-8f44-87618653a39c} WFD ASP Coordination Protocol (UDP-In) Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2201000000000000 "....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWP_ACTION_PERMIT 0 68238 FWP_UINT64 10700801135674916864 {33989d24-4033-4bd0-b74f-9bcf3d09dbeb} WFD ASP Coordination Protocol (UDP-In) Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2201000000000000 "....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68239 FWP_UINT64 10700801144264851456 {6a14e12f-4cc9-4ba8-8087-ce034ce64aa9} Core Networking - Multicast Listener Report v2 (ICMPv6-In) Multicast Listener Report v2 message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2301000000000000 #....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 143 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 68240 FWP_UINT64 10700799142810091520 {b39cb12b-597e-47f5-8e3f-9dd402f046f7} Core Networking - Multicast Listener Report v2 (ICMPv6-In) Multicast Listener Report v2 message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2301000000000000 #....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 143 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68241 FWP_UINT64 10700799151400026112 {58df562c-0db6-447a-9f51-a1a9ca36a7da} Core Networking - Multicast Listener Query (ICMPv6-In) An IPv6 multicast-capable router uses the Multicast Listener Query message to query a link for multicast group membership. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2401000000000000 $....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 130 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 68242 FWP_UINT64 10700799142810091520 {422c78ee-d74f-4287-92cb-f7ebd9b13d7f} Core Networking - Multicast Listener Query (ICMPv6-In) An IPv6 multicast-capable router uses the Multicast Listener Query message to query a link for multicast group membership. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2401000000000000 $....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 130 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68243 FWP_UINT64 10700799151400026112 {c86577a4-f769-4666-8ef8-da0d20234c50} Core Networking - Multicast Listener Report (ICMPv6-In) The Multicast Listener Report message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2501000000000000 %....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 131 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWP_ACTION_PERMIT 0 68244 FWP_UINT64 10700799142810091520 {7aebe37a-9063-4a41-bfe2-c5f36fc48aa1} Core Networking - Multicast Listener Report (ICMPv6-In) The Multicast Listener Report message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query. FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2501000000000000 %....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 530079007300740065006d000000 System FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWP_MATCH_EQUAL FWP_UINT16 131 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68245 FWP_UINT64 10700799151400026112 {c60857b2-86f1-4479-ac73-2d5cc8d478cb} mDNS (UDP-In) Inbound rule for mDNS traffic [UDP] FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2601000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68250 FWP_UINT64 10700799211529568256 {47eea8d3-5188-4143-acdf-202833261322} mDNS (UDP-In) Inbound rule for mDNS traffic [UDP] FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2601000000000000 ........ FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5353 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68251 FWP_UINT64 10700799220119502848 {efc20c2d-6c5a-4e5b-8a34-98b4483999a2} Wi-Fi Direct ASP Coordination Protocol (UDP-In) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2701000000000000 '....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWP_ACTION_PERMIT 0 68254 FWP_UINT64 324507594213294080 {35413795-c6d4-4215-a986-4f6430c1d790} Wi-Fi Direct ASP Coordination Protocol (UDP-In) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2701000000000000 '....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68255 FWP_UINT64 324507602803228672 {d6b96843-703f-4584-bd03-4031d5af55ea} Allow incoming WSD to PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2901000000000000 )....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68262 FWP_UINT64 324505670067945472 {2cbbf8db-968e-4981-9676-5e84aba688c6} Allow incoming WSD to PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2901000000000000 )....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68263 FWP_UINT64 324505678657880064 {ab7af7b8-34b2-47a2-bb0d-cfac2a1a824e} Allow incoming WSD to PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2a01000000000000 *....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWP_ACTION_PERMIT 0 68266 FWP_UINT64 324472409841205248 {15f2650a-c099-4d56-a815-a14736393443} Allow incoming WSD to PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2a01000000000000 *....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68267 FWP_UINT64 324472418431139840 {69bf11f7-0703-41a2-933f-5699bf1ebbb4} Microsoft Store Microsoft Store FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWP_ACTION_PERMIT 0 68291 FWP_UINT64 10376293747620052992 {436b36f0-9320-423f-a04f-1a9ca00007fb} Microsoft Store Microsoft Store FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWP_ACTION_PERMIT 0 68292 FWP_UINT64 10376293748022706176 {00117075-341a-482a-acc5-e8b238826759} Microsoft Store Microsoft Store FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68293 FWP_UINT64 10376293756612640768 {c5399251-8bef-439b-8544-8f21ffa7ba41} Microsoft Store Microsoft Store FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 68294 FWP_UINT64 10376293748022706176 {82915472-9da4-48af-b908-8c7a02f6ddaf} Microsoft Store Microsoft Store FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WF 2d01000000000000 -....... FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_SUBLAYER_TEREDO FWP_UINT8 9 FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_EQUAL FWP_SID S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68295 FWP_UINT64 10376293756612640768 FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD ALE Receive/Accept v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_NAP_CONTEXT FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_REAUTHORIZE_REASON FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 47 {c3dbed20-0bb6-4bf3-828d-96732e1e012f} Windows Firewall: callout Performs logging. FWPM_CALLOUT_FLAG_REGISTERED 00000200 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD 279 FWPM_LAYER_ALE_AUTH_CONNECT_V4 ALE Connect v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_REAUTHORIZE_REASON FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_PEER_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ALE_ORIGINAL_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_EFFECTIVE_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 48 FWPM_CALLOUT_IPSEC_ALE_CONNECT_V4 WFP Built-in IPsec ALE Connect v4 Layer Callout Applies IPsec policy modifiers to client applications. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_AUTH_CONNECT_V4 15 FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V4 WFP Built-in TCP Chimney Offload ALE Connect v4 Layer Callout Enables or disables TCP Chimney Offload for each outgoing connection. FWPM_LAYER_ALE_AUTH_CONNECT_V4 19 FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V4 WFP Built-in Set Option ALE Connect v4 Layer Callout Sets classify options on outbound flows. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_CONNECT_V4 23 FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V4 WFP Built-in TCP Templates ALE Connect v4 Layer Callout Applies TCP Template for each outgoing connection. FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_AUTH_CONNECT_V4 33 FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V4 WFP Built-in Reserved callout WFP Built-in Reserved callout FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_CONNECT_V4 37 FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_CONNECT_LAYER_V4 WFP Built-in Policy Silent Mode ALE Connect v4 Layer Callout Audit and log policy for outgoing connection. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_CONNECT_V4 41 FWPM_CALLOUT_BUILT_IN_RESERVED_3 WFP Built-in Accept Redirect Proxy Tag ALE Connect v4 Layer Callout Tags the outgoing connection from an accept redirected proxy app to prevent infinite redirection. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_CONNECT_V4 47 {c3dbed20-0bb6-4bf3-828d-96732e1e0230} Windows Firewall: callout Allows secondary connections. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_CONNECT_V4 282 {b6b2ca61-fb98-4422-adc2-e7cf56b3680c} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66222 FWP_UINT64 18446744073709551615 {082edf36-12d7-4698-858a-cf274b78d09a} Quarantine Default Inbound Loopback Exception This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66601 FWP_UINT64 18446744073709551615 {304a339a-845d-47b1-9ad9-df3b55c31f26} AppContainerLoopback This filter allows outbound AppContainer loopback traffic FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67196 FWP_UINT64 18446744073709551615 {a167c347-5706-417d-ab3f-dc24cdd9c69b} AppContainerLoopback This filter blocks loopback traffic to port 137 FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 137 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_BLOCK {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67198 FWP_UINT64 18446744073709551615 {6b9edc4a-2d53-465e-8c54-13b65024e3b6} AppContainerLoopback This filter blocks AppContainer loopback traffic FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551614 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_BLOCK {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67202 FWP_UINT64 18446744073709551614 {0a023b5d-ef1a-45a7-9cde-efcb260348a6} Default Outbound This is the default outbound filter which blocks or permits traffic based on user configured default settings FWPM_PROVIDER_MPSSVC_WF 9500000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67644 FWP_UINT64 9223372036854777848 {3bcbc8e4-3be2-43d5-8c7e-765d0de1b129} Default Outbound This is the default outbound filter which blocks or permits traffic based on user configured default settings FWPM_PROVIDER_MPSSVC_WF 9500000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWP_ACTION_PERMIT 0 67648 FWP_UINT64 3458764513820540928 {f7a47614-e0ec-4d6a-9cf2-99b8f993d1b7} UWP Default Outbound Block Rule This is the UWP Default Outbound Block filter. This filter blocks any outbound packets from UWP apps that do not have the correct capability tokens for the resource they are trying to reach. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_APP_ISOLATION 9a00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_EMPTY FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_NOT_EQUAL FWP_SID S-1-0-0 FWP_ACTION_BLOCK {11ec8831-cda4-4bab-aa69-cb45e32f4ea9} 67659 FWP_UINT64 137438953472 {81fe2467-61a3-46dc-8c59-a6a3277920ff} AxInstSV TCP outbound allow Allow only outbound TCP traffic from AxInstSV FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c100000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67876 FWP_UINT64 985368576917504 {8b7fd125-5491-4c7a-96cb-10aacbccc7d9} Allow outbound TCP traffic from CDPSvc from any port to port 5040 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c300000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 5040 FWP_ACTION_PERMIT 0 67880 FWP_UINT64 987292722266112 {1ce149fd-f072-4c78-998c-aa9be7b13469} Allow outbound UDP traffic from any port to CDPSvc port 5050 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c400000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 5050 FWP_ACTION_PERMIT 0 67882 FWP_UINT64 987292722266112 {71a8a4a8-65c6-4a5b-9d97-f15febdc067a} Allow outbound UDP traffic from CDPSvc port 5050 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c500000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5050 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67884 FWP_UINT64 1055737321095168 {2c84d584-7bc5-40db-b6c8-b28d4e40a483} Allow outbound TCP traffic from CDPSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c600000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67886 FWP_UINT64 985368576917504 {672ccb84-0882-4542-8404-7650c867a918} Allow outbound TCP traffic from CDPSvc from any port to port 5160 (Wi-Fi Direct Transport) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c800000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 5160 FWP_ACTION_PERMIT 0 67890 FWP_UINT64 987292722266112 {185c4b7a-6d3f-46ab-9a41-146c6ec220be} Block outbound traffic from deviceenroller.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH cc00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 \device\harddiskvolume3\windows\system32\deviceenroller.exe FWP_ACTION_BLOCK {4dd4109f-8980-4e66-b307-887227d761a4} 67898 FWP_UINT64 137438953472 {b832287d-98a4-4509-9edf-e796cf1a363f} Allow outbound TCP traffic from deviceenroller.exe FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH cd00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 \device\harddiskvolume3\windows\system32\deviceenroller.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67900 FWP_UINT64 985299857440768 {7d008627-122e-4757-94f3-40fd1e6a32ab} Block outbound traffic from omadmclient.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH ce00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 \device\harddiskvolume3\windows\system32\omadmclient.exe FWP_ACTION_BLOCK {f876928c-1566-4b9a-a110-57d531115565} 67902 FWP_UINT64 137438953472 {4d0e90b1-9d99-4847-afad-63b5336d414a} Allow outbound TCP traffic from omadmclient.exe FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH cf00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 \device\harddiskvolume3\windows\system32\omadmclient.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67904 FWP_UINT64 985299857440768 {af29eee0-e0d3-4834-8d51-668e799215c9} Block outbound traffic from dmcertinst.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH d100000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\dmcertinst.exe FWP_ACTION_BLOCK {3742db91-517a-4f69-b378-08c5c09364b3} 67908 FWP_UINT64 137438953472 {4fdcd4c6-c326-4b60-b320-84fc25c10cec} Allow outbound TCP traffic from dmcertinst.exe FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d200000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\dmcertinst.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67910 FWP_UINT64 985299857440768 {a93ec3cd-e423-4bd5-a38d-3593f40c2fe6} Allow outbound TCP traffic from DMEnrollment FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d300000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67912 FWP_UINT64 985368576917504 {c830f042-5e91-4521-9d1a-c08aeac73a48} DhcpFirewallPolicy DhcpFirewallPolicy FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d400000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 68 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 67 FWP_ACTION_PERMIT 0 67914 FWP_UINT64 1057661466443776 {bd69a0ac-3eec-43c2-8e77-57159930f77f} DhcpFirewallPolicy DhcpFirewallPolicy FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d700000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 546 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 547 FWP_ACTION_PERMIT 0 67920 FWP_UINT64 1057661466443776 {e9f93da5-9659-46c5-9525-93d80021b23f} Device Metadata Retrieval Allow dmrc communication with WMIS FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d800000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-286057374-2594772386-1471686342-3682429118-820474675) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 80 FWP_ACTION_PERMIT 0 67922 FWP_UINT64 987292722266112 {180cd47b-5d74-4505-a1ff-cd84de1d2af5} Allow outbound UDP traffic from fdphost port 3702 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH db00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWP_ACTION_PERMIT 0 67928 FWP_UINT64 987292722266112 {8e168718-b7a5-4ae5-80ee-67e629a24d19} Allow outbound UDP traffic from fdphost port 1900 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH dd00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 1900 FWP_ACTION_PERMIT 0 67932 FWP_UINT64 987292722266112 {b0589e60-9f9a-43aa-9d6b-5f8d52dafd90} Allow outbound TCP traffic from fdphost FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH de00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67934 FWP_UINT64 985368576917504 {04419b91-af39-4843-9b6a-7676f52111a6} Allow outbound UDP traffic to LMHosts port 53 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH df00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 53 FWP_ACTION_PERMIT 0 67936 FWP_UINT64 987292722266112 {5ba31685-5a93-4ec1-8559-7e4dc41cd4a0} Allow outbound TCP traffic to LMHosts port 53 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e000000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 53 FWP_ACTION_PERMIT 0 67938 FWP_UINT64 987292722266112 {03d2ca8b-de9c-4271-9379-2c7e01346d1d} Allow outbound TCP traffic from AJRouter FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e300000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67944 FWP_UINT64 985368576917504 {beec7dba-4e91-4b23-a7b7-4b946d7b0a03} Allow outbound UDP traffic from AJRouter FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e400000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67946 FWP_UINT64 985368576917504 {0f4eb248-1eb1-44e8-af26-3139fc422409} Allow Grouping to send to port 3587 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e600000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3587 FWP_ACTION_PERMIT 0 67950 FWP_UINT64 987292722266112 {8b18ea82-9285-46f1-9d5c-8825be7defbb} Allow PNRP to send to port 3540 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e800000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3540 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 1024 FWP_UINT16 65535 FWP_ACTION_PERMIT 0 67954 FWP_UINT64 1056012199002112 {48f7051b-b0ca-4b0d-b025-7331aa9463cc} IPsec Policy Agent service hardening - LDAP/TCP Allow IPsec Policy Agent outbound LDAP/TCP traffic to Active Directory FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e900000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 389 FWP_ACTION_PERMIT 0 67956 FWP_UINT64 987292722266112 {2b4cfcf1-3509-4705-ab10-1385dd1b35e3} IPsec Policy Agent service hardening - LDAP/UDP Allow IPsec Policy Agent outbound LDAP/UDP traffic to Active Directory FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH ea00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 389 FWP_ACTION_PERMIT 0 67958 FWP_UINT64 987292722266112 {58ee92c1-2cae-43e7-ab8a-b4063a731c8a} Block all outbound traffic from SearchFilterHost FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH ed00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\searchfilterhost.exe FWP_ACTION_BLOCK {03843031-9e01-449d-b94b-047c6fbe714c} 67964 FWP_UINT64 137438953472 {59fe49fe-991b-4b1c-bba1-70fef8bbd4c6} Allow outbound LDAP traffic from SearchIndexer FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH ee00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006500610072006300680069006e00640065007800650072002e006500780065000000 \device\harddiskvolume3\windows\system32\searchindexer.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 389 FWP_ACTION_PERMIT 0 67966 FWP_UINT64 987292722266112 {0391cc05-7e9f-4eef-be8f-7ba037e44a34} Allow all outbound TCP and RPC from SPPEXTCOMOBJ FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f200000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000 \device\harddiskvolume3\windows\system32\sppextcomobj.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67974 FWP_UINT64 985368576917504 {2d002771-07b6-494c-abea-3ab1a1b89169} Allow all outbound TCP ports traffic for vmicheartbeat FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f600000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 1 FWP_UINT16 65535 FWP_ACTION_PERMIT 0 67986 FWP_UINT64 985643454824448 {79d5cc16-49fc-4996-b3a5-2f02a2d79e01} Allow outbound UDP traffic from local NTP port 123 to remote NTP port 123 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f800000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 123 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 123 FWP_ACTION_PERMIT 0 67990 FWP_UINT64 1057661466443776 {06fc5b6e-ce4e-4355-ae4f-5b3a5c4ccf25} Allow TCP traffic from Wcmsvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH fa00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67994 FWP_UINT64 985368576917504 {0f6315c7-96ec-4ed5-9553-6c3ba0363148} Allow NTP traffic from Wcmsvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH fb00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 123 FWP_ACTION_PERMIT 0 67996 FWP_UINT64 987292722266112 {13f46409-d68e-488e-ad18-7f4fb2fe2b64} Allow Out TCP traffic from WinDefend FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH fc00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f0077007300200064006500660065006e006400650072005c006d0073006d00700065006e0067002e006500780065000000 \device\harddiskvolume3\program files\windows defender\msmpeng.