mirror of
https://github.com/rbmm/SC
synced 2026-06-08 17:03:41 +00:00
rbmm
677 lines
26 KiB
Plaintext
677 lines
26 KiB
Plaintext
case 0x3798e4ed: // "pro"
|
|
break;
|
|
0: 0(0) [0] 18 "(null)"
|
|
1: 4(0) [0] cf "System"
|
|
2: 8c(4) [0] 0 "Secure System"
|
|
3: b4(4) [0] 4 "Registry"
|
|
4: 220(4) [0] 2 "smss.exe"
|
|
5: 350(330) [0] e "csrss.exe"
|
|
6: 3a0(330) [0] 2 "wininit.exe"
|
|
7: 3a8(398) [1] d "csrss.exe"
|
|
8: 260(3a0) [0] 9 "services.exe"
|
|
9: 2b8(398) [1] 4 "winlogon.exe"
|
|
a: 20c(3a0) [0] 1 "LsaIso.exe"
|
|
b: 334(3a0) [0] b "lsass.exe"
|
|
c: 468(260) [0] 13 "svchost.exe"
|
|
d: 48c(2b8) [1] 5 "fontdrvhost.exe"
|
|
e: 488(3a0) [0] 5 "fontdrvhost.exe"
|
|
f: 4e8(260) [0] c "svchost.exe"
|
|
10: 518(260) [0] 6 "svchost.exe"
|
|
11: 560(2b8) [1] 11 "dwm.exe"
|
|
12: 61c(260) [0] 2 "svchost.exe"
|
|
13: 62c(260) [0] 1e "svchost.exe"
|
|
14: 678(260) [0] 4 "svchost.exe"
|
|
15: 728(260) [0] 5 "svchost.exe"
|
|
16: 738(260) [0] d "svchost.exe"
|
|
17: 764(260) [0] 3 "svchost.exe"
|
|
18: 76c(260) [0] 4 "svchost.exe"
|
|
19: 774(260) [0] 4 "svchost.exe"
|
|
1a: 7b4(260) [0] 5 "svchost.exe"
|
|
1b: 210(260) [0] 5 "svchost.exe"
|
|
1c: 434(260) [0] 6 "svchost.exe"
|
|
1d: 8a4(260) [0] 4 "svchost.exe"
|
|
1e: 96c(260) [0] b "svchost.exe"
|
|
1f: 974(260) [0] 6 "svchost.exe"
|
|
20: 994(260) [0] 6 "WUDFHost.exe"
|
|
21: 9b8(260) [0] 8 "svchost.exe"
|
|
22: 9f4(260) [0] 6 "svchost.exe"
|
|
23: 9fc(260) [0] 4 "svchost.exe"
|
|
24: a04(260) [0] 6 "svchost.exe"
|
|
25: a34(260) [0] 5 "svchost.exe"
|
|
26: ac0(4) [0] 12 "Memory Compression"
|
|
27: acc(260) [0] 8 "svchost.exe"
|
|
28: b24(260) [0] 3 "svchost.exe"
|
|
29: b58(260) [0] 8 "svchost.exe"
|
|
2a: b6c(260) [0] 4 "svchost.exe"
|
|
2b: b74(260) [0] 8 "svchost.exe"
|
|
2c: bf8(260) [0] 8 "svchost.exe"
|
|
2d: c1c(260) [0] 4 "svchost.exe"
|
|
2e: c5c(260) [0] 7 "svchost.exe"
|
|
2f: ce0(260) [0] 5 "svchost.exe"
|
|
30: d30(260) [0] 4 "svchost.exe"
|
|
31: d38(260) [0] 3 "svchost.exe"
|
|
32: d94(260) [0] 4 "svchost.exe"
|
|
33: e34(260) [0] 13 "svchost.exe"
|
|
34: e4c(260) [0] 7 "svchost.exe"
|
|
35: e54(260) [0] 5 "svchost.exe"
|
|
36: e5c(260) [0] a "svchost.exe"
|
|
37: e64(260) [0] 2 "svchost.exe"
|
|
38: e6c(260) [0] 3 "svchost.exe"
|
|
39: f54(260) [0] 6 "svchost.exe"
|
|
3a: fd8(e6c) [0] 5 "dasHost.exe"
|
|
3b: ff8(260) [0] c "svchost.exe"
|
|
3c: 1178(260) [0] 6 "svchost.exe"
|
|
3d: 11d8(210) [1] c "sihost.exe"
|
|
3e: 11f4(260) [1] 5 "svchost.exe"
|
|
3f: 1210(260) [1] 8 "svchost.exe"
|
|
40: 125c(738) [1] 8 "taskhostw.exe"
|
|
41: 12e0(260) [0] 4 "svchost.exe"
|
|
42: 13e0(260) [0] 8 "svchost.exe"
|
|
43: 1128(112c) [1] 38 "explorer.exe"
|
|
44: 1148(11d8) [1] 8 "ShellHost.exe"
|
|
45: 12c0(260) [0] 7 "svchost.exe"
|
|
46: 1478(260) [0] 3 "svchost.exe"
|
|
47: 150c(260) [0] 3 "svchost.exe"
|
|
48: 15e8(468) [1] 28 "SearchHost.exe"
|
|
49: 15f0(468) [1] e "StartMenuExperienceHost.exe"
|
|
4a: 16c0(260) [0] 3 "svchost.exe"
|
|
4b: 1754(260) [1] 3 "svchost.exe"
|
|
4c: 1760(468) [1] 6 "RuntimeBroker.exe"
|
|
4d: 17b4(468) [1] 5 "RuntimeBroker.exe"
|
|
4e: 8(260) [0] 3 "svchost.exe"
|
|
4f: 1900(468) [1] 6 "dllhost.exe"
|
|
50: 1b44(ce0) [1] c "ctfmon.exe"
|
|
51: 15a0(468) [1] c "LockApp.exe"
|
|
52: 1a24(468) [1] 14 "RuntimeBroker.exe"
|
|
53: 15b8(260) [1] 5 "svchost.exe"
|
|
54: 1c04(260) [1] 7 "svchost.exe"
|
|
55: 1df0(468) [1] 1b "TextInputHost.exe"
|
|
56: 1be4(260) [0] 6 "svchost.exe"
|
|
57: 1f20(1128) [1] a "Far.exe"
|
|
58: 1cfc(260) [0] b "svchost.exe"
