Confronta il testo

Trova la differenza tra due file di testo

Real-time diff

Unified diff

Collapse lines

Highlight change

Syntax highlighting

Strumenti

Diffchecker Desktop The most secure way to run Diffchecker. Get the Diffchecker Desktop app: your diffs never leave your computer!Get Desktop

Untitled diff

Created 6 years agoDiff never expires

Lines
Total
Removed

Words
Total
Removed

To continue using this feature, upgrade to Diffchecker Pro View Pricing

733 lines

Lines
Total
Added

Words
Total
Added

To continue using this feature, upgrade to Diffchecker Pro View Pricing

730 lines

--------------------------------------------------------------------------------

[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000

[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000

--------------------------------------------------------------------------------

Interfaces :

Endpoints :

--------------------------------------------------------------------------------

Interfaces :

RPC 76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\windows\system32\wininit.exe

RPC 76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\WINDOWS\system32\wininit.exe

0 -> I_WMsgkSendMessage

1 -> I_WMsgkSendPSPMessage

RPC 894de0c0-0d55-11d3-a322-00c04fa321a1 (1.0) -- C:\windows\system32\wininit.exe

RPC 894de0c0-0d55-11d3-a322-00c04fa321a1 (1.0) -- C:\WINDOWS\system32\wininit.exe

0 -> s_BaseInitiateShutdown

1 -> s_BaseAbortShutdown

2 -> s_BaseInitiateShutdownEx

RPC d95afe70-a6d5-4259-822e-2c84da1ddb0d (1.0) -- C:\windows\system32\wininit.exe

RPC d95afe70-a6d5-4259-822e-2c84da1ddb0d (1.0) -- C:\WINDOWS\system32\wininit.exe

0 -> s_WsdrInitiateShutdown

1 -> s_WsdrAbortShutdown

2 -> s_WsdrCheckForHiberboot

RPC 76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\windows\system32\wininit.exe

RPC 76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\WINDOWS\system32\wininit.exe

0 -> I_WMsgSendMessage

1 -> I_WMsgSendPSPMessage

2 -> I_WMsgSendNotifyMessage

3 -> I_WMsgSendReconnectionUpdateMessage

Endpoints :

ncalrpc : WMsgKRpc0551A0

ncalrpc : WMsgKRpc017ED30

ncacn_np : \PIPE\InitShutdown

ncalrpc : WindowsShutdown

ncacn_ip_tcp : 49664

ncacn_ip_tcp : 1536

--------------------------------------------------------------------------------

Interfaces :

Endpoints :

--------------------------------------------------------------------------------

Interfaces :

RPC 76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\windows\system32\winlogon.exe

0 -> I_WMsgkSendMessage

1 -> I_WMsgkSendPSPMessage

RPC 76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\windows\system32\winlogon.exe

0 -> I_WMsgSendMessage

1 -> I_WMsgSendPSPMessage

2 -> I_WMsgSendNotifyMessage

3 -> I_WMsgSendReconnectionUpdateMessage

Endpoints :

ncalrpc : WMsgKRpc058201

--------------------------------------------------------------------------------

Interfaces :

RPC 367abb81-9844-35f1-ad32-98f038001003 (2.0) -- C:\windows\system32\services.exe

RPC 367abb81-9844-35f1-ad32-98f038001003 (2.0) -- C:\WINDOWS\system32\services.exe

0 -> RCloseServiceHandle

1 -> RControlService

2 -> RDeleteService

3 -> RLockServiceDatabase

4 -> RQueryServiceObjectSecurity

5 -> RSetServiceObjectSecurity

6 -> RQueryServiceStatus

7 -> RSetServiceStatus

8 -> RUnlockServiceDatabase

9 -> RNotifyBootConfigStatus

10 -> RI_ScSetServiceBitsW

11 -> RChangeServiceConfigW

12 -> RCreateServiceW

13 -> REnumDependentServicesW

14 -> REnumServicesStatusW

15 -> ROpenSCManagerW

16 -> ROpenServiceW

17 -> RQueryServiceConfigW

18 -> RQueryServiceLockStatusW

19 -> RStartServiceW

20 -> RGetServiceDisplayNameW

21 -> RGetServiceKeyNameW

22 -> CServiceRecord::GetStatusInternal

23 -> RChangeServiceConfigA

24 -> RCreateServiceA

25 -> REnumDependentServicesA

26 -> REnumServicesStatusA

27 -> ROpenSCManagerA

28 -> ROpenServiceA

29 -> RQueryServiceConfigA

30 -> RQueryServiceLockStatusA

31 -> RStartServiceA

32 -> RGetServiceDisplayNameA

33 -> RGetServiceKeyNameA

34 -> CServiceRecord::GetStatusInternal

35 -> REnumServiceGroupW

36 -> RChangeServiceConfig2A

37 -> RChangeServiceConfig2W

38 -> RQueryServiceConfig2A

39 -> RQueryServiceConfig2W

40 -> RQueryServiceStatusEx

41 -> REnumServicesStatusExA

42 -> REnumServicesStatusExW

43 -> RI_ScBroadcastServiceControlMessage

44 -> RCreateServiceWOW64A

45 -> RCreateServiceWOW64W

46 -> RI_ScQueryServiceTagInfo

47 -> RNotifyServiceStatusChange

48 -> RGetNotifyResults

49 -> RCloseNotifyHandle

50 -> RControlServiceExA

51 -> RControlServiceExW

52 -> RI_ScSendPnPMessage

53 -> RI_ScValidatePnPService

54 -> RI_ScOpenServiceStatusHandle

55 -> RI_ScQueryServiceConfig

56 -> RQueryServiceConfigEx

57 -> RI_ScRegisterPreshutdownRestart

58 -> RI_ScReparseServiceDatabase

59 -> RQueryUserServiceName

60 -> RCreateWowService

61 -> RGetServiceRegistryStateKey

62 -> RGetServiceDirectory

63 -> RGetServiceProcessToken

RPC a2c45f7c-7d32-46ad-96f5-adafb486be74 (1.0) -- C:\WINDOWS\system32\services.exe

RPC a2c45f7c-7d32-46ad-96f5-adafb486be74 (1.0) -- C:\windows\system32\services.exe

0 -> RI_ScOpenServiceChannelHandle

1 -> RI_ScSendResponseReceiveControls

2 -> RI_ScCloseServiceChannelHandle

RPC 93149ca2-973b-11d1-8c39-00c04fb984f9 (0.0) -- C:\windows\SYSTEM32\scesrv.dll

RPC 93149ca2-973b-11d1-8c39-00c04fb984f9 (0.0) -- C:\WINDOWS\SYSTEM32\scesrv.dll

0 -> SceSvcRpcQueryInfo

1 -> SceSvcRpcSetInfo

2 -> SceRpcSetupUpdateObject

3 -> SceRpcSetupMoveFile

4 -> SceRpcGenerateTemplate

5 -> SceRpcConfigureSystem

6 -> SceRpcGetDatabaseInfo

7 -> SceRpcGetObjectChildren

8 -> SceRpcOpenDatabase

9 -> SceRpcCloseDatabase

10 -> SceRpcGetDatabaseDescription

11 -> SceRpcGetDBTimeStamp

12 -> SceRpcGetObjectSecurity

13 -> SceRpcGetAnalysisSummary

14 -> SceRpcAnalyzeSystem

15 -> SceRpcUpdateDatabaseInfo

16 -> SceRpcUpdateObjectInfo

17 -> SceRpcStartTransaction

18 -> SceRpcCommitTransaction

19 -> SceRpcRollbackTransaction

20 -> SceRpcGetServerProductType

21 -> SceSvcRpcUpdateInfo

22 -> SceRpcCopyObjects

23 -> SceRpcSetupResetLocalPolicy

24 -> SceRpcNotifySaveChangesInGP

25 -> SceRpcControlNotificationQProcess

26 -> SceRpcBrowseDatabaseTable

27 -> SceRpcGetSystemSecurity

28 -> SceRpcGetSystemSecurity

29 -> SceRpcSetSystemSecurity

30 -> SceRpcSetSystemSecurity

31 -> SceRpcSetDatabaseSetting

32 -> SceRpcGetDatabaseSetting

33 -> SceRpcConfigureConvertedFileSecurityImmediately

Endpoints :

ncalrpc : ntsvcs

ncacn_np : \pipe\ntsvcs

ncacn_np : \PIPE\scerpc

ncacn_ip_tcp : 49677

ncacn_ip_tcp : 1543

--------------------------------------------------------------------------------

[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000

--------------------------------------------------------------------------------

['KeyIso', 'SamSs', 'VaultSvc']

Interfaces :

RPC 12345778-1234-abcd-ef00-0123456789ab (0.0) -- C:\windows\system32\lsasrv.dll

RPC 12345778-1234-abcd-ef00-0123456789ab (0.0) -- C:\WINDOWS\system32\lsasrv.dll

0 -> LsarClose

1 -> CredrRename

2 -> LsarEnumeratePrivileges

3 -> LsarQuerySecurityObject

4 -> LsarSetSecurityObject

5 -> LsaITestCall

6 -> LsarOpenPolicyRPC

7 -> LsarQueryInformationPolicy

8 -> LsarSetInformationPolicy

9 -> LsaITestCall

10 -> LsarCreateAccount

11 -> LsarEnumerateAccounts

12 -> LsarCreateTrustedDomain

13 -> LsarEnumerateTrustedDomains

14 -> LsarLookupNames

15 -> LsarLookupSids

16 -> LsarCreateSecret

17 -> LsarOpenAccount

18 -> LsarEnumeratePrivilegesAccount

19 -> LsarAddPrivilegesToAccount

20 -> LsarRemovePrivilegesFromAccount

21 -> LsarGetQuotasForAccount

22 -> LsarSetQuotasForAccount

23 -> LsarGetSystemAccessAccount

24 -> LsarSetSystemAccessAccount

25 -> LsarOpenTrustedDomain

26 -> LsarQueryInfoTrustedDomain

27 -> LsarSetInformationTrustedDomain

28 -> LsarOpenSecret

29 -> LsarSetSecret

30 -> LsarQuerySecret

31 -> LsarLookupPrivilegeValue

32 -> LsarLookupPrivilegeName

33 -> LsarLookupPrivilegeDisplayName

34 -> LsarDeleteObject

35 -> LsarEnumerateAccountsWithUserRight

36 -> LsarEnumerateAccountRights

37 -> LsarAddAccountRights

38 -> LsarRemoveAccountRights

39 -> LsarQueryTrustedDomainInfo

40 -> LsarSetTrustedDomainInfo

41 -> LsarDeleteTrustedDomain

42 -> LsarStorePrivateData

43 -> LsarRetrievePrivateData

44 -> LsarOpenPolicy2

45 -> LsarGetUserName

46 -> LsarQueryInformationPolicy2

47 -> LsarSetInformationPolicy2

48 -> LsarQueryTrustedDomainInfoByName

49 -> LsarSetTrustedDomainInfoByName

50 -> LsarEnumerateTrustedDomainsEx

51 -> LsarCreateTrustedDomainEx

52 -> LsaITestCall

53 -> LsarQueryDomainInformationPolicy

54 -> LsarSetDomainInformationPolicy

55 -> LsarOpenTrustedDomainByName

56 -> LsaITestCall

57 -> LsarLookupSids2

58 -> LsarLookupNames2

59 -> LsarCreateTrustedDomainEx2

60 -> CredrWrite

61 -> CredrRead

62 -> CredrEnumerate

63 -> CredrWriteDomainCredentials

64 -> CredrReadDomainCredentials

65 -> CredrDelete

66 -> CredrGetTargetInfo

67 -> CredrProfileLoaded

68 -> LsarLookupNames3

69 -> CredrGetSessionTypes

70 -> LsarRegisterAuditEvent

71 -> LsarGenAuditEvent

72 -> LsarUnregisterAuditEvent

73 -> LsarQueryForestTrustInformation

74 -> LsarSetForestTrustInformation

75 -> CredrRename

76 -> LsarLookupSids3

77 -> LsarLookupNames4

78 -> LsarOpenPolicySce

79 -> LsarAdtRegisterSecurityEventSource

80 -> LsarAdtUnregisterSecurityEventSource

81 -> LsarAdtReportSecurityEvent

82 -> CredrFindBestCredential

83 -> LsarSetAuditPolicy

84 -> LsarQueryAuditPolicy

85 -> LsarEnumerateAuditPolicy

86 -> LsarEnumerateAuditCategories

87 -> LsarEnumerateAuditSubCategories

88 -> LsarLookupAuditCategoryName

89 -> LsarLookupAuditSubCategoryName

90 -> LsarSetAuditSecurity

91 -> LsarQueryAuditSecurity

92 -> CredrReadByTokenHandle

93 -> CredrRestoreCredentials

94 -> CredrBackupCredentials

95 -> LsarManageSidNameMapping

96 -> CredrProfileUnloaded

97 -> CredrRename

98 -> CredrRename

99 -> CredrRename

100 -> CredrRename

101 -> CredrRename

102 -> LsarEfsGetSmartcardCredentials

103 -> LsarAuditSetGlobalSacl

104 -> LsarAuditQueryGlobalSacl

105 -> CredrProfileLoadedEx

106 -> LsarInteractiveSessionIsLoggedOff

107 -> LsarConfigureAutoLogonCredentials

108 -> LsarGetDeviceRegistrationInfo

109 -> LsaITestCall

110 -> LsarProfileDeleted

111 -> LsaITestCall

112 -> CredrRename

112 -> LsarMakeLogonSessionsSiblings

113 -> LsarValidateProcUniqueLuid

114 -> LsarIsArsoAllowedByPolicy

115 -> LsarIsArsoAllowedByConsent

116 -> LsarEnableArsoConsent

117 -> LsarDisableArsoConsent

118 -> LsarIsArsoAllowedByPolicy

119 -> LsarIsUserArsoEnabled

120 -> LsarEnableUserArso

121 -> LsarDisableUserArso

122 -> LsarConfigureUserArso

123 -> LsarGetInprocDispatchTable

124 -> LsarSetSharedUserSession

125 -> LsarClearSharedUserSession

126 -> LsarEnablePasswordLessCurrentUser

RPC ace1c026-8b3f-4711-8918-f345d17f5bff (1.0) -- C:\WINDOWS\system32\lsasrv.dll

127 -> LsarDisablePasswordLessCurrentUser

RPC ace1c026-8b3f-4711-8918-f345d17f5bff (1.0) -- C:\windows\system32\lsasrv.dll

0 -> S_RPC_LspUpdatePrivateData

1 -> S_RPC_LspReadPrivateData

RPC afc07e2e-311c-4435-808c-c483ffeec7c9 (1.0) -- C:\windows\system32\lsasrv.dll

RPC afc07e2e-311c-4435-808c-c483ffeec7c9 (1.0) -- C:\WINDOWS\system32\lsasrv.dll

0 -> LsarGetAvailableCAPIDs

1 -> LsarSetCAPs

2 -> LsarQueryCAPs

RPC c0d930f0-b787-4124-99bc-21f0ecb642ce (0.0) -- C:\windows\system32\lsasrv.dll

RPC c0d930f0-b787-4124-99bc-21f0ecb642ce (0.0) -- C:\WINDOWS\system32\lsasrv.dll

0 -> LsarConnectLocalUser

1 -> LsarDisconnectLocalUser

2 -> LsarCreateConnectedUser

3 -> LsarIsCurrentUserConnected

4 -> LsarRenewCertificate

5 -> LsarGetSSOAccountType

6 -> LsarIsUserMSA

RPC d25576e4-00d2-43f7-98f9-b4c0724158f9 (0.0) -- C:\windows\system32\lsasrv.dll

RPC d25576e4-00d2-43f7-98f9-b4c0724158f9 (0.0) -- C:\WINDOWS\system32\lsasrv.dll

0 -> LsarEasMarkUserControlled

1 -> LsarEasGetCallerPasswordComplexity

2 -> LsarEasGetControlledUsersInfo

RPC c681d488-d850-11d0-8c52-00c04fd90f7e (1.0) -- C:\windows\system32\efslsaext.dll

RPC c681d488-d850-11d0-8c52-00c04fd90f7e (1.0) -- C:\WINDOWS\system32\efslsaext.dll

0 -> EfsRpcOpenFileRaw_Downlevel

1 -> EfsRpcReadFileRaw_Downlevel

2 -> EfsRpcWriteFileRaw_Downlevel

3 -> EfsRpcCloseRaw_Downlevel

4 -> EfsRpcEncryptFileSrv_Downlevel

5 -> EfsRpcDecryptFileSrv_Downlevel

6 -> EfsRpcQueryUsersOnFile_Downlevel

7 -> EfsRpcQueryRecoveryAgents_Downlevel

8 -> EfsRpcRemoveUsersFromFile_Downlevel

9 -> EfsRpcAddUsersToFile_Downlevel

10 -> EfsRpcFileKeyInfoEx_Downlevel

11 -> EfsRpcFileKeyInfoEx_Downlevel

12 -> EfsRpcFileKeyInfo_Downlevel

13 -> EfsRpcDuplicateEncryptionInfoFile_Downlevel

14 -> EfsRpcFileKeyInfoEx_Downlevel

15 -> EfsRpcAddUsersToFileEx_Downlevel

16 -> EfsRpcFileKeyInfoEx_Downlevel

17 -> EfsRpcFileKeyInfoEx_Downlevel

18 -> EfsRpcFileKeyInfoEx_Downlevel

19 -> EfsRpcFileKeyInfoEx_Downlevel

20 -> EfsRpcFlushEfsCache_Downlevel

RPC fb8a0729-2d04-4658-be93-27b4ad553fac (1.0) -- C:\windows\system32\lsass.exe

RPC fb8a0729-2d04-4658-be93-27b4ad553fac (1.0) -- C:\WINDOWS\system32\lsass.exe

0 -> LsaLookuprOpenPolicy2

1 -> LsaLookuprClose

2 -> LsaLookuprTranslateSids2

3 -> LsaLookuprTranslateNames3

4 -> LsaLookuprManageCache

5 -> LsaLookuprGetDomainInfo

6 -> LsaLookuprUserAccountType

RPC 4f32adc8-6052-4a04-8701-293ccf2096f0 (1.0) -- C:\windows\SYSTEM32\SspiSrv.dll

RPC 4f32adc8-6052-4a04-8701-293ccf2096f0 (1.0) -- C:\WINDOWS\SYSTEM32\SspiSrv.dll

0 -> SspirConnectRpc

1 -> SspirDisconnectRpc

2 -> SspirDisconnectRpc

3 -> SspirCallRpc

4 -> SspirAcquireCredentialsHandle

5 -> SspirFreeCredentialsHandle

6 -> SspirProcessSecurityContext

7 -> SspirDeleteSecurityContext

8 -> SspirSslQueryCredentialsAttributes

9 -> SspirNegQueryContextAttributes

10 -> SspirSslSetCredentialsAttributes

11 -> SspirApplyControlToken

12 -> SspirLogonUser

13 -> SspirLookupAccountSid

14 -> SspirGetUserName

15 -> SspirGetInprocDispatchTable

RPC 11220835-5b26-4d94-ae86-c3e475a809de (1.0) -- C:\windows\system32\dpapisrv.dll

RPC 11220835-5b26-4d94-ae86-c3e475a809de (1.0) -- C:\WINDOWS\system32\dpapisrv.dll

0 -> s_SSCryptProtectData

1 -> s_SSCryptUnprotectData

2 -> s_SSCryptUpdateProtectedState

RPC 5cbe92cb-f4be-45c9-9fc9-33e73e557b20 (1.0) -- C:\windows\system32\dpapisrv.dll

RPC 5cbe92cb-f4be-45c9-9fc9-33e73e557b20 (1.0) -- C:\WINDOWS\system32\dpapisrv.dll

0 -> s_SSRecoverQueryStatus

1 -> s_SSRecoverImportRecoveryKey

2 -> s_SSRecoverPassword

RPC 7f1317a8-4dea-4fa2-a551-df5516ff8879 (1.0) -- C:\windows\system32\dpapisrv.dll

RPC 7f1317a8-4dea-4fa2-a551-df5516ff8879 (1.0) -- C:\WINDOWS\system32\dpapisrv.dll

0 -> s_LRpcSIDKeyProtect

1 -> s_LRpcSIDKeyUnprotect

RPC 3919286a-b10c-11d0-9ba8-00c04fd92ef5 (0.0) -- C:\windows\system32\lsasrv.dll

RPC 3919286a-b10c-11d0-9ba8-00c04fd92ef5 (0.0) -- C:\WINDOWS\system32\lsasrv.dll

0 -> DsRolerGetPrimaryDomainInformation

RPC 12345778-1234-abcd-ef00-0123456789ac (1.0) -- C:\windows\SYSTEM32\samsrv.dll

RPC 12345778-1234-abcd-ef00-0123456789ac (1.0) -- C:\WINDOWS\SYSTEM32\samsrv.dll

0 -> SamrConnect

1 -> SamrCloseHandle

2 -> SamrSetSecurityObject

3 -> SamrQuerySecurityObject

4 -> SamrShutdownSamServer

5 -> SamrLookupDomainInSamServer

6 -> SamrEnumerateDomainsInSamServer

7 -> SamrOpenDomain

8 -> SamrQueryInformationDomain

9 -> SamrSetInformationDomain

10 -> SamrCreateGroupInDomain

11 -> SamrEnumerateGroupsInDomain

12 -> SamrCreateUserInDomain

13 -> SamrEnumerateUsersInDomain

14 -> SamrCreateAliasInDomain

15 -> SamrEnumerateAliasesInDomain

16 -> SamrGetAliasMembership

17 -> SamrLookupNamesInDomain

18 -> SamrLookupIdsInDomain

19 -> SamrOpenGroup

20 -> SamrQueryInformationGroup

21 -> SamrSetInformationGroup

22 -> SamrAddMemberToGroup

23 -> SamrDeleteGroup

24 -> SamrRemoveMemberFromGroup

25 -> SamrGetMembersInGroup

26 -> SamrSetMemberAttributesOfGroup

27 -> SamrOpenAlias

28 -> SamrQueryInformationAlias

29 -> SamrSetInformationAlias

30 -> SamrDeleteAlias

31 -> SamrAddMemberToAlias

32 -> SamrRemoveMemberFromAlias

33 -> SamrGetMembersInAlias

34 -> SamrOpenUser

35 -> SamrDeleteUser

36 -> SamrQueryInformationUser

37 -> SamrSetInformationUser

38 -> SamrChangePasswordUser

39 -> SamrGetGroupsForUser

40 -> SamrQueryDisplayInformation

41 -> SamrGetDisplayEnumerationIndex

42 -> SamrTestPrivateFunctionsDomain

43 -> SamrTestPrivateFunctionsUser

44 -> SamrGetUserDomainPasswordInformation

45 -> SamrRemoveMemberFromForeignDomain

46 -> SamrQueryInformationDomain2

47 -> SamrQueryInformationUser2

48 -> SamrQueryDisplayInformation2

49 -> SamrGetDisplayEnumerationIndex2

50 -> SamrCreateUser2InDomain

51 -> SamrQueryDisplayInformation3

52 -> SamrAddMultipleMembersToAlias

53 -> SamrRemoveMultipleMembersFromAlias

54 -> SamrOemChangePasswordUser2

55 -> SamrUnicodeChangePasswordUser2

56 -> SamrGetDomainPasswordInformation

57 -> SamrConnect2

58 -> SamrSetInformationUser2

59 -> SamrSetBootKeyInformation

60 -> SamrGetBootKeyInformation

61 -> SamrConnect3

62 -> SamrConnect4

63 -> SamrUnicodeChangePasswordUser3

64 -> SamrConnect5

65 -> SamrRidToSid

66 -> SamrSetDSRMPassword

67 -> SamrValidatePassword

68 -> SamrQueryLocalizableAccountsInDomain

69 -> SamrPerformGenericOperation

70 -> SamrSyncDSRMPasswordFromAccount

71 -> SamrLookupNamesInDomain2

72 -> SamrEnumerateUsersInDomain2

RPC b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 (2.0) -- C:\windows\system32\keyiso.dll

RPC b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 (2.0) -- C:\WINDOWS\system32\keyiso.dll

0 -> s_SrvRpcCreateContext

1 -> s_SrvRpcReleaseContext

2 -> s_SrvRpcCryptOpenStorageProvider

3 -> s_SrvRpcCryptIsAlgSupported

4 -> s_SrvRpcCryptEnumAlgorithms

5 -> s_SrvRpcCryptEnumKeys

6 -> s_SrvRpcCryptFreeBuffer

7 -> s_SrvRpcCryptFreeProvider

8 -> s_SrvRpcCryptFreeKey

9 -> s_SrvRpcCryptOpenKey

10 -> s_SrvRpcCryptCreatePersistedKey

11 -> s_SrvRpcCryptGetProviderProperty

12 -> s_SrvRpcCryptSetProviderProperty

13 -> s_SrvRpcCryptGetKeyProperty

14 -> s_SrvRpcCryptSetKeyProperty

15 -> s_SrvRpcCryptFinalizeKey

16 -> s_SrvRpcCryptEncrypt

17 -> s_SrvRpcCryptDecrypt

18 -> s_SrvRpcCryptImportKey

19 -> s_SrvRpcCryptExportKey

20 -> s_SrvRpcCryptSignHash

21 -> s_SrvRpcCryptVerifySignature

22 -> s_SrvRpcCryptDeleteKey

23 -> s_SrvRpcCryptNotifyChangeKey

24 -> s_SrvRpcCryptSecretAgreement

25 -> s_SrvRpcCryptDeriveKey

26 -> s_SrvRpcCryptFreeSecret

27 -> s_SrvRpcCryptCipherEncrypt

28 -> s_SrvRpcCryptCipherDecrypt

29 -> s_SrvRpcCryptKeyDerivation

30 -> s_SrvRpcCryptCreateClaim

31 -> s_SrvRpcCryptVerifyClaim

RPC 8fb74744-b2ff-4c00-be0d-9ef9a191fe1b (1.0) -- C:\windows\system32\keyiso.dll

RPC 8fb74744-b2ff-4c00-be0d-9ef9a191fe1b (1.0) -- C:\WINDOWS\system32\keyiso.dll

0 -> s_GetSymmetricPopKeyTransportKey

1 -> s_GetSymmetricPopKeyTransportKeyName

2 -> s_DeleteSymmetricPopKeyTransportKey

3 -> s_ImportSymmetricPopKey

4 -> s_SignWithSymmetricPopKey

5 -> s_VerifyWithSymmetricPopKey

6 -> s_DecryptWithSymmetricPopKey

7 -> s_EncryptWithSymmetricPopKey

8 -> s_GetKeyAttestationForContainerService

9 -> s_RenewKeyAttestation

10 -> s_GetPregenUserKey

11 -> s_GetPregenKeyState

RPC 51a227ae-825b-41f2-b4a9-1ac9557a1018 (1.0) -- C:\windows\system32\keyiso.dll

RPC 51a227ae-825b-41f2-b4a9-1ac9557a1018 (1.0) -- C:\WINDOWS\system32\keyiso.dll

0 -> s_TokenBindingGenerateTpmKeyFromSoftware

RPC bb8b98e8-84dd-45e7-9f34-c3fb6155eeed (1.0) -- C:\Windows\System32\vaultsvc.dll

0 -> VltCreateItemType

1 -> VltDeleteItemType

2 -> VltEnumerateItemTypes

3 -> VltAddItem

4 -> VltFindItems

5 -> VltEnumerateItems

6 -> VltGetItem

7 -> VltRemoveItem

8 -> VltGetItemType

9 -> VltOpenVault

10 -> VltCloseVault

11 -> VltGetInformation

12 -> VltEnumerateVaults

13 -> VltEnumerateSettingUnits

14 -> VltGetSettingUnit

15 -> VltApplySettingUnit

16 -> VltRemoveSettingUnit

17 -> VltTriggerSync

18 -> VltGetSettingUnitInfo

Endpoints :

ncacn_np : \pipe\lsass

ncalrpc : audit

ncalrpc : securityevent

ncalrpc : LSARPC_ENDPOINT

ncalrpc : lsacap

ncalrpc : LSA_IDPEXT_ENDPOINT

ncalrpc : LSA_EAS_ENDPOINT

ncalrpc : lsapolicylookup

ncalrpc : lsasspirpc

ncalrpc : protected_storage

ncalrpc : SidKey Local End Point

ncalrpc : samss lpc

ncacn_ip_tcp : 49678

ncacn_ip_tcp : 1635

ncalrpc : Vault

--------------------------------------------------------------------------------

['PlugPlay']

Interfaces :

Endpoints :

--------------------------------------------------------------------------------

[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000

--------------------------------------------------------------------------------

[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000

--------------------------------------------------------------------------------

['BrokerInfrastructure', 'DcomLaunch', 'Power', 'SystemEventsBroker']

Interfaces :

RPC 6c9b7b96-45a8-4cca-9eb3-e21ccf8b5a89 (1.1) -- c:\windows\system32\umpo.dll

0 -> UmpoRpcGetPowerConfiguration

1 -> UmpoRpcReadFromSystemPowerKey

2 -> UmpoRpcReadFromUserPowerKey

3 -> UmpoRpcReadACValue

4 -> UmpoRpcReadDCValue

5 -> UmpoRpcWriteToSystemPowerKey

6 -> UmpoRpcWriteToUserPowerKey

7 -> UmpoRpcApplyPowerRequestOverride

8 -> UmpoRpcApplyPowerSetting

9 -> UmpoRpcSetActiveScheme

10 -> UmpoRpcGetActiveScheme

11 -> UmpoRpcSetActiveOverlayScheme

12 -> UmpoRpcGetActualOverlayScheme

13 -> UmpoRpcGetEffectiveOverlayScheme

14 -> UmpoRpcGetOverlaySchemes

15 -> UmpoRpcRestoreDefaultScheme

16 -> UmpoRpcRestoreDefaultSchemesAll

17 -> UmpoRpcDuplicateScheme

18 -> UmpoRpcDeleteScheme

19 -> UmpoRpcImportScheme

20 -> UmpoRpcReplaceDefaultPowerSchemes

21 -> UmpoRpcLegacyEventRegisterNotification

22 -> UmpoRpcEnumerate

23 -> UmpoRpcReadSecurityDescriptor

24 -> UmpoRpcWriteSecurityDescriptor

25 -> UmpoRpcSettingAccessCheck

26 -> UmpoRpcCreateSetting

27 -> UmpoRpcCreatePossibleSetting

28 -> UmpoRpcRemoveSetting

29 -> UmpoSetExpectedUserAwayIntervals

30 -> UmpoClearExpectedUserAwayIntervals

31 -> UmpoGetMinUserAwayPredictionInterval

32 -> UmpoRpcGetAdaptiveStandbyDiagnostics

RPC 9b8699ae-0e44-47b1-8e7f-86a461d7ecdc (0.0) -- c:\windows\system32\rpcss.dll

0 -> _LaunchActivatorServer

1 -> _LaunchRunAsServer

2 -> _LaunchService

3 -> _LaunchWinRTActivatorServer

3 -> LaunchWinRTActivatorServer

4 -> _LaunchWinRTRunAsServer

5 -> _LaunchWinRTService

6 -> _CertifyServerIdentity

7 -> _QueryNTService

8 -> _QueryNTServiceType

9 -> ControlNTService

10 -> PrivTranslateShareName

10 -> PrivRunAsSetWinstaDesktop

11 -> GenericStreamBase<IMarshalingStream,AllocationWrapper>::Commit

11 -> PrivRunAsRelease

12 -> IsPortOpen

12 -> PrivRunAsInvalidateAndRelease

13 -> TickleActivationSettings

13 -> PrivTranslateShareName

14 -> QueryProcessArchitecture

14 -> GenericMarshalingStreamWithContextAttributesViaCallback<<lambda_9644d90489056d7e1fb2e547ff4245ea> >::Clone

15 -> PrivilegedNotifyWinRTActivationStoreChanged

15 -> IsPortOpen

16 -> _QueryUserSidForSession

16 -> TickleActivationSettings

17 -> PrivActivatePsmServer

17 -> QueryProcessArchitecture

18 -> _PrivGetUserTokenForSession

18 -> PrivilegedNotifyWinRTActivationStoreChanged

19 -> PrivGetBrokerToken

19 -> _QueryUserSidForSession

20 -> PrivGetDesktopWinRTBrokerToken

20 -> PrivActivatePsmServer

21 -> PrivGetPsmToken

21 -> _PrivGetUserTokenForSession

22 -> GetSessionUserTokenCacheDetails

22 -> PrivGetBrokerToken

23 -> PrivilegedNotifyComClassChangesFromDeployment

23 -> PrivGetDesktopWinRTBrokerToken

24 -> PrivGetPsmTokenWithDynamicId

24 -> PrivGetPsmToken

25 -> PrivGetInteractiveUserToken

25 -> GetSessionUserTokenCacheDetails

26 -> PrivReportUnhealthyProcess

26 -> PrivilegedNotifyComClassChangesFromDeployment

27 -> PrivNormalizePsmTokenHostId

27 -> PrivGetPsmTokenWithDynamicId

28 -> PrivGetInteractiveUserToken

29 -> PrivReportUnhealthyProcess

RPC 4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvActivateApplication

1 -> PsmSrvCloseActivationChannel

2 -> PsmSrvOpenActivationChannel

3 -> PsmSrvRegisterProcess

RPC 085b0334-e454-4d91-9b8c-4134f9e793f3 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvOpenManagementChannel

0 -> PsmSrvInitializeExtension

1 -> PsmSrvSetApplicationState

1 -> PsmSrvOpenManagementChannel

2 -> PsmSrvSetApplicationPriority

2 -> PsmSrvSetApplicationState

3 -> PsmSrvReleaseCacheEntry

3 -> PsmSrvSetApplicationPriority

4 -> PsmSrvAcquireCachedEntries

4 -> PsmSrvReleaseCacheEntry

5 -> PsmSrvQueryApplicationSwapState

5 -> PsmSrvAcquireCachedEntries

6 -> PsmSrvCloseActivationChannel

6 -> PsmSrvQueryApplicationSwapState

7 -> PsmSrvSetApplicationProperties

7 -> PsmSrvCloseActivationChannel

8 -> PsmSrvQueryApplicationProperties

8 -> PsmSrvSetApplicationProperties

9 -> PsmSrvQueryApplicationResourceUsage

9 -> PsmSrvQueryApplicationProperties

10 -> PsmSrvQueryMemoryUsage

10 -> PsmSrvQueryApplicationResourceUsage

11 -> PsmSrvResetMaxMemoryUsage

11 -> PsmSrvQueryMemoryUsage

12 -> PsmSrvQuerySharedCommit

12 -> PsmSrvResetMaxMemoryUsage

13 -> PsmSrvQuerySharedCommit

RPC 8782d3b9-ebbd-4644-a3d8-e8725381919b (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvRegisterQuiesceResumeApp

1 -> PsmSrvQuiesceCallbacksComplete

2 -> PsmSrvCloseActivationChannel

RPC 3b338d89-6cfa-44b8-847e-531531bc9992 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvQueryApplicationPerformanceInformation

1 -> PsmSrvQueryQuotaInformation

RPC bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvOpenTcChannel

1 -> PsmSrvApplyTaskCompletion

2 -> PsmSrvRegisterDynamicProcess

3 -> PsmSrvCloseActivationChannel

4 -> PsmSrvGetSessionInfo

RPC 5824833b-3c1a-4ad2-bdfd-c31d19e23ed2 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvRegisterAppPriorityNotification

1 -> PsmSrvQueryApplicationResourceUsageForTimer

2 -> PsmSrvTimerStart

3 -> PsmSrvTimerCleanup

4 -> PsmSrvTimerRemainingResourceTimeGet

5 -> PsmSrvTimerElapsedResourceTimeGet

RPC 0361ae94-0316-4c6c-8ad8-c594375800e2 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvQueryCurrentApplications

1 -> PsmSrvQueryApplicationHosts

2 -> PsmSrvQueryApplicationHostExecutionState

3 -> PsmSrvQueryApplicationHostJob

4 -> PsmSrvConnect

5 -> PsmSrvDisconnect

6 -> PsmSrvSubscribeToNotifications

7 -> PsmSrvUnsubscribeFromNotifications

RPC 2d98a740-581d-41b9-aa0d-a88b9d5ce938 (1.0) -- C:\windows\SYSTEM32\bisrv.dll

RPC 2d98a740-581d-41b9-aa0d-a88b9d5ce938 (1.0) -- c:\windows\system32\bisrv.dll

0 -> RBiSrvActivateDeferredWorkItem

1 -> RBiSrvActivateInBackground

2 -> RBiSrvActivateWorkItem

3 -> RBiSrvAssociateActivationProxy

4 -> RBiSrvAssociateApplicationExtensionClass

5 -> RBiSrvCancelWorkItem

6 -> RBiSrvCreateEvent

7 -> RBiSrvCreateEventForPackageName

8 -> RBiSrvDeleteEvent

9 -> RBiSrvDisassociateWorkItem

10 -> RBiSrvDiscardPendingActivations

11 -> RBiSrvEnumerateBrokeredEvents

12 -> RBiSrvEnumerateUserContexts

13 -> RBiSrvEnumerateUserSessions

14 -> RBiSrvEnumerateWorkItemsForPackageName

15 -> RBiPtSrvGetStatusStateNameFromBrokerEventId

15 -> RBiSrvQueryBrokeredEvent

16 -> RBiSrvQueryBrokeredEvent

16 -> RBiSrvQuerySystemStateBroadcastChannels

17 -> RBiSrvQuerySystemStateBroadcastChannels

17 -> RBiSrvQueryUserContext

18 -> RBiSrvQueryUserContext

18 -> RBiSrvQueryUserSession

19 -> RBiSrvQueryUserSession

19 -> RBiSrvQueryWorkItem

20 -> RBiSrvQueryWorkItem

20 -> RBiPtSrvQueryWorkItemStatusStateName

21 -> RBiPtSrvQueryWorkItemStatusStateName

21 -> RBiSrvSignalEvent

22 -> RBiSrvSignalEvent

22 -> RBiSrvSignalMultipleEvents

23 -> RBiSrvSignalMultipleEvents

23 -> RBiSrvSignalTriggerEvent

24 -> RBiSrvSignalTriggerEvent

24 -> RBiSrvUpdateEventParameters

25 -> RBiSrvUpdateEventParameters

25 -> RBiSrvUpdateEventFlags

26 -> RBiSrvUpdateEventFlags

26 -> RBiSrvUpdateEventInformation

27 -> RBiSrvUpdateEventInformation

RPC 8bfc3be1-6def-4e2d-af74-7c47cd0ade4a (1.0) -- c:\windows\system32\bisrv.dll

RPC 8bfc3be1-6def-4e2d-af74-7c47cd0ade4a (1.0) -- C:\windows\SYSTEM32\bisrv.dll

0 -> RBiSrvActivateWorkItemForUser

1 -> RBiSrvChangeApplicationStateForPackageNameForUser

2 -> RBiSrvChangeApplicationStateForPsmKeyForUser

3 -> RBiSrvChangeUserState

4 -> RBiSrvEnumerateWorkItemsForPackageNameAndUser

5 -> RBiSrvGetActiveBackgroundTasksEventForUser

6 -> RBiSrvGetCancellationTimeoutInMs

7 -> RBiSrvIsApplicationTerminateSensitiveForUser

8 -> RBiSrvNotifyEndSession

9 -> RBiSrvNotifyNewSession

10 -> RBiSrvNotifyNewSessionComplete

11 -> RBiSrvNotifyNewUser

12 -> RBiSrvQueryWorkItemForUser

13 -> RBiSrvResetActiveUserForPackage

14 -> RBiSrvSetActiveUserForPackage

15 -> RBiSrvTerminateApplicationHostForUser

16 -> RBiSrvUpdateBackgroundAccessApplicationsForUser

RPC 1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 (1.0) -- C:\windows\SYSTEM32\bisrv.dll

RPC 1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 (1.0) -- c:\windows\system32\bisrv.dll

0 -> RBiRtSrvAddWaitableEvent

1 -> RBiRtSrvAssociateWorkItem

2 -> RBiRtSrvCreateEvent

3 -> RBiRtSrvCreateEventForApp

4 -> RBiRtSrvCreateStatusStateName

5 -> RBiRtSrvDeleteEvent

6 -> RBiRtSrvDisassociateWorkItem

7 -> RBiRtSrvEnumerateBrokeredEvents

8 -> RBiRtSrvEnumerateWorkItems

9 -> RBiRtSrvGetWorkItemProperties

10 -> RBiRtSrvInitiatePause

11 -> RBiRtSrvQueryBrokerEventId

12 -> RBiRtSrvQueryBrokerEventIdFromWorkItem

13 -> RBiRtSrvRegisterWorkItem

14 -> RBiRtSrvSignalEvent

15 -> RBiRtSrvUpdateEventParameters

RPC c605f9fb-f0a3-4e2a-a073-73560f8d9e3e (1.0) -- c:\windows\system32\bisrv.dll

0 -> RBiSrvSignalEvent

RPC 0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e (1.0) -- c:\windows\system32\bisrv.dll

0 -> RBiPtSrvActivateDeferredWorkItem

1 -> RBiPtSrvActivateInBackground

2 -> RBiPtSrvActivateWorkItem

3 -> RBiPtSrvAssociateActivationProxy

4 -> RBiPtSrvAssociateApplicationEntryPoint

5 -> RBiPtSrvCancelWorkItem

6 -> RBiPtSrvCreateEvent

7 -> RBiPtSrvCreateEventForApp

8 -> RBiPtSrvCreateEventForPackageName

9 -> RBiPtSrvDeleteEvent

10 -> RBiPtSrvDisableWorkItem

11 -> RBiPtSrvDisassociateWorkItem

12 -> RBiPtSrvEnableWorkItem

13 -> RBiPtSrvEnumerateBrokeredEvents

14 -> RBiPtSrvEnumerateWorkItemsF

Diff salvati

Testo originale

Apri file

--------------------------------------------------------------------------------
<WinProcess "smss.exe" pid 368 at 0x5306908L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 472 at 0x5306e48L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "wininit.exe" pid 548 at 0x5306780L>
64

Interfaces :
RPC  76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\windows\system32\wininit.exe
	0 -> I_WMsgkSendMessage
	1 -> I_WMsgkSendPSPMessage
RPC  894de0c0-0d55-11d3-a322-00c04fa321a1 (1.0) -- C:\windows\system32\wininit.exe
	0 -> s_BaseInitiateShutdown
	1 -> s_BaseAbortShutdown
	2 -> s_BaseInitiateShutdownEx
RPC  d95afe70-a6d5-4259-822e-2c84da1ddb0d (1.0) -- C:\windows\system32\wininit.exe
	0 -> s_WsdrInitiateShutdown
	1 -> s_WsdrAbortShutdown
	2 -> s_WsdrCheckForHiberboot
RPC  76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\windows\system32\wininit.exe
	0 -> I_WMsgSendMessage
	1 -> I_WMsgSendPSPMessage
	2 -> I_WMsgSendNotifyMessage
	3 -> I_WMsgSendReconnectionUpdateMessage
Endpoints :
ncalrpc         : WMsgKRpc0551A0
ncacn_np        : \PIPE\InitShutdown
ncalrpc         : WindowsShutdown
ncacn_ip_tcp    : 49664
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 564 at 0x53069e8L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "winlogon.exe" pid 644 at 0x5306860L>
64

Interfaces :
RPC  367abb81-9844-35f1-ad32-98f038001003 (2.0) -- C:\windows\system32\services.exe
	0 -> RCloseServiceHandle
	1 -> RControlService
	2 -> RDeleteService
	3 -> RLockServiceDatabase
	4 -> RQueryServiceObjectSecurity
	5 -> RSetServiceObjectSecurity
	6 -> RQueryServiceStatus
	7 -> RSetServiceStatus
	8 -> RUnlockServiceDatabase
	9 -> RNotifyBootConfigStatus
	10 -> RI_ScSetServiceBitsW
	11 -> RChangeServiceConfigW
	12 -> RCreateServiceW
	13 -> REnumDependentServicesW
	14 -> REnumServicesStatusW
	15 -> ROpenSCManagerW
	16 -> ROpenServiceW
	17 -> RQueryServiceConfigW
	18 -> RQueryServiceLockStatusW
	19 -> RStartServiceW
	20 -> RGetServiceDisplayNameW
	21 -> RGetServiceKeyNameW
	22 -> CServiceRecord::GetStatusInternal
	23 -> RChangeServiceConfigA
	24 -> RCreateServiceA
	25 -> REnumDependentServicesA
	26 -> REnumServicesStatusA
	27 -> ROpenSCManagerA
	28 -> ROpenServiceA
	29 -> RQueryServiceConfigA
	30 -> RQueryServiceLockStatusA
	31 -> RStartServiceA
	32 -> RGetServiceDisplayNameA
	33 -> RGetServiceKeyNameA
	34 -> CServiceRecord::GetStatusInternal
	35 -> REnumServiceGroupW
	36 -> RChangeServiceConfig2A
	37 -> RChangeServiceConfig2W
	38 -> RQueryServiceConfig2A
	39 -> RQueryServiceConfig2W
	40 -> RQueryServiceStatusEx
	41 -> REnumServicesStatusExA
	42 -> REnumServicesStatusExW
	43 -> RI_ScBroadcastServiceControlMessage
	44 -> RCreateServiceWOW64A
	45 -> RCreateServiceWOW64W
	46 -> RI_ScQueryServiceTagInfo
	47 -> RNotifyServiceStatusChange
	48 -> RGetNotifyResults
	49 -> RCloseNotifyHandle
	50 -> RControlServiceExA
	51 -> RControlServiceExW
	52 -> RI_ScSendPnPMessage
	53 -> RI_ScValidatePnPService
	54 -> RI_ScOpenServiceStatusHandle
	55 -> RI_ScQueryServiceConfig
	56 -> RQueryServiceConfigEx
	57 -> RI_ScRegisterPreshutdownRestart
	58 -> RI_ScReparseServiceDatabase
	59 -> RQueryUserServiceName
	60 -> RCreateWowService
	61 -> RGetServiceRegistryStateKey
	62 -> RGetServiceDirectory
	63 -> RGetServiceProcessToken
RPC  a2c45f7c-7d32-46ad-96f5-adafb486be74 (1.0) -- C:\windows\system32\services.exe
	0 -> RI_ScOpenServiceChannelHandle
	1 -> RI_ScSendResponseReceiveControls
	2 -> RI_ScCloseServiceChannelHandle
RPC  93149ca2-973b-11d1-8c39-00c04fb984f9 (0.0) -- C:\windows\SYSTEM32\scesrv.dll
	0 -> SceSvcRpcQueryInfo
	1 -> SceSvcRpcSetInfo
	2 -> SceRpcSetupUpdateObject
	3 -> SceRpcSetupMoveFile
	4 -> SceRpcGenerateTemplate
	5 -> SceRpcConfigureSystem
	6 -> SceRpcGetDatabaseInfo
	7 -> SceRpcGetObjectChildren
	8 -> SceRpcOpenDatabase
	9 -> SceRpcCloseDatabase
	10 -> SceRpcGetDatabaseDescription
	11 -> SceRpcGetDBTimeStamp
	12 -> SceRpcGetObjectSecurity
	13 -> SceRpcGetAnalysisSummary
	14 -> SceRpcAnalyzeSystem
	15 -> SceRpcUpdateDatabaseInfo
	16 -> SceRpcUpdateObjectInfo
	17 -> SceRpcStartTransaction
	18 -> SceRpcCommitTransaction
	19 -> SceRpcRollbackTransaction
	20 -> SceRpcGetServerProductType
	21 -> SceSvcRpcUpdateInfo
	22 -> SceRpcCopyObjects
	23 -> SceRpcSetupResetLocalPolicy
	24 -> SceRpcNotifySaveChangesInGP
	25 -> SceRpcControlNotificationQProcess
	26 -> SceRpcBrowseDatabaseTable
	27 -> SceRpcGetSystemSecurity
	28 -> SceRpcGetSystemSecurity
	29 -> SceRpcSetSystemSecurity
	30 -> SceRpcSetSystemSecurity
	31 -> SceRpcSetDatabaseSetting
	32 -> SceRpcGetDatabaseSetting
	33 -> SceRpcConfigureConvertedFileSecurityImmediately
Endpoints :
ncalrpc         : ntsvcs
ncacn_np        : \pipe\ntsvcs
ncacn_np        : \PIPE\scerpc
ncacn_ip_tcp    : 49677
--------------------------------------------------------------------------------
<WinProcess "lsass.exe" pid 692 at 0x53062b0L>
64
['KeyIso', 'SamSs', 'VaultSvc']