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67998 FWP_UINT64 985368576917504 {aef21544-e454-4d2f-a571-e803b3a9e120} Allow outbound TCP traffic from WinHttpAutoProxySvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH fd00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68000 FWP_UINT64 985368576917504 {8915b586-51f3-4e71-9282-cff4dbeca20c} Allow TCP traffic from lpasvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0001000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68010 FWP_UINT64 985368576917504 {ee4f6b00-cba1-40d4-8d89-0310b8975f30} Allow HTTP traffic from cloudidsvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0101000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 443 FWP_ACTION_PERMIT 0 68012 FWP_UINT64 987292722266112 {ca791cd5-85a3-4b7f-8b6b-9d9cb02ac722} Allow outgoing TCP from PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0401000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68022 FWP_UINT64 985368576917504 {4c5f7c67-c7ce-4313-a45b-70f03fbad5fc} WinDefend Outbound for TCP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0a01000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d0064006100740061005c006d006900630072006f0073006f00660074005c00770069006e0064006f0077007300200064006500660065006e006400650072005c0070006c006100740066006f0072006d005c0034002e00310038002e0032003200300031002e00310030002d0030005c006d0073006d00700065006e0067002e006500780065000000 \device\harddiskvolume3\programdata\microsoft\windows defender\platform\4.18.2201.10-0\msmpeng.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68044 FWP_UINT64 985368576917504 {d07a9c84-a50f-40c9-80f5-303ab4951d68} WSH Default Outbound Block Blocks all outbound traffic for services who have been network hardened FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-2627155378-1124895651-3977206752-2157268346-3811978089)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL FWP_ACTION_BLOCK {de04f4bd-a953-47f6-b1b6-eb6e24a546d6} 68049 FWP_UINT64 68719476736 {e4639f53-f9fd-4949-aec7-e3eefd4e43b4} FTP Inspection Filter This filter enables inspection of FTP. FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 1024 FWP_UINT16 65535 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e0230} 0 68054 FWP_UINT64 18446744073709551615 {44a498f6-139a-41f2-8d9b-a4ec3885601a} InternetClientServer Outbound Default Rule InternetClientServer Outbound Default Rule FWPM_PROVIDER_MPSSVC_APP_ISOLATION 1d01000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_EMPTY FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_NOT_EQUAL FWP_SID S-1-0-0 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 0.0.0.0 FWP_UINT32 255.255.255.255 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_PERMIT 0 68210 FWP_UINT64 206158432248 {4c0965e1-a644-4286-b045-9dd0db4c0ac6} InternetClient Default Rule InternetClient Default Rule FWPM_PROVIDER_MPSSVC_APP_ISOLATION 1e01000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_EMPTY FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_NOT_EQUAL FWP_SID S-1-0-0 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 0.0.0.0 FWP_UINT32 255.255.255.255 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_PERMIT 0 68212 FWP_UINT64 206158432248 {c70ec623-3900-4841-b0d8-57ba37b02d03} Wi-Fi Direct ASP Coordination Protocol (UDP-Out) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2801000000000000 (....... FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWP_ACTION_PERMIT 0 68256 FWP_UINT64 253259241672933376 {825d479b-33b3-47ee-9667-cddf6646c94a} Wi-Fi Direct ASP Coordination Protocol (UDP-Out) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2801000000000000 (....... FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68257 FWP_UINT64 253259276032671744 {7f29d8b2-c34e-4676-a939-0a56f30f4fb2} Allow outgoing WSD from PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2b01000000000000 +....... FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68268 FWP_UINT64 253257317527584768 {71d65205-3137-4c02-a833-96c6b1ee73d8} Allow outgoing WSD from PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2b01000000000000 +....... FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68269 FWP_UINT64 253257351887323136 {427a2740-809d-4a32-8a1e-03584c5ca624} Allow outgoing WSD from PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2c01000000000000 ,....... FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWP_ACTION_PERMIT 0 68272 FWP_UINT64 253188872928755712 {4d84d151-4c1c-40c9-a0e6-d2be2bdb3bf2} Allow outgoing WSD from PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2c01000000000000 ,....... FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 10.0.2.0 FWP_UINT32 10.0.2.255 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT32 224.0.0.0 FWP_UINT32 239.255.255.255 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68273 FWP_UINT64 253188907288494080 FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD ALE Connect v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_REAUTHORIZE_REASON FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_PEER_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ALE_ORIGINAL_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_EFFECTIVE_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 49 {c3dbed20-0bb6-4bf3-828d-96732e1e0131} Windows Firewall: callout Performs logging. FWPM_CALLOUT_FLAG_REGISTERED 00000200 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD 274 FWPM_LAYER_ALE_AUTH_CONNECT_V6 ALE Connect v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_REAUTHORIZE_REASON FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_PEER_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ALE_ORIGINAL_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_EFFECTIVE_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 50 FWPM_CALLOUT_IPSEC_ALE_CONNECT_V6 WFP Built-in IPsec ALE Connect v6 Layer Callout Applies IPsec policy modifiers to client applications. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_AUTH_CONNECT_V6 16 FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V6 WFP Built-in TCP Chimney Offload ALE Connect v6 Layer Callout Enables or disables TCP Chimney Offload for each outgoing connection. FWPM_LAYER_ALE_AUTH_CONNECT_V6 20 FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V6 WFP Built-in Set Option ALE Connect v6 Layer Callout Sets classify options on outbound flows. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_CONNECT_V6 24 FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V6 WFP Built-in TCP Templates ALE Connect v6 Layer Callout Applies TCP Template for each outgoing connection. FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_AUTH_CONNECT_V6 34 FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V6 WFP Built-in Reserved callout WFP Built-in Reserved callout FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_CONNECT_V6 38 FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_CONNECT_LAYER_V6 WFP Built-in Policy Silent Mode ALE Connect v6 Layer Callout Audit and log policy for outgoing connection. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_CONNECT_V6 42 FWPM_CALLOUT_BUILT_IN_RESERVED_4 WFP Built-in Accept Redirect Proxy Tag ALE Connect v6 Layer Callout Tags the outgoing connection from an accept redirected proxy app to prevent infinite redirection. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_LAYER_ALE_AUTH_CONNECT_V6 48 {c3dbed20-0bb6-4bf3-828d-96732e1e0232} Windows Firewall: callout Allows secondary connections. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_CONNECT_V6 283 {0aa7fff8-919f-453c-928c-28a12122ba38} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {93132c36-6e06-4e6f-a10b-218787cd49cf} 66223 FWP_UINT64 18446744073709551615 {15d327cf-89c3-4032-9ded-774ae6b0b49f} Quarantine Default Inbound Loopback Exception This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. FWPM_FILTER_FLAG_PERSISTENT FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_QUARANTINE FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {30433c31-b05f-421f-8fde-018ea4c68af4} 66600 FWP_UINT64 18446744073709551615 {2c73ec55-e34c-4ebd-8e2e-6268206bc153} AppContainerLoopback This filter allows outbound AppContainer loopback traffic FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWP_ACTION_PERMIT {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67197 FWP_UINT64 18446744073709551615 {d26fbfe7-0a28-45b2-83fd-95b733e1a9fd} AppContainerLoopback This filter blocks loopback traffic to port 137 FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551615 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 137 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_BLOCK {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67199 FWP_UINT64 18446744073709551615 {c5fbb5ec-e4fc-4aac-810a-4219a166cf1c} AppContainerLoopback This filter blocks AppContainer loopback traffic FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_UINT64 18446744073709551614 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 1 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_BLOCK {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} 67203 FWP_UINT64 18446744073709551614 {8c247d5b-b402-40bb-a35b-a55ec3043f1a} Default Outbound This is the default outbound filter which blocks or permits traffic based on user configured default settings FWPM_PROVIDER_MPSSVC_WF 9500000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 8 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT 0 67646 FWP_UINT64 9223372036854776824 {0c22b647-52e8-484c-aaea-f3d7f4d9dc11} Default Outbound This is the default outbound filter which blocks or permits traffic based on user configured default settings FWPM_PROVIDER_MPSSVC_WF 9500000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT8 3 FWP_ACTION_PERMIT 0 67650 FWP_UINT64 3458764513820540928 {3af696f6-6a4c-47bb-b032-e6c4faf8cb88} UWP Default Outbound Block Rule This is the UWP Default Outbound Block filter. This filter blocks any outbound packets from UWP apps that do not have the correct capability tokens for the resource they are trying to reach. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_APP_ISOLATION 9a00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_EMPTY FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_NOT_EQUAL FWP_SID S-1-0-0 FWP_ACTION_BLOCK {11ec8831-cda4-4bab-aa69-cb45e32f4ea9} 67660 FWP_UINT64 68719476736 {091b498c-ac44-4e38-8c3d-f40842f71020} AxInstSV TCP outbound allow Allow only outbound TCP traffic from AxInstSV FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c100000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67877 FWP_UINT64 105656195481600 {66fc1e24-94a1-4f94-8737-a817f1f93509} Allow outbound TCP traffic from CDPSvc from any port to port 5040 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c300000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 5040 FWP_ACTION_PERMIT 0 67881 FWP_UINT64 106068512342016 {cab91dde-a33b-4d6d-a373-6f1a085eeee2} Allow outbound UDP traffic from any port to CDPSvc port 5050 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c400000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 5050 FWP_ACTION_PERMIT 0 67883 FWP_UINT64 106068512342016 {12268eee-a96f-414e-ada7-93a9394ae68b} Allow outbound UDP traffic from CDPSvc port 5050 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c500000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 5050 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67885 FWP_UINT64 123248381526016 {2bea35b9-7546-4ba2-bc6d-a11e73d8837b} Allow outbound TCP traffic from CDPSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c600000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67887 FWP_UINT64 105656195481600 {2a9440fb-0bb0-4ff6-8154-d72d60d909a7} Allow outbound TCP traffic from CDPSvc from any port to port 5160 (Wi-Fi Direct Transport) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH c800000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 5160 FWP_ACTION_PERMIT 0 67891 FWP_UINT64 106068512342016 {8f1aa30f-7e4d-48d2-8fdf-35af8b7e5b61} Block outbound traffic from deviceenroller.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH cc00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 \device\harddiskvolume3\windows\system32\deviceenroller.exe FWP_ACTION_BLOCK {4dd4109f-8980-4e66-b307-887227d761a4} 67899 FWP_UINT64 68719476736 {6ce0ad1a-cbde-40c6-b942-6c6e066d8c2a} Allow outbound TCP traffic from deviceenroller.exe FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH cd00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 \device\harddiskvolume3\windows\system32\deviceenroller.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67901 FWP_UINT64 105621835743232 {f30f70ce-47ff-49f7-ba7c-145a3a153449} Block outbound traffic from omadmclient.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH ce00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 \device\harddiskvolume3\windows\system32\omadmclient.exe FWP_ACTION_BLOCK {f876928c-1566-4b9a-a110-57d531115565} 67903 FWP_UINT64 68719476736 {d44825a1-c9fc-485f-98ce-3dd7eecc4876} Allow outbound TCP traffic from omadmclient.exe FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH cf00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 \device\harddiskvolume3\windows\system32\omadmclient.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67905 FWP_UINT64 105621835743232 {30e3a6fe-4e5f-4560-8c1b-62c80250709a} Block outbound traffic from dmcertinst.exe FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH d100000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\dmcertinst.exe FWP_ACTION_BLOCK {3742db91-517a-4f69-b378-08c5c09364b3} 67909 FWP_UINT64 68719476736 {fd5d3521-ac9a-4868-9645-f41db0a96e6a} Allow outbound TCP traffic from dmcertinst.exe FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d200000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\dmcertinst.exe FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67911 FWP_UINT64 105621835743232 {1e6890f9-a50c-4153-a5fc-33c0ba2a1836} Allow outbound TCP traffic from DMEnrollment FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d300000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67913 FWP_UINT64 105656195481600 {0036b900-9ed0-4134-bb44-eea7ec2cedee} DhcpFirewallPolicy DhcpFirewallPolicy FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d400000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 68 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 67 FWP_ACTION_PERMIT 0 67915 FWP_UINT64 123660698386432 {296e7a35-573a-40e4-b4e4-b9b262f32db0} DhcpFirewallPolicy DhcpFirewallPolicy FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d700000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 546 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 547 FWP_ACTION_PERMIT 0 67921 FWP_UINT64 123660698386432 {166a1317-b522-45a1-80ea-9e19153e6b25} Device Metadata Retrieval Allow dmrc communication with WMIS FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH d800000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-286057374-2594772386-1471686342-3682429118-820474675) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 80 FWP_ACTION_PERMIT 0 67923 FWP_UINT64 106068512342016 {a777788c-4705-40a1-ab2b-5a19760caed9} Allow outbound UDP traffic from fdphost port 3702 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH db00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWP_ACTION_PERMIT 0 67929 FWP_UINT64 106068512342016 {f0c77ee0-11f9-4b1c-a42d-8f616ae354f3} Allow outbound UDP traffic from fdphost port 1900 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH dd00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 1900 FWP_ACTION_PERMIT 0 67933 FWP_UINT64 106068512342016 {69327dfd-e878-4369-929c-e3b6e676fbfd} Allow outbound TCP traffic from fdphost FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH de00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67935 FWP_UINT64 105656195481600 {626987bd-a33b-47b9-9615-37f568d01d82} Allow outbound UDP traffic to LMHosts port 53 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH df00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 53 FWP_ACTION_PERMIT 0 67937 FWP_UINT64 106068512342016 {c29ccedf-39ff-434c-9a77-dcbf23e65d78} Allow outbound TCP traffic to LMHosts port 53 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e000000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 53 FWP_ACTION_PERMIT 0 67939 FWP_UINT64 106068512342016 {c0781e20-e98e-4edd-8629-83265170d024} Allow outbound TCP traffic from AJRouter FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e300000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67945 FWP_UINT64 105656195481600 {19a3f689-f230-43bc-a1c6-ea367563c31f} Allow outbound UDP traffic from AJRouter FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e400000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 67947 FWP_UINT64 105656195481600 {eb9eb551-58b9-438d-93e3-5e9bfd3fa4a4} Allow Grouping to send to port 3587 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e600000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3587 FWP_ACTION_PERMIT 0 67951 FWP_UINT64 106068512342016 {72db2410-37d0-4a0c-ab90-2f27b91f8fa6} Allow PNRP to send to port 3540 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e800000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3540 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 1024 FWP_UINT16 65535 FWP_ACTION_PERMIT 0 67955 FWP_UINT64 123385820479488 {fc565d30-798d-41ae-9037-248e9c9ce633} IPsec Policy Agent service hardening - LDAP/TCP Allow IPsec Policy Agent outbound LDAP/TCP traffic to Active Directory FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH e900000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 389 FWP_ACTION_PERMIT 0 67957 FWP_UINT64 106068512342016 {051461c3-1d6e-4214-9e67-820fc2e2d10a} IPsec Policy Agent service hardening - LDAP/UDP Allow IPsec Policy Agent outbound LDAP/UDP traffic to Active Directory FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH ea00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 389 FWP_ACTION_PERMIT 0 67959 FWP_UINT64 106068512342016 {755391ea-bc1b-4822-907e-1102749cfb38} Block all outbound traffic from SearchFilterHost FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH ed00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\searchfilterhost.exe FWP_ACTION_BLOCK {03843031-9e01-449d-b94b-047c6fbe714c} 67965 FWP_UINT64 68719476736 {6a06e8ac-2968-42da-8e51-0e4a0d3b92a4} Allow outbound LDAP traffic from SearchIndexer FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH ee00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006500610072006300680069006e00640065007800650072002e006500780065000000 \device\harddiskvolume3\windows\system32\searchindexer.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 389 FWP_ACTION_PERMIT 0 67967 FWP_UINT64 106068512342016 {25a4c983-4191-4c5a-8895-590d672049e0} Allow all outbound TCP and RPC from SPPEXTCOMOBJ FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f200000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000 \device\harddiskvolume3\windows\system32\sppextcomobj.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67975 FWP_UINT64 105656195481600 {4222b1e0-05d8-45ef-b1d6-eda36f16a14f} Allow all outbound TCP ports traffic for vmicheartbeat FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f600000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 1 FWP_UINT16 65535 FWP_ACTION_PERMIT 0 67987 FWP_UINT64 105793634435072 {1b42b924-8daa-4a22-a438-4ce931610f24} Allow outbound UDP traffic from local NTP port 123 to remote NTP port 123 FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH f800000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 123 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 123 FWP_ACTION_PERMIT 0 67991 FWP_UINT64 123660698386432 {f79665c6-3633-4d7b-9c44-461d448be8be} Allow TCP traffic from Wcmsvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH fa00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67995 FWP_UINT64 105656195481600 {6b276741-4138-4dd3-8d90-394998728306} Allow NTP traffic from Wcmsvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH fb00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 123 FWP_ACTION_PERMIT 0 67997 FWP_UINT64 106068512342016 {65ad8ec4-5659-493a-998e-f37f54973c02} Allow Out TCP traffic from WinDefend FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH fc00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f0077007300200064006500660065006e006400650072005c006d0073006d00700065006e0067002e006500780065000000 \device\harddiskvolume3\program files\windows defender\msmpeng.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 67999 FWP_UINT64 105656195481600 {023dae46-b7c7-40c8-90ca-45c70ba97068} Allow outbound TCP traffic from WinHttpAutoProxySvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH fd00000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68001 FWP_UINT64 105656195481600 {734e929d-2a7b-45e8-a576-1721a9075413} Allow TCP traffic from lpasvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0001000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68011 FWP_UINT64 105656195481600 {0999a296-1a9e-40e5-bd28-08bf5f4fa7a6} Allow HTTP traffic from cloudidsvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0101000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 443 FWP_ACTION_PERMIT 0 68013 FWP_UINT64 106068512342016 {d60de164-082e-49f2-8c7f-1fc5f5749f53} Allow outgoing TCP from PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0401000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68023 FWP_UINT64 105656195481600 {c0d7b9ed-5246-4d59-87fc-1d39339b02c4} WinDefend Outbound for TCP FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 0a01000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d0064006100740061005c006d006900630072006f0073006f00660074005c00770069006e0064006f0077007300200064006500660065006e006400650072005c0070006c006100740066006f0072006d005c0034002e00310038002e0032003200300031002e00310030002d0030005c006d0073006d00700065006e0067002e006500780065000000 \device\harddiskvolume3\programdata\microsoft\windows defender\platform\4.18.2201.10-0\msmpeng.