|
|
59: 1ff0(1f20) [1] 4 "conhost.exe"
|
|
5a: 32c(1128) [1] 74 "devenv.exe"
|
|
5b: b0c(7d4) [1] 19 "PerfWatson2.exe"
|
|
5c: 12f0(32c) [1] b "Microsoft.ServiceHub.Controller.exe"
|
|
5d: b1c(12f0) [1] c "ServiceHub.VSDetouredHost.exe"
|
|
5e: 1978(1128) [1] 28 "chrome.exe"
|
|
5f: 1e58(1978) [1] 8 "chrome.exe"
|
|
60: 14f8(260) [0] f "svchost.exe"
|
|
61: 1dec(1978) [1] 12 "chrome.exe"
|
|
62: d54(1978) [1] 12 "chrome.exe"
|
|
63: 11b4(1978) [1] b "chrome.exe"
|
|
64: 644(12f0) [1] 17 "ServiceHub.IdentityHost.exe"
|
|
65: 229c(260) [0] 5 "svchost.exe"
|
|
66: 22c4(1978) [1] 13 "chrome.exe"
|
|
67: 2304(260) [0] 5 "svchost.exe"
|
|
68: 214c(12f0) [1] e "ServiceHub.ThreadedWaitDialog.exe"
|
|
69: 2200(12f0) [1] 9 "ServiceHub.IntellicodeModelService.exe"
|
|
6a: 16ac(12f0) [1] 10 "ServiceHub.IndexingService.exe"
|
|
6b: 13ec(32c) [1] 1 "vshost.exe"
|
|
6c: 25f0(1978) [1] 14 "chrome.exe"
|
|
6d: 26bc(1978) [1] 9 "chrome.exe"
|
|
6e: 1af4(12f0) [1] d "ServiceHub.Host.AnyCPU.exe"
|
|
6f: 1ae0(12f0) [1] a "ServiceHub.TestWindowStoreHost.exe"
|
|
70: 2988(260) [0] 5 "svchost.exe"
|
|
71: 2a5c(260) [0] 5 "svchost.exe"
|
|
72: 20dc(1128) [1] 1 "Notepad2.exe"
|
|
73: 758(16a0) [1] 1 "mspdbsrv.exe"
|
|
74: 1cb0(1128) [1] 2e "devenv.exe"
|
|
75: 2e14(260) [0] a "svchost.exe"
|
|
76: 2f5c(1978) [1] 14 "chrome.exe"
|
|
77: f5c(1978) [1] 13 "chrome.exe"
|
|
78: 2df0(1978) [1] 9 "chrome.exe"
|
|
79: 1718(1978) [1] 17 "chrome.exe"
|
|
7a: 2eb0(1978) [1] 13 "chrome.exe"
|
|
7b: 2e2c(1978) [1] 13 "chrome.exe"
|
|
7c: 1774(1978) [1] 13 "chrome.exe"
|
|
7d: 1008(1f20) [1] 1 "Notepad2.exe"
|
|
7e: 2834(1978) [1] 15 "chrome.exe"
|
|
7f: 1608(17e0) [1] 1e "Skype.exe"
|
|
80: 2c84(1608) [1] 8 "Skype.exe"
|
|
81: 1cd4(1608) [1] a "Skype.exe"
|
|
82: 27d0(1608) [1] 31 "Skype.exe"
|
|
83: 578(1608) [1] 5 "Skype.exe"
|
|
84: 13b4(1608) [1] 12 "Skype.exe"
|
|
85: 3084(260) [0] 4 "svchost.exe"
|
|
86: 2888(1978) [1] 19 "chrome.exe"
|
|
87: 1f34(1978) [1] 13 "chrome.exe"
|
|
88: 2964(1978) [1] 13 "chrome.exe"
|
|
89: 2a08(1128) [1] 1 "DbgNew.exe"
|
|
8a: 2848(1f20) [1] 1 "notepad.exe"
|
|
8b: 23b4(1128) [1] 4 "calc1.exe"
|
|
8c: 5e8(1978) [1] 9 "chrome.exe"
|
|
8d: 2dc0(1978) [1] 13 "chrome.exe"
|
|
8e: 17c4(1978) [1] 18 "chrome.exe"
|
|
8f: 21c0(ecc) [1] 10 "vctip.exe"
|
|
90: 315c(1978) [1] 13 "chrome.exe"
|
|
91: 33d0(1978) [1] 13 "chrome.exe"
|
|
92: 2cd4(1978) [1] 14 "chrome.exe"
|
|
93: 3300(1978) [1] 13 "chrome.exe"
|
|
94: 17a8(1978) [1] 13 "chrome.exe"
|
|
95: 650(32c) [1] 13 "MSBuild.exe"
|
|
96: 2818(650) [1] 2 "conhost.exe"
|
|
97: 2bc8(1978) [1] 13 "chrome.exe"
|
|
98: 2fc4(1978) [1] 13 "chrome.exe"
|
|
99: 11ac(28fc) [1] e "mspdbsrv.exe"
|
|
9a: f90(32c) [1] 6 "VcxprojReader.exe"
|
|
9b: 3368(f90) [1] 4 "conhost.exe"
|
|
9c: 32d8(260) [0] 6 "svchost.exe"
|
|
9d: 184c(32c) [1] 8 "VcxprojReader.exe"
|
|
9e: cc4(184c) [1] 2 "conhost.exe"
|
|
9f: d18(13ec) [1] 7 "vcpkgsrv.exe"
|
|
a0: 166c(1978) [1] d "chrome.exe"
|
|
a1: 1254(13ec) [1] 7 "vcpkgsrv.exe"
|
|
a2: 1d10(1f20) [1] 4 "cmd.exe"
|
|
a3: 2544(1d10) [1] 1 "TestTask.x64.exe"
|
|
case 0xda7233c0: // "ltsk"
|
|
break;
|
|
["\"]
|
|
["RemoteDesktop"]
|
|
["Harry"]
|
|
["Mozilla"]
|
|
["Microsoft"]
|
|
["XblGameSave"]
|
|
["Windows"]
|
|
["WwanSvc"]
|
|
[TASK_STATE_READY]: "OobeDiscovery"
|
|
[TASK_STATE_READY]: "NotificationTask"
|
|
["WS"]
|
|
["Workplace Join"]
|
|
[TASK_STATE_DISABLED]: "Recovery-Check"
|
|
[TASK_STATE_DISABLED]: "Device-Sync"
|
|
[TASK_STATE_DISABLED]: "Automatic-Device-Join"