Interfaces :
RPC  12345778-1234-abcd-ef00-0123456789ab (0.0) -- C:\windows\system32\lsasrv.dll
	0 -> LsarClose
	1 -> CredrRename
	2 -> LsarEnumeratePrivileges
	3 -> LsarQuerySecurityObject
	4 -> LsarSetSecurityObject
	5 -> LsaITestCall
	6 -> LsarOpenPolicyRPC
	7 -> LsarQueryInformationPolicy
	8 -> LsarSetInformationPolicy
	9 -> LsaITestCall
	10 -> LsarCreateAccount
	11 -> LsarEnumerateAccounts
	12 -> LsarCreateTrustedDomain
	13 -> LsarEnumerateTrustedDomains
	14 -> LsarLookupNames
	15 -> LsarLookupSids
	16 -> LsarCreateSecret
	17 -> LsarOpenAccount
	18 -> LsarEnumeratePrivilegesAccount
	19 -> LsarAddPrivilegesToAccount
	20 -> LsarRemovePrivilegesFromAccount
	21 -> LsarGetQuotasForAccount
	22 -> LsarSetQuotasForAccount
	23 -> LsarGetSystemAccessAccount
	24 -> LsarSetSystemAccessAccount
	25 -> LsarOpenTrustedDomain
	26 -> LsarQueryInfoTrustedDomain
	27 -> LsarSetInformationTrustedDomain
	28 -> LsarOpenSecret
	29 -> LsarSetSecret
	30 -> LsarQuerySecret
	31 -> LsarLookupPrivilegeValue
	32 -> LsarLookupPrivilegeName
	33 -> LsarLookupPrivilegeDisplayName
	34 -> LsarDeleteObject
	35 -> LsarEnumerateAccountsWithUserRight
	36 -> LsarEnumerateAccountRights
	37 -> LsarAddAccountRights
	38 -> LsarRemoveAccountRights
	39 -> LsarQueryTrustedDomainInfo
	40 -> LsarSetTrustedDomainInfo
	41 -> LsarDeleteTrustedDomain
	42 -> LsarStorePrivateData
	43 -> LsarRetrievePrivateData
	44 -> LsarOpenPolicy2
	45 -> LsarGetUserName
	46 -> LsarQueryInformationPolicy2
	47 -> LsarSetInformationPolicy2
	48 -> LsarQueryTrustedDomainInfoByName
	49 -> LsarSetTrustedDomainInfoByName
	50 -> LsarEnumerateTrustedDomainsEx
	51 -> LsarCreateTrustedDomainEx
	52 -> LsaITestCall
	53 -> LsarQueryDomainInformationPolicy
	54 -> LsarSetDomainInformationPolicy
	55 -> LsarOpenTrustedDomainByName
	56 -> LsaITestCall
	57 -> LsarLookupSids2
	58 -> LsarLookupNames2
	59 -> LsarCreateTrustedDomainEx2
	60 -> CredrWrite
	61 -> CredrRead
	62 -> CredrEnumerate
	63 -> CredrWriteDomainCredentials
	64 -> CredrReadDomainCredentials
	65 -> CredrDelete
	66 -> CredrGetTargetInfo
	67 -> CredrProfileLoaded
	68 -> LsarLookupNames3
	69 -> CredrGetSessionTypes
	70 -> LsarRegisterAuditEvent
	71 -> LsarGenAuditEvent
	72 -> LsarUnregisterAuditEvent
	73 -> LsarQueryForestTrustInformation
	74 -> LsarSetForestTrustInformation
	75 -> CredrRename
	76 -> LsarLookupSids3
	77 -> LsarLookupNames4
	78 -> LsarOpenPolicySce
	79 -> LsarAdtRegisterSecurityEventSource
	80 -> LsarAdtUnregisterSecurityEventSource
	81 -> LsarAdtReportSecurityEvent
	82 -> CredrFindBestCredential
	83 -> LsarSetAuditPolicy
	84 -> LsarQueryAuditPolicy
	85 -> LsarEnumerateAuditPolicy
	86 -> LsarEnumerateAuditCategories
	87 -> LsarEnumerateAuditSubCategories
	88 -> LsarLookupAuditCategoryName
	89 -> LsarLookupAuditSubCategoryName
	90 -> LsarSetAuditSecurity
	91 -> LsarQueryAuditSecurity
	92 -> CredrReadByTokenHandle
	93 -> CredrRestoreCredentials
	94 -> CredrBackupCredentials
	95 -> LsarManageSidNameMapping
	96 -> CredrProfileUnloaded
	97 -> CredrRename
	98 -> CredrRename
	99 -> CredrRename
	100 -> CredrRename
	101 -> CredrRename
	102 -> LsarEfsGetSmartcardCredentials
	103 -> LsarAuditSetGlobalSacl
	104 -> LsarAuditQueryGlobalSacl
	105 -> CredrProfileLoadedEx
	106 -> LsarInteractiveSessionIsLoggedOff
	107 -> LsarConfigureAutoLogonCredentials
	108 -> LsarGetDeviceRegistrationInfo
	109 -> LsaITestCall
	110 -> LsarProfileDeleted
	111 -> LsaITestCall
	112 -> CredrRename
	113 -> LsarValidateProcUniqueLuid
	114 -> LsarIsArsoAllowedByPolicy
	115 -> LsarIsArsoAllowedByConsent
	116 -> LsarEnableArsoConsent
	117 -> LsarDisableArsoConsent
	118 -> LsarIsArsoAllowedByPolicy
	119 -> LsarIsUserArsoEnabled
	120 -> LsarEnableUserArso
	121 -> LsarDisableUserArso
	122 -> LsarConfigureUserArso
	123 -> LsarGetInprocDispatchTable
	124 -> LsarSetSharedUserSession
	125 -> LsarClearSharedUserSession
	126 -> LsarEnablePasswordLessCurrentUser
	127 -> LsarDisablePasswordLessCurrentUser
RPC  ace1c026-8b3f-4711-8918-f345d17f5bff (1.0) -- C:\windows\system32\lsasrv.dll
	0 -> S_RPC_LspUpdatePrivateData
	1 -> S_RPC_LspReadPrivateData
RPC  afc07e2e-311c-4435-808c-c483ffeec7c9 (1.0) -- C:\windows\system32\lsasrv.dll
	0 -> LsarGetAvailableCAPIDs
	1 -> LsarSetCAPs
	2 -> LsarQueryCAPs
RPC  c0d930f0-b787-4124-99bc-21f0ecb642ce (0.0) -- C:\windows\system32\lsasrv.dll
	0 -> LsarConnectLocalUser
	1 -> LsarDisconnectLocalUser
	2 -> LsarCreateConnectedUser
	3 -> LsarIsCurrentUserConnected
	4 -> LsarRenewCertificate
	5 -> LsarGetSSOAccountType
	6 -> LsarIsUserMSA
RPC  d25576e4-00d2-43f7-98f9-b4c0724158f9 (0.0) -- C:\windows\system32\lsasrv.dll
	0 -> LsarEasMarkUserControlled
	1 -> LsarEasGetCallerPasswordComplexity
	2 -> LsarEasGetControlledUsersInfo
RPC  c681d488-d850-11d0-8c52-00c04fd90f7e (1.0) -- C:\windows\system32\efslsaext.dll
	0 -> EfsRpcOpenFileRaw_Downlevel
	1 -> EfsRpcReadFileRaw_Downlevel
	2 -> EfsRpcWriteFileRaw_Downlevel
	3 -> EfsRpcCloseRaw_Downlevel
	4 -> EfsRpcEncryptFileSrv_Downlevel
	5 -> EfsRpcDecryptFileSrv_Downlevel
	6 -> EfsRpcQueryUsersOnFile_Downlevel
	7 -> EfsRpcQueryRecoveryAgents_Downlevel
	8 -> EfsRpcRemoveUsersFromFile_Downlevel
	9 -> EfsRpcAddUsersToFile_Downlevel
	10 -> EfsRpcFileKeyInfoEx_Downlevel
	11 -> EfsRpcFileKeyInfoEx_Downlevel
	12 -> EfsRpcFileKeyInfo_Downlevel
	13 -> EfsRpcDuplicateEncryptionInfoFile_Downlevel
	14 -> EfsRpcFileKeyInfoEx_Downlevel
	15 -> EfsRpcAddUsersToFileEx_Downlevel
	16 -> EfsRpcFileKeyInfoEx_Downlevel
	17 -> EfsRpcFileKeyInfoEx_Downlevel
	18 -> EfsRpcFileKeyInfoEx_Downlevel
	19 -> EfsRpcFileKeyInfoEx_Downlevel
	20 -> EfsRpcFlushEfsCache_Downlevel
RPC  fb8a0729-2d04-4658-be93-27b4ad553fac (1.0) -- C:\windows\system32\lsass.exe
	0 -> LsaLookuprOpenPolicy2
	1 -> LsaLookuprClose
	2 -> LsaLookuprTranslateSids2
	3 -> LsaLookuprTranslateNames3
	4 -> LsaLookuprManageCache
	5 -> LsaLookuprGetDomainInfo
	6 -> LsaLookuprUserAccountType
RPC  4f32adc8-6052-4a04-8701-293ccf2096f0 (1.0) -- C:\windows\SYSTEM32\SspiSrv.dll
	0 -> SspirConnectRpc
	1 -> SspirDisconnectRpc
	2 -> SspirDisconnectRpc
	3 -> SspirCallRpc
	4 -> SspirAcquireCredentialsHandle
	5 -> SspirFreeCredentialsHandle
	6 -> SspirProcessSecurityContext
	7 -> SspirDeleteSecurityContext
	8 -> SspirSslQueryCredentialsAttributes
	9 -> SspirNegQueryContextAttributes
	10 -> SspirSslSetCredentialsAttributes
	11 -> SspirApplyControlToken
	12 -> SspirLogonUser
	13 -> SspirLookupAccountSid
	14 -> SspirGetUserName
	15 -> SspirGetInprocDispatchTable
RPC  11220835-5b26-4d94-ae86-c3e475a809de (1.0) -- C:\windows\system32\dpapisrv.dll
	0 -> s_SSCryptProtectData
	1 -> s_SSCryptUnprotectData
	2 -> s_SSCryptUpdateProtectedState
RPC  5cbe92cb-f4be-45c9-9fc9-33e73e557b20 (1.0) -- C:\windows\system32\dpapisrv.dll
	0 -> s_SSRecoverQueryStatus
	1 -> s_SSRecoverImportRecoveryKey
	2 -> s_SSRecoverPassword
RPC  7f1317a8-4dea-4fa2-a551-df5516ff8879 (1.0) -- C:\windows\system32\dpapisrv.dll
	0 -> s_LRpcSIDKeyProtect
	1 -> s_LRpcSIDKeyUnprotect
RPC  3919286a-b10c-11d0-9ba8-00c04fd92ef5 (0.0) -- C:\windows\system32\lsasrv.dll
	0 -> DsRolerGetPrimaryDomainInformation
RPC  12345778-1234-abcd-ef00-0123456789ac (1.0) -- C:\windows\SYSTEM32\samsrv.dll
	0 -> SamrConnect
	1 -> SamrCloseHandle
	2 -> SamrSetSecurityObject
	3 -> SamrQuerySecurityObject
	4 -> SamrShutdownSamServer
	5 -> SamrLookupDomainInSamServer
	6 -> SamrEnumerateDomainsInSamServer
	7 -> SamrOpenDomain
	8 -> SamrQueryInformationDomain
	9 -> SamrSetInformationDomain
	10 -> SamrCreateGroupInDomain
	11 -> SamrEnumerateGroupsInDomain
	12 -> SamrCreateUserInDomain
	13 -> SamrEnumerateUsersInDomain
	14 -> SamrCreateAliasInDomain
	15 -> SamrEnumerateAliasesInDomain
	16 -> SamrGetAliasMembership
	17 -> SamrLookupNamesInDomain
	18 -> SamrLookupIdsInDomain
	19 -> SamrOpenGroup
	20 -> SamrQueryInformationGroup
	21 -> SamrSetInformationGroup
	22 -> SamrAddMemberToGroup
	23 -> SamrDeleteGroup
	24 -> SamrRemoveMemberFromGroup
	25 -> SamrGetMembersInGroup
	26 -> SamrSetMemberAttributesOfGroup
	27 -> SamrOpenAlias
	28 -> SamrQueryInformationAlias
	29 -> SamrSetInformationAlias
	30 -> SamrDeleteAlias
	31 -> SamrAddMemberToAlias
	32 -> SamrRemoveMemberFromAlias
	33 -> SamrGetMembersInAlias
	34 -> SamrOpenUser
	35 -> SamrDeleteUser
	36 -> SamrQueryInformationUser
	37 -> SamrSetInformationUser
	38 -> SamrChangePasswordUser
	39 -> SamrGetGroupsForUser
	40 -> SamrQueryDisplayInformation
	41 -> SamrGetDisplayEnumerationIndex
	42 -> SamrTestPrivateFunctionsDomain
	43 -> SamrTestPrivateFunctionsUser
	44 -> SamrGetUserDomainPasswordInformation
	45 -> SamrRemoveMemberFromForeignDomain
	46 -> SamrQueryInformationDomain2
	47 -> SamrQueryInformationUser2
	48 -> SamrQueryDisplayInformation2
	49 -> SamrGetDisplayEnumerationIndex2
	50 -> SamrCreateUser2InDomain
	51 -> SamrQueryDisplayInformation3
	52 -> SamrAddMultipleMembersToAlias
	53 -> SamrRemoveMultipleMembersFromAlias
	54 -> SamrOemChangePasswordUser2
	55 -> SamrUnicodeChangePasswordUser2
	56 -> SamrGetDomainPasswordInformation
	57 -> SamrConnect2
	58 -> SamrSetInformationUser2
	59 -> SamrSetBootKeyInformation
	60 -> SamrGetBootKeyInformation
	61 -> SamrConnect3
	62 -> SamrConnect4
	63 -> SamrUnicodeChangePasswordUser3
	64 -> SamrConnect5
	65 -> SamrRidToSid
	66 -> SamrSetDSRMPassword
	67 -> SamrValidatePassword
	68 -> SamrQueryLocalizableAccountsInDomain
	69 -> SamrPerformGenericOperation
	70 -> SamrSyncDSRMPasswordFromAccount
	71 -> SamrLookupNamesInDomain2
	72 -> SamrEnumerateUsersInDomain2
RPC  b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 (2.0) -- C:\windows\system32\keyiso.dll
	0 -> s_SrvRpcCreateContext
	1 -> s_SrvRpcReleaseContext
	2 -> s_SrvRpcCryptOpenStorageProvider
	3 -> s_SrvRpcCryptIsAlgSupported
	4 -> s_SrvRpcCryptEnumAlgorithms
	5 -> s_SrvRpcCryptEnumKeys
	6 -> s_SrvRpcCryptFreeBuffer
	7 -> s_SrvRpcCryptFreeProvider
	8 -> s_SrvRpcCryptFreeKey
	9 -> s_SrvRpcCryptOpenKey
	10 -> s_SrvRpcCryptCreatePersistedKey
	11 -> s_SrvRpcCryptGetProviderProperty
	12 -> s_SrvRpcCryptSetProviderProperty
	13 -> s_SrvRpcCryptGetKeyProperty
	14 -> s_SrvRpcCryptSetKeyProperty
	15 -> s_SrvRpcCryptFinalizeKey
	16 -> s_SrvRpcCryptEncrypt
	17 -> s_SrvRpcCryptDecrypt
	18 -> s_SrvRpcCryptImportKey
	19 -> s_SrvRpcCryptExportKey
	20 -> s_SrvRpcCryptSignHash
	21 -> s_SrvRpcCryptVerifySignature
	22 -> s_SrvRpcCryptDeleteKey
	23 -> s_SrvRpcCryptNotifyChangeKey
	24 -> s_SrvRpcCryptSecretAgreement
	25 -> s_SrvRpcCryptDeriveKey
	26 -> s_SrvRpcCryptFreeSecret
	27 -> s_SrvRpcCryptCipherEncrypt
	28 -> s_SrvRpcCryptCipherDecrypt
	29 -> s_SrvRpcCryptKeyDerivation
	30 -> s_SrvRpcCryptCreateClaim
	31 -> s_SrvRpcCryptVerifyClaim
RPC  8fb74744-b2ff-4c00-be0d-9ef9a191fe1b (1.0) -- C:\windows\system32\keyiso.dll
	0 -> s_GetSymmetricPopKeyTransportKey
	1 -> s_GetSymmetricPopKeyTransportKeyName
	2 -> s_DeleteSymmetricPopKeyTransportKey
	3 -> s_ImportSymmetricPopKey
	4 -> s_SignWithSymmetricPopKey
	5 -> s_VerifyWithSymmetricPopKey
	6 -> s_DecryptWithSymmetricPopKey
	7 -> s_EncryptWithSymmetricPopKey
	8 -> s_GetKeyAttestationForContainerService
	9 -> s_RenewKeyAttestation
	10 -> s_GetPregenUserKey
	11 -> s_GetPregenKeyState
RPC  51a227ae-825b-41f2-b4a9-1ac9557a1018 (1.0) -- C:\windows\system32\keyiso.dll
	0 -> s_TokenBindingGenerateTpmKeyFromSoftware
RPC  bb8b98e8-84dd-45e7-9f34-c3fb6155eeed (1.0) -- C:\Windows\System32\vaultsvc.dll
	0 -> VltCreateItemType
	1 -> VltDeleteItemType
	2 -> VltEnumerateItemTypes
	3 -> VltAddItem
	4 -> VltFindItems
	5 -> VltEnumerateItems
	6 -> VltGetItem
	7 -> VltRemoveItem
	8 -> VltGetItemType
	9 -> VltOpenVault
	10 -> VltCloseVault
	11 -> VltGetInformation
	12 -> VltEnumerateVaults
	13 -> VltEnumerateSettingUnits
	14 -> VltGetSettingUnit
	15 -> VltApplySettingUnit
	16 -> VltRemoveSettingUnit
	17 -> VltTriggerSync
	18 -> VltGetSettingUnitInfo
Endpoints :
ncacn_np        : \pipe\lsass
ncalrpc         : audit
ncalrpc         : securityevent
ncalrpc         : LSARPC_ENDPOINT
ncalrpc         : lsacap
ncalrpc         : LSA_IDPEXT_ENDPOINT
ncalrpc         : LSA_EAS_ENDPOINT
ncalrpc         : lsapolicylookup
ncalrpc         : lsasspirpc
ncalrpc         : protected_storage
ncalrpc         : SidKey Local End Point
ncalrpc         : samss lpc
ncacn_ip_tcp    : 49678
ncalrpc         : Vault
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 808 at 0x5306e10L>
64
['PlugPlay']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "fontdrvhost.exe" pid 832 at 0x5306ba8L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "fontdrvhost.exe" pid 828 at 0x5306898L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 844 at 0x53064a8L>
64
['BrokerInfrastructure', 'DcomLaunch', 'Power', 'SystemEventsBroker']

Interfaces :
RPC  6c9b7b96-45a8-4cca-9eb3-e21ccf8b5a89 (1.1) -- c:\windows\system32\umpo.dll
	0 -> UmpoRpcGetPowerConfiguration
	1 -> UmpoRpcReadFromSystemPowerKey
	2 -> UmpoRpcReadFromUserPowerKey
	3 -> UmpoRpcReadACValue
	4 -> UmpoRpcReadDCValue
	5 -> UmpoRpcWriteToSystemPowerKey
	6 -> UmpoRpcWriteToUserPowerKey
	7 -> UmpoRpcApplyPowerRequestOverride
	8 -> UmpoRpcApplyPowerSetting
	9 -> UmpoRpcSetActiveScheme
	10 -> UmpoRpcGetActiveScheme
	11 -> UmpoRpcSetActiveOverlayScheme
	12 -> UmpoRpcGetActualOverlayScheme
	13 -> UmpoRpcGetEffectiveOverlayScheme
	14 -> UmpoRpcGetOverlaySchemes
	15 -> UmpoRpcRestoreDefaultScheme
	16 -> UmpoRpcRestoreDefaultSchemesAll
	17 -> UmpoRpcDuplicateScheme
	18 -> UmpoRpcDeleteScheme
	19 -> UmpoRpcImportScheme
	20 -> UmpoRpcReplaceDefaultPowerSchemes
	21 -> UmpoRpcLegacyEventRegisterNotification
	22 -> UmpoRpcEnumerate
	23 -> UmpoRpcReadSecurityDescriptor
	24 -> UmpoRpcWriteSecurityDescriptor
	25 -> UmpoRpcSettingAccessCheck
	26 -> UmpoRpcCreateSetting
	27 -> UmpoRpcCreatePossibleSetting
	28 -> UmpoRpcRemoveSetting
	29 -> UmpoSetExpectedUserAwayIntervals
	30 -> UmpoClearExpectedUserAwayIntervals
	31 -> UmpoGetMinUserAwayPredictionInterval
	32 -> UmpoRpcGetAdaptiveStandbyDiagnostics
RPC  9b8699ae-0e44-47b1-8e7f-86a461d7ecdc (0.0) -- c:\windows\system32\rpcss.dll
	0 -> _LaunchActivatorServer
	1 -> _LaunchRunAsServer
	2 -> _LaunchService
	3 -> _LaunchWinRTActivatorServer
	4 -> _LaunchWinRTRunAsServer
	5 -> _LaunchWinRTService
	6 -> _CertifyServerIdentity
	7 -> _QueryNTService
	8 -> _QueryNTServiceType
	9 -> ControlNTService
	10 -> PrivTranslateShareName
	11 -> GenericStreamBase<IMarshalingStream,AllocationWrapper>::Commit
	12 -> IsPortOpen
	13 -> TickleActivationSettings
	14 -> QueryProcessArchitecture
	15 -> PrivilegedNotifyWinRTActivationStoreChanged
	16 -> _QueryUserSidForSession
	17 -> PrivActivatePsmServer
	18 -> _PrivGetUserTokenForSession
	19 -> PrivGetBrokerToken
	20 -> PrivGetDesktopWinRTBrokerToken
	21 -> PrivGetPsmToken
	22 -> GetSessionUserTokenCacheDetails
	23 -> PrivilegedNotifyComClassChangesFromDeployment
	24 -> PrivGetPsmTokenWithDynamicId
	25 -> PrivGetInteractiveUserToken
	26 -> PrivReportUnhealthyProcess
	27 -> PrivNormalizePsmTokenHostId
RPC  4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvActivateApplication
	1 -> PsmSrvCloseActivationChannel
	2 -> PsmSrvOpenActivationChannel
	3 -> PsmSrvRegisterProcess
RPC  085b0334-e454-4d91-9b8c-4134f9e793f3 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvOpenManagementChannel
	1 -> PsmSrvSetApplicationState
	2 -> PsmSrvSetApplicationPriority
	3 -> PsmSrvReleaseCacheEntry
	4 -> PsmSrvAcquireCachedEntries
	5 -> PsmSrvQueryApplicationSwapState
	6 -> PsmSrvCloseActivationChannel
	7 -> PsmSrvSetApplicationProperties
	8 -> PsmSrvQueryApplicationProperties
	9 -> PsmSrvQueryApplicationResourceUsage
	10 -> PsmSrvQueryMemoryUsage
	11 -> PsmSrvResetMaxMemoryUsage
	12 -> PsmSrvQuerySharedCommit
RPC  8782d3b9-ebbd-4644-a3d8-e8725381919b (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvRegisterQuiesceResumeApp
	1 -> PsmSrvQuiesceCallbacksComplete
	2 -> PsmSrvCloseActivationChannel
RPC  3b338d89-6cfa-44b8-847e-531531bc9992 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvQueryApplicationPerformanceInformation
	1 -> PsmSrvQueryQuotaInformation
RPC  bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvOpenTcChannel
	1 -> PsmSrvApplyTaskCompletion
	2 -> PsmSrvRegisterDynamicProcess
	3 -> PsmSrvCloseActivationChannel
	4 -> PsmSrvGetSessionInfo
RPC  5824833b-3c1a-4ad2-bdfd-c31d19e23ed2 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvRegisterAppPriorityNotification
	1 -> PsmSrvQueryApplicationResourceUsageForTimer
	2 -> PsmSrvTimerStart
	3 -> PsmSrvTimerCleanup
	4 -> PsmSrvTimerRemainingResourceTimeGet
	5 -> PsmSrvTimerElapsedResourceTimeGet
RPC  0361ae94-0316-4c6c-8ad8-c594375800e2 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvQueryCurrentApplications
	1 -> PsmSrvQueryApplicationHosts
	2 -> PsmSrvQueryApplicationHostExecutionState
	3 -> PsmSrvQueryApplicationHostJob
	4 -> PsmSrvConnect
	5 -> PsmSrvDisconnect
	6 -> PsmSrvSubscribeToNotifications
	7 -> PsmSrvUnsubscribeFromNotifications
RPC  2d98a740-581d-41b9-aa0d-a88b9d5ce938 (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> RBiSrvActivateDeferredWorkItem
	1 -> RBiSrvActivateInBackground
	2 -> RBiSrvActivateWorkItem
	3 -> RBiSrvAssociateActivationProxy
	4 -> RBiSrvAssociateApplicationExtensionClass
	5 -> RBiSrvCancelWorkItem
	6 -> RBiSrvCreateEvent
	7 -> RBiSrvCreateEventForPackageName
	8 -> RBiSrvDeleteEvent
	9 -> RBiSrvDisassociateWorkItem
	10 -> RBiSrvDiscardPendingActivations
	11 -> RBiSrvEnumerateBrokeredEvents
	12 -> RBiSrvEnumerateUserContexts
	13 -> RBiSrvEnumerateUserSessions
	14 -> RBiSrvEnumerateWorkItemsForPackageName
	15 -> RBiPtSrvGetStatusStateNameFromBrokerEventId
	16 -> RBiSrvQueryBrokeredEvent
	17 -> RBiSrvQuerySystemStateBroadcastChannels
	18 -> RBiSrvQueryUserContext
	19 -> RBiSrvQueryUserSession
	20 -> RBiSrvQueryWorkItem
	21 -> RBiPtSrvQueryWorkItemStatusStateName
	22 -> RBiSrvSignalEvent
	23 -> RBiSrvSignalMultipleEvents
	24 -> RBiSrvSignalTriggerEvent
	25 -> RBiSrvUpdateEventParameters
	26 -> RBiSrvUpdateEventFlags
	27 -> RBiSrvUpdateEventInformation
RPC  8bfc3be1-6def-4e2d-af74-7c47cd0ade4a (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> RBiSrvActivateWorkItemForUser
	1 -> RBiSrvChangeApplicationStateForPackageNameForUser
	2 -> RBiSrvChangeApplicationStateForPsmKeyForUser
	3 -> RBiSrvChangeUserState
	4 -> RBiSrvEnumerateWorkItemsForPackageNameAndUser
	5 -> RBiSrvGetActiveBackgroundTasksEventForUser
	6 -> RBiSrvGetCancellationTimeoutInMs
	7 -> RBiSrvIsApplicationTerminateSensitiveForUser
	8 -> RBiSrvNotifyEndSession
	9 -> RBiSrvNotifyNewSession
	10 -> RBiSrvNotifyNewSessionComplete
	11 -> RBiSrvNotifyNewUser
	12 -> RBiSrvQueryWorkItemForUser
	13 -> RBiSrvResetActiveUserForPackage
	14 -> RBiSrvSetActiveUserForPackage
	15 -> RBiSrvTerminateApplicationHostForUser
	16 -> RBiSrvUpdateBackgroundAccessApplicationsForUser
RPC  1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> RBiRtSrvAddWaitableEvent
	1 -> RBiRtSrvAssociateWorkItem
	2 -> RBiRtSrvCreateEvent
	3 -> RBiRtSrvCreateEventForApp
	4 -> RBiRtSrvCreateStatusStateName
	5 -> RBiRtSrvDeleteEvent
	6 -> RBiRtSrvDisassociateWorkItem
	7 -> RBiRtSrvEnumerateBrokeredEvents
	8 -> RBiRtSrvEnumerateWorkItems
	9 -> RBiRtSrvGetWorkItemProperties
	10 -> RBiRtSrvInitiatePause
	11 -> RBiRtSrvQueryBrokerEventId
	12 -> RBiRtSrvQueryBrokerEventIdFromWorkItem
	13 -> RBiRtSrvRegisterWorkItem
	14 -> RBiRtSrvSignalEvent
	15 -> RBiRtSrvUpdateEventParameters
RPC  c605f9fb-f0a3-4e2a-a073-73560f8d9e3e (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> RBiSrvSignalEvent
RPC  0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> RBiPtSrvActivateDeferredWorkItem
	1 -> RBiPtSrvActivateInBackground
	2 -> RBiPtSrvActivateWorkItem
	3 -> RBiPtSrvAssociateActivationProxy
	4 -> RBiPtSrvAssociateApplicationEntryPoint
	5 -> RBiPtSrvCancelWorkItem
	6 -> RBiPtSrvCreateEvent
	7 -> RBiPtSrvCreateEventForApp
	8 -> RBiPtSrvCreateEventForPackageName
	9 -> RBiPtSrvDeleteEvent
	10 -> RBiPtSrvDisableWorkItem
	11 -> RBiPtSrvDisassociateWorkItem
	12 -> RBiPtSrvEnableWorkItem
	13 -> RBiPtSrvEnumerateBrokeredEvents
	14 -> RBiPtSrvEnumerateWorkItemsForPackageName
	15 -> RBiPtSrvGetStatusStateNameFromBrokerEventId
	16 -> RBiPtSrvQueryBrokeredEvent
	17 -> RBiPtSrvQueryBrokerEventId
	18 -> RBiPtSrvQuerySystemStateBroadcastChannels
	19 -> RBiPtSrvQueryWorkItem
	20 -> RBiPtSrvQueryWorkItemStatusStateName
	21 -> RBiPtSrvSignalEvent
	22 -> RBiPtSrvSignalMultipleEvents
	23 -> RBiPtSrvSignalTriggerEvent
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
RPC  2513bcbe-6cd4-4348-855e-7efb3c336dd3 (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> SrvOdbCreateSession
	1 -> SrvOdbCompleteSession
	2 -> SrvOdbLaunchBackgroundTask
	3 -> SrvOdbCancelBackgroundTask
	4 -> SrvOdbCancelBackgroundTasksForPackage
RPC  20c40295-8dba-48e6-aebf-3e78ef3bb144 (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> SrvOdbPtCreateSession
	1 -> SrvOdbPtCompleteSession
	2 -> SrvOdbPtLaunchBackgroundTask
	3 -> SrvOdbPtCancelBackgroundTask
	4 -> SrvOdbPtCancelBackgroundTasksForPackage
RPC  b8cadbaf-e84b-46b9-84f2-6f71c03f9e55 (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> SrvOdbLbPublishLegacyExitCode
RPC  857fb1be-084f-4fb5-b59c-4b2c4be5f0cf (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> SrvOdbPrivGetLaunchInfo
RPC  55e6b932-1979-45d6-90c5-7f6270724112 (1.0) -- C:\windows\SYSTEM32\resourcepolicyserver.dll
	0 -> Srv_GetResourcePolicyKey
	1 -> Srv_GetResourcePolicyInformation
	2 -> Srv_CreateResourcePolicy
	3 -> Srv_GetResourcePolicyName
	4 -> Srv_CreatePolicyEngineClientContext
	5 -> Srv_ClosePolicyEngineClientContext
	6 -> Srv_RegisterForPackageEnergyStateChangeNotifications
	7 -> Srv_IsPackageInGoodEnergyState
	8 -> Srv_InterruptiveUIStateChanged_Subscribe
	9 -> Srv_InterruptiveUIStateChanged_Unsubscribe
RPC  76c217bc-c8b4-4201-a745-373ad9032b1a (1.0) -- C:\windows\SYSTEM32\resourcepolicyserver.dll
	0 -> Srv_QueryApplicationEnergyUsage
	1 -> Srv_GetDeviceSpecificConversionFactor
	2 -> Srv_ResetTotalEnergyUsage
RPC  88abcbc3-34ea-76ae-8215-767520655a23 (0.0) -- C:\windows\SYSTEM32\resourcepolicyserver.dll
	0 -> GcsSrv_GetGameConfigSize
	1 -> GcsSrv_GetGameConfig
	2 -> GcsSrv_GetGameConfigSizeForClientProcess
	3 -> GcsSrv_GetGameConfigForClientProcess
	4 -> GcsSrv_ModifyGameConfig
	5 -> GcsSrv_AddGameConfig
	6 -> GcsSrv_RemoveGameConfig
	7 -> GcsSrv_GetGameIdByAUMID
	8 -> GcsSrv_GetGameIdByPID
	9 -> GcsSrv_GetGameIdCount
	10 -> GcsSrv_GetAllGameIds
	11 -> GcsSrv_GetGameIdsByExeNameCount
	12 -> GcsSrv_GetGameIdsByExeName
	13 -> GcsSrv_GetGameProperty
	14 -> GcsSrv_GetGamePropertySize
	15 -> GcsSrv_SetGameProperty
	16 -> GcsSrv_GetGlobalProperty
	17 -> GcsSrv_GetGlobalPropertySize
	18 -> GcsSrv_SetGlobalProperty
	19 -> GcsSrv_SetGamePropertyUserOverride
	20 -> GcsSrv_GetGamePropertyIsUserOverride
RPC  2c7fd9ce-e706-4b40-b412-953107ef9bb0 (0.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> RmgrSrv_RegisterWithServer
	1 -> RmgrSrv_RmSetMemoryUsageLimit
	2 -> RmgrSrv_RmRegisterResource
	3 -> RmgrSrv_RmAccessCheck
	4 -> RmgrSrv_RmAccessCheckOnCaller
	5 -> RmgrSrv_RmAvailabilityCheck
	6 -> RmgrSrv_RmAcquireResources
	7 -> RmgrSrv_RmGetNotification
	8 -> RmgrSrv_RmReleaseResources
RPC  c521facf-09a9-42c5-b155-72388595cbf0 (0.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> RmtSrv_RM_ConnectToServer
	1 -> RmtSrv_RM_DisconnectFromServer
	2 -> RmtSrv_RM_AcquireResourceSet
	3 -> RmtSrv_RS_Apply
	4 -> RmtSrv_RS_ReleaseResources
	5 -> ExecutionModel::BaseResourceSet::OnAccessLost
	6 -> RmtSrv_RS_SetExternalResourcePriorities
	7 -> ExecutionModel::BaseResourceSet::OnAccessLost
RPC  1832bcf6-cab8-41d4-85d2-c9410764f75a (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> RmCoreRpcSrvConnectToRmServer
	1 -> RmCoreRpcSrvDisconnectFromRmServer
	2 -> RmCoreRpcSrvRegisterActivityHostCallbacks
	3 -> RmCoreRpcSrvUnregisterActivityHostCallbacks
	4 -> RmCoreRpcSrvAcquireResourceSet
	5 -> RmCoreRpcSrvApplyResourceSet
	6 -> RmCoreRpcSrvReleaseResourceSet
	7 -> CrmRpcSrvActivityRenew
	8 -> RmCoreRpcSrvQueryHostMemoryLimitValues
RPC  4dace966-a243-4450-ae3f-9b7bcb5315b8 (2.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> RmGameModeSrvRegisterProcess
	1 -> RmGameModeSrvUnregisterProcess
	2 -> RmGameModeSrvDisableForRegisteredProcess
	3 -> RmGameModeSrvReenableForRegisteredProcess
	4 -> RmGameModeSrvGetLargestValidResourceRequest
	5 -> RmGameModeSrvRegisterPairedAuxiliaryProcess
RPC  178d84be-9291-4994-82c6-3f909aca5a03 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> RmGameModeRSrvRegisterProcess
	1 -> RmGameModeRSrvUnregisterProcess
	2 -> RmGameModeRSrvDisableForRegisteredProcess
	3 -> RmGameModeRSrvReenableForRegisteredProcess
	4 -> RmGameModeRSrvRegisterPairedAuxiliaryProcess
RPC  e53d94ca-7464-4839-b044-09a2fb8b3ae5 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnect
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvCreateActivity
	3 -> HamRpcSrvCreateActivityForProcess
	4 -> HamRpcSrvCreateAutoRestartActivity
	5 -> HamRpcSrvStartActivityAsync
	6 -> HamRpcSrvStopActivity
	7 -> HamRpcSrvUpdateActivityProperties
	8 -> HamRpcSrvTerminateActivityHost
	9 -> HamRpcSrvSetExternalResourcePriority
	10 -> HamRpcSrvResetExternalResourcePriority
	11 -> HamRpcSrvCloseActivity
	12 -> HamRpcSrvIsHostBeingDebugged
	13 -> HamRpcSrvTerminateHostOnProcessExit
	14 -> HamRpcSrvGetApplicationInterruptiveUIState
	15 -> HamRpcSrvGetPackageInterruptiveUIState
	16 -> HamRpcSrvGetInterruptiveUIStateForAumid
RPC  fae436b0-b864-4a87-9eda-298547cd82f2 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectDebugging
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvDebugOpenPackageHandle
	3 -> HamRpcSrvDebugClosePackageHandle
	4 -> HamRpcSrvDebugModeEnable
	5 -> HamRpcSrvDebugTerminatePackage
	6 -> HamRpcSrvDebugQueryPackageState
	7 -> HamRpcSrvDebugSuspendPackage
RPC  082a3471-31b6-422a-b931-a54401960c62 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectExtendedExecution
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvIsHostHamManaged
	3 -> HamRpcSrvQueryTaskCompletionsForTerminateGraph
	4 -> HamRpcSrvCreateExtendedExecution
	5 -> HamRpcSrvStartExtendedExecutionAsync
	6 -> HamRpcSrvCloseActivity
	7 -> HamRpcSrvAddDependency
	8 -> HamRpcSrvRemoveDependency
	9 -> HamRpcSrvAddHostDependency
	10 -> HamRpcSrvRemoveHostDependency
	11 -> HamRpcSrvTerminateSelf
	12 -> HamRpcSrvTerminateSelfOnRequiredProcessExit
	13 -> HamRpcSrvTryEstimateRemainingQuiesceTime
RPC  6982a06e-5fe2-46b1-b39c-a2c545bfa069 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectFullTrust
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvFullTrustOpenPackageHandle
	3 -> HamRpcSrvDebugClosePackageHandle
	4 -> HamRpcSrvDebugTerminatePackage
RPC  0ff1f646-13bb-400a-ab50-9a78f2b7a85a (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvFindOrCreateHostId
	1 -> HamRpcSrvCreateSingleUseHostId
	2 -> HamRpcSrvRetrieveDynamicIdForHostId
RPC  4ed8abcc-f1e2-438b-981f-bb0e8abc010c (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectStateChangeNotifications
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvGetApplicationStateForPsmKey
	3 -> HamRpcSrvTerminateIfSuspendedByProcess
RPC  95406f0b-b239-4318-91bb-cea3a46ff0dc (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectServicing
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvFullTrustOpenPackageHandle
	3 -> HamRpcSrvDebugClosePackageHandle
	4 -> HamRpcSrvServicingQueryActiveAppsInPackage
	5 -> HamRpcSrvServicingEnableServicing
	6 -> HamRpcSrvDebugTerminatePackage
RPC  0d47017b-b33b-46ad-9e18-fe96456c5078 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectSessionState
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvSessionStateLogoffUser
	3 -> HamRpcSrvSessionStateLogoffSession
RPC  dd59071b-3215-4c59-8481-972edadc0f6a (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> CrmRpcSrvRegister
	1 -> CrmRpcSrvUnregister
	2 -> CrmRpcSrvActivityAllocate
	3 -> CrmRpcSrvActivityQueryWindowClosedReasons
	4 -> CrmRpcSrvActivityFree
	5 -> CrmRpcSrvActivityStart
	6 -> CrmRpcSrvActivityRenew
	7 -> CrmRpcSrvActivityStop
	8 -> CrmRpcSrvActivityWindowClosedReasonSubscribe
	9 -> CrmRpcSrvActivityWindowClosedReasonUnsubscribe
RPC  d09bdeb5-6171-4a34-bfe2-06fa82652568 (1.0) -- c:\windows\system32\BrokerLib.dll
	0 -> _BriCreateEvent
	1 -> _BriDeleteEvent
	2 -> BriDisableEvent
	3 -> BriEnableEvent
	4 -> BriSignalEvent
RPC  9b008953-f195-4bf9-bde0-4471971e58ed (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> SebiEnumerateEvents
	1 -> _SebiEnumerateEventsByType
	2 -> _SebiQueryEventData
	3 -> SebiQueryEventPackage
	4 -> _SebiSignalSyncEventEx
	5 -> SebiGetUserPresenceHistory
RPC  697dcda9-3ba9-4eb2-9247-e11f1901b0d2 (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> CSebiCreateWellKnownEvent
	1 -> _CSebiCreatePrivateEvent
	2 -> _CSebiDeleteEvent
	3 -> CSebiEnumerateEvents
	4 -> CSebiQueryEventData
	5 -> CSebiCreateCustomEvent
RPC  1377d115-98fd-4034-b574-111156ca239c (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> _CSebiRegisterPublisher
	1 -> CSebiPublisherUpdateLevelEvent
	2 -> CSebiUnregisterPublisher
RPC  7419cf08-91a7-4afd-8f5e-1dd76de094fd (1.0) -- c:\windows\system32\DAB.dll
	0 -> s_DabRpcRegisterTriggerConsumer
	1 -> s_DabRpcUnregisterTriggerConsumer
	2 -> s_DabRpcGetLastScheduledRunTime
RPC  fc48cd89-98d6-4628-9839-86f7a3e4161a (1.0) -- C:\Windows\System32\ACPBackgroundManagerPolicy.dll
	0 -> MVoipSrvNotifyVoipActiveCall
	1 -> MVoipSrvNotifyVoipActivityCompleted
	2 -> MVoipSrvHoldActiveCall
	3 -> MVoipSrvUnholdActiveCall
	4 -> MVoipSrvNotifyIncomingCallDialogDisplayed
	5 -> MVoipSrvNotifyIncomingCallDialogDismissed
	6 -> MVoipSrvLaunchVoipRtcTask
	7 -> MVoipSrvLaunchVoipActivity
	8 -> MVoipSrvCancelVoipCall
OLE  7656cfa4-b63a-4542-a8de-ef402bac895d (0.0) -- IUserApplicationStateChangeHandler
OLE  43c6b434-c1be-4ad2-af03-c0deaccebd1f (0.0) -- IBackgroundAccessStateChangeHandler
OLE  0166231b-fd21-4e33-a713-75eb3207a138 (0.0) -- IBackgroundWorkItemInstanceRemote
Endpoints :
ncalrpc         : umpo
ncalrpc         : actkernel
ncalrpc         : LRPC-52052fd65c5c272467
ncalrpc         : OLE0B4A1FCA316D75160A1E9D74EAA9
ncalrpc         : LRPC-4ab018e2789c955e4e
ncalrpc         : LRPC-10ae42bf2b12c862e5
ncalrpc         : LRPC-72ebfc69859a71292b
ncalrpc         : LRPC-841d50e1fe23b6a7d7
ncalrpc         : LRPC-b950717adfd86cb405
ncalrpc         : csebpub
ncalrpc         : dabrpc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 940 at 0x5306550L>
64
['RpcEptMapper', 'RpcSs']

Interfaces :
RPC  e1af8308-5d1f-11c9-91a4-08002b14a0fa (3.0) -- c:\windows\system32\rpcepmap.dll
	0 -> ept_delete
	1 -> ept_delete
	2 -> ept_lookup
	3 -> ept_map
	4 -> ept_lookup_handle_free
	5 -> ept_delete
	6 -> ept_delete
	7 -> ept_map_auth
	8 -> ept_map_auth_async
RPC  0b0a6584-9e0f-11cf-a3cf-00805f68cb1b (1.1) -- c:\windows\system32\rpcepmap.dll
	0 -> OpenEndpointMapper
	1 -> AllocateReservedIPPort
	2 -> ept_insert_ex
	3 -> ept_delete_ex
	4 -> SetRestrictRemoteClients
	5 -> ResetWithNoAuthException
RPC  1d55b526-c137-46c5-ab79-638f2a68e869 (1.0) -- c:\windows\system32\rpcepmap.dll
	0 -> RemoteGetCellByDebugCellID
	1 -> RemoteOpenRPCDebugCallInfoEnumeration
	2 -> RemoteGetNextRPCDebugCallInfo
	3 -> RemoteFinishRPCDebugCallInfoEnumeration
	4 -> RemoteOpenRPCDebugEndpointInfoEnumeration
	5 -> RemoteGetNextRPCDebugEndpointInfo
	6 -> RemoteFinishRPCDebugEndpointInfoEnumeration
	7 -> RemoteOpenRPCDebugThreadInfoEnumeration
	8 -> RemoteGetNextRPCDebugThreadInfo
	9 -> RemoteFinishRPCDebugThreadInfoEnumeration
	10 -> RemoteOpenRPCDebugClientCallInfoEnumeration
	11 -> RemoteGetNextRPCDebugClientCallInfo
	12 -> RemoteFinishRPCDebugClientCallInfoEnumeration
RPC  64fe0b7f-9ef5-4553-a7db-9a1975777554 (1.0) -- C:\windows\system32\RpcRtRemote.dll
	0 -> FwConnectToManager
	1 -> FwSubscribeForNewRulesNotification
	2 -> FwInterfaceRegistered
RPC  e60c73e6-88f9-11cf-9af1-0020af6e72f4 (2.0) -- c:\windows\system32\rpcss.dll
	0 -> _Connect
	1 -> _SetAppID
	2 -> GetDefaultSecurityPermissions
	3 -> _AllocateReservedIds
	4 -> _BulkUpdateOIDs
	5 -> _ClientResolveOXID
	6 -> _ServerAllocateOXIDAndOIDs
	7 -> _ServerAllocateOIDs
	8 -> _ServerFreeOXIDAndOIDs
	9 -> _SetServerOIDFlags
	10 -> _Disconnect
	11 -> GetUpdatedResolverBindings
RPC  99fcfec4-5260-101b-bbcb-00aa0021347a (0.0) -- c:\windows\system32\rpcss.dll
	0 -> ResolveOxid
	1 -> SimplePing
	2 -> ComplexPing
	3 -> ServerAlive
	4 -> ResolveOxid2
	5 -> ServerAlive2
RPC  b9e79e60-3d52-11ce-aaa1-00006901293f (0.2) -- c:\windows\system32\rpcss.dll
	0 -> IrotRegister
	1 -> IrotRevoke
	2 -> IrotIsRunning
	3 -> IrotGetObject
	4 -> IrotNoteChangeTime
	5 -> IrotGetTimeOfLastChange
	6 -> IrotEnumRunning
	7 -> IMgotRegister
	8 -> IMgotRevoke
	9 -> IMgotGetObject
	10 -> IMgotEnumRunning
RPC  412f241e-c12a-11ce-abff-0020af6e7a17 (0.2) -- c:\windows\system32\rpcss.dll
	0 -> ServerRegisterClsid
	1 -> ServerRevokeClsid
	2 -> ServerRegisterActivatableClasses
	3 -> ServerRevokeActivatableClasses
	4 -> GetThreadID
	5 -> UpdateActivationSettings
	6 -> RegisterWindowPropInterface
	7 -> GetWindowPropInterface
	8 -> EnableDisableDynamicIPTracking
	9 -> GetCurrentAddrExclusionList
	10 -> SetAddrExclusionList
	11 -> FlushSCMBindings
	12 -> RetireServer
	13 -> NotifyDDStartOrStop
	14 -> QueryDragDropActive
	15 -> SetOrRevokeForcedDropTarget
	16 -> IsObjectCreationAllowed
	17 -> ControlTracingForProcess
	18 -> QueryPIDForActivation
	19 -> NotifyWinRTActivationStoreChanged
	20 -> DecodeProxy
	21 -> NotifyPsmResume
	22 -> QueryServerProcessHandleHeld
	23 -> RegisterRacActivationToken
	24 -> RevokeRacActivationToken
	25 -> RegisterConsoleHandles
	26 -> RevokeConsoleHandles
	27 -> NotifyComClassChangesFromDeployment
DCOM 00000136-0000-0000-c000-000000000046 (0.0) -- ISCMLocalActivator
RPC  c6f3ee72-ce7e-11d1-b71e-00c04fc3111a (1.0) -- c:\windows\system32\rpcss.dll
	0 -> ProcessActivatorStarted
	1 -> ProcessActivatorInitializing
	2 -> ProcessActivatorReady
	3 -> ProcessActivatorStopped
	4 -> ProcessActivatorPaused
	5 -> ProcessActivatorResumed
	6 -> ProcessActivatorUserInitializing
RPC  4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 (0.0) -- c:\windows\system32\rpcss.dll
	0 -> RemoteActivation
DCOM 000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
RPC  cb40a179-20e1-43f0-97fb-3c5c6ff37ec3 (0.0) -- c:\windows\system32\rpcss.dll
	0 -> CrossContainerActivation
Endpoints :
ncalrpc         : epmapper
ncacn_ip_tcp    : 135
ncacn_np        : \pipe\epmapper
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 980 at 0x5306cc0L>
64
['LSM']

Interfaces :
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
RPC  11f25515-c879-400a-989e-b074d5f092fe (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcGetUserToken
	1 -> RpcConnectTerminal
	2 -> RpcSystemShutdownStarted
	3 -> RpcConsumeCacheSession
	4 -> RpcGetRequestForWinlogon
	5 -> RpcReportWinlogonReply
	6 -> RpcGetReconnectId
	7 -> RpcCreateWorkerSession
	8 -> RpcGetWorkerSessionGpuLuid
RPC  1e665584-40fe-4450-8f6e-802362399694 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcBroadcastSystemMessage
	1 -> RpcSendWindowMessage
	2 -> RpcCreateSession
	3 -> RpcTerminateSession
RPC  484809d6-4239-471b-b5bc-61df8c23ac48 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcOpenSession
	1 -> RpcCloseSession
	2 -> RpcConnect
	3 -> RpcDisconnect
	4 -> RpcLogoff
	5 -> RpcGetUserName
	6 -> RpcGetTerminalName
	7 -> RpcGetState
	8 -> RpcIsSessionDesktopLocked
	9 -> RpcShowMessageBox
	10 -> RpcGetTimes
	11 -> RpcGetSessionCounters
	12 -> RpcGetSessionInformation
	13 -> RpcSwitchToServicesSession
	14 -> RpcRevertFromServicesSession
	15 -> RpcGetLoggedOnCount
	16 -> RpcGetSessionType
	17 -> RpcGetSessionInformationEx
	18 -> RpcIsTerminalRemote
	19 -> RpcIsBoundToCacheTerminal
	20 -> RpcConnectAndLockTargetDesktop
RPC  e3907f22-c899-44e7-9d11-9d8b3d924832 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcEnableChildSessions
	1 -> RpcIsChildSessionsEnabled
	2 -> RpcGetChildSessionId
	3 -> RpcGetParentSessionId
	4 -> RpcGetAllUserSessions
RPC  53825514-1183-4934-a0f4-cfdc51c3389b (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcIsCurrentSessionTerminalRemote
	1 -> RpcGetCurrentSessionTerminalName
	2 -> RpcGetCurrentSessionInformation
	3 -> RpcGetCurrentSessionCapabilities
	4 -> RpcGetCurrentSessionType
RPC  11899a43-2b68-4a76-92e3-a3d6ad8c26ce (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcWaitForSessionState
	1 -> RpcRegisterAsyncNotification
	2 -> RpcWaitAsyncNotification
	3 -> RpcUnRegisterAsyncNotification
RPC  c2d15ccf-a416-46dc-ba58-4624ac7a9123 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcRegisterCurrentSessionAsyncNotification
	1 -> RpcWaitAsyncNotificationEx
	2 -> RpcUnRegisterAsyncNotificationEx
RPC  88143fd0-c28d-4b2b-8fef-8d882f6a9390 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcOpenEnum
	1 -> RpcCloseEnum
	2 -> RpcFilterByState
	3 -> RpcFilterByCallersName
	4 -> RpcEnumAddFilter
	5 -> RpcGetEnumResult
	6 -> RpcFilterBySessionType
	7 -> RpcFilterByLicenseType
	8 -> RpcGetSessionIds
	9 -> RpcGetEnumResultEx
	10 -> RpcGetAllSessions
	11 -> RpcGetAllSessionsEx
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  517f87fe-597a-4672-8555-6daf1c8c788d (0.0) -- ISessionManager
OLE  75a446c5-40b7-41d3-8d53-292652c04121 (0.0) -- ITSEventDispatcher
OLE  959c5a99-177c-478e-8c3b-77e07e9bf3aa (0.0) -- ISessionList
OLE  a8105b4f-7d5a-402b-aac0-fd85daecf94c (0.0) -- ISessionEnum
OLE  a1b7de7a-4e77-43db-ae78-96fc182fed4a (0.0) -- ITSSession
OLE  1a8a5d71-d95b-4dcd-915e-f9f6d31879ad (0.0) -- ITerminal
OLE  6344a5b7-ef1c-47ba-98b7-28c664427793 (0.0) -- IGlassTerminal
OLE  c2d3e131-c587-49b4-8bae-f0ee269eeb31 (0.0) -- ITSSessionAttribute
OLE  35481b58-f46c-4254-b52c-fdc3001484c3 (0.0) -- IRestrictedCalls
OLE  4d10b48b-c531-4731-9bde-b03c28e9c61c (0.0) -- IUserName
Endpoints :
ncalrpc         : LRPC-6b49de762b15890702
ncalrpc         : LSMApi
ncacn_np        : \pipe\LSM_API_service
ncalrpc         : OLE3F9B241B15C1D6F0A2B264568291
--------------------------------------------------------------------------------
<WinProcess "LogonUI.exe" pid 420 at 0x5306278L>
64