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736) FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWP_ACTION_PERMIT 0 68045 FWP_UINT64 105656195481600 {05baa320-a8d8-40e3-b310-3b7d7c115dac} WSH Default Outbound Block Blocks all outbound traffic for services who have been network hardened FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WSH FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-2627155378-1124895651-3977206752-2157268346-3811978089)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL FWP_ACTION_BLOCK {de04f4bd-a953-47f6-b1b6-eb6e24a546d6} 68048 FWP_UINT64 34359738368 {892a3cae-0c40-4a8a-8aa4-cf539bbed38a} FTP Inspection Filter This filter enables inspection of FTP. FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_UINT16 1024 FWP_UINT16 65535 FWP_ACTION_CALLOUT_UNKNOWN {c3dbed20-0bb6-4bf3-828d-96732e1e0232} 0 68055 FWP_UINT64 18446744073709551615 {8b1704e1-3f4f-4fe2-bc92-0b013dd74bdb} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68112 FWP_UINT64 18446744073709551615 {9b3fa2c3-4e42-4c0f-8afb-e9f0d58e9261} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68113 FWP_UINT64 18446744073709551615 {4bfd4120-6a07-4b97-81fa-455048c76e4a} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68114 FWP_UINT64 18446744073709551615 {fcdc301b-92d9-44bb-b257-88b581b56248} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68115 FWP_UINT64 18446744073709551615 {408fb9f7-e31d-4c1a-9056-0660f482826f} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68116 FWP_UINT64 18446744073709551615 {b0b78a7e-20d4-45d6-987c-57a5783592fb} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68117 FWP_UINT64 18446744073709551615 {2f99501c-4c59-413b-b954-3ff993fdbfae} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68118 FWP_UINT64 18446744073709551615 {f8157303-181c-4c8d-b79c-47bfde1aeaf0} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68119 FWP_UINT64 18446744073709551615 {b17cc3b4-a615-46f3-b2c6-2687d34fab02} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68120 FWP_UINT64 18446744073709551615 {9b7b4e38-e234-44d2-b571-d374e27a4e0b} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68121 FWP_UINT64 18446744073709551615 {a1619fd8-02a0-47b7-b5e0-cfa96070a783} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68122 FWP_UINT64 18446744073709551615 {c08500c7-668a-4bac-945c-34b70d89be0b} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 136 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68123 FWP_UINT64 18446744073709551615 {58083807-89f3-4df3-9a42-0030b4a28be1} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68124 FWP_UINT64 18446744073709551615 {cc4f4f68-e749-4deb-9532-8eeecc65fd2e} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68125 FWP_UINT64 18446744073709551615 {8c5974d0-a252-4be3-8805-88649820ec32} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68126 FWP_UINT64 18446744073709551615 {1a3d3203-0424-42d8-8027-248351309474} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68127 FWP_UINT64 18446744073709551615 {0b8840ae-0286-4003-a653-1918f0bb88e6} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68128 FWP_UINT64 18446744073709551615 {59c1253f-d019-4d86-9d10-a620dedbf830} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68129 FWP_UINT64 18446744073709551615 {75410a3a-fb4b-4c4e-a43b-65fa2f6b12b6} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68130 FWP_UINT64 18446744073709551615 {8a3541a0-0456-4909-91bc-a016060fc4ba} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68131 FWP_UINT64 18446744073709551615 {bad0a5c5-8e42-4b2e-907d-43d004424df9} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68132 FWP_UINT64 18446744073709551615 {85fd608d-794c-47d5-9819-86dddddd6fb6} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 3 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68133 FWP_UINT64 18446744073709551615 {f09da621-2d41-44ef-80d0-142da1df005b} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 2 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68134 FWP_UINT64 18446744073709551615 {88bbe0f8-8dfc-4699-a847-a9349a4af991} Boot Time Filter This filter is in effect before the service starts. FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT FWPM_FILTER_FLAG_INDEXED FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 58 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 133 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWP_MATCH_EQUAL FWP_UINT8 3 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWP_MATCH_EQUAL FWP_UINT32 131 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 14 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWP_ACTION_PERMIT {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} 68135 FWP_UINT64 18446744073709551615 {429c6993-632c-4633-b930-65684a5b7300} InternetClientServer Outbound Default Rule InternetClientServer Outbound Default Rule FWPM_PROVIDER_MPSSVC_APP_ISOLATION 1d01000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_EMPTY FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_NOT_EQUAL FWP_SID S-1-0-0 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE :: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_PERMIT 0 68211 FWP_UINT64 103079216120 {82e6ae67-453a-49bd-b6e2-7b46d586602a} InternetClient Default Rule InternetClient Default Rule FWPM_PROVIDER_MPSSVC_APP_ISOLATION 1e01000000000000 ........ FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION FWP_EMPTY FWPM_CONDITION_ALE_PACKAGE_ID FWP_MATCH_NOT_EQUAL FWP_SID S-1-0-0 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE :: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ORIGINAL_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_CURRENT_PROFILE_ID FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) FWP_ACTION_PERMIT 0 68213 FWP_UINT64 103079216120 {9a8412a0-0fd5-462c-a11f-eb5ec9fc9709} Wi-Fi Direct ASP Coordination Protocol (UDP-Out) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2801000000000000 (....... FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWP_ACTION_PERMIT 0 68258 FWP_UINT64 162253247820595200 {ad448bcc-9e58-4f9d-9d01-844b5628280b} Wi-Fi Direct ASP Coordination Protocol (UDP-Out) FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2801000000000000 (....... FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 7235 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68259 FWP_UINT64 162253265000464384 {ca82888c-e15c-4d97-9deb-f172bcc2c55c} Allow outgoing WSD from PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2b01000000000000 +....... FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_PERMIT 0 68270 FWP_UINT64 162252835503734784 {413958f1-052c-41bb-9600-59345c58297d} Allow outgoing WSD from PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2b01000000000000 +....... FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68271 FWP_UINT64 162252852683603968 {b5b94431-92bb-4993-ae20-dca728cb6a3f} Allow outgoing WSD from PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2c01000000000000 ,....... FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWP_ACTION_PERMIT 0 68274 FWP_UINT64 162235655634550784 {f3611be4-ea21-41ad-bfbb-ff12ffc536f9} Allow outgoing WSD from PeerDistSvc FWPM_FILTER_FLAG_INDEXED FWPM_PROVIDER_MPSSVC_WSH 2c01000000000000 ,....... FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY FWPM_CONDITION_ALE_APP_ID FWP_MATCH_EQUAL FWP_BYTE_BLOB_TYPE 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 \device\harddiskvolume3\windows\system32\svchost.exe FWPM_CONDITION_ALE_USER_ID FWP_MATCH_EQUAL FWP_SECURITY_DESCRIPTOR_TYPE O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE fe80:: FWP_BYTE_ARRAY16_TYPE fe80::ffff:ffff:ffff:ffff FWPM_CONDITION_IP_REMOTE_ADDRESS FWP_MATCH_RANGE FWP_RANGE_TYPE FWP_BYTE_ARRAY16_TYPE ff00:: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 3702 FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_ALL_SET FWP_UINT32 4 FWP_ACTION_PERMIT 0 68275 FWP_UINT64 162235672814419968 FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD ALE Connect v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_NEXTHOP_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_ORIGINAL_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_REAUTHORIZE_REASON FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_PEER_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ORIGINAL_ICMP_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_ALE_ORIGINAL_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_EFFECTIVE_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 51 {c3dbed20-0bb6-4bf3-828d-96732e1e0133} Windows Firewall: callout Performs logging. FWPM_CALLOUT_FLAG_REGISTERED 00000200 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD 275 FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 ALE Flow Established v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_ORIGINAL_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 52 {8e44982b-f477-11df-85ce-78e7d1810190} NDU Flow Established V4 Callout NDU Flow Established V4 Callout FWP_CALLOUT_FLAG_ALLOW_OFFLOAD FWPM_CALLOUT_FLAG_REGISTERED 00000360 {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 262 {c3dbed20-0bb6-4bf3-828d-96732e1e0134} Windows Firewall: callout Performs logging. FWPM_CALLOUT_FLAG_REGISTERED 00000200 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 280 {c3dbed20-0bb6-4bf3-828d-96732e1e0334} Windows Firewall: callout Initiates deep protocol inspection on the flow. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 286 {f762e452-8bfd-47f6-9425-368d888b01dc} windefend_flow_established_v4 windefend FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 298 {8e44982c-f477-11df-85ce-78e7d1810190} NDU Flow Established V4 SubLayer Filter NDU Flow Established V4 SubLayer Filter {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 FWPM_SUBLAYER_INSPECTION FWP_EMPTY FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_CALLOUT_INSPECTION {8e44982b-f477-11df-85ce-78e7d1810190} 0 66999 FWP_UINT64 2 {a5ce04ca-2cda-423e-8fef-52fb9e9fcf3a} FTP Inspection Filter This filter enables inspection of FTP. FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 21 FWP_ACTION_CALLOUT_INSPECTION {c3dbed20-0bb6-4bf3-828d-96732e1e0334} 0 68056 FWP_UINT64 18446744073709551615 {a70ef9b7-c790-4db0-a376-0378f9815b02} FTP Inspection Filter This filter enables inspection of FTP. FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 21 FWP_ACTION_CALLOUT_INSPECTION {c3dbed20-0bb6-4bf3-828d-96732e1e0334} 0 68058 FWP_UINT64 18446744073709551615 {a1dd6389-d3b1-4f46-9300-611216024728} windefend_flow_established_v4 windefend FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} FWP_EMPTY FWPM_CONDITION_DIRECTION FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_DIRECTION FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_INSPECTION {f762e452-8bfd-47f6-9425-368d888b01dc} 0 68280 FWP_UINT64 532575961056 FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD ALE Flow Established v4 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_ORIGINAL_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 53 FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 ALE Flow Established v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_ORIGINAL_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 54 {8e44982d-f477-11df-85ce-78e7d1810190} NDU Flow Established V6 Callout NDU Flow Established V6 Callout FWP_CALLOUT_FLAG_ALLOW_OFFLOAD FWPM_CALLOUT_FLAG_REGISTERED 00000360 {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 263 {c3dbed20-0bb6-4bf3-828d-96732e1e0136} Windows Firewall: callout Performs logging. FWPM_CALLOUT_FLAG_REGISTERED 00000200 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 281 {c3dbed20-0bb6-4bf3-828d-96732e1e0336} Windows Firewall: callout Initiates deep protocol inspection on the flow. FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_PROVIDER_MPSSVC_WF FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 287 {31114833-2891-4edd-a8ec-2ff8549aa491} windefend_flow_established_v6 windefend FWPM_CALLOUT_FLAG_REGISTERED FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 299 {8e44982e-f477-11df-85ce-78e7d1810190} NDU Flow Established V6 SubLayer Filter NDU Flow Established V6 SubLayer Filter {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 FWPM_SUBLAYER_INSPECTION FWP_EMPTY FWPM_CONDITION_FLAGS FWP_MATCH_FLAGS_NONE_SET FWP_UINT32 1 FWP_ACTION_CALLOUT_INSPECTION {8e44982d-f477-11df-85ce-78e7d1810190} 0 67000 FWP_UINT64 2 {8076bfdc-eed9-4602-9570-29b6e402fba5} FTP Inspection Filter This filter enables inspection of FTP. FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_REMOTE_PORT FWP_MATCH_EQUAL FWP_UINT16 21 FWP_ACTION_CALLOUT_INSPECTION {c3dbed20-0bb6-4bf3-828d-96732e1e0336} 0 68057 FWP_UINT64 18446744073709551615 {b6c1c213-7518-4af8-9bcf-eeabe82c63ac} FTP Inspection Filter This filter enables inspection of FTP. FWPM_PROVIDER_MPSSVC_WF ffffffffffffffff ........ FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 FWPM_SUBLAYER_MPSSVC_WF FWP_UINT64 18446744073709551615 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_LOCAL_PORT FWP_MATCH_EQUAL FWP_UINT16 21 FWP_ACTION_CALLOUT_INSPECTION {c3dbed20-0bb6-4bf3-828d-96732e1e0336} 0 68059 FWP_UINT64 18446744073709551615 {4994b7fe-47d8-4ac5-8fa8-77b203c5b640} windefend_flow_established_v6 windefend FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} FWP_EMPTY FWPM_CONDITION_DIRECTION FWP_MATCH_EQUAL FWP_UINT32 0 FWPM_CONDITION_DIRECTION FWP_MATCH_EQUAL FWP_UINT32 1 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 6 FWPM_CONDITION_IP_PROTOCOL FWP_MATCH_EQUAL FWP_UINT8 17 FWP_ACTION_CALLOUT_INSPECTION {31114833-2891-4edd-a8ec-2ff8549aa491} 0 68281 FWP_UINT64 33286004704 FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD ALE Flow Established v6 Discard Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_ORIGINAL_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 55 FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET Inbound Ethernet Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_INTERFACE_MAC_ADDRESS FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY6_TYPE FWPM_CONDITION_MAC_LOCAL_ADDRESS FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY6_TYPE FWPM_CONDITION_MAC_REMOTE_ADDRESS FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY6_TYPE FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_ETHER_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VLAN_ID FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NDIS_PORT FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_L2_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 56 FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET Outbound Ethernet Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_INTERFACE_MAC_ADDRESS FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY6_TYPE FWPM_CONDITION_MAC_LOCAL_ADDRESS FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY6_TYPE FWPM_CONDITION_MAC_REMOTE_ADDRESS FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY6_TYPE FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_ETHER_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VLAN_ID FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NDIS_PORT FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_L2_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 57 FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE Inbound Native MAC Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_NDIS_MEDIA_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NDIS_PORT FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_L2_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 58 FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE Outbound Native MAC Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_NDIS_MEDIA_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_NDIS_PORT FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_L2_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 59 FWPM_LAYER_NAME_RESOLUTION_CACHE_V4 Name Resolution Cache v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_PEER_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 60 FWPM_LAYER_NAME_RESOLUTION_CACHE_V6 Name Resolution Cache v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_PEER_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 61 FWPM_LAYER_ALE_RESOURCE_RELEASE_V4 ALE Resource Release v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 62 FWPM_LAYER_ALE_RESOURCE_RELEASE_V6 ALE Resource Release v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 63 FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4 ALE Endpoint Closure v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 64 FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V6 ALE Endpoint Closure v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 65 FWPM_LAYER_ALE_CONNECT_REDIRECT_V4 ALE Connect Redirect v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_ORIGINAL_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 66 FWPM_LAYER_ALE_CONNECT_REDIRECT_V6 ALE Connect Redirect v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_ORIGINAL_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 67 FWPM_LAYER_ALE_BIND_REDIRECT_V4 ALE Bind Redirect v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 68 {8bc14e84-4287-4c9e-81da-532335532058} Interface Binding Callout FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_PROVIDER_MPSSVC_WSH FWPM_LAYER_ALE_BIND_REDIRECT_V4 258 FWPM_LAYER_ALE_BIND_REDIRECT_V6 ALE Bind Redirect v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 69 {8bc14e84-4287-4c9e-81da-532335532059} Interface Binding Callout FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000300 FWPM_PROVIDER_MPSSVC_WSH FWPM_LAYER_ALE_BIND_REDIRECT_V6 259 FWPM_LAYER_STREAM_PACKET_V4 Stream Packet v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 70 FWPM_LAYER_STREAM_PACKET_V6 Stream Packet v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_TUNNEL_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 71 FWPM_LAYER_INGRESS_VSWITCH_ETHERNET Ingress vSwitch Ethernet layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_MAC_SOURCE_ADDRESS FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY6_TYPE FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_MAC_DESTINATION_ADDRESS FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY6_TYPE FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_ETHER_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VLAN_ID FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_VSWITCH_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_NETWORK_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_VM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_L2_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 72 FWPM_LAYER_EGRESS_VSWITCH_ETHERNET Egress vSwitch Ethernet layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_MAC_SOURCE_ADDRESS FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY6_TYPE FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_MAC_DESTINATION_ADDRESS FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY6_TYPE FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_ETHER_TYPE FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VLAN_ID FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_VSWITCH_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_NETWORK_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_VM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_L2_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 73 FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V4 Ingress vSwitch Transport v4 layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_SOURCE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_SOURCE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_DESTINATION_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VLAN_ID FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_VSWITCH_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_NETWORK_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_VM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_L2_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 74 FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V6 Ingress vSwitch Transport v6 layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_SOURCE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_SOURCE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_DESTINATION_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VLAN_ID FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_VSWITCH_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_NETWORK_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_VM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_L2_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 75 FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V4 Egress vSwitch Transport v4 layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_SOURCE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_DESTINATION_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_SOURCE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_DESTINATION_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VLAN_ID FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_VSWITCH_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_NETWORK_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_VM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_L2_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 