|
|
["Work Folders"]
|
|
[TASK_STATE_READY]: "Work Folders Maintenance Work"
|
|
[TASK_STATE_READY]: "Work Folders Logon Synchronization"
|
|
["WOF"]
|
|
[TASK_STATE_DISABLED]: "WIM-Hash-Validation"
|
|
[TASK_STATE_READY]: "WIM-Hash-Management"
|
|
["WlanSvc"]
|
|
[TASK_STATE_READY]: "MoProfileManagement"
|
|
[TASK_STATE_READY]: "CDSSync"
|
|
["Wininet"]
|
|
[TASK_STATE_RUNNING]: "CacheTask"
|
|
["WindowsUpdate"]
|
|
["WindowsColorSystem"]
|
|
[TASK_STATE_READY]: "Calibration Loader"
|
|
["WindowsBackup"]
|
|
["Windows Subsystem For Linux"]
|
|
["Windows Media Sharing"]
|
|
[TASK_STATE_READY]: "UpdateLibrary"
|
|
["Windows Filtering Platform"]
|
|
[TASK_STATE_READY]: "BfeOnServiceStartTypeChange"
|
|
["Windows Error Reporting"]
|
|
[TASK_STATE_READY]: "QueueReporting"
|
|
["Windows Defender"]
|
|
[TASK_STATE_READY]: "Windows Defender Verification"
|
|
[TASK_STATE_READY]: "Windows Defender Scheduled Scan"
|
|
[TASK_STATE_READY]: "Windows Defender Cleanup"
|
|
[TASK_STATE_READY]: "Windows Defender Cache Maintenance"
|
|
["Windows Activation Technologies"]
|
|
["WDI"]
|
|
[TASK_STATE_READY]: "ResolutionHost"
|
|
["WCM"]
|
|
[TASK_STATE_READY]: "WiFiTask"
|
|
["WaaSMedic"]
|
|
[TASK_STATE_DISABLED]: "PerformRemediation"
|
|
["User Profile Service"]
|
|
[TASK_STATE_DISABLED]: "HiveUploadTask"
|
|
["USB"]
|
|
[TASK_STATE_READY]: "Usb-Notifications"
|
|
["UPnP"]
|
|
[TASK_STATE_READY]: "UPnPHostConfig"
|
|
["UpdateOrchestrator"]
|
|
[TASK_STATE_READY]: "UUS Failover Task"
|
|
[TASK_STATE_READY]: "USO_UxBroker"
|
|
[TASK_STATE_READY]: "StartOobeAppsScan_LicenseAccepted"
|
|
[TASK_STATE_READY]: "StartOobeAppsScanAfterUpdate"
|
|
[TASK_STATE_READY]: "Start Oobe Expedite Work"
|
|
[TASK_STATE_READY]: "Schedule Work"
|
|
[TASK_STATE_DISABLED]: "Schedule Wake To Work"
|
|
[TASK_STATE_READY]: "Schedule Scan Static Task"
|
|
[TASK_STATE_READY]: "Schedule Scan"
|
|
[TASK_STATE_DISABLED]: "Schedule Maintenance Work"
|
|
[TASK_STATE_READY]: "Report policies"
|
|
["UNP"]
|
|
[TASK_STATE_DISABLED]: "RunUpdateNotificationMgr"
|
|
["TPM"]
|
|
[TASK_STATE_READY]: "Tpm-PreAttestationHealthCheck"
|
|
[TASK_STATE_READY]: "Tpm-Maintenance"
|
|
[TASK_STATE_READY]: "Tpm-HASCertRetr"
|
|
["Time Zone"]
|
|
[TASK_STATE_READY]: "SynchronizeTimeZone"
|
|
["Time Synchronization"]
|
|
[TASK_STATE_READY]: "SynchronizeTime"
|
|
[TASK_STATE_READY]: "ForceSynchronizeTime"
|
|
["TextServicesFramework"]
|
|
[TASK_STATE_READY]: "MsCtfMonitor"
|
|
["TaskScheduler"]
|
|
["Task Manager"]
|
|
[TASK_STATE_READY]: "Interactive"
|
|
["SystemRestore"]
|
|
[TASK_STATE_READY]: "SR"
|
|
["Sysmain"]
|
|
[TASK_STATE_READY]: "WsSwapAssessmentTask"
|
|
[TASK_STATE_READY]: "ResPriStaticDbSync"
|
|
[TASK_STATE_DISABLED]: "HybridDriveCacheRebalance"
|
|
[TASK_STATE_DISABLED]: "HybridDriveCachePrepopulate"
|
|
["SyncCenter"]
|
|
["Sustainability"]
|
|
[TASK_STATE_READY]: "SustainabilityTelemetry"
|
|
[TASK_STATE_READY]: "PowerGridForecastTask"
|
|
["Subscription"]
|
|
[TASK_STATE_DISABLED]: "LicenseAcquisition"
|
|
[TASK_STATE_READY]: "EnableLicenseAcquisition"
|
|
["Storage Tiers Management"]
|
|
[TASK_STATE_DISABLED]: "Storage Tiers Optimization"
|
|
[TASK_STATE_READY]: "Storage Tiers Management Initialization"
|
|
["StateRepository"]
|
|
[TASK_STATE_READY]: "MaintenanceTasks"
|
|
["Speech"]
|
|
[TASK_STATE_READY]: "SpeechModelDownloadTask"
|
|
["SpacePort"]
|
|
[TASK_STATE_READY]: "SpaceManagerTask"
|
|
[TASK_STATE_READY]: "SpaceAgentTask"
|
|
["SoftwareProtectionPlatform"]