Interfaces :
RPC  f3f09ffd-fbcf-4291-944d-70ad6e0e73bb (1.0) -- C:\windows\System32\logoncontroller.dll
	0 -> WluirAbort
	1 -> WluirSecureDisplayLocked
	2 -> WluirDisplayLocked
	3 -> WluirWaitForLockScreenDismiss
	4 -> WluirDisplayMessage
	5 -> WluirDisplayRequestCredentialsError
	6 -> WluirDisplaySecurityOptions
	7 -> WluirDisplayStatus
	8 -> WluirDisplayTSDisconnectOptions
	9 -> WluirDisplayWelcome
	10 -> WluirNotifyIsReadyForDesktopSwitch
	11 -> WluirPromptForCredentials
	12 -> WluirReleaseContext
	13 -> WluirClearUIState
	14 -> WluirReportResult
	15 -> WluirRequestCredentials
	16 -> WluirDisplayTSDisconnectUI
	17 -> WluirDisplayTSReconnectUI
	18 -> WluirNotifyUserIsLoggedOn
	19 -> WluirFinishOperation
	20 -> WluirInformLogonUI
	21 -> WluirDelayLocked
	22 -> WluirSecureDelayLocked
	23 -> WluirGetShutdownResolverInfo
	24 -> WluirSignalShutdown
	25 -> WluirPrepareWebDialog
	26 -> WluirWaitForWebDialogComplete
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  0000000c-0000-0000-c000-000000000046 (0.0) -- IStream
OLE  06386a7a-e009-5b0b-ab68-a8e48b516647 (0.0) -- __FIAsyncOperationWithProgressCompletedHandler_2_Windows__CStorage__CStreams__CIBuffer_UINT32
OLE  30d5a829-7fa4-4026-83bb-d75bae4ea99e (0.0) -- IClosable
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  ce17c10a-90f9-42e5-a43b-4ffee2f937a0 (0.0) -- IObjectWithRWLock
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
OLE  947aab5f-0a5c-4c13-b4d6-4bf7836fc9f8 (0.0) -- IFileOperation
Endpoints :
ncalrpc         : LRPC-7ad18c0181b776e795
ncalrpc         : OLE273901A57D58B270B18B090D94E5
--------------------------------------------------------------------------------
<WinProcess "dwm.exe" pid 416 at 0x53068d0L>
64

Interfaces :
RPC  df4df73a-c52d-4e3a-8003-8437fdf8302a (0.0) -- c:\windows\system32\coremessaging.dll
	0 -> ServerValidateWindowId
	1 -> ServerValidateWindowIdAndOwner
Endpoints :
ncalrpc         : LRPC-0004450a441212400f
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1104 at 0x53067f0L>
64
['NcbService']

Interfaces :
RPC  d09bdeb5-6171-4a34-bfe2-06fa82652568 (1.0) -- c:\windows\system32\BrokerLib.dll
	0 -> _BriCreateEvent
	1 -> _BriDeleteEvent
	2 -> BriDisableEvent
	3 -> BriEnableEvent
	4 -> BriSignalEvent
RPC  5222821f-d5e2-4885-84f1-5f6185a0ec41 (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> RpcSrvRegisterControlChannelReset
	1 -> RpcSrvUnregisterControlChannelReset
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\Windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
RPC  880fd55e-43b9-11e0-b1a8-cf4edfd72085 (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> KapiRegisterProvider
	1 -> KapiDeregisterProvider
	2 -> KapiUpdateKaSample
	3 -> KapiReceiveKaUpdateRequest
RPC  e40f7b57-7a25-4cd3-a135-7f7d3df9d16b (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> RpcSrvCreateSession
	1 -> RpcSrvDestroySession
	2 -> RpcSrvStartBrokeredActivation
	3 -> RpcSrvSetServerKeepAliveInterval
	4 -> RpcSrvGetCurrentKeepAliveInterval
	5 -> RpcSrvDecreaseKeepAliveInterval
	6 -> RpcSrvUsingTransport
	7 -> RpcSrvIndicateSlotAllocation
	8 -> RpcSrvSBCreatePushEnabledContext
	9 -> RpcSrvSBTransferOwnership
	10 -> RpcSrvSBRetrieveSocket
	11 -> RpcSrvSBCompleteRetrieveSocket
	12 -> RpcSrvSBRetrieveContext
	13 -> RpcSrvSBEnumSockets
	14 -> RpcSrvHotspotRegisterHotspotApp
	15 -> RpcSrvHotspotFindEventForPackage
	16 -> RpcSrvHotspotTriggerBackgroundEvent
	17 -> RpcSrvHotspotIsAppInstalled
	18 -> RpcSrvFirewallWcmSetFirewallRule
	19 -> RpcSrvFirewallWcmSetFirewallRuleFlags
	20 -> RpcSrvFirewallWcmDeleteFirewallRule
Endpoints :
ncalrpc         : LRPC-c671927dd9659a0385
ncalrpc         : LRPC-b104ee7e9393d8bf7f
ncalrpc         : OLE9C9313BE9E1E2574A19C7FAC69FC
ncalrpc         : LRPC-0c5aafc72066fcc0c4
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1176 at 0x5306978L>
64
['TimeBrokerSvc']

Interfaces :
RPC  82273fdc-e32a-18c3-3f78-827929dc23ea (0.0) -- c:\windows\system32\wevtsvc.dll
	0 -> ElfrClearELFW
	1 -> ElfrBackupELFW
	2 -> ElfrCloseEL
	3 -> ElfrDeregisterEventSource
	4 -> ElfrNumberOfRecords
	5 -> ElfrOldestRecord
	6 -> ElfrChangeNotify
	7 -> ElfrOpenELW
	8 -> ElfrRegisterEventSourceW
	9 -> ElfrOpenBELW
	10 -> ElfrReadELW
	11 -> ElfrReportEventW
	12 -> ElfrClearELFA
	13 -> ElfrBackupELFA
	14 -> ElfrOpenELA
	15 -> ElfrRegisterEventSourceA
	16 -> ElfrOpenBELA
	17 -> ElfrReadELA
	18 -> ElfrReportEventA
	19 -> ElfrRegisterClusterSvc
	20 -> ElfrDeregisterClusterSvc
	21 -> ElfrWriteClusterEvents
	22 -> ElfrGetLogInformation
	23 -> ElfrFlushEL
	24 -> ElfrReportEventAndSourceW
	25 -> ElfrReportEventExW
	26 -> ElfrReportEventExA
RPC  f6beaff7-1e19-4fbb-9f8f-b89e2018337c (1.0) -- c:\windows\system32\wevtsvc.dll
	0 -> _EvtRpcRegisterRemoteSubscription
	1 -> _EvtRpcRemoteSubscriptionNextAsync
	2 -> _EvtRpcRemoteSubscriptionNext
	3 -> EvtRpcRemoteSubscriptionWaitAsync
	4 -> EvtRpcRegisterControllableOperation
	5 -> _EvtRpcRegisterLogQuery
	6 -> EvtRpcClearLog
	7 -> EvtRpcExportLog
	8 -> EvtRpcLocalizeExportLog
	9 -> _EvtRpcMessageRender
	10 -> EvtRpcMessageRenderDefault
	11 -> _EvtRpcQueryNext
	12 -> _EvtRpcQuerySeek
	13 -> EvtRpcClose
	14 -> EvtRpcCancel
	15 -> _EvtRpcAssertConfig
	16 -> EvtRpcRetractConfig
	17 -> _EvtRpcOpenLogHandle
	18 -> _EvtRpcGetLogFileInfo
	19 -> _EvtRpcGetChannelList
	20 -> _EvtRpcGetChannelConfig
	21 -> EvtRpcPutChannelConfig
	22 -> _EvtRpcGetPublisherList
	23 -> EvtRpcGetPublisherListForChannel
	24 -> _EvtRpcGetPublisherMetadata
	25 -> _EvtRpcGetPublisherResourceMetadata
	26 -> EvtRpcGetEventMetadataEnum
	27 -> EvtRpcGetNextEventMetadata
	28 -> _EvtRpcGetClassicLogDisplayName
Endpoints :
ncalrpc         : eventlog
ncacn_np        : \pipe\eventlog
ncacn_ip_tcp    : 49665
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1288 at 0x5306400L>
64
['vmickvpexchange']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1308 at 0x53060b8L>
64
['vmicrdv']

Interfaces :
RPC  f763c91c-2ab1-47fa-868f-7de7efd42194 (1.0) -- C:\windows\system32\vmrdvcore.dll
	0 -> VmGetAppAllowListEntryByAlias
	1 -> VmVerifyAppAllowed
Endpoints :
ncalrpc         : RdvVmAllowListRpc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1348 at 0x53062e8L>
64
['vmicshutdown']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1372 at 0x53069b0L>
64
['vmictimesync']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1392 at 0x5306ac8L>
64
['UmRdpService']

Interfaces :
RPC  7212a04b-b463-402e-9649-2ba477394676 (1.0) -- c:\windows\system32\umrdp.dll
	0 -> CTSEventFilterBlockAllEvents::AllowTSEvent
	1 -> RpcOpenDevice
	2 -> RpcCloseDevice
	3 -> RpcGetSessionId
	4 -> RpcGetInterfaceGuids
	5 -> RpcGetClientDeviceId
	6 -> RpcGetDeviceCaps
RPC  c80066a8-7579-44fc-b9b2-8466930791b0 (1.0) -- c:\windows\system32\umrdp.dll
	0 -> RpcPrintDrvGetInfo
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : RemoteDevicesLPC_API
ncalrpc         : TSUMRPD_PRINT_DRV_LPC_API
ncalrpc         : OLEF239C965B5F7A486BA655D8FB6B3
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1408 at 0x5306b00L>
64
['vmicvss']

Interfaces :
RPC  326731e3-c1c0-4a69-ae20-7d9044a4ea5c (1.0) -- c:\windows\system32\profsvc.dll
	0 -> DropClientContext
	1 -> ReleaseClientContext
	2 -> LoadUserProfileServer
	3 -> UnloadUserProfileServer
	4 -> DeleteProfileServer
	5 -> RemapProfileServer
	6 -> CreateProfileServer
	7 -> ProcessWmiSettingsServer
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
Endpoints :
ncalrpc         : IUserProfile2
ncalrpc         : OLE578C3DF3149721A3389842CC648C
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1604 at 0x5306be0L>
64
['nsi']

Interfaces :
RPC  7ea70bcf-48af-4f6a-8968-6a440754d5fa (1.0) -- c:\windows\system32\nsisvc.dll
	0 -> RpcNsiGetParameter
	1 -> RpcNsiGetAllParameters
	2 -> RpcNsiEnumerateObjectsAllParameters
	3 -> RpcNsiSetParameter
	4 -> RpcNsiSetAllParameters
	5 -> RpcNsiRegisterChangeNotification
	6 -> RpcNsiDeregisterChangeNotification
	7 -> RpcNsiRequestChangeNotification
	8 -> RpcNsiParameterChange
Endpoints :
ncalrpc         : LRPC-743e6bda820abcb648
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1652 at 0x53063c8L>
64
['EventSystem']

Interfaces :
RPC  b58aa02e-2884-4e97-8176-4ee06d794184 (1.0) -- c:\windows\system32\sysmain.dll
	0 -> PfRpcServerExecuteCommand
Endpoints :
ncalrpc         : LRPC-7489ddaf2de31ec276
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1684 at 0x5306080L>
64
['Themes']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "Memory Compression" pid 1932 at 0x5306da0L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1980 at 0x5306518L>
64
['Dhcp']

Interfaces :
RPC  3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 (1.0) -- C:\windows\system32\dhcpcore6.dll
	0 -> RpcSrvRequestPrefixEx
	1 -> RpcSrvRenewPrefixEx
	2 -> RpcSrvReleasePrefixEx
	3 -> RpcSrvCancelOperation
	4 -> RpcSrvEnablev6Tracing
	5 -> RpcSrvRequestParams
	6 -> RpcSrvAcquireParametersv6
	7 -> RpcSrvReleaseParametersv6
	8 -> RpcSrvQueryLeaseInfov6
	9 -> RpcSrvGetTraceArray
	10 -> RpcSrvSetUserClass
	11 -> RpcSrvQueryLeaseInfov6Array
	12 -> RpcSrvEnableDhcpv6
RPC  3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 (1.0) -- c:\windows\system32\dhcpcore.dll
	0 -> RpcSrvEnableDhcp
	1 -> RpcSrvRenewLease
	2 -> RpcSrvDeleteStaticAddressAndDefaultGateways
	3 -> RpcSrvCheckServerAvailability
	4 -> RpcSrvRenewLeaseByBroadcast
	5 -> RpcSrvReleaseLease
	6 -> RpcSrvSetFallbackParams
	7 -> RpcSrvGetFallbackParams
	8 -> RpcSrvFallbackRefreshParams
	9 -> RpcSrvStaticRefreshParams
	10 -> RpcSrvRemoveDnsRegistrations
	11 -> RpcSrvRequestParams
	12 -> RpcSrvPersistentRequestParams
	13 -> RpcSrvRegisterParams
	14 -> RpcSrvDeRegisterParams
	15 -> RpcSrvEnumInterfaces
	16 -> RpcSrvQueryLeaseInfo
	17 -> RpcSrvQueryLeaseInfoArray
	18 -> RpcSrvSetClassId
	19 -> RpcSrvGetClassId
	20 -> RpcSrvSetClientId
	21 -> RpcSrvGetClientId
	22 -> RpcSrvNotifyMediaReconnected
	23 -> RpcSrvGetOriginalSubnetMask
	24 -> RpcSrvSetMSFTVendorSpecificOptions
	25 -> RpcSrvRequestCachedParams
	26 -> RpcSrvRegisterConnectionStateNotification
	27 -> RpcSrvDeRegisterConnectionStateNotification
	28 -> RpcSrvGetNotificationStatus
	29 -> RpcSrvGetDhcpServicedConnections
	30 -> RpcSrvGetTraceArray
	31 -> RpcSrvEnableTracing
	32 -> RpcSrvLeaseIpAddressEx
	33 -> RpcSrvRenewIpAddressLeaseEx
	34 -> RpcSrvReleaseIpAddressLeaseEx
	35 -> RpcSrvMadcapApiStartup
	36 -> RpcSrvMadcapApiCleanup
	37 -> RpcSrvMadcapEnumerateScopes
	38 -> RpcSrvMadcapGenUID
	39 -> RpcSrvMadcapRequestAddress
	40 -> RpcSrvMadcapRenewAddress
	41 -> RpcSrvMadcapReleaseAddress
Endpoints :
ncalrpc         : dhcpcsvc6
ncalrpc         : dhcpcsvc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1132 at 0x5306ef0L>
64
['CertPropSvc']

Interfaces :
RPC  30b044a5-a225-43f0-b3a4-e060df91f9c1 (1.0) -- c:\windows\system32\certprop.dll
	0 -> s_RPC_SmartCardRootCertsNotifyService
	1 -> s_RPC_SmartCardCertsNotifyService
Endpoints :
ncalrpc         : LRPC-0bf0ff1ef1a9db2596
--------------------------------------------------------------------------------
<WinProcess "VSSVC.exe" pid 404 at 0x5306a20L>
64
['VSS']

Interfaces :
RPC  0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> ItSrvRegisterIdleTask
	1 -> ItSrvUnregisterIdleTask
	2 -> ItSrvProcessIdleTasks
	3 -> ItSrvSetDetectionParameters
	4 -> ItSrvSetRuntimeOverrides
RPC  1ff70682-0a51-30e8-076d-740be8cee98b (1.0) -- C:\windows\system32\taskcomp.dll
	0 -> NetrJobAdd
	1 -> NetrJobDel
	2 -> NetrJobEnum
	3 -> NetrJobGetInfo
RPC  378e52b0-c0a9-11cf-822d-00aa0051e40f (1.0) -- C:\windows\system32\taskcomp.dll
	0 -> SASetAccountInformation
	1 -> SASetNSAccountInformation
	2 -> SAGetNSAccountInformation
	3 -> SAGetAccountInformation
RPC  2a82bb21-e44f-4791-9aa1-dfae788e2f43 (1.0) -- c:\windows\system32\UBPM.dll
	0 -> s_UbpmRpcOpenTaskHostChannel
	1 -> s_UbpmRpcCloseTaskHostChannel
	2 -> s_UbpmRpcTaskHostSendResponseReceiveCommand
	3 -> s_UbpmRpcTaskHostReportTaskStatus
RPC  33d84484-3626-47ee-8c6f-e7e98b113be1 (2.0) -- C:\windows\SYSTEM32\WPTaskScheduler.dll
	0 -> s_TaskSchedulerCreateSchedule
	1 -> s_TaskSchedulerDeleteSchedule
	2 -> s_TaskSchedulerFindFirstSchedule
	3 -> s_TaskSchedulerFindNextSchedule
	4 -> s_TaskSchedulerFindScheduleClose
	5 -> s_TaskSchedulerGetSchedule
	6 -> s_TaskSchedulerEnableSchedule
	7 -> s_TaskSchedulerExecuteSchedule
	8 -> s_TaskSchedulerAdvanceSchedule
	9 -> s_TaskSchedulerAdvanceScheduleIntervals
	10 -> s_TaskSchedulerSnoozeSchedule
	11 -> s_TaskSchedulerGetPublishStateName
	12 -> s_TaskSchedulerServiceControl
RPC  86d35949-83c9-4044-b424-db363231fd0c (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> SchRpcHighestVersion
	1 -> _SchRpcRegisterTask
	2 -> SchRpcRetrieveTask
	3 -> SchRpcCreateFolder
	4 -> SchRpcSetSecurity
	5 -> SchRpcGetSecurity
	6 -> SchRpcEnumFolders
	7 -> SchRpcEnumTasks
	8 -> SchRpcEnumInstances
	9 -> SchRpcGetInstanceInfo
	10 -> SchRpcStopInstance
	11 -> SchRpcStop
	12 -> SchRpcRun
	13 -> SchRpcDelete
	14 -> SchRpcRename
	15 -> SchRpcScheduledRuntimes
	16 -> SchRpcGetLastRunInfo
	17 -> _SchRpcGetTaskInfo
	18 -> SchRpcGetNumberOfMissedRuns
	19 -> SchRpcEnableTask
RPC  3a9ef155-691d-4449-8d05-09ad57031823 (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> I_pSchRpcRegisterTask
	1 -> I_pSchRpcEnumTasks
	2 -> I_pSchRpcGetTaskInfo
	3 -> I_pSchRpcAquireTaskStateNotificationsName
	4 -> I_pAcquireBackgroundExecutionMode
	5 -> I_pReleaseBackgroundExecutionMode
	6 -> I_pSetTaskDisabledForCurrentUser
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-69ba40d97baa37e78b
ncacn_np        : \PIPE\atsvc
ncalrpc         : ubpmtaskhostchannel
ncalrpc         : LRPC-1eae62186b2bb71d85
ncacn_ip_tcp    : 49666
ncalrpc         : OLEB9967DDCAAC08A0219EA8093CC24
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2056 at 0x5306828L>
64
['SENS']

Interfaces :
RPC  63fbe424-2029-11d1-8db8-00aa004abd5e (1.0) -- c:\windows\system32\sens.dll
	0 -> RPC_IsNetworkAlive
	1 -> RPC_IsDestinationReachableA
	2 -> RPC_IsDestinationReachableA
RPC  a0bc4698-b8d7-4330-a28f-7709e18b6108 (4.0) -- c:\windows\system32\sens.dll
	0 -> RPC_SensNotifyWinlogonEvent
	1 -> RPC_SensNotifyRasEvent
	2 -> RPC_SensNotifyNetconEvent
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  97312c82-d4c2-11d1-b682-00805fc79216 (0.0) -- ICollectionNotify
Endpoints :
ncalrpc         : senssvc
ncalrpc         : LRPC-cc6192df9611677bb5
ncalrpc         : OLE12DBE078CDEC19CDB2151EB60065
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2132 at 0x5306fd0L>
64
['AudioEndpointBuilder']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2156 at 0x5319898L>
64
['FontCache']

Interfaces :
RPC  f2c9b409-c1c9-4100-8639-d8ab1486694a (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> ClusterConnectUpcall
	1 -> ClusterDisConnectUpcall
RPC  eb081a0d-10ee-478a-a1dd-50995283e7a8 (3.0) -- c:\windows\system32\wkssvc.dll
	0 -> GetWitnessNodes
RPC  6bffd098-a112-3610-9833-46c3f87e345a (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> NetrWkstaGetInfo
	1 -> NetrWkstaSetInfo
	2 -> NetrWkstaUserEnum
	3 -> NetrWkstaUserGetInfo
	4 -> NetrWkstaUserSetInfo
	5 -> NetrWkstaTransportEnum
	6 -> NetrWkstaTransportAdd
	7 -> NetrWkstaTransportDel
	8 -> NetrUseAdd
	9 -> NetrUseGetInfo
	10 -> NetrUseDel
	11 -> NetrUseEnum
	12 -> I_NetrLogonDomainNameAdd
	13 -> NetrWorkstationStatisticsGet
	14 -> I_NetrLogonDomainNameAdd
	15 -> I_NetrLogonDomainNameAdd
	16 -> I_NetrLogonDomainNameAdd
	17 -> I_NetrLogonDomainNameAdd
	18 -> I_NetrLogonDomainNameAdd
	19 -> I_NetrLogonDomainNameAdd
	20 -> NetrGetJoinInformation
	21 -> I_NetrLogonDomainNameAdd
	22 -> NetrJoinDomain2
	23 -> NetrUnjoinDomain2
	24 -> NetrRenameMachineInDomain2
	25 -> NetrValidateName2
	26 -> NetrGetJoinableOUs2
	27 -> NetrAddAlternateComputerName
	28 -> NetrRemoveAlternateComputerName
	29 -> NetrSetPrimaryComputerName
	30 -> NetrEnumerateComputerNames
RPC  7f1343fe-50a9-4927-a778-0c5859517bac (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> DfsDsGetDcName
	1 -> DfsDsIsDomainController
	2 -> DfsCredWrite
	3 -> DfsCredDelete
Endpoints :
ncalrpc         : LRPC-28f9e92a2d2927492b
ncacn_np        : \PIPE\wkssvc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2256 at 0x5319cc0L>
64
['NlaSvc']

Interfaces :
RPC  aa411582-9bdf-48fb-b42b-faa1eee33949 (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> PMuxRpcPluginRegister
	1 -> PMuxRpcPluginUnregister
	2 -> PMuxRpcPluginDataIndicate
RPC  c33b9f46-2088-4dbc-97e3-6125f127661c (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> AppSrv_NlaOpenQuery
	1 -> AppSrv_NlaAsyncIndicate
	2 -> AppSrv_NlaRefreshQuery
	3 -> AppSrv_NlaCloseQuery
	4 -> RpcNlaIndicateReprobe
	5 -> RpcNlaGetCaptivePortalHosts
RPC  4c8d0bef-d7f1-49f0-9102-caa05f58d114 (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> RPCQueryLANIds
Endpoints :
ncalrpc         : nlaplg
ncalrpc         : nlaapi
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2308 at 0x5319f60L>
64
['Dnscache']

Interfaces :
RPC  45776b01-5956-4485-9f80-f428f7d60129 (2.0) -- c:\windows\system32\dnsrslvr.dll
	0 -> CRrReadCache
	1 -> R_ResolverGetConfig
	2 -> R_ResolverFlushCache
	3 -> R_ResolverFlushCacheEntry
	4 -> R_ResolverQuery
	5 -> R_DnsRegisterLocal
	6 -> R_DnsDeRegisterLocal
	7 -> R_DnsStartMulticastQuery
	8 -> R_DnsGetMulticastData
	9 -> R_DnsStopMulticastQuery
	10 -> R_ResolverSimpleOp
	11 -> R_DnsGetProxyInformation
	12 -> R_DnsGetPolicyTableInfo
	13 -> R_DnsSetConnectionPolicyInfo
	14 -> R_DnsDeleteConnectionPolicyInfo
	15 -> R_DnsGetSettings
	16 -> R_DnsSetSettings
	17 -> R_DnsGetInterfaceSettings
	18 -> R_DnsSetInterfaceSettings
	19 -> R_DnsGetAdaptersInfo
Endpoints :
ncalrpc         : DNSResolver
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2360 at 0x5319da0L>
64
['Audiosrv']

Interfaces :
RPC  09704557-82c0-416b-b6e4-c85b8f789803 (2.8) -- c:\windows\system32\audiosrv.dll
	0 -> AudioServerGetMixFormat
	1 -> AudioServerIsFormatSupported
	2 -> AudioServerGetDevicePeriod
	3 -> AudioServerIsOffloadCapable
	4 -> AudioServerInitialize
	5 -> AudioServerDisconnect
	6 -> AudioServerGetAudioSession
	7 -> AudioServerCreateStream
	8 -> AudioServerStartStream
	9 -> AudioServerStopStream
	10 -> AudioServerPreStartStream
	11 -> AudioServerStartStreamAborted
	12 -> AudioServerResetEndpoint
	13 -> AudioServerDestroyStream
	14 -> AudioServerGetEndpointBufferSize
	15 -> AudioServerGetStreamLatency
	16 -> AudioServerSetStreamSampleRate
	17 -> AudioServerGetChannelCount
	18 -> AudioServerSetChannelVolume
	19 -> AudioServerGetChannelVolume
	20 -> AudioServerSetAllVolumes
	21 -> AudioServerGetAllVolumes
	22 -> AudioServerSetAllInitialVolumesWithRamp
	23 -> AudioSessionGetId
	24 -> AudioSessionGetInstanceId
	25 -> AudioSessionGetStreamSwitchId
	26 -> AudioSessionGetProcessId
	27 -> AudioSessionGetState
	28 -> AudioSessionGetLastActivation
	29 -> AudioSessionGetLastInactivation
	30 -> AudioSessionIsSystemSoundsSession
	31 -> AudioSessionGetDisplayOptions
	32 -> AudioSessionGetDisplayName
	33 -> AudioSessionSetDisplayName
	34 -> AudioSessionGetIconPath
	35 -> AudioSessionSetIconPath
	36 -> AudioSessionGetGroupingParam
	37 -> AudioSessionSetGroupingParam
	38 -> AudioSessionGetVolume
	39 -> AudioSessionSetVolume
	40 -> AudioSessionGetMute
	41 -> AudioSessionSetMute
	42 -> AudioSessionGetChannelCount
	43 -> AudioSessionSetChannelVolume
	44 -> AudioSessionGetChannelVolume
	45 -> AudioSessionSetAllVolumes
	46 -> AudioSessionGetAllVolumes
	47 -> AudioSessionPropertyStoreCommit
	48 -> AudioSessionPropertyStoreGetAt
	49 -> AudioSessionPropertyStoreGetCount
	50 -> AudioSessionPropertyStoreGetValue
	51 -> AudioSessionPropertyStoreSetValue
	52 -> AudioSessionSetDuckingPreference
	53 -> AudioSessionGetDuckingState
	54 -> AudioSessionGetIsComms
	55 -> AudioSessionDestroy
	56 -> AudioSessionMeterGetPeakValue
	57 -> AudioSessionMeterGetMeteringChannelCount
	58 -> AudioSessionMeterGetChannelsPeakValues
	59 -> AudioSessionSetWindowId
	60 -> PolicyConfigGetMixFormat
	61 -> PolicyConfigGetDeviceFormat
	62 -> PolicyConfigSetDeviceFormat
	63 -> PolicyConfigResetDeviceFormat
	64 -> PolicyConfigGetProcessingPeriod
	65 -> PolicyConfigSetProcessingPeriod
	66 -> PolicyConfigGetShareMode
	67 -> PolicyConfigSetShareMode
	68 -> PolicyConfigGetPropertyValue
	69 -> PolicyConfigSetPropertyValue
	70 -> PolicyConfigSetDefaultEndpoint
	71 -> PolicyConfigSetEndpointVisibility
	72 -> PolicyConfigSetEndpointAbilityToBeDefault
	73 -> PolicyConfigSetAccessibilityAudioMonoMixState
	74 -> PolicyConfigGetAccessibilityAudioMonoMixState
	75 -> PolicyConfigValidateSpatialAudioSettings
	76 -> PolicyConfigReportSpatialLicenseChanged
	77 -> PolicyConfigSetMixedRealitySpatialAudioFormatPolicy
	78 -> PolicyConfigGetDeviceFormatAndSpatialSettings
	79 -> PolicyConfigSetDeviceSpatialSettings
	80 -> PolicyConfigAddDynamicRoutingRule
	81 -> PolicyConfigRemoveDynamicRoutingRule
	82 -> PolicyConfigUpdateDynamicRoutingRule
	83 -> PolicyConfigGetDynamicRoutingRule
	84 -> GetAudioSessionManager
	85 -> AudioSessionManagerDestroy
	86 -> AudioSessionManagerGetAudioSessions
	87 -> AudioSessionManagerGetCurrentSession
	88 -> AudioSessionManagerGetExistingSession
	89 -> AudioSessionManagerGetSessionForStreamSwitch
	90 -> AudioSessionManagerAddAudioSessionClientNotification
	91 -> AudioSessionManagerDeleteAudioSessionClientNotification
	92 -> AudioSessionManagerAddVolumeDuckNotification
	93 -> AudioSessionManagerDeleteVolumeDuckNotification
	94 -> AudioVolumeConnect
	95 -> AudioVolumeDisconnect
	96 -> AudioVolumeQueryHardwareSupport
	97 -> AudioVolumeGetVolumeRange
	98 -> AudioVolumeGetChannelCount
	99 -> AudioVolumeSetMasterVolumeLevel
	100 -> AudioVolumeSetMasterVolumeLevelScalar
	101 -> AudioVolumeGetMasterVolumeLevel
	102 -> AudioVolumeGetMasterVolumeLevelScalar
	103 -> AudioVolumeSetChannelVolumeLevel
	104 -> AudioVolumeSetChannelVolumeLevelScalar
	105 -> AudioVolumeGetChannelVolumeLevel
	106 -> AudioVolumeGetChannelVolumeLevelScalar
	107 -> AudioVolumeSetMute
	108 -> AudioVolumeGetMute
	109 -> AudioVolumeAddMasterVolumeNotification
	110 -> AudioVolumeDeleteMasterVolumeNotification
	111 -> AudioMeterGetPeakValue
	112 -> AudioMeterGetMeteringChannelCount
	113 -> AudioMeterGetChannelsPeakValues
	114 -> AudioVolumeGetStepInfo
	115 -> AudioVolumeStepUp
	116 -> AudioVolumeStepDown
	117 -> AudioServerGetBufferSizeLimits
	118 -> AudioServerSetLastBufferInProgress
	119 -> AudioServerIsRawStreamSupported
	120 -> AudioServerDeriveStreamCategory
	121 -> AudioServerGetStreamVpoContext
	122 -> AudioServerGetEndpointVpoContext
	123 -> AudioServerCloseVpoContext
	124 -> AudioServerGetCurrentSharedModeEnginePeriod
	125 -> AudioServerGetSharedModeEnginePeriod
	126 -> AudioServerRequestSpatialDynamicObjects
	127 -> AudioServerSetAmbMetadata
	128 -> AudioServerSetAmbHeadTracking
	129 -> AudioServerGetAmbHeadTracking
	130 -> AudioServerSetAmbRotation
	131 -> asm_GetApplicationSubmixContext
	132 -> asm_GetApplicationSubmixContextFromPID
	133 -> asm_GetApplicationSubmixContextForProcessTree
	134 -> asm_ApplicationSubmixContextDestroy
	135 -> asm_GetApplicationSubmixes
	136 -> asm_ApplicationSubmixDestroy
	137 -> asm_AudioServerGetApplicationSubmixFormat
	138 -> asm_AudioServerGetApplicationSubmixPeriod
	139 -> asm_AudioServerGetApplicationSubmixId
	140 -> asm_GetApplicationSubmixFromId
	141 -> asm_AudioServerInitializeStream
	142 -> AudioServerTelephonyControlStartSession
	143 -> AudioServerTelephonyControlIsSessionStarted
	144 -> AudioServerTelephonyControlEndSession
	145 -> AudioServerTelephonyControlSetRoutingPolicy
	146 -> AudioServerTelephonyControlGetRoutingPolicy
	147 -> AudioServerTelephonyControlSetCallState
	148 -> AudioServerTelephonyControlGetCallState
	149 -> AudioServerTelephonyControlProviderChange
	150 -> AudioServerTelephonyControlSetMute
	151 -> AudioServerTelephonyControlGetMute
	152 -> AudioServerTelephonyControlSetVOIPMute
	153 -> AudioServerTelephonyControlGetVOIPMute
	154 -> AudioServerTelephonyControlSetVolume
	155 -> AudioServerTelephonyControlGetMaxCallInstanceCount
	156 -> AudioServerTelephonyControlGetValidTelephonyInstance
	157 -> AudioServerGetAudioHistoryProducerHandle
	158 -> AudioServerReleaseAudioHistoryProducerHandle
	159 -> AudioServerGetAudioHistoryProducerInfo
	160 -> AudioServerPopulateAudioHistoryForStream
	161 -> PolicyConfigGetEndpointExtendedSpatialLicenseInfo
RPC  7c69ac10-fa12-4dbf-90d9-c7f1e40f5dc5 (1.6) -- c:\windows\system32\audiosrv.dll
	0 -> s_winmmGetPnpInfo
	1 -> s_mmeNotifyDeviceStateChanged
	2 -> s_mmeNotifyDeviceAdded
	3 -> s_mmeNotifyDeviceRemoved
	4 -> s_mmeNotifyDefaultDeviceChanged
	5 -> s_tsSessionGetAudioProtocol
	6 -> s_tsRegisterAudioProtocolNotification
	7 -> s_tsUnregisterAudioProtocolNotification
	8 -> s_sndevtResolveSoundAlias
	9 -> s_pbmRegisterPlaybackManagerNotifications
	10 -> s_pbmUnregisterPlaybackManagerNotifications
	11 -> s_pbmSetSmtcSubscriptionState
	12 -> s_pbmGetSoundLevel
	13 -> s_ccCreateHandsfreeHidFileFromAudioId
	14 -> s_pbmRegisterAppClosureNotification
	15 -> s_pbmUnregisterAppClosureNotification
	16 -> s_pbmPlayToStreamStateChanged
	17 -> s_pbmIsPlaying
	18 -> s_pbmCastingAppStateChanged
	19 -> s_pbmVoipCallStateChanged
	20 -> s_pbmLaunchBackgroundTask
	21 -> s_pbmRegisterAsBackgroundTask
	22 -> s_afxOpenAudioEffectsWatcher
	23 -> s_afxCloseAudioEffectsWatcher
	24 -> s_midiOpenPort
	25 -> s_rtgGetDefaultAudioEndpoint
	26 -> s_apmRegisterProxyAudioProcess
	27 -> s_apmSetDuckingGainForId
	28 -> s_apmSetLayoutGainForId
	29 -> s_apmSetVolumeGroupGainForId
	30 -> s_apmSetVolumeGroupGainScalarForId
	31 -> s_apmSetVolumeGroupMuteForId
	32 -> s_setRingerVibrateState
	33 -> s_getRingerVibrateState
	34 -> s_getEmergencyCallbackMode
	35 -> s_setEmergencyCallbackMode
	36 -> s_apmSetPersistedDefaultAudioEndpoint
	37 -> s_apmGetPersistedDefaultAudioEndpoint
	38 -> s_apmClearAllPersistedApplicationDefaultEndpoints
	39 -> s_apmRegisterAudioStateMonitor
	40 -> s_apmUnregisterAudioStateMonitor
	41 -> s_apmHandleEuVolumeNotificationResponse
	42 -> AudioServerTelephonyControlGetCallStateSync
	43 -> AudioServerTelephonyControlGetMuteSync
	44 -> s_apmSetBalanceGroupBalanceForId
	45 -> s_apmSetPreferredChatApplication
	46 -> s_apmResetPreferredChatApplication
	47 -> s_CreateHolographicDisplay
	48 -> s_DestroyHolographicDisplay
	49 -> s_GetHeadRotation
RPC  910562c3-ebd9-46b9-baba-1d45842a0ceb (1.0) -- c:\windows\system32\audiosrv.dll
	0 -> s_pbmReportAppInteractivityChange
	1 -> CHybridPropertyStore::Commit
	2 -> s_pbmAllowMediaPlaybackForApp
	3 -> s_CapabilityAccessManagerNotification
	4 -> s_pbmRegisterAppManagerNotification
	5 -> s_pbmUnregisterAppManagerNotification
	6 -> s_pbmReportAppClosing
	7 -> s_pbmReportHostedAppStateChange
	8 -> s_SetScreenReaderState
	9 -> s_pbmSwitchSoftNonInteractiveAppsToHardNonInteractive
	10 -> s_pbmReportApplicationState
	11 -> s_pbmSetApplicationViewPosition
RPC  cba4c918-e55a-46ee-aa62-cade158e9165 (1.0) -- c:\windows\system32\audiosrv.dll
	0 -> s_adGetDeviceGraphWnfStateName
RPC  c7ce3826-891f-4376-b161-c63d2403142c (1.0) -- c:\windows\system32\audiosrv.dll
	0 -> s_RequestHrtfData
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  a8a900c6-da0b-5bcc-a71a-be0b9265d87a (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageInstallingEventArgs
OLE  bd636cf1-541f-53ea-8efc-e1604a395b1a (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageUninstallingEventArgs
OLE  2f732065-eff0-4c7c-8fc1-363851b1f1d7 (0.0) -- iaudiographcallback
Endpoints :
ncalrpc         : AudioClientRpc
ncalrpc         : Audiosrv
ncalrpc         : PlaybackManagerRpc
ncalrpc         : AudioSrvDiagnosticsRpc
ncalrpc         : SpatialSoundDataManagerRpc
ncalrpc         : OLEA1694B7BE165BE08A75BA4D67625
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2440 at 0x5319a58L>
64
['SessionEnv']

Interfaces :
RPC  3473dd4d-2e88-4006-9cba-22570909dd10 (5.1) -- c:\windows\system32\winhttp.dll
	0 -> GetProxyForUrl
	1 -> ResetAutoProxy
	2 -> SaveProxyCredentials
	3 -> StoreSavedProxyCredentialsForCurrentUser
	4 -> DeleteSavedProxyCredentials
	5 -> ReindicateAllProxies
	6 -> ReadProxySettings
	7 -> WriteProxySettings
	8 -> ConnectionUpdateIfIndexTable
	9 -> ConnectionSetPolicyEntries
	10 -> ConnectionDeletePolicyEntries
RPC  824d8d77-a27f-4915-a536-36e9283dce29 (5.1) -- c:\windows\system32\winhttp.dll
	0 -> s_PacWorkerCallbackInitSessionRpc
	1 -> s_PacWorkerCallbackCloseSessionRpc
	2 -> s_PacWorkerCallbackIsResolvableRpc
	3 -> s_PacWorkerCallbackIsResolvableExRpc
	4 -> s_PacWorkerCallbackIsInNetRpc
	5 -> s_PacWorkerCallbackIsInNetExRpc
	6 -> s_PacWorkerCallbackDnsResolveRpc
	7 -> s_PacWorkerCallbackDnsResolveExRpc
	8 -> s_PacWorkerCallbackMyIpAddressRpc
	9 -> s_PacWorkerCallbackMyIpAddressExRpc
	10 -> s_PacWorkerCallbackSortIpAddressListRpc
Endpoints :
ncalrpc         : LRPC-1106d284665f4b3d5d
ncalrpc         : a13b2b26-4e2b-4250-bff3-06ba3da81956
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2252 at 0x5319240L>
64
['Wcmsvc']

Interfaces :
RPC  abfb6ca3-0c5e-4734-9285-0aee72fe8d1c (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcOpenHandle
	1 -> RpcCloseHandle
	2 -> RpcEnumInterfaces
	3 -> RpcQueryParameter
	4 -> RpcSetParameter
	5 -> RpcQueryPublicParameter
	6 -> RpcSetPublicParameter
	7 -> RpcSetProfileList
	8 -> RpcGetProfileList
	9 -> RpcGetProfileListByPurpose
	10 -> RpcGetTokens
	11 -> RpcOrderConnection
	12 -> RpcBeginIgnoreProfileList
	13 -> RpcResetIgnoreProfileList
	14 -> RpcEndIgnoreProfileList
	15 -> RpcOpenOnDemandRequestHandle
	16 -> RpcOpenOnDemandRequestHandleByWwanProfileName
	17 -> RpcStartOnDemandRequest
	18 -> RpcCancelOnDemandRequest
	19 -> RpcCloseOnDemandRequestHandle
	20 -> RpcQueryOnDemandRequestStateInfo
RPC  b37f900a-eae4-4304-a2ab-12bb668c0188 (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcRegisterForNotifications
	1 -> RpcGetPendingNotification
	2 -> RpcCloseNotificationsHandle
	3 -> RpcAcquireSelectableConnectionAsync
	4 -> RpcReleaseSelectableConnection
	5 -> RpcGetSelectableConnectionList
	6 -> RpcGetInterfaceContextTable
	7 -> RpcAddRoutePolicy
	8 -> RpcRemoveRoutePolicy
	9 -> RpcRemoveMatchingRoutePolicy
	10 -> RpcGetRoutingHint
	11 -> RpcCheckCapabilityStatus
RPC  e7f76134-9ef5-4949-a2d6-3368cc0988f3 (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcEnterConnectedStandby
	1 -> RpcExitConnectedStandby
	2 -> RpcEnterNetQuiet
	3 -> RpcExitNetQuiet
RPC  7aeb6705-3ae6-471a-882d-f39c109edc12 (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcSetOperatorDataplanStatus
	1 -> RpcSetOperatorConnectionCost
	2 -> RpcSetOperatorCycleData
RPC  f44e62af-dab1-44c2-8013-049a9de417d6 (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcUpdateCapabilityAccess
	1 -> RpcDeprovisionCapability
RPC  c2d1b5dd-fa81-4460-9dd6-e7658b85454b (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcSetProxyInformation
	1 -> RpcDeleteProxyInformation
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-96b557c995f0059b6f
ncalrpc         : OLE961E91843456DD6F0DD0A79DF5BB
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2464 at 0x5319978L>
64
['DusmSvc']

Interfaces :
RPC  c27f3c08-92ba-478c-b446-b419c4cef0e2 (1.0) -- c:\windows\system32\dusmsvc.dll
	0 -> DusmRpcEnumConnectionList
	1 -> DusmRpcEnumProfileList
	2 -> DusmRpcQueryConnectionProperties
	3 -> DusmRpcQueryCost
	4 -> DusmRpcQueryUserCost
	5 -> DusmRpcQueryOperatorCost
	6 -> DusmRpcSetUserCost
	7 -> DusmRpcSetOperatorCost
	8 -> DusmRpcQueryDataPlan
	9 -> DusmRpcQueryUserDataPlan
	10 -> DusmRpcQueryOperatorDataPlan
	11 -> DusmRpcSetUserDataPlan
	12 -> DusmRpcSetOperatorDataPlan
	13 -> DusmRpcQuerySource
	14 -> DusmRpcSetSource
	15 -> DusmRpcQueryBackgroundRestriction
	16 -> DusmRpcSetBackgroundRestriction
	17 -> DusmRpcQueryGlobalDpuState
	18 -> DusmRpcGetAttributedNetworkUsage
	19 -> DusmRpcGetConnectionListNetworkUsage
	20 -> DusmRpcGetNetworkUsage
	21 -> DusmRpcGetProviderNetworkUsage
	22 -> DusmRpcSetAttributionMapping
	23 -> DusmRpcResetNetworkUsage
	24 -> DusmRpcFlushCostCache
Endpoints :
ncalrpc         : LRPC-fe377b929e997d74df
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2608 at 0x5319c88L>
64
['ShellHWDetection']

Interfaces :
RPC  12345678-1234-abcd-ef00-0123456789ab (1.0) -- C:\windows\System32\spoolsv.exe
	0 -> RpcEnumPrinters
	1 -> RpcOpenPrinter
	2 -> RpcSetJob
	3 -> RpcGetJob
	4 -> RpcEnumJobs
	5 -> RpcAddPrinter
	6 -> RpcDeletePrinter
	7 -> RpcSetPrinter
	8 -> RpcGetPrinter
	9 -> RpcAddPrinterDriver
	10 -> RpcEnumPrinterDrivers
	11 -> RpcGetPrinterDriver
	12 -> RpcGetPrinterDriverDirectory
	13 -> RpcDeletePrinterDriver
	14 -> RpcAddPrintProcessor
	15 -> RpcEnumPrintProcessors
	16 -> RpcGetPrintProcessorDirectory
	17 -> RpcStartDocPrinter
	18 -> RpcStartPagePrinter
	19 -> RpcWritePrinter
	20 -> RpcEndPagePrinter
	21 -> RpcAbortPrinter
	22 -> RpcReadPrinter
	23 -> RpcEndDocPrinter
	24 -> RpcAddJob
	25 -> RpcScheduleJob
	26 -> RpcGetPrinterData
	27 -> RpcSetPrinterData
	28 -> RpcWaitForPrinterChange
	29 -> RpcClosePrinter
	30 -> RpcAddForm
	31 -> RpcDeleteForm
	32 -> RpcGetForm
	33 -> RpcSetForm
	34 -> RpcEnumForms
	35 -> RpcEnumPorts
	36 -> RpcEnumMonitors
	37 -> RpcAddPort
	38 -> RpcConfigurePort
	39 -> RpcDeletePort
	40 -> RpcCreatePrinterIC
	41 -> RpcPlayGdiScriptOnPrinterIC
	42 -> RpcDeletePrinterIC
	43 -> RpcAddPrinterConnection
	44 -> RpcDeletePrinterConnection
	45 -> RpcPrinterMessageBox
	46 -> RpcAddMonitor
	47 -> RpcDeleteMonitor
	48 -> RpcDeletePrintProcessor
	49 -> RpcAddPrintProvidor
	50 -> RpcDeletePrintProvidor
	51 -> RpcEnumPrintProcessorDatatypes
	52 -> RpcResetPrinter
	53 -> RpcGetPrinterDriver2
	54 -> RpcClientFindFirstPrinterChangeNotification
	55 -> RpcFindNextPrinterChangeNotification
	56 -> RpcFindClosePrinterChangeNotification
	57 -> NThreadingLibrary::TWorkItem::NotifyCancel
	58 -> RpcReplyOpenPrinter
	59 -> RpcRouterReplyPrinter
	60 -> RpcReplyClosePrinter
	61 -> RpcAddPortEx
	62 -> RpcRemoteFindFirstPrinterChangeNotification
	63 -> RpcSetAllocFailCount
	64 -> RpcResetPrinterEx
	65 -> RpcRemoteFindFirstPrinterChangeNotificationEx
	66 -> RpcRouterReplyPrinterEx
	67 -> RpcRouterRefreshPrinterChangeNotification
	68 -> RpcSetAllocFailCount
	69 -> RpcOpenPrinterEx
	70 -> RpcAddPrinterEx
	71 -> RpcSetPort
	72 -> RpcEnumPrinterData
	73 -> RpcDeletePrinterData
	74 -> NThreadingLibrary::TWorkItem::NotifyCancel
	75 -> NThreadingLibrary::TWorkItem::NotifyCancel
	76 -> NThreadingLibrary::TWorkItem::NotifyCancel
	77 -> RpcSetPrinterDataEx
	78 -> RpcGetPrinterDataEx
	79 -> RpcEnumPrinterDataEx
	80 -> RpcEnumPrinterKey
	81 -> RpcDeletePrinterDataEx
	82 -> RpcDeletePrinterKey
	83 -> RpcSeekPrinter
	84 -> RpcDeletePrinterDriverEx
	85 -> RpcAddPerMachineConnection
	86 -> RpcDeletePerMachineConnection
	87 -> RpcEnumPerMachineConnections
	88 -> RpcXcvData
	89 -> RpcAddPrinterDriverEx
	90 -> RpcSplOpenPrinter
	91 -> RpcGetSpoolFileInfo
	92 -> RpcCommitSpoolData
	93 -> RpcGetSpoolFileInfo2
	94 -> RpcCommitSpoolData2
	95 -> RpcCloseSpoolFileHandle
	96 -> RpcFlushPrinter
	97 -> RpcSendRecvBidiData
	98 -> RpcAddDriverCatalog
	99 -> RpcAddPrinterConnection2
	100 -> RpcInstallPrinterDriverFromPackage
	101 -> RpcUploadPrinterDriverPackage
	102 -> RpcGetCorePrinterDrivers
	103 -> RpcCorePrinterDriverInstalled
	104 -> RpcGetPrinterDriverPackagePath
	105 -> RpcDeletePrinterDriverPackage
	106 -> RpcFindCompatibleDriver
	107 -> RpcReportJobProcessingProgress
	108 -> RpcSetSpoolerPolicy
	109 -> RpcInternalGetPrinterDriver
	110 -> RpcGetJobNamedPropertyValue
	111 -> RpcSetJobNamedProperty
	112 -> RpcDeleteJobNamedProperty
	113 -> RpcEnumJobNamedProperties
	114 -> RpcCreateAppSandbox
	115 -> RpcGetUserPropertyBag
	116 -> RpcLogJobInfoForBranchOffice
RPC  0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 (1.0) -- C:\windows\System32\spoolsv.exe
	0 -> IRPCAsyncNotify_RegisterClient
	1 -> IRPCAsyncNotify_UnregisterClient
	2 -> IRPCAsyncNotify_GetServerRefferal
	3 -> IRPCAsyncNotify_GetNewChannel
	4 -> IRPCAsyncNotify_GetNotificationSendResponse
	5 -> IRPCAsyncNotify_GetNotification
	6 -> IRPCAsyncNotify_CloseChannel
RPC  ae33069b-a2a8-46ee-a235-ddfd339be281 (1.0) -- C:\windows\System32\spoolsv.exe
	0 -> IRPCRemoteObject_Create
	1 -> IRPCRemoteObject_Delete
RPC  4a452661-8290-4b36-8fbe-7f4093a94978 (1.0) -- C:\windows\System32\spoolsv.exe
	0 -> IRPCAsyncNotifyChannel_CreateChannel
	1 -> IRPCAsyncNotifyChannel_SendNotification
	2 -> IRPCAsyncNotifyChannel_SendNotificationGetResponse
	3 -> IRPCAsyncNotifyChannel_CloseChannel
RPC  76f03f96-cdfd-44fc-a22c-64950a001209 (1.0) -- C:\windows\System32\spoolsv.exe
	0 -> RpcAsyncOpenPrinter
	1 -> RpcAsyncAddPrinter
	2 -> RpcAsyncSetJob
	3 -> RpcAsyncGetJob
	4 -> RpcAsyncEnumJobs
	5 -> RpcAsyncAddJob
	6 -> RpcAsyncScheduleJob
	7 -> RpcAsyncDeletePrinter
	8 -> RpcAsyncSetPrinter
	9 -> RpcAsyncGetPrinter
	10 -> RpcAsyncStartDocPrinter
	11 -> RpcAsyncStartPagePrinter
	12 -> RpcAsyncWritePrinter
	13 -> RpcAsyncEndPagePrinter
	14 -> RpcAsyncEndDocPrinter
	15 -> RpcAsyncAbortPrinter
	16 -> RpcAsyncGetPrinterData
	17 -> RpcAsyncGetPrinterDataEx
	18 -> RpcAsyncSetPrinterData
	19 -> RpcAsyncSetPrinterDataEx
	20 -> RpcAsyncClosePrinter
	21 -> RpcAsyncAddForm
	22 -> RpcAsyncDeleteForm
	23 -> RpcAsyncGetForm
	24 -> RpcAsyncSetForm
	25 -> RpcAsyncEnumForms
	26 -> RpcAsyncGetPrinterDriver
	27 -> RpcAsyncEnumPrinterData
	28 -> RpcAsyncEnumPrinterDataEx
	29 -> RpcAsyncEnumPrinterKey
	30 -> RpcAsyncDeletePrinterData
	31 -> RpcAsyncDeletePrinterDataEx
	32 -> RpcAsyncDeletePrinterKey
	33 -> RpcAsyncXcvData
	34 -> RpcAsyncSendRecvBidiData
	35 -> RpcAsyncCreatePrinterIC
	36 -> RpcAsyncPlayGdiScriptOnPrinterIC
	37 -> RpcAsyncDeletePrinterIC
	38 -> RpcAsyncEnumPrinters
	39 -> RpcAsyncAddPrinterDriver
	40 -> RpcAsyncEnumPrinterDrivers
	41 -> RpcAsyncGetPrinterDriverDirectory
	42 -> RpcAsyncDeletePrinterDriver
	43 -> RpcAsyncDeletePrinterDriverEx
	44 -> RpcAsyncAddPrintProcessor
	45 -> RpcAsyncEnumPrintProcessors
	46 -> RpcAsyncGetPrintProcessorDirectory
	47 -> RpcAsyncEnumPorts
	48 -> RpcAsyncEnumMonitors
	49 -> RpcAsyncAddPort
	50 -> RpcAsyncSetPort
	51 -> RpcAsyncAddMonitor
	52 -> RpcAsyncDeleteMonitor
	53 -> RpcAsyncDeletePrintProcessor
	54 -> RpcAsyncEnumPrintProcessorDatatypes
	55 -> RpcAsyncAddPerMachineConnection
	56 -> RpcAsyncDeletePerMachineConnection
	57 -> RpcAsyncEnumPerMachineConnections
	58 -> RpcSyncRegisterForRemoteNotifications
	59 -> RpcSyncUnRegisterForRemoteNotifications
	60 -> RpcSyncRefreshRemoteNotifications
	61 -> RpcAsyncGetRemoteNotifications
	62 -> RpcAsyncInstallPrinterDriverFromPackage
	63 -> RpcAsyncUploadPrinterDriverPackage
	64 -> RpcAsyncGetCorePrinterDrivers
	65 -> RpcAsyncCorePrinterDriverInstalled
	66 -> RpcAsyncGetPrinterDriverPackagePath
	67 -> RpcAsyncDeletePrinterDriverPackage
	68 -> RpcAsyncReadPrinter
	69 -> RpcAsyncResetPrinter
	70 -> RpcAsyncGetJobNamedPropertyValue
	71 -> RpcAsyncSetJobNamedProperty
	72 -> RpcAsyncDeleteJobNamedProperty
	73 -> RpcAsyncEnumJobNamedProperties
	74 -> RpcAsyncLogJobInfoForBranchOffice
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-a7109f2c2cdeefba97
ncacn_np        : \pipe\spoolss
ncacn_ip_tcp    : 49676
ncalrpc         : OLE2D77958200DDBE189A720E9EED55
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3120 at 0x5319eb8L>
64
['BFE', 'mpssvc']