76 FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V6 Egress vSwitch Transport v6 layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_SOURCE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_SOURCE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_DESTINATION_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VLAN_ID FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_VSWITCH_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_NETWORK_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_SOURCE_VM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_L2_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 77 FWPM_LAYER_INBOUND_TRANSPORT_FAST Inbound Transport v4 Layer fast FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_SUBLAYER_UNIVERSAL 78 {8e44982f-f477-11df-85ce-78e7d1810190} NDU Inbound Transport Callout NDU Inbound Transport Callout FWP_CALLOUT_FLAG_ALLOW_OFFLOAD FWPM_CALLOUT_FLAG_REGISTERED 00000360 {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_INBOUND_TRANSPORT_FAST 264 {8e449830-f477-11df-85ce-78e7d1810190} NDU Inbound Transport SubLayer Filter NDU Inbound Transport SubLayer Filter {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_INBOUND_TRANSPORT_FAST FWPM_SUBLAYER_INSPECTION FWP_EMPTY FWP_ACTION_CALLOUT_INSPECTION {8e44982f-f477-11df-85ce-78e7d1810190} 0 67001 FWP_UINT64 576460752303423487 FWPM_LAYER_OUTBOUND_TRANSPORT_FAST Outbound Transport v4 Layer fast FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_SUBLAYER_UNIVERSAL 79 {8e449833-f477-11df-85ce-78e7d1810190} NDU Outbound Transport Callout NDU Outbound Transport Callout FWP_CALLOUT_FLAG_ALLOW_OFFLOAD FWPM_CALLOUT_FLAG_REGISTERED 00000360 {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_OUTBOUND_TRANSPORT_FAST 265 {8e449834-f477-11df-85ce-78e7d1810190} NDU Outbound Transport SubLayer Filter NDU Outbound Transport SubLayer Filter {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_OUTBOUND_TRANSPORT_FAST FWPM_SUBLAYER_INSPECTION FWP_EMPTY FWP_ACTION_CALLOUT_INSPECTION {8e449833-f477-11df-85ce-78e7d1810190} 0 67002 FWP_UINT64 576460752303423487 FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST Inbound Native MAC Layer fast FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_SUBLAYER_UNIVERSAL 80 {8e449837-f477-11df-85ce-78e7d1810190} NDU Inbound Mac Frame Native Callout NDU Inbound Mac Frame Native Callout FWP_CALLOUT_FLAG_ALLOW_OFFLOAD FWPM_CALLOUT_FLAG_REGISTERED 000003E0 {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST 266 {8e449838-f477-11df-85ce-78e7d1810190} NDU Inbound Mac Frame Native SubLayer Filter NDU Inbound Mac Frame Native SubLayer Filter {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST FWPM_SUBLAYER_INSPECTION FWP_EMPTY FWP_ACTION_CALLOUT_INSPECTION {8e449837-f477-11df-85ce-78e7d1810190} 0 67003 FWP_UINT64 576460752303423487 FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST Outbound Native MAC Layer fast FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_SUBLAYER_UNIVERSAL 81 {8e449839-f477-11df-85ce-78e7d1810190} NDU Outbound Mac Frame Native Callout NDU Outbound Mac Frame Native Callout FWP_CALLOUT_FLAG_ALLOW_OFFLOAD FWPM_CALLOUT_FLAG_REGISTERED 000003E0 {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST 267 {8e44983a-f477-11df-85ce-78e7d1810190} NDU Outbound Mac Frame Native SubLayer Filter NDU Outbound Mac Frame Native SubLayer Filter {8e44982a-f477-11df-85ce-78e7d1810190} FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST FWPM_SUBLAYER_INSPECTION FWP_EMPTY FWP_ACTION_CALLOUT_INSPECTION {8e449839-f477-11df-85ce-78e7d1810190} 0 67004 FWP_UINT64 576460752303423487 FWPM_LAYER_INBOUND_RESERVED2 Inbound HTTP Reserved Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_RESERVED0 FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_RESERVED1 FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_RESERVED2 FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_RESERVED3 FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_RESERVED4 FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_RESERVED5 FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_RESERVED6 FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_RESERVED7 FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_RESERVED8 FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_RESERVED9 FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_RESERVED10 FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_RESERVED11 FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_RESERVED12 FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_RESERVED13 FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_RESERVED14 FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_RESERVED15 FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_SUBLAYER_UNIVERSAL 82 {29243af8-ecaf-4436-a44e-f9fb7070aa04} ALE Accept Redirect v4 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 83 FWPM_CALLOUT_BUILT_IN_RESERVED_1 WFP Built-in Proxy Connection ALE Accept Redirect v4 Layer Callout Redirects the inbound connection to the address in the provider context. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000300 {29243af8-ecaf-4436-a44e-f9fb7070aa04} 45 {c9809347-218f-4b7f-a742-b281a3f631b4} ALE Accept Redirect v6 Layer FWPM_LAYER_FLAG_KERNEL FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_ALE_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_ALE_USER_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_ACCESS_INFORMATION_TYPE FWPM_CONDITION_ALE_PACKAGE_ID FWPM_FIELD_RAW_DATA FWP_SID FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_COMPARTMENT_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 84 FWPM_CALLOUT_BUILT_IN_RESERVED_2 WFP Built-in Proxy Connection ALE Accept Redirect v6 Layer Callout Redirects the inbound connection to the address in the provider context. FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT FWPM_CALLOUT_FLAG_REGISTERED 00000300 {c9809347-218f-4b7f-a742-b281a3f631b4} 46 FWPM_LAYER_IPSEC_KM_DEMUX_V4 IPsec KM Demux v4 Layer FWPM_LAYER_FLAG_BUILTIN FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_QM_MODE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_SUBLAYER_UNIVERSAL 85 FWPM_LAYER_IPSEC_KM_DEMUX_V6 IPsec KM Demux v6 Layer FWPM_LAYER_FLAG_BUILTIN FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_QM_MODE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_SUBLAYER_UNIVERSAL 86 FWPM_LAYER_IPSEC_V4 IPsec v4 Layer FWPM_LAYER_FLAG_BUILTIN FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_SUBLAYER_UNIVERSAL 87 FWPM_LAYER_IPSEC_V6 IPsec v6 Layer FWPM_LAYER_FLAG_BUILTIN FWPM_CONDITION_IP_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_REMOTE_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_SUBLAYER_UNIVERSAL 88 FWPM_LAYER_IKEEXT_V4 IKE v4 Layer FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_SUBLAYER_UNIVERSAL 89 FWPM_LAYER_IKEEXT_V6 IKE v6 Layer FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_FIELD_RAW_DATA FWP_UINT64 FWPM_CONDITION_CURRENT_PROFILE_ID FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_SECURITY_REALM_ID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_SUBLAYER_UNIVERSAL 90 FWPM_LAYER_RPC_UM RPC UM Layer FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_REMOTE_USER_TOKEN FWPM_FIELD_RAW_DATA FWP_TOKEN_INFORMATION_TYPE FWPM_CONDITION_RPC_IF_UUID FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_RPC_IF_VERSION FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_RPC_IF_FLAG FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DCOM_APP_ID FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IMAGE_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_RPC_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_RPC_AUTH_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_RPC_AUTH_LEVEL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SEC_KEY_SIZE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_V4 FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_V6 FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_PIPE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS_V4 FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS_V6 FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_SUBLAYER_UNIVERSAL 91 FWPM_LAYER_RPC_EPMAP RPC EPMAP Layer FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_REMOTE_USER_TOKEN FWPM_FIELD_RAW_DATA FWP_TOKEN_INFORMATION_TYPE FWPM_CONDITION_RPC_IF_UUID FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_RPC_IF_VERSION FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_RPC_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_RPC_AUTH_TYPE FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_RPC_AUTH_LEVEL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_SEC_KEY_SIZE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_V4 FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_LOCAL_ADDRESS_V6 FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_IP_LOCAL_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_PIPE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_IP_REMOTE_ADDRESS_V4 FWPM_FIELD_IP_ADDRESS FWP_UINT32 FWPM_CONDITION_IP_REMOTE_ADDRESS_V6 FWPM_FIELD_IP_ADDRESS FWP_BYTE_ARRAY16_TYPE FWPM_SUBLAYER_UNIVERSAL 92 FWPM_LAYER_RPC_EP_ADD RPC EP ADD Layer FWPM_LAYER_FLAG_BUILTIN FWPM_CONDITION_PROCESS_WITH_RPC_IF_UUID FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_RPC_PROTOCOL FWPM_FIELD_RAW_DATA FWP_UINT8 FWPM_CONDITION_RPC_EP_VALUE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_RPC_EP_FLAGS FWPM_FIELD_FLAGS FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 93 FWPM_LAYER_RPC_PROXY_CONN RPC Proxy Connect Layer FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_CLIENT_TOKEN FWPM_FIELD_RAW_DATA FWP_TOKEN_INFORMATION_TYPE FWPM_CONDITION_RPC_SERVER_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_RPC_SERVER_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_RPC_PROXY_AUTH_TYPE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CLIENT_CERT_OID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_SUBLAYER_UNIVERSAL 94 FWPM_LAYER_RPC_PROXY_IF RPC Proxy Interface Layer FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_CLIENT_TOKEN FWPM_FIELD_RAW_DATA FWP_TOKEN_INFORMATION_TYPE FWPM_CONDITION_RPC_IF_UUID FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_RPC_IF_VERSION FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_RPC_SERVER_NAME FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_RPC_SERVER_PORT FWPM_FIELD_RAW_DATA FWP_UINT16 FWPM_CONDITION_RPC_PROXY_AUTH_TYPE FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_CLIENT_CERT_OID FWPM_FIELD_RAW_DATA FWP_BYTE_BLOB_TYPE FWPM_SUBLAYER_UNIVERSAL 95 FWPM_LAYER_KM_AUTHORIZATION Keying Module Authorization Layer FWPM_LAYER_FLAG_BUILTIN FWPM_LAYER_FLAG_CLASSIFY_MOSTLY FWPM_CONDITION_REMOTE_ID FWPM_FIELD_RAW_DATA FWP_TOKEN_INFORMATION_TYPE FWPM_CONDITION_AUTHENTICATION_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_KM_TYPE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_DIRECTION FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_KM_MODE FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_CONDITION_IPSEC_POLICY_KEY FWPM_FIELD_RAW_DATA FWP_BYTE_ARRAY16_TYPE FWPM_CONDITION_KM_AUTH_NAP_CONTEXT FWPM_FIELD_RAW_DATA FWP_UINT32 FWPM_SUBLAYER_UNIVERSAL 96 FWPM_PROVIDER_IKEEXT Microsoft Corporation Microsoft Windows WFP Built-in IKEEXT provider used to identify filters added by IKE/AuthIP. FWPM_PROVIDER_FLAG_DISABLED IKEEXT FWPM_PROVIDER_TCP_CHIMNEY_OFFLOAD Microsoft Corporation Microsoft Windows WFP Built-in TCP Chimney Offload provider used to identify filters added by TCP Chimney Offload. FWPM_PROVIDER_MPSSVC_APP_ISOLATION @bfe.dll,-1217 Microsoft Windows WFP Built-in MPSSVC App Isolation provider. mpssvc FWPM_PROVIDER_MPSSVC_WSH Microsoft Corporation Microsoft Windows WFP Built-in MPSSVC Windows Service Hardening and Quarantine provider. mpssvc FWPM_PROVIDER_MPSSVC_EDP Microsoft Corporation Microsoft Windows WFP Built-in MPSSVC Enterprise Data Protection provider. mpssvc {c698301d-9129-450c-937c-f4b834bfb374} Microsoft Corporation Microsoft Windows edge traversal socket option authorization provider {893a4f22-9bba-49b7-8c66-3d40929c8fd5} Microsoft Corporation Microsoft Windows Teredo firewall provider FWPM_PROVIDER_MPSSVC_WF Microsoft Corporation Microsoft Windows WFP Built-in MPSSVC Windows Firewall provider. mpssvc FWPM_PROVIDER_IPSEC_DOSP_CONFIG Microsoft Corporation Microsoft Windows WFP Built-in IPsec DoS Protection configuration provider used to identify filters added by IPsec Denial of Service Protection. FWPM_PROVIDER_TCP_TEMPLATES Microsoft Corporation Microsoft Windows WFP Built-in TCP Templates provider used to identify filters added by TCP Template based configuration. FWPM_PROVIDER_MPSSVC_TENANT_RESTRICTIONS WFP Built-in MPSSVC Tenant Restrictions Sublayer Microsoft Windows WFP Built-in MPSSVC Tenant Restrictions provider. mpssvc {1bebc969-61a5-4732-a177-847a0817862a} Microsoft Corporation Microsoft Windows Defender Firewall IPsec Provider FWPM_PROVIDER_FLAG_PERSISTENT MPSSVC {8e44982a-f477-11df-85ce-78e7d1810190} Microsoft Corporation Windows Network Data Usage (NDU) Provider NDU FWPM_PROVIDER_CONTEXT_SECURE_SOCKET_AUTHIP WFP Built-in Default Secure Socket AuthIP Policy Provider Context Authenticated Internet Protocol (AuthIP) main mode default policy for secure sockets. FWPM_IPSEC_AUTHIP_MM_CONTEXT 0 IKEEXT_ANONYMOUS IKEEXT_IMPERSONATION_NONE IKEEXT_CIPHER_AES_128 0 0 IKEEXT_INTEGRITY_SHA1 7200 IKEEXT_DH_ECP_256 0 IKEEXT_CIPHER_3DES 0 0 IKEEXT_INTEGRITY_SHA1 7200 IKEEXT_DH_GROUP_2 0 0 0 9223372036854775808 FWPM_PROVIDER_CONTEXT_SECURE_SOCKET_IPSEC WFP Built-in Default Secure Socket IPsec Policy Provider Context Internet Protocol Security (IPsec) quick mode default policy for secure sockets. FWPM_IPSEC_AUTHIP_QM_TRANSPORT_CONTEXT 3600 56320 2147483647 IPSEC_TRANSFORM_ESP_AUTH IPSEC_AUTH_SHA_1 IPSEC_AUTH_CONFIG_HMAC_SHA_1_96 IPSEC_PFS_NONE 3600 56320 2147483647 IPSEC_TRANSFORM_ESP_AUTH_AND_CIPHER IPSEC_AUTH_SHA_1 IPSEC_AUTH_CONFIG_HMAC_SHA_1_96 IPSEC_CIPHER_TYPE_AES_128 IPSEC_CIPHER_CONFIG_CBC_AES_128 IPSEC_PFS_NONE 3600 56320 2147483647 IPSEC_TRANSFORM_ESP_AUTH_AND_CIPHER IPSEC_AUTH_SHA_1 IPSEC_AUTH_CONFIG_HMAC_SHA_1_96 IPSEC_CIPHER_TYPE_3DES IPSEC_CIPHER_CONFIG_CBC_3DES IPSEC_PFS_NONE 3600 56320 2147483647 IPSEC_TRANSFORM_AH IPSEC_AUTH_SHA_1 IPSEC_AUTH_CONFIG_HMAC_SHA_1_96 IPSEC_PFS_NONE IPSEC_POLICY_FLAG_ND_BOUNDARY 10 300 60 IKEEXT_KERBEROS IKEEXT_SSL IKEEXT_CERT_CONFIG_TRUSTED_ROOT_STORE 1 1.3.6.1.5.5.7.3.2 IKEEXT_CERT_CONFIG_TRUSTED_ROOT_STORE 2 1.3.6.1.5.5.7.3.2 1.3.6.1.5.5.8.2.2 1 1.3.6.1.5.5.7.3.2 1 1.3.6.1.5.5.8.2.2 IKEEXT_IMPERSONATION_SOCKET_PRINCIPAL 9223372036854775809 {30433c31-b05f-421f-8fde-018ea4c68af4} MPSSVC Stores filter origin FWPM_PROVIDER_CONTEXT_FLAG_PERSISTENT FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 510075006100720061006e00740069006e0065002000440065006600610075006c0074000000 Q.u.a.r.a.n.t.i.n.e. .D.e.f.a.u.l.t... 9223372036854775810 {93132c36-6e06-4e6f-a10b-218787cd49cf} MPSSVC Stores filter origin FWPM_PROVIDER_CONTEXT_FLAG_PERSISTENT FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 42006f006f007400740069006d0065002000440065006600610075006c0074000000 B.o.o.t.t.i.m.e. .D.e.f.a.u.l.t... 9223372036854775811 {252fe349-15c1-48d5-82a6-e62a2e483dcf} State Management Provider Context Contains State Management Options FWPM_PROVIDER_MPSSVC_WF FWPM_CLASSIFY_OPTIONS_CONTEXT FWP_CLASSIFY_OPTION_LOOSE_SOURCE_MAPPING FWP_UINT32 1 9223372036854775812 {2ea412db-5c9d-4bbd-9af2-4914d2dbfe17} State Management Provider Context Contains State Management Options FWPM_PROVIDER_MPSSVC_WF FWPM_CLASSIFY_OPTIONS_CONTEXT FWP_CLASSIFY_OPTION_LOCAL_ONLY_MAPPING FWP_UINT32 1 9223372036854775813 {9889f02d-6a85-49b4-8928-884e5ab5ee59} Policy Silent Mode Provider Context The policy is inspected only but not enforced FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50006f006c00690063007900530069006c0065006e0074004d006f0064006500500072006f00760069006400650072000000 P.o.l.i.c.y.S.i.l.e.n.t.M.o.d.e.P.r.o.v.i.d.e.r... 9223372036854775814 {de04f4bd-a953-47f6-b1b6-eb6e24a546d6} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5700530048002000440065006600610075006c0074000000 W.S.H. .D.e.f.a.u.l.t... 9223372036854775815 {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 51007500650072007900200055007300650072002000440065006600610075006c0074000000 Q.u.e.r.y. .U.s.e.r. .D.e.f.a.u.l.t... 9223372036854775816 {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 41007000700043006f006e007400610069006e006500720020004c006f006f0070006200610063006b000000 A.p.p.C.o.n.t.a.i.n.e.r. .L.o.o.p.b.a.c.k... 9223372036854775817 {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53007400650061006c00740068000000 S.t.e.a.l.t.h... 9223372036854775818 {20f3bb11-bbf6-4e60-aeb3-e651c675d642} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006800690065006c0064006500640020004d00610069006e002000520075006c0065000000 S.h.i.e.l.d.e.d. .M.a.i.n. .R.u.l.e... 9223372036854776151 {28127d58-a9af-43ee-bfe2-a06cb632fa4e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 440065006600610075006c007400200049006e0062006f0075006e0064000000 D.e.f.a.u.l.t. .I.n.b.o.u.n.d... 9223372036854776154 {df7bad3c-1c14-4ad9-ab82-5eb01bc9d76b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006800690065006c0064006500640020004d00610069006e002000520075006c0065000000 S.h.i.e.l.d.e.d. .M.a.i.n. .R.u.l.e... 9223372036854776157 {396a665b-ae9f-4c00-a33d-098abf605990} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 440065006600610075006c007400200049006e0062006f0075006e0064000000 D.e.f.a.u.l.t. .I.n.b.o.u.n.d... 9223372036854776160 {7a06a358-d5e2-4304-8970-c724ca7c9674} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006800690065006c0064006500640020004d00610069006e002000520075006c0065000000 S.h.i.e.l.d.e.d. .M.a.i.n. .R.u.l.e... 9223372036854776163 {abf0b72d-a22e-427e-9139-ebca0193e5d9} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 440065006600610075006c007400200049006e0062006f0075006e0064000000 D.e.f.a.u.l.t. .I.n.b.o.u.n.d... 9223372036854776166 {b36473ef-bf42-49b9-ac24-adba245e825c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5500570050002000440065006600610075006c007400200049006e0062006f0075006e006400200042006c006f0063006b002000520075006c0065000000 U.W.P. .D.e.f.a.u.l.t. .I.n.b.o.u.n.d. .B.l.o.c.k. .R.u.l.e... 9223372036854776169 {11ec8831-cda4-4bab-aa69-cb45e32f4ea9} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5500570050002000440065006600610075006c00740020004f007500740062006f0075006e006400200042006c006f0063006b002000520075006c0065000000 U.W.P. .D.e.f.a.u.l.t. .O.u.t.b.o.u.n.d. .B.l.o.c.k. .R.u.l.e... 9223372036854776170 {13fd7ae8-4dad-4362-9178-9991d6ac4670} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 41007500640069006f007300720076002d0031000000 A.u.d.i.o.s.r.v.-.1... 9223372036854776171 {74eff966-472f-46ce-9391-ad9e1303f145} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 41007500640069006f007300720076002d0032000000 A.u.d.i.o.s.r.v.-.2... 9223372036854776172 {ac7ae3b6-0cf9-4ae4-9212-6c452f977570} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4100560045006e00640070006f0069006e0074004200750069006c006400650072002d0031000000 A.V.E.n.d.p.o.i.n.t.B.u.i.l.d.e.r.-.1... 9223372036854776173 {2153ec13-392d-4ffd-aedb-b4818c4dc9f7} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4100560045006e00640070006f0069006e0074004200750069006c006400650072002d0032000000 A.V.E.n.d.p.o.i.n.t.B.u.i.l.d.e.r.-.2... 9223372036854776174 {a16428ab-a823-4c1e-aee4-9bce9dd30989} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4100780049006e0073007400530056002d0031000000 A.x.I.n.s.t.S.V.-.1... 9223372036854776175 {3cec65bf-a4e1-4376-b287-0691e08a6f63} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4100780049006e0073007400530056002d0033000000 A.x.I.n.s.t.S.V.-.3... 9223372036854776176 {9066c4f6-66a6-41fc-a268-07d1b287af42} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4200460045002d0031000000 B.F.E.-.1... 9223372036854776177 {dbc25b5e-745f-46f2-800b-2178e7367202} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4200460045002d0032000000 B.F.E.-.2... 9223372036854776178 {074c3ea9-af96-4a28-a6c6-db9b0335adb0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4300440050005300760063002d0032000000 C.D.P.S.v.c.-.2... 9223372036854776179 {e26c5b51-f344-4e59-b535-2ce78d16974c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4300440050005300760063002d0036000000 C.D.P.S.v.c.-.6... 9223372036854776180 {8966736d-4524-4694-9e2e-ee9f1387e011} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00330032002d0031000000 c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.3.2.-.1... 9223372036854776181 {bd49f24b-1801-46be-969c-e0cf5afd621a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00330032002d0032000000 c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.3.2.-.2... 9223372036854776182 {cc755386-b9e1-4342-a317-790c4f0a9534} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00360034002d0031000000 c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.6.4.-.1... 9223372036854776183 {bfa85b2e-3c06-4d69-b4e1-f149cff4661e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00360034002d0032000000 c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.6.4.-.2... 9223372036854776184 {a8b55da6-3aba-41f3-b7ba-443233f64fce} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0031000000 D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.1... 