|
|
[TASK_STATE_READY]: "SvcRestartTaskNetwork"
|
|
[TASK_STATE_READY]: "SvcRestartTaskLogon"
|
|
[TASK_STATE_READY]: "SvcRestartTask"
|
|
["SMB"]
|
|
["Shell"]
|
|
[TASK_STATE_READY]: "UpdateUserPictureTask"
|
|
[TASK_STATE_READY]: "ThemesSyncedImageDownload"
|
|
[TASK_STATE_DISABLED]: "ThemeAssetTask_SyncFODState"
|
|
[TASK_STATE_READY]: "IndexerAutomaticMaintenance"
|
|
[TASK_STATE_READY]: "FamilySafetyRefreshTask"
|
|
[TASK_STATE_DISABLED]: "FamilySafetyMonitorToastTask"
|
|
[TASK_STATE_READY]: "FamilySafetyMonitor"
|
|
[TASK_STATE_READY]: "CreateObjectTask"
|
|
["SharedPC"]
|
|
[TASK_STATE_DISABLED]: "Account Cleanup"
|
|
["Setup"]
|
|
["SettingSync"]
|
|
["Servicing"]
|
|
[TASK_STATE_READY]: "StartComponentCleanup"
|
|
[TASK_STATE_DISABLED]: "OOBEFodSetup"
|
|
["Security"]
|
|
["Pwdless"]
|
|
[TASK_STATE_READY]: "IntelligentPwdlessTask"
|
|
["RetailDemo"]
|
|
["rempl"]
|
|
["RemoteAssistance"]
|
|
[TASK_STATE_READY]: "RemoteAssistanceTask"
|
|
["RemoteApp and Desktop Connections Update"]
|
|
["Registry"]
|
|
[TASK_STATE_READY]: "RegIdleBackup"
|
|
["ReFsDedupSvc"]
|
|
[TASK_STATE_READY]: "Initialization"
|
|
["RecoveryEnvironment"]
|
|
[TASK_STATE_DISABLED]: "VerifyWinRE"
|
|
["Ras"]
|
|
[TASK_STATE_READY]: "MobilityManager"
|
|
["PushToInstall"]
|
|
[TASK_STATE_READY]: "Registration"
|
|
[TASK_STATE_READY]: "LoginCheck"
|
|
["Printing"]
|
|
[TASK_STATE_READY]: "PrintJobCleanupTask"
|
|
[TASK_STATE_READY]: "PrinterCleanupTask"
|
|
[TASK_STATE_READY]: "EduPrintProv"
|
|
["Power Efficiency Diagnostics"]
|
|
[TASK_STATE_READY]: "AnalyzeSystem"
|
|
["Plug and Play"]
|
|
[TASK_STATE_READY]: "Sysprep Generalize Drivers"
|
|
[TASK_STATE_READY]: "Plug and Play Cleanup"
|
|
[TASK_STATE_READY]: "Device Install Reboot Required"
|
|
[TASK_STATE_READY]: "Device Install Group Policy"
|
|
["PLA"]
|
|
["System"]
|
|
["PI"]
|
|
[TASK_STATE_READY]: "Sqm-Tasks"
|
|
[TASK_STATE_READY]: "SecureBootEncodeUEFI"
|
|
[TASK_STATE_READY]: "Secure-Boot-Update"
|
|
["PerformanceTrace"]
|
|
[TASK_STATE_READY]: "RequestTrace"
|
|
["Offline Files"]
|
|
[TASK_STATE_DISABLED]: "Logon Synchronization"
|
|
[TASK_STATE_DISABLED]: "Background Synchronization"
|
|
["NlaSvc"]
|
|
[TASK_STATE_READY]: "WiFiTask"
|
|
["Network Connectivity Status Indicator"]
|
|
[TASK_STATE_READY]: "NcsiIdentifyUserProxies"
|
|
["NetTrace"]
|
|
["Multimedia"]
|
|
[TASK_STATE_RUNNING]: "SystemSoundsService"
|
|
["MUI"]
|
|
[TASK_STATE_READY]: "LPRemove"
|
|
["Mobile Broadband Accounts"]
|
|
[TASK_STATE_READY]: "MNO Metadata Parser"
|
|
["MemoryDiagnostic"]
|
|
[TASK_STATE_DISABLED]: "RunFullMemoryDiagnostic"
|
|
[TASK_STATE_READY]: "ProcessMemoryDiagnosticEvents"
|
|
["Maps"]
|
|
[TASK_STATE_DISABLED]: "MapsUpdateTask"
|
|
[TASK_STATE_READY]: "MapsToastTask"
|
|
["Management"]
|
|
["Provisioning"]
|
|
[TASK_STATE_DISABLED]: "RunOnReboot"
|
|
[TASK_STATE_DISABLED]: "Retry"
|
|
[TASK_STATE_DISABLED]: "MdmDiagnosticsCleanup"
|
|
[TASK_STATE_READY]: "Logon"
|
|
[TASK_STATE_READY]: "Cellular"
|
|
["Autopilot"]
|
|
[TASK_STATE_DISABLED]: "RemediateHardwareChange"
|
|
[TASK_STATE_DISABLED]: "DetectHardwareChange"
|
|
["Maintenance"]
|
|
[TASK_STATE_READY]: "WinSAT"
|
|
["Location"]
|
|
[TASK_STATE_READY]: "WindowsActionDialog"
|
|
[TASK_STATE_READY]: "Notifications"
|
|
["Live"]
|
|
["Roaming"]
|
|
["License Manager"]
|
|
[TASK_STATE_READY]: "TempSignedLicenseExchange"
|
|
["LanguageComponentsInstaller"]
|
|
[TASK_STATE_DISABLED]: "Uninstallation"
|
|
[TASK_STATE_READY]: "ReconcileLanguageResources"