Interfaces :
RPC  dd490425-5325-4565-b774-7e27d6c09c24 (1.0) -- c:\windows\system32\bfe.dll
	0 -> BfeRpcGetNextNotificationBatch
	1 -> BfeRpcNotifyComplete
	2 -> BfeRpcEngineOpen
	3 -> BfeRpcEngineClose
	4 -> BfeRpcEngineGetOption
	5 -> BfeRpcEngineSetOption
	6 -> BfeRpcEngineGetSecurityInfo
	7 -> BfeRpcEngineSetSecurityInfo
	8 -> BfeRpcSessionCreateEnumHandle
	9 -> BfeRpcAleEndpointEnum
	10 -> BfeRpcAleEndpointDestroyEnumHandle
	11 -> BfeRpcTransactionBegin
	12 -> BfeRpcTransactionCommit
	13 -> BfeRpcTransactionAbort
	14 -> BfeRpcProviderAdd
	15 -> BfeRpcProviderDeleteByKey
	16 -> BfeRpcProviderGetByKey
	17 -> BfeRpcProviderCreateEnumHandle
	18 -> BfeRpcAleEndpointEnum
	19 -> BfeRpcAleEndpointDestroyEnumHandle
	20 -> BfeRpcProviderGetSecurityInfoByKey
	21 -> BfeRpcProviderSetSecurityInfoByKey
	22 -> BfeRpcProviderSubscribeChanges
	23 -> BfeRpcProviderUnsubscribeChanges
	24 -> BfeRpcProviderSubscriptionsGet
	25 -> BfeRpcProviderContextAdd
	26 -> BfeRpcProviderContextDeleteById
	27 -> BfeRpcProviderContextDeleteByKey
	28 -> BfeRpcProviderContextGetById
	29 -> BfeRpcProviderContextGetByKey
	30 -> BfeRpcProviderContextCreateEnumHandle
	31 -> BfeRpcAleEndpointEnum
	32 -> BfeRpcAleEndpointDestroyEnumHandle
	33 -> BfeRpcProviderContextGetSecurityInfoByKey
	34 -> BfeRpcProviderContextSetSecurityInfoByKey
	35 -> BfeRpcProviderContextSubscribeChanges
	36 -> BfeRpcProviderContextUnsubscribeChanges
	37 -> BfeRpcProviderContextSubscriptionsGet
	38 -> BfeRpcSubLayerAdd
	39 -> BfeRpcSubLayerDeleteByKey
	40 -> BfeRpcSubLayerGetByKey
	41 -> BfeRpcSubLayerCreateEnumHandle
	42 -> BfeRpcAleEndpointEnum
	43 -> BfeRpcAleEndpointDestroyEnumHandle
	44 -> BfeRpcSubLayerGetSecurityInfoByKey
	45 -> BfeRpcSubLayerSetSecurityInfoByKey
	46 -> BfeRpcSubLayerSubscribeChanges
	47 -> BfeRpcSubLayerUnsubscribeChanges
	48 -> BfeRpcSubLayerSubscriptionsGet
	49 -> BfeRpcLayerGetById
	50 -> BfeRpcLayerGetByKey
	51 -> BfeRpcLayerCreateEnumHandle
	52 -> BfeRpcAleEndpointEnum
	53 -> BfeRpcAleEndpointDestroyEnumHandle
	54 -> BfeRpcLayerGetSecurityInfoByKey
	55 -> BfeRpcLayerSetSecurityInfoByKey
	56 -> BfeRpcCalloutAdd
	57 -> BfeRpcCalloutDeleteById
	58 -> BfeRpcCalloutDeleteByKey
	59 -> BfeRpcCalloutGetById
	60 -> BfeRpcCalloutGetByKey
	61 -> BfeRpcCalloutCreateEnumHandle
	62 -> BfeRpcAleEndpointEnum
	63 -> BfeRpcAleEndpointDestroyEnumHandle
	64 -> BfeRpcCalloutGetSecurityInfoByKey
	65 -> BfeRpcCalloutSetSecurityInfoByKey
	66 -> BfeRpcCalloutSubscribeChanges
	67 -> BfeRpcCalloutUnsubscribeChanges
	68 -> BfeRpcCalloutSubscriptionsGet
	69 -> BfeRpcFilterAdd
	70 -> BfeRpcFilterDeleteById
	71 -> BfeRpcFilterDeleteByKey
	72 -> BfeRpcFilterGetById
	73 -> BfeRpcFilterGetByKey
	74 -> BfeRpcFilterCreateEnumHandle
	75 -> BfeRpcAleEndpointEnum
	76 -> BfeRpcAleEndpointDestroyEnumHandle
	77 -> BfeRpcFilterGetSecurityInfoByKey
	78 -> BfeRpcFilterSetSecurityInfoByKey
	79 -> BfeRpcFilterSubscribeChanges
	80 -> BfeRpcFilterUnsubscribeChanges
	81 -> BfeRpcFilterSubscriptionsGet
	82 -> BfeRpcBfeIPsecOffloadDone
	83 -> BfeRpcBfeIPsecDosFWUsed
	84 -> BfeRpcBfeIPsecGetStatistics
	85 -> BfeRpcBfeIPsecSaContextCreate
	86 -> BfeRpcBfeIPsecSaContextDeleteById
	87 -> BfeRpcBfeIPsecSaContextGetById
	88 -> BfeRpcBfeIPsecSaContextGetOrSetSpi
	89 -> BfeRpcBfeIPsecSaContextAddInbound
	90 -> BfeRpcBfeIPsecSaContextAddOutbound
	91 -> BfeRpcBfeIPsecSaContextUpdate
	92 -> BfeRpcBfeIPsecSaContextExpire
	93 -> BfeRpcBfeIPsecSaContextCreateEnumHandle
	94 -> BfeRpcAleEndpointEnum
	95 -> BfeRpcAleEndpointDestroyEnumHandle
	96 -> BfeRpcBfeIPsecSaContextSubscribe
	97 -> BfeRpcBfeIPsecSaContextUnsubscribe
	98 -> BfeRpcBfeIPsecSaContextSubscriptionsGet
	99 -> BfeRpcBfeIPsecSaCreateEnumHandle
	100 -> BfeRpcAleEndpointEnum
	101 -> BfeRpcAleEndpointDestroyEnumHandle
	102 -> BfeRpcBfeIPsecSaDbGetSecurityInfo
	103 -> BfeRpcBfeIPsecSaDbSetSecurityInfo
	104 -> BfeRpcBfeIPsecDospGetStatistics
	105 -> BfeRpcBfeIPsecDospStateCreateEnumHandle
	106 -> BfeRpcAleEndpointEnum
	107 -> BfeRpcBfeIPsecDospStateDestroyEnumHandle
	108 -> BfeRpcBfeIPsecDospGetSecurityInfo
	109 -> BfeRpcBfeIPsecDospSetSecurityInfo
	110 -> BfeRpcNetEventCreateEnumHandle
	111 -> BfeRpcAleEndpointEnum
	112 -> BfeRpcAleEndpointDestroyEnumHandle
	113 -> BfeRpcNetEventsGetSecurityInfo
	114 -> BfeRpcNetEventsSetSecurityInfo
	115 -> BfeRpcNetEventSubscribe
	116 -> BfeRpcNetEventUnsubscribe
	117 -> BfeRpcNetEventSubscriptionsGet
	118 -> BfeRpcNetEventsLost
	119 -> BfeRpcConnectionGetById
	120 -> BfeRpcConnectionGetByIPsecInfo
	121 -> BfeRpcConnectionGetByS2STunnelId
	122 -> BfeRpcConnectionCreateEnumHandle
	123 -> BfeRpcAleEndpointEnum
	124 -> BfeRpcAleEndpointDestroyEnumHandle
	125 -> BfeRpcConnectionGetSecurityInfo
	126 -> BfeRpcConnectionSetSecurityInfo
	127 -> BfeRpcConnectionGetS2STunnelId
	128 -> BfeRpcConnectionSubscribe
	129 -> BfeRpcConnectionUnsubscribe
	130 -> BfeRpcConnectionSubscriptionsGet
	131 -> BfeRpcConnectionsLost
	132 -> BfeRpcClassify
	133 -> BfeRpcAddLayerReplica
	134 -> BfeRpcDeleteLayerReplica
	135 -> BfeRpcSecureSocketAdd
	136 -> BfeRpcBfeIPsecTunnelDeleteByKey
	137 -> BfeRpcBfeIPsecTunnelAdd
	138 -> BfeRpcBfeIPsecTunnelAddConditions
	139 -> BfeRpcBfeIPsecS2STunnelAddConditions
	140 -> BfeRpcBfeIPsecS2STunnelRemoveConditions
	141 -> BfeRpcBfeIPsecTunnelDeleteByKey
	142 -> BfeRpcBfeIPsecS2STunnelAddInterfaceToCompartment
	143 -> BfeRpcBfeIPsecS2STunnelGetInterfaceForCompartment
	144 -> BfeRpcBfeIPsecS2STunnelRemoveInterfaceFromCompartment
	145 -> BfeRpcBfeIPsecSaInitiateAsync
	146 -> BfeRpcOpenToken
	147 -> BfeRpcCloseToken
	148 -> BfeRpcAleExplicitCredentialsQuery
	149 -> BfeRpcAleEndpointGetById
	150 -> BfeRpcAleEndpointCreateEnumHandle
	151 -> BfeRpcAleEndpointEnum
	152 -> BfeRpcAleEndpointDestroyEnumHandle
	153 -> BfeRpcAleEndpointGetSecurityInfo
	154 -> BfeRpcAleEndpointSetSecurityInfo
	155 -> BfeRpcAleGetPortStatus
	156 -> BfeRpcIsUserAuthConfigured
	157 -> BfeRpcKeyModuleAdd
	158 -> BfeRpcKeyModuleDeleteByKey
	159 -> BfeRpcKeyModuleUpdateAcquire
	160 -> BfeRpcKeyDictatorCheck
	161 -> BfeRpcGetKeyFromDictator
	162 -> BfeRpcNotifyKey
	163 -> BfeRpcKeyManagerAdd
	164 -> BfeRpcKeyManagerDeleteByKey
	165 -> BfeRpcKeyManagersGet
	166 -> BfeRpcKeyManagerGetSecurityInfoByKey
	167 -> BfeRpcKeyManagerSetSecurityInfoByKey
	168 -> BfeRpcvSwitchEventFire
	169 -> BfeRpcvSwitchEventsGetSecurityInfo
	170 -> BfeRpcvSwitchEventsSetSecurityInfo
	171 -> BfeRpcvSwitchEventSubscribe
	172 -> BfeRpcvSwitchEventUnsubscribe
	173 -> BfeRpcvSwitchEventSubscriptionsGet
	174 -> BfeRpcBfeIPsecDriverInitiateAcquire
	175 -> BfeRpcBfeIPsecDriverExpire
	176 -> BfeRpcBfeIPsecDriverSaOffloaded
	177 -> BfeRpcBfeIPsecDriverProcessClearTextResponse
	178 -> BfeRpcBfeProcessNameResolutionEvent
	179 -> BfeRpcVpnTriggerEventFire
	180 -> BfeRpcVpnTriggerEventSubscribe
	181 -> BfeRpcVpnTriggerEventUnsubscribe
	182 -> BfeRpcVpnTriggerAddAppSids
	183 -> BfeRpcVpnTriggerRemoveAppSids
	184 -> BfeRpcVpnTriggerAddFilePaths
	185 -> BfeRpcVpnTriggerRemoveFilePaths
	186 -> BfeRpcVpnTriggerAddSecurityDescriptor
	187 -> BfeRpcVpnTriggerRemoveSecurityDescriptor
	188 -> BfeRpcVpnTriggerSetStateDisconnected
	189 -> BfeRpcVpnTriggerInitializeNrptTriggering
	190 -> BfeRpcVpnTriggerUninitializeNrptTriggering
	191 -> BfeRpcVpnTriggerResetNrptTriggering
	192 -> BfeRpcVpnTriggerConfigureParameters
	193 -> BfeRpcBitmapIndexGet
	194 -> BfeRpcBitmapIndexFree
RPC  7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_FWIndicatePortInUse
	1 -> RPC_FWGetIndicatedPortInUse
	2 -> RPC_FWIndicateTupleInUse
	3 -> RPC_FWResetIndicatedTupleInUse
	4 -> RPC_FWIndicateProxyForUrl
	5 -> CNetProfileEventSink::NetworkAdded
	6 -> RPC_FWIsTargetAProxy
	7 -> RPC_NetworkIsolationSetupAppContainerBinaries
	8 -> RPC_NetworkIsolationRegisterForAppContainerChanges
	9 -> Rpc_NetworkIsolationRegistrationGetLastEvent
	10 -> RPC_NetworkIsolationUnregisterForAppContainerChanges
	11 -> RPC_NetworkIsolationGetAppContainer
	12 -> RPC_NetworkIsolationEnumAppContainers
	13 -> RPC_NetworkIsolationAddAllowEnterpriseIdRule
	14 -> RPC_NetworkIsolationCreateAllInterfacesContainer
	15 -> RPC_NetworkIsolationCreateInterfaceContainer
	16 -> RPC_NetworkIsolationDeleteAllInterfacesContainer
	17 -> RPC_NetworkIsolationDeleteInterfaceContainer
RPC  f47433c3-3e9d-4157-aad4-83aa1f5c2d4c (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_NetworkIsolationDiagnoseConnectFailure
	1 -> RPC_NetworkIsolationGetEnterpriseIdAsync
	2 -> RPC_NetworkIsolationCreateContainer
	3 -> RPC_NetworkIsolationDeleteContainer
	4 -> RPC_NetworkIsolationGetAppContainerConfig
	5 -> RPC_NetworkIsolationSetAppContainerConfig
	6 -> RPC_NetworkIsolationCreateAppContainer
	7 -> RPC_NetworkIsolationDeleteAppContainer
	8 -> RPC_NetworkIsolationCreateAppContainerLoopbackRules
	9 -> RPC_NetworkIsolationDeleteAppContainerLoopbackRules
RPC  2fb92682-6599-42dc-ae13-bd2ca89bd11c (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_FWOpenPolicyStore
	1 -> RPC_FWClosePolicyStore
	2 -> RPC_FWRestoreDefaults
	3 -> RPC_FWGetGlobalConfig
	4 -> RPC_FWSetGlobalConfig
	5 -> RPC_FWAddFirewallRule
	6 -> RPC_FWSetFirewallRule
	7 -> RPC_FWDeleteFirewallRule
	8 -> RPC_FWDeleteAllFirewallRules
	9 -> RPC_FWEnumFirewallRules
	10 -> RPC_FWGetConfig
	11 -> RPC_FWSetConfig
	12 -> RPC_FWNotifyUnsupportedAttempt
	13 -> RPC_FWAddConnectionSecurityRule
	14 -> RPC_FWSetConnectionSecurityRule
	15 -> RPC_FWDeleteConnectionSecurityRule
	16 -> RPC_FWDeleteAllConnectionSecurityRules
	17 -> RPC_FWEnumConnectionSecurityRules
	18 -> RPC_FWAddAuthenticationSet
	19 -> RPC_FWSetAuthenticationSet
	20 -> RPC_FWDeleteAuthenticationSet
	21 -> RPC_FWDeleteAllAuthenticationSets
	22 -> RPC_FWEnumAuthenticationSets
	23 -> RPC_FWAddCryptoSet
	24 -> RPC_FWSetCryptoSet
	25 -> RPC_FWDeleteCryptoSet
	26 -> RPC_FWDeleteAllCryptoSets
	27 -> RPC_FWEnumCryptoSets
	28 -> RPC_FWEnumPhase1SAs
	29 -> RPC_FWEnumPhase2SAs
	30 -> RPC_FWDeletePhase1SAs
	31 -> RPC_FWDeletePhase2SAs
	32 -> RPC_FWRegisterProduct
	33 -> RPC_FWUnregisterProduct
	34 -> RPC_FWEnumProducts
	35 -> RPC_FWAddMainModeRule
	36 -> RPC_FWSetMainModeRule
	37 -> RPC_FWDeleteMainModeRule
	38 -> RPC_FWDeleteAllMainModeRules
	39 -> RPC_FWEnumMainModeRules
	40 -> RPC_FWQueryFirewallRules
	41 -> RPC_FWQueryConnectionSecurityRules2_10
	42 -> RPC_FWQueryMainModeRules
	43 -> RPC_FWQueryAuthenticationSets
	44 -> RPC_FWQueryCryptoSets
	45 -> RPC_FWEnumNetworks
	46 -> RPC_FWEnumAdapters
	47 -> RPC_FWGetGlobalConfig2_10
	48 -> RPC_FWGetConfig2_10
	49 -> RPC_FWAddFirewallRule2_10
	50 -> RPC_FWSetFirewallRule2_10
	51 -> RPC_FWEnumFirewallRules2_10
	52 -> RPC_FWAddConnectionSecurityRule2_10
	53 -> RPC_FWSetConnectionSecurityRule2_10
	54 -> RPC_FWEnumConnectionSecurityRules2_10
	55 -> RPC_FWAddAuthenticationSet2_10
	56 -> RPC_FWSetAuthenticationSet2_10
	57 -> RPC_FWEnumAuthenticationSets2_10
	58 -> RPC_FWAddCryptoSet2_10
	59 -> RPC_FWSetCryptoSet2_10
	60 -> RPC_FWEnumCryptoSets2_10
	61 -> RPC_FWDiagGetAppList
	62 -> RPC_FWAddConnectionSecurityRule2_20
	63 -> RPC_FWSetConnectionSecurityRule2_20
	64 -> RPC_FWEnumConnectionSecurityRules2_20
	65 -> RPC_FWQueryConnectionSecurityRules2_20
	66 -> RPC_FWAddAuthenticationSet2_20
	67 -> RPC_FWSetAuthenticationSet2_20
	68 -> RPC_FWEnumAuthenticationSets2_20
	69 -> RPC_FWQueryAuthenticationSets2_20
	70 -> RPC_FWAddFirewallRule2_20
	71 -> RPC_FWSetFirewallRule2_20
	72 -> RPC_FWEnumFirewallRules2_20
	73 -> RPC_FWQueryFirewallRules2_20
	74 -> RPC_FWQueryIsolationType
	75 -> RPC_FWSelectConSecRule
	76 -> RPC_FWAddFirewallRule2_24
	77 -> RPC_FWSetFirewallRule2_24
	78 -> RPC_FWEnumFirewallRules2_24
	79 -> RPC_FWQueryFirewallRules2_24
	80 -> RPC_FWAddFirewallRule2_25
	81 -> RPC_FWSetFirewallRule2_25
	82 -> RPC_FWEnumFirewallRules2_25
	83 -> RPC_FWQueryFirewallRules2_25
	84 -> RPC_FWAddFirewallRule2_26
	85 -> RPC_FWSetFirewallRule2_26
	86 -> RPC_FWEnumFirewallRules2_26
	87 -> RPC_FWQueryFirewallRules2_26
	88 -> RPC_FWAddFirewallRule2_27
	89 -> RPC_FWSetFirewallRule2_27
	90 -> RPC_FWEnumFirewallRules2_27
	91 -> RPC_FWQueryFirewallRules2_27
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
Endpoints :
ncalrpc         : LRPC-ed9d7ac604d40c5ebd
ncalrpc         : LRPC-f160739feac8ff62a5
ncalrpc         : LRPC-ea0c57f873808f128d
ncalrpc         : LRPC-f0d73120b1337b746d
ncalrpc         : OLE1A85C7A80535A4E0EF0B2D03A60F
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3196 at 0x5319d30L>
64
['CryptSvc']

Interfaces :
RPC  0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 (1.0) -- c:\windows\system32\cryptsvc.dll
	0 -> s_SSCertProtectFunction
RPC  2579ff35-0ab0-4e5a-88fa-1d88c4e0cb92 (2.0) -- C:\Windows\System32\crypttpmeksvc.dll
	0 -> s_SSTpmEndorsementKeyGetInfo
	1 -> s_SSTpmEndorsementKeyDecryptChallenge
	2 -> s_SSTpmAttestationCapable
	3 -> s_SSTpmGetAttestationForAik
	4 -> s_SSTpmGetManufacturerInfo
RPC  f50aac00-c7f3-428e-a022-a6b71bfb9d43 (2.0) -- C:\Windows\System32\cryptcatsvc.dll
	0 -> s_SSCatDBAddCatalog
	1 -> s_SSCatDBDeleteCatalog
	2 -> s_SSCatDBEnumCatalogs
	3 -> s_SSCatDBPauseResumeService
	4 -> s_SSCatDBRebuildDatabase
	5 -> s_SSCatDBPrepareForCall
	6 -> s_SSCatDBAddCatalog2
	7 -> s_SSCatDBSmartlockerDefenderCheck
RPC  1495a2be-b7a8-4299-9d3b-8825e5bcbfb9 (1.0) -- C:\Windows\System32\webauthn.dll
	0 -> s_SSCtapCommand
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : keysvc
ncalrpc         : OLE037BD8768B2F1438658B1D7E91E0
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3208 at 0x5319fd0L>
64
['DiagTrack']

Interfaces :
RPC  4c9dbf19-d39e-4bb9-90ee-8f7179b20283 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcApi_IsScenarioActive
	1 -> UtcApi_EscalateScenario
	2 -> UtcApi_EscalateScenarioAsync
	3 -> UtcApi_IsEscalationRunning
	4 -> UtcApi_DownloadLatestSettingsForNamespace
	5 -> UtcApi_DownloadLatestSettingsForNamespaceAsync
	6 -> UtcApi_GetActiveScenarioList
	7 -> UtcApi_ForceUpload
	8 -> UtcApi_ResetUsageMetrics
	9 -> UtcApi_IsTraceRunning
	10 -> UtcApi_GetActiveTraceRuntime
	11 -> UtcApi_GetKnownTraceList
	12 -> UtcApi_DownloadLatestSettings
	13 -> UtcApi_ReloadSettings
	14 -> UtcApi_UpdateTimerConfiguration
	15 -> UtcApi_ClearTimerConfiguration
	16 -> UtcApi_GetNextScheduledFireTime
	17 -> UtcApi_GetTimerConfiguration
	18 -> UtcApi_GetCustomTraceList
	19 -> UtcApi_StartCustomTrace
	20 -> UtcApi_SnapCustomTrace
	21 -> UtcApi_StopCustomTrace
	22 -> UtcApi_EscalateScenario2
	23 -> UtcApi_EscalateScenarioAsync2
	24 -> UtcApi_GetActiveTraceInfo
	25 -> UtcApi_EnableWERLocalReports
	26 -> UtcApi_RestoreWERLocalReportsSettings
	27 -> UtcApi_QueryWERLocalReportsEnabled
	28 -> UtcApi_IsEscalationRunningEx
	29 -> UtcApi_QueryDiagnosticCollectionState
RPC  fd8be72b-a9cd-4b2c-a9ca-4ded242fbe4d (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcApi_SendSyntheticTrigger
	1 -> UtcApi_ChangeEtmPauseState
RPC  95095ec8-32ea-4eb0-a3e2-041f97b36168 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcTelemetryOptInApi_SetTelemetryOptIn
RPC  e38f5360-8572-473e-b696-1b46873beeab (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcTenantApi_RegisterTelemetryTenant
	1 -> UtcTenantApi_UnregisterTelemetryTenant
	2 -> UtcTenantApi_UpdateDailyUploadQuota
	3 -> UtcTenantApi_ForceUpload
RPC  d22895ef-aff4-42c5-a5b2-b14466d34ab4 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcEventTranscriptApi_FetchTranscriptStats
	1 -> Microsoft::Diagnostics::FileWrapStream::Commit
	2 -> UtcEventTranscriptApi_FetchTranscriptRecordPayload
	3 -> UtcEventTranscriptApi_FetchKnownTags
	4 -> UtcEventTranscriptApi_FetchEventTags
	5 -> UtcEventTranscriptApi_IsSampledIn
	6 -> UtcEventTranscriptApi_FetchTranscriptRecordsPage2
	7 -> UtcEventTranscriptApi_CancelFetchOperations
RPC  98cd761e-e77d-41c8-a3c0-0fb756d90ec2 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcWerHelperApi_FetchReportCount
	1 -> UtcWerHelperApi_FetchReportData
	2 -> UtcWerHelperApi_EnableWerLocalReports
	3 -> UtcWerHelperApi_RestoreWerLocalReportsSettings
	4 -> UtcWerHelperApi_QueryWerLocalReportsEnabled
	5 -> UtcWerHelperApi_FetchReportData2
	6 -> UtcWerHelperApi_ExtractReport
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-50e83a038203afe3bc
ncalrpc         : OLEFE3287CB2905D0734C098267C24F
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3216 at 0x53198d0L>
64
['iphlpsvc']

Interfaces :
RPC  552d076a-cb29-4e44-8b6a-d15e59e2c0af (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> IpTransitionProtocolApplyConfigChanges
	1 -> IpTransitionProtocolApplyConfigChangesEx
	2 -> IpTransitionCreatev6Inv4Tunnel
	3 -> IpTransitionDeletev6Inv4Tunnel
RPC  ecbdb051-f208-46b9-8c8b-648d9d3f3944 (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> RefreshTeredoState
	1 -> ResetDisabledComponentsForTeredo
RPC  1fff8faa-ec23-4e3f-a8ce-4b2f8707e636 (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> TeredoCreateConsumerHandle
	1 -> TeredoCloseConsumerHandle
RPC  2e6035b2-e8f1-41a7-a044-656b439c4c34 (1.0) -- C:\windows\system32\httpprxm.dll
	0 -> ProxyMgrProviderRegisterForEventNotification
	1 -> ProxyMgrProviderUnregisterEventNotification
	2 -> ProxyMgrProviderGetNotification
	3 -> ProxyMgrGetProxyEventInformation
	4 -> ProxyMgrSetProxyConfiguration
	5 -> ProxyMgrSetProxyCredentials
RPC  c36be077-e14b-4fe9-8abc-e856ef4f048b (1.0) -- C:\windows\system32\httpprxm.dll
	0 -> RpcSrvProxyMgrClientRegisterForEventNotification
	1 -> RpcSrvProxyMgrClientGetNotification
	2 -> RpcSrvProxyMgrClientUnregisterEventNotification
	3 -> RpcSrvProxyMgrClientGetProxyForUrl
	4 -> RpcSrvProxyMgrClientGetProxyCredentials
	5 -> RpcSrvProxyMgrClientGetAllProxiesForUrl
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
RPC  c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 (1.0) -- C:\windows\system32\adhsvc.dll
	0 -> Rpc_AdhEngineOpen
	1 -> Rpc_AdhEngineClose
	2 -> Rpc_AdhStatusEventSubscribe
	3 -> Rpc_AdhStatusEventSubscriptionGetLastEvent
	4 -> Rpc_AdhStatusEventUnsubscribe
	5 -> Rpc_AdhGetConfig
	6 -> Rpc_AdhGetEvidenceCollectorResult
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
Endpoints :
ncalrpc         : LRPC-3d9f14cbe3d5f73628
ncalrpc         : TeredoDiagnostics
ncalrpc         : TeredoControl
ncalrpc         : OLE3960B3F4B2DDB5FB88EAA7555C75
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3228 at 0x5319080L>
64
['DPS']

Interfaces :
RPC  98716d03-89ac-44c7-bb8c-285824e51c4a (1.0) -- c:\windows\system32\srvsvc.dll
	0 -> XsOpenPrinter
	1 -> XsClosePrinter
	2 -> XsAddJob
	3 -> XsScheduleJob
	4 -> XsProcessPnp
	5 -> XsProcDownLevelAPI
RPC  1a0d010f-1c33-432c-b0f5-8cf4e8053099 (1.0) -- c:\windows\system32\srvsvc.dll
	0 -> IdSegRequestNextSequence
	1 -> IdSegRequestNodeInvalidation
RPC  4b324fc8-1670-01d3-1278-5a47bf6ee188 (3.0) -- c:\windows\system32\srvsvc.dll
	0 -> NetrCharDevControl
	1 -> NetrCharDevControl
	2 -> NetrCharDevControl
	3 -> NetrCharDevControl
	4 -> NetrCharDevControl
	5 -> NetrCharDevControl
	6 -> NetrCharDevControl
	7 -> NetrCharDevControl
	8 -> NetrConnectionEnum
	9 -> NetrFileEnum
	10 -> NetrFileGetInfo
	11 -> NetrFileClose
	12 -> NetrSessionEnum
	13 -> NetrSessionDel
	14 -> NetrShareAdd
	15 -> NetrShareEnum
	16 -> NetrShareGetInfo
	17 -> NetrShareSetInfo
	18 -> NetrShareDel
	19 -> NetrShareDelSticky
	20 -> NetrShareCheck
	21 -> NetrServerGetInfo
	22 -> NetrServerSetInfo
	23 -> NetrServerDiskEnum
	24 -> NetrServerStatisticsGet
	25 -> NetrServerTransportAdd
	26 -> NetrServerTransportEnum
	27 -> NetrServerTransportDel
	28 -> NetrRemoteTOD
	29 -> I_NetrServerSetServiceBits
	30 -> NetprPathType
	31 -> NetprPathCanonicalize
	32 -> NetprPathCompare
	33 -> NetprNameValidate
	34 -> NetprNameCanonicalize
	35 -> NetprNameCompare
	36 -> NetrShareEnumSticky
	37 -> NetrShareDelStart
	38 -> NetrShareDelCommit
	39 -> NetrpGetFileSecurity
	40 -> NetrpSetFileSecurity
	41 -> NetrServerTransportAddEx
	42 -> I_NetrServerSetServiceBitsEx
	43 -> NetrDfsGetVersion
	44 -> NetrCharDevControl
	45 -> NetrCharDevControl
	46 -> NetrCharDevControl
	47 -> NetrCharDevControl
	48 -> NetrCharDevControl
	49 -> NetrCharDevControl
	50 -> NetrCharDevControl
	51 -> NetrCharDevControl
	52 -> NetrCharDevControl
	53 -> NetrServerTransportDelEx
	54 -> NetrServerAliasAdd
	55 -> NetrServerAliasEnum
	56 -> NetrServerAliasDel
	57 -> NetrShareDelEx
	58 -> LocalrSessionEnum
	59 -> LocalrSessionGetInfo
	60 -> LocalrSessionDel
	61 -> LocalrFileEnum
	62 -> LocalrFileGetInfo
	63 -> LocalrFileClose
	64 -> LocalrShareEnum
	65 -> LocalrShareGetInfo
	66 -> LocalrShareSetInfo
	67 -> LocalrShareAdd
	68 -> LocalrShareDelEx
	69 -> LocalrAliasGet
	70 -> NetrServerTransportAddForInstance
	71 -> NetrServerTransportDelForInstance
Endpoints :
ncalrpc         : LRPC-4f1d5488ca14ed3f91
ncacn_np        : \PIPE\srvsvc
--------------------------------------------------------------------------------
<WinProcess "WaAppAgent.exe" pid 3268 at 0x5319860L>
64
['RdAgent']

Interfaces :
RPC  300f3532-38cc-11d0-a3f0-0020af6b0add (1.2) -- c:\windows\system32\trkwks.dll
	0 -> Stubold_LnkMendLink
	1 -> StubGetFileTrackingInformation
	2 -> StubGetFileTrackingInformation
	3 -> StubLnkSetVolumeId
	4 -> StubGetFileTrackingInformation
	5 -> StubGetFileTrackingInformation
	6 -> StubGetFileTrackingInformation
	7 -> StubGetFileTrackingInformation
	8 -> StubLnkOnRestore
	9 -> StubLnkMendLink
	10 -> StubGetFileTrackingInformation
	11 -> StubGetFileTrackingInformation
	12 -> StubLnkSearchMachine
Endpoints :
ncacn_np        : \pipe\trkwks
ncalrpc         : trkwks
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3300 at 0x5319550L>
64
['W32Time']

Interfaces :
RPC  8fb6d884-2388-11d0-8c35-00c04fda2795 (4.1) -- c:\windows\system32\w32time.dll
	0 -> s_W32TimeSync
	1 -> s_W32TimeGetNetlogonServiceBits
	2 -> s_W32TimeQueryProviderStatus
	3 -> s_W32TimeQuerySource
	4 -> s_W32TimeQueryProviderConfiguration
	5 -> s_W32TimeQueryConfiguration
	6 -> s_W32TimeQueryStatus
	7 -> s_W32TimeLog
Endpoints :
ncalrpc         : W32TIME_ALT
ncacn_np        : \PIPE\W32TIME_ALT
--------------------------------------------------------------------------------
<WinProcess "MsMpEng.exe" pid 3328 at 0x53197b8L>
64
['WinDefend']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4008 at 0x53199b0L>
64
['wuauserv']

Interfaces :
RPC  30adc50c-5cbc-46ce-9a0e-91914789e23c (1.0) -- c:\windows\system32\nrpsrv.DLL
	0 -> RpcNrpGetAddrInfo
	1 -> RpcNrpGetNameInfo
Endpoints :
ncalrpc         : LRPC-f6938ea0eb3f3baa4e
--------------------------------------------------------------------------------
<WinProcess "NisSrv.exe" pid 5104 at 0x5319320L>
64
['WdNisSvc']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4488 at 0x5319be0L>
64
['pla']

Interfaces :
RPC  647d4452-9f33-4a18-b2be-c5c0e920e94e (1.0) -- c:\windows\system32\pla.dll
	0 -> PlaiSrvControl
	1 -> PlaiSrvQuerySession
	2 -> PlaiSrvGetStatus
	3 -> PlaiSrvRegisterCollectorSet
	4 -> PlaiSrvUpdateMetadata
	5 -> PlaiSrvSwitchToCompiling
	6 -> PlaiSrvCloseCollectorSet
Endpoints :
ncalrpc         : {F14A3514-198A-4DF9-88B3-EEA099B470F4}
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 5672 at 0x5319198L>
64
['SSDPSRV']

Interfaces :
RPC  4b112204-0e19-11d3-b42b-0000f81feb9f (1.0) -- c:\windows\system32\ssdpsrv.dll
	0 -> _SSDPOpenRpc
	1 -> _SSDPCloseRpc
	2 -> RegisterServiceExRpc
	3 -> _DeregisterServiceRpc
	4 -> CleanupCacheRpc
	5 -> BeginSearchRpc
	6 -> GetSearchNotificationRpc
	7 -> CancelSearchRpc
	8 -> CloseSearchRpc
	9 -> EnableNotificationRpc
	10 -> _InitializeSyncHandle
	11 -> _RemoveSyncHandle
	12 -> RegisterNotificationRpc
	13 -> RegisterNotificationAsyncRpc
	14 -> _GetNotificationRpc
	15 -> _WakeupGetNotificationRpc
	16 -> DeregisterNotificationRpc
	17 -> SetICSInterfaces
	18 -> SetICSOff
	19 -> EnableFirewallRuleRpc
	20 -> DisableFirewallRuleRpc
Endpoints :
ncalrpc         : LRPC-7739fe9ede05529e24
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 4128 at 0x5319438L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "winlogon.exe" pid 956 at 0x5319668L>
64

Interfaces :
RPC  76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\windows\system32\winlogon.exe
	0 -> I_WMsgkSendMessage
	1 -> I_WMsgkSendPSPMessage
RPC  76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\windows\system32\winlogon.exe
	0 -> I_WMsgSendMessage
	1 -> I_WMsgSendPSPMessage
	2 -> I_WMsgSendNotifyMessage
	3 -> I_WMsgSendReconnectionUpdateMessage
RPC  12e65dd8-887f-41ef-91bf-8d816c42c2e7 (1.0) -- C:\windows\system32\winlogon.exe
	0 -> WlSecureDesktoprPromptingRequest
	1 -> WlSecureDesktoprConfirmationRequest
	2 -> WlSecureDesktoprCredmanBackupRequest
	3 -> WlSecureDesktoprCredmanRestoreRequest
	4 -> WlSecureDesktoprSimulateSAS
Endpoints :
ncalrpc         : WMsgKRpc0920722
--------------------------------------------------------------------------------
<WinProcess "fontdrvhost.exe" pid 3992 at 0x5319e48L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "dwm.exe" pid 4176 at 0x5319b38L>
64

Interfaces :
RPC  169c453b-5955-4672-be44-21f61e9ef18f (1.0) -- c:\windows\system32\scdeviceenum.dll
	0 -> s_NgcCtnrEnumCreateNode
	1 -> s_NgcCtnrEnumDeleteNode
Endpoints :
ncalrpc         : LRPC-d51e953fcdc5765dda
--------------------------------------------------------------------------------
<WinProcess "rdpclip.exe" pid 820 at 0x53192e8L>
64

Interfaces :
RPC  10bd2718-13bd-4b84-8e7d-8b5c83770a86 (1.0) -- C:\windows\System32\rdpclip.exe
	0 -> RpcSetRenderHint
	1 -> RpcGetStartMenuRect
RPC  de79fc6c-dc6f-43c7-a48e-63bbc8d4009d (1.0) -- C:\windows\System32\rdpclip.exe
	0 -> UMRDP_SHChangeNotify
	1 -> UMRDP_WNetAddConnection2
	2 -> UMRDP_WNetCancelConnection2
	3 -> UMRDP_StorePrinterConfig
	4 -> UMRDP_StoreDefaultPrinter
	5 -> UMRDP_RestoreDefaultPrinter
	6 -> UMRDP_SetDefaultPrinter
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000135-0000-0000-c000-000000000046 (0.0) -- IInterfaceFromWindowProp
OLE  0000010e-0000-0000-c000-000000000046 (0.0) -- IDataObject
OLE  0000000c-0000-0000-c000-000000000046 (0.0) -- IStream
Endpoints :
ncalrpc         : HintApiRPCEntry#2
ncalrpc         : UMRdpEndpoint_2
ncalrpc         : OLED61FC11976D6B4EE1BE5E9B46B15
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1004 at 0x5319e10L>
64
['CDPUserSvc_9c09e']

Interfaces :
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
OLE  cb728b20-f786-11ce-92ad-00aa00a74cd0 (0.0) -- IProfferService
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
OLE  00000001-0000-0000-c000-000000000046 (0.0) -- IClassFactory
OLE  6d5140c1-7436-11ce-8034-00aa006009fa (0.0) -- IServiceProvider
OLE  e7fb793d-3581-4b54-a798-ab8e9d69c963 (0.0) -- IBackgroundActivationSessionManagerEvents
OLE  e12fe107-2d78-46a1-bca8-d93e4c2ab2bc (0.0) -- IPlmStateChangeNotifications
OLE  428d4ddd-3462-43df-9395-1eff13ae7a4b (0.0) -- IBackgroundAccessManagerService
OLE  fc99c60d-d59b-4b2b-b73d-3a1cc9f2aafa (0.0) -- ILifetimeManagerRemote
OLE  d7a5d1cc-fcbc-4e54-9deb-45ef67293cf8 (0.0) -- IHostIdStore
OLE  69c083b1-7f6f-490d-9d77-c0219a95b25d (0.0) -- IProcessLifetimeManagerControl
OLE  7656cfa4-b63a-4542-a8de-ef402bac895d (0.0) -- IUserApplicationStateChangeHandler
RPC  8ec21e98-b5ce-4916-a3d6-449fa428a007 (0.0) -- C:\Windows\System32\modernexecserver.dll
	0 -> FmMuxSrvRegisterCoreUIEndpoints
	1 -> FmMuxSrvGenerateTaskInstanceId
	2 -> FmMuxSrvLaunchTask
	3 -> FmMuxSrvResumeTask
	4 -> FmMuxSrvPauseTask
	5 -> FmMuxSrvCancelTask
	6 -> FmMuxSrvAbortTask
	7 -> FmMuxSrvGetTaskPid
	8 -> FmMuxSrvSetTaskDehydrationEligibility
	9 -> FmMuxSrvSetTaskProperty
	10 -> FmMuxSrvResolveApplicationUri
	11 -> FmMuxSrvGetActivationPolicy
	12 -> FmMuxSrvLogoffUser
	13 -> FmMuxSrvShutdown
	14 -> FmMuxSrvSetForegroundTaskInstanceId
	15 -> FmMuxSrvGenerateActivationInstanceId
	16 -> FmMuxSrvActivationPrerequisitePhase
	17 -> FmMuxSrvIsCBETask
	18 -> FmMuxSrvIsValidTaskPid
	19 -> FmMuxSrvResumePrerequisitePhase
	20 -> FmMuxSrvGetForegroundTaskInstanceId
	21 -> FmMuxSrvActivationBypass
	22 -> FmMuxSrvIsActivationDehydrated
	23 -> FmMuxSrvRequestResourceSet
RPC  0fc77b1a-95d8-4a2e-a0c0-cff54237462b (0.0) -- C:\Windows\System32\modernexecserver.dll
	0 -> FmMuxSrvRegisterFGNotificationCoreUIEndpoint
	1 -> FmMuxSrvUnRegisterFGNotificationCoreUIEndpoint
	2 -> FmMuxSrvGetForegroundProductId
	3 -> FmMuxSrvIsForegroundProductId
	4 -> FmMuxSrvGetProductIdFromProcessId
	5 -> FmMuxSrvGenerateWatsonReport
	6 -> FmMuxSrvGetProcessProductId
	7 -> FmMuxSrvDehydrateHost
	8 -> FmMuxSrvIsCallingProcessForeground
RPC  b1ef227e-dfa5-421e-82bb-67a6a129c496 (0.0) -- C:\Windows\System32\modernexecserver.dll
	0 -> FmMuxSrvIsActivationBeingDebugged
	1 -> FmMuxSrvIsForegroundActivation
	2 -> FmMuxSrvGetForegroundActivationInstanceId
	3 -> FmMuxSrvGetApplicationId
	4 -> FmMuxSrvGetPackageFamilyName
	5 -> FmMuxSrvGetPackageFullName
	6 -> FmMuxSrvGetPSMKey
	7 -> FmMuxSrvDehydrateApplication
	8 -> FmMuxSrvSetAutoDehydrateFlag
	9 -> FmMuxSrvGetAutoDehydrateFlag
	10 -> FmMuxSrvReloadSettings
OLE  eb9d0454-25db-5620-98b8-be4c5d0dbc67 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserChangedEventArgs]
OLE  9ec3d9d5-b413-51df-8c64-640e3356e351 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserAuthenticationStatusChangingEventArgs]
OLE  a478f456-5d69-41d4-8fd5-a414c516c781 (0.0) -- IUserPackageStateChangeHandler
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  5e75aba7-c424-4076-9d47-409a1eda087f (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIWindowStatics
OLE  882d9981-e3b3-4275-a857-00c3910fb5c3 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewStatics
OLE  c5230dad-4d49-4c07-aafa-7bafbbff72b0 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIWindowWatcher
OLE  3169ab14-dd32-4d2f-b943-0e53446f5085 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewWatcher
OLE  998d66a2-4a54-496c-9e18-268890860004 (0.0) -- IApplicationActivationManagerPriv
OLE  e7a5f14e-0650-44f2-9168-35cd1d04fe20 (0.0) -- IApplicationActivationPhonePriv
OLE  a5447aa8-063b-4ddc-8b81-021591a43bf1 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewChangedEventArgs
OLE  dac0a812-87a6-4f5a-8493-b80e07a89344 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewActivationRequestedEventArgs
OLE  5c19477e-81ef-4d21-baa4-c3040ad2ea6b (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewRequestEventArgs
OLE  add68ce2-bfd3-4208-a2c8-d48fb2e32c41 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppView
OLE  90ea19c8-8014-484d-a9f3-c1aecb25e39b (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppModel
OLE  43c44496-73a7-4b25-b876-1df2708e3e45 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIUniversalAppModel
OLE  ecc8094d-d468-4860-9d61-260400aa9829 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CISplashScreen
OLE  402af51f-a72c-45b8-8fe3-cff04ed914f1 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIUniversalTitleBar
OLE  05f3eb97-d7d7-4f49-919d-368bc0323fb4 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewBehaviorStatics
OLE  266d6f6f-822f-4304-b3b6-9dc7fec054a5 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewActivationRequestedEventArgsPreview
OLE  cdb5efb3-5788-509d-9be1-71ccb8a3362a (0.0) -- IAsyncOperation<boolean>
OLE  9345de75-e838-4721-9f20-7b09ac8be053 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewExecutionStateChangedEventArgs
OLE  57e9a04f-e685-491c-b433-f71b7b334bd3 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewUniversalPropertyChangedEventArgs
OLE  0f4accb1-d8f9-4011-ba37-2557925a78cf (0.0) -- IServiceHostBrokerProvider
OLE  d98fd14a-522a-4d59-b875-811e83919a9e (0.0) -- IApplicationActivationBroker
OLE  cd292360-2763-4085-8a9f-74b224a29175 (0.0) -- __x_Windows_CUI_CCore_CICoreWindowFactory
OLE  83140d1c-7e82-4cfb-96e4-f997cede7e10 (0.0) -- IUiaManagerWindowRegistration
OLE  6dc8c1be-86e5-4eef-8335-72cab53f06c8 (0.0) -- IUiaWindowRegistrationToken
OLE  317be656-a8be-48a0-95c9-cd02915bc9de (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIWindowChangedEventArgs
OLE  4f6719dc-762f-41da-b4e8-d3a037bca583 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIWindow
OLE  087ca5a4-8cfc-4264-b39d-da2bb2583a11 (0.0) -- ICoreWindowFactoryPriv
OLE  d928b176-b291-4bd6-9f6f-2e21e3ef6cbc (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIWindowBehaviorStatics
OLE  b6652262-46bb-521f-89f6-e890430bff3e (0.0) -- __FIReference_1_Windows__CInternal__CApplicationModel__CWindowManagement__CAppModelFrameworkKind
OLE  7fb024b8-0c52-44f0-aa7b-442557825557 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIUniversalBatch
OLE  a768d72d-edbd-4f38-b426-72f9f42ec757 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewVisibilityChangedEventArgs
OLE  445289d9-2bba-4b3d-9f41-09683cc27200 (0.0) -- IBackgroundTaskCapabilityInternal
OLE  cf651713-cd08-4fd8-b697-a281b6544e2e (0.0) -- __x_Windows_CApplicationModel_CActivation_CIActivatedEventArgs
OLE  a2add09a-fb9b-4e6e-bc69-0b810eeb0ab4 (0.0) -- IBackgroundActivationContext
OLE  601d51e3-801e-49c9-bbfa-fe29a662aead (0.0) -- IConfigureWindowFactory
OLE  0e0da070-2224-4934-8090-041f7ff223eb (0.0) -- ISplashScreen
OLE  ca4d975c-d4d6-43f0-97c0-0833c6391c24 (0.0) -- __x_Windows_CApplicationModel_CActivation_CISplashScreen
OLE  0e8c8da1-11b5-4fad-975a-14f51015e07a (0.0) -- ISplashScreenPriv
OLE  fc4801a3-2ba9-11cf-a229-00aa003d7352 (0.0) -- IObjectWithSite
OLE  8690f4ac-60ec-4d4b-93b3-ab71fbbecf80 (0.0) -- IApplicationActivationImpl
OLE  98057f1b-132b-473d-ac4b-aee7ac87887a (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewPreview
OLE  1f79f7de-20bf-4591-930a-d490b78fb09f (0.0) -- __x_Windows_CInternal_COneCore_CViewEventHandlers_CICoreCUIBroker
OLE  62a9407f-345a-4300-8cdd-4847dee60f48 (0.0) -- IApplicationInstanceManager
OLE  2f3eca0f-a0a7-445b-8f88-f6260a7dac04 (0.0) -- IPlmDataQuery
OLE  36c8be08-bca4-4431-b5c0-b07bc0baf3c8 (0.0) -- IPlmPackageServicing
OLE  85a098aa-ef5a-451b-b332-c1b795431bc3 (0.0) -- IContractActivation
OLE  2931fe47-4c9a-4e70-8de4-b80394ff42c1 (0.0) -- __x_Windows_CApplicationModel_CContracts_CInternal_CIContractBrokerPartialTrustStatics
OLE  98fba1b6-2909-418d-9ecf-c21600fa7822 (0.0) -- __x_Windows_CApplicationModel_CContracts_CInternal_CIContractBrokerBaseTrustAccessibleServer
OLE  c218afae-7884-4151-873f-631e82388d0d (0.0) -- IContractBrokerGetStreamReadyEvent
OLE  4bb67095-515f-4e53-b6bb-ddeb70df3cc4 (0.0) -- IContractBrokerGetStream
OLE  9eb0164f-16c5-45a6-9d11-6ba6b20d9635 (0.0) -- __x_Windows_CSystem_CInternal_CLaunch_CILauncherQueryInfoStatics
OLE  8246ed12-33e8-52b3-a5c5-19779de9999e (0.0) -- __FIVectorView_1_Windows__CApplicationModel__CAppInfo
OLE  cf7f59b3-6a09-4de8-a6c0-5792d56880d1 (0.0) -- __x_Windows_CApplicationModel_CIAppInfo
OLE  fed95700-f716-4950-bcac-8e2e1ca1b307 (0.0) -- IClipboardProtectionServices
OLE  48f4e2d1-eeba-461e-8f8f-6353da1a3aca (0.0) -- IApplicationStateChangeOutOfProcNotificationService
OLE  ee046ed5-6eaf-4fba-bdf6-0965545fedb8 (0.0) -- IUiaManagerEndpointStateNotifierSinkRegistration
OLE  fcbc010e-a314-43e9-b40a-49690a0c8b78 (0.0) -- IUiaManagerEndpointStateNotifierSinkRegistrationToken
Endpoints :
ncalrpc         : OLE560FA880F9111C2398064EEE6CEA
ncalrpc         : LRPC-dfe947b7652251660a
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 5556 at 0x5319128L>
64
['WpnUserService_9c09e']