9223372036854776185 {c4e61e5c-3e66-4efb-b22b-87f8e56cf9c2} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4400650076006900630065004d0061006e006100670065006d0065006e0074002d00310030000000 D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.1.0... 9223372036854776186 {4dd4109f-8980-4e66-b307-887227d761a4} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4400650076006900630065004d0061006e006100670065006d0065006e0074002d00310031000000 D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.1.1... 9223372036854776187 {f876928c-1566-4b9a-a110-57d531115565} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0032000000 D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.2... 9223372036854776188 {616fdcf3-1169-46b5-8224-cffc7276af2e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0034000000 D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.4... 9223372036854776189 {3742db91-517a-4f69-b378-08c5c09364b3} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0035000000 D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.5... 9223372036854776190 {49208958-c95e-48da-832f-60636a24827a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0037000000 D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.7... 9223372036854776191 {70f84089-a6de-44ab-88ba-681a2d87204e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0038000000 D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.8... 9223372036854776192 {acc4c150-270a-47dc-91d0-23dcf4b073f4} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 44004800430050002d0034000000 D.H.C.P.-.4... 9223372036854776193 {fa7bff4f-61db-455f-8fec-220c1122cda0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 44004800430050002d0035000000 D.H.C.P.-.5... 9223372036854776194 {140da811-71af-4719-aea9-3e3196bb2c73} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 44006900730070006c006100790045006e00680061006e00630065006d0065006e00740053006500720076006900630065002000440065006e007900200041006c006c00200049006e0062006f0075006e0064000000 D.i.s.p.l.a.y.E.n.h.a.n.c.e.m.e.n.t.S.e.r.v.i.c.e. .D.e.n.y. .A.l.l. .I.n.b.o.u.n.d... 9223372036854776195 {e8b4f949-15cf-4ef0-8c72-4b472a399374} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 44006900730070006c006100790045006e00680061006e00630065006d0065006e00740053006500720076006900630065002000440065006e007900200041006c006c0020004f007500740062006f0075006e0064000000 D.i.s.p.l.a.y.E.n.h.a.n.c.e.m.e.n.t.S.e.r.v.i.c.e. .D.e.n.y. .A.l.l. .O.u.t.b.o.u.n.d... 9223372036854776196 {29442789-6efc-46ed-b261-a526c4b07a9b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 64006f00740033007300760063002d0031000000 d.o.t.3.s.v.c.-.1... 9223372036854776197 {39e96b50-7896-45bf-8a32-6df85e30668a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 64006f00740033007300760063002d0032000000 d.o.t.3.s.v.c.-.2... 9223372036854776198 {b9e16b36-f84a-4ada-8ad6-72303a132d9c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4400500053002d0031000000 D.P.S.-.1... 9223372036854776199 {d7138c16-5c23-4147-8aa2-26c31ffa3282} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4400500053002d0032000000 D.P.S.-.2... 9223372036854776200 {56ca2cdd-1a5b-49db-b1b1-0c7ecda76a96} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4500760065006e0074006c006f0067002d0032000000 E.v.e.n.t.l.o.g.-.2... 9223372036854776201 {66d12cf5-d1c3-4fcf-beec-60486740a808} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4500760065006e0074006c006f0067002d0033000000 E.v.e.n.t.l.o.g.-.3... 9223372036854776202 {766e17d2-0adf-4c0c-a05f-bd0e3a611a0d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 66006400700068006f00730074002d0031000000 f.d.p.h.o.s.t.-.1... 9223372036854776203 {82c89ca7-9d25-44bf-b763-ae9a0fc19072} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 66006400700068006f00730074002d0032000000 f.d.p.h.o.s.t.-.2... 9223372036854776204 {d8d7429a-458d-419c-903a-72b1770c2fa5} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 660068007300760063002d0031000000 f.h.s.v.c.-.1... 9223372036854776205 {e4c31fb1-c4d0-4425-80cb-13aeaf564696} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 660068007300760063002d0032000000 f.h.s.v.c.-.2... 9223372036854776206 {4d390cf4-706e-4f3a-afc5-75de5af9327e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 48006900640053006500720076002d0031000000 H.i.d.S.e.r.v.-.1... 9223372036854776207 {a03a74d6-9d42-487f-9ebf-0576fb284312} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 48006900640053006500720076002d0032000000 H.i.d.S.e.r.v.-.2... 9223372036854776208 {dc9f453d-1eaa-4912-8a95-ec50252e8abd} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4c004d0048006f007300740073002d0033000000 L.M.H.o.s.t.s.-.3... 9223372036854776209 {7c926fc6-603b-4a56-bd0e-683fc579cb4b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4c004d0048006f007300740073002d0034000000 L.M.H.o.s.t.s.-.4... 9223372036854776210 {482ea2c8-fdf2-41e7-8c58-b77891b9e26e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4d006900630072006f0073006f00660074002d00570069006e0064006f00770073002d0041006c006c004a006f0079006e002d0052006f0075007400650072002d0042006c006f0063006b002d0049006e002d0041006c006c0045006c00730065000000 M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.l.l.J.o.y.n.-.R.o.u.t.e.r.-.B.l.o.c.k.-.I.n.-.A.l.l.E.l.s.e... 9223372036854776211 {b91e477a-b12b-4ffe-8036-fb467a589bb5} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4d006900630072006f0073006f00660074002d00570069006e0064006f00770073002d0041006c006c004a006f0079006e002d0052006f0075007400650072002d0042006c006f0063006b002d004f00750074002d0041006c006c0045006c00730065000000 M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.l.l.J.o.y.n.-.R.o.u.t.e.r.-.B.l.o.c.k.-.O.u.t.-.A.l.l.E.l.s.e... 9223372036854776212 {84a6277c-c2cf-4550-8617-4766635b0978} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4d00500053005300560043002d0031000000 M.P.S.S.V.C.-.1... 9223372036854776213 {9dc391c3-71d8-4649-b1d5-75ed10f360a9} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4d00500053005300560043002d0032000000 M.P.S.S.V.C.-.2... 9223372036854776214 {0565668f-d3c2-489b-86fc-63eaa40816b7} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4e00650074006d0061006e002d0031000000 N.e.t.m.a.n.-.1... 9223372036854776215 {e66edf14-6359-4ebf-a197-ba3f7537af1b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 4e00650074006d0061006e002d0032000000 N.e.t.m.a.n.-.2... 9223372036854776216 {a8703831-1566-41ef-a65d-e1810ef57048} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5000320050002000470072006f007500700069006e006700200042006c006f0063006b00200049006e000000 P.2.P. .G.r.o.u.p.i.n.g. .B.l.o.c.k. .I.n... 9223372036854776217 {07e62e11-172d-4a30-af90-caf4e66d513b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5000320050002000470072006f007500700069006e006700200042006c006f0063006b0020004f00750074000000 P.2.P. .G.r.o.u.p.i.n.g. .B.l.o.c.k. .O.u.t... 9223372036854776218 {1e2445fb-9e48-41aa-98ff-d540234e8a15} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50003200500020004900640065006e007400200042006c006f0063006b00200049006e000000 P.2.P. .I.d.e.n.t. .B.l.o.c.k. .I.n... 9223372036854776219 {4fbe1969-bcf9-4b68-8e7f-12bdb7f4b5c5} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50003200500020004900640065006e007400200042006c006f0063006b0020004f00750074000000 P.2.P. .I.d.e.n.t. .B.l.o.c.k. .O.u.t... 9223372036854776220 {2ec90dcd-0a0b-46e8-a930-97e228065a8d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5000630061005300760063002d0031000000 P.c.a.S.v.c.-.1... 9223372036854776221 {023d6954-db44-4559-875b-c888101ce60c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5000630061005300760063002d0032000000 P.c.a.S.v.c.-.2... 9223372036854776222 {0f745c88-3d06-4f3f-836a-246ed1fdb397} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 500065007200660048006f00730074002d0031000000 P.e.r.f.H.o.s.t.-.1... 9223372036854776223 {3f019c77-26df-4344-96a3-327d030483fd} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 500065007200660048006f00730074002d0032000000 P.e.r.f.H.o.s.t.-.2... 9223372036854776224 {e39d0a93-3337-4e1e-b56a-d00861b1f26a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50004e0052005000200042006c006f0063006b00200049006e000000 P.N.R.P. .B.l.o.c.k. .I.n... 9223372036854776225 {c4c5bf1b-6190-4fdc-95ec-0d4ba3d09dbc} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50004e0052005000200042006c006f0063006b0020004f00750074000000 P.N.R.P. .B.l.o.c.k. .O.u.t... 9223372036854776226 {d7744c01-2520-4e53-9d09-1b4c41561898} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50006e00720070004100750074006f00200042006c006f0063006b00200049006e000000 P.n.r.p.A.u.t.o. .B.l.o.c.k. .I.n... 9223372036854776227 {f293ff68-0301-4ecb-9c6f-b0b73b0c0f99} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50006e00720070004100750074006f00200042006c006f0063006b0020004f00750074000000 P.n.r.p.A.u.t.o. .B.l.o.c.k. .O.u.t... 9223372036854776228 {08edbc40-f085-4664-8cf6-cfb6e9ebe8f6} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50006f006c006900630079004100670065006e0074002d0034000000 P.o.l.i.c.y.A.g.e.n.t.-.4... 9223372036854776229 {542d5137-d23a-4bb4-8d90-9c30857d84bc} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50006f006c006900630079004100670065006e0074002d0035000000 P.o.l.i.c.y.A.g.e.n.t.-.5... 9223372036854776230 {3a5e8a34-82df-4083-a6ed-87ea8ed3507a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 530065006100720063006800460069006c0074006500720048006f00730074002d0031000000 S.e.a.r.c.h.F.i.l.t.e.r.H.o.s.t.-.1... 9223372036854776231 {03843031-9e01-449d-b94b-047c6fbe714c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 530065006100720063006800460069006c0074006500720048006f00730074002d0032000000 S.e.a.r.c.h.F.i.l.t.e.r.H.o.s.t.-.2... 9223372036854776232 {bbe3095e-afe8-4c43-8de5-b9994738a268} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006500610072006300680049006e00640065007800650072002d0031000000 S.e.a.r.c.h.I.n.d.e.x.e.r.-.1... 9223372036854776233 {c7031a73-1778-4847-9b46-8ce7fa8798c1} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006500610072006300680049006e00640065007800650072002d0032000000 S.e.a.r.c.h.I.n.d.e.x.e.r.-.2... 9223372036854776234 {c0cedbe2-34f4-4491-bd19-152a55b1b6e0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 530065006100720063006800500072006f0074006f0063006f006c0048006f00730074002d0031000000 S.e.a.r.c.h.P.r.o.t.o.c.o.l.H.o.s.t.-.1... 9223372036854776235 {be0ee23e-c670-47d6-8112-7cf182d22041} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53004e004d00500054005200410050002d0032000000 S.N.M.P.T.R.A.P.-.2... 9223372036854776236 {b508cf8d-5dbe-44e9-bc10-85402404c8f4} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53004e004d00500054005200410050002d0033000000 S.N.M.P.T.R.A.P.-.3... 9223372036854776237 {7b84e8bb-fa4a-42c3-b61d-6e2b0532fdc5} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53005000500045005800540043004f004d004f0042004a002d0033000000 S.P.P.E.X.T.C.O.M.O.B.J.-.3... 9223372036854776238 {6cc74acd-ca95-45f6-8c3b-5e62000940b0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53005000500045005800540043004f004d004f0042004a002d0034000000 S.P.P.E.X.T.C.O.M.O.B.J.-.4... 9223372036854776239 {f63fb925-3743-4a88-95ed-a842472b93fc} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5300790073006d00610069006e002d0031000000 S.y.s.m.a.i.n.-.1... 9223372036854776240 {0613da54-aa3d-4d9d-afd6-d4d64f655001} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5300790073006d00610069006e002d0032000000 S.y.s.m.a.i.n.-.2... 9223372036854776241 {d8e3c9f1-31ab-441a-896a-8c4b0d3b2019} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5400610062006c006500740049006e0070007500740053006500720076006900630065002d0031000000 T.a.b.l.e.t.I.n.p.u.t.S.e.r.v.i.c.e.-.1... 9223372036854776242 {cfcaf1e6-48d2-47d1-a1e3-d7b017af03ee} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5400610062006c006500740049006e0070007500740053006500720076006900630065002d0032000000 T.a.b.l.e.t.I.n.p.u.t.S.e.r.v.i.c.e.-.2... 9223372036854776243 {7b6dc94c-eb68-4c29-9f34-589b83c2f93a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 540072006b0077006b0073002d0031000000 T.r.k.w.k.s.-.1... 9223372036854776244 {42e3bde9-8223-45ae-a948-b331cfad1178} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 540072006b0077006b0073002d0032000000 T.r.k.w.k.s.-.2... 9223372036854776245 {f5ce7aa1-73b7-4368-8117-1b81a708a5b8} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 55006d0052006400700053006500720076006900630065002d0031000000 U.m.R.d.p.S.e.r.v.i.c.e.-.1... 9223372036854776246 {09581f72-a5fa-4f0d-83c1-e0a072bb2e5c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 55006d0052006400700053006500720076006900630065002d0032000000 U.m.R.d.p.S.e.r.v.i.c.e.-.2... 9223372036854776247 {89946940-1d3d-4828-baf2-ef863ff4d926} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5600610063005300760063002d0031000000 V.a.c.S.v.c.-.1... 9223372036854776248 {09c48c05-27b6-4ee0-99f7-a39203499a80} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5600610063005300760063002d0032000000 V.a.c.S.v.c.-.2... 9223372036854776249 {20ba781c-7644-4706-9a3d-3cadb206da34} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5600440053002d0031000000 V.D.S.-.1... 9223372036854776250 {de982dfe-87db-49d3-ab9e-fd063af6cf3e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d00690063006700750065007300740069006e0074006500720066006100630065002d0062006c006f0063006b002d0069006e000000 v.m.i.c.g.u.e.s.t.i.n.t.e.r.f.a.c.e.-.b.l.o.c.k.-.i.n... 9223372036854776251 {66d956e2-2f1d-424c-9d3c-48ae68b15ed6} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d00690063006700750065007300740069006e0074006500720066006100630065002d0062006c006f0063006b002d006f00750074000000 v.m.i.c.g.u.e.s.t.i.n.t.e.r.f.a.c.e.-.b.l.o.c.k.-.o.u.t... 9223372036854776252 {36a4e3cc-ec47-49eb-977f-e55f10f19083} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d00690063006800650061007200740062006500610074002d0062006c006f0063006b002d0069006e000000 v.m.i.c.h.e.a.r.t.b.e.a.t.-.b.l.o.c.k.-.i.n... 9223372036854776253 {8293ae37-bed3-4430-a7a4-68b06342c2e2} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d00690063006800650061007200740062006500610074002d0062006c006f0063006b002d006f00750074000000 v.m.i.c.h.e.a.r.t.b.e.a.t.-.b.l.o.c.k.-.o.u.t... 9223372036854776254 {fcc62406-2a46-4704-8605-51da6478c028} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d00690063006b0076007000650078006300680061006e00670065002d0062006c006f0063006b002d0069006e000000 v.m.i.c.k.v.p.e.x.c.h.a.n.g.e.-.b.l.o.c.k.-.i.n... 9223372036854776255 {996f6ad1-478b-49a3-9ac5-9278bbfdab90} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d00690063006b0076007000650078006300680061006e00670065002d0062006c006f0063006b002d006f00750074000000 v.m.i.c.k.v.p.e.x.c.h.a.n.g.e.-.b.l.o.c.k.-.o.u.t... 9223372036854776256 {c9a666f9-bc1e-4e39-9ee6-52940117aad8} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d00690063007200640076002d0062006c006f0063006b002d0069006e000000 v.m.i.c.r.d.v.-.b.l.o.c.k.-.i.n... 9223372036854776257 {19d55ef7-9fd1-43d0-b47c-b7752e875f3e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d00690063007200640076002d0062006c006f0063006b002d006f00750074000000 v.m.i.c.r.d.v.-.b.l.o.c.k.-.o.u.t... 9223372036854776258 {79d972a5-c160-4af7-b091-58da324a4ff0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d0069006300730068007500740064006f0077006e002d0062006c006f0063006b002d0069006e000000 v.m.i.c.s.h.u.t.d.o.w.n.-.b.l.o.c.k.-.i.n... 9223372036854776259 {2c1956cf-17bc-4820-b44d-522f9985dc29} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d0069006300730068007500740064006f0077006e002d0062006c006f0063006b002d006f00750074000000 v.m.i.c.s.h.u.t.d.o.w.n.-.b.l.o.c.k.-.o.u.t... 9223372036854776260 {0c6406d9-1628-4c44-b2da-b5f8ca525a44} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d0069006300740069006d006500730079006e0063002d0062006c006f0063006b002d0069006e000000 v.m.i.c.t.i.m.e.s.y.n.c.-.b.l.o.c.k.-.i.n... 9223372036854776261 {f245355c-3927-4d7a-b7eb-57a3db7827c6} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d0069006300740069006d006500730079006e0063002d0062006c006f0063006b002d006f00750074000000 v.m.i.c.t.i.m.e.s.y.n.c.-.b.l.o.c.k.-.o.u.t... 9223372036854776262 {b4fc7eca-e42d-4ae1-a29e-bc721cde5535} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d006900630076006d00730065007300730069006f006e002d0062006c006f0063006b002d0069006e000000 v.m.i.c.v.m.s.e.s.s.i.o.n.-.b.l.o.c.k.-.i.n... 9223372036854776263 {3c267f8e-944d-4068-acad-75ba5821575b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d006900630076006d00730065007300730069006f006e002d0062006c006f0063006b002d006f00750074000000 v.m.i.c.v.m.s.e.s.s.i.o.n.-.b.l.o.c.k.-.o.u.t... 9223372036854776264 {c58cd9f2-b4e4-43f5-b494-d7260d82f973} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d00690063007600730073002d0062006c006f0063006b002d0069006e000000 v.m.i.c.v.s.s.-.b.l.o.c.k.-.i.n... 9223372036854776265 {1622032e-7b49-4f11-b377-d2c73c90bcc8} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 76006d00690063007600730073002d0062006c006f0063006b002d006f00750074000000 v.m.i.c.v.s.s.-.b.l.o.c.k.-.o.u.t... 9223372036854776266 {a5086f3a-f5e4-481e-8caf-1ff0204b001c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7700620065006e00670069006e0065002d0031000000 w.b.e.n.g.i.n.e.-.1... 9223372036854776267 {c2733d72-d500-4045-94f2-09606cd6dbc6} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7700620065006e00670069006e0065002d0033000000 w.b.e.n.g.i.n.e.-.3... 9223372036854776268 {c6f5a818-b954-42a7-b596-45591ca10f6a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 570063006d007300760063002d0031000000 W.c.m.s.v.c.-.1... 9223372036854776269 {f87d269f-537e-4352-b018-87e5976976f7} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 570063006d007300760063002d0033000000 W.c.m.s.v.c.-.3... 9223372036854776270 {0c3cddb6-de83-4012-8dca-52a7682f97da} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 570064006900530079007300740065006d0048006f00730074002d0031000000 W.d.i.S.y.s.t.e.m.H.o.s.t.-.1... 9223372036854776271 {ffd72c64-50dc-4b5b-8b1e-1dfe782f4d0d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 570064006900530079007300740065006d0048006f00730074002d0032000000 W.d.i.S.y.s.t.e.m.H.o.s.t.-.2... 9223372036854776272 {9a09d870-2858-4be6-9e2f-ce10b4907fa0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5700650072005300760063002d0031000000 W.e.r.S.v.c.-.1... 9223372036854776273 {c54b278f-9127-40bf-aa5e-86674fa65c76} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5700650072005300760063002d0032000000 W.e.r.S.v.c.-.2... 9223372036854776274 {690f4ad8-bc37-48b7-bed6-bfa7a526a895} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 570069006e0064006f007700730044006500660065006e006400650072002d0032000000 W.i.n.d.o.w.s.D.e.f.e.n.d.e.r.-.2... 9223372036854776275 {cdfd6c38-1499-44b4-a900-60aa4e8936c2} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 570069006e0064006f007700730044006500660065006e006400650072002d0033000000 W.i.n.d.o.w.s.D.e.f.e.n.d.e.r.-.3... 9223372036854776276 {22d7902a-15f9-4e7c-85fa-062e993aa6d5} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 570069006e0048007400740070004100750074006f00500072006f00780079005300760063002d0032000000 W.i.n.H.t.t.p.A.u.t.o.P.r.o.x.y.S.v.c.-.2... 9223372036854776277 {2810cbd2-88bb-47d7-a215-409c6cd87bee} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 570069006e0048007400740070004100750074006f00500072006f00780079005300760063002d0033000000 W.i.n.H.t.t.p.A.u.t.o.P.r.o.x.y.S.v.c.-.3... 9223372036854776278 {359ad55a-40a5-45e0-91ba-c921ac9cb876} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 57006c0061006e007300760063002d0031000000 W.l.a.n.s.v.c.-.1... 9223372036854776279 {c9368850-7641-4a64-9c8d-91c38550f267} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 57006c0061006e007300760063002d0032000000 W.l.a.n.s.v.c.-.2... 9223372036854776280 {e4bb7146-61ab-49c8-b9f3-57e9d27207e1} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 77006c00700061007300760063002d0031000000 w.l.p.a.s.v.c.-.1... 9223372036854776281 {478442b4-ce51-424a-991f-9207b636722c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 77006c00700061007300760063002d0033000000 w.l.p.a.s.v.c.-.3... 9223372036854776282 {10cc650c-46e4-40e3-b9d8-1e34fee2055f} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5700530043002000440065006e007900200041006c006c00200049006e0062006f0075006e0064000000 W.S.C. .D.e.n.y. .A.l.l. .I.n.b.o.u.n.d... 9223372036854776283 {fece87b4-8033-4dbe-a385-6bc285eb6d78} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5700530043002000440065006e007900200041006c006c0020004f007500740062006f0075006e0064000000 W.S.C. .D.e.n.y. .A.l.l. .O.u.t.b.o.u.n.d... 9223372036854776284 {9724c57d-1990-4c1f-b17d-8847702bfcef} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5700770061006e005300760063002d0031000000 W.w.a.n.S.v.c.-.1... 9223372036854776285 {c0ff73ea-8d25-4280-a754-96b67c932869} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 5700770061006e005300760063002d0032000000 W.w.a.n.S.v.c.-.2... 9223372036854776286 {ed046545-5b2c-4368-b04e-e93ca55def93} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 410073007300690067006e00650064004100630063006500730073004d0061006e0061006700650072005300760063002d0031000000 A.s.s.i.g.n.e.d.A.c.c.e.s.s.M.a.n.a.g.e.r.S.v.c.-.1... 9223372036854776287 {1b7af7da-20ed-4fb5-9eb4-3e63fcb7536c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 410073007300690067006e00650064004100630063006500730073004d0061006e0061006700650072005300760063002d0032000000 A.s.s.i.g.n.e.d.A.c.c.e.s.s.M.a.n.a.g.e.r.S.v.c.-.2... 9223372036854776288 {6796b00a-0007-4eeb-b176-41c6807585a4} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 63006c006f0075006400690064007300760063002d0062006c006f0063006b002d0069006e000000 c.l.o.u.d.i.d.s.v.c.