|
|
[TASK_STATE_READY]: "Installation"
|
|
["Kernel"]
|
|
[TASK_STATE_READY]: "La57Cleanup"
|
|
["International"]
|
|
[TASK_STATE_READY]: "Synchronize Language Settings"
|
|
["InstallService"]
|
|
[TASK_STATE_DISABLED]: "WakeUpAndScanForUpdates"
|
|
[TASK_STATE_DISABLED]: "WakeUpAndContinueUpdates"
|
|
[TASK_STATE_READY]: "SmartRetry"
|
|
[TASK_STATE_READY]: "ScanForUpdatesAsUser"
|
|
[TASK_STATE_READY]: "ScanForUpdates"
|
|
[TASK_STATE_READY]: "RestoreDevice"
|
|
["input"]
|
|
[TASK_STATE_READY]: "TouchpadSyncDataAvailable"
|
|
[TASK_STATE_READY]: "syncpensettings"
|
|
[TASK_STATE_READY]: "PenSyncDataAvailable"
|
|
[TASK_STATE_READY]: "MouseSyncDataAvailable"
|
|
[TASK_STATE_READY]: "LocalUserSyncDataAvailable"
|
|
[TASK_STATE_READY]: "InputSettingsRestoreDataAvailable"
|
|
["HelloFace"]
|
|
[TASK_STATE_READY]: "FODCleanupTask"
|
|
["Flighting"]
|
|
["OneSettings"]
|
|
[TASK_STATE_READY]: "RefreshCache"
|
|
["FeatureConfig"]
|
|
[TASK_STATE_READY]: "UsageDataReporting"
|
|
[TASK_STATE_READY]: "UsageDataReceiver"
|
|
[TASK_STATE_READY]: "UsageDataFlushing"
|
|
[TASK_STATE_READY]: "ReconcileFeatures"
|
|
[TASK_STATE_DISABLED]: "BootstrapUsageDataReporting"
|
|
["FileHistory"]
|
|
[TASK_STATE_READY]: "File History (maintenance mode)"
|
|
["File Classification Infrastructure"]
|
|
[TASK_STATE_DISABLED]: "Property Definition Sync"
|
|
["Feedback"]
|
|
["Siuf"]
|
|
[TASK_STATE_READY]: "DmClientOnScenarioDownload"
|
|
[TASK_STATE_READY]: "DmClient"
|
|
["ExploitGuard"]
|
|
[TASK_STATE_READY]: "ExploitGuard MDM policy Refresh"
|
|
["ErrorDetails"]
|
|
[TASK_STATE_DISABLED]: "ErrorDetailsUpdate"
|
|
[TASK_STATE_READY]: "EnableErrorDetailsUpdate"
|
|
["EnterpriseMgmt"]
|
|
[TASK_STATE_READY]: "MDMMaintenenceTask"
|
|
["EDP"]
|
|
[TASK_STATE_READY]: "StorageCardEncryption Task"
|
|
[TASK_STATE_READY]: "EDP Inaccessible Credentials Task"
|
|
[TASK_STATE_READY]: "EDP Auth Task"
|
|
[TASK_STATE_READY]: "EDP App Launch Task"
|
|
["DUSM"]
|
|
[TASK_STATE_READY]: "dusmtask"
|
|
["DiskFootprint"]
|
|
[TASK_STATE_READY]: "StorageSense"
|
|
[TASK_STATE_READY]: "Diagnostics"
|
|
["DiskDiagnostic"]
|
|
[TASK_STATE_DISABLED]: "Microsoft-Windows-DiskDiagnosticResolver"
|
|
[TASK_STATE_READY]: "Microsoft-Windows-DiskDiagnosticDataCollector"
|
|
["DiskCleanup"]
|
|
[TASK_STATE_READY]: "SilentCleanup"
|
|
["DirectX"]
|
|
[TASK_STATE_READY]: "DXGIAdapterCache"
|
|
[TASK_STATE_READY]: "DirectXDatabaseUpdater"
|
|
["Diagnosis"]
|
|
[TASK_STATE_READY]: "UnexpectedCodepath"
|
|
[TASK_STATE_READY]: "Scheduled"
|
|
[TASK_STATE_READY]: "RecommendedTroubleshootingScanner"
|
|
["DeviceLicensingService"]
|
|
["DeviceDirectoryClient"]
|
|
[TASK_STATE_READY]: "RegisterUserDevice"
|
|
[TASK_STATE_READY]: "RegisterDeviceWnsFallback"
|
|
[TASK_STATE_READY]: "RegisterDeviceSettingChange"
|
|
[TASK_STATE_DISABLED]: "RegisterDeviceScreenOnOff"
|
|
[TASK_STATE_READY]: "RegisterDeviceProtectionStateChanged"
|
|
[TASK_STATE_READY]: "RegisterDevicePolicyChange"
|
|
[TASK_STATE_DISABLED]: "RegisterDevicePeriodic6"
|
|
[TASK_STATE_DISABLED]: "RegisterDevicePeriodic24"
|
|
[TASK_STATE_DISABLED]: "RegisterDevicePeriodic1"
|
|
[TASK_STATE_DISABLED]: "RegisterDeviceLocationRightsChange"
|
|
[TASK_STATE_DISABLED]: "RegisterDeviceConnectedToNetwork"
|
|
[TASK_STATE_READY]: "RegisterDeviceAccountChange"
|
|
[TASK_STATE_READY]: "LocateCommandUserSession"
|
|
[TASK_STATE_READY]: "IntegrityCheck"
|
|
[TASK_STATE_READY]: "HandleWnsCommand"
|
|
[TASK_STATE_READY]: "HandleCommand"