Interfaces :
RPC  cad784cb-4c1b-4d96-b8f7-4716b568b13c (1.0) -- C:\windows\system32\wininet.dll
	0 -> s_UrlCacheGetManagerInterface
	1 -> StaticProxyResolver::CancelAll
	2 -> s_UrlCacheOpenContainer
	3 -> s_UrlCacheCloseContainer
	4 -> s_UrlCacheSetContainerEntryMaximumAge
	5 -> s_UrlCacheAddUrl
	6 -> s_UrlCacheLookupUrl
	7 -> s_UrlCacheCheckUrlsExist
	8 -> s_UrlCacheGetUrlBinaryBlob
	9 -> s_UrlCacheAddUrlBinaryBlob
	10 -> s_UrlCacheDeleteUrl
	11 -> s_UrlCacheUnlockUrl
	12 -> s_UrlCacheUpdateUrl
	13 -> s_UrlCacheEntryEnum
	14 -> s_UrlCacheEntryEnumClose
	15 -> s_UrlCacheEntryEnumNext
	16 -> s_UrlCacheCleanupUrls
	17 -> s_UrlCacheCleanupHttpsUrls
	18 -> s_UrlCacheGetSize
	19 -> s_UrlCacheGetLimit
	20 -> s_UrlCacheSetLimit
	21 -> s_UrlCacheGetCrossContainerContentTotalSizeAndLimit
	22 -> s_UrlCacheCleanupCrossContainers
	23 -> s_UrlCacheGetBloomFilter
	24 -> s_UrlCacheReleaseBloomFilter
	25 -> s_UrlCacheGetNextDirectory
	26 -> s_UrlCacheAddLeakFile
	27 -> s_UrlCacheCreateGroup
	28 -> s_UrlCacheDeleteGroup
	29 -> s_UrlCacheGetGroupIds
	30 -> s_UrlCacheGetGroup
	31 -> s_UrlCacheUpdateGroup
	32 -> s_UrlCacheSetUrlGroup
	33 -> s_UrlCacheGetContentContainerDirectories
	34 -> s_UrlCacheCreateExtensibleContainer
	35 -> s_UrlCacheDeleteExtensibleContainer
	36 -> s_UrlCacheGetExtensibleContainersList
	37 -> s_UrlCacheRpcSetGlobalLimit
	38 -> s_UrlCacheRpcGetGlobalLimit
	39 -> s_UrlCacheRpcReloadSettings
	40 -> s_UrlCacheGetGlobalCounters
	41 -> s_AppCacheOpenContainer
	42 -> s_AppCacheCloseContainer
	43 -> s_AppCacheRpcCheckManifest
	44 -> s_AppCacheRpcLookup
	45 -> s_AppCacheRpcDeleteGroup
	46 -> s_AppCacheRpcDeleteIeGroup
	47 -> s_AppCacheRpcGetFallbackUrl
	48 -> s_AppCacheRpcGetDownloadList
	49 -> s_AppCacheRpcCloseHandle
	50 -> s_AppCacheRpcInvalidate
	51 -> s_AppCacheRpcGetInfo
	52 -> s_AppCacheRpcGetGroupsList
	53 -> s_AppCacheRpcFreeSpace
	54 -> s_AppCacheRpcGetIeGroupList
	55 -> s_AppCacheRpcFreeIeSpace
	56 -> s_AppCacheRpcRetrieveUrl
	57 -> s_AppCacheRpcCommitUrl
	58 -> s_AppCacheRpcUpdateExtraData
	59 -> s_AppCacheRpcFinalize
	60 -> s_DependencyStoreOpenContainer
	61 -> s_DependencyStoreCloseContainer
	62 -> s_DependencyStoreUpdateUrl
	63 -> s_DependencyStoreRetrieveUrl
	64 -> s_DependencyStoreDeleteContainer
	65 -> s_HstsOpenContainer
	66 -> s_HstsCloseContainer
	67 -> s_HstsGetHstsEntries
	68 -> s_HstsSetHstsEntries
	69 -> s_HstsPurgeContainer
	70 -> s_CookieOpenContainer
	71 -> s_CookieCloseContainer
	72 -> s_CookieGetCookies
	73 -> s_CookieGetAllCookies
	74 -> s_CookieUpdateCookies
	75 -> s_CookiePurgeContainer
	76 -> s_BlobOpenContainer
	77 -> s_BlobCloseContainer
	78 -> s_BlobGetEntries
	79 -> s_BlobGetEntry
	80 -> s_BlobSetEntry
	81 -> s_BlobDeleteEntry
	82 -> s_BlobPurgeContainer
RPC  9d420415-b8fb-4f4a-8c53-4502ead30ca9 (1.0) -- C:\windows\System32\PlaySndSrv.dll
	0 -> I_PlaySoundkPostMessage
Endpoints :
ncalrpc         : webcache_{031b98cf-4a69-4c31-ab42-fd9b3c199407}_S-1-5-21-4197069449-1782053943-1514089459-500
ncalrpc         : PlaySoundKRpc2
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 5776 at 0x5319e80L>
64
['TokenBroker']

Interfaces :
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  b07904dd-31f6-452c-a738-fa5a2fda337b (0.0) -- __x_Windows_CInternal_CStateRepository_CIUserStatics
OLE  bb7966ba-e363-4f5d-b1bf-901fabfb603b (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageStatics
OLE  5232f8ea-49c7-4840-bfbb-66e785689e88 (0.0) -- __x_Windows_CInternal_CStateRepository_CIUser
OLE  d239aef3-1f67-43ec-be5e-8fbc2cb72000 (0.0) -- __x_Windows_CInternal_CStateRepository_CITileViewStatics
OLE  78662bbb-1464-4279-b5ff-ffccb2bc6529 (0.0) -- __x_Windows_CInternal_CStateRepository_CIApplicationExtensionStatics
OLE  35215f68-9b34-5676-b602-3814bf0e57f6 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CPackage
OLE  ab19c2c5-9694-5644-a825-7976f20063b1 (0.0) -- __FIIterable_1_Windows__CInternal__CStateRepository__CPackage
OLE  e09b3138-ae27-5c5f-a744-0ddf9881cee6 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CApplicationExtension
OLE  7d4d0de5-3dc0-58c1-a31e-572e2eba5228 (0.0) -- __FIIterator_1_Windows__CInternal__CStateRepository__CPackage
OLE  81aba04c-0d4b-422d-b790-3de217afde4d (0.0) -- __x_Windows_CInternal_CStateRepository_CIApplicationExtension
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  8e69aa27-aa66-456a-8ca9-6ce89f1bf043 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackage
OLE  b17fc34b-d906-4cd1-ad70-c16d125d1686 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileUserNotificationChannelStatics
OLE  8a43ed9f-f4e6-4421-acf9-1dab2986820c (0.0) -- IPropertySet
OLE  1b0d3570-0877-5ec2-8a2c-3b9539506aca (0.0) -- IMap<HSTRING,IInspectable>
OLE  366a9874-5ea2-436a-828f-0145bd6cf463 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileUserNotificationChannel
OLE  fe39030f-8455-4bf4-af4a-a34c336e4c13 (0.0) -- __x_Windows_CInternal_CStateRepository_CISecondaryTileUserNotificationChannelStatics
OLE  b15abd7e-4d7e-49e4-9cda-d564220fef0c (0.0) -- __x_Windows_CInternal_CStateRepository_CIApplication
OLE  100e0fe5-f8e6-4211-b7ad-21085e53a12e (0.0) -- __x_Windows_CInternal_CStateRepository_CISecondaryTileUserNotificationChannel
OLE  f7e80409-27e5-4514-805f-a431c4ce3b96 (0.0) -- __x_Windows_CInternal_CStateRepository_CIMrtApplicationStatics
OLE  8afe010a-b611-484e-944d-5ea6e4a23569 (0.0) -- __x_Windows_CInternal_CStateRepository_CIMrtApplication
OLE  ede4711a-0c90-4d5b-acf3-58af696d9425 (0.0) -- __x_Windows_CInternal_CStateRepository_CIMrtPackageStatics
OLE  e15958e5-d7fd-435b-a075-0b959b6788d5 (0.0) -- __x_Windows_CInternal_CStateRepository_CIMrtPackage
OLE  d81e96f1-a89c-417e-9335-59531026309d (0.0) -- __x_Windows_CInternal_CStateRepository_CIApplicationStatics
OLE  4fe0a6ff-aa6b-4cb3-9241-dd477a7abb84 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageFamily
OLE  3f593a63-8c13-4aaf-b4c6-840d3dda9e89 (0.0) -- __x_Windows_CInternal_CStateRepository_CISecondaryTileUserStatics
OLE  a859fc78-67cd-447a-9e17-5d0e14176a71 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageUserStatics
OLE  306b5ee3-4a11-5d18-8d6a-c5a60b606905 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CPackageUser
OLE  05088a81-8af6-41e9-a3af-77321cc3c6ea (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageUser
OLE  02f69653-707a-4bce-a0ae-b6053e3b17cd (0.0) -- __x_Windows_CInternal_CStateRepository_CManagement_CIRepositoryManager
OLE  8645456f-d9a2-4b82-afec-58f0e8df0acf (0.0) -- __x_Windows_CInternal_CStateRepository_CIFileTypeAssociationStatics
OLE  89bc3f49-f8d9-5103-ba13-de497e609167 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CFileTypeAssociation
OLE  1bb373e7-f9b5-5c96-a392-cb957cb3ee66 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CApplication
OLE  9519f1d6-cf33-4920-8419-688881b44f79 (0.0) -- __x_Windows_CInternal_CStateRepository_CITileViewQueryFilter
OLE  5b80a794-e1ba-5917-9ed5-63e7cde8ee9a (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CTileView
OLE  db5abad9-b595-50ca-9ae4-28e796601256 (0.0) -- __FIIterable_1_Windows__CInternal__CStateRepository__CTileView
OLE  0d2a8ed4-fa32-5dfa-a177-3898968b4290 (0.0) -- __FIIterator_1_Windows__CInternal__CStateRepository__CTileView
OLE  314e4199-1c0b-40d1-b47e-163300700e4c (0.0) -- __x_Windows_CInternal_CStateRepository_CITileView
OLE  4cc8fe6a-5976-4ece-ac32-62e2a5497f46 (0.0) -- __x_Windows_CInternal_CStateRepository_CIFileTypeAssociation
OLE  0f2f217e-7957-4262-a74c-df03d9e9e9c1 (0.0) -- __x_Windows_CInternal_CStateRepository_CIProtocolStatics
OLE  63624def-cd42-5bcf-96e6-e27614e5d807 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CProtocol
OLE  fdd7e51e-d1cc-41d9-ae36-a5fac6fe5216 (0.0) -- __x_Windows_CInternal_CStateRepository_CIProtocol
OLE  dd4cd077-46ac-4e8f-9afb-f0055ae35b32 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageLocationStatics
OLE  86f5b0ee-9560-4d76-a06a-ca4c8bfe4426 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageFamilyStatics
OLE  a39a796c-2c0e-4530-bf70-d633ee369785 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageLocation
OLE  7fe36c7d-c0d2-4ed2-970c-95f671367f20 (0.0) -- __x_Windows_CInternal_CStateRepository_CIApplicationPropertyStatics
OLE  f7a88ec3-6f33-46bf-83b8-78aaf94ac396 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackagePolicyStatics
OLE  500f5564-558d-5886-ba4a-b41ffeb39322 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CPackagePolicy
OLE  7619d03f-b9b1-446c-aeb9-f126825fd333 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackagePolicy
OLE  76b8f79f-34a1-4d59-bfaa-1472aba872e5 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileUserStatics
OLE  6dd00567-b07e-59ee-ad82-d9d8ec4c2914 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CPrimaryTileUserDataChange
OLE  da069297-d440-588a-8550-8302e7e879b8 (0.0) -- __FIIterable_1_Windows__CInternal__CStateRepository__CPrimaryTileUserDataChange
OLE  15b2bc91-0a52-5ba5-8f3a-9302adfa28a6 (0.0) -- __FIIterator_1_Windows__CInternal__CStateRepository__CPrimaryTileUserDataChange
OLE  16462b61-3298-441c-af1b-1c0995748cf7 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileUserDataChange
OLE  c9e5352e-a07a-4e91-8309-46904e20888c (0.0) -- __x_Windows_CInternal_CStateRepository_CIDependencyGraphStatics
OLE  66d2ce49-2ebb-5cb4-8f27-ddbd019099a5 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CDependencyGraph
OLE  6a94ad8a-dd00-5816-a025-016d0ba262b6 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CSecondaryTileUserDataChange
OLE  d54e91cc-2033-5964-b69d-bd0f2459c396 (0.0) -- __FIIterable_1_Windows__CInternal__CStateRepository__CSecondaryTileUserDataChange
OLE  3c310f81-daa9-5425-baa9-7e7958c75b5f (0.0) -- __FIIterator_1_Windows__CInternal__CStateRepository__CSecondaryTileUserDataChange
OLE  cb3a2a28-41c0-4687-9ea6-c248191321de (0.0) -- __x_Windows_CInternal_CStateRepository_CITargetDeviceFamilyStatics
OLE  e5dbfeae-3a40-4926-920c-a1ad8882663e (0.0) -- __x_Windows_CInternal_CStateRepository_CITargetDeviceFamily
OLE  804eb537-d7e6-4945-bba0-e6137d421ae4 (0.0) -- __x_Windows_CInternal_CStateRepository_CIAppUriHandlerStatics
OLE  be14c746-e9c8-5ef4-8811-68272ca94e59 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CAppUriHandler
OLE  21f54ca7-3fe6-447a-a4dc-a9afc49c4999 (0.0) -- __x_Windows_CInternal_CStateRepository_CIAppUriHandler
OLE  2f2cd542-df5a-4f71-a46d-6d694f32fa97 (0.0) -- __x_Windows_CInternal_CStateRepository_CIXapStatics
OLE  04222ebf-3c08-5a6f-b227-d886a2b52873 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CProtocolLauncherInfo
OLE  219c82b0-40f6-4f7e-a532-4373bb075ed7 (0.0) -- __x_Windows_CInternal_CStateRepository_CIProtocolLauncherInfo
OLE  01e6e15a-7659-4e66-8f82-223e1831afc8 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageFamilyPolicyStatics
OLE  96362321-f8c2-591f-b3ef-32979d06a8bb (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CPackageFamilyPolicy
OLE  d88678cf-e543-4953-b04d-bc5da7b90592 (0.0) -- __x_Windows_CInternal_CStateRepository_CISecondaryTileViewStatics
OLE  15f99879-aa48-571f-845d-144893440cfd (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CFileTypeAssociationLauncherInfo
OLE  79f51b1c-f79f-4c22-8bc2-a5b3875f4a63 (0.0) -- __x_Windows_CInternal_CStateRepository_CIDependencyGraph
OLE  82122bea-b05d-4ca4-9607-7c215e0435f5 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileViewStatics
OLE  e9d7d323-3b8c-472f-bf0c-97b8da53abf6 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileView
Endpoints :
ncalrpc         : OLEA2BB2B5D88474E7280BE090CB33D
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1416 at 0x5319ac8L>
64
['TabletInputService']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1840 at 0x5319710L>
64
['CDPSvc']

Testo modificato

Apri file

--------------------------------------------------------------------------------
<WinProcess "smss.exe" pid 520 at 0x5db0c50L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 776 at 0x5db0908L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "wininit.exe" pid 876 at 0x5db0e48L>
64

Interfaces :
RPC  76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\WINDOWS\system32\wininit.exe
	0 -> I_WMsgkSendMessage
	1 -> I_WMsgkSendPSPMessage
RPC  894de0c0-0d55-11d3-a322-00c04fa321a1 (1.0) -- C:\WINDOWS\system32\wininit.exe
	0 -> s_BaseInitiateShutdown
	1 -> s_BaseAbortShutdown
	2 -> s_BaseInitiateShutdownEx
RPC  d95afe70-a6d5-4259-822e-2c84da1ddb0d (1.0) -- C:\WINDOWS\system32\wininit.exe
	0 -> s_WsdrInitiateShutdown
	1 -> s_WsdrAbortShutdown
	2 -> s_WsdrCheckForHiberboot
RPC  76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\WINDOWS\system32\wininit.exe
	0 -> I_WMsgSendMessage
	1 -> I_WMsgSendPSPMessage
	2 -> I_WMsgSendNotifyMessage
	3 -> I_WMsgSendReconnectionUpdateMessage
Endpoints :
ncalrpc         : WMsgKRpc017ED30
ncacn_np        : \PIPE\InitShutdown
ncalrpc         : WindowsShutdown
ncacn_ip_tcp    : 1536
--------------------------------------------------------------------------------
<WinProcess "services.exe" pid 948 at 0x5db0f28L>
64

Interfaces :
RPC  367abb81-9844-35f1-ad32-98f038001003 (2.0) -- C:\WINDOWS\system32\services.exe
	0 -> RCloseServiceHandle
	1 -> RControlService
	2 -> RDeleteService
	3 -> RLockServiceDatabase
	4 -> RQueryServiceObjectSecurity
	5 -> RSetServiceObjectSecurity
	6 -> RQueryServiceStatus
	7 -> RSetServiceStatus
	8 -> RUnlockServiceDatabase
	9 -> RNotifyBootConfigStatus
	10 -> RI_ScSetServiceBitsW
	11 -> RChangeServiceConfigW
	12 -> RCreateServiceW
	13 -> REnumDependentServicesW
	14 -> REnumServicesStatusW
	15 -> ROpenSCManagerW
	16 -> ROpenServiceW
	17 -> RQueryServiceConfigW
	18 -> RQueryServiceLockStatusW
	19 -> RStartServiceW
	20 -> RGetServiceDisplayNameW
	21 -> RGetServiceKeyNameW
	22 -> CServiceRecord::GetStatusInternal
	23 -> RChangeServiceConfigA
	24 -> RCreateServiceA
	25 -> REnumDependentServicesA
	26 -> REnumServicesStatusA
	27 -> ROpenSCManagerA
	28 -> ROpenServiceA
	29 -> RQueryServiceConfigA
	30 -> RQueryServiceLockStatusA
	31 -> RStartServiceA
	32 -> RGetServiceDisplayNameA
	33 -> RGetServiceKeyNameA
	34 -> CServiceRecord::GetStatusInternal
	35 -> REnumServiceGroupW
	36 -> RChangeServiceConfig2A
	37 -> RChangeServiceConfig2W
	38 -> RQueryServiceConfig2A
	39 -> RQueryServiceConfig2W
	40 -> RQueryServiceStatusEx
	41 -> REnumServicesStatusExA
	42 -> REnumServicesStatusExW
	43 -> RI_ScBroadcastServiceControlMessage
	44 -> RCreateServiceWOW64A
	45 -> RCreateServiceWOW64W
	46 -> RI_ScQueryServiceTagInfo
	47 -> RNotifyServiceStatusChange
	48 -> RGetNotifyResults
	49 -> RCloseNotifyHandle
	50 -> RControlServiceExA
	51 -> RControlServiceExW
	52 -> RI_ScSendPnPMessage
	53 -> RI_ScValidatePnPService
	54 -> RI_ScOpenServiceStatusHandle
	55 -> RI_ScQueryServiceConfig
	56 -> RQueryServiceConfigEx
	57 -> RI_ScRegisterPreshutdownRestart
	58 -> RI_ScReparseServiceDatabase
	59 -> RQueryUserServiceName
	60 -> RCreateWowService
	61 -> RGetServiceRegistryStateKey
	62 -> RGetServiceDirectory
RPC  a2c45f7c-7d32-46ad-96f5-adafb486be74 (1.0) -- C:\WINDOWS\system32\services.exe
	0 -> RI_ScOpenServiceChannelHandle
	1 -> RI_ScSendResponseReceiveControls
	2 -> RI_ScCloseServiceChannelHandle
RPC  93149ca2-973b-11d1-8c39-00c04fb984f9 (0.0) -- C:\WINDOWS\SYSTEM32\scesrv.dll
	0 -> SceSvcRpcQueryInfo
	1 -> SceSvcRpcSetInfo
	2 -> SceRpcSetupUpdateObject
	3 -> SceRpcSetupMoveFile
	4 -> SceRpcGenerateTemplate
	5 -> SceRpcConfigureSystem
	6 -> SceRpcGetDatabaseInfo
	7 -> SceRpcGetObjectChildren
	8 -> SceRpcOpenDatabase
	9 -> SceRpcCloseDatabase
	10 -> SceRpcGetDatabaseDescription
	11 -> SceRpcGetDBTimeStamp
	12 -> SceRpcGetObjectSecurity
	13 -> SceRpcGetAnalysisSummary
	14 -> SceRpcAnalyzeSystem
	15 -> SceRpcUpdateDatabaseInfo
	16 -> SceRpcUpdateObjectInfo
	17 -> SceRpcStartTransaction
	18 -> SceRpcCommitTransaction
	19 -> SceRpcRollbackTransaction
	20 -> SceRpcGetServerProductType
	21 -> SceSvcRpcUpdateInfo
	22 -> SceRpcCopyObjects
	23 -> SceRpcSetupResetLocalPolicy
	24 -> SceRpcNotifySaveChangesInGP
	25 -> SceRpcControlNotificationQProcess
	26 -> SceRpcBrowseDatabaseTable
	27 -> SceRpcGetSystemSecurity
	28 -> SceRpcGetSystemSecurity
	29 -> SceRpcSetSystemSecurity
	30 -> SceRpcSetSystemSecurity
	31 -> SceRpcSetDatabaseSetting
	32 -> SceRpcGetDatabaseSetting
	33 -> SceRpcConfigureConvertedFileSecurityImmediately
Endpoints :
ncalrpc         : ntsvcs
ncacn_np        : \pipe\ntsvcs
ncacn_np        : \PIPE\scerpc
ncacn_ip_tcp    : 1543
--------------------------------------------------------------------------------
<WinProcess "LsaIso.exe" pid 968 at 0x5db0c88L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "lsass.exe" pid 980 at 0x5e18358L>
64
['KeyIso', 'SamSs', 'VaultSvc']

Interfaces :
RPC  12345778-1234-abcd-ef00-0123456789ab (0.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> LsarClose
	1 -> CredrRename
	2 -> LsarEnumeratePrivileges
	3 -> LsarQuerySecurityObject
	4 -> LsarSetSecurityObject
	5 -> LsaITestCall
	6 -> LsarOpenPolicyRPC
	7 -> LsarQueryInformationPolicy
	8 -> LsarSetInformationPolicy
	9 -> LsaITestCall
	10 -> LsarCreateAccount
	11 -> LsarEnumerateAccounts
	12 -> LsarCreateTrustedDomain
	13 -> LsarEnumerateTrustedDomains
	14 -> LsarLookupNames
	15 -> LsarLookupSids
	16 -> LsarCreateSecret
	17 -> LsarOpenAccount
	18 -> LsarEnumeratePrivilegesAccount
	19 -> LsarAddPrivilegesToAccount
	20 -> LsarRemovePrivilegesFromAccount
	21 -> LsarGetQuotasForAccount
	22 -> LsarSetQuotasForAccount
	23 -> LsarGetSystemAccessAccount
	24 -> LsarSetSystemAccessAccount
	25 -> LsarOpenTrustedDomain
	26 -> LsarQueryInfoTrustedDomain
	27 -> LsarSetInformationTrustedDomain
	28 -> LsarOpenSecret
	29 -> LsarSetSecret
	30 -> LsarQuerySecret
	31 -> LsarLookupPrivilegeValue
	32 -> LsarLookupPrivilegeName
	33 -> LsarLookupPrivilegeDisplayName
	34 -> LsarDeleteObject
	35 -> LsarEnumerateAccountsWithUserRight
	36 -> LsarEnumerateAccountRights
	37 -> LsarAddAccountRights
	38 -> LsarRemoveAccountRights
	39 -> LsarQueryTrustedDomainInfo
	40 -> LsarSetTrustedDomainInfo
	41 -> LsarDeleteTrustedDomain
	42 -> LsarStorePrivateData
	43 -> LsarRetrievePrivateData
	44 -> LsarOpenPolicy2
	45 -> LsarGetUserName
	46 -> LsarQueryInformationPolicy2
	47 -> LsarSetInformationPolicy2
	48 -> LsarQueryTrustedDomainInfoByName
	49 -> LsarSetTrustedDomainInfoByName
	50 -> LsarEnumerateTrustedDomainsEx
	51 -> LsarCreateTrustedDomainEx
	52 -> LsaITestCall
	53 -> LsarQueryDomainInformationPolicy
	54 -> LsarSetDomainInformationPolicy
	55 -> LsarOpenTrustedDomainByName
	56 -> LsaITestCall
	57 -> LsarLookupSids2
	58 -> LsarLookupNames2
	59 -> LsarCreateTrustedDomainEx2
	60 -> CredrWrite
	61 -> CredrRead
	62 -> CredrEnumerate
	63 -> CredrWriteDomainCredentials
	64 -> CredrReadDomainCredentials
	65 -> CredrDelete
	66 -> CredrGetTargetInfo
	67 -> CredrProfileLoaded
	68 -> LsarLookupNames3
	69 -> CredrGetSessionTypes
	70 -> LsarRegisterAuditEvent
	71 -> LsarGenAuditEvent
	72 -> LsarUnregisterAuditEvent
	73 -> LsarQueryForestTrustInformation
	74 -> LsarSetForestTrustInformation
	75 -> CredrRename
	76 -> LsarLookupSids3
	77 -> LsarLookupNames4
	78 -> LsarOpenPolicySce
	79 -> LsarAdtRegisterSecurityEventSource
	80 -> LsarAdtUnregisterSecurityEventSource
	81 -> LsarAdtReportSecurityEvent
	82 -> CredrFindBestCredential
	83 -> LsarSetAuditPolicy
	84 -> LsarQueryAuditPolicy
	85 -> LsarEnumerateAuditPolicy
	86 -> LsarEnumerateAuditCategories
	87 -> LsarEnumerateAuditSubCategories
	88 -> LsarLookupAuditCategoryName
	89 -> LsarLookupAuditSubCategoryName
	90 -> LsarSetAuditSecurity
	91 -> LsarQueryAuditSecurity
	92 -> CredrReadByTokenHandle
	93 -> CredrRestoreCredentials
	94 -> CredrBackupCredentials
	95 -> LsarManageSidNameMapping
	96 -> CredrProfileUnloaded
	97 -> CredrRename
	98 -> CredrRename
	99 -> CredrRename
	100 -> CredrRename
	101 -> CredrRename
	102 -> LsarEfsGetSmartcardCredentials
	103 -> LsarAuditSetGlobalSacl
	104 -> LsarAuditQueryGlobalSacl
	105 -> CredrProfileLoadedEx
	106 -> LsarInteractiveSessionIsLoggedOff
	107 -> LsarConfigureAutoLogonCredentials
	108 -> LsarGetDeviceRegistrationInfo
	109 -> LsaITestCall
	110 -> LsarProfileDeleted
	111 -> LsaITestCall
	112 -> LsarMakeLogonSessionsSiblings
	113 -> LsarValidateProcUniqueLuid
	114 -> LsarIsArsoAllowedByPolicy
	115 -> LsarIsArsoAllowedByConsent
	116 -> LsarEnableArsoConsent
	117 -> LsarDisableArsoConsent
	118 -> LsarIsArsoAllowedByPolicy
	119 -> LsarIsUserArsoEnabled
	120 -> LsarEnableUserArso
	121 -> LsarDisableUserArso
	122 -> LsarConfigureUserArso
	123 -> LsarGetInprocDispatchTable
	124 -> LsarSetSharedUserSession
	125 -> LsarClearSharedUserSession
RPC  ace1c026-8b3f-4711-8918-f345d17f5bff (1.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> S_RPC_LspUpdatePrivateData
	1 -> S_RPC_LspReadPrivateData
RPC  afc07e2e-311c-4435-808c-c483ffeec7c9 (1.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> LsarGetAvailableCAPIDs
	1 -> LsarSetCAPs
	2 -> LsarQueryCAPs
RPC  c0d930f0-b787-4124-99bc-21f0ecb642ce (0.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> LsarConnectLocalUser
	1 -> LsarDisconnectLocalUser
	2 -> LsarCreateConnectedUser
	3 -> LsarIsCurrentUserConnected
	4 -> LsarRenewCertificate
	5 -> LsarGetSSOAccountType
	6 -> LsarIsUserMSA
RPC  d25576e4-00d2-43f7-98f9-b4c0724158f9 (0.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> LsarEasMarkUserControlled
	1 -> LsarEasGetCallerPasswordComplexity
	2 -> LsarEasGetControlledUsersInfo
RPC  c681d488-d850-11d0-8c52-00c04fd90f7e (1.0) -- C:\WINDOWS\system32\efslsaext.dll
	0 -> EfsRpcOpenFileRaw_Downlevel
	1 -> EfsRpcReadFileRaw_Downlevel
	2 -> EfsRpcWriteFileRaw_Downlevel
	3 -> EfsRpcCloseRaw_Downlevel
	4 -> EfsRpcEncryptFileSrv_Downlevel
	5 -> EfsRpcDecryptFileSrv_Downlevel
	6 -> EfsRpcQueryUsersOnFile_Downlevel
	7 -> EfsRpcQueryRecoveryAgents_Downlevel
	8 -> EfsRpcRemoveUsersFromFile_Downlevel
	9 -> EfsRpcAddUsersToFile_Downlevel
	10 -> EfsRpcFileKeyInfoEx_Downlevel
	11 -> EfsRpcFileKeyInfoEx_Downlevel
	12 -> EfsRpcFileKeyInfo_Downlevel
	13 -> EfsRpcDuplicateEncryptionInfoFile_Downlevel
	14 -> EfsRpcFileKeyInfoEx_Downlevel
	15 -> EfsRpcAddUsersToFileEx_Downlevel
	16 -> EfsRpcFileKeyInfoEx_Downlevel
	17 -> EfsRpcFileKeyInfoEx_Downlevel
	18 -> EfsRpcFileKeyInfoEx_Downlevel
	19 -> EfsRpcFileKeyInfoEx_Downlevel
	20 -> EfsRpcFlushEfsCache_Downlevel
RPC  fb8a0729-2d04-4658-be93-27b4ad553fac (1.0) -- C:\WINDOWS\system32\lsass.exe
	0 -> LsaLookuprOpenPolicy2
	1 -> LsaLookuprClose
	2 -> LsaLookuprTranslateSids2
	3 -> LsaLookuprTranslateNames3
	4 -> LsaLookuprManageCache
	5 -> LsaLookuprGetDomainInfo
	6 -> LsaLookuprUserAccountType
RPC  4f32adc8-6052-4a04-8701-293ccf2096f0 (1.0) -- C:\WINDOWS\SYSTEM32\SspiSrv.dll
	0 -> SspirConnectRpc
	1 -> SspirDisconnectRpc
	2 -> SspirDisconnectRpc
	3 -> SspirCallRpc
	4 -> SspirAcquireCredentialsHandle
	5 -> SspirFreeCredentialsHandle
	6 -> SspirProcessSecurityContext
	7 -> SspirDeleteSecurityContext
	8 -> SspirSslQueryCredentialsAttributes
	9 -> SspirNegQueryContextAttributes
	10 -> SspirSslSetCredentialsAttributes
	11 -> SspirApplyControlToken
	12 -> SspirLogonUser
	13 -> SspirLookupAccountSid
	14 -> SspirGetUserName
	15 -> SspirGetInprocDispatchTable
RPC  11220835-5b26-4d94-ae86-c3e475a809de (1.0) -- C:\WINDOWS\system32\dpapisrv.dll
	0 -> s_SSCryptProtectData
	1 -> s_SSCryptUnprotectData
	2 -> s_SSCryptUpdateProtectedState
RPC  5cbe92cb-f4be-45c9-9fc9-33e73e557b20 (1.0) -- C:\WINDOWS\system32\dpapisrv.dll
	0 -> s_SSRecoverQueryStatus
	1 -> s_SSRecoverImportRecoveryKey
	2 -> s_SSRecoverPassword
RPC  7f1317a8-4dea-4fa2-a551-df5516ff8879 (1.0) -- C:\WINDOWS\system32\dpapisrv.dll
	0 -> s_LRpcSIDKeyProtect
	1 -> s_LRpcSIDKeyUnprotect
RPC  3919286a-b10c-11d0-9ba8-00c04fd92ef5 (0.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> DsRolerGetPrimaryDomainInformation
RPC  12345778-1234-abcd-ef00-0123456789ac (1.0) -- C:\WINDOWS\SYSTEM32\samsrv.dll
	0 -> SamrConnect
	1 -> SamrCloseHandle
	2 -> SamrSetSecurityObject
	3 -> SamrQuerySecurityObject
	4 -> SamrShutdownSamServer
	5 -> SamrLookupDomainInSamServer
	6 -> SamrEnumerateDomainsInSamServer
	7 -> SamrOpenDomain
	8 -> SamrQueryInformationDomain
	9 -> SamrSetInformationDomain
	10 -> SamrCreateGroupInDomain
	11 -> SamrEnumerateGroupsInDomain
	12 -> SamrCreateUserInDomain
	13 -> SamrEnumerateUsersInDomain
	14 -> SamrCreateAliasInDomain
	15 -> SamrEnumerateAliasesInDomain
	16 -> SamrGetAliasMembership
	17 -> SamrLookupNamesInDomain
	18 -> SamrLookupIdsInDomain
	19 -> SamrOpenGroup
	20 -> SamrQueryInformationGroup
	21 -> SamrSetInformationGroup
	22 -> SamrAddMemberToGroup
	23 -> SamrDeleteGroup
	24 -> SamrRemoveMemberFromGroup
	25 -> SamrGetMembersInGroup
	26 -> SamrSetMemberAttributesOfGroup
	27 -> SamrOpenAlias
	28 -> SamrQueryInformationAlias
	29 -> SamrSetInformationAlias
	30 -> SamrDeleteAlias
	31 -> SamrAddMemberToAlias
	32 -> SamrRemoveMemberFromAlias
	33 -> SamrGetMembersInAlias
	34 -> SamrOpenUser
	35 -> SamrDeleteUser
	36 -> SamrQueryInformationUser
	37 -> SamrSetInformationUser
	38 -> SamrChangePasswordUser
	39 -> SamrGetGroupsForUser
	40 -> SamrQueryDisplayInformation
	41 -> SamrGetDisplayEnumerationIndex
	42 -> SamrTestPrivateFunctionsDomain
	43 -> SamrTestPrivateFunctionsUser
	44 -> SamrGetUserDomainPasswordInformation
	45 -> SamrRemoveMemberFromForeignDomain
	46 -> SamrQueryInformationDomain2
	47 -> SamrQueryInformationUser2
	48 -> SamrQueryDisplayInformation2
	49 -> SamrGetDisplayEnumerationIndex2
	50 -> SamrCreateUser2InDomain
	51 -> SamrQueryDisplayInformation3
	52 -> SamrAddMultipleMembersToAlias
	53 -> SamrRemoveMultipleMembersFromAlias
	54 -> SamrOemChangePasswordUser2
	55 -> SamrUnicodeChangePasswordUser2
	56 -> SamrGetDomainPasswordInformation
	57 -> SamrConnect2
	58 -> SamrSetInformationUser2
	59 -> SamrSetBootKeyInformation
	60 -> SamrGetBootKeyInformation
	61 -> SamrConnect3
	62 -> SamrConnect4
	63 -> SamrUnicodeChangePasswordUser3
	64 -> SamrConnect5
	65 -> SamrRidToSid
	66 -> SamrSetDSRMPassword
	67 -> SamrValidatePassword
	68 -> SamrQueryLocalizableAccountsInDomain
	69 -> SamrPerformGenericOperation
	70 -> SamrSyncDSRMPasswordFromAccount
	71 -> SamrLookupNamesInDomain2
	72 -> SamrEnumerateUsersInDomain2
RPC  b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 (2.0) -- C:\WINDOWS\system32\keyiso.dll
	0 -> s_SrvRpcCreateContext
	1 -> s_SrvRpcReleaseContext
	2 -> s_SrvRpcCryptOpenStorageProvider
	3 -> s_SrvRpcCryptIsAlgSupported
	4 -> s_SrvRpcCryptEnumAlgorithms
	5 -> s_SrvRpcCryptEnumKeys
	6 -> s_SrvRpcCryptFreeBuffer
	7 -> s_SrvRpcCryptFreeProvider
	8 -> s_SrvRpcCryptFreeKey
	9 -> s_SrvRpcCryptOpenKey
	10 -> s_SrvRpcCryptCreatePersistedKey
	11 -> s_SrvRpcCryptGetProviderProperty
	12 -> s_SrvRpcCryptSetProviderProperty
	13 -> s_SrvRpcCryptGetKeyProperty
	14 -> s_SrvRpcCryptSetKeyProperty
	15 -> s_SrvRpcCryptFinalizeKey
	16 -> s_SrvRpcCryptEncrypt
	17 -> s_SrvRpcCryptDecrypt
	18 -> s_SrvRpcCryptImportKey
	19 -> s_SrvRpcCryptExportKey
	20 -> s_SrvRpcCryptSignHash
	21 -> s_SrvRpcCryptVerifySignature
	22 -> s_SrvRpcCryptDeleteKey
	23 -> s_SrvRpcCryptNotifyChangeKey
	24 -> s_SrvRpcCryptSecretAgreement
	25 -> s_SrvRpcCryptDeriveKey
	26 -> s_SrvRpcCryptFreeSecret
	27 -> s_SrvRpcCryptCipherEncrypt
	28 -> s_SrvRpcCryptCipherDecrypt
	29 -> s_SrvRpcCryptKeyDerivation
	30 -> s_SrvRpcCryptCreateClaim
	31 -> s_SrvRpcCryptVerifyClaim
RPC  8fb74744-b2ff-4c00-be0d-9ef9a191fe1b (1.0) -- C:\WINDOWS\system32\keyiso.dll
	0 -> s_GetSymmetricPopKeyTransportKey
	1 -> s_GetSymmetricPopKeyTransportKeyName
	2 -> s_DeleteSymmetricPopKeyTransportKey
	3 -> s_ImportSymmetricPopKey
	4 -> s_SignWithSymmetricPopKey
	5 -> s_VerifyWithSymmetricPopKey
	6 -> s_DecryptWithSymmetricPopKey
	7 -> s_EncryptWithSymmetricPopKey
	8 -> s_GetKeyAttestationForContainerService
	9 -> s_RenewKeyAttestation
	10 -> s_GetPregenUserKey
	11 -> s_GetPregenKeyState
RPC  51a227ae-825b-41f2-b4a9-1ac9557a1018 (1.0) -- C:\WINDOWS\system32\keyiso.dll
	0 -> s_TokenBindingGenerateTpmKeyFromSoftware
RPC  bb8b98e8-84dd-45e7-9f34-c3fb6155eeed (1.0) -- C:\Windows\System32\vaultsvc.dll
	0 -> VltCreateItemType
	1 -> VltDeleteItemType
	2 -> VltEnumerateItemTypes
	3 -> VltAddItem
	4 -> VltFindItems
	5 -> VltEnumerateItems
	6 -> VltGetItem
	7 -> VltRemoveItem
	8 -> VltGetItemType
	9 -> VltOpenVault
	10 -> VltCloseVault
	11 -> VltGetInformation
	12 -> VltEnumerateVaults
	13 -> VltEnumerateSettingUnits
	14 -> VltGetSettingUnit
	15 -> VltApplySettingUnit
	16 -> VltRemoveSettingUnit
	17 -> VltTriggerSync
	18 -> VltGetSettingUnitInfo
Endpoints :
ncacn_np        : \pipe\lsass
ncalrpc         : audit
ncalrpc         : securityevent
ncalrpc         : LSARPC_ENDPOINT
ncalrpc         : lsacap
ncalrpc         : LSA_IDPEXT_ENDPOINT
ncalrpc         : LSA_EAS_ENDPOINT
ncalrpc         : lsapolicylookup
ncalrpc         : lsasspirpc
ncalrpc         : protected_storage
ncalrpc         : SidKey Local End Point
ncalrpc         : samss lpc
ncacn_ip_tcp    : 1635
ncalrpc         : Vault
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 672 at 0x5e18a90L>
64
['PlugPlay']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 748 at 0x5e18d68L>
64
['BrokerInfrastructure', 'DcomLaunch', 'Power', 'SystemEventsBroker']