-.b.l.o.c.k.-.i.n... 9223372036854776289 {774ac201-15c6-444f-82c9-1dcdff4326f2} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 63006c006f0075006400690064007300760063002d0062006c006f0063006b002d006f00750074000000 c.l.o.u.d.i.d.s.v.c.-.b.l.o.c.k.-.o.u.t... 9223372036854776290 {b47fa28f-cdca-41e8-8360-733d8216d7f9} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 43007300630053006500720076006900630065002d0031000000 C.s.c.S.e.r.v.i.c.e.-.1... 9223372036854776291 {6e9a9b45-a4cb-4723-bd55-60149243222d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 43007300630053006500720076006900630065002d0032000000 C.s.c.S.e.r.v.i.c.e.-.2... 9223372036854776292 {5845f29b-b4a1-4df2-b66e-609e5f902183} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50006500650072004400690073007400200042006c006f0063006b00200049006e000000 P.e.e.r.D.i.s.t. .B.l.o.c.k. .I.n... 9223372036854776293 {e22f0814-cca5-4de3-8991-4f296ccec7a5} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 50006500650072004400690073007400200042006c006f0063006b0020004f00750074000000 P.e.e.r.D.i.s.t. .B.l.o.c.k. .O.u.t... 9223372036854776294 {66e8985e-169a-4c11-9701-40419c45a9cc} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 57005000440042005500530045004e0055004d002d0031000000 W.P.D.B.U.S.E.N.U.M.-.1... 9223372036854776295 {cfef2756-ac04-449a-b6c6-ed010f460651} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 57005000440042005500530045004e0055004d002d0032000000 W.P.D.B.U.S.E.N.U.M.-.2... 9223372036854776296 {2d39a837-d11e-4242-aa55-d55d0d92ae68} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 640064003400340036003600360033002d0030003000380036002d0034006100390037002d0038003000370061002d006100380033006500390035006400640038003400640038000000 d.d.4.4.6.6.6.3.-.0.0.8.6.-.4.a.9.7.-.8.0.7.a.-.a.8.3.e.9.5.d.d.8.4.d.8... 9223372036854776297 {19d6b0d9-e808-4803-a59f-92ae87bf4b00} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 300033006400320066006500650030002d0031006100640065002d0034003800610036002d0061003700640030002d003100390033006200610064003000310035003100330038000000 0.3.d.2.f.e.e.0.-.1.a.d.e.-.4.8.a.6.-.a.7.d.0.-.1.9.3.b.a.d.0.1.5.1.3.8... 9223372036854776298 {522717a3-989a-403d-8bd9-2301754f6bd4} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00340038003500440036003700310044002d0041003500330037002d0034003800410037002d0039003000440035002d003600370038003300380041003500420041004100320045007d000000 {.4.8.5.D.6.7.1.D.-.A.5.3.7.-.4.8.A.7.-.9.0.D.5.-.6.7.8.3.8.A.5.B.A.A.2.E.}... 9223372036854776299 {fcb5f99f-cabd-4580-b4f4-d8bb7629abd2} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310043003100420039003600340036002d0032004200340046002d0034003300450046002d0038004300350042002d003300460039003000300042003700310034004100410042007d000000 {.1.C.1.B.9.6.4.6.-.2.B.4.F.-.4.3.E.F.-.8.C.5.B.-.3.F.9.0.0.B.7.1.4.A.A.B.}... 9223372036854776300 {68d4ff07-c138-454b-aa7e-316622d0a73c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310044004400440045003200300038002d0032004500330032002d0034003200410045002d0038003800380046002d004200440043003200380038003000380036004500300032007d000000 {.1.D.D.D.E.2.0.8.-.2.E.3.2.-.4.2.A.E.-.8.8.8.F.-.B.D.C.2.8.8.0.8.6.E.0.2.}... 9223372036854776301 {4237d279-1e81-4828-958f-467bf3a5349b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00360038003600420038003300350039002d0031003200330043002d0034003100370032002d0042003100330033002d004200390032003000350030003900320036003300440033007d000000 {.6.8.6.B.8.3.5.9.-.1.2.3.C.-.4.1.7.2.-.B.1.3.3.-.B.9.2.0.5.0.9.2.6.3.D.3.}... 9223372036854776302 {6a19fa7f-ef2b-42cf-b2d6-8139181d816b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450045003400340044004100450041002d0034003100390036002d0034003000450036002d0041003900370030002d003500340038003500330043004400460045003900440041007d000000 {.E.E.4.4.D.A.E.A.-.4.1.9.6.-.4.0.E.6.-.A.9.7.0.-.5.4.8.5.3.C.D.F.E.9.D.A.}... 9223372036854776303 {52026488-b6af-4372-9685-0d69706e6683} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00330038004300380037004200360045002d0034004600410031002d0034004400440043002d0042004300460043002d003600360033004500450035003600450030004300430030007d000000 {.3.8.C.8.7.B.6.E.-.4.F.A.1.-.4.D.D.C.-.B.C.F.C.-.6.6.3.E.E.5.6.E.0.C.C.0.}... 9223372036854776304 {249d04ff-49a5-4e08-87e9-0e68e2019df7} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00460041004400390039003200330043002d0034003900320030002d0034003200310030002d0038004400300042002d003400310030004600300039003100440043004300300043007d000000 {.F.A.D.9.9.2.3.C.-.4.9.2.0.-.4.2.1.0.-.8.D.0.B.-.4.1.0.F.0.9.1.D.C.C.0.C.}... 9223372036854776305 {cbc261c4-d5fd-4e97-8de5-9c64f045fbb0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440034004100460032003900380030002d0039004600370038002d0034004300390041002d0039003700430030002d003800390046003300360030004300390042004300380039007d000000 {.D.4.A.F.2.9.8.0.-.9.F.7.8.-.4.C.9.A.-.9.7.C.0.-.8.9.F.3.6.0.C.9.B.C.8.9.}... 9223372036854776306 {f369fb4f-039a-40d7-89c4-e9d1636f38e1} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00460033004300450030003900350037002d0042004600320039002d0034003200300035002d0038003000350046002d003800450033004400350045003000390037003300340042007d000000 {.F.3.C.E.0.9.5.7.-.B.F.2.9.-.4.2.0.5.-.8.0.5.F.-.8.E.3.D.5.E.0.9.7.3.4.B.}... 9223372036854776307 {c29535e1-3bbf-4491-bfe8-020381591955} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00370044003900370038003700380042002d0043003900310041002d0034003200460034002d0038003700360034002d003300440037004500320030003400310038003400370030007d000000 {.7.D.9.7.8.7.8.B.-.C.9.1.A.-.4.2.F.4.-.8.7.6.4.-.3.D.7.E.2.0.4.1.8.4.7.0.}... 9223372036854776308 {b1f4be4b-02f3-4fe6-9da0-489362bd0b71} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00410042003600410042004400320035002d0038003300420030002d0034003200390030002d0041003700420045002d003400340035003300410042003000370035003100460031007d000000 {.A.B.6.A.B.D.2.5.-.8.3.B.0.-.4.2.9.0.-.A.7.B.E.-.4.4.5.3.A.B.0.7.5.1.F.1.}... 9223372036854776309 {7eb2b4ea-2142-4c7e-a44f-ebb62240040d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00360038003300380041003400340035002d0030004200460033002d0034004500390046002d0042004500410044002d004400320045003900420044003700320042004500460044007d000000 {.6.8.3.8.A.4.4.5.-.0.B.F.3.-.4.E.9.F.-.B.E.A.D.-.D.2.E.9.B.D.7.2.B.E.F.D.}... 9223372036854776310 {176827d1-c164-4c39-8c31-3afecc6a8b87} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430044003500440034003000450046002d0042004500350036002d0034003500440034002d0042003400300035002d003900350031003500450038004400310034003300410037007d000000 {.C.D.5.D.4.0.E.F.-.B.E.5.6.-.4.5.D.4.-.B.4.0.5.-.9.5.1.5.E.8.D.1.4.3.A.7.}... 9223372036854776311 {5f6a0bbb-a184-4846-b780-05f78b81c312} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00370034004600340043004500410031002d0032003600430031002d0034003100440036002d0038003900450042002d004400430033003700450037004600310039003600410033007d000000 {.7.4.F.4.C.E.A.1.-.2.6.C.1.-.4.1.D.6.-.8.9.E.B.-.D.C.3.7.E.7.F.1.9.6.A.3.}... 9223372036854776312 {2b60bea0-0fb8-431e-b6bc-2ecb692ddb06} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00390035003700300036004600330030002d0045004400300035002d0034004500370043002d0041003800440041002d003300350045004500360037003700420036003000360042007d000000 {.9.5.7.0.6.F.3.0.-.E.D.0.5.-.4.E.7.C.-.A.8.D.A.-.3.5.E.E.6.7.7.B.6.0.6.B.}... 9223372036854776313 {39ba4b09-2547-445d-a928-30377b0904fc} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450032004500430033003600380038002d0046003000300035002d0034004200430036002d0041003700420046002d003100360032003900410042004600350031003000300041007d000000 {.E.2.E.C.3.6.8.8.-.F.0.0.5.-.4.B.C.6.-.A.7.B.F.-.1.6.2.9.A.B.F.5.1.0.0.A.}... 9223372036854776314 {eab91178-7ca7-4e7c-9c51-b0fb5529aeec} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310034003500420039003500350046002d0038003200430041002d0034003700360036002d0038004600430037002d004500360033003700330039003000370042004400390046007d000000 {.1.4.5.B.9.5.5.F.-.8.2.C.A.-.4.7.6.6.-.8.F.C.7.-.E.6.3.7.3.9.0.7.B.D.9.F.}... 9223372036854776315 {172590db-b33f-47df-9a24-df562ac3ec0f} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320032003000370041004400310042002d0034003600330036002d0034003100340033002d0038004100390034002d004100310041003400330041003100310032004300330042007d000000 {.2.2.0.7.A.D.1.B.-.4.6.3.6.-.4.1.4.3.-.8.A.9.4.-.A.1.A.4.3.A.1.1.2.C.3.B.}... 9223372036854776316 {6a3f64d4-864f-42ed-9dd8-30a826e49a5a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320046004500440031003700460037002d0033003000300039002d0034003800440043002d0041003600320036002d003200360030004400420046004500370039003400310035007d000000 {.2.F.E.D.1.7.F.7.-.3.0.0.9.-.4.8.D.C.-.A.6.2.6.-.2.6.0.D.B.F.E.7.9.4.1.5.}... 9223372036854776317 {74988442-3bfb-451c-9a63-9eabb07c4485} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300031003200340036004100430030002d0043003800340039002d0034003100370036002d0042003400330030002d003500440046003000350046004600330041003200370036007d000000 {.0.1.2.4.6.A.C.0.-.C.8.4.9.-.4.1.7.6.-.B.4.3.0.-.5.D.F.0.5.F.F.3.A.2.7.6.}... 9223372036854776318 {5f35226f-d9fa-4d44-8136-27a1c662a034} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00410033004400440044004200360043002d0041003800300043002d0034004300450033002d0039003400420036002d003400320035004500390045004400380037004200390044007d000000 {.A.3.D.D.D.B.6.C.-.A.8.0.C.-.4.C.E.3.-.9.4.B.6.-.4.2.5.E.9.E.D.8.7.B.9.D.}... 9223372036854776319 {ee701874-f029-4ad6-b10b-a96448806f5e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00360030003700390035003700380033002d0037004100340043002d0034003700380035002d0041003100300037002d003600380043003900350036004100330042004500380037007d000000 {.6.0.7.9.5.7.8.3.-.7.A.4.C.-.4.7.8.5.-.A.1.0.7.-.6.8.C.9.5.6.A.3.B.E.8.7.}... 9223372036854776320 {f51c59dd-efbf-4d67-8098-1ed8362db864} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310037004200450034004600360034002d0033004500360031002d0034004200420037002d0039003400450031002d003200330042004500320042003800320038004600330038007d000000 {.1.7.B.E.4.F.6.4.-.3.E.6.1.-.4.B.B.7.-.9.4.E.1.-.2.3.B.E.2.B.8.2.8.F.3.8.}... 9223372036854776321 {4118e8a8-7bc3-4cfa-bc76-b58807f4b331} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300037004500340031004500350039002d0032004100330036002d0034003700300036002d0039003200310041002d003500420038003200410037003900380043004600350042007d000000 {.0.7.E.4.1.E.5.9.-.2.A.3.6.-.4.7.0.6.-.9.2.1.A.-.5.B.8.2.A.7.9.8.C.F.5.B.}... 9223372036854776322 {4cb1e008-1717-41de-b54b-002f7f5ee7ed} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00410041003900420033003900370044002d0030003700360042002d0034003700390042002d0042004600310046002d003500390034003100350044004400430030004300390046007d000000 {.A.A.9.B.3.9.7.D.-.0.7.6.B.-.4.7.9.B.-.B.F.1.F.-.5.9.4.1.5.D.D.C.0.C.9.F.}... 9223372036854776323 {c78cca83-d284-4994-afa2-36f2d141092d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440046003600310037004500420035002d0042003400450044002d0034004500410038002d0039003700420039002d004100360038003300460045004400330035004500350031007d000000 {.D.F.6.1.7.E.B.5.-.B.4.E.D.-.4.E.A.8.-.9.7.B.9.-.A.6.8.3.F.E.D.3.5.E.5.1.}... 9223372036854776324 {3992e37e-b141-4b1e-97c7-91a13aad3f4d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430032003800340030004100430043002d0032003500300034002d0034003300430046002d0038003900460045002d004200380035004500440044003600360034003400320032007d000000 {.C.2.8.4.0.A.C.C.-.2.5.0.4.-.4.3.C.F.-.8.9.F.E.-.B.8.5.E.D.D.6.6.4.4.2.2.}... 9223372036854776325 {05ec7931-2f4c-41be-a2ea-6d51d1bbbece} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00460044003800390030003600430042002d0045004400430033002d0034003500320031002d0038003000370037002d004600330036004600410038004400320038003900410044007d000000 {.F.D.8.9.0.6.C.B.-.E.D.C.3.-.4.5.2.1.-.8.0.7.7.-.F.3.6.F.A.8.D.2.8.9.A.D.}... 9223372036854776326 {99d123c2-3b7b-4ed4-9ec8-db4045ecab9c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00370037003800310044003600460038002d0036003100420046002d0034004500310030002d0042003400310042002d003000350045004200420045003800340036004500390045007d000000 {.7.7.8.1.D.6.F.8.-.6.1.B.F.-.4.E.1.0.-.B.4.1.B.-.0.5.E.B.B.E.8.4.6.E.9.E.}... 9223372036854776327 {f1e8ae28-b94f-4ea4-8146-effcf1aab52d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350037003800340038004300320043002d0044003800310034002d0034003600450036002d0041003500360030002d003000330043003700390035003700330039003400330041007d000000 {.5.7.8.4.8.C.2.C.-.D.8.1.4.-.4.6.E.6.-.A.5.6.0.-.0.3.C.7.9.5.7.3.9.4.3.A.}... 9223372036854776328 {f110ffcf-96c3-4478-bb37-1b945cb78a70} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00370030003400320031004100330042002d0045003900410039002d0034003000360043002d0039003400350036002d003400430044003000380030003300430046003000350041007d000000 {.7.0.4.2.1.A.3.B.-.E.9.A.9.-.4.0.6.C.-.9.4.5.6.-.4.C.D.0.8.0.3.C.F.0.5.A.}... 9223372036854776329 {f981bff2-8c56-445e-8cb7-96a027e9f6b1} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00420041004500300032004400420044002d0032003600420031002d0034004100340037002d0039003200390030002d003400300030003200360043003800380043003900390034007d000000 {.B.A.E.0.2.D.B.D.-.2.6.B.1.-.4.A.4.7.-.9.2.9.0.-.4.0.0.2.6.C.8.8.C.9.9.4.}... 9223372036854776330 {fefb887e-0b75-460c-9c27-d56487aac61a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320033003600390033004600450030002d0031003800380039002d0034003500320044002d0039004600450030002d004100390045004600420030003000390033003700330042007d000000 {.2.3.6.9.3.F.E.0.-.1.8.8.9.-.4.5.2.D.-.9.F.E.0.-.A.9.E.F.B.0.0.9.3.7.3.B.}... 9223372036854776331 {160c36c9-0822-478c-95ee-e5f979416fbb} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350033003200380036004400320043002d0043004400460046002d0034003900450035002d0039004600320039002d004400370043004500450043004100440037003900410036007d000000 {.5.3.2.8.6.D.2.C.-.C.D.F.F.-.4.9.E.5.-.9.F.2.9.-.D.7.C.E.E.C.A.D.7.9.A.6.}... 9223372036854776332 {a005febd-1b7b-4a86-90cc-92d03d4ef881} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440041003700430032004600380033002d0030004200370031002d0034004600300044002d0042004200350030002d003700460039003300390032004200380031003000380032007d000000 {.D.A.7.C.2.F.8.3.-.0.B.7.1.-.4.F.0.D.-.B.B.5.0.-.7.F.9.3.9.2.B.8.1.0.8.2.}... 9223372036854776333 {d1a7f6b9-32b7-43f3-9c54-729684ef4756} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00460037003400360033003500310031002d0039004400300030002d0034004300420045002d0041003300420031002d003900430031004100350031003100360042004100310032007d000000 {.F.7.4.6.3.5.1.1.-.9.D.0.0.-.4.C.B.E.-.A.3.B.1.-.9.C.1.A.5.1.1.6.B.A.1.2.}... 9223372036854776334 {eb407abd-ec36-44d8-8fc6-881762cd0741} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430038004300410039004500310043002d0039003800370038002d0034004100440044002d0038003000450033002d003700420045003700360035003000330041004600340045007d000000 {.C.8.C.A.9.E.1.C.-.9.8.7.8.-.4.A.D.D.-.8.0.E.3.-.7.B.E.7.6.5.0.3.A.F.4.E.}... 9223372036854776335 {f38530b7-9907-4f2e-be76-f1071e6395f0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00340039004600330032003800430042002d0044003500320046002d0034004100340044002d0041003800430032002d003900320036004200440034003600300037003800360038007d000000 {.4.9.F.3.2.8.C.B.-.D.5.2.F.-.4.A.4.D.-.A.8.C.2.-.9.2.6.B.D.4.6.0.7.8.6.8.}... 9223372036854776336 {45f882ef-306e-4e41-bf2b-e06259932b00} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00380031003400440032003200450033002d0046003000440042002d0034003900380034002d0039003800330046002d004200430033003200360039003600420045003000460031007d000000 {.8.1.4.D.2.2.E.3.-.F.0.D.B.-.4.9.8.4.-.9.8.3.F.-.B.C.3.2.6.9.6.B.E.0.F.1.}... 9223372036854776337 {2e30c355-e9ed-49ce-a635-266a4440be9e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440045003400300036003700420035002d0044003000310044002d0034004600370046002d0039003500420039002d004200430041003500360045004100430041004600410041007d000000 {.D.E.4.0.6.7.B.5.-.D.0.1.D.-.4.F.7.F.-.9.5.B.9.-.B.C.A.5.6.E.A.C.A.F.A.A.}... 9223372036854776338 {a5a5784f-7482-4fb0-8f7d-d76ea07b5573} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300035003400460038004100420046002d0039003200330039002d0034003800460032002d0041004300450031002d003000360038003000310030003200420042004100430036007d000000 {.0.5.4.F.8.A.B.F.-.9.2.3.9.-.4.8.F.2.-.A.C.E.1.-.0.6.8.0.1.0.2.B.B.A.C.6.}... 9223372036854776339 {e5c91f00-cb28-4d70-8ef2-9351c595e63e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00420032004300330045003700330045002d0035004400390038002d0034004200330037002d0038004100440032002d004600410036003900300035003400350037003800320045007d000000 {.B.2.C.3.E.7.3.E.-.5.D.9.8.-.4.B.3.7.-.8.A.D.2.-.F.A.6.9.0.5.4.5.7.8.2.E.}... 9223372036854776340 {13e654d8-0311-4b2b-937c-1f01e46ffbb2} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310046003500430043003400460036002d0030004100440042002d0034003200450044002d0042003500430043002d003100350045004200350045004200390030003100430034007d000000 {.1.F.5.C.C.4.F.6.-.0.A.D.B.-.4.2.E.D.-.B.5.C.C.-.1.5.E.B.5.E.B.9.0.1.C.4.}... 9223372036854776341 {df298d75-3e7f-4e8d-8b55-f56b4926c82f} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450034004500330044003300310033002d0038003500450033002d0034004300450030002d0041003100330030002d003500380035004400430039003600370041004400360036007d000000 {.E.4.E.3.D.3.1.3.-.8.5.E.3.-.4.C.E.0.-.A.1.3.0.-.5.8.5.D.C.9.6.7.A.D.6.6.}... 9223372036854776342 {9521e687-22a1-418f-bce2-7eb7fe25070a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00340033003000310042004300350039002d0032004100450045002d0034003500410038002d0039003600340038002d004600360031004200330035003400320030003500320046007d000000 {.4.3.0.1.B.C.5.9.-.2.A.E.E.-.4.5.A.8.-.9.6.4.8.-.F.6.1.B.3.5.4.2.0.5.2.F.}... 9223372036854776343 {db42024e-f9e7-4f03-b4c3-94fb3db7f934} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00390044003600420033003300320041002d0046003500320032002d0034003400430036002d0042003400380044002d003900430043004300340035003200330037003900380036007d000000 {.9.D.6.B.3.3.2.A.-.F.5.2.2.-.4.4.C.6.-.B.4.8.D.-.9.C.C.C.4.5.2.3.7.9.8.6.}... 9223372036854776344 {35f3ec13-352d-4b4d-80e7-0745db50321e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350041003300330032003700430037002d0033003500380035002d0034004600460043002d0039004200390042002d004100380044004400310037004400380031004600380033007d000000 {.5.A.3.3.2.7.C.7.-.3.5.8.5.-.4.F.F.C.-.9.B.9.B.-.A.8.D.D.1.7.D.8.1.F.8.3.}... 9223372036854776345 {0de8b3b5-a43a-4651-9397-f7a2a5c86ec6} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00360038003900310046003600460036002d0032003500320035002d0034004600420032002d0039003300330045002d003900450046003000370046003300380033003300350044007d000000 {.6.8.9.1.F.6.F.6.-.2.5.2.5.-.4.F.B.2.-.9.3.3.E.-.9.E.F.0.7.F.3.8.3.3.5.D.}... 9223372036854776346 {23729a28-9e77-4000-a175-0d3ace63d138} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00330034003800390034003600390032002d0036003500380031002d0034003500440035002d0041004200450044002d003000440036003400350039003500360032004400320041007d000000 {.3.4.8.9.4.6.9.2.-.6.5.8.1.-.4.5.D.5.-.A.B.E.D.-.0.D.6.4.5.9.5.6.2.D.2.A.}... 9223372036854776347 {1588f8a1-b166-48f6-bef3-a2918b2b4b2e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440036004200430039003000420046002d0035004400340043002d0034003200420038002d0042004200380031002d004400330030004200350045003500390033003300300043007d000000 {.D.6.B.C.9.0.B.F.-.5.D.4.C.-.4.2.B.8.-.B.B.8.1.-.D.3.0.B.5.E.5.9.3.3.0.C.}... 9223372036854776348 {eeefb14f-6d56-4ad8-9a0d-6906e0f27143} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00370036003900310046003900420034002d0031004400310031002d0034003900360030002d0038003800310045002d003400320030003100440045003100330031004100340034007d000000 {.7.6.9.1.F.9.B.4.-.1.D.1.1.-.4.9.6.0.-.8.8.1.E.-.4.2.0.1.D.E.1.3.1.A.4.4.}... 9223372036854776349 {ef018b97-7b72-4cdb-8f9e-6cda465099ad} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320042003100440036003200350045002d0041004500350039002d0034004300430037002d0039003500300044002d004200320035004400340046004600340043004100370039007d000000 {.2.B.1.D.6.2.5.E.-.A.E.5.9.-.4.C.C.7.-.9.5.0.D.-.B.2.5.D.4.F.F.4.C.A.7.9.}... 9223372036854776350 {70e5215e-c496-4954-a024-485e29f64ed1} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320030004400330039003200300030002d0034004600330044002d0034004300330037002d0039004500370035002d004600370037003400310032004500430045003900300036007d000000 {.2.0.D.3.9.2.0.0.-.4.F.3.D.-.4.C.3.7.-.9.E.7.5.-.F.7.7.4.1.2.E.C.E.9.0.6.}... 9223372036854776351 {57ca4bf8-eb85-4596-b0f5-93f3f457c9da} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00340031003500440041003600430045002d0035004500390041002d0034003400360032002d0039004100310046002d004400370039004600340037003700460031003900410035007d000000 {.4.1.5.D.A.6.C.E.-.5.E.9.A.-.4.4.6.2.-.9.A.1.F.-.D.7.9.F.4.7.7.F.1.9.A.5.}... 9223372036854776352 {4b3fce1f-7c65-4f21-9cb6-12610863dc49} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440037004100460035003800320034002d0042003100430044002d0034004300360037002d0042003100440033002d003800350044003500330038003800310041004100340039007d000000 {.D.7.A.F.5.8.2.4.-.B.1.C.D.-.4.C.6.7.-.B.1.D.3.-.8.5.D.5.3.8.8.1.A.A.4.9.}... 9223372036854776353 {a0789b38-a6a5-44c8-aee7-cb273954a2c0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430035003500330035004200370043002d0031003900390044002d0034003000380032002d0041003100380034002d004400430030003300350043003300430035003800390038007d000000 {.C.5.5.3.5.B.7.C.-.1.9.9.D.-.4.0.8.2.-.A.1.8.4.-.D.C.0.3.5.C.3.C.5.8.9.8.}... 