|
|
["Device Setup"]
|
|
[TASK_STATE_READY]: "Metadata Refresh"
|
|
["Device Information"]
|
|
[TASK_STATE_READY]: "Device User"
|
|
[TASK_STATE_READY]: "Device"
|
|
["Defrag"]
|
|
[TASK_STATE_READY]: "ScheduledDefrag"
|
|
["Data Integrity Scan"]
|
|
[TASK_STATE_READY]: "Data Integrity Scan for Crash Recovery"
|
|
[TASK_STATE_READY]: "Data Integrity Scan"
|
|
[TASK_STATE_READY]: "Data Integrity Check And Scan"
|
|
["Customer Experience Improvement Program"]
|
|
[TASK_STATE_READY]: "UsbCeip"
|
|
[TASK_STATE_READY]: "Consolidator"
|
|
["Containers"]
|
|
[TASK_STATE_READY]: "CmCleanup"
|
|
["ConsentUX"]
|
|
["UnifiedConsent"]
|
|
[TASK_STATE_READY]: "UnifiedConsentSyncTask"
|
|
["CloudRestore"]
|
|
[TASK_STATE_READY]: "Restore"
|
|
[TASK_STATE_READY]: "Backup"
|
|
["CloudExperienceHost"]
|
|
[TASK_STATE_READY]: "CreateObjectTask"
|
|
["Clip"]
|
|
[TASK_STATE_DISABLED]: "LicenseImdsIntegration"
|
|
[TASK_STATE_DISABLED]: "License Validation"
|
|
["Chkdsk"]
|
|
[TASK_STATE_READY]: "SyspartRepair"
|
|
[TASK_STATE_READY]: "ProactiveScan"
|
|
["CertificateServicesClient"]
|
|
[TASK_STATE_READY]: "UserTask-Roam"
|
|
[TASK_STATE_READY]: "UserTask"
|
|
[TASK_STATE_READY]: "SystemTask"
|
|
[TASK_STATE_READY]: "KeyPreGenTask"
|
|
[TASK_STATE_READY]: "CryptoPolicyTask"
|
|
[TASK_STATE_READY]: "AikCertEnrollTask"
|
|
["capabilityaccessmanager"]
|
|
[TASK_STATE_READY]: "maintenancetasks"
|
|
["BrokerInfrastructure"]
|
|
[TASK_STATE_READY]: "BgTaskRegistrationMaintenanceTask"
|
|
["Bluetooth"]
|
|
[TASK_STATE_READY]: "UninstallDeviceTask"
|
|
["BitLocker"]
|
|
[TASK_STATE_READY]: "BitLocker MDM policy Refresh"
|
|
[TASK_STATE_READY]: "BitLocker Encrypt All Drives"
|
|
["Autochk"]
|
|
[TASK_STATE_READY]: "Proxy"
|
|
["AppxDeploymentClient"]
|
|
[TASK_STATE_READY]: "UCPD velocity"
|
|
[TASK_STATE_DISABLED]: "Pre-staged app cleanup"
|
|
["AppListBackup"]
|
|
[TASK_STATE_READY]: "BackupNonMaintenance"
|
|
[TASK_STATE_READY]: "Backup"
|
|
["ApplicationData"]
|
|
[TASK_STATE_READY]: "DsSvcCleanup"
|
|
[TASK_STATE_READY]: "CleanupTemporaryState"
|
|
[TASK_STATE_READY]: "appuriverifierinstall"
|
|
[TASK_STATE_READY]: "appuriverifierdaily"
|
|
["Application Experience"]
|
|
[TASK_STATE_READY]: "StartupAppTask"
|
|
[TASK_STATE_READY]: "SdbinstMergeDbTask"
|
|
[TASK_STATE_READY]: "PcaPatchDbTask"
|
|
[TASK_STATE_READY]: "Microsoft Compatibility Appraiser Exp"
|
|
[TASK_STATE_READY]: "Microsoft Compatibility Appraiser"
|
|
[TASK_STATE_READY]: "MareBackup"
|
|
["AppID"]
|
|
[TASK_STATE_DISABLED]: "VerifiedPublisherCertStoreCheck"
|
|
[TASK_STATE_READY]: "SmartScreenSpecific"
|
|
[TASK_STATE_DISABLED]: "PolicyConverter"
|
|
[TASK_STATE_READY]: "EDP Policy Manager"
|
|
["Active Directory Rights Management Services Client"]
|
|
[".NET Framework"]
|
|
[TASK_STATE_DISABLED]: ".NET Framework NGEN v4.0.30319 Critical"
|
|
[TASK_STATE_DISABLED]: ".NET Framework NGEN v4.0.30319 64 Critical"
|
|
[TASK_STATE_READY]: ".NET Framework NGEN v4.0.30319 64"
|
|
[TASK_STATE_READY]: ".NET Framework NGEN v4.0.30319"
|
|
["VisualStudio"]
|
|
["Updates"]
|
|
[TASK_STATE_READY]: "BackgroundDownload"
|
|
["OneCore"]
|
|
["DirectX"]
|
|
["Office"]
|
|
["GoogleSystem"]
|
|
["GoogleUpdater"]
|
|
["Event Viewer Tasks"]
|
|
case 0x32a6485e: // "fld"
|
|
break;
|
|
C:\Users\DefaultAppPool
|
|
2
|
|
12 ["AppData"]
|
|
10 ["Local"]
|
|
2416 ["Application Data"]
|
|
2416 ["History"]
|
|
10 ["Microsoft"]
|
|
10 ["Temp"]
|
|
2416 ["Temporary Internet Files"]
|
|
10 ["LocalLow"]