Interfaces :
RPC  6c9b7b96-45a8-4cca-9eb3-e21ccf8b5a89 (1.1) -- c:\windows\system32\umpo.dll
	0 -> UmpoRpcGetPowerConfiguration
	1 -> UmpoRpcReadFromSystemPowerKey
	2 -> UmpoRpcReadFromUserPowerKey
	3 -> UmpoRpcReadACValue
	4 -> UmpoRpcReadDCValue
	5 -> UmpoRpcWriteToSystemPowerKey
	6 -> UmpoRpcWriteToUserPowerKey
	7 -> UmpoRpcApplyPowerRequestOverride
	8 -> UmpoRpcApplyPowerSetting
	9 -> UmpoRpcSetActiveScheme
	10 -> UmpoRpcGetActiveScheme
	11 -> UmpoRpcSetActiveOverlayScheme
	12 -> UmpoRpcGetActualOverlayScheme
	13 -> UmpoRpcGetEffectiveOverlayScheme
	14 -> UmpoRpcGetOverlaySchemes
	15 -> UmpoRpcRestoreDefaultScheme
	16 -> UmpoRpcRestoreDefaultSchemesAll
	17 -> UmpoRpcDuplicateScheme
	18 -> UmpoRpcDeleteScheme
	19 -> UmpoRpcImportScheme
	20 -> UmpoRpcReplaceDefaultPowerSchemes
	21 -> UmpoRpcLegacyEventRegisterNotification
	22 -> UmpoRpcEnumerate
	23 -> UmpoRpcReadSecurityDescriptor
	24 -> UmpoRpcWriteSecurityDescriptor
	25 -> UmpoRpcSettingAccessCheck
	26 -> UmpoRpcCreateSetting
	27 -> UmpoRpcCreatePossibleSetting
	28 -> UmpoRpcRemoveSetting
	29 -> UmpoSetExpectedUserAwayIntervals
	30 -> UmpoClearExpectedUserAwayIntervals
	31 -> UmpoGetMinUserAwayPredictionInterval
	32 -> UmpoRpcGetAdaptiveStandbyDiagnostics
RPC  9b8699ae-0e44-47b1-8e7f-86a461d7ecdc (0.0) -- c:\windows\system32\rpcss.dll
	0 -> _LaunchActivatorServer
	1 -> _LaunchRunAsServer
	2 -> _LaunchService
	3 -> LaunchWinRTActivatorServer
	4 -> _LaunchWinRTRunAsServer
	5 -> _LaunchWinRTService
	6 -> _CertifyServerIdentity
	7 -> _QueryNTService
	8 -> _QueryNTServiceType
	9 -> ControlNTService
	10 -> PrivRunAsSetWinstaDesktop
	11 -> PrivRunAsRelease
	12 -> PrivRunAsInvalidateAndRelease
	13 -> PrivTranslateShareName
	14 -> GenericMarshalingStreamWithContextAttributesViaCallback<<lambda_9644d90489056d7e1fb2e547ff4245ea> >::Clone
	15 -> IsPortOpen
	16 -> TickleActivationSettings
	17 -> QueryProcessArchitecture
	18 -> PrivilegedNotifyWinRTActivationStoreChanged
	19 -> _QueryUserSidForSession
	20 -> PrivActivatePsmServer
	21 -> _PrivGetUserTokenForSession
	22 -> PrivGetBrokerToken
	23 -> PrivGetDesktopWinRTBrokerToken
	24 -> PrivGetPsmToken
	25 -> GetSessionUserTokenCacheDetails
	26 -> PrivilegedNotifyComClassChangesFromDeployment
	27 -> PrivGetPsmTokenWithDynamicId
	28 -> PrivGetInteractiveUserToken
	29 -> PrivReportUnhealthyProcess
RPC  4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvActivateApplication
	1 -> PsmSrvCloseActivationChannel
	2 -> PsmSrvOpenActivationChannel
	3 -> PsmSrvRegisterProcess
RPC  085b0334-e454-4d91-9b8c-4134f9e793f3 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvInitializeExtension
	1 -> PsmSrvOpenManagementChannel
	2 -> PsmSrvSetApplicationState
	3 -> PsmSrvSetApplicationPriority
	4 -> PsmSrvReleaseCacheEntry
	5 -> PsmSrvAcquireCachedEntries
	6 -> PsmSrvQueryApplicationSwapState
	7 -> PsmSrvCloseActivationChannel
	8 -> PsmSrvSetApplicationProperties
	9 -> PsmSrvQueryApplicationProperties
	10 -> PsmSrvQueryApplicationResourceUsage
	11 -> PsmSrvQueryMemoryUsage
	12 -> PsmSrvResetMaxMemoryUsage
	13 -> PsmSrvQuerySharedCommit
RPC  8782d3b9-ebbd-4644-a3d8-e8725381919b (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvRegisterQuiesceResumeApp
	1 -> PsmSrvQuiesceCallbacksComplete
	2 -> PsmSrvCloseActivationChannel
RPC  3b338d89-6cfa-44b8-847e-531531bc9992 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvQueryApplicationPerformanceInformation
	1 -> PsmSrvQueryQuotaInformation
RPC  bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvOpenTcChannel
	1 -> PsmSrvApplyTaskCompletion
	2 -> PsmSrvRegisterDynamicProcess
	3 -> PsmSrvCloseActivationChannel
	4 -> PsmSrvGetSessionInfo
RPC  5824833b-3c1a-4ad2-bdfd-c31d19e23ed2 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvRegisterAppPriorityNotification
	1 -> PsmSrvQueryApplicationResourceUsageForTimer
	2 -> PsmSrvTimerStart
	3 -> PsmSrvTimerCleanup
	4 -> PsmSrvTimerRemainingResourceTimeGet
	5 -> PsmSrvTimerElapsedResourceTimeGet
RPC  0361ae94-0316-4c6c-8ad8-c594375800e2 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvQueryCurrentApplications
	1 -> PsmSrvQueryApplicationHosts
	2 -> PsmSrvQueryApplicationHostExecutionState
	3 -> PsmSrvQueryApplicationHostJob
	4 -> PsmSrvConnect
	5 -> PsmSrvDisconnect
	6 -> PsmSrvSubscribeToNotifications
	7 -> PsmSrvUnsubscribeFromNotifications
RPC  2d98a740-581d-41b9-aa0d-a88b9d5ce938 (1.0) -- c:\windows\system32\bisrv.dll
	0 -> RBiSrvActivateDeferredWorkItem
	1 -> RBiSrvActivateInBackground
	2 -> RBiSrvActivateWorkItem
	3 -> RBiSrvAssociateActivationProxy
	4 -> RBiSrvAssociateApplicationExtensionClass
	5 -> RBiSrvCancelWorkItem
	6 -> RBiSrvCreateEvent
	7 -> RBiSrvCreateEventForPackageName
	8 -> RBiSrvDeleteEvent
	9 -> RBiSrvDisassociateWorkItem
	10 -> RBiSrvDiscardPendingActivations
	11 -> RBiSrvEnumerateBrokeredEvents
	12 -> RBiSrvEnumerateUserContexts
	13 -> RBiSrvEnumerateUserSessions
	14 -> RBiSrvEnumerateWorkItemsForPackageName
	15 -> RBiSrvQueryBrokeredEvent
	16 -> RBiSrvQuerySystemStateBroadcastChannels
	17 -> RBiSrvQueryUserContext
	18 -> RBiSrvQueryUserSession
	19 -> RBiSrvQueryWorkItem
	20 -> RBiPtSrvQueryWorkItemStatusStateName
	21 -> RBiSrvSignalEvent
	22 -> RBiSrvSignalMultipleEvents
	23 -> RBiSrvSignalTriggerEvent
	24 -> RBiSrvUpdateEventParameters
	25 -> RBiSrvUpdateEventFlags
	26 -> RBiSrvUpdateEventInformation
RPC  8bfc3be1-6def-4e2d-af74-7c47cd0ade4a (1.0) -- c:\windows\system32\bisrv.dll
	0 -> RBiSrvActivateWorkItemForUser
	1 -> RBiSrvChangeApplicationStateForPackageNameForUser
	2 -> RBiSrvChangeApplicationStateForPsmKeyForUser
	3 -> RBiSrvChangeUserState
	4 -> RBiSrvEnumerateWorkItemsForPackageNameAndUser
	5 -> RBiSrvGetActiveBackgroundTasksEventForUser
	6 -> RBiSrvGetCancellationTimeoutInMs
	7 -> RBiSrvIsApplicationTerminateSensitiveForUser
	8 -> RBiSrvNotifyEndSession
	9 -> RBiSrvNotifyNewSession
	10 -> RBiSrvNotifyNewSessionComplete
	11 -> RBiSrvNotifyNewUser
	12 -> RBiSrvQueryWorkItemForUser
	13 -> RBiSrvResetActiveUserForPackage
	14 -> RBiSrvSetActiveUserForPackage
	15 -> RBiSrvTerminateApplicationHostForUser
	16 -> RBiSrvUpdateBackgroundAccessApplicationsForUser
RPC  1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 (1.0) -- c:\windows\system32\bisrv.dll
	0 -> RBiRtSrvAddWaitableEvent
	1 -> RBiRtSrvAssociateWorkItem
	2 -> RBiRtSrvCreateEvent
	3 -> RBiRtSrvCreateEventForApp
	4 -> RBiRtSrvCreateStatusStateName
	5 -> RBiRtSrvDeleteEvent
	6 -> RBiRtSrvDisassociateWorkItem
	7 -> RBiRtSrvEnumerateBrokeredEvents
	8 -> RBiRtSrvEnumerateWorkItems
	9 -> RBiRtSrvGetWorkItemProperties
	10 -> RBiRtSrvInitiatePause
	11 -> RBiRtSrvQueryBrokerEventId
	12 -> RBiRtSrvQueryBrokerEventIdFromWorkItem
	13 -> RBiRtSrvRegisterWorkItem
	14 -> RBiRtSrvSignalEvent
	15 -> RBiRtSrvUpdateEventParameters
RPC  c605f9fb-f0a3-4e2a-a073-73560f8d9e3e (1.0) -- c:\windows\system32\bisrv.dll
	0 -> RBiSrvSignalEvent
RPC  0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e (1.0) -- c:\windows\system32\bisrv.dll
	0 -> RBiPtSrvActivateDeferredWorkItem
	1 -> RBiPtSrvActivateInBackground
	2 -> RBiPtSrvActivateWorkItem
	3 -> RBiPtSrvAssociateActivationProxy
	4 -> RBiPtSrvAssociateApplicationEntryPoint
	5 -> RBiPtSrvCancelWorkItem
	6 -> RBiPtSrvCreateEvent
	7 -> RBiPtSrvCreateEventForApp
	8 -> RBiPtSrvCreateEventForPackageName
	9 -> RBiPtSrvDeleteEvent
	10 -> RBiPtSrvDisableWorkItem
	11 -> RBiPtSrvDisassociateWorkItem
	12 -> RBiPtSrvEnableWorkItem
	13 -> RBiPtSrvEnumerateBrokeredEvents
	14 -> RBiPtSrvEnumerateWorkItemsForPackageName
	15 -> RBiPtSrvQueryBrokeredEvent
	16 -> RBiPtSrvQueryBrokerEventId
	17 -> RBiPtSrvQuerySystemStateBroadcastChannels
	18 -> RBiPtSrvQueryWorkItem
	19 -> RBiPtSrvQueryWorkItemStatusStateName
	20 -> RBiPtSrvSignalEvent
	21 -> RBiPtSrvSignalMultipleEvents
	22 -> RBiPtSrvSignalTriggerEvent
RPC  55e6b932-1979-45d6-90c5-7f6270724112 (1.0) -- C:\WINDOWS\SYSTEM32\resourcepolicyserver.dll
	0 -> Srv_GetResourcePolicyKey
	1 -> Srv_GetResourcePolicyInformation
	2 -> Srv_CreateResourcePolicy
	3 -> Srv_GetResourcePolicyName
	4 -> Srv_CreatePolicyEngineClientContext
	5 -> Srv_ClosePolicyEngineClientContext
	6 -> Srv_AcquireResources
	7 -> Srv_ResSet_Apply
	8 -> Srv_ResSet_ReleaseResources
	9 -> Srv_ResSet_SetProperty
	10 -> Srv_ResSet_GetProperty
	11 -> Srv_ResSet_SetExternalPriorities
	12 -> Srv_ResSet_NotifyPendingTransition
	13 -> Srv_ResSet_CreateTerminalResourceSet
	14 -> Srv_ResSet_UpdateImportanceAndResourceLimits
	15 -> Srv_RegisterForPackageEnergyStateChangeNotifications
	16 -> Srv_IsPackageInGoodEnergyState
	17 -> Srv_ResourcePolicy_SetProcessAffinityMask
	18 -> Srv_ResourcePolicy_RevertProcessAffinityMask
	19 -> Srv_ResourcePolicy_GetProcessGroupCount
	20 -> Srv_ResourcePolicy_GetProcessAffinityMask
	21 -> Srv_ResourcePolicy_SetGlobalProcessAffinityMask
	22 -> Srv_ResourcePolicy_GetGlobalGroupCount
	23 -> Srv_ResourcePolicy_GetGlobalProcessAffinityMask
	24 -> Srv_QueryPackageInterruptiveUIState
	25 -> Srv_QueryApplicationInterruptiveUIState
	26 -> Srv_QueryApplicationInterruptiveUIStateByPsmKey
	27 -> Srv_InterruptiveUIStateChanged_Subscribe
	28 -> Srv_InterruptiveUIStateChanged_Unsubscribe
RPC  76c217bc-c8b4-4201-a745-373ad9032b1a (1.0) -- C:\WINDOWS\SYSTEM32\resourcepolicyserver.dll
	0 -> Srv_QueryApplicationEnergyUsage
	1 -> Srv_GetDeviceSpecificConversionFactor
	2 -> Srv_ResetTotalEnergyUsage
RPC  88abcbc3-34ea-76ae-8215-767520655a23 (0.0) -- C:\WINDOWS\SYSTEM32\resourcepolicyserver.dll
	0 -> GcsSrv_GetGameConfigSize
	1 -> GcsSrv_GetGameConfig
	2 -> GcsSrv_GetGameConfigSizeForClientProcess
	3 -> GcsSrv_GetGameConfigForClientProcess
	4 -> GcsSrv_ModifyGameConfig
	5 -> GcsSrv_AddGameConfig
	6 -> GcsSrv_RemoveGameConfig
	7 -> GcsSrv_GetGameIdByAUMID
	8 -> GcsSrv_GetGameIdByPID
	9 -> GcsSrv_GetGameIdCount
	10 -> GcsSrv_GetAllGameIds
	11 -> GcsSrv_GetGameIdsByExeNameCount
	12 -> GcsSrv_GetGameIdsByExeName
	13 -> GcsSrv_GetGameProperty
	14 -> GcsSrv_GetGamePropertySize
	15 -> GcsSrv_SetGameProperty
	16 -> GcsSrv_GetGlobalProperty
	17 -> GcsSrv_GetGlobalPropertySize
	18 -> GcsSrv_SetGlobalProperty
	19 -> GcsSrv_SetGamePropertyUserOverride
	20 -> GcsSrv_GetGamePropertyIsUserOverride
RPC  2c7fd9ce-e706-4b40-b412-953107ef9bb0 (0.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> RmgrSrv_RegisterWithServer
	1 -> RmgrSrv_RmSetMemoryUsageLimit
	2 -> RmgrSrv_RmRegisterResource
	3 -> RmgrSrv_RmAccessCheck
	4 -> RmgrSrv_RmAccessCheckOnCaller
	5 -> RmgrSrv_RmAvailabilityCheck
	6 -> RmgrSrv_RmAcquireResources
	7 -> RmgrSrv_RmGetNotification
	8 -> RmgrSrv_RmReleaseResources
RPC  c521facf-09a9-42c5-b155-72388595cbf0 (0.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> RmtSrv_RM_ConnectToServer
	1 -> RmtSrv_RM_DisconnectFromServer
	2 -> RmtSrv_RM_AcquireResourceSet
	3 -> RmtSrv_RS_Apply
	4 -> RmtSrv_RS_ReleaseResources
	5 -> RmtSrv_RS_CreateTerminalResourceSet
	6 -> RmtSrv_RS_SetExternalResourcePriorities
	7 -> RmtSrv_RS_SetAutoRelease
RPC  1832bcf6-cab8-41d4-85d2-c9410764f75a (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> RmCoreRpcSrvConnectToRmServer
	1 -> RmCoreRpcSrvDisconnectFromRmServer
	2 -> RmCoreRpcSrvRegisterActivityHostCallbacks
	3 -> RmCoreRpcSrvUnregisterActivityHostCallbacks
	4 -> RmCoreRpcSrvAcquireResourceSet
	5 -> RmCoreRpcSrvApplyResourceSet
	6 -> RmCoreRpcSrvReleaseResourceSet
	7 -> RmCoreRpcSrvSetHostLimits
	8 -> RmCoreRpcSrvQueryHostMemoryLimitValues
RPC  4dace966-a243-4450-ae3f-9b7bcb5315b8 (2.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> RmGameModeSrvRegisterProcess
	1 -> RmGameModeSrvUnregisterProcess
	2 -> RmGameModeSrvDisableForRegisteredProcess
	3 -> RmGameModeSrvReenableForRegisteredProcess
	4 -> RmGameModeSrvGetLargestValidResourceRequest
	5 -> RmGameModeSrvRegisterPairedAuxiliaryProcess
RPC  e53d94ca-7464-4839-b044-09a2fb8b3ae5 (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnect
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvCreateActivity
	3 -> HamRpcSrvCreateActivityForProcess
	4 -> HamRpcSrvStartActivityAsync
	5 -> HamRpcSrvStopActivity
	6 -> HamRpcSrvUpdateActivityProperties
	7 -> HamRpcSrvTerminateActivityHost
	8 -> HamRpcSrvSetExternalResourcePriority
	9 -> HamRpcSrvResetExternalResourcePriority
	10 -> HamRpcSrvCloseActivity
	11 -> HamRpcSrvIsHostBeingDebugged
	12 -> HamRpcSrvTerminateHostOnProcessExit
	13 -> HamRpcSrvGetApplicationInterruptiveUIState
	14 -> HamRpcSrvGetPackageInterruptiveUIState
	15 -> HamRpcSrvGetInterruptiveUIStateForAumid
RPC  082a3471-31b6-422a-b931-a54401960c62 (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectExtendedExecution
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvIsHostHamManaged
	3 -> HamRpcSrvQueryTaskCompletionsForTerminateGraph
	4 -> HamRpcSrvCreateExtendedExecution
	5 -> HamRpcSrvStartExtendedExecutionAsync
	6 -> HamRpcSrvCloseActivity
	7 -> HamRpcSrvAddDependency
	8 -> HamRpcSrvRemoveDependency
	9 -> HamRpcSrvAddHostDependency
	10 -> HamRpcSrvRemoveHostDependency
	11 -> HamRpcSrvTerminateSelf
	12 -> HamRpcSrvTryEstimateRemainingQuiesceTime
RPC  4ed8abcc-f1e2-438b-981f-bb0e8abc010c (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectStateChangeNotifications
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvGetApplicationStateForPsmKey
	3 -> HamRpcSrvTerminateIfSuspendedByProcess
RPC  95406f0b-b239-4318-91bb-cea3a46ff0dc (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectServicing
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvDebugOpenPackageHandle
	3 -> HamRpcSrvDebugClosePackageHandle
	4 -> HamRpcSrvServicingQueryActiveAppsInPackage
	5 -> HamRpcSrvServicingEnableServicing
	6 -> HamRpcSrvDebugTerminatePackage
RPC  fae436b0-b864-4a87-9eda-298547cd82f2 (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectDebugging
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvDebugOpenPackageHandle
	3 -> HamRpcSrvDebugClosePackageHandle
	4 -> HamRpcSrvDebugModeEnable
	5 -> HamRpcSrvDebugTerminatePackage
	6 -> HamRpcSrvDebugQueryPackageState
	7 -> HamRpcSrvDebugSuspendPackage
RPC  178d84be-9291-4994-82c6-3f909aca5a03 (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> RmGameModeRSrvRegisterProcess
	1 -> RmGameModeRSrvUnregisterProcess
	2 -> RmGameModeRSrvDisableForRegisteredProcess
	3 -> RmGameModeRSrvReenableForRegisteredProcess
	4 -> RmGameModeRSrvRegisterPairedAuxiliaryProcess
RPC  0d47017b-b33b-46ad-9e18-fe96456c5078 (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectSessionState
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvSessionStateLogoffUser
	3 -> HamRpcSrvSessionStateLogoffSession
RPC  dd59071b-3215-4c59-8481-972edadc0f6a (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> CrmRpcSrvSubscribe
	1 -> CrmRpcSrvUnsubscribe
	2 -> CrmRpcSrvWorkStart
	3 -> CrmRpcSrvWorkStop
RPC  2513bcbe-6cd4-4348-855e-7efb3c336dd3 (1.0) -- c:\windows\system32\bisrv.dll
	0 -> SrvOdbCreateSession
	1 -> SrvOdbCompleteSession
	2 -> SrvOdbLaunchBackgroundTask
	3 -> SrvOdbCancelBackgroundTask
	4 -> SrvOdbCancelBackgroundTasksForPackage
RPC  20c40295-8dba-48e6-aebf-3e78ef3bb144 (1.0) -- c:\windows\system32\bisrv.dll
	0 -> SrvOdbPtCreateSession
	1 -> SrvOdbPtCompleteSession
	2 -> SrvOdbPtLaunchBackgroundTask
	3 -> SrvOdbPtCancelBackgroundTask
	4 -> SrvOdbPtCancelBackgroundTasksForPackage
RPC  b8cadbaf-e84b-46b9-84f2-6f71c03f9e55 (1.0) -- c:\windows\system32\bisrv.dll
	0 -> SrvOdbLbPublishLegacyExitCode
RPC  857fb1be-084f-4fb5-b59c-4b2c4be5f0cf (1.0) -- c:\windows\system32\bisrv.dll
	0 -> SrvOdbPrivGetLaunchInfo
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
RPC  d09bdeb5-6171-4a34-bfe2-06fa82652568 (1.0) -- c:\windows\system32\BrokerLib.dll
	0 -> _BriCreateEvent
	1 -> _BriDeleteEvent
	2 -> BriDisableEvent
	3 -> BriEnableEvent
	4 -> BriSignalEvent
RPC  9b008953-f195-4bf9-bde0-4471971e58ed (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> SebiEnumerateEvents
	1 -> _SebiEnumerateEventsByType
	2 -> SebiQueryEventData
	3 -> SebiQueryEventPackage
	4 -> SebiSignalSyncEventEx
	5 -> SebiGetUserPresenceHistory
RPC  697dcda9-3ba9-4eb2-9247-e11f1901b0d2 (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> CSebiCreateWellKnownEvent
	1 -> _CSebiCreatePrivateEvent
	2 -> _CSebiDeleteEvent
	3 -> CSebiEnumerateEvents
	4 -> CSebiQueryEventData
	5 -> CSebiCreateCustomEvent
RPC  1377d115-98fd-4034-b574-111156ca239c (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> _CSebiRegisterPublisher
	1 -> CSebiPublisherUpdateLevelEvent
	2 -> CSebiUnregisterPublisher
RPC  7419cf08-91a7-4afd-8f5e-1dd76de094fd (1.0) -- c:\windows\system32\DAB.dll
	0 -> s_DabRpcRegisterTriggerConsumer
	1 -> s_DabRpcUnregisterTriggerConsumer
	2 -> s_DabRpcGetLastScheduledRunTime
RPC  fc48cd89-98d6-4628-9839-86f7a3e4161a (1.0) -- C:\Windows\System32\ACPBackgroundManagerPolicy.dll
	0 -> MVoipSrvNotifyVoipActiveCall
	1 -> MVoipSrvNotifyVoipActivityCompleted
	2 -> MVoipSrvHoldActiveCall
	3 -> MVoipSrvUnholdActiveCall
	4 -> MVoipSrvNotifyIncomingCallDialogDisplayed
	5 -> MVoipSrvNotifyIncomingCallDialogDismissed
	6 -> MVoipSrvLaunchVoipRtcTask
	7 -> MVoipSrvCancelVoipRtcTask
OLE  7656cfa4-b63a-4542-a8de-ef402bac895d (0.0) -- IUserApplicationStateChangeHandler
OLE  43c6b434-c1be-4ad2-af03-c0deaccebd1f (0.0) -- IBackgroundAccessStateChangeHandler
OLE  eb9d0454-25db-5620-98b8-be4c5d0dbc67 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserChangedEventArgs]
OLE  0166231b-fd21-4e33-a713-75eb3207a138 (0.0) -- IBackgroundWorkItemInstanceRemote
OLE  839d7762-5121-4009-9234-4f0d19394f04 (0.0) -- ITaskHandler
Endpoints :
ncalrpc         : umpo
ncalrpc         : actkernel
ncalrpc         : LRPC-a0c225312c664cbe52
ncalrpc         : LRPC-9117321b1f3e68b3ea
ncalrpc         : LRPC-c415227320dbc2b224
ncalrpc         : OLE725BEDE187C9611C6F16D2B71ED3
ncalrpc         : LRPC-ad9f8eadd07cbdf162
ncalrpc         : LRPC-77924dd5092f1575c4
ncalrpc         : LRPC-c3073d1124937de4cc
ncalrpc         : csebpub
ncalrpc         : dabrpc
--------------------------------------------------------------------------------
<WinProcess "WUDFHost.exe" pid 744 at 0x5e18828L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1120 at 0x5e18438L>
64
['RpcEptMapper', 'RpcSs']

Interfaces :
RPC  e1af8308-5d1f-11c9-91a4-08002b14a0fa (3.0) -- c:\windows\system32\rpcepmap.dll
	0 -> ept_delete
	1 -> ept_delete
	2 -> ept_lookup
	3 -> ept_map
	4 -> ept_lookup_handle_free
	5 -> ept_delete
	6 -> ept_delete
	7 -> ept_map_auth
	8 -> ept_map_auth_async
RPC  0b0a6584-9e0f-11cf-a3cf-00805f68cb1b (1.1) -- c:\windows\system32\rpcepmap.dll
	0 -> OpenEndpointMapper
	1 -> AllocateReservedIPPort
	2 -> ept_insert_ex
	3 -> ept_delete_ex
	4 -> SetRestrictRemoteClients
	5 -> ResetWithNoAuthException
RPC  1d55b526-c137-46c5-ab79-638f2a68e869 (1.0) -- c:\windows\system32\rpcepmap.dll
	0 -> RemoteGetCellByDebugCellID
	1 -> RemoteOpenRPCDebugCallInfoEnumeration
	2 -> RemoteGetNextRPCDebugCallInfo
	3 -> RemoteFinishRPCDebugCallInfoEnumeration
	4 -> RemoteOpenRPCDebugEndpointInfoEnumeration
	5 -> RemoteGetNextRPCDebugEndpointInfo
	6 -> RemoteFinishRPCDebugEndpointInfoEnumeration
	7 -> RemoteOpenRPCDebugThreadInfoEnumeration
	8 -> RemoteGetNextRPCDebugThreadInfo
	9 -> RemoteFinishRPCDebugThreadInfoEnumeration
	10 -> RemoteOpenRPCDebugClientCallInfoEnumeration
	11 -> RemoteGetNextRPCDebugClientCallInfo
	12 -> RemoteFinishRPCDebugClientCallInfoEnumeration
RPC  64fe0b7f-9ef5-4553-a7db-9a1975777554 (1.0) -- c:\windows\system32\RpcRtRemote.dll
	0 -> FwConnectToManager
	1 -> FwSubscribeForNewRulesNotification
	2 -> FwInterfaceRegistered
RPC  e60c73e6-88f9-11cf-9af1-0020af6e72f4 (2.0) -- c:\windows\system32\rpcss.dll
	0 -> _Connect
	1 -> _SetAppID
	2 -> GetDefaultSecurityPermissions
	3 -> _AllocateReservedIds
	4 -> BulkUpdateOIDs
	5 -> _ClientResolveOXID
	6 -> _ServerAllocateOXIDAndOIDs
	7 -> _ServerAllocateOIDs
	8 -> ServerFreeOXIDAndOIDs
	9 -> _SetServerOIDFlags
	10 -> _Disconnect
RPC  99fcfec4-5260-101b-bbcb-00aa0021347a (0.0) -- c:\windows\system32\rpcss.dll
	0 -> ResolveOxid
	1 -> SimplePing
	2 -> ComplexPing
	3 -> ServerAlive
	4 -> ResolveOxid2
	5 -> ServerAlive2
RPC  b9e79e60-3d52-11ce-aaa1-00006901293f (0.2) -- c:\windows\system32\rpcss.dll
	0 -> IrotRegister
	1 -> IrotRevoke
	2 -> IrotIsRunning
	3 -> IrotGetObject
	4 -> IrotNoteChangeTime
	5 -> IrotGetTimeOfLastChange
	6 -> IrotEnumRunning
	7 -> IMgotRegister
	8 -> IMgotRevoke
	9 -> IMgotGetObject
	10 -> IMgotEnumRunning
RPC  412f241e-c12a-11ce-abff-0020af6e7a17 (0.2) -- c:\windows\system32\rpcss.dll
	0 -> ServerRegisterClsid
	1 -> ServerRevokeClsid
	2 -> ServerRegisterActivatableClasses
	3 -> ServerRevokeActivatableClasses
	4 -> GetThreadID
	5 -> UpdateActivationSettings
	6 -> RegisterWindowPropInterface
	7 -> GetWindowPropInterface
	8 -> EnableDisableDynamicIPTracking
	9 -> GetCurrentAddrExclusionList
	10 -> SetAddrExclusionList
	11 -> FlushSCMBindings
	12 -> RetireServer
	13 -> NotifyDDStartOrStop
	14 -> QueryDragDropActive
	15 -> SetOrRevokeForcedDropTarget
	16 -> IsObjectCreationAllowed
	17 -> ControlTracingForProcess
	18 -> QueryPIDForActivation
	19 -> NotifyWinRTActivationStoreChanged
	20 -> DecodeProxy
	21 -> NotifyPsmResume
	22 -> QueryServerProcessHandleHeld
	23 -> RegisterRacActivationToken
	24 -> RevokeRacActivationToken
	25 -> RegisterConsoleHandles
	26 -> RevokeConsoleHandles
	27 -> NotifyComClassChangesFromDeployment
DCOM 00000136-0000-0000-c000-000000000046 (0.0) -- ISCMLocalActivator
RPC  c6f3ee72-ce7e-11d1-b71e-00c04fc3111a (1.0) -- c:\windows\system32\rpcss.dll
	0 -> ProcessActivatorStarted
	1 -> ProcessActivatorInitializing
	2 -> ProcessActivatorReady
	3 -> ProcessActivatorStopped
	4 -> ProcessActivatorPaused
	5 -> ProcessActivatorResumed
	6 -> ProcessActivatorUserInitializing
RPC  4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 (0.0) -- c:\windows\system32\rpcss.dll
	0 -> RemoteActivation
DCOM 000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
Endpoints :
ncalrpc         : epmapper
ncacn_ip_tcp    : 135
ncacn_np        : \pipe\epmapper
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1164 at 0x5e18748L>
64
['LSM']

Interfaces :
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
RPC  11f25515-c879-400a-989e-b074d5f092fe (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcGetUserToken
	1 -> RpcConnectTerminal
	2 -> RpcSystemShutdownStarted
	3 -> RpcGetRequestForWinlogon
	4 -> RpcReportWinlogonReply
	5 -> RpcGetReconnectId
	6 -> RpcCreateWorkerSession
	7 -> RpcGetWorkerSessionGpuLuid
RPC  1e665584-40fe-4450-8f6e-802362399694 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcBroadcastSystemMessage
	1 -> RpcSendWindowMessage
	2 -> RpcCreateSession
	3 -> RpcTerminateSession
RPC  484809d6-4239-471b-b5bc-61df8c23ac48 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcOpenSession
	1 -> RpcCloseSession
	2 -> RpcConnect
	3 -> RpcDisconnect
	4 -> RpcLogoff
	5 -> RpcGetUserName
	6 -> RpcGetTerminalName
	7 -> RpcGetState
	8 -> RpcIsSessionDesktopLocked
	9 -> RpcShowMessageBox
	10 -> RpcGetTimes
	11 -> RpcGetSessionCounters
	12 -> RpcGetSessionInformation
	13 -> RpcSwitchToServicesSession
	14 -> RpcRevertFromServicesSession
	15 -> RpcGetLoggedOnCount
	16 -> RpcGetSessionType
	17 -> RpcGetSessionInformationEx
	18 -> RpcIsTerminalRemote
	19 -> RpcConnectAndLockTargetDesktop
RPC  e3907f22-c899-44e7-9d11-9d8b3d924832 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcEnableChildSessions
	1 -> RpcIsChildSessionsEnabled
	2 -> RpcGetChildSessionId
	3 -> RpcGetParentSessionId
	4 -> RpcGetAllUserSessions
RPC  53825514-1183-4934-a0f4-cfdc51c3389b (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcIsCurrentSessionTerminalRemote
	1 -> RpcGetCurrentSessionTerminalName
	2 -> RpcGetCurrentSessionInformation
	3 -> RpcGetCurrentSessionCapabilities
	4 -> RpcGetCurrentSessionType
RPC  11899a43-2b68-4a76-92e3-a3d6ad8c26ce (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcWaitForSessionState
	1 -> RpcRegisterAsyncNotification
	2 -> RpcWaitAsyncNotification
	3 -> RpcUnRegisterAsyncNotification
RPC  c2d15ccf-a416-46dc-ba58-4624ac7a9123 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcRegisterCurrentSessionAsyncNotification
	1 -> RpcWaitAsyncNotificationEx
	2 -> RpcUnRegisterAsyncNotificationEx
RPC  88143fd0-c28d-4b2b-8fef-8d882f6a9390 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcOpenEnum
	1 -> RpcCloseEnum
	2 -> RpcFilterByState
	3 -> RpcFilterByCallersName
	4 -> RpcEnumAddFilter
	5 -> RpcGetEnumResult
	6 -> RpcFilterBySessionType
	7 -> RpcFilterByLicenseType
	8 -> RpcGetSessionIds
	9 -> RpcGetEnumResultEx
	10 -> RpcGetAllSessions
	11 -> RpcGetAllSessionsEx
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  517f87fe-597a-4672-8555-6daf1c8c788d (0.0) -- ISessionManager
OLE  75a446c5-40b7-41d3-8d53-292652c04121 (0.0) -- ITSEventDispatcher
OLE  959c5a99-177c-478e-8c3b-77e07e9bf3aa (0.0) -- ISessionList
OLE  a8105b4f-7d5a-402b-aac0-fd85daecf94c (0.0) -- ISessionEnum
OLE  a1b7de7a-4e77-43db-ae78-96fc182fed4a (0.0) -- ITSSession
OLE  1a8a5d71-d95b-4dcd-915e-f9f6d31879ad (0.0) -- ITerminal
OLE  6344a5b7-ef1c-47ba-98b7-28c664427793 (0.0) -- IGlassTerminal
OLE  c2d3e131-c587-49b4-8bae-f0ee269eeb31 (0.0) -- ITSSessionAttribute
OLE  35481b58-f46c-4254-b52c-fdc3001484c3 (0.0) -- IRestrictedCalls
OLE  4d10b48b-c531-4731-9bde-b03c28e9c61c (0.0) -- IUserName
Endpoints :
ncalrpc         : LRPC-56fe77ce659d43da99
ncalrpc         : LSMApi
ncacn_np        : \pipe\LSM_API_service
ncalrpc         : OLE72598D8A0D6838E6A3EBF8662F4B
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1396 at 0x5e18908L>
64
['TermService']

Interfaces :
RPC  ae55c4c0-64ce-11dd-ad8b-0800200c9a66 (1.0) -- c:\windows\system32\bdesvc.dll
	0 -> BdeSvcApipAddRecoveryPassword
	1 -> BdeSvcApipConversionEncrypt
	2 -> BdeSvcApipEventTrigger
	3 -> BdeSvcApipChangeProtector
	4 -> BdeSvcApipConversionEncryptEx
	5 -> BdeSvcApipCheckADSchema
	6 -> BdeSvcApipQueryCachedEASProtectionStatus
	7 -> BdeSvcApipDoTurnOnDeviceEncryption
	8 -> BdeSvcApipEnableSilentDeviceEncryption
	9 -> BdeSvcApipEnableSilentBitLocker
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-33b5f6eebf56b84252
ncalrpc         : OLEE2E87CED3CCC1206BBA6ED3A58AB
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1508 at 0x5e181d0L>
64
['NcbService']

Interfaces :
RPC  d09bdeb5-6171-4a34-bfe2-06fa82652568 (1.0) -- c:\windows\system32\BrokerLib.dll
	0 -> _BriCreateEvent
	1 -> _BriDeleteEvent
	2 -> BriDisableEvent
	3 -> BriEnableEvent
	4 -> BriSignalEvent
RPC  5222821f-d5e2-4885-84f1-5f6185a0ec41 (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> RpcSrvRegisterControlChannelReset
	1 -> RpcSrvUnregisterControlChannelReset
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
RPC  880fd55e-43b9-11e0-b1a8-cf4edfd72085 (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> KapiRegisterProvider
	1 -> KapiDeregisterProvider
	2 -> KapiUpdateKaSample
	3 -> KapiReceiveKaUpdateRequest
RPC  e40f7b57-7a25-4cd3-a135-7f7d3df9d16b (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> RpcSrvCreateSession
	1 -> RpcSrvDestroySession
	2 -> RpcSrvStartBrokeredActivation
	3 -> RpcSrvSetServerKeepAliveInterval
	4 -> RpcSrvGetCurrentKeepAliveInterval
	5 -> RpcSrvDecreaseKeepAliveInterval
	6 -> RpcSrvUsingTransport
	7 -> RpcSrvIndicateSlotAllocation
	8 -> RpcSrvSBCreatePushEnabledContext
	9 -> RpcSrvSBTransferOwnership
	10 -> RpcSrvSBRetrieveSocket
	11 -> RpcSrvSBCompleteRetrieveSocket
	12 -> RpcSrvSBRetrieveContext
	13 -> RpcSrvSBEnumSockets
	14 -> RpcSrvCreateRadioDevice
	15 -> RpcSrvDeleteRadioDevice
	16 -> RpcSrvHotspotRegisterHotspotApp
	17 -> RpcSrvHotspotFindEventForPackage
	18 -> RpcSrvHotspotTriggerBackgroundEvent
	19 -> RpcSrvHotspotIsAppInstalled
	20 -> RpcSrvFirewallWcmSetFirewallRule
	21 -> RpcSrvFirewallWcmSetFirewallRuleFlags
	22 -> RpcSrvFirewallWcmDeleteFirewallRule
Endpoints :
ncalrpc         : LRPC-313331d19214b6495c
ncalrpc         : LRPC-fb5f696445160b36fd
ncalrpc         : OLE9764AD9A03F54AA6A31D01B9E095
ncalrpc         : LRPC-613198ad3a2d3b1d80
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1516 at 0x5e188d0L>
64
['TimeBrokerSvc']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1636 at 0x5e18cc0L>
64
['HvHost']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1716 at 0x5e18e10L>
64
['EventLog']

Interfaces :
RPC  82273fdc-e32a-18c3-3f78-827929dc23ea (0.0) -- c:\windows\system32\wevtsvc.dll
	0 -> ElfrClearELFW
	1 -> ElfrBackupELFW
	2 -> ElfrCloseEL
	3 -> ElfrDeregisterEventSource
	4 -> ElfrNumberOfRecords
	5 -> ElfrOldestRecord
	6 -> ElfrChangeNotify
	7 -> ElfrOpenELW
	8 -> ElfrRegisterEventSourceW
	9 -> ElfrOpenBELW
	10 -> ElfrReadELW
	11 -> ElfrReportEventW
	12 -> ElfrClearELFA
	13 -> ElfrBackupELFA
	14 -> ElfrOpenELA
	15 -> ElfrRegisterEventSourceA
	16 -> ElfrOpenBELA
	17 -> ElfrReadELA
	18 -> ElfrReportEventA
	19 -> ElfrRegisterClusterSvc
	20 -> ElfrDeregisterClusterSvc
	21 -> ElfrWriteClusterEvents
	22 -> ElfrGetLogInformation
	23 -> ElfrFlushEL
	24 -> ElfrReportEventAndSourceW
	25 -> ElfrReportEventExW
	26 -> ElfrReportEventExA
RPC  f6beaff7-1e19-4fbb-9f8f-b89e2018337c (1.0) -- c:\windows\system32\wevtsvc.dll
	0 -> _EvtRpcRegisterRemoteSubscription
	1 -> _EvtRpcRemoteSubscriptionNextAsync
	2 -> _EvtRpcRemoteSubscriptionNext
	3 -> EvtRpcRemoteSubscriptionWaitAsync
	4 -> EvtRpcRegisterControllableOperation
	5 -> _EvtRpcRegisterLogQuery
	6 -> EvtRpcClearLog
	7 -> EvtRpcExportLog
	8 -> EvtRpcLocalizeExportLog
	9 -> _EvtRpcMessageRender
	10 -> EvtRpcMessageRenderDefault
	11 -> _EvtRpcQueryNext
	12 -> _EvtRpcQuerySeek
	13 -> EvtRpcClose
	14 -> EvtRpcCancel
	15 -> _EvtRpcAssertConfig
	16 -> _EvtRpcRetractConfig
	17 -> _EvtRpcOpenLogHandle
	18 -> _EvtRpcGetLogFileInfo
	19 -> _EvtRpcGetChannelList
	20 -> _EvtRpcGetChannelConfig
	21 -> EvtRpcPutChannelConfig
	22 -> _EvtRpcGetPublisherList
	23 -> EvtRpcGetPublisherListForChannel
	24 -> _EvtRpcGetPublisherMetadata
	25 -> _EvtRpcGetPublisherResourceMetadata
	26 -> EvtRpcGetEventMetadataEnum
	27 -> EvtRpcGetNextEventMetadata
	28 -> _EvtRpcGetClassicLogDisplayName
Endpoints :
ncalrpc         : eventlog
ncacn_np        : \pipe\eventlog
ncacn_ip_tcp    : 1537
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1944 at 0x5e184e0L>
64
['nsi']

Interfaces :
RPC  7ea70bcf-48af-4f6a-8968-6a440754d5fa (1.0) -- c:\windows\system32\nsisvc.dll
	0 -> RpcNsiGetParameter
	1 -> RpcNsiGetAllParameters
	2 -> RpcNsiEnumerateObjectsAllParameters
	3 -> RpcNsiSetParameter
	4 -> RpcNsiSetAllParameters
	5 -> RpcNsiRegisterChangeNotification
	6 -> RpcNsiDeregisterChangeNotification
	7 -> RpcNsiRequestChangeNotification
	8 -> RpcNsiParameterChange
Endpoints :
ncalrpc         : LRPC-a9e30291416fef1f94
--------------------------------------------------------------------------------
<WinProcess "NVDisplay.Container.exe" pid 1964 at 0x5e184a8L>
64
['NVDisplay.ContainerLocalSystem']

Interfaces :
RPC  3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 (1.0) -- c:\windows\system32\dhcpcore6.dll
	0 -> RpcSrvRequestPrefixEx
	1 -> RpcSrvRenewPrefixEx
	2 -> RpcSrvReleasePrefixEx
	3 -> RpcSrvCancelOperation
	4 -> RpcSrvEnablev6Tracing
	5 -> RpcSrvRequestParams
	6 -> RpcSrvAcquireParametersv6
	7 -> RpcSrvReleaseParametersv6
	8 -> RpcSrvQueryLeaseInfov6
	9 -> RpcSrvGetTraceArray
	10 -> RpcSrvSetUserClass
	11 -> RpcSrvQueryLeaseInfov6Array
	12 -> RpcSrvEnableDhcpv6
RPC  3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 (1.0) -- c:\windows\system32\dhcpcore.dll
	0 -> RpcSrvEnableDhcp
	1 -> RpcSrvRenewLease
	2 -> RpcSrvDeleteStaticAddressAndDefaultGateways
	3 -> RpcSrvCheckServerAvailability
	4 -> RpcSrvRenewLeaseByBroadcast
	5 -> RpcSrvReleaseLease
	6 -> RpcSrvSetFallbackParams
	7 -> RpcSrvGetFallbackParams
	8 -> RpcSrvFallbackRefreshParams
	9 -> RpcSrvStaticRefreshParams
	10 -> RpcSrvRemoveDnsRegistrations
	11 -> RpcSrvRequestParams
	12 -> RpcSrvPersistentRequestParams
	13 -> RpcSrvRegisterParams
	14 -> RpcSrvDeRegisterParams
	15 -> RpcSrvEnumInterfaces
	16 -> RpcSrvQueryLeaseInfo
	17 -> RpcSrvQueryLeaseInfoArray
	18 -> RpcSrvSetClassId
	19 -> RpcSrvGetClassId
	20 -> RpcSrvSetClientId
	21 -> RpcSrvGetClientId
	22 -> RpcSrvNotifyMediaReconnected
	23 -> RpcSrvGetOriginalSubnetMask
	24 -> RpcSrvSetMSFTVendorSpecificOptions
	25 -> RpcSrvRequestCachedParams
	26 -> RpcSrvRegisterConnectionStateNotification
	27 -> RpcSrvDeRegisterConnectionStateNotification
	28 -> RpcSrvGetNotificationStatus
	29 -> RpcSrvGetDhcpServicedConnections
	30 -> RpcSrvGetTraceArray
	31 -> RpcSrvEnableTracing
	32 -> RpcSrvLeaseIpAddressEx
	33 -> RpcSrvRenewIpAddressLeaseEx
	34 -> RpcSrvReleaseIpAddressLeaseEx
	35 -> RpcSrvMadcapApiStartup
	36 -> RpcSrvMadcapApiCleanup
	37 -> RpcSrvMadcapEnumerateScopes
	38 -> RpcSrvMadcapGenUID
	39 -> RpcSrvMadcapRequestAddress
	40 -> RpcSrvMadcapRenewAddress
	41 -> RpcSrvMadcapReleaseAddress
Endpoints :
ncalrpc         : dhcpcsvc6
ncalrpc         : dhcpcsvc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 768 at 0x5e18048L>
64
['UmRdpService']

Interfaces :
RPC  326731e3-c1c0-4a69-ae20-7d9044a4ea5c (1.0) -- c:\windows\system32\profsvc.dll
	0 -> DropClientContext
	1 -> ReleaseClientContext
	2 -> LoadUserProfileServer
	3 -> UnloadUserProfileServer
	4 -> DeleteProfileServer
	5 -> RemapProfileServer
	6 -> CreateProfileServer
	7 -> ProcessWmiSettingsServer
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
Endpoints :
ncalrpc         : IUserProfile2
ncalrpc         : OLE6F8BDD12948DEBD71B04215252FE
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1840 at 0x5e18898L>
64
['SysMain']

Interfaces :
RPC  b58aa02e-2884-4e97-8176-4ee06d794184 (1.0) -- c:\windows\system32\sysmain.dll
	0 -> PfRpcServerExecuteCommand
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-0e6f1aa3c02f3f32a5
ncalrpc         : OLE723934C840209383EF7E4D981BAC
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2064 at 0x5e18b00L>
64
['Themes']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2076 at 0x5e18c88L>
64
['EventSystem']

Interfaces :
RPC  aa411582-9bdf-48fb-b42b-faa1eee33949 (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> PMuxRpcPluginRegister
	1 -> PMuxRpcPluginUnregister
	2 -> PMuxRpcPluginDataIndicate
RPC  c33b9f46-2088-4dbc-97e3-6125f127661c (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> AppSrv_NlaOpenQuery
	1 -> AppSrv_NlaAsyncIndicate
	2 -> AppSrv_NlaRefreshQuery
	3 -> AppSrv_NlaCloseQuery
	4 -> RpcNlaIndicateReprobe
RPC  4c8d0bef-d7f1-49f0-9102-caa05f58d114 (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> RPCQueryLANIds
Endpoints :
ncalrpc         : nlaplg
ncalrpc         : nlaapi
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2248 at 0x5e18e80L>
64
['CertPropSvc']

Interfaces :
RPC  30b044a5-a225-43f0-b3a4-e060df91f9c1 (1.0) -- c:\windows\system32\certprop.dll
	0 -> s_RPC_SmartCardRootCertsNotifyService
	1 -> s_RPC_SmartCardCertsNotifyService
Endpoints :
ncalrpc         : LRPC-efec9fc562caac861f
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2320 at 0x5e187f0L>
64
['Schedule']

Interfaces :
RPC  0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> ItSrvRegisterIdleTask
	1 -> ItSrvUnregisterIdleTask
	2 -> ItSrvProcessIdleTasks
	3 -> ItSrvSetDetectionParameters
	4 -> ItSrvSetRuntimeOverrides
RPC  1ff70682-0a51-30e8-076d-740be8cee98b (1.0) -- C:\WINDOWS\system32\taskcomp.dll
	0 -> NetrJobAdd
	1 -> NetrJobDel
	2 -> NetrJobEnum
	3 -> NetrJobGetInfo
RPC  378e52b0-c0a9-11cf-822d-00aa0051e40f (1.0) -- C:\WINDOWS\system32\taskcomp.dll
	0 -> SASetAccountInformation
	1 -> SASetNSAccountInformation
	2 -> SAGetNSAccountInformation
	3 -> SAGetAccountInformation
RPC  2a82bb21-e44f-4791-9aa1-dfae788e2f43 (1.0) -- c:\windows\system32\UBPM.dll
	0 -> s_UbpmRpcOpenTaskHostChannel
	1 -> s_UbpmRpcCloseTaskHostChannel
	2 -> s_UbpmRpcTaskHostSendResponseReceiveCommand
	3 -> s_UbpmRpcTaskHostReportTaskStatus
RPC  33d84484-3626-47ee-8c6f-e7e98b113be1 (2.0) -- C:\WINDOWS\SYSTEM32\WPTaskScheduler.dll
	0 -> s_TaskSchedulerCreateSchedule
	1 -> s_TaskSchedulerDeleteSchedule
	2 -> s_TaskSchedulerFindFirstSchedule
	3 -> s_TaskSchedulerFindNextSchedule
	4 -> s_TaskSchedulerFindScheduleClose
	5 -> s_TaskSchedulerGetSchedule
	6 -> s_TaskSchedulerEnableSchedule
	7 -> s_TaskSchedulerExecuteSchedule
	8 -> s_TaskSchedulerAdvanceSchedule
	9 -> s_TaskSchedulerAdvanceScheduleIntervals
	10 -> s_TaskSchedulerSnoozeSchedule
	11 -> s_TaskSchedulerGetPublishStateName
	12 -> s_TaskSchedulerServiceControl
RPC  86d35949-83c9-4044-b424-db363231fd0c (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> SchRpcHighestVersion
	1 -> SchRpcRegisterTask
	2 -> SchRpcRetrieveTask
	3 -> SchRpcCreateFolder
	4 -> SchRpcSetSecurity
	5 -> SchRpcGetSecurity
	6 -> SchRpcEnumFolders
	7 -> SchRpcEnumTasks
	8 -> SchRpcEnumInstances
	9 -> SchRpcGetInstanceInfo
	10 -> SchRpcStopInstance
	11 -> SchRpcStop
	12 -> SchRpcRun
	13 -> SchRpcDelete
	14 -> SchRpcRename
	15 -> SchRpcScheduledRuntimes
	16 -> SchRpcGetLastRunInfo
	17 -> SchRpcGetTaskInfo
	18 -> SchRpcGetNumberOfMissedRuns
	19 -> SchRpcEnableTask
RPC  3a9ef155-691d-4449-8d05-09ad57031823 (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> I_pSchRpcRegisterTask
	1 -> I_pSchRpcEnumTasks
	2 -> I_pSchRpcGetTaskInfo
	3 -> I_pSchRpcAquireTaskStateNotificationsName
	4 -> I_pAcquireBackgroundExecutionMode
	5 -> I_pReleaseBackgroundExecutionMode
	6 -> I_pSetTaskDisabledForCurrentUser
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-51c51864fe6e0c48ac
ncacn_np        : \PIPE\atsvc
ncalrpc         : ubpmtaskhostchannel
ncalrpc         : LRPC-c2989cc83b76aaef0e
ncacn_ip_tcp    : 1538
ncalrpc         : OLEFCCE0CD6FC139AAA2578089FB67F
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2464 at 0x5e18550L>
64
['SENS']

Interfaces :
RPC  63fbe424-2029-11d1-8db8-00aa004abd5e (1.0) -- c:\windows\system32\sens.dll
	0 -> RPC_IsNetworkAlive
	1 -> RPC_IsDestinationReachableA
	2 -> RPC_IsDestinationReachableA
RPC  a0bc4698-b8d7-4330-a28f-7709e18b6108 (4.0) -- c:\windows\system32\sens.dll
	0 -> RPC_SensNotifyWinlogonEvent
	1 -> RPC_SensNotifyRasEvent
	2 -> RPC_SensNotifyNetconEvent
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  97312c82-d4c2-11d1-b682-00805fc79216 (0.0) -- ICollectionNotify
Endpoints :
ncalrpc         : senssvc
ncalrpc         : LRPC-acd8265eed74c34dcd
ncalrpc         : OLEC47EA283FE69A099E22AC7CA613A
--------------------------------------------------------------------------------
<WinProcess "Memory Compression" pid 2480 at 0x5e18a20L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "igfxCUIService.exe" pid 2600 at 0x5e189e8L>
64
['igfxCUIService2.0.0.0']

Interfaces :
RPC  f2c9b409-c1c9-4100-8639-d8ab1486694a (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> ClusterConnectUpcall
	1 -> ClusterDisConnectUpcall
RPC  eb081a0d-10ee-478a-a1dd-50995283e7a8 (3.0) -- c:\windows\system32\wkssvc.dll
	0 -> GetWitnessNodes
RPC  6bffd098-a112-3610-9833-46c3f87e345a (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> NetrWkstaGetInfo
	1 -> NetrWkstaSetInfo
	2 -> NetrWkstaUserEnum
	3 -> NetrWkstaUserGetInfo
	4 -> NetrWkstaUserSetInfo
	5 -> NetrWkstaTransportEnum
	6 -> NetrWkstaTransportAdd
	7 -> NetrWkstaTransportDel
	8 -> NetrUseAdd
	9 -> NetrUseGetInfo
	10 -> NetrUseDel
	11 -> NetrUseEnum
	12 -> I_NetrLogonDomainNameAdd
	13 -> NetrWorkstationStatisticsGet
	14 -> I_NetrLogonDomainNameAdd
	15 -> I_NetrLogonDomainNameAdd
	16 -> I_NetrLogonDomainNameAdd
	17 -> I_NetrLogonDomainNameAdd
	18 -> I_NetrLogonDomainNameAdd
	19 -> I_NetrLogonDomainNameAdd
	20 -> NetrGetJoinInformation
	21 -> I_NetrLogonDomainNameAdd
	22 -> NetrJoinDomain2
	23 -> NetrUnjoinDomain2
	24 -> NetrRenameMachineInDomain2
	25 -> NetrValidateName2
	26 -> NetrGetJoinableOUs2
	27 -> NetrAddAlternateComputerName
	28 -> NetrRemoveAlternateComputerName
	29 -> NetrSetPrimaryComputerName
	30 -> NetrEnumerateComputerNames
RPC  7f1343fe-50a9-4927-a778-0c5859517bac (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> DfsDsGetDcName
	1 -> DfsDsIsDomainController
	2 -> DfsCredWrite
	3 -> DfsCredDelete
Endpoints :
ncalrpc         : LRPC-ae939f8a0790b55959
ncacn_np        : \PIPE\wkssvc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2708 at 0x5e18278L>
64
['UserManager']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2912 at 0x5e182b0L>
64
['FontCache']

Interfaces :
RPC  45776b01-5956-4485-9f80-f428f7d60129 (2.0) -- c:\windows\system32\dnsrslvr.dll
	0 -> CRrReadCache
	1 -> R_ResolverGetConfig
	2 -> R_ResolverFlushCache
	3 -> R_ResolverFlushCacheEntry
	4 -> R_ResolverQuery
	5 -> R_DnsRegisterLocal
	6 -> R_DnsDeRegisterLocal
	7 -> R_DnsStartMulticastQuery
	8 -> R_DnsGetMulticastData
	9 -> R_DnsStopMulticastQuery
	10 -> R_ResolverSimpleOp
	11 -> R_DnsGetProxyInformation
	12 -> R_DnsGetPolicyTableInfo
	13 -> R_DnsSetConnectionPolicyInfo
	14 -> R_DnsDeleteConnectionPolicyInfo
Endpoints :
ncalrpc         : DNSResolver
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3096 at 0x5e180b8L>
64
['Audiosrv']

Interfaces :
RPC  c27f3c08-92ba-478c-b446-b419c4cef0e2 (1.0) -- c:\windows\system32\dusmsvc.dll
	0 -> DusmRpcEnumConnectionList
	1 -> DusmRpcEnumProfileList
	2 -> DusmRpcQueryConnectionProperties
	3 -> DusmRpcQueryCost
	4 -> DusmRpcQueryUserCost
	5 -> DusmRpcQueryOperatorCost
	6 -> DusmRpcSetUserCost
	7 -> DusmRpcSetOperatorCost
	8 -> DusmRpcQueryDataPlan
	9 -> DusmRpcQueryUserDataPlan
	10 -> DusmRpcQueryOperatorDataPlan
	11 -> DusmRpcSetUserDataPlan
	12 -> DusmRpcSetOperatorDataPlan
	13 -> DusmRpcQuerySource
	14 -> DusmRpcSetSource
	15 -> DusmRpcQueryBackgroundRestriction
	16 -> DusmRpcSetBackgroundRestriction
	17 -> DusmRpcQueryGlobalDpuState
	18 -> DusmRpcGetAttributedNetworkUsage
	19 -> DusmRpcGetConnectionListNetworkUsage
	20 -> DusmRpcGetNetworkUsage
	21 -> DusmRpcGetProviderNetworkUsage
	22 -> DusmRpcSetAttributionMapping
	23 -> DusmRpcResetNetworkUsage
	24 -> DusmRpcFlushCostCache
Endpoints :
ncalrpc         : LRPC-321ce10e1e312e06be
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3240 at 0x5e18ba8L>
64
['Wcmsvc']