9223372036854776354 {7954653e-00d4-493b-bf75-a7df7811caca} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00330032003000320037004200410041002d0046004400420044002d0034003200330030002d0041003900450035002d004100460034004600330037003200410037003400350042007d000000 {.3.2.0.2.7.B.A.A.-.F.D.B.D.-.4.2.3.0.-.A.9.E.5.-.A.F.4.F.3.7.2.A.7.4.5.B.}... 9223372036854776355 {986ffd0c-9682-4e34-93ee-18282e6fc7e4} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00410043003200410042003000430045002d0045004400390036002d0034003500350041002d0039003100430035002d003100440039004200430046004100330043003100380037007d000000 {.A.C.2.A.B.0.C.E.-.E.D.9.6.-.4.5.5.A.-.9.1.C.5.-.1.D.9.B.C.F.A.3.C.1.8.7.}... 9223372036854776356 {c4a200b8-5ef7-4b22-990c-3de8576a89c2} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00460042003400320039004600380038002d0039003400340039002d0034004300440046002d0041003600390032002d003700450034003800440035003200450045004500460041007d000000 {.F.B.4.2.9.F.8.8.-.9.4.4.9.-.4.C.D.F.-.A.6.9.2.-.7.E.4.8.D.5.2.E.E.E.F.A.}... 9223372036854776357 {5504179a-041a-4796-902c-9d29d6461739} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350037003300300032004100430032002d0036003000460039002d0034003700410034002d0038003400330035002d004600420041004600450030003800300036004400320041007d000000 {.5.7.3.0.2.A.C.2.-.6.0.F.9.-.4.7.A.4.-.8.4.3.5.-.F.B.A.F.E.0.8.0.6.D.2.A.}... 9223372036854776358 {f8a49d92-f357-4994-8b2a-a3cbed9d995b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00420039003900340034004300370046002d0037003100390030002d0034004300340045002d0041004100380046002d004400370033003600460034004200370042003900340041007d000000 {.B.9.9.4.4.C.7.F.-.7.1.9.0.-.4.C.4.E.-.A.A.8.F.-.D.7.3.6.F.4.B.7.B.9.4.A.}... 9223372036854776359 {ccee2909-294e-4ad6-b0ef-fa93cdf3d2b5} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00340045003100450038003500330036002d0046004600450037002d0034003200420039002d0042003500340035002d003900380030004400330045003200300030003700300044007d000000 {.4.E.1.E.8.5.3.6.-.F.F.E.7.-.4.2.B.9.-.B.5.4.5.-.9.8.0.D.3.E.2.0.0.7.0.D.}... 9223372036854776360 {3aaefe3a-4f84-40da-a38a-319c198ac067} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00380042003100390046003900440034002d0033004200460045002d0034003900300030002d0041004200430033002d004400410039003100380037003600410044003400320043007d000000 {.8.B.1.9.F.9.D.4.-.3.B.F.E.-.4.9.0.0.-.A.B.C.3.-.D.A.9.1.8.7.6.A.D.4.2.C.}... 9223372036854776361 {2fceaed8-43de-431e-9e1c-248e4f8f43e1} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320041004400370033004500310035002d0041004400380041002d0034004500310037002d0042004200450030002d004200420038003200450039003600360046003900360045007d000000 {.2.A.D.7.3.E.1.5.-.A.D.8.A.-.4.E.1.7.-.B.B.E.0.-.B.B.8.2.E.9.6.6.F.9.6.E.}... 9223372036854776362 {a2ddf546-d32c-4a74-b522-12c269bee88f} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00390035003500410034003800350041002d0039004600300036002d0034004100360043002d0041003900360044002d004100330042003500430046003600390046004200350042007d000000 {.9.5.5.A.4.8.5.A.-.9.F.0.6.-.4.A.6.C.-.A.9.6.D.-.A.3.B.5.C.F.6.9.F.B.5.B.}... 9223372036854776363 {8852c503-6be2-4850-b366-41a3600b3c14} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00370043003100330033003900300038002d0030003500330045002d0034003800350039002d0039004400360034002d004600300031003300440031004100410035003600300036007d000000 {.7.C.1.3.3.9.0.8.-.0.5.3.E.-.4.8.5.9.-.9.D.6.4.-.F.0.1.3.D.1.A.A.5.6.0.6.}... 9223372036854776364 {d02a7aa2-6454-4fd6-82fb-b198cef82a49} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430043003100410039004200390046002d0046004200420033002d0034003300300045002d0039004200350033002d004300380039003800420035003400380039003100430036007d000000 {.C.C.1.A.9.B.9.F.-.F.B.B.3.-.4.3.0.E.-.9.B.5.3.-.C.8.9.8.B.5.4.8.9.1.C.6.}... 9223372036854776365 {577bdf7b-b66e-4aa7-8c1e-0056a2312d4d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00360032003500340043003500440044002d0036004600430039002d0034003900460030002d0038004300350039002d003400350030004200440033004600320039003100390038007d000000 {.6.2.5.4.C.5.D.D.-.6.F.C.9.-.4.9.F.0.-.8.C.5.9.-.4.5.0.B.D.3.F.2.9.1.9.8.}... 9223372036854776366 {e972b787-cefb-4018-8a07-cb56fb335d05} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440043004200370044003300310041002d0043003600440030002d0034004500340037002d0042003300380034002d003200460039003400430030003400440030003300360034007d000000 {.D.C.B.7.D.3.1.A.-.C.6.D.0.-.4.E.4.7.-.B.3.8.4.-.2.F.9.4.C.0.4.D.0.3.6.4.}... 9223372036854776367 {a1c1ada8-14c5-436e-a4c1-9ed9a31cf907} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430037004200320036004100450043002d0038003800440044002d0034004300390030002d0039003100310043002d004100410037003500350031003500440039003600360041007d000000 {.C.7.B.2.6.A.E.C.-.8.8.D.D.-.4.C.9.0.-.9.1.1.C.-.A.A.7.5.5.1.5.D.9.6.6.A.}... 9223372036854776368 {000023c2-38de-4459-b661-d03163e40e3a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00360046004400350033003700420035002d0036004300330031002d0034003500380042002d0038003900310033002d003400440042004100440041003700430030003000340030007d000000 {.6.F.D.5.3.7.B.5.-.6.C.3.1.-.4.5.8.B.-.8.9.1.3.-.4.D.B.A.D.A.7.C.0.0.4.0.}... 9223372036854776369 {98008b68-29a7-4a99-ab26-95244c6f3f54} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320037003400320035004500360031002d0031003600450037002d0034003400370030002d0038004600410042002d003600440041004400430041004600320038003000380035007d000000 {.2.7.4.2.5.E.6.1.-.1.6.E.7.-.4.4.7.0.-.8.F.A.B.-.6.D.A.D.C.A.F.2.8.0.8.5.}... 9223372036854776370 {43241563-341c-4081-a5c8-5936cf234f41} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450030004400420037003000330041002d0036003800410045002d0034003200410045002d0042004600410035002d003200390036003400390039004200300033004200450031007d000000 {.E.0.D.B.7.0.3.A.-.6.8.A.E.-.4.2.A.E.-.B.F.A.5.-.2.9.6.4.9.9.B.0.3.B.E.1.}... 9223372036854776371 {447f6038-491e-4529-bc1e-a587cba618a3} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450041003900330032004500410041002d0036004300460043002d0034003200390042002d0042003700320035002d003000370044004100440033004400330035003000450044007d000000 {.E.A.9.3.2.E.A.A.-.6.C.F.C.-.4.2.9.B.-.B.7.2.5.-.0.7.D.A.D.3.D.3.5.0.E.D.}... 9223372036854776372 {5c41bff6-8bf5-48af-b42e-3b913be0d81f} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350031004200450041003600460041002d0042004400350033002d0034003200350038002d0041003600420035002d003500430044003400410044003300300031004600310033007d000000 {.5.1.B.E.A.6.F.A.-.B.D.5.3.-.4.2.5.8.-.A.6.B.5.-.5.C.D.4.A.D.3.0.1.F.1.3.}... 9223372036854776373 {978930af-c0d6-4296-ae53-cabba5589a56} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440035003500360034004100350046002d0039003800320038002d0034003600360031002d0039004600430043002d004200460045003200320039003200460043003300370033007d000000 {.D.5.5.6.4.A.5.F.-.9.8.2.8.-.4.6.6.1.-.9.F.C.C.-.B.F.E.2.2.9.2.F.C.3.7.3.}... 9223372036854776374 {848b440e-9599-4a74-b7d7-e85f5eabbee0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00330035003700410044004300300030002d0041003400450044002d0034004200370035002d0039003500460033002d003700410030003600370035004600440036003800320045007d000000 {.3.5.7.A.D.C.0.0.-.A.4.E.D.-.4.B.7.5.-.9.5.F.3.-.7.A.0.6.7.5.F.D.6.8.2.E.}... 9223372036854776375 {074dbf65-e26f-4e48-bcf6-2e6308011093} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00390045003900320033003700390041002d0031004600370044002d0034003400430044002d0042004400380046002d004400450041003400300033003600360031003000330045007d000000 {.9.E.9.2.3.7.9.A.-.1.F.7.D.-.4.4.C.D.-.B.D.8.F.-.D.E.A.4.0.3.6.6.1.0.3.E.}... 9223372036854776376 {8ebcef68-f34d-4139-8b85-7b57334b9329} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310037003100350031003900310046002d0035003100450038002d0034003900320046002d0038003800460044002d004500440043003000330044003500370045004600370042007d000000 {.1.7.1.5.1.9.1.F.-.5.1.E.8.-.4.9.2.F.-.8.8.F.D.-.E.D.C.0.3.D.5.7.E.F.7.B.}... 9223372036854776377 {152c9c3b-b07e-486e-a750-7d561d75f843} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450043003600410039003600330039002d0035003300360035002d0034003600430041002d0042004400460042002d004500350041004100300039003300420035004200460045007d000000 {.E.C.6.A.9.6.3.9.-.5.3.6.5.-.4.6.C.A.-.B.D.F.B.-.E.5.A.A.0.9.3.B.5.B.F.E.}... 9223372036854776378 {4c37bb57-9bdf-4ab2-891f-cccdbc2b0d0c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440041003600320046003000300041002d0041003000350034002d0034004600420032002d0038004600370033002d003100370031004100370034003900360045003500360036007d000000 {.D.A.6.2.F.0.0.A.-.A.0.5.4.-.4.F.B.2.-.8.F.7.3.-.1.7.1.A.7.4.9.6.E.5.6.6.}... 9223372036854776379 {6f3f53ac-3323-445c-9236-0794fb401551} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440042004300410038003200380035002d0035003400330042002d0034003000330035002d0042003900330035002d004200390039004500320033003100350037003500360031007d000000 {.D.B.C.A.8.2.8.5.-.5.4.3.B.-.4.0.3.5.-.B.9.3.5.-.B.9.9.E.2.3.1.5.7.5.6.1.}... 9223372036854776380 {02438bea-ea89-467b-95c8-818ba1d1c792} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300039003200340033003100330033002d0033004400350041002d0034004500340034002d0041003800310041002d003700440030003100330034004300300031003800440030007d000000 {.0.9.2.4.3.1.3.3.-.3.D.5.A.-.4.E.4.4.-.A.8.1.A.-.7.D.0.1.3.4.C.0.1.8.D.0.}... 9223372036854776381 {86b5cc90-9f68-470a-b4ea-a0649192dc04} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00330033003100430046004600440038002d0046003100320041002d0034004200410044002d0041004200410043002d004100410039004100300035003500460041003800370037007d000000 {.3.3.1.C.F.F.D.8.-.F.1.2.A.-.4.B.A.D.-.A.B.A.C.-.A.A.9.A.0.5.5.F.A.8.7.7.}... 9223372036854776382 {c7e71c4d-4300-492f-9531-78b23a4270af} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00340034003100360030004200370037002d0042003100340043002d0034003100380042002d0041004600420037002d003500350034004200330032003900420034003600310041007d000000 {.4.4.1.6.0.B.7.7.-.B.1.4.C.-.4.1.8.B.-.A.F.B.7.-.5.5.4.B.3.2.9.B.4.6.1.A.}... 9223372036854776383 {ba1eb0dc-09b8-4985-9a99-40696b5eb363} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300038004600420044003100370037002d0046003100330033002d0034003500390036002d0042003800380037002d003200430042004600420042003900440044003300420032007d000000 {.0.8.F.B.D.1.7.7.-.F.1.3.3.-.4.5.9.6.-.B.8.8.7.-.2.C.B.F.B.B.9.D.D.3.B.2.}... 9223372036854776384 {bdfe501c-4d70-448d-939f-01ee41bd1d51} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440039004100370033003800330034002d0038004100310037002d0034004400370043002d0042003600460034002d003500330038004300350032003000450033004100440036007d000000 {.D.9.A.7.3.8.3.4.-.8.A.1.7.-.4.D.7.C.-.B.6.F.4.-.5.3.8.C.5.2.0.E.3.A.D.6.}... 9223372036854776385 {84f429fe-9e92-4f64-9e85-1638507af4bb} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430042004300370037003300320035002d0044003300420032002d0034003300350032002d0039004300380043002d004300350034003300330036003800460032003100330030007d000000 {.C.B.C.7.7.3.2.5.-.D.3.B.2.-.4.3.5.2.-.9.C.8.C.-.C.5.4.3.3.6.8.F.2.1.3.0.}... 9223372036854776386 {c517f12a-4314-4b91-a3e3-cffa9ba1151c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00360032004300430045004500330042002d0035003800300030002d0034004500430036002d0038003200450041002d003700330035003300330030004400320033004100370041007d000000 {.6.2.C.C.E.E.3.B.-.5.8.0.0.-.4.E.C.6.-.8.2.E.A.-.7.3.5.3.3.0.D.2.3.A.7.A.}... 9223372036854776387 {4e4daac0-5ff3-4fd0-b89b-8515c76d2b39} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350035004100360038003800460033002d0037004300410032002d0034004300330038002d0042004600300035002d004200350035004300340042003900390041004500330030007d000000 {.5.5.A.6.8.8.F.3.-.7.C.A.2.-.4.C.3.8.-.B.F.0.5.-.B.5.5.C.4.B.9.9.A.E.3.0.}... 9223372036854776388 {2cbac533-c29f-4914-9c3d-39c8c547a017} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440038003800330041003700450039002d0037003600420031002d0034003000350041002d0042003900380034002d003800430033003600360032003200450033004600310036007d000000 {.D.8.8.3.A.7.E.9.-.7.6.B.1.-.4.0.5.A.-.B.9.8.4.-.8.C.3.6.6.2.2.E.3.F.1.6.}... 9223372036854776389 {b09b0efc-578d-48b1-ab44-ad43ae7e0180} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300042004200300036003800340038002d0031004100450035002d0034004600310041002d0042003100310041002d004500380030003600360035003900420041003900370037007d000000 {.0.B.B.0.6.8.4.8.-.1.A.E.5.-.4.F.1.A.-.B.1.1.A.-.E.8.0.6.6.5.9.B.A.9.7.7.}... 9223372036854776390 {df4b6bcf-364f-4b59-be2e-708a2cf34736} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440032003200380042003800430043002d0037003700320043002d0034003000420046002d0041004100460046002d003700370042003600360031003500450039003300310033007d000000 {.D.2.2.8.B.8.C.C.-.7.7.2.C.-.4.0.B.F.-.A.A.F.F.-.7.7.B.6.6.1.5.E.9.3.1.3.}... 9223372036854776391 {f1e8ead7-7365-4b62-98e0-07d8c7a70f69} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440032003400340033003300320041002d0038003100320044002d0034004600350045002d0039004300390045002d004400330035004500300032003100300044003900450034007d000000 {.D.2.4.4.3.3.2.A.-.8.1.2.D.-.4.F.5.E.-.9.C.9.E.-.D.3.5.E.0.2.1.0.D.9.E.4.}... 9223372036854776392 {54c215ee-3737-4395-b870-3c39a92d6e14} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00380034003900460036003100310038002d0037003000430038002d0034003100370036002d0039004300450033002d004100390037003600320042004100300034003500460034007d000000 {.8.4.9.F.6.1.1.8.-.7.0.C.8.-.4.1.7.6.-.9.C.E.3.-.A.9.7.6.2.B.A.0.4.5.F.4.}... 9223372036854776393 {dc9e7dac-335e-4ac9-86c7-4ec827dfa623} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00360039003000390044004400360038002d0030004200390034002d0034003400330038002d0042003200450034002d003000450043003000450043003500340039004400430035007d000000 {.6.9.0.9.D.D.6.8.-.0.B.9.4.-.4.4.3.8.-.B.2.E.4.-.0.E.C.0.E.C.5.4.9.D.C.5.}... 9223372036854776394 {e34c6afe-4306-4659-93f3-4d97ec7172c6} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00410046004500320030003100380033002d0035003900310031002d0034003900380042002d0038004200320030002d003500420031004100440032003400430044003200330031007d000000 {.A.F.E.2.0.1.8.3.-.5.9.1.1.-.4.9.8.B.-.8.B.2.0.-.5.B.1.A.D.2.4.C.D.2.3.1.}... 9223372036854776395 {f2910211-63cc-46f9-b8e7-cd75d195b804} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00330038004300450046003000410033002d0039004100310032002d0034004400310042002d0042003400430046002d003200460043003300330041003500350031003500380046007d000000 {.3.8.C.E.F.0.A.3.-.9.A.1.2.-.4.D.1.B.-.B.4.C.F.-.2.F.C.3.3.A.5.5.1.5.8.F.}... 9223372036854776396 {34d3c4b0-f3dd-408d-8f06-aef15eb33e99} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300039003000310043004600320035002d0031003600430030002d0034004200360034002d0039003000390032002d003000390039003400370034004300350044003000450042007d000000 {.0.9.0.1.C.F.2.5.-.1.6.C.0.-.4.B.6.4.-.9.0.9.2.-.0.9.9.4.7.4.C.5.D.0.E.B.}... 9223372036854776397 {6256af2d-05dd-4bbd-81b0-b65cf3505cc7} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350035003600300039003000390031002d0033004600350043002d0034003500410031002d0041004600420038002d004500340032003300460046003700350043004200300035007d000000 {.5.5.6.0.9.0.9.1.-.3.F.5.C.-.4.5.A.1.-.A.F.B.8.-.E.4.2.3.F.F.7.5.C.B.0.5.}... 9223372036854776398 {b656da4a-de0d-4d0e-8f93-4273211ec8de} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300032004400390038003000390036002d0039004100380031002d0034004600370034002d0042003900310046002d004600300042004400450030004400430034003100460041007d000000 {.0.2.D.9.8.0.9.6.-.9.A.8.1.-.4.F.7.4.-.B.9.1.F.-.F.0.B.D.E.0.D.C.4.1.F.A.}... 9223372036854776399 {db9854c8-9f5a-4731-a881-ac02fa59715d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00360032003500460030003500450038002d0045003000360046002d0034003500460035002d0042003300380036002d003700330044003000430043003500320034004100440041007d000000 {.6.2.5.F.0.5.E.8.-.E.0.6.F.-.4.5.F.5.-.B.3.8.6.-.7.3.D.0.C.C.5.2.4.A.D.A.}... 9223372036854776400 {278afac0-96f3-483f-b065-daf09e88e006} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00380030003000460046003400330045002d0035004400320030002d0034004100320034002d0041003600450045002d003000450033004200320035003600320038003600310030007d000000 {.8.0.0.F.F.4.3.E.-.5.D.2.0.-.4.A.2.4.-.A.6.E.E.-.0.E.3.B.2.5.6.2.8.6.1.0.}... 9223372036854776401 {83ff194c-2394-4712-bf17-d5ec5c46f605} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300032003100390031003700360042002d0037004300340030002d0034003400320043002d0042003000370033002d003400450045003600450042004300300032004100300043007d000000 {.0.2.1.9.1.7.6.B.-.7.C.4.0.-.4.4.2.C.-.B.0.7.3.-.4.E.E.6.E.B.C.0.2.A.0.C.}... 9223372036854776402 {d44012ee-bfc1-40ec-8efe-d82a7572b0f4} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00410037004100310046003400340031002d0030003800360031002d0034003500320036002d0041004300310039002d004300300045004600410039003100330033003300430034007d000000 {.A.7.A.1.F.4.4.1.-.0.8.6.1.-.4.5.2.6.-.A.C.1.9.-.C.0.E.F.A.9.1.3.3.3.C.4.}... 9223372036854776403 {6cc13dd8-dd41-4153-9f2c-b73d772dbef3} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300030003600360030003200300039002d0039003000340039002d0034004300450033002d0038003100450030002d004200320039004300300031004400310035003900460043007d000000 {.0.0.6.6.0.2.0.9.-.9.0.4.9.-.4.C.E.3.-.8.1.E.0.-.B.2.9.C.0.1.D.1.5.9.F.C.}... 9223372036854776404 {ff24c069-f535-479a-8c11-f081dd0ac319} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320033003600450033003900320033002d0039003200320032002d0034003000330035002d0038003500410046002d003100390031003100410035004200380042003900340035007d000000 {.2.3.6.E.3.9.2.3.-.9.2.2.2.-.4.0.3.5.-.8.5.A.F.-.1.9.1.1.A.5.B.8.B.9.4.5.}... 9223372036854776405 {4d5c2e53-a292-49ca-a085-a5576bb43cbf} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310031004600430030003200420045002d0030004100410037002d0034003300330043002d0041003700430033002d004500310046004100360037004200340046004300410034007d000000 {.1.1.F.C.0.2.B.E.-.0.A.A.7.-.4.3.3.C.-.A.7.C.3.-.E.1.F.A.6.7.B.4.F.C.A.4.}... 9223372036854776406 {10fff4e2-b1f1-4ad9-8621-d8312897f70d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00370035003500380031004100380039002d0030003600300032002d0034004300380044002d0038003000310030002d003600440044003300340036003100440035003500330045007d000000 {.7.5.5.8.1.A.8.9.-.0.6.0.2.-.4.C.8.D.-.8.0.1.0.-.6.D.D.3.4.6.1.D.5.5.3.E.}... 9223372036854776407 {368c1f37-db34-4e36-ae3e-1a894777a379} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440043004600330045003900310032002d0036003600390035002d0034004100430039002d0038004100430039002d003700390033003300340038003200430039003400330037007d000000 {.D.C.F.3.E.9.1.2.-.6.6.9.5.-.4.A.C.9.-.8.A.C.9.-.7.9.3.3.4.8.2.C.9.4.3.7.}... 9223372036854776408 {488dae1d-fa1e-404f-a365-32b5f9a97209} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430033003600420031003000370036002d0034003700450043002d0034004200450045002d0039003500300037002d004500300035004500330041003400360036004300340045007d000000 {.C.3.6.B.1.0.7.6.-.4.7.E.C.-.4.B.E.E.-.9.5.0.7.-.E.0.5.E.3.A.4.6.6.C.4.E.}... 9223372036854776411 {6f8faa8d-e741-4380-a25e-079570bee209} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430038003300330037003200310044002d0039003500300034002d0034004400310041002d0039003900340042002d004500360036003300380043004200320041003500370045007d000000 {.C.8.3.3.7.2.1.D.-.9.5.0.4.-.4.D.1.A.-.9.9.4.B.-.E.6.6.3.8.C.B.2.A.5.7.E.}... 9223372036854776412 {7252f45c-99e4-4b10-a885-6e89864ddbdf} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440030004400460045003600420034002d0037003700350042002d0034003200360037002d0041003300340035002d003700390033004300440034003300340043003900410041007d000000 {.D.0.D.F.E.6.B.4.-.7.7.5.B.-.4.2.6.7.-.A.3.4.5.-.7.9.3.C.D.4.3.4.C.9.A.A.}... 9223372036854776413 {cc263db7-a803-4ddc-915b-c28786aa1106} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430042003200430043004500370033002d0033003300380045002d0034003400410045002d0038003600350044002d003100370039003400420041004100460039003300430044007d000000 {.C.B.2.C.C.E.7.3.-.3.3.8.E.-.4.4.A.E.-.8.6.5.D.-.1.7.9.4.B.A.A.F.9.3.C.D.}... 9223372036854776414 {41d435c4-374c-4379-81c5-e77b5ac3b000} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00340034004500450037003200430034002d0032003300450035002d0034004100340030002d0042003900340033002d003900310044004300450036003000310043003600420045007d000000 {.4.4.E.E.7.2.C.4.-.2.3.E.5.-.4.A.4.0.-.B.9.4.3.-.9.1.D.C.E.6.0.1.C.6.B.E.}... 9223372036854776415 {61b04769-24ce-41d7-a0db-551604ba286c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300046003800460043003500310032002d0038003100410034002d0034003600410038002d0039003300390036002d004400440041004500420036004300350046004200370034007d000000 {.0.F.8.F.C.5.1.2.-.8.1.A.4.-.4.6.A.8.-.9.3.9.6.-.D.D.A.E.B.6.C.5.F.B.7.4.}... 9223372036854776416 {ea99112d-7c47-468c-97a2-0f8d8b8d9434} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00420038004300450030003900440031002d0044003800390033002d0034003200340042002d0039003500370045002d003900360030004600350035004400460036003400370041007d000000 {.B.8.C.E.0.9.D.1.-.D.8.9.3.-.4.2.4.B.-.9.5.7.E.-.9.6.0.F.5.5.D.F.6.4.7.A.}... 9223372036854776417 {cce03e11-69e7-4526-b635-6c4d3d4d9e60} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320045003000320042003700450034002d0034004300320038002d0034004300460045002d0038003000360036002d003600350039003800440046003400410039003700300041007d000000 {.2.E.0.2.B.7.E.4.-.4.C.2.8.-.4.C.F.E.-.8.0.6.6.-.6.5.9.8.D.F.4.A.9.7.0.A.}... 9223372036854776418 {9e93f20a-fa57-4f9e-a74e-b92fb120b2cd} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350035003100350042004500420044002d0031003600430043002d0034003800420037002d0042003500430044002d003000440036003200320038003900360035004300380032007d000000 {.5.5.1.5.B.E.B.D.-.1.6.C.C.-.4.8.B.7.-.B.5.C.D.-.0.D.6.2.2.8.9.6.5.C.8.2.}... 