HEX
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/8.4.25
System: Windows NT DESKTOP-4TAV2RJ 10.0 build 19045 (Windows 10) AMD64
User: fred (0)
PHP: 8.4.25
Disabled: NONE
Upload Files
File: C:/Windows/System32/wbem/zh-TW/filetrace.mfl
��#pragma classflags(64)

#pragma namespace("\\\\.\\root\\wmi")

instance of __namespace{ name="ms_404";};

#pragma namespace("\\\\.\\root\\wmi\\ms_404")



[Description("File Kernel Trace; Operation Set 1") : Amended,AMENDMENT, LOCALE(0x0404)] 

class MSNT_FileBaseTrace_Set1 : EventTrace

{

  [Description("_U(u�ej") : Amended,ValueDescriptions{"�^�z", "�^�zwQ
T�{S�", "ܕ��", "���S", "�[eQ", "�gb�nj
�", "-��[nj
�", "�gb� EA", "-��[ EA", "�cn�}]�@S", "�gb��x�x@Snj
�", "-��[�x�x@Snj
�", "�v��c6R", "�jHh�|q}�c6R", "݈n�c6R�", "gQ�݈n�c6R", "ܕ_j", "���[�c6R", "nt", "�^�z���N�i", "�gb��[hQ'`", "-��[�[hQ'`", "��_j", "�|q}�c6R", "݈n���f", "�gb�M�M�", "-��[M�M�", "PNP"} : Amended] uint32 Flags;

};



[Description("File Kernel Trace; Operation Set 2") : Amended,AMENDMENT, LOCALE(0x0404)] 

class MSNT_FileBaseTrace_Set2 : EventTrace

{

  [Description("_U(u�ej") : Amended,ValueDescriptions{"Acquire For Section Tek", "Release For Section Tek", "Acquire For Mod �[eQ", "Release For Mod �[eQ", "Acquire For CC �cn", "Release For CC �cn", "��wnj�eAm�jHhir�N", "��S��GR�WL��_� IO �j�g", "�}��gb���_U", "MDL ���S", "MDL ���S�[b", "�n�P MDL �[eQ", "MDL �[eQ�[b", "�x�x@S݈	�", "�x�x@SxS	�"} : Amended] uint32 Flags;

};



[Description("File Kernel Trace; Optional Data") : Amended,AMENDMENT, LOCALE(0x0404)] 

class MSNT_FileBaseTrace_OptionalData : EventTrace

{

  [Description("_U(u�ej") : Amended,ValueDescriptions{"O(u�gQ�[", "�]\O���kX�%R�x", "
N!kX[�SBf��", "|T�S�Sxe", "|T�SP}�gnj�e", "HQMR�vnj�e", "(W�s	g�jHh
N�^�z", "U�t���z�]\O�z", "\��R� IO"} : Amended] uint32 Flags;

};



[Description("File Kernel Trace; Volume To Log") : Amended,AMENDMENT, LOCALE(0x0404)] 

class MSNT_FileBaseTrace_VolumeToLog : EventTrace

{

  [Description("_U(u�ej") : Amended,ValueDescriptions{"A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "hQ�", ",g_j", "�}�"} : Amended] uint32 Flags;

};



[Description("�jHh��d�") : Amended,DisplayName("�jHh��d�") : Amended,AMENDMENT, LOCALE(0x0404)] 

class FileTrace : MSNT_FileBaseTrace_Set1

{

};



[Description("�jHh��d��N�N") : Amended,AMENDMENT, LOCALE(0x0404)] 

class FileOperation : FileTrace

{

  [Description("�rKa") : Amended] uint32 Status;

  [Description("�d\O") : Amended] uint8 Operation;

  [Description("!k���d\O") : Amended] uint8 MinorOperation;

  [Description("�^_�") : Amended] uint32 SequenceNumber;

  [Description("�/f&T�pR��d\O") : Amended] uint8 IsPagingIO;

  [Description("�/f&T�p�_� IO �d\O") : Amended] uint8 IsFastIO;

  [Description("/f�v�") : Amended] uint8 IsDirectory;

  [Description("(W�s	g�jHh
N|T�S�^�z") : Amended] uint8 CreateOnExisting;

  [Description("���Y�d\O�vBf��") : Amended] sint64 StartTime;

  [Description("�d\OU�tz�^�vX�%R�x") : Amended] uint32 ProcessId;

  [Description("�^�zU�tz�^�vBf��") : Amended] sint64 ProcessCreateTime;

  [Description("�jHhir�N") : Amended] uint64 FileObject;

  [Description("�jHh
N!kX[�SBf��") : Amended] sint64 LastAccessTime;

  [Description("�]\O���kX�%R�x") : Amended] uint32 SessionId;

  [Description("���z�]\O�z") : Amended] uint64 WindowStation;

  [Description("X[�S Token MO@W") : Amended] uint32 AccessToken;

  [Description("O(u� SID nj�ew��^") : Amended] uint32 SidLength;

  [Description("�Sxenj�ew��^") : Amended] uint32 ParametersLength;

  [Description("P}�gnj�ew��^") : Amended] uint32 ResultLength;

  [Description("
NNP<Pw��^") : Amended] uint32 PreviousValueLength;

  [Description("O(u� SID") : Amended] object UserSID;

  [description("�d\O�Sxe") : Amended] uint8 OperationalParameters[];

  [description("�gb�P}�gnj�e") : Amended] uint8 ResultData[];

  [description("
NNP<P") : Amended] uint8 PreviousValue[];

  [Description("�jHh
T1z") : Amended] string FileName;

  [Description("�x�x@S DOS 
T1z") : Amended] string VolumeDosName;

  [Description("�x�x@S GUID 
T1z") : Amended] string VolumeGuidName;

  [Description("�x�x@S
T1z") : Amended] string VolumeName;

};