Interfaces :
RPC  25952c5d-7976-4aa1-a3cb-c35f7ae79d1b (1.1) -- c:\windows\system32\wlansvc.dll
	0 -> Srv_WDiagRpcInitSession
	1 -> Srv_WDiagRpcEndSession
	2 -> Srv_WDiagRpcQueryStatistics
	3 -> Srv_WDiagRpcQueryConnectionContextInfo
	4 -> Srv_WDiagRpcAutoConfigGetInterfaceInfo
	5 -> Srv_WDiagRpcGetExtensibilityInfo
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
RPC  266f33b4-c7c1-4bd1-8f52-ddb8f2214ea9 (1.0) -- c:\windows\system32\wlansvc.dll
	0 -> RpcOpenHandle
	1 -> RpcCloseHandle
	2 -> RpcEnumInterfaces
	3 -> RpcSetAutoConfigParameter
	4 -> RpcQueryAutoConfigParameter
	5 -> RpcGetInterfaceCapability
	6 -> RpcSetInterface
	7 -> RpcQueryInterface
	8 -> RpcIhvControl
	9 -> RpcScan
	10 -> RpcGetAvailableNetworkList
	11 -> RpcPrivateGetAvailableNetworkList
	12 -> RpcPrivateClearAnqpCache
	13 -> RpcPrivateRefreshAnqpCache
	14 -> RpcPrivateGetAnqpCacheResponse
	15 -> RpcPrivateParseAnqpRawData
	16 -> RpcPrivateGetAnqpOSUProviderList
	17 -> RpcPrivateEnableAnqpOsuRegistration
	18 -> RpcPrivateGetAnqpOsuRegistrationStatus
	19 -> RpcGetNetworkBssList
	20 -> RpcConnect
	21 -> RpcConnectEx
	22 -> RpcDisconnect
	23 -> RpcRegisterNotification
	24 -> RpcAsyncGetNotification
	25 -> RpcSetProfileEapUserData
	26 -> RpcSetProfile
	27 -> RpcGetProfile
	28 -> RpcDeleteProfile
	29 -> RpcRenameProfile
	30 -> RpcSetProfileList
	31 -> RpcSetProfileListForOffload
	32 -> RpcGetProfileList
	33 -> RpcSetProfilePosition
	34 -> RpcSetProfileCustomUserData
	35 -> RpcGetProfileCustomUserData
	36 -> RpcSetFilterList
	37 -> RpcGetFilterList
	38 -> RpcSetPsdIEDataList
	39 -> RpcSaveTemporaryProfile
	40 -> RpcIsUIRequestPending
	41 -> RpcSetUIForwardingNetworkList
	42 -> RpcIsNetworkSuppressed
	43 -> RpcRemoveUIForwardingNetworkList
	44 -> RpcQueryExtUIRequest
	45 -> RpcUIResponse
	46 -> RpcGetProfileKeyInfo
	47 -> RpcAsyncDoPlap
	48 -> RpcQueryPlapCredentials
	49 -> RpcCancelPlap
	50 -> RpcSetSecuritySettings
	51 -> RpcGetSecuritySettings
	52 -> RpcHostedNetworkPerformOperation
	53 -> RpcHostedNetworkHlpQueryEverUsed
	54 -> RpcHostedNetworkSetProperty
	55 -> RpcHostedNetworkQueryProperty
	56 -> RpcHostedNetworkQueryStatus
	57 -> RpcHostedNetworkQueryWCNSettings
	58 -> RpcHostedNetworkSetWCNSettings
	59 -> RpcGetProfileEapUserDataInfo
	60 -> RpcQueryPreConnectInput
	61 -> RpcConnectWithInput
	62 -> RpcRefreshConnections
	63 -> RpcInternalScan
	64 -> RpcHostedNetworkSetSecondaryKey
	65 -> RpcHostedNetworkQuerySecondaryKey
	66 -> RpcRegisterVirtualStationNotification
	67 -> RpcEnumAllInterfaces
	68 -> RpcQueryInterfacePortType
	69 -> RpcWFDDiscoverDevices
	70 -> RpcWFDGetVisibleDevices
	71 -> RpcWFDStopDiscoverDevices
	72 -> RpcWFDStartBackgroundDiscovery
	73 -> RpcWFDStopBackgroundDiscovery
	74 -> RpcWFDDiscoverDeviceServiceInformation
	75 -> RpcWFDOpenHandle
	76 -> RpcWFDRegisterVMgrCaller
	77 -> RpcWFDUnregisterVMgrCaller
	78 -> RpcWFDQueryProperty
	79 -> RpcWFDSetProperty
	80 -> RpcWFDSetSecondaryDeviceTypeList
	81 -> RpcWFDPairEnumerateCeremonies
	82 -> RpcWFDPairSelectCeremony
	83 -> RpcWFDPairWithDevice
	84 -> RpcWFDPairCancel
	85 -> RpcWFDPairCancelByDeviceAddress
	86 -> RpcWFDOpenSession
	87 -> RpcWFDGetSessionEndpointPairs
	88 -> RpcWFDConfigureFirewallForSession
	89 -> RpcWFDCancelOpenSession
	90 -> RpcWFDCloseSession
	91 -> RpcWFDAbortSession
	92 -> RpcWFDForceDisconnect
	93 -> RpcWFDForceDisconnectLegacyPeer
	94 -> RpcWFDAcceptGroupRequestAndOpenSession
	95 -> RpcWFDDeclineGroupRequest
	96 -> RpcWFDSetWCNSettings
	97 -> RpcWFDAcceptConnectRequestAndOpenSession
	98 -> RpcWFDDeclineConnectRequest
	99 -> RpcWFDGetPeerInfo
	100 -> RpcWFDGetDefaultGroupProfile
	101 -> RpcWFDGetProfileKeyInfo
	102 -> RpcWFDStartUsingGroup
	103 -> RpcWFDStopUsingGroup
	104 -> RpcWFDOpenLegacySessionWithProfile
	105 -> RpcWFDCloseLegacySession
	106 -> RpcWFDIsInterfaceWiFiDirect
	107 -> RpcIsWiFiDirectRunningOnWiFiAdapter
	108 -> RpcWFDUpdateDeviceVisibility
	109 -> RpcWFDOpenLegacySession
	110 -> RpcWFDFlushVisibleDeviceList
	111 -> RpcWlanNotifyVsIeProvider
	112 -> RpcWlanNotifyVsIeProviderEx
	113 -> RpcWFDGetDeviceDescriptorForPendingRequest
	114 -> RpcWFDStartOffloadedDiscovery
	115 -> RpcWFDStopOffloadedDiscovery
	116 -> RpcWFDGetPrimaryAdapterState
	117 -> RpcWFDDiscoverDevicesEx
	118 -> RpcWFDGetVisibleDevicesEx
	119 -> RpcWFDStopDiscoverDevicesEx
	120 -> RpcWFDSetSelectedWfdMgr
	121 -> RpcWFDSetSelectedWfdMgrWithoutClientContext
	122 -> RpcWFDResetSelectedWfdMgr
	123 -> RpcWiFiDisplaySetSinkClientHandle
	124 -> RpcWiFiDisplaySetSinkState
	125 -> RpcWiFiDisplayResetSinkState
	126 -> RpcSetProfileMetadata
	127 -> RpcGetProfileMetadata
	128 -> RpcWCMGetProfileList
	129 -> RpcWcmSetProfile
	130 -> RpcWcmSetInterface
	131 -> RpcWcmGetInterface
	132 -> RpcWcmDisconnect
	133 -> RpcStoreRadioState
	134 -> RpcGetStoredRadioState
	135 -> RpcGetRadioInformation
	136 -> RpcGetProfileIndex
	137 -> RpcGetMFPNegotiated
	138 -> RpcPrivateQueryInterface
	139 -> RpcPrivateSetInterface
	140 -> RpcUpdateBasicProfileSecurity
	141 -> RpcPrivateQuery11adPairedConfig
	142 -> RpcGetSupportedDeviceServices
	143 -> RpcDeviceServiceCommand
RPC  266f33b4-c7c1-4bd1-8f52-ddb8f2214eb0 (1.0) -- c:\windows\system32\wlansvc.dll
	0 -> RpcLowPrivOpenHandle
	1 -> RpcLowPrivCloseHandle
	2 -> RpcLowPrivRegisterNotification
	3 -> RpcLowPrivAsyncGetNotification
	4 -> RpcLowPrivSetInterface
	5 -> RpcLowPrivQueryInterface
	6 -> RpcLowPrivEnumInterfaces
	7 -> RpcWfdLowPrivIsWfdSupported
	8 -> RpcWfdLowPrivOpenHandle
	9 -> RpcWfdLowPrivCancelOpenSession
	10 -> RpcWfdLowPrivCloseSession
	11 -> RpcWfdLowPrivGetSessionEndpointPairs
	12 -> RpcWfdLowPrivConfigureFirewallForSession
	13 -> RpcWfdLowPrivOpenLegacySessionWithProfile
	14 -> RpcWfdLowPrivCloseLegacySession
	15 -> RpcWfdLowPrivQueryProperty
	16 -> RpcWfdLowPrivSetProperty
	17 -> RpcWfdLowPrivStartUsingGroup
	18 -> RpcWfdLowPrivStopUsingGroup
	19 -> RpcWlanLowPrivNotifyVsIeProvider
	20 -> RpcWfdLowPrivOpenSessionByDafObjectId
	21 -> RpcWfdLowPrivDeclineDeviceApiConnectionRequest
	22 -> RpcWfdLowPrivStartDeviceApiConnectionRequestListener
	23 -> RpcWfdLowPrivStopDeviceApiConnectionRequestListener
	24 -> RpcWFDSvcLowPrivPublishService
	25 -> RpcWFDSvcLowPrivUnpublishService
	26 -> RpcWfdSvcLowPrivOpenSeekerSession
	27 -> RpcWfdSvcLowPrivOpenAdvertiserSession
	28 -> RpcWfdSvcLowPrivGetProvisioningInfo
	29 -> RpcWfdSvcLowPrivConnectSession
	30 -> RpcWfdSvcLowPrivCancelSession
	31 -> RpcWfdSvcLowPrivAcceptSession
	32 -> RpcWfdSvcLowPrivConfigureSession
	33 -> RpcWfdSvcLowPrivCloseSession
	34 -> RpcWfdSvcLowPrivGetSessionEndpointPairs
	35 -> RpcWfdLowPrivRegisterVMgrCaller
	36 -> RpcWfdLowPrivUnregisterVMgrCaller
	37 -> RpcWlanVMgrQueryCurrentScenarios
	38 -> RpcWfdLowPrivGetPendingGroupRequestDetails
RPC  c3f42c6e-d4cc-4e5a-938b-9c5e8a5d8c2e (1.0) -- c:\windows\system32\WLANMSM.DLL
	0 -> RpcDot11ExtRegisterIhvProcess
	1 -> RpcDot11ExtPreAssociateCompletion
	2 -> RpcDot11ExtPostAssociateCompletion
	3 -> RpcDot11ExtSendUIRequest
	4 -> RpcDot11ExtSendNotification
	5 -> RpcDot11ExtGetProfileCustomUserData
	6 -> RpcDot11ExtSetProfileCustomUserData
	7 -> RpcDot11ExtNotifyChangeState
	8 -> RpcDot11ExtSetCurrentProfile
	9 -> RpcDot11ExtStartOneX
	10 -> RpcDot11ExtStopOneX
	11 -> RpcDot11ExtProcessSecurityPacket
	12 -> RpcDot11ExtRequestVirtualStation
	13 -> RpcDot11ExtReleaseVirtualStation
	14 -> RpcDot11ExtSetVirtualStationAPProperties
RPC  a111f1c6-5923-47c0-9a68-d0bafb577901 (1.0) -- C:\Windows\System32\NetSetupShim.dll
	0 -> RpcNetSetup_NotifyHost_Connect
	1 -> RpcNetSetup_NotifyHost_Disconnect
	2 -> RpcNetSetup_Isolation_ExecuteInfSection
	3 -> RpcNetSetup_NotifyObject_Load
	4 -> RpcNetSetup_NotifyObject_Unload
	5 -> RpcNetSetup_ComponentControl_Initialize
	6 -> RpcNetSetup_ComponentControl_ApplyChanges
	7 -> RpcNetSetup_ComponentControl_ApplyPnpChanges
	8 -> RpcNetSetup_ComponentControl_CancelChanges
	9 -> RpcNetSetup_ComponentSetup_Install
	10 -> RpcNetSetup_ComponentSetup_Upgrade
	11 -> RpcNetSetup_ComponentSetup_Removing
	12 -> RpcNetSetup_NotifyBinding_QueryBindingPath
	13 -> RpcNetSetup_NotifyBinding_NotifyBindingPath
	14 -> RpcNetSetup_NotifyGlobal_GetSupportedNotifications
	15 -> RpcNetSetup_NotifyGlobal_SysQueryBindingPath
	16 -> RpcNetSetup_NotifyGlobal_SysNotifyBindingPath
	17 -> RpcNetSetup_NotifyGlobal_SysNotifyComponent
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-980e251dff6123d053
ncalrpc         : LRPC-1584350eef00c3a38a
ncalrpc         : OLE70A9045440095781F084FEE0B79C
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3452 at 0x5e18b70L>
64
['BFE', 'CoreMessagingRegistrar', 'mpssvc']

Interfaces :
RPC  df4df73a-c52d-4e3a-8003-8437fdf8302a (0.0) -- c:\windows\system32\coremessaging.dll
	0 -> ServerValidateWindowId
	1 -> ServerValidateWindowIdAndOwner
RPC  dd490425-5325-4565-b774-7e27d6c09c24 (1.0) -- c:\windows\system32\bfe.dll
	0 -> BfeRpcGetNextNotificationBatch
	1 -> BfeRpcNotifyComplete
	2 -> BfeRpcEngineOpen
	3 -> BfeRpcEngineClose
	4 -> BfeRpcEngineGetOption
	5 -> BfeRpcEngineSetOption
	6 -> BfeRpcEngineGetSecurityInfo
	7 -> BfeRpcEngineSetSecurityInfo
	8 -> BfeRpcSessionCreateEnumHandle
	9 -> BfeRpcAleEndpointEnum
	10 -> BfeRpcAleEndpointDestroyEnumHandle
	11 -> BfeRpcTransactionBegin
	12 -> BfeRpcTransactionCommit
	13 -> BfeRpcTransactionAbort
	14 -> BfeRpcProviderAdd
	15 -> BfeRpcProviderDeleteByKey
	16 -> BfeRpcProviderGetByKey
	17 -> BfeRpcProviderCreateEnumHandle
	18 -> BfeRpcAleEndpointEnum
	19 -> BfeRpcAleEndpointDestroyEnumHandle
	20 -> BfeRpcProviderGetSecurityInfoByKey
	21 -> BfeRpcProviderSetSecurityInfoByKey
	22 -> BfeRpcProviderSubscribeChanges
	23 -> BfeRpcProviderUnsubscribeChanges
	24 -> BfeRpcProviderSubscriptionsGet
	25 -> BfeRpcProviderContextAdd
	26 -> BfeRpcProviderContextDeleteById
	27 -> BfeRpcProviderContextDeleteByKey
	28 -> BfeRpcProviderContextGetById
	29 -> BfeRpcProviderContextGetByKey
	30 -> BfeRpcProviderContextCreateEnumHandle
	31 -> BfeRpcAleEndpointEnum
	32 -> BfeRpcAleEndpointDestroyEnumHandle
	33 -> BfeRpcProviderContextGetSecurityInfoByKey
	34 -> BfeRpcProviderContextSetSecurityInfoByKey
	35 -> BfeRpcProviderContextSubscribeChanges
	36 -> BfeRpcProviderContextUnsubscribeChanges
	37 -> BfeRpcProviderContextSubscriptionsGet
	38 -> BfeRpcSubLayerAdd
	39 -> BfeRpcSubLayerDeleteByKey
	40 -> BfeRpcSubLayerGetByKey
	41 -> BfeRpcSubLayerCreateEnumHandle
	42 -> BfeRpcAleEndpointEnum
	43 -> BfeRpcAleEndpointDestroyEnumHandle
	44 -> BfeRpcSubLayerGetSecurityInfoByKey
	45 -> BfeRpcSubLayerSetSecurityInfoByKey
	46 -> BfeRpcSubLayerSubscribeChanges
	47 -> BfeRpcSubLayerUnsubscribeChanges
	48 -> BfeRpcSubLayerSubscriptionsGet
	49 -> BfeRpcLayerGetById
	50 -> BfeRpcLayerGetByKey
	51 -> BfeRpcLayerCreateEnumHandle
	52 -> BfeRpcAleEndpointEnum
	53 -> BfeRpcAleEndpointDestroyEnumHandle
	54 -> BfeRpcLayerGetSecurityInfoByKey
	55 -> BfeRpcLayerSetSecurityInfoByKey
	56 -> BfeRpcCalloutAdd
	57 -> BfeRpcCalloutDeleteById
	58 -> BfeRpcCalloutDeleteByKey
	59 -> BfeRpcCalloutGetById
	60 -> BfeRpcCalloutGetByKey
	61 -> BfeRpcCalloutCreateEnumHandle
	62 -> BfeRpcAleEndpointEnum
	63 -> BfeRpcAleEndpointDestroyEnumHandle
	64 -> BfeRpcCalloutGetSecurityInfoByKey
	65 -> BfeRpcCalloutSetSecurityInfoByKey
	66 -> BfeRpcCalloutSubscribeChanges
	67 -> BfeRpcCalloutUnsubscribeChanges
	68 -> BfeRpcCalloutSubscriptionsGet
	69 -> BfeRpcFilterAdd
	70 -> BfeRpcFilterDeleteById
	71 -> BfeRpcFilterDeleteByKey
	72 -> BfeRpcFilterGetById
	73 -> BfeRpcFilterGetByKey
	74 -> BfeRpcFilterCreateEnumHandle
	75 -> BfeRpcAleEndpointEnum
	76 -> BfeRpcAleEndpointDestroyEnumHandle
	77 -> BfeRpcFilterGetSecurityInfoByKey
	78 -> BfeRpcFilterSetSecurityInfoByKey
	79 -> BfeRpcFilterSubscribeChanges
	80 -> BfeRpcFilterUnsubscribeChanges
	81 -> BfeRpcFilterSubscriptionsGet
	82 -> BfeRpcBfeIPsecOffloadDone
	83 -> BfeRpcBfeIPsecDosFWUsed
	84 -> BfeRpcBfeIPsecGetStatistics
	85 -> BfeRpcBfeIPsecSaContextCreate
	86 -> BfeRpcBfeIPsecSaContextDeleteById
	87 -> BfeRpcBfeIPsecSaContextGetById
	88 -> BfeRpcBfeIPsecSaContextGetOrSetSpi
	89 -> BfeRpcBfeIPsecSaContextAddInbound
	90 -> BfeRpcBfeIPsecSaContextAddOutbound
	91 -> BfeRpcBfeIPsecSaContextUpdate
	92 -> BfeRpcBfeIPsecSaContextExpire
	93 -> BfeRpcBfeIPsecSaContextCreateEnumHandle
	94 -> BfeRpcAleEndpointEnum
	95 -> BfeRpcAleEndpointDestroyEnumHandle
	96 -> BfeRpcBfeIPsecSaContextSubscribe
	97 -> BfeRpcBfeIPsecSaContextUnsubscribe
	98 -> BfeRpcBfeIPsecSaContextSubscriptionsGet
	99 -> BfeRpcBfeIPsecSaCreateEnumHandle
	100 -> BfeRpcAleEndpointEnum
	101 -> BfeRpcAleEndpointDestroyEnumHandle
	102 -> BfeRpcBfeIPsecSaDbGetSecurityInfo
	103 -> BfeRpcBfeIPsecSaDbSetSecurityInfo
	104 -> BfeRpcBfeIPsecDospGetStatistics
	105 -> BfeRpcBfeIPsecDospStateCreateEnumHandle
	106 -> BfeRpcAleEndpointEnum
	107 -> BfeRpcBfeIPsecDospStateDestroyEnumHandle
	108 -> BfeRpcBfeIPsecDospGetSecurityInfo
	109 -> BfeRpcBfeIPsecDospSetSecurityInfo
	110 -> BfeRpcNetEventCreateEnumHandle
	111 -> BfeRpcAleEndpointEnum
	112 -> BfeRpcAleEndpointDestroyEnumHandle
	113 -> BfeRpcNetEventsGetSecurityInfo
	114 -> BfeRpcNetEventsSetSecurityInfo
	115 -> BfeRpcNetEventSubscribe
	116 -> BfeRpcNetEventUnsubscribe
	117 -> BfeRpcNetEventSubscriptionsGet
	118 -> BfeRpcNetEventsLost
	119 -> BfeRpcConnectionGetById
	120 -> BfeRpcConnectionGetByIPsecInfo
	121 -> BfeRpcConnectionGetByS2STunnelId
	122 -> BfeRpcConnectionCreateEnumHandle
	123 -> BfeRpcAleEndpointEnum
	124 -> BfeRpcAleEndpointDestroyEnumHandle
	125 -> BfeRpcConnectionGetSecurityInfo
	126 -> BfeRpcConnectionSetSecurityInfo
	127 -> BfeRpcConnectionGetS2STunnelId
	128 -> BfeRpcConnectionSubscribe
	129 -> BfeRpcConnectionUnsubscribe
	130 -> BfeRpcConnectionSubscriptionsGet
	131 -> BfeRpcConnectionsLost
	132 -> BfeRpcClassify
	133 -> BfeRpcAddLayerReplica
	134 -> BfeRpcDeleteLayerReplica
	135 -> BfeRpcSecureSocketAdd
	136 -> BfeRpcBfeIPsecTunnelDeleteByKey
	137 -> BfeRpcBfeIPsecTunnelAdd
	138 -> BfeRpcBfeIPsecTunnelAddConditions
	139 -> BfeRpcBfeIPsecS2STunnelAddConditions
	140 -> BfeRpcBfeIPsecS2STunnelRemoveConditions
	141 -> BfeRpcBfeIPsecTunnelDeleteByKey
	142 -> BfeRpcBfeIPsecS2STunnelAddInterfaceToCompartment
	143 -> BfeRpcBfeIPsecS2STunnelGetInterfaceForCompartment
	144 -> BfeRpcBfeIPsecS2STunnelRemoveInterfaceFromCompartment
	145 -> BfeRpcBfeIPsecSaInitiateAsync
	146 -> BfeRpcOpenToken
	147 -> BfeRpcCloseToken
	148 -> BfeRpcAleExplicitCredentialsQuery
	149 -> BfeRpcAleEndpointGetById
	150 -> BfeRpcAleEndpointCreateEnumHandle
	151 -> BfeRpcAleEndpointEnum
	152 -> BfeRpcAleEndpointDestroyEnumHandle
	153 -> BfeRpcAleEndpointGetSecurityInfo
	154 -> BfeRpcAleEndpointSetSecurityInfo
	155 -> BfeRpcAleGetPortStatus
	156 -> BfeRpcIsUserAuthConfigured
	157 -> BfeRpcKeyModuleAdd
	158 -> BfeRpcKeyModuleDeleteByKey
	159 -> BfeRpcKeyModuleUpdateAcquire
	160 -> BfeRpcKeyDictatorCheck
	161 -> BfeRpcGetKeyFromDictator
	162 -> BfeRpcNotifyKey
	163 -> BfeRpcKeyManagerAdd
	164 -> BfeRpcKeyManagerDeleteByKey
	165 -> BfeRpcKeyManagersGet
	166 -> BfeRpcKeyManagerGetSecurityInfoByKey
	167 -> BfeRpcKeyManagerSetSecurityInfoByKey
	168 -> BfeRpcvSwitchEventFire
	169 -> BfeRpcvSwitchEventsGetSecurityInfo
	170 -> BfeRpcvSwitchEventsSetSecurityInfo
	171 -> BfeRpcvSwitchEventSubscribe
	172 -> BfeRpcvSwitchEventUnsubscribe
	173 -> BfeRpcvSwitchEventSubscriptionsGet
	174 -> BfeRpcBfeIPsecDriverInitiateAcquire
	175 -> BfeRpcBfeIPsecDriverExpire
	176 -> BfeRpcBfeIPsecDriverSaOffloaded
	177 -> BfeRpcBfeIPsecDriverProcessClearTextResponse
	178 -> BfeRpcBfeProcessNameResolutionEvent
	179 -> BfeRpcVpnTriggerEventFire
	180 -> BfeRpcVpnTriggerEventSubscribe
	181 -> BfeRpcVpnTriggerEventUnsubscribe
	182 -> BfeRpcVpnTriggerAddAppSids
	183 -> BfeRpcVpnTriggerRemoveAppSids
	184 -> BfeRpcVpnTriggerAddFilePaths
	185 -> BfeRpcVpnTriggerRemoveFilePaths
	186 -> BfeRpcVpnTriggerAddSecurityDescriptor
	187 -> BfeRpcVpnTriggerRemoveSecurityDescriptor
	188 -> BfeRpcVpnTriggerSetStateDisconnected
	189 -> BfeRpcVpnTriggerInitializeNrptTriggering
	190 -> BfeRpcVpnTriggerUninitializeNrptTriggering
	191 -> BfeRpcVpnTriggerResetNrptTriggering
	192 -> BfeRpcVpnTriggerConfigureParameters
	193 -> BfeRpcBitmapIndexGet
	194 -> BfeRpcBitmapIndexFree
RPC  7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_FWIndicatePortInUse
	1 -> RPC_FWGetIndicatedPortInUse
	2 -> RPC_FWIndicateTupleInUse
	3 -> RPC_FWResetIndicatedTupleInUse
	4 -> RPC_FWIndicateProxyForUrl
	5 -> CNetProfileEventSink::NetworkAdded
	6 -> RPC_FWIsTargetAProxy
	7 -> RPC_NetworkIsolationSetupAppContainerBinaries
	8 -> RPC_NetworkIsolationRegisterForAppContainerChanges
	9 -> Rpc_NetworkIsolationRegistrationGetLastEvent
	10 -> RPC_NetworkIsolationUnregisterForAppContainerChanges
	11 -> RPC_NetworkIsolationGetAppContainer
	12 -> RPC_NetworkIsolationEnumAppContainers
	13 -> RPC_NetworkIsolationAddAllowEnterpriseIdRule
	14 -> RPC_NetworkIsolationCreateAllInterfacesContainer
	15 -> RPC_NetworkIsolationCreateInterfaceContainer
	16 -> RPC_NetworkIsolationDeleteAllInterfacesContainer
	17 -> RPC_NetworkIsolationDeleteInterfaceContainer
RPC  f47433c3-3e9d-4157-aad4-83aa1f5c2d4c (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_NetworkIsolationDiagnoseConnectFailure
	1 -> RPC_NetworkIsolationGetEnterpriseIdAsync
	2 -> RPC_NetworkIsolationCreateContainer
	3 -> RPC_NetworkIsolationDeleteContainer
	4 -> RPC_NetworkIsolationGetAppContainerConfig
	5 -> RPC_NetworkIsolationSetAppContainerConfig
	6 -> RPC_NetworkIsolationCreateAppContainer
	7 -> RPC_NetworkIsolationDeleteAppContainer
	8 -> RPC_NetworkIsolationCreateAppContainerLoopbackRules
	9 -> RPC_NetworkIsolationDeleteAppContainerLoopbackRules
RPC  2fb92682-6599-42dc-ae13-bd2ca89bd11c (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_FWOpenPolicyStore
	1 -> RPC_FWClosePolicyStore
	2 -> RPC_FWRestoreDefaults
	3 -> RPC_FWGetGlobalConfig
	4 -> RPC_FWSetGlobalConfig
	5 -> RPC_FWAddFirewallRule
	6 -> RPC_FWSetFirewallRule
	7 -> RPC_FWDeleteFirewallRule
	8 -> RPC_FWDeleteAllFirewallRules
	9 -> RPC_FWEnumFirewallRules
	10 -> RPC_FWGetConfig
	11 -> RPC_FWSetConfig
	12 -> RPC_FWNotifyUnsupportedAttempt
	13 -> RPC_FWAddConnectionSecurityRule
	14 -> RPC_FWSetConnectionSecurityRule
	15 -> RPC_FWDeleteConnectionSecurityRule
	16 -> RPC_FWDeleteAllConnectionSecurityRules
	17 -> RPC_FWEnumConnectionSecurityRules
	18 -> RPC_FWAddAuthenticationSet
	19 -> RPC_FWSetAuthenticationSet
	20 -> RPC_FWDeleteAuthenticationSet
	21 -> RPC_FWDeleteAllAuthenticationSets
	22 -> RPC_FWEnumAuthenticationSets
	23 -> RPC_FWAddCryptoSet
	24 -> RPC_FWSetCryptoSet
	25 -> RPC_FWDeleteCryptoSet
	26 -> RPC_FWDeleteAllCryptoSets
	27 -> RPC_FWEnumCryptoSets
	28 -> RPC_FWEnumPhase1SAs
	29 -> RPC_FWEnumPhase2SAs
	30 -> RPC_FWDeletePhase1SAs
	31 -> RPC_FWDeletePhase2SAs
	32 -> RPC_FWRegisterProduct
	33 -> RPC_FWUnregisterProduct
	34 -> RPC_FWEnumProducts
	35 -> RPC_FWAddMainModeRule
	36 -> RPC_FWSetMainModeRule
	37 -> RPC_FWDeleteMainModeRule
	38 -> RPC_FWDeleteAllMainModeRules
	39 -> RPC_FWEnumMainModeRules
	40 -> RPC_FWQueryFirewallRules
	41 -> RPC_FWQueryConnectionSecurityRules2_10
	42 -> RPC_FWQueryMainModeRules
	43 -> RPC_FWQueryAuthenticationSets
	44 -> RPC_FWQueryCryptoSets
	45 -> RPC_FWEnumNetworks
	46 -> RPC_FWEnumAdapters
	47 -> RPC_FWGetGlobalConfig2_10
	48 -> RPC_FWGetConfig2_10
	49 -> RPC_FWAddFirewallRule2_10
	50 -> RPC_FWSetFirewallRule2_10
	51 -> RPC_FWEnumFirewallRules2_10
	52 -> RPC_FWAddConnectionSecurityRule2_10
	53 -> RPC_FWSetConnectionSecurityRule2_10
	54 -> RPC_FWEnumConnectionSecurityRules2_10
	55 -> RPC_FWAddAuthenticationSet2_10
	56 -> RPC_FWSetAuthenticationSet2_10
	57 -> RPC_FWEnumAuthenticationSets2_10
	58 -> RPC_FWAddCryptoSet2_10
	59 -> RPC_FWSetCryptoSet2_10
	60 -> RPC_FWEnumCryptoSets2_10
	61 -> RPC_FWDiagGetAppList
	62 -> RPC_FWAddConnectionSecurityRule2_20
	63 -> RPC_FWSetConnectionSecurityRule2_20
	64 -> RPC_FWEnumConnectionSecurityRules2_20
	65 -> RPC_FWQueryConnectionSecurityRules2_20
	66 -> RPC_FWAddAuthenticationSet2_20
	67 -> RPC_FWSetAuthenticationSet2_20
	68 -> RPC_FWEnumAuthenticationSets2_20
	69 -> RPC_FWQueryAuthenticationSets2_20
	70 -> RPC_FWAddFirewallRule2_20
	71 -> RPC_FWSetFirewallRule2_20
	72 -> RPC_FWEnumFirewallRules2_20
	73 -> RPC_FWQueryFirewallRules2_20
	74 -> RPC_FWQueryIsolationType
	75 -> RPC_FWSelectConSecRule
	76 -> RPC_FWAddFirewallRule2_24
	77 -> RPC_FWSetFirewallRule2_24
	78 -> RPC_FWEnumFirewallRules2_24
	79 -> RPC_FWQueryFirewallRules2_24
	80 -> RPC_FWAddFirewallRule2_25
	81 -> RPC_FWSetFirewallRule2_25
	82 -> RPC_FWEnumFirewallRules2_25
	83 -> RPC_FWQueryFirewallRules2_25
	84 -> RPC_FWAddFirewallRule2_26
	85 -> RPC_FWSetFirewallRule2_26
	86 -> RPC_FWEnumFirewallRules2_26
	87 -> RPC_FWQueryFirewallRules2_26
	88 -> RPC_FWAddFirewallRule2_27
	89 -> RPC_FWSetFirewallRule2_27
	90 -> RPC_FWEnumFirewallRules2_27
	91 -> RPC_FWQueryFirewallRules2_27
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
Endpoints :
ncalrpc         : LRPC-d9f8936950b36b0b95
ncalrpc         : LRPC-85eb860f11f29b9b01
ncalrpc         : LRPC-4ef3a62e074c9cae5b
ncalrpc         : LRPC-514e2a0c21b20b4d9a
ncalrpc         : LRPC-135f73867046c3d66f
ncalrpc         : OLE7306F1ABD36F90ECF223B73622E2
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3524 at 0x5e18470L>
64
['ShellHWDetection']

Interfaces :
RPC  12345678-1234-abcd-ef00-0123456789ab (1.0) -- C:\WINDOWS\System32\spoolsv.exe
	0 -> RpcEnumPrinters
	1 -> RpcOpenPrinter
	2 -> RpcSetJob
	3 -> RpcGetJob
	4 -> RpcEnumJobs
	5 -> RpcAddPrinter
	6 -> RpcDeletePrinter
	7 -> RpcSetPrinter
	8 -> RpcGetPrinter
	9 -> RpcAddPrinterDriver
	10 -> RpcEnumPrinterDrivers
	11 -> RpcGetPrinterDriver
	12 -> RpcGetPrinterDriverDirectory
	13 -> RpcDeletePrinterDriver
	14 -> RpcAddPrintProcessor
	15 -> RpcEnumPrintProcessors
	16 -> RpcGetPrintProcessorDirectory
	17 -> RpcStartDocPrinter
	18 -> RpcStartPagePrinter
	19 -> RpcWritePrinter
	20 -> RpcEndPagePrinter
	21 -> RpcAbortPrinter
	22 -> RpcReadPrinter
	23 -> RpcEndDocPrinter
	24 -> RpcAddJob
	25 -> RpcScheduleJob
	26 -> RpcGetPrinterData
	27 -> RpcSetPrinterData
	28 -> RpcWaitForPrinterChange
	29 -> RpcClosePrinter
	30 -> RpcAddForm
	31 -> RpcDeleteForm
	32 -> RpcGetForm
	33 -> RpcSetForm
	34 -> RpcEnumForms
	35 -> RpcEnumPorts
	36 -> RpcEnumMonitors
	37 -> RpcAddPort
	38 -> RpcConfigurePort
	39 -> RpcDeletePort
	40 -> RpcCreatePrinterIC
	41 -> RpcPlayGdiScriptOnPrinterIC
	42 -> RpcDeletePrinterIC
	43 -> RpcAddPrinterConnection
	44 -> RpcDeletePrinterConnection
	45 -> RpcPrinterMessageBox
	46 -> RpcAddMonitor
	47 -> RpcDeleteMonitor
	48 -> RpcDeletePrintProcessor
	49 -> RpcAddPrintProvidor
	50 -> RpcDeletePrintProvidor
	51 -> RpcEnumPrintProcessorDatatypes
	52 -> RpcResetPrinter
	53 -> RpcGetPrinterDriver2
	54 -> RpcClientFindFirstPrinterChangeNotification
	55 -> RpcFindNextPrinterChangeNotification
	56 -> RpcFindClosePrinterChangeNotification
	57 -> NThreadingLibrary::TWorkItem::NotifyCancel
	58 -> RpcReplyOpenPrinter
	59 -> RpcRouterReplyPrinter
	60 -> RpcReplyClosePrinter
	61 -> RpcAddPortEx
	62 -> RpcRemoteFindFirstPrinterChangeNotification
	63 -> RpcSetAllocFailCount
	64 -> RpcResetPrinterEx
	65 -> RpcRemoteFindFirstPrinterChangeNotificationEx
	66 -> RpcRouterReplyPrinterEx
	67 -> RpcRouterRefreshPrinterChangeNotification
	68 -> RpcSetAllocFailCount
	69 -> RpcOpenPrinterEx
	70 -> RpcAddPrinterEx
	71 -> RpcSetPort
	72 -> RpcEnumPrinterData
	73 -> RpcDeletePrinterData
	74 -> NThreadingLibrary::TWorkItem::NotifyCancel
	75 -> NThreadingLibrary::TWorkItem::NotifyCancel
	76 -> NThreadingLibrary::TWorkItem::NotifyCancel
	77 -> RpcSetPrinterDataEx
	78 -> RpcGetPrinterDataEx
	79 -> RpcEnumPrinterDataEx
	80 -> RpcEnumPrinterKey
	81 -> RpcDeletePrinterDataEx
	82 -> RpcDeletePrinterKey
	83 -> RpcSeekPrinter
	84 -> RpcDeletePrinterDriverEx
	85 -> RpcAddPerMachineConnection
	86 -> RpcDeletePerMachineConnection
	87 -> RpcEnumPerMachineConnections
	88 -> RpcXcvData
	89 -> RpcAddPrinterDriverEx
	90 -> RpcSplOpenPrinter
	91 -> RpcGetSpoolFileInfo
	92 -> RpcCommitSpoolData
	93 -> RpcGetSpoolFileInfo2
	94 -> RpcCommitSpoolData2
	95 -> RpcCloseSpoolFileHandle
	96 -> RpcFlushPrinter
	97 -> RpcSendRecvBidiData
	98 -> RpcAddDriverCatalog
	99 -> RpcAddPrinterConnection2
	100 -> RpcInstallPrinterDriverFromPackage
	101 -> RpcUploadPrinterDriverPackage
	102 -> RpcGetCorePrinterDrivers
	103 -> RpcCorePrinterDriverInstalled
	104 -> RpcGetPrinterDriverPackagePath
	105 -> RpcDeletePrinterDriverPackage
	106 -> RpcFindCompatibleDriver
	107 -> RpcReportJobProcessingProgress
	108 -> RpcSetSpoolerPolicy
	109 -> RpcInternalGetPrinterDriver
	110 -> RpcGetJobNamedPropertyValue
	111 -> RpcSetJobNamedProperty
	112 -> RpcDeleteJobNamedProperty
	113 -> RpcEnumJobNamedProperties
	114 -> RpcCreateAppSandbox
	115 -> RpcGetUserPropertyBag
	116 -> RpcLogJobInfoForBranchOffice
RPC  0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 (1.0) -- C:\WINDOWS\System32\spoolsv.exe
	0 -> IRPCAsyncNotify_RegisterClient
	1 -> IRPCAsyncNotify_UnregisterClient
	2 -> IRPCAsyncNotify_GetServerRefferal
	3 -> IRPCAsyncNotify_GetNewChannel
	4 -> IRPCAsyncNotify_GetNotificationSendResponse
	5 -> IRPCAsyncNotify_GetNotification
	6 -> IRPCAsyncNotify_CloseChannel
RPC  ae33069b-a2a8-46ee-a235-ddfd339be281 (1.0) -- C:\WINDOWS\System32\spoolsv.exe
	0 -> IRPCRemoteObject_Create
	1 -> IRPCRemoteObject_Delete
RPC  4a452661-8290-4b36-8fbe-7f4093a94978 (1.0) -- C:\WINDOWS\System32\spoolsv.exe
	0 -> IRPCAsyncNotifyChannel_CreateChannel
	1 -> IRPCAsyncNotifyChannel_SendNotification
	2 -> IRPCAsyncNotifyChannel_SendNotificationGetResponse
	3 -> IRPCAsyncNotifyChannel_CloseChannel
RPC  76f03f96-cdfd-44fc-a22c-64950a001209 (1.0) -- C:\WINDOWS\System32\spoolsv.exe
	0 -> RpcAsyncOpenPrinter
	1 -> RpcAsyncAddPrinter
	2 -> RpcAsyncSetJob
	3 -> RpcAsyncGetJob
	4 -> RpcAsyncEnumJobs
	5 -> RpcAsyncAddJob
	6 -> RpcAsyncScheduleJob
	7 -> RpcAsyncDeletePrinter
	8 -> RpcAsyncSetPrinter
	9 -> RpcAsyncGetPrinter
	10 -> RpcAsyncStartDocPrinter
	11 -> RpcAsyncStartPagePrinter
	12 -> RpcAsyncWritePrinter
	13 -> RpcAsyncEndPagePrinter
	14 -> RpcAsyncEndDocPrinter
	15 -> RpcAsyncAbortPrinter
	16 -> RpcAsyncGetPrinterData
	17 -> RpcAsyncGetPrinterDataEx
	18 -> RpcAsyncSetPrinterData
	19 -> RpcAsyncSetPrinterDataEx
	20 -> RpcAsyncClosePrinter
	21 -> RpcAsyncAddForm
	22 -> RpcAsyncDeleteForm
	23 -> RpcAsyncGetForm
	24 -> RpcAsyncSetForm
	25 -> RpcAsyncEnumForms
	26 -> RpcAsyncGetPrinterDriver
	27 -> RpcAsyncEnumPrinterData
	28 -> RpcAsyncEnumPrinterDataEx
	29 -> RpcAsyncEnumPrinterKey
	30 -> RpcAsyncDeletePrinterData
	31 -> RpcAsyncDeletePrinterDataEx
	32 -> RpcAsyncDeletePrinterKey
	33 -> RpcAsyncXcvData
	34 -> RpcAsyncSendRecvBidiData
	35 -> RpcAsyncCreatePrinterIC
	36 -> RpcAsyncPlayGdiScriptOnPrinterIC
	37 -> RpcAsyncDeletePrinterIC
	38 -> RpcAsyncEnumPrinters
	39 -> RpcAsyncAddPrinterDriver
	40 -> RpcAsyncEnumPrinterDrivers
	41 -> RpcAsyncGetPrinterDriverDirectory
	42 -> RpcAsyncDeletePrinterDriver
	43 -> RpcAsyncDeletePrinterDriverEx
	44 -> RpcAsyncAddPrintProcessor
	45 -> RpcAsyncEnumPrintProcessors
	46 -> RpcAsyncGetPrintProcessorDirectory
	47 -> RpcAsyncEnumPorts
	48 -> RpcAsyncEnumMonitors
	49 -> RpcAsyncAddPort
	50 -> RpcAsyncSetPort
	51 -> RpcAsyncAddMonitor
	52 -> RpcAsyncDeleteMonitor
	53 -> RpcAsyncDeletePrintProcessor
	54 -> RpcAsyncEnumPrintProcessorDatatypes
	55 -> RpcAsyncAddPerMachineConnection
	56 -> RpcAsyncDeletePerMachineConnection
	57 -> RpcAsyncEnumPerMachineConnections
	58 -> RpcSyncRegisterForRemoteNotifications
	59 -> RpcSyncUnRegisterForRemoteNotifications
	60 -> RpcSyncRefreshRemoteNotifications
	61 -> RpcAsyncGetRemoteNotifications
	62 -> RpcAsyncInstallPrinterDriverFromPackage
	63 -> RpcAsyncUploadPrinterDriverPackage
	64 -> RpcAsyncGetCorePrinterDrivers
	65 -> RpcAsyncCorePrinterDriverInstalled
	66 -> RpcAsyncGetPrinterDriverPackagePath
	67 -> RpcAsyncDeletePrinterDriverPackage
	68 -> RpcAsyncReadPrinter
	69 -> RpcAsyncResetPrinter
	70 -> RpcAsyncGetJobNamedPropertyValue
	71 -> RpcAsyncSetJobNamedProperty
	72 -> RpcAsyncDeleteJobNamedProperty
	73 -> RpcAsyncEnumJobNamedProperties
	74 -> RpcAsyncLogJobInfoForBranchOffice
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
OLE  00000001-0000-0000-c000-000000000046 (0.0) -- IClassFactory
Endpoints :
ncalrpc         : LRPC-86933dfe29009d4e26
ncacn_np        : \pipe\spoolss
ncacn_ip_tcp    : 1541
ncalrpc         : OLEA8008E976AAC9D631AC104F46EEF
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3968 at 0x5e18208L>
64
['DiagTrack']

Interfaces :
RPC  4c9dbf19-d39e-4bb9-90ee-8f7179b20283 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcApi_IsScenarioActive
	1 -> UtcApi_EscalateScenario
	2 -> UtcApi_EscalateScenarioAsync
	3 -> UtcApi_IsEscalationRunning
	4 -> UtcApi_DownloadLatestSettingsForNamespace
	5 -> UtcApi_DownloadLatestSettingsForNamespaceAsync
	6 -> UtcApi_GetActiveScenarioList
	7 -> UtcApi_ForceUpload
	8 -> UtcApi_ResetUsageMetrics
	9 -> UtcApi_IsTraceRunning
	10 -> UtcApi_GetActiveTraceRuntime
	11 -> UtcApi_GetKnownTraceList
	12 -> UtcApi_DownloadLatestSettings
	13 -> UtcApi_ReloadSettings
	14 -> UtcApi_UpdateTimerConfiguration
	15 -> UtcApi_ClearTimerConfiguration
	16 -> UtcApi_GetNextScheduledFireTime
	17 -> UtcApi_GetTimerConfiguration
	18 -> UtcApi_GetCustomTraceList
	19 -> UtcApi_StartCustomTrace
	20 -> UtcApi_SnapCustomTrace
	21 -> UtcApi_StopCustomTrace
	22 -> UtcApi_EscalateScenario2
	23 -> UtcApi_EscalateScenarioAsync2
	24 -> UtcApi_GetActiveTraceInfo
	25 -> UtcApi_EnableWERLocalReports
	26 -> UtcApi_RestoreWERLocalReportsSettings
	27 -> UtcApi_QueryWERLocalReportsEnabled
	28 -> UtcApi_IsEscalationRunningEx
RPC  fd8be72b-a9cd-4b2c-a9ca-4ded242fbe4d (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcApi_SendSyntheticTrigger
	1 -> UtcApi_ChangeEtmPauseState
RPC  95095ec8-32ea-4eb0-a3e2-041f97b36168 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcTelemetryOptInApi_SetTelemetryOptIn
RPC  e38f5360-8572-473e-b696-1b46873beeab (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcTenantApi_RegisterTelemetryTenant
	1 -> UtcTenantApi_UnregisterTelemetryTenant
	2 -> UtcTenantApi_UpdateDailyUploadQuota
	3 -> UtcTenantApi_ForceUpload
RPC  d22895ef-aff4-42c5-a5b2-b14466d34ab4 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcEventTranscriptApi_FetchTranscriptStats
	1 -> UtcEventTranscriptApi_FetchTranscriptRecordsPage
	2 -> UtcEventTranscriptApi_FetchTranscriptRecordPayload
	3 -> UtcEventTranscriptApi_FetchKnownTags
	4 -> UtcEventTranscriptApi_FetchEventTags
	5 -> UtcEventTranscriptApi_IsSampledIn
	6 -> UtcEventTranscriptApi_FetchTranscriptRecordsPage2
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  ac7f26f2-feb7-5b2a-8ac4-345bc62caede (0.0) -- IMapView<HSTRING,HSTRING>
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  e9bdaaf0-cbf6-5c72-be90-29cbf3a1319b (0.0) -- IIterable<IKeyValuePair<HSTRING,HSTRING> >
OLE  05eb86f1-7140-5517-b88d-cbaebe57e6b1 (0.0) -- IIterator<IKeyValuePair<HSTRING,HSTRING> >
OLE  60310303-49c5-52e6-abc6-a9b36eccc716 (0.0) -- IKeyValuePair<HSTRING,HSTRING>
OLE  199e065c-8195-55da-9c10-8aeaf9ac1062 (0.0) -- __FIVectorView_1_Windows__CSecurity__CAuthentication__CWeb__CCore__CWebTokenResponse
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
Endpoints :
ncalrpc         : LRPC-cb86006467d51636ea
ncalrpc         : OLE2D17161BF24248D2919A6BE91941
--------------------------------------------------------------------------------
<WinProcess "Sysmon.exe" pid 3980 at 0x5e18160L>
64
['Sysmon']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "EvtEng.exe" pid 4020 at 0x5e18588L>
64
['EvtEng']
[!!] Invalid rpcrt4 base: 0x1c4427e0000 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4036 at 0x5e186a0L>
64
['TrkWks']

Interfaces :
RPC  0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 (1.0) -- c:\windows\system32\cryptsvc.dll
	0 -> s_SSCertProtectFunction
RPC  2579ff35-0ab0-4e5a-88fa-1d88c4e0cb92 (2.0) -- C:\Windows\System32\crypttpmeksvc.dll
	0 -> s_SSTpmEndorsementKeyGetInfo
	1 -> s_SSTpmEndorsementKeyDecryptChallenge
	2 -> s_SSTpmAttestationCapable
	3 -> s_SSTpmGetAttestationForAik
	4 -> s_SSTpmGetManufacturerInfo
RPC  f50aac00-c7f3-428e-a022-a6b71bfb9d43 (2.0) -- C:\Windows\System32\cryptcatsvc.dll
	0 -> s_SSCatDBAddCatalog
	1 -> s_SSCatDBDeleteCatalog
	2 -> s_SSCatDBEnumCatalogs
	3 -> s_SSCatDBPauseResumeService
	4 -> s_SSCatDBRebuildDatabase
	5 -> s_SSCatDBPrepareForCall
	6 -> s_SSCatDBAddCatalog2
	7 -> s_SSCatDBSmartlockerDefenderCheck
RPC  1495a2be-b7a8-4299-9d3b-8825e5bcbfb9 (1.0) -- C:\Windows\System32\webauthn.dll
	0 -> s_SSCtapCommand
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : keysvc
ncalrpc         : OLE114FFE22F3EBA1BDE1F447BE0387
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4044 at 0x5e18b38L>
64
['DPS']

Interfaces :
RPC  78e5d322-59a2-4324-ae3f-8bc8de32bdfc (1.0) -- c:\windows\system32\sstpsvc.dll
	0 -> SstpSvcSetConfig
	1 -> SstpSvcGetConfig
	2 -> SstpSvcCreateUpdateTenantGatewayMapping
	3 -> SstpSvcRemoveTenantGatewayMapping
	4 -> SstpSvcGetTenantGatewayMapping
Endpoints :
ncalrpc         : SstpSvcRpc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4068 at 0x5e185f8L>
64
['stisvc']

Interfaces :
RPC  8c7a6de0-788d-11d0-9edf-444553540000 (2.0) -- c:\windows\system32\wiaservc.dll
	0 -> R_StiApiGetVersion
	1 -> R_StiApiEnableHwNotifications
	2 -> R_StiApiGetHwNotificationState
	3 -> R_StiApiLaunchApplication
	4 -> R_StiApiOpenDevice
	5 -> R_StiApiSubscribe
	6 -> R_StiApiGetLastNotificationData
	7 -> R_StiApiUnSubscribe
	8 -> R_StiApiCloseDevice
	9 -> R_StiApiLockDevice
	10 -> R_StiApiUnlockDevice
	11 -> R_WiaGetEventDataAsync
	12 -> OpenClientConnection
	13 -> CloseClientConnection
	14 -> RegisterUnregisterForEventNotification
	15 -> WiaGetRuntimetEventDataAsync
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
Endpoints :
ncalrpc         : STI_LRPC
ncalrpc         : OLE1E06AB5CC832699E14B490289211
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4080 at 0x5e18198L>
64
['WpnService']