9223372036854776419 {d7494c94-88e8-4e5e-9a7a-b5ceda82fff6} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430034003600380031003400350034002d0036004200330038002d0034003700360037002d0038003500440045002d004600340037004400420039004500310046004600310039007d000000 {.C.4.6.8.1.4.5.4.-.6.B.3.8.-.4.7.6.7.-.8.5.D.E.-.F.4.7.D.B.9.E.1.F.F.1.9.}... 9223372036854776420 {39b3a2c0-9c09-4442-b2f2-43214a54b45a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450035004600460033003900460030002d0045004100370032002d0034003300440031002d0042004100410044002d003500390031003700330039004300330043003300380039007d000000 {.E.5.F.F.3.9.F.0.-.E.A.7.2.-.4.3.D.1.-.B.A.A.D.-.5.9.1.7.3.9.C.3.C.3.8.9.}... 9223372036854776421 {2baa143c-6dbe-49e8-9267-5cc0059ed12d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350044004600460036004500300030002d0044003800310041002d0034004300460035002d0041003300410034002d003800320045003600360033003600380036004100360041007d000000 {.5.D.F.F.6.E.0.0.-.D.8.1.A.-.4.C.F.5.-.A.3.A.4.-.8.2.E.6.6.3.6.8.6.A.6.A.}... 9223372036854776422 {26af65c1-8005-4cf0-ada0-9aa571a1365e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00380035003200380031004100330031002d0034004100420033002d0034003100310032002d0039004100390037002d004300430038003700390045003900430044003500440039007d000000 {.8.5.2.8.1.A.3.1.-.4.A.B.3.-.4.1.1.2.-.9.A.9.7.-.C.C.8.7.9.E.9.C.D.5.D.9.}... 9223372036854776423 {ea23c737-f8b8-4a7d-ab55-3396e8d029f2} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440043003500430044003200380046002d0039004300350044002d0034004300300042002d0041003100370043002d003100300045003800390030004200450037004100390043007d000000 {.D.C.5.C.D.2.8.F.-.9.C.5.D.-.4.C.0.B.-.A.1.7.C.-.1.0.E.8.9.0.B.E.7.A.9.C.}... 9223372036854776424 {bff5e1d1-5465-49b3-b3c6-c812334ae432} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00370039004200450034003500330045002d0031003300340031002d0034004200320045002d0039003000460031002d004300370044003300300033003500350038003900450041007d000000 {.7.9.B.E.4.5.3.E.-.1.3.4.1.-.4.B.2.E.-.9.0.F.1.-.C.7.D.3.0.3.5.5.8.9.E.A.}... 9223372036854776425 {a7a81b7f-2287-4d4a-b34e-eafa46a56fed} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00410036004200430039004300340030002d0034003400390041002d0034003100340043002d0038003200310038002d003700390042004100330044004200410038003000390043007d000000 {.A.6.B.C.9.C.4.0.-.4.4.9.A.-.4.1.4.C.-.8.2.1.8.-.7.9.B.A.3.D.B.A.8.0.9.C.}... 9223372036854776426 {0dfc39e6-df49-4ff4-ad33-a67704cd209b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00410041003400310039004300440038002d0033003800440030002d0034003800390036002d0039004200350030002d003100350046003600300037003700440032003600370032007d000000 {.A.A.4.1.9.C.D.8.-.3.8.D.0.-.4.8.9.6.-.9.B.5.0.-.1.5.F.6.0.7.7.D.2.6.7.2.}... 9223372036854776427 {e014bc02-d4a9-413d-8213-199172a7df9e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00330043003900350045003100460041002d0046004400370038002d0034004400320042002d0038004200430041002d003000420045004400420038004500460035003300350034007d000000 {.3.C.9.5.E.1.F.A.-.F.D.7.8.-.4.D.2.B.-.8.B.C.A.-.0.B.E.D.B.8.E.F.5.3.5.4.}... 9223372036854776428 {21f5906e-61ef-4d15-87b2-89f4786ec5d0} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300036003800450035004300340033002d0042003800390042002d0034003200350041002d0039003700430039002d003300310036003100390041003300410038004400440030007d000000 {.0.6.8.E.5.C.4.3.-.B.8.9.B.-.4.2.5.A.-.9.7.C.9.-.3.1.6.1.9.A.3.A.8.D.D.0.}... 9223372036854776429 {a6088cfc-cd47-4787-b825-f9182c0e5bfe} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00380044003000430035004600310043002d0033003400440032002d0034003700450046002d0042004200340043002d003500330043004400350046003000300031003900310045007d000000 {.8.D.0.C.5.F.1.C.-.3.4.D.2.-.4.7.E.F.-.B.B.4.C.-.5.3.C.D.5.F.0.0.1.9.1.E.}... 9223372036854776430 {816e87d6-82f6-4a64-8f51-5ce17e19ce41} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350042003000460030004500440045002d0031003000430046002d0034003900440036002d0041003300440033002d003800360036004300320031003800420038003400300046007d000000 {.5.B.0.F.0.E.D.E.-.1.0.C.F.-.4.9.D.6.-.A.3.D.3.-.8.6.6.C.2.1.8.B.8.4.0.F.}... 9223372036854776431 {ddb485c7-523d-473e-aa7c-006050a20609} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00460039003000410039003400460044002d0038003700390045002d0034004100380035002d0041003200300036002d004400320037004600360034003000330039003200350038007d000000 {.F.9.0.A.9.4.F.D.-.8.7.9.E.-.4.A.8.5.-.A.2.0.6.-.D.2.7.F.6.4.0.3.9.2.5.8.}... 9223372036854776432 {aab2b3fd-6d4d-4a30-8f5d-4562010bd49e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00420032003800410046003000450035002d0044003000420037002d0034003800420036002d0039004500300030002d003300430031003100320030004600430043004300460034007d000000 {.B.2.8.A.F.0.E.5.-.D.0.B.7.-.4.8.B.6.-.9.E.0.0.-.3.C.1.1.2.0.F.C.C.C.F.4.}... 9223372036854776433 {5f3612b3-d154-4a81-a87f-9812b69d879f} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320034003100380043004400430037002d0033003100410036002d0034003400310044002d0038004500390034002d003200430030003800310033003300430034003500340041007d000000 {.2.4.1.8.C.D.C.7.-.3.1.A.6.-.4.4.1.D.-.8.E.9.4.-.2.C.0.8.1.3.3.C.4.5.4.A.}... 9223372036854776434 {abb7f935-dc63-46d8-b66c-f0cc5c1e5280} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00390033004200440033004100370031002d0031003000320036002d0034003600450031002d0041004100320032002d003700360030004100460035003500430038004200320034007d000000 {.9.3.B.D.3.A.7.1.-.1.0.2.6.-.4.6.E.1.-.A.A.2.2.-.7.6.0.A.F.5.5.C.8.B.2.4.}... 9223372036854776435 {54883c72-078c-4ac9-ba34-a84418454eca} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310046003100300039004300340033002d0035003900310038002d0034004600460043002d0039003600410030002d004600310039003900450033003500420043003200410032007d000000 {.1.F.1.0.9.C.4.3.-.5.9.1.8.-.4.F.F.C.-.9.6.A.0.-.F.1.9.9.E.3.5.B.C.2.A.2.}... 9223372036854776436 {70e256b2-922a-432a-9f93-0da28403e285} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310037004200340039003100450032002d0042004600310034002d0034004100380033002d0042003300450037002d004300390039004200390044003700390039003800340036007d000000 {.1.7.B.4.9.1.E.2.-.B.F.1.4.-.4.A.8.3.-.B.3.E.7.-.C.9.9.B.9.D.7.9.9.8.4.6.}... 9223372036854776439 {768024ef-bdcf-4652-87ba-6bab3d4c5188} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450039004500420045003000310038002d0041003000300034002d0034004100320030002d0039003400450036002d003500350036004600450030003400440038003600340044007d000000 {.E.9.E.B.E.0.1.8.-.A.0.0.4.-.4.A.2.0.-.9.4.E.6.-.5.5.6.F.E.0.4.D.8.6.4.D.}... 9223372036854776440 {3b994b2a-f242-4c76-855c-03b815f2060b} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450038003900360042003900450042002d0037003900420041002d0034003700430043002d0039003000390045002d003800410038003900420039004200370044003200370037007d000000 {.E.8.9.6.B.9.E.B.-.7.9.B.A.-.4.7.C.C.-.9.0.9.E.-.8.A.8.9.B.9.B.7.D.2.7.7.}... 9223372036854776441 {6df8b345-0230-43d9-8d8e-12dc278a5da6} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300034003300330035004500380033002d0036004400330044002d0034003400380039002d0041003800420044002d003400360031004500300031003200390046004300450036007d000000 {.0.4.3.3.5.E.8.3.-.6.D.3.D.-.4.4.8.9.-.A.8.B.D.-.4.6.1.E.0.1.2.9.F.C.E.6.}... 9223372036854776442 {f24769c1-3640-4f68-afde-76aa79179219} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00340031004100320034003700320045002d0046004600440036002d0034003600450032002d0041003000330035002d004300430038004600450031003000300034004500410038007d000000 {.4.1.A.2.4.7.2.E.-.F.F.D.6.-.4.6.E.2.-.A.0.3.5.-.C.C.8.F.E.1.0.0.4.E.A.8.}... 9223372036854776443 {aefe901c-5a83-4e4c-9d5e-178ff2082943} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00380046003100310042003900390034002d0044003100390031002d0034003000340038002d0042003900430042002d003000460044003500380045003600330030003600390036007d000000 {.8.F.1.1.B.9.9.4.-.D.1.9.1.-.4.0.4.8.-.B.9.C.B.-.0.F.D.5.8.E.6.3.0.6.9.6.}... 9223372036854776444 {78518afb-c587-4564-a904-4e6be35bf900} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00390044003400440034004500370032002d0038004600350044002d0034003000340041002d0039003400380036002d003400420035003400320039004600460035003800330031007d000000 {.9.D.4.D.4.E.7.2.-.8.F.5.D.-.4.0.4.A.-.9.4.8.6.-.4.B.5.4.2.9.F.F.5.8.3.1.}... 9223372036854776445 {95555d1b-c7d8-4915-b994-00260f75e514} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310038003400440030003600440041002d0044003100370037002d0034004600450045002d0041004300460032002d003900350042003700380032004100420035003900390046007d000000 {.1.8.4.D.0.6.D.A.-.D.1.7.7.-.4.F.E.E.-.A.C.F.2.-.9.5.B.7.8.2.A.B.5.9.9.F.}... 9223372036854776446 {0b587fb8-2b5d-4186-84ca-ff54e76304fa} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00340046003200340043004200390039002d0034003900430038002d0034004300340036002d0038003200350042002d004400370031004100390037003800360043004200440034007d000000 {.4.F.2.4.C.B.9.9.-.4.9.C.8.-.4.C.4.6.-.8.2.5.B.-.D.7.1.A.9.7.8.6.C.B.D.4.}... 9223372036854776447 {805b81fa-6d7a-43a3-91c1-f13f1a1a9162} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450034004500380046003900330036002d0043004600380036002d0034003200410036002d0039003900450031002d003400370045004200390033003400380042003700420030007d000000 {.E.4.E.8.F.9.3.6.-.C.F.8.6.-.4.2.A.6.-.9.9.E.1.-.4.7.E.B.9.3.4.8.B.7.B.0.}... 9223372036854776448 {4069af0d-2fc4-448f-807f-9c6876d0a3ea} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00390041003500440033003800450041002d0046003300350043002d0034003100380043002d0041003700310033002d003300340044003000360031004500360033003500420046007d000000 {.9.A.5.D.3.8.E.A.-.F.3.5.C.-.4.1.8.C.-.A.7.1.3.-.3.4.D.0.6.1.E.6.3.5.B.F.}... 9223372036854776449 {a5bfc811-4153-4f33-8718-d8f4522e2091} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00390038003700360044003800450035002d0046003300310035002d0034004500460043002d0039004500440043002d003800420039003300410046003100360031004300330045007d000000 {.9.8.7.6.D.8.E.5.-.F.3.1.5.-.4.E.F.C.-.9.E.D.C.-.8.B.9.3.A.F.1.6.1.C.3.E.}... 9223372036854776450 {1a89d52d-bdc9-4413-bd14-8e6e834da99c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00350041003900440046004100340039002d0039004100350030002d0034003400450036002d0038004400460046002d004100460039003500450032004500430038004400390032007d000000 {.5.A.9.D.F.A.4.9.-.9.A.5.0.-.4.4.E.6.-.8.D.F.F.-.A.F.9.5.E.2.E.C.8.D.9.2.}... 9223372036854776451 {804b6c1e-62a6-440e-a4e1-45fd8949dce6} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430043004100300043003400320032002d0037003400310041002d0034004500350044002d0038004100300045002d003300360038003700350041004300440036003100420038007d000000 {.C.C.A.0.C.4.2.2.-.7.4.1.A.-.4.E.5.D.-.8.A.0.E.-.3.6.8.7.5.A.C.D.6.1.B.8.}... 9223372036854776452 {c99679ae-a6f8-497d-b6eb-94821d27a44d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440038004600430033003500310035002d0043003200360037002d0034003700420042002d0039003700430045002d003900330032003000300035003800300043003600330045007d000000 {.D.8.F.C.3.5.1.5.-.C.2.6.7.-.4.7.B.B.-.9.7.C.E.-.9.3.2.0.0.5.8.0.C.6.3.E.}... 9223372036854776453 {221b7254-8807-42ab-bfa5-0cd2dbd0f0d5} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440046003100340037003300440037002d0030003800330033002d0034003500300042002d0039003900310041002d003100420039003800380044003300300038004400360039007d000000 {.D.F.1.4.7.3.D.7.-.0.8.3.3.-.4.5.0.B.-.9.9.1.A.-.1.B.9.8.8.D.3.0.8.D.6.9.}... 9223372036854776454 {0f24b893-b964-4d88-8875-d462390251e5} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450038003900360034004100340044002d0045003800380046002d0034003400330043002d0042003600360046002d004300420037003000450039003700410036004200380038007d000000 {.E.8.9.6.4.A.4.D.-.E.8.8.F.-.4.4.3.C.-.B.6.6.F.-.C.B.7.0.E.9.7.A.6.B.8.8.}... 9223372036854776455 {c8e8b63f-05ac-4b2c-858a-d3b66b9bca94} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300038003400420039004500320036002d0046003900320046002d0034003100350039002d0042003700370043002d003000460046003900410032003600360046004400390041007d000000 {.0.8.4.B.9.E.2.6.-.F.9.2.F.-.4.1.5.9.-.B.7.7.C.-.0.F.F.9.A.2.6.6.F.D.9.A.}... 9223372036854776456 {934834f5-e0a5-441b-85c2-73fd9be9463f} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00370045004600430031003900320033002d0038003000460042002d0034003900440046002d0042003000430033002d004100350033004400430038003800450033004300430030007d000000 {.7.E.F.C.1.9.2.3.-.8.0.F.B.-.4.9.D.F.-.B.0.C.3.-.A.5.3.D.C.8.8.E.3.C.C.0.}... 9223372036854776457 {f0e85dc1-2a2a-4fc0-b501-a30cbac74a8e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450044004200330043004400310045002d0042004600370041002d0034003500440036002d0041003800390034002d003300340046003300360039003400370034003400380041007d000000 {.E.D.B.3.C.D.1.E.-.B.F.7.A.-.4.5.D.6.-.A.8.9.4.-.3.4.F.3.6.9.4.7.4.4.8.A.}... 9223372036854776458 {09a98b8a-115e-495c-836b-42b475630183} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00450030004400420042004100410031002d0043004200330035002d0034003100450037002d0039003900350043002d003300370041004200360043003500380035003400300038007d000000 {.E.0.D.B.B.A.A.1.-.C.B.3.5.-.4.1.E.7.-.9.9.5.C.-.3.7.A.B.6.C.5.8.5.4.0.8.}... 9223372036854776461 {400124d1-e3bc-4c21-84f1-9c2fdd660eaa} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00390031003000440039003100450031002d0032003900320038002d0034003600420032002d0038003600450046002d003600410045003100460032004400380045003200410043007d000000 {.9.1.0.D.9.1.E.1.-.2.9.2.8.-.4.6.B.2.-.8.6.E.F.-.6.A.E.1.F.2.D.8.E.2.A.C.}... 9223372036854776462 {f9f5ba6c-d936-4b6f-9503-aa2fc28d2bb8} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440046004400410045004600310031002d0046004100420043002d0034003400460031002d0039003400450036002d003300440043003600320035003800460038003500420036007d000000 {.D.F.D.A.E.F.1.1.-.F.A.B.C.-.4.4.F.1.-.9.4.E.6.-.3.D.C.6.2.5.8.F.8.5.B.6.}... 9223372036854776463 {fbb9b711-0218-4bd3-bc24-5f88cdd9fcec} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310034003400450038003900370032002d0030004500310030002d0034003600350033002d0038004400440032002d003600420031003400350038003000440046004600300046007d000000 {.1.4.4.E.8.9.7.2.-.0.E.1.0.-.4.6.5.3.-.8.D.D.2.-.6.B.1.4.5.8.0.D.F.F.0.F.}... 9223372036854776464 {60847319-40c2-4c6b-9b63-67b1fdef219d} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00300043003000420030003500410046002d0046003100450043002d0034003000310039002d0038004400340032002d004300350034004400350044004400340031004500420041007d000000 {.0.C.0.B.0.5.A.F.-.F.1.E.C.-.4.0.1.9.-.8.D.4.2.-.C.5.4.D.5.D.D.4.1.E.B.A.}... 9223372036854776467 {6b9eebdb-a4d1-451c-9830-de157ab09a0a} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00430045004300380041003000420044002d0042004500320041002d0034003900440034002d0038004200310044002d004400440032003900340035004300440039003300440046007d000000 {.C.E.C.8.A.0.B.D.-.B.E.2.A.-.4.9.D.4.-.8.B.1.D.-.D.D.2.9.4.5.C.D.9.3.D.F.}... 9223372036854776468 {3e440dea-e76d-48aa-b372-560e409b30f1} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... 9223372036854776481 {9d6ea685-ea31-45e1-b8da-a022482c5663} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... 9223372036854776482 {e6cbde25-ce3a-4f6c-ad20-2430fc3be2ec} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... 9223372036854776483 {d67aa0d4-e024-4a5e-b849-9b0a4411f2c7} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... 9223372036854776484 {e7d69b11-d4ea-4140-afc1-3bd5e7bc77d3} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... 9223372036854776485 {d4108881-9c33-48bd-9ba2-da4340a6d656} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... 9223372036854776486 {321945bf-7e0d-4d0b-ba60-4c35526d1059} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00370034003000390038003700450033002d0038004200460039002d0034003000330033002d0038004400330032002d004200440030003200340036003900430035003500360032007d000000 {.7.4.0.9.8.7.E.3.-.8.B.F.9.-.4.0.3.3.-.8.D.3.2.-.B.D.0.2.4.6.9.C.5.5.6.2.}... 9223372036854776489 {fd7430b7-c11f-4981-beb4-57061db06e47} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310033004400310037003200340045002d0043003100300041002d0034004200360044002d0042003000300039002d003900370033004600320032003600440043004400340046007d000000 {.1.3.D.1.7.2.4.E.-.C.1.0.A.-.4.B.6.D.-.B.0.0.9.-.9.7.3.F.2.2.6.D.C.D.4.F.}... 9223372036854776490 {3576462a-269e-4a46-9f90-72d5b7c9c10e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006800690065006c006400650064002000490043004d00500020007600340020004f00750074000000 S.h.i.e.l.d.e.d. .I.C.M.P. .v.4. .O.u.t... 9223372036854776491 {5848fa86-7a5a-4193-9e0b-e6a3e69395f8} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006800690065006c006400650064002000490043004d00500020007600360020004f00750074000000 S.h.i.e.l.d.e.d. .I.C.M.P. .v.6. .O.u.t... 9223372036854776492 {8ab03769-319b-4d2e-81dd-8edc91cbbb8c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006800690065006c006400650064002000490043004d00500020007600340020004f00750074000000 S.h.i.e.l.d.e.d. .I.C.M.P. .v.4. .O.u.t... 9223372036854776493 {302e8ae9-db45-4f11-bf3d-20e0807f3804} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006800690065006c006400650064002000490043004d00500020007600360020004f00750074000000 S.h.i.e.l.d.e.d. .I.C.M.P. .v.6. .O.u.t... 9223372036854776494 {aa4a4221-6f16-4b9c-9a07-b4b4ba6a6bf2} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006800690065006c006400650064002000490043004d00500020007600340020004f00750074000000 S.h.i.e.l.d.e.d. .I.C.M.P. .v.4. .O.u.t... 9223372036854776495 {11a26e34-bc51-40d3-b421-822ad6efbb3e} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 53006800690065006c006400650064002000490043004d00500020007600360020004f00750074000000 S.h.i.e.l.d.e.d. .I.C.M.P. .v.6. .O.u.t... 9223372036854776496 {7b4bd8fd-5d1f-4b8c-9836-4a01a350e746} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00320033004300340039003900450031002d0043003700360042002d0034003700300035002d0041003700310031002d004400450041004400360032004300380033003800440033007d000000 {.2.3.C.4.9.9.E.1.-.C.7.6.B.-.4.7.0.5.-.A.7.1.1.-.D.E.A.D.6.2.C.8.3.8.D.3.}... 9223372036854776497 {ab88322b-f465-4441-9345-715826fcab31} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00420045003800300036004300350034002d0041003800410046002d0034003200330043002d0039004500350036002d004300350041003800300033004600450041003300310033007d000000 {.B.E.8.0.6.C.5.4.-.A.8.A.F.-.4.2.3.C.-.9.E.5.6.-.C.5.A.8.0.3.F.E.A.3.1.3.}... 9223372036854776498 {d6011340-9eba-4253-9ed0-a763c7ef7b6c} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00310042004100420031003400360035002d0034003000430045002d0034003500390039002d0039004500420032002d003200340035003600440030004600420041003300330043007d000000 {.1.B.A.B.1.4.6.5.-.4.0.C.E.-.4.5.9.9.-.9.E.B.2.-.2.4.5.6.D.0.F.B.A.3.3.C.}... 9223372036854776499 {6186f5b6-f4b7-414d-ba20-a82103204847} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00440031003000440041003000340039002d0041004500340035002d0034003200370032002d0039003900450032002d004600370046003800350035003200450046003700420030007d000000 {.D.1.0.D.A.0.4.9.-.A.E.4.5.-.4.2.7.2.-.9.9.E.2.-.F.7.F.8.5.5.2.E.F.7.B.0.}... 9223372036854776500 {c4f20cf5-f405-49a7-b6a4-97b66f9cf587} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00420041004500420032003100440043002d0039003100330043002d0034004100300037002d0039004400440042002d004400320034003400360041003400390041003200360036007d000000 {.B.A.E.B.2.1.D.C.-.9.1.3.C.-.4.A.0.7.-.9.D.D.B.-.D.2.4.4.6.A.4.9.A.2.6.6.}... 9223372036854776501 {ba22195c-728b-4815-be61-4a4f69743fe2} MPSSVC Stores filter origin FWPM_PROVIDER_MPSSVC_WF FWPM_GENERAL_CONTEXT 7b00330030003600350032004100450030002d0035003300320031002d0034003200390033002d0041004100430042002d003200440045003300300042004500360033003600340034007d000000 {.3.0.6.5.2.A.E.0.-.5.3.2.1.-.4.2.9.3.-.A.A.C.B.-.2.D.E.3.0.B.E.6.3.6.4.4.}... 9223372036854776502 FWPM_SUBLAYER_INSPECTION WFP Built-in Inspection Sublayer 0 FWPM_SUBLAYER_TEREDO WFP Built-in Edge Traversal Sublayer 1 FWPM_SUBLAYER_MPSSVC_WF WFP Built-in MPSSVC Windows Firewall Sublayer FWPM_PROVIDER_MPSSVC_WF 2 FWPM_SUBLAYER_MPSSVC_WSH WFP Built-in MPSSVC Windows Service Hardening Sublayer FWPM_PROVIDER_MPSSVC_WSH 3 FWPM_SUBLAYER_MPSSVC_QUARANTINE WFP Built-in MPSSVC Quarantine Sublayer FWPM_PROVIDER_MPSSVC_WSH 4 FWPM_SUBLAYER_MPSSVC_EDP WFP Built-in MPSSVC Enterprise Data Protection Sublayer FWPM_PROVIDER_MPSSVC_EDP 5 FWPM_SUBLAYER_MPSSVC_TENANT_RESTRICTIONS WFP Built-in MPSSVC Tenant Restrictions Sublayer FWPM_PROVIDER_MPSSVC_TENANT_RESTRICTIONS 6 FWPM_SUBLAYER_MPSSVC_APP_ISOLATION WFP Built-in MPSSVC App Isolation Sublayer FWPM_PROVIDER_MPSSVC_APP_ISOLATION 7 {7b6b11f6-cbb5-433c-ae06-6a4f0076e49e} Edge traversal Teredo Authorization Sublayer Edge traversal Teredo Authorization Sublayer 8 {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} windefend 4096 FWPM_SUBLAYER_TCP_CHIMNEY_OFFLOAD WFP Built-in TCP Chimney Offload Sublayer 8192 FWPM_SUBLAYER_TCP_TEMPLATES WFP Built-in TCP Templates Sublayer 8704 FWPM_SUBLAYER_IPSEC_SECURITY_REALM WFP Built-in IPsec Security Realm Sublayer 12288 FWPM_SUBLAYER_SECURE_SOCKET WFP Built-in Secure Socket Sublayer 16384 FWPM_SUBLAYER_LIPS WFP Built-in Legacy IPsec Sublayer 32767 FWPM_SUBLAYER_UNIVERSAL WFP Built-in Universal Sublayer 32768 FWPM_SUBLAYER_IPSEC_DOSP WFP Built-in IPsec DoS Protection Sublayer 34816 FWPM_SUBLAYER_IPSEC_FORWARD_OUTBOUND_TUNNEL WFP Built-in IPsec Forward Outbound Tunnel Sublayer 36864 FWPM_SUBLAYER_IPSEC_TUNNEL WFP Built-in IPsec Tunnel Sublayer 40960 {9ba30013-c84e-47e5-ac6e-1e1aed72fa69} Microsoft Corporation FWPM_SUBLAYER_FLAG_PERSISTENT {1bebc969-61a5-4732-a177-847a0817862a} 40961 FWPM_SUBLAYER_RPC_AUDIT RPC Built-in Audit Sublayer 49152 {a87fb472-fc68-4805-8559-c6ae774773e0} PortmasterSublayer The Portmaster sublayer holds all it's filters. 65535 `)