|
|
10 ["Roaming"]
|
|
14 ["Microsoft"]
|
|
2416 ["Application Data"]
|
|
2416 ["Cookies"]
|
|
11 ["Desktop"]
|
|
11 ["Documents"]
|
|
2416 ["My Music"]
|
|
2416 ["My Pictures"]
|
|
2416 ["My Videos"]
|
|
11 ["Downloads"]
|
|
11 ["Favorites"]
|
|
11 ["Links"]
|
|
2416 ["Local Settings"]
|
|
11 ["Music"]
|
|
2416 ["My Documents"]
|
|
2416 ["NetHood"]
|
|
2022 262144 "NTUSER.DAT"
|
|
26 103424 "ntuser.dat.LOG1"
|
|
26 0 "ntuser.dat.LOG2"
|
|
26 65536 "NTUSER.DAT{b794f0d8-4b5d-11e6-80e4-e41d2d719790}.TM.blf"
|
|
26 524288 "NTUSER.DAT{b794f0d8-4b5d-11e6-80e4-e41d2d719790}.TMContainer00000000000000000001.regtrans-ms"
|
|
26 524288 "NTUSER.DAT{b794f0d8-4b5d-11e6-80e4-e41d2d719790}.TMContainer00000000000000000002.regtrans-ms"
|
|
6 20 "ntuser.ini"
|
|
11 ["Pictures"]
|
|
2416 ["PrintHood"]
|
|
2416 ["Recent"]
|
|
10 ["Saved Games"]
|
|
2416 ["SendTo"]
|
|
2416 ["Start Menu"]
|
|
2416 ["Templates"]
|
|
11 ["Videos"]
|
|
case 0x39131377: // "srv"
|
|
break;
|
|
16c0 "Appinfo" ("Application Information") "NT AUTHORITY\SYSTEM"
|
|
b6c "AudioEndpointBuilder" ("Windows Audio Endpoint Builder") "NT AUTHORITY\SYSTEM"
|
|
c5c "Audiosrv" ("Windows Audio") "NT AUTHORITY\LOCAL SERVICE"
|
|
14f8 "BITS" ("Background Intelligent Transfer Service") "NT AUTHORITY\SYSTEM"
|
|
468 "BrokerInfrastructure" ("Background Tasks Infrastructure Service") "NT AUTHORITY\SYSTEM"
|
|
8 "camsvc" ("Capability Access Manager Service") "NT AUTHORITY\SYSTEM"
|
|
13e0 "CDPSvc" ("Connected Devices Platform Service") "NT AUTHORITY\LOCAL SERVICE"
|
|
974 "CertPropSvc" ("Certificate Propagation") "NT AUTHORITY\SYSTEM"
|
|
678 "CoreMessagingRegistrar" ("CoreMessaging") "NT AUTHORITY\LOCAL SERVICE"
|
|
1be4 "CryptSvc" ("Cryptographic Services") "NT AUTHORITY\NETWORK SERVICE"
|
|
468 "DcomLaunch" ("DCOM Server Process Launcher") "NT AUTHORITY\SYSTEM"
|
|
e6c "DeviceAssociationService" ("Device Association Service") "NT AUTHORITY\SYSTEM"
|
|
acc "Dhcp" ("DHCP Client") "NT AUTHORITY\LOCAL SERVICE"
|
|
c1c "DispBrokerDesktopSvc" ("Display Policy Service") "NT AUTHORITY\LOCAL SERVICE"
|
|
2e14 "DisplayEnhancementService" ("Display Enhancement Service") "NT AUTHORITY\SYSTEM"
|
|
96c "Dnscache" ("DNS Client") "NT AUTHORITY\NETWORK SERVICE"
|
|
d38 "DusmSvc" ("Data Usage") "NT AUTHORITY\LOCAL SERVICE"
|
|
9b8 "EventLog" ("Windows Event Log") "NT AUTHORITY\LOCAL SERVICE"
|
|
a04 "EventSystem" ("COM+ Event System") "NT AUTHORITY\LOCAL SERVICE"
|
|
b74 "FontCache" ("Windows Font Cache Service") "NT AUTHORITY\LOCAL SERVICE"
|
|
32d8 "gpsvc" ("Group Policy Client") "NT AUTHORITY\SYSTEM"
|
|
434 "hidserv" ("Human Interface Device Service") "NT AUTHORITY\SYSTEM"
|
|
61c "HvHost" ("HV Host Service") "NT AUTHORITY\SYSTEM"
|
|
2a5c "InstallService" ("Microsoft Store Install Service") "NT AUTHORITY\SYSTEM"
|
|
2988 "InventorySvc" ("Inventory and Compatibility Appraisal service") "NT AUTHORITY\SYSTEM"
|
|
334 "KeyIso" ("CNG Key Isolation") "NT AUTHORITY\SYSTEM"
|
|
f54 "LanmanServer" ("Server") "NT AUTHORITY\SYSTEM"
|
|
a34 "LanmanWorkstation" ("Workstation") "NT AUTHORITY\NETWORK SERVICE"
|
|
3084 "lmhosts" ("TCP/IP NetBIOS Helper") "NT AUTHORITY\LOCAL SERVICE"
|
|
518 "LSM" ("Local Session Manager") "NT AUTHORITY\SYSTEM"
|
|
764 "NcbService" ("Network Connection Broker") "NT AUTHORITY\SYSTEM"
|
|
7b4 "netprofm" ("Network List Service") "NT AUTHORITY\NETWORK SERVICE"
|
|
150c "NgcCtnrSvc" ("Microsoft Passport Container") "NT AUTHORITY\LOCAL SERVICE"
|
|
1478 "NgcSvc" ("Microsoft Passport") "NT AUTHORITY\SYSTEM"
|
|
728 "nsi" ("Network Store Interface Service") "NT AUTHORITY\LOCAL SERVICE"
|
|
1cfc "PcaSvc" ("Program Compatibility Assistant Service") "NT AUTHORITY\SYSTEM"
|
|
468 "PlugPlay" ("Plug and Play") "NT AUTHORITY\SYSTEM"
|
|
468 "Power" ("Power") "NT AUTHORITY\SYSTEM"
|
|
76c "ProfSvc" ("User Profile Service") "NT AUTHORITY\SYSTEM"
|
|
ff8 "RasMan" ("Remote Access Connection Manager") "NT AUTHORITY\SYSTEM"
|
|
12c0 "RmSvc" ("Radio Management Service") "NT AUTHORITY\LOCAL SERVICE"
|
|
4e8 "RpcEptMapper" ("RPC Endpoint Mapper") "NT AUTHORITY\NETWORK SERVICE"
|
|
4e8 "RpcSs" ("Remote Procedure Call (RPC)") "NT AUTHORITY\NETWORK SERVICE"
|
|
334 "SamSs" ("Security Accounts Manager") "NT AUTHORITY\SYSTEM"
|
|
738 "Schedule" ("Task Scheduler") "NT AUTHORITY\SYSTEM"
|
|
b24 "SENS" ("System Event Notification Service") "NT AUTHORITY\SYSTEM"
|
|
b58 "SessionEnv" ("Remote Desktop Configuration") "NT AUTHORITY\SYSTEM"
|
|
d94 "ShellHWDetection" ("Shell Hardware Detection") "NT AUTHORITY\SYSTEM"
|
|
e64 "SstpSvc" ("Secure Socket Tunneling Protocol Service") "NT AUTHORITY\LOCAL SERVICE"
|
|
e54 "StateRepository" ("State Repository Service") "NT AUTHORITY\SYSTEM"
|
|
1178 "StiSvc" ("Windows Image Acquisition (WIA)") "NT AUTHORITY\LOCAL SERVICE"
|
|
229c "StorSvc" ("Storage Service") "NT AUTHORITY\SYSTEM"
|
|
9f4 "SysMain" ("SysMain") "NT AUTHORITY\SYSTEM"
|
|
468 "SystemEventsBroker" ("System Events Broker") "NT AUTHORITY\SYSTEM"
|
|
62c "TermService" ("Remote Desktop Services") "NT AUTHORITY\NETWORK SERVICE"
|
|
ce0 "TextInputManagementService" ("Text Input Management Service") "NT AUTHORITY\SYSTEM"
|
|
9fc "Themes" ("Themes") "NT AUTHORITY\SYSTEM"
|
|
774 "TimeBrokerSvc" ("Time Broker") "NT AUTHORITY\LOCAL SERVICE"
|
|
12e0 "TokenBroker" ("Web Account Manager") "NT AUTHORITY\SYSTEM"
|
|
8a4 "UmRdpService" ("Remote Desktop Services UserMode Port Redirector") "NT AUTHORITY\SYSTEM"
|
|
210 "UserManager" ("User Manager") "NT AUTHORITY\SYSTEM"
|
|
334 "VaultSvc" ("Credential Manager") "NT AUTHORITY\SYSTEM"
|
|
2304 "W32Time" ("Windows Time") "NT AUTHORITY\LOCAL SERVICE"
|
|
e34 "WAS" ("Windows Process Activation Service") "NT AUTHORITY\SYSTEM"
|
|
d30 "Wcmsvc" ("Windows Connection Manager") "NT AUTHORITY\LOCAL SERVICE"
|
|
bf8 "WinHttpAutoProxySvc" ("WinHTTP Web Proxy Auto-Discovery Service") "NT AUTHORITY\LOCAL SERVICE"
|
|
e5c "Winmgmt" ("Windows Management Instrumentation") "NT AUTHORITY\SYSTEM"
|
|
e4c "WpnService" ("Windows Push Notifications System Service") "NT AUTHORITY\SYSTEM"
|
|
1c04 "cbdhsvc_37199" ("Clipboard User Service_37199") "DESKTOP-2N5ODLB\Harry"
|
|
11f4 "CDPUserSvc_37199" ("Connected Devices Platform User Service_37199") "DESKTOP-2N5ODLB\Harry"
|
|
15b8 "NPSMSvc_37199" ("Now Playing Session Manager Service_37199") "DESKTOP-2N5ODLB\Harry"
|
|
1754 "UdkUserSvc_37199" ("Udk User Service_37199") "DESKTOP-2N5ODLB\Harry"
|
|
1210 "WpnUserService_37199" ("Windows Push Notifications User Service_37199") "DESKTOP-2N5ODLB\Harry"
|
|
List_Services=0
|
|
case 0x3a1032b4: // "usr"
|
|
break;
|
|
1 {00000000-0002207d} 8120 Interactive NTLM "DESKTOP-2N5ODLB" "DESKTOP-2N5ODLB\Harry" S-1-5-21-3032776714-2974785564-2375659916-1001
|
|
1 {00000000-000221bc} 8120 Interactive NTLM "DESKTOP-2N5ODLB" "DESKTOP-2N5ODLB\Harry" S-1-5-21-3032776714-2974785564-2375659916-1001
|
|
case 0x00691a3b: // "id"
|
|
break;
|
|
1890
|
|
DumpProcessThreads(6288)=c0000225
|
|
The object was not found.
|
|
The object was not found.
|