Interfaces :
RPC  850cee52-3038-4277-b9b4-e05db8b2c35c (1.0) -- c:\windows\system32\das.dll
	0 -> DasCreateAssociationContextForApp
	1 -> DasCreateAssociationContextFromOobBlob
	2 -> DasStartEnumCeremonies
	3 -> DasSelectCeremony
	4 -> DasStartReadCeremonyData
	5 -> DasStartWriteCeremonyData
	6 -> DasStartFinalize
	7 -> DasStartDeviceStatusNotification
	8 -> DasCloseAssociationContext
	9 -> DasStartRemoveAssociation
	10 -> DasCreateImportExportContext
	11 -> DasStartAepImport
	12 -> DasStartAepExport
	13 -> DasCloseImportExportContext
RPC  a1d4eae7-39f8-4bca-8e72-832767f5082a (1.0) -- c:\windows\system32\das.dll
	0 -> DasCreateInboundContext
	1 -> DasStartListenForInboundAssociations
	2 -> DasGetInboundAssociationResult
	3 -> DasCloseInboundContext
	4 -> DasRegisterForInboundAssociationsAppActivation
	5 -> DasGetInboundAssociationResultForAppActivation
RPC  2e7d4935-59d2-4312-a2c8-41900aa5495f (1.0) -- c:\windows\system32\das.dll
	0 -> DasCreateChallengeContext
	1 -> DasStartChallengeDevicePresence
	2 -> DasCloseChallengeContext
RPC  bd84cd86-9825-4376-813d-334c543f89b1 (1.0) -- c:\windows\system32\das.dll
	0 -> RpcDevQueryCreate
	1 -> RpcDevQueryClose
	2 -> RpcDevQueryGetResult
	3 -> RpcDevPropertySet
RPC  5b665b9a-a086-4e26-ae24-96ab050b0ec3 (1.0) -- c:\windows\system32\das.dll
	0 -> DasCreateAepStoreAep
	1 -> DasDeleteAepStoreAep
	2 -> DasSetAepStoreAepProperties
Endpoints :
ncalrpc         : LRPC-84704d3fc3ab9c25d8
--------------------------------------------------------------------------------
<WinProcess "MsiTrueColorService.exe" pid 3116 at 0x5e18e48L>
64
['MsiTrueColorService']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "ZeroConfigService.exe" pid 4132 at 0x5e189b0L>
64
['ZeroConfigService']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "IntelCpHDCPSvc.exe" pid 4180 at 0x5dd8550L>
64
['cplspcon']

Interfaces :
RPC  2f5f6520-ca46-1067-b319-00dd010662da (1.0) -- c:\windows\system32\tapisrv.dll
	0 -> ClientAttach
	1 -> ClientRequest
	2 -> ClientDetach
RPC  2f5f6521-cb55-1059-b446-00df0bce31db (1.0) -- c:\windows\system32\unimdm.tsp
	0 -> notifSendFrame
Endpoints :
ncacn_np        : \pipe\tapsrv
ncalrpc         : tapsrvlpc
ncalrpc         : unimdmsvc
--------------------------------------------------------------------------------
<WinProcess "vmnetdhcp.exe" pid 4560 at 0x5dd8cc0L>
32
['VMnetDHCP']
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "vmnat.exe" pid 4604 at 0x5dd8cf8L>
32
['VMware NAT Service']
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "vmware-authd.exe" pid 4716 at 0x5dd8ac8L>
32
['VMAuthdService']
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4728 at 0x5dd8b70L>
64
['WdiServiceHost']

Interfaces :
RPC  98716d03-89ac-44c7-bb8c-285824e51c4a (1.0) -- c:\windows\system32\srvsvc.dll
	0 -> XsOpenPrinter
	1 -> XsClosePrinter
	2 -> XsAddJob
	3 -> XsScheduleJob
	4 -> XsProcessPnp
	5 -> XsProcDownLevelAPI
RPC  1a0d010f-1c33-432c-b0f5-8cf4e8053099 (1.0) -- c:\windows\system32\srvsvc.dll
	0 -> IdSegRequestNextSequence
	1 -> IdSegRequestNodeInvalidation
RPC  4b324fc8-1670-01d3-1278-5a47bf6ee188 (3.0) -- c:\windows\system32\srvsvc.dll
	0 -> NetrCharDevControl
	1 -> NetrCharDevControl
	2 -> NetrCharDevControl
	3 -> NetrCharDevControl
	4 -> NetrCharDevControl
	5 -> NetrCharDevControl
	6 -> NetrCharDevControl
	7 -> NetrCharDevControl
	8 -> NetrConnectionEnum
	9 -> NetrFileEnum
	10 -> NetrFileGetInfo
	11 -> NetrFileClose
	12 -> NetrSessionEnum
	13 -> NetrSessionDel
	14 -> NetrShareAdd
	15 -> NetrShareEnum
	16 -> NetrShareGetInfo
	17 -> NetrShareSetInfo
	18 -> NetrShareDel
	19 -> NetrShareDelSticky
	20 -> NetrShareCheck
	21 -> NetrServerGetInfo
	22 -> NetrServerSetInfo
	23 -> NetrServerDiskEnum
	24 -> NetrServerStatisticsGet
	25 -> NetrServerTransportAdd
	26 -> NetrServerTransportEnum
	27 -> NetrServerTransportDel
	28 -> NetrRemoteTOD
	29 -> I_NetrServerSetServiceBits
	30 -> NetprPathType
	31 -> NetprPathCanonicalize
	32 -> NetprPathCompare
	33 -> NetprNameValidate
	34 -> NetprNameCanonicalize
	35 -> NetprNameCompare
	36 -> NetrShareEnumSticky
	37 -> NetrShareDelStart
	38 -> NetrShareDelCommit
	39 -> NetrpGetFileSecurity
	40 -> NetrpSetFileSecurity
	41 -> NetrServerTransportAddEx
	42 -> I_NetrServerSetServiceBitsEx
	43 -> NetrDfsGetVersion
	44 -> NetrCharDevControl
	45 -> NetrCharDevControl
	46 -> NetrCharDevControl
	47 -> NetrCharDevControl
	48 -> NetrCharDevControl
	49 -> NetrCharDevControl
	50 -> NetrCharDevControl
	51 -> NetrCharDevControl
	52 -> NetrCharDevControl
	53 -> NetrServerTransportDelEx
	54 -> NetrServerAliasAdd
	55 -> NetrServerAliasEnum
	56 -> NetrServerAliasDel
	57 -> NetrShareDelEx
	58 -> LocalrSessionEnum
	59 -> LocalrSessionGetInfo
	60 -> LocalrSessionDel
	61 -> LocalrFileEnum
	62 -> LocalrFileGetInfo
	63 -> LocalrFileClose
	64 -> LocalrShareEnum
	65 -> LocalrShareGetInfo
	66 -> LocalrShareSetInfo
	67 -> LocalrShareAdd
	68 -> LocalrShareDelEx
	69 -> LocalrAliasGet
	70 -> NetrServerTransportAddForInstance
	71 -> NetrServerTransportDelForInstance
Endpoints :
ncalrpc         : LRPC-f4d5bafb48cb6d0b45
ncacn_np        : \PIPE\srvsvc
--------------------------------------------------------------------------------
<WinProcess "vmms.exe" pid 4780 at 0x5dd88d0L>
64
['vmms']

Interfaces :
RPC  552d076a-cb29-4e44-8b6a-d15e59e2c0af (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> IpTransitionProtocolApplyConfigChanges
	1 -> IpTransitionProtocolApplyConfigChangesEx
RPC  ecbdb051-f208-46b9-8c8b-648d9d3f3944 (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> RefreshTeredoState
	1 -> ResetDisabledComponentsForTeredo
RPC  1fff8faa-ec23-4e3f-a8ce-4b2f8707e636 (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> TeredoCreateConsumerHandle
	1 -> TeredoCloseConsumerHandle
RPC  2e6035b2-e8f1-41a7-a044-656b439c4c34 (1.0) -- C:\WINDOWS\system32\httpprxm.dll
	0 -> ProxyMgrProviderRegisterForEventNotification
	1 -> ProxyMgrProviderUnregisterEventNotification
	2 -> ProxyMgrProviderGetNotification
	3 -> ProxyMgrGetProxyEventInformation
	4 -> ProxyMgrSetProxyConfiguration
	5 -> ProxyMgrSetProxyCredentials
RPC  c36be077-e14b-4fe9-8abc-e856ef4f048b (1.0) -- C:\WINDOWS\system32\httpprxm.dll
	0 -> RpcSrvProxyMgrClientRegisterForEventNotification
	1 -> RpcSrvProxyMgrClientGetNotification
	2 -> RpcSrvProxyMgrClientUnregisterEventNotification
	3 -> RpcSrvProxyMgrClientGetProxyForUrl
	4 -> RpcSrvProxyMgrClientGetProxyCredentials
	5 -> RpcSrvProxyMgrClientGetAllProxiesForUrl
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
RPC  c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 (1.0) -- C:\WINDOWS\system32\adhsvc.dll
	0 -> Rpc_AdhEngineOpen
	1 -> Rpc_AdhEngineClose
	2 -> Rpc_AdhStatusEventSubscribe
	3 -> Rpc_AdhStatusEventSubscriptionGetLastEvent
	4 -> Rpc_AdhStatusEventUnsubscribe
	5 -> Rpc_AdhGetConfig
	6 -> Rpc_AdhGetEvidenceCollectorResult
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
Endpoints :
ncalrpc         : LRPC-468ba3aa8e54f640a8
ncalrpc         : TeredoDiagnostics
ncalrpc         : TeredoControl
ncalrpc         : OLE8D3C864969A59979DAAEDA313AF1
--------------------------------------------------------------------------------
<WinProcess "vmware-usbarbitrator64.exe" pid 4808 at 0x5dd8f28L>
64
['VMUSBArbService']

Interfaces :
RPC  20610036-fa22-11cf-9823-00a0c911e5df (1.0) -- c:\windows\system32\rasmans.dll
	0 -> RasRpcPortEnum
	1 -> RasRpcDeviceEnum
	2 -> RasRpcGetDevConfig
	3 -> RasRpcPortGetInfo
	4 -> RasRpcEnumConnections
	5 -> RasRpcDeleteEntry
	6 -> RasRpcGetErrorString
	7 -> RasRpcGetCountryInfo
	8 -> RasRpcGetInstalledProtocols
	9 -> RasRpcGetUserPreferences
	10 -> RasRpcSetUserPreferences
	11 -> RasRpcGetSystemDirectory
	12 -> RasRpcSubmitRequest
	13 -> RasRpcSubmitRequestLocal
	14 -> RasRpcGetInstalledProtocolsEx
	15 -> RasRpcGetVersion
RPC  81ee95a8-882e-4615-888a-53344ca149e4 (1.0) -- C:\WINDOWS\system32\vpnike.dll
	0 -> VpnikeCreateTunnel
	1 -> VpnikeUpdateTunnel
	2 -> VpnikeCloseTunnel
	3 -> VpnikeGetCfgPayloadRequest
	4 -> VpnikeProcessCfgPayloadReply
	5 -> VpnikeProcessCfgPayloadRequest
	6 -> VpnikeNewRasIncomingCall
	7 -> VpnikeGetTsRequest
	8 -> VpnikeProcessTsReply
	9 -> VpnikeProcessTsRequest
	10 -> VpnikeRemoveTs
	11 -> VpnikeGetServerEapAuthRequestPacket
	12 -> VpnikeProcessEapAuthPacket
	13 -> VpnikeQueryEapAuthAttributes
	14 -> VpnIkeProcessAdditionalAddressNotification
	15 -> VpnikeCreateIDPayload
	16 -> VpnikeTunnelAuthDone
	17 -> VpnikeCreateOptionalIDrPayload
RPC  650a7e26-eab8-5533-ce43-9c1dfce11511 (1.0) -- C:\WINDOWS\system32\rascustom.dll
	0 -> Rpc_VpnProtEngOpen
	1 -> Rpc_VpnProtEngClose
	2 -> Rpc_VpnProtEngEventSubscribe
	3 -> Rpc_VpnProtEngEventSubscriptionGetLastEvent
	4 -> Rpc_VpnProtEngEventUnsubscribe
	5 -> Rpc_VpnProtEngSendGetCredentialsRequest
	6 -> Rpc_VpnProtEngSendNegotiatingNetworkRequest
	7 -> Rpc_VpnProtEngSendInterfaceCreateRequest
	8 -> Rpc_VpnProtEngSendInterfaceDestroyRequest
	9 -> Rpc_VpnProtEngSendConnectError
	10 -> Rpc_VpnProtEngGetConfiguration
	11 -> Rpc_VpnProtEngGetBestCostInterface
	12 -> Rpc_VpnProtEngGetStatementOfHealth
	13 -> Rpc_VpnProtEngSetKeepAliveFrequencyOverrideRequest
	14 -> Rpc_VpnProtEngSendGetCustomPromptRequest
	15 -> Rpc_VpnProtEngSendGetCertificateConsentBlankUiRequest
	16 -> Rpc_VpnProtEngSendCloseCertificateConsentBlankUiRequest
	17 -> Rpc_VpnProtEngPluginInstall
	18 -> Rpc_VpnProtEngPluginUninstall
	19 -> Rpc_VpnProtEngSetCostNetworkSettings
	20 -> Rpc_VpnProtEngGetCostNetworkSettings
	21 -> Rpc_VpnProtEngExecuteAndCaptureLogs
	22 -> Rpc_VpnProtEngGetInterface
	23 -> Rpc_VpnProtEngPluginEnumerate
	24 -> Rpc_VpnProtEngAddProfileFromXml
	25 -> Rpc_VpnProtEngWinRtConnect
	26 -> Rpc_VpnProtEngWinRtDisconnect
	27 -> Rpc_VpnProtEngWinRtEnumerate
	28 -> Rpc_VpnProtEngWinRtGetEapBlob
	29 -> Rpc_VpnProtEngWinRtGetEapXml
	30 -> Rpc_VpnProtEngWinRtGetMoniker
	31 -> Rpc_VpnProtEngWinRtGetConnectionStatus
	32 -> Rpc_VpnProtEngWinRtUpdateRegistryProfileList
	33 -> Rpc_VpnProtEngGetProxyForUrlAndSingleSessionDeviceUser
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
Endpoints :
ncacn_np        : \PIPE\ROUTER
ncalrpc         : RasmanLrpc
ncalrpc         : VpnikeRpc
ncalrpc         : LRPC-ac14c3be97f6e49e09
ncalrpc         : OLEE9C19143A346A740C8B1E9E8B3E7
--------------------------------------------------------------------------------
<WinProcess "dasHost.exe" pid 5088 at 0x5dd8978L>
64

Interfaces :
RPC  eeee008d-5c99-4e4b-861b-547a26e8abd0 (1.0) -- C:\WINDOWS\system32\dashost.exe
	0 -> DasHostLoadProvider
	1 -> DasHostSetDasProcessHandle
	2 -> DasHostUnloadProvider
	3 -> DasHostShutdown
	4 -> DasHostCreateProviderQuery
	5 -> DasHostCloseQuery
	6 -> DasHostProviderQueryGetResult
	7 -> DasHostCreateAssociationContext
	8 -> DasHostCreateAssociationContextFromOobBlob
	9 -> DasHostStartEnumCeremonies
	10 -> DasHostSelectCeremony
	11 -> DasHostStartReadCeremonyData
	12 -> DasHostStartWriteCeremonyData
	13 -> DasHostStartFinalize
	14 -> DasHostDeviceStatusNotification
	15 -> DasHostStartRemoveAssociation
	16 -> DasHostCloseAssociationContext
	17 -> DasHostCreateDevnodeManagementContext
	18 -> DasHostStartDevnodeManagement
	19 -> DasHostEndDevnodeManagement
	20 -> DasHostPickupDevnodeManagementOperation
	21 -> DasHostGetDevnodeFactoryOperationInfo
	22 -> DasHostCompleteDevnodeFactoryOperation
	23 -> DasHostGetDevnodeOperationInfo
	24 -> DasHostCompleteDevnodeOperation
	25 -> DasHostCloseDevnodeManagementContext
	26 -> DasHostCreateChallengeContext
	27 -> DasHostStartChallengeDevicePresence
	28 -> DasHostCloseChallengeContext
	29 -> DasHostCreateImportExportContext
	30 -> DasHostStartImport
	31 -> DasHostStartExport
	32 -> DasHostCloseImportExportContext
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : DasHostCC{8d6a4f7a-48c7-4547-be8ba9c99a2bab25}
ncalrpc         : OLED67D46C9255848EC676551EAFAA7
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 5932 at 0x5dd8080L>
64
['PolicyAgent']

Interfaces :
RPC  12345678-1234-abcd-ef00-0123456789ab (1.0) -- c:\windows\system32\ipsecsvc.dll
	0 -> RpcAddTransportFilter
	1 -> RpcDeleteTransportFilter
	2 -> RpcEnumTransportFilters
	3 -> RpcSetTransportFilter
	4 -> RpcGetTransportFilter
	5 -> RpcAddQMPolicy
	6 -> RpcDeleteQMPolicy
	7 -> RpcEnumQMPolicies
	8 -> RpcSetQMPolicy
	9 -> RpcGetQMPolicy
	10 -> RpcAddMMPolicy
	11 -> RpcDeleteMMPolicy
	12 -> RpcEnumMMPolicies
	13 -> RpcSetMMPolicy
	14 -> RpcGetMMPolicy
	15 -> RpcAddMMFilter
	16 -> RpcDeleteMMFilter
	17 -> RpcEnumMMFilters
	18 -> RpcSetMMFilter
	19 -> RpcGetMMFilter
	20 -> RpcMatchMMFilter
	21 -> RpcMatchTransportFilter
	22 -> RpcGetQMPolicyByID
	23 -> RpcGetMMPolicyByID
	24 -> RpcAddMMAuthMethods
	25 -> RpcDeleteMMAuthMethods
	26 -> RpcEnumMMAuthMethods
	27 -> RpcSetMMAuthMethods
	28 -> RpcGetMMAuthMethods
	29 -> RpcAddSAs
	30 -> RpcAddSAs
	31 -> RpcAddSAs
	32 -> RpcEnumMMSAs
	33 -> RpcDeleteMMSAs
	34 -> RpcDeleteQMSAs
	35 -> RpcQueryIKEStatistics
	36 -> RpcAddSAs
	37 -> RpcAddSAs
	38 -> RpcAddSAs
	39 -> RpcQueryIPSecStatistics
	40 -> RpcEnumQMSAs
	41 -> RpcAddTunnelFilter
	42 -> RpcDeleteTunnelFilter
	43 -> RpcEnumTunnelFilters
	44 -> RpcSetTunnelFilter
	45 -> RpcGetTunnelFilter
	46 -> RpcMatchTunnelFilter
	47 -> RpcOpenMMFilterHandle
	48 -> RpcCloseMMFilterHandle
	49 -> RpcOpenTransportFilterHandle
	50 -> RpcCloseTransportFilterHandle
	51 -> RpcOpenTunnelFilterHandle
	52 -> RpcCloseTunnelFilterHandle
	53 -> RpcEnumIpsecInterfaces
	54 -> RpcAddSAs
	55 -> RpcSetConfigurationVariables
	56 -> RpcGetConfigurationVariables
	57 -> RpcQuerySpdPolicyState
	58 -> RpcAddMMFilterEx
	59 -> RpcEnumMMFiltersEx
	60 -> RpcSetMMFilterEx
	61 -> RpcGetMMFilterEx
	62 -> RpcMatchMMFilterEx
	63 -> RpcOpenMMFilterHandleEx
	64 -> RpcAddTransportFilterEx
	65 -> RpcEnumTransportFiltersEx
	66 -> RpcSetTransportFilterEx
	67 -> RpcGetTransportFilterEx
	68 -> RpcMatchTransportFilterEx
	69 -> RpcOpenTransportFilterHandleEx
	70 -> RpcQueryRemoteFWRunning
Endpoints :
ncalrpc         : ipsec
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 5940 at 0x5dd8c50L>
64
['SSDPSRV']

Interfaces :
RPC  4b112204-0e19-11d3-b42b-0000f81feb9f (1.0) -- c:\windows\system32\ssdpsrv.dll
	0 -> _SSDPOpenRpc
	1 -> _SSDPCloseRpc
	2 -> RegisterServiceExRpc
	3 -> _DeregisterServiceRpc
	4 -> CleanupCacheRpc
	5 -> BeginSearchRpc
	6 -> GetSearchNotificationRpc
	7 -> CancelSearchRpc
	8 -> CloseSearchRpc
	9 -> EnableNotificationRpc
	10 -> _InitializeSyncHandle
	11 -> _RemoveSyncHandle
	12 -> RegisterNotificationRpc
	13 -> RegisterNotificationAsyncRpc
	14 -> _GetNotificationRpc
	15 -> _WakeupGetNotificationRpc
	16 -> DeregisterNotificationRpc
	17 -> SetICSInterfaces
	18 -> SetICSOff
	19 -> EnableFirewallRuleRpc
	20 -> DisableFirewallRuleRpc
Endpoints :
ncalrpc         : LRPC-5e723fcc225d082187
--------------------------------------------------------------------------------
<WinProcess "WmiPrvSE.exe" pid 5452 at 0x5dd8588L>
64

Interfaces :
RPC  e7a216af-1ec1-447f-8d3f-a87278db564d (1.0) -- C:\WINDOWS\system32\vmcompute.exe
	0 -> HcsRpc_EnumerateSystems
	1 -> HcsRpc_CreateSystem
	2 -> HcsRpc_OpenSystem
	3 -> HcsRpc_StartSystem
	4 -> HcsRpc_ShutdownSystem
	5 -> HcsRpc_TerminateSystem
	6 -> HcsRpc_PauseSystem
	7 -> HcsRpc_ResumeSystem
	8 -> HcsRpc_SaveSystem
	9 -> HcsRpc_GetSystemProperties
	10 -> HcsRpc_ModifySystem
	11 -> HcsRpc_AddSystemResource
	12 -> HcsRpc_ModifySystemResource
	13 -> HcsRpc_RemoveSystemResource
	14 -> HcsRpc_RegisterSystemNotifications
	15 -> HcsRpc_UnregisterSystemNotifications
	16 -> HcsRpc_QuerySystemNotification
	17 -> HcsRpc_CloseSystem
	18 -> HcsRpc_CreateProcess
	19 -> HcsRpc_OpenProcess
	20 -> HcsRpc_SignalProcess
	21 -> HcsRpc_GetProcessInfo
	22 -> HcsRpc_GetProcessProperties
	23 -> HcsRpc_ModifyProcess
	24 -> HcsRpc_RegisterProcessNotifications
	25 -> HcsRpc_UnregisterProcessNotifications
	26 -> HcsRpc_QueryProcessNotification
	27 -> HcsRpc_CloseProcess
	28 -> HcsRpc_GetServiceProperties
	29 -> HcsRpc_ModifyServiceSettings
Endpoints :
ncalrpc         : LRPC-4068c498fbc5b167b0
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 6888 at 0x5dd8b38L>
64
['hns']

Interfaces :
RPC  0767a036-0d22-48aa-ba69-b619480f38cb (1.0) -- c:\windows\system32\pcasvc.dll
	0 -> RAiMonitorProcess
	1 -> RAiSendToService
	2 -> RAiNotifyMsiInstall
	3 -> RAiLinkChildToParent
	4 -> RAiGetFileInfoFromPath
Endpoints :
ncalrpc         : LRPC-3dbea9ac2075148991
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 7148 at 0x5dd8dd8L>
64
['SharedAccess']

Interfaces :
RPC  e64b9aee-f372-4312-9a14-8f1502b5c8e3 (1.0) -- c:\windows\system32\ipnathlp.dll
	0 -> IpNatHlpRpcServerGetConnectedDevices
	1 -> IpNatHlpRpcServerStartSharing
	2 -> IpNatHlpRpcServerStopSharing
	3 -> IpNatHlpRpcServerStartDhcpServer
	4 -> IpNatHlpRpcServerStopDhcpServer
	5 -> IpNatHlpRpcServerUpdateSharingSettingsFromStorage
	6 -> V2IpNatHlpRpcServerStartSharingByInternalPrefix
	7 -> V2IpNatHlpRpcServerStopSharingByInternalPrefix
	8 -> V2IpNatHlpRpcServerStartDhcpServer
	9 -> V2IpNatHlpRpcServerStopDhcpServer
	10 -> V2IpNatHlpRpcServerStartDnsServer
	11 -> V2IpNatHlpRpcServerStopDnsServer
	12 -> V2IpNatHlpRpcServerEnumDhcpState
	13 -> V2IpNatHlpRpcServerEnumDnsState
	14 -> V2IpNatHlpRpcServerCreateStaticMapping
	15 -> V2IpNatHlpRpcServerDeleteStaticMapping
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-50c214ea8705fbab3a
ncalrpc         : OLE2DC3BB3BCF471E67CEF1904EADCD
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3436 at 0x5dd8f60L>
64
['nvagent']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 6992 at 0x5dd86d8L>
64
['TabletInputService']

Interfaces :
RPC  0497b57d-2e66-424f-a0c6-157cd5d41700 (1.0) -- c:\windows\system32\appinfo.dll
	0 -> RAiLaunchProcessWithIdentity
	1 -> RAiGetPackageActivationToken
	2 -> RAiFinishPackageActivation
	3 -> RAiEnsurePackageShutdown
RPC  201ef99a-7fa0-444c-9399-19ba84f12a1a (1.0) -- c:\windows\system32\appinfo.dll
	0 -> RAiLaunchAdminProcess
	1 -> RAiProcessRunOnce
	2 -> RAiLogonWithSmartCardCreds
	3 -> RAiOverrideDesktopPromptPolicy
	4 -> RAiDisableElevationForSession
	5 -> RAiEnableElevationForSession
	6 -> RAiForceElevationPromptForCOM
RPC  5f54ce7d-5b79-4175-8584-cb65313a0e98 (1.0) -- c:\windows\system32\appinfo.dll
	0 -> RAiGetTokenForCOM
RPC  fd7a0523-dc70-43dd-9b2e-9c5ed48225b1 (1.0) -- c:\windows\system32\appinfo.dll
	0 -> RAiGetTokenForMSI
RPC  58e604e8-9adb-4d2e-a464-3b0683fb1480 (1.0) -- c:\windows\system32\appinfo.dll
	0 -> RAiGetTokenForAxIS
Endpoints :
ncalrpc         : LRPC-2c336e65039e36772a
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 8844 at 0x5dd8f98L>
64
['TokenBroker']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "IAStorDataMgrSvc.exe" pid 9152 at 0x5dd82e8L>
32
['IAStorDataMgrSvc']
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "SgrmBroker.exe" pid 11100 at 0x5dd8390L>
64
['SgrmBroker']

Interfaces :
RPC  7a20fcec-dec4-4c59-be57-212e8f65d3de (1.0) -- C:\WINDOWS\system32\SgrmBroker.exe
	0 -> s_SgrmGetReport
	1 -> s_SgrmRegisterSense
	2 -> s_SgrmUnregisterSense
Endpoints :
ncalrpc         : SgrmRpc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 6612 at 0x5dd87f0L>
64
['wscsvc']

Interfaces :
RPC  be7f785e-0e3a-4ab7-91de-7e46e443be29 (0.0) -- c:\windows\system32\storsvc.dll
	0 -> SvcMountVolume
	1 -> SvcDismountVolume
	2 -> SvcFormatVolume
	3 -> SvcGetStorageInstanceCount
	4 -> SvcGetStorageDeviceInfo
	5 -> CCleanupPolicy::CleanupItem
	6 -> SvcResetPhone
	7 -> SvcRebootToFlashingMode
	8 -> SvcRebootToUosFlashing
	9 -> SvcFinalizeVolume
	10 -> SvcGetStorageSettings
	11 -> SvcResetStoragePolicySettings
	12 -> SvcSetStorageSettings
	13 -> SvcTriggerStorageCleanup
	14 -> SvcTriggerLowStorageNotification
	15 -> SvcMoveFileInheritSecurity
	16 -> SvcScanVolume
	17 -> SvcProcessStorageCardChange
	18 -> SvcProvisionForAppInstall
	19 -> SvcGetStorageInstanceCountForMaps
	20 -> SvcGetStoragePolicySettings
	21 -> SvcSetStoragePolicySettings
	22 -> SvcTriggerStoragePolicies
	23 -> SvcPredictStorageHealth
RPC  54b4c689-969a-476f-8dc2-990885e9f562 (0.0) -- c:\windows\system32\storsvc.dll
	0 -> SvcOpenStorageType
	1 -> SvcSelectStorageVolumeEx
	2 -> SvcSelectStorageVolume
	3 -> SvcFindNextStorageType
	4 -> SvcFindNextStorageTypeEx
	5 -> SvcCloseFindStorage
	6 -> SvcGetStorageDebugInfo
	7 -> SvcGetStorageExecutionInfo
	8 -> SvcGetTopFolders
	9 -> SvcFindNextStorageTypeExAsync
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-916a7dc50d8ab310bd
ncalrpc         : OLE2CDE8F840013580E84B91408DB75
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 13288 at 0x5dd82b0L>
64
['LicenseManager']

Interfaces :
RPC  98e96949-bc59-47f1-92d1-8c25b46f85c7 (1.0) -- C:\WINDOWS\system32\WLANExt.exe
	0 -> RpcDot11ExtIhvInitService
	1 -> RpcDot11ExtIhvDeinitService
	2 -> RpcDot11ExtIhvInitAdapter
	3 -> RpcDot11ExtIhvDeinitAdapter
	4 -> RpcDot11ExtIhvProcessSessionChange
	5 -> RpcDot11ExtIhvIsUIRequestPending
	6 -> RpcDot11ExtIhvPerformCapabilityMatch
	7 -> RpcDot11ExtIhvValidateProfile
	8 -> RpcDot11ExtIhvPerformPreAssociate
	9 -> RpcDot11ExtIhvAdapterReset
	10 -> RpcDot11ExtIhvCreateDiscoveryProfiles
	11 -> RpcDot11ExtIhvProcessUIResponse
	12 -> RpcDot11ExtIhvQueryUIRequest
	13 -> RpcDot11ExtIhvOnexIndicateResult
	14 -> RpcDot11ExtIhvControl
RPC  a111f1c6-5923-47c0-9a68-d0bafb577901 (1.0) -- C:\Windows\System32\NetSetupShim.dll
	0 -> RpcNetSetup_NotifyHost_Connect
	1 -> RpcNetSetup_NotifyHost_Disconnect
	2 -> RpcNetSetup_Isolation_ExecuteInfSection
	3 -> RpcNetSetup_NotifyObject_Load
	4 -> RpcNetSetup_NotifyObject_Unload
	5 -> RpcNetSetup_ComponentControl_Initialize
	6 -> RpcNetSetup_ComponentControl_ApplyChanges
	7 -> RpcNetSetup_ComponentControl_ApplyPnpChanges
	8 -> RpcNetSetup_ComponentControl_CancelChanges
	9 -> RpcNetSetup_ComponentSetup_Install
	10 -> RpcNetSetup_ComponentSetup_Upgrade
	11 -> RpcNetSetup_ComponentSetup_Removing
	12 -> RpcNetSetup_NotifyBinding_QueryBindingPath
	13 -> RpcNetSetup_NotifyBinding_NotifyBindingPath
	14 -> RpcNetSetup_NotifyGlobal_GetSupportedNotifications
	15 -> RpcNetSetup_NotifyGlobal_SysQueryBindingPath
	16 -> RpcNetSetup_NotifyGlobal_SysNotifyBindingPath
	17 -> RpcNetSetup_NotifyGlobal_SysNotifyComponent
Endpoints :
ncalrpc         : LRPC-88cce70afd054e6103
--------------------------------------------------------------------------------
<WinProcess "conhost.exe" pid 5808 at 0x5dd89e8L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 9728 at 0x5dd8eb8L>
64
['wlidsvc']

Interfaces :
RPC  cc105610-da03-467e-bc73-5b9e2937458d (1.0) -- c:\windows\system32\wlidsvc.dll
	0 -> WLIDPublishService
	1 -> WLIDUnpublishService
	2 -> WLIDResolveDevice
	3 -> WLIDResolveUser
	4 -> WLIDConnectIdentity
	5 -> WLIDUpdateConnectedIdentity
	6 -> WLIDCompleteConnect
	7 -> WLIDDisconnectIdentity
	8 -> WLIDCreateIdentity
	9 -> WLIDDeleteIdentity
	10 -> WLIDImportIdentity
	11 -> WLIDGetLocalDeviceName
	12 -> WLIDCreateContext
	13 -> WLIDCreateContextWithLogonId
	14 -> WLIDSetAuthData
	15 -> WLIDDeleteContext
	16 -> WLIDGetServiceConfig
	17 -> WLIDAcquireTokens
	18 -> WLIDUpdateToken
	19 -> WLIDAddOrDeleteColorSetCookie
	20 -> WLIDWatsonReport
	21 -> WLIDGetCachedTokens
	22 -> WLIDGetExtendedError
	23 -> WLIDGetUserExtendedProperty
	24 -> WLIDSetUserExtendedProperty
	25 -> WLIDGetIdentityProperty
	26 -> WLIDSetOptions
	27 -> WLIDEnumIdentities
	28 -> WLIDHasPersistedCredential
	29 -> WLIDPersistCredential
	30 -> WLIDPersistCredentialForConnectedUser
	31 -> WLIDRemovePersistedCredential
	32 -> WLIDVerifyAssertion
	33 -> WLIDGetDeviceId
	34 -> WLIDProvisionDeviceId
	35 -> WLIDGetDeviceIdEx
	36 -> WLIDRenewDeviceId
	37 -> WLIDDeProvisionDeviceId
	38 -> WLIDEnumDevices
	39 -> WLIDAssociateDeviceToUser
	40 -> WLIDDisassociateDeviceFromUser
	41 -> WLIDEnumerateUserAssociatedDevices
	42 -> WLIDUpdateUserAssociatedDeviceProperties
	43 -> WLIDCreateContextForLinkedIdentity
	44 -> WLIDAddUserToSsoGroup
	45 -> WLIDGetUsersFromSsoGroup
	46 -> WLIDRemoveUserFromSsoGroup
	47 -> WLIDGetAuthError
	48 -> WLIDGetDeviceShortLivedToken
	49 -> WLIDGetHIPChallenge
	50 -> WLIDSetHIPSolution
	51 -> WLIDSetDefaultUserForTarget
	52 -> WLIDGetDefaultUserForTarget
	53 -> WLIDIsKioskMode
	54 -> WLIDGetConfigString
	55 -> WLIDGetSvcEnvironment
	56 -> WLIDGetIdName
	57 -> WLIDGetConfigDWORDValue
	58 -> WLIDGetUserPropertiesFromSystemStore
	59 -> WLIDSetUserPropertiesToSystemStore
	60 -> WLIDInitializeEx
	61 -> WLIDEnableTrace
	62 -> WLIDDisableTrace
	63 -> WLIDGetOneTimeCredential
	64 -> WLIDGetIssuerCertificate
	65 -> WLIDCreateContextWithChallenge
	66 -> WLIDGetDefaultUserForTargetEx
	67 -> WLIDSendOneTimeCode
	68 -> WLIDGetUserPropertiesFromHandle
	69 -> WLIDGetKeyLatest
	70 -> WLIDGetKeyWithVersion
	71 -> WLIDGetOpenHandlesData
	72 -> WLIDGetSignedTokens
	73 -> WLIDGetDeviceDAToken
	74 -> WLIDGetProofOfPossessionTokens
	75 -> WLIDRegisterUserIdkey
	76 -> WLIDUpdateDeviceLicenseInfo
	77 -> WLIDManageApprover
	78 -> WLIDListSessions
	79 -> WLIDApproveSession
	80 -> WLIDGetScenarioInlineUrlWithContextData
	81 -> WLIDGetInlineUrlContextData
	82 -> WLIDAcquireTokensWithNGC
	83 -> WLIDGetTotpCode
	84 -> WLIDCleanupIdentity
	85 -> WLIDGetAppData
RPC  faf2447b-b348-4feb-8dbe-beee5b7f7778 (1.0) -- c:\windows\system32\wlidsvc.dll
	0 -> RenewCertificate
RPC  572e35b4-1344-4565-96a1-f5df3bfa89bb (1.0) -- c:\windows\system32\wlidsvc.dll
	0 -> WLIDNCreateContext
	1 -> WLIDNDeleteContext
	2 -> WLIDNGetNextNotification
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-a88769e55cac7e04eb
ncalrpc         : liveidsvcnotify
ncalrpc         : OLE843CCE9586FB30A70A5793E2BFE5
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 11728 at 0x5dd8828L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "winlogon.exe" pid 1324 at 0x5dd8278L>
64

Interfaces :
RPC  76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\WINDOWS\System32\WinLogon.exe
	0 -> I_WMsgkSendMessage
	1 -> I_WMsgSendPSPMessage
RPC  76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\WINDOWS\System32\WinLogon.exe
	0 -> I_WMsgSendMessage
	1 -> I_WMsgSendPSPMessage
	2 -> I_WMsgSendNotifyMessage
	3 -> I_WMsgSendReconnectionUpdateMessage
RPC  12e65dd8-887f-41ef-91bf-8d816c42c2e7 (1.0) -- C:\WINDOWS\System32\WinLogon.exe
	0 -> WlSecureDesktoprPromptingRequest
	1 -> WlSecureDesktoprConfirmationRequest
	2 -> WlSecureDesktoprCredmanBackupRequest
	3 -> WlSecureDesktoprCredmanRestoreRequest
	4 -> WlSecureDesktoprSimulateSAS
Endpoints :
ncalrpc         : WMsgKRpc01841F46E2
--------------------------------------------------------------------------------
<WinProcess "fontdrvhost.exe" pid 5920 at 0x5dd8198L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "dwm.exe" pid 3952 at 0x5dd81d0L>
64

Interfaces :
RPC  9d420415-b8fb-4f4a-8c53-4502ead30ca9 (1.0) -- C:\WINDOWS\System32\PlaySndSrv.dll
	0 -> I_PlaySoundkPostMessage
RPC  cad784cb-4c1b-4d96-b8f7-4716b568b13c (1.0) -- C:\WINDOWS\system32\wininet.dll
	0 -> s_UrlCacheGetManagerInterface
	1 -> StaticProxyResolver::CancelAll
	2 -> s_UrlCacheOpenContainer
	3 -> s_UrlCacheCloseContainer
	4 -> s_UrlCacheSetContainerEntryMaximumAge
	5 -> s_UrlCacheAddUrl
	6 -> s_UrlCacheLookupUrl
	7 -> s_UrlCacheCheckUrlsExist
	8 -> s_UrlCacheGetUrlBinaryBlob
	9 -> s_UrlCacheAddUrlBinaryBlob
	10 -> s_UrlCacheDeleteUrl
	11 -> s_UrlCacheUnlockUrl
	12 -> s_UrlCacheUpdateUrl
	13 -> s_UrlCacheEntryEnum
	14 -> s_UrlCacheEntryEnumClose
	15 -> s_UrlCacheEntryEnumNext
	16 -> s_UrlCacheCleanupUrls
	17 -> s_UrlCacheCleanupHttpsUrls
	18 -> s_UrlCacheGetSize
	19 -> s_UrlCacheGetLimit
	20 -> s_UrlCacheSetLimit
	21 -> s_UrlCacheGetCrossContainerContentTotalSizeAndLimit
	22 -> s_UrlCacheCleanupCrossContainers
	23 -> s_UrlCacheGetBloomFilter
	24 -> s_UrlCacheReleaseBloomFilter
	25 -> s_UrlCacheGetNextDirectory
	26 -> s_UrlCacheAddLeakFile
	27 -> s_UrlCacheCreateGroup
	28 -> s_UrlCacheDeleteGroup
	29 -> s_UrlCacheGetGroupIds
	30 -> s_UrlCacheGetGroup
	31 -> s_UrlCacheUpdateGroup
	32 -> s_UrlCacheSetUrlGroup
	33 -> s_UrlCacheGetContentContainerDirectories
	34 -> s_UrlCacheCreateExtensibleContainer
	35 -> s_UrlCacheDeleteExtensibleContainer
	36 -> s_UrlCacheGetExtensibleContainersList
	37 -> s_UrlCacheRpcSetGlobalLimit
	38 -> s_UrlCacheRpcGetGlobalLimit
	39 -> s_UrlCacheRpcReloadSettings
	40 -> s_UrlCacheGetGlobalCounters
	41 -> s_AppCacheOpenContainer
	42 -> s_AppCacheCloseContainer
	43 -> s_AppCacheRpcCheckManifest
	44 -> s_AppCacheRpcLookup
	45 -> s_AppCacheRpcDeleteGroup
	46 -> s_AppCacheRpcDeleteIeGroup
	47 -> s_AppCacheRpcGetFallbackUrl
	48 -> s_AppCacheRpcGetDownloadList
	49 -> s_AppCacheRpcCloseHandle
	50 -> s_AppCacheRpcInvalidate
	51 -> s_AppCacheRpcGetInfo
	52 -> s_AppCacheRpcGetGroupsList
	53 -> s_AppCacheRpcFreeSpace
	54 -> s_AppCacheRpcGetIeGroupList
	55 -> s_AppCacheRpcFreeIeSpace
	56 -> s_AppCacheRpcRetrieveUrl
	57 -> s_AppCacheRpcCommitUrl
	58 -> s_AppCacheRpcUpdateExtraData
	59 -> s_AppCacheRpcFinalize
	60 -> s_DependencyStoreOpenContainer
	61 -> s_DependencyStoreCloseContainer
	62 -> s_DependencyStoreUpdateUrl
	63 -> s_DependencyStoreRetrieveUrl
	64 -> s_DependencyStoreDeleteContainer
	65 -> s_HstsOpenContainer
	66 -> s_HstsCloseContainer
	67 -> s_HstsGetHstsEntries
	68 -> s_HstsSetHstsEntries
	69 -> s_HstsPurgeContainer
	70 -> s_CookieOpenContainer
	71 -> s_CookieCloseContainer
	72 -> s_CookieGetCookies
	73 -> s_CookieGetAllCookies
	74 -> s_CookieUpdateCookies
	75 -> s_CookiePurgeContainer
	76 -> s_BlobOpenContainer
	77 -> s_BlobCloseContainer
	78 -> s_BlobGetEntries
	79 -> s_BlobGetEntry
	80 -> s_BlobSetEntry
	81 -> s_BlobDeleteEntry
	82 -> s_BlobPurgeContainer
Endpoints :
ncalrpc         : PlaySoundKRpc2
ncalrpc         : webcache_{031b98cf-4a69-4c31-ab42-fd9b3c199407}_S-1-5-21-4215984009-642367717-812980365-1001
--------------------------------------------------------------------------------
<WinProcess "SynTPEnh.exe" pid 6452 at 0x5dd8160L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "igfxEM.exe" pid 11140 at 0x5dd8be0L>
64

Interfaces :
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  de8ed432-fd92-47a6-9c73-738c7b466c69 (0.0) -- IAppReadinessTaskCallback
OLE  76c0dbbb-15e0-4e7b-b61b-20eeea2001e0 (0.0) -- IAccPropServer
OLE  00000160-0000-0000-c000-000000000046 (0.0) -- IPrivDragDrop
OLE  eb9d0454-25db-5620-98b8-be4c5d0dbc67 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserChangedEventArgs]
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
OLE  8b14e88b-5663-4caf-b196-c31479262831 (0.0) -- IImmersiveApplication
OLE  cb728b20-f786-11ce-92ad-00aa00a74cd0 (0.0) -- IProfferService
OLE  6d5140c1-7436-11ce-8034-00aa006009fa (0.0) -- IServiceProvider
OLE  7702e77c-66f6-479b-af2b-e316cff5f814 (0.0) -- IAsyncCallbackDispatcher
OLE  000214e3-0000-0000-c000-000000000046 (0.0) -- IShellView
OLE  00000114-0000-0000-c000-000000000046 (0.0) -- IOleWindow
OLE  cd17328b-e4ef-4215-a92d-62a914658f82 (0.0) -- IObjectWithCachedState
OLE  d1b9407f-a351-5319-bce5-178ee5585391 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CShell__CViewManagerInterop__CIViewWrapper_Windows__CInternal__CShell__CViewManagerInterop__CIViewEventArgs
OLE  b755e6e0-b048-49cc-8911-11a041216f5f (0.0) -- IApplicationStateChangeHandler
OLE  940c223d-5bdc-49db-968c-e4f3ef9b9270 (0.0) -- IImmersiveMonitorNotification
OLE  727f9e97-76ee-497b-a942-b6371328485c (0.0) -- IApplicationViewChangeListener
OLE  ea8a389b-437d-4791-aa14-5dca004bc92a (0.0) -- IAsyncCallback
OLE  6592b66a-4a51-5ccc-82c5-9042acf93a44 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CShell__CExperience__CShellExperienceDispatcher_Windows__CInternal__CShell__CExperience__CIShellExperienceViewStateChangedEventArgs
OLE  1b7781cd-1b97-4728-8b6e-67a7e55cc53c (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIPeopleBarFlyoutExperienceManager
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  ab65b025-ff88-470a-9513-b62bcd7ce879 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIPeopleBarJumpViewExperienceManager
OLE  8667db0d-6960-465f-b9a4-c461863efa91 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIShoulderTapExperienceManager
OLE  df65db57-d504-456e-8bd7-004ce308d8d9 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIActionCenterExperienceManager
OLE  87324ffd-bd0a-4de8-840a-b60e345a336f (0.0) -- ISettingsFlowController
OLE  90adbab9-cdb8-43dd-8daa-ba1180be5215 (0.0) -- IMultitaskingViewServiceProvider
OLE  103231ae-04cb-4e5e-b63d-e3ce47cd0f0a (0.0) -- IImmersiveAppCrusher
OLE  373e56cf-0a1b-4b4a-a1a4-a46b25ffd7e3 (0.0) -- ITabletModeViewManager
OLE  fff59320-db70-4865-8fed-8b502d692f12 (0.0) -- ISnapServiceProvider
OLE  6a5e657d-223a-4875-838b-c311ed73523b (0.0) -- IImmersiveLayoutChanges
OLE  6584ce6b-7d82-49c2-89c9-c6bc02ba8c38 (0.0) -- IAppVisibilityEvents
OLE  00000001-0000-0000-c000-000000000046 (0.0) -- IClassFactory
OLE  e87e2bc9-ec45-4ddb-95e1-b275d66cbeaa (0.0) -- IApplicationPreLaunch
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
OLE  537b455d-1240-433b-82af-10929138b8be (0.0) -- IMultitaskingViewManager
OLE  a5322dff-9ebc-5df1-953d-0237cea8614b (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CStateRepository__CPrimaryTileUserNotifier_Windows__CInternal__CStateRepository__CPrimaryTileUserChangedEventArgs
OLE  ccb96d97-791c-5741-8f33-fb7266d6ea33 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CStateRepository__CSecondaryTileUserNotifier_Windows__CInternal__CStateRepository__CSecondaryTileUserChangedEventArgs
OLE  6e6c3c52-5a5e-4b4b-a0f8-7fe12621a93e (0.0) -- IEdgeUiManager
OLE  bcf1f74f-2413-46b3-8707-ec2fca11965d (0.0) -- IImmersiveLauncherTrayNotify
OLE  5090de35-ed23-43be-9714-586c5041026a (0.0) -- IHolographicViewTransitionNotificationService
OLE  d8d60399-a0f1-f987-5551-321fd1b49864 (0.0) -- IImmersiveLauncher
OLE  c50898f6-c536-5f47-8583-8b2c2438a13b (0.0) -- Windows.Foundation.IEventHandler<IInspectable>
OLE  99fc44e3-ce9a-4284-bf04-76331d1b1788 (0.0) -- __x_Windows_CApplicationModel_CActivation_CIInitializeActivatedEventArgs
OLE  cf651713-cd08-4fd8-b697-a281b6544e2e (0.0) -- __x_Windows_CApplicationModel_CActivation_CIActivatedEventArgs
OLE  7ca84d06-f54c-4ba8-bd6f-9abaf9380d51 (0.0) -- __x_Windows_CApplicationModel_CActivation_CIMultiviewActivationProperties
OLE  0c44717b-19f7-48d6-b046-cf22826eaa74 (0.0) -- __x_Windows_CApplicationModel_CActivation_CIPrelaunchActivatedEventArgs
OLE  fbc93e26-a14a-4b4f-82b0-33bed920af52 (0.0) -- __x_Windows_CApplicationModel_CActivation_CILaunchActivatedEventArgs
OLE  9767060c-9476-42e2-8f7b-2f10fd13765c (0.0) -- IImmersiveShellBroker
OLE  fec0a504-8e6c-40ff-8a92-f7d693afdcf0 (0.0) -- IShellExperienceBroker
OLE  99e01be7-d840-6dfb-694f-8814c2ec727e (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIStartExperienceBroker
OLE  a16f3786-6cb0-4258-a21e-d949edaa7a18 (0.0) -- IApplicationGlomBroker
OLE  796be4b3-0fb1-415d-9984-0bc8b72e5fa2 (0.0) -- IFullScreenBroker
OLE  988881d6-4fa0-4554-86b0-25911104973a (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIStartUserInfoBroker
OLE  905a0fe1-bc53-11df-8c49-001e4fc686da (0.0) -- __x_Windows_CFoundation_CIByteSeeker
OLE  bb94daad-7836-4d62-9557-2a7b83839b7b (0.0) -- ISafeSaveHandleManager
OLE  f4ee3175-aba2-4df7-b53c-93c4e4e2b0a3 (0.0) -- IRefCountedClosable
OLE  5e0ebc87-bece-4f2a-8d36-3673758f6c55 (0.0) -- IFileHandle
OLE  fa9812c4-0b34-47d0-9b0b-157fb5b5fdf2 (0.0) -- IDuplicateHandleProvider
OLE  04c2542d-3c28-4510-a0c0-8db0e0a3a526 (0.0) -- IDuplicateHandleProvider2
OLE  68766f36-3808-42f9-a18f-0abde6391172 (0.0) -- IAdviseOplockCallback
OLE  2e8fcb18-a0ee-41ad-8ef8-77fb3a370ca5 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIShellExperienceManagerFactory
OLE  599db028-e1d3-433d-9f90-32468634d59e (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIInputDialExperienceManager
OLE  13c6456c-c8eb-4f83-91b8-9d425f546210 (0.0) -- INotificationControllerDataSink
OLE  85cb6900-4d95-11cf-960c-0080c7f4ee85 (0.0) -- IShellWindows
OLE  00020400-0000-0000-c000-000000000046 (0.0) -- IDispatch
OLE  71538e01-5877-4d2d-ac1a-ff42b6da910d (0.0) -- IWpnSettingCallback
OLE  1ec5d3ef-a8bf-4311-9eeb-33ba50f461fe (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIBaseExperienceManager
OLE  3c4367fa-99ac-52c0-964d-0dcd1a9ba729 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CShell__CExperience__CIBaseExperienceManager_Windows__CInternal__CShell__CExperience__CIVisibilityChangedEventArgs
OLE  7ab93c52-0e48-4750-ba9d-1a4113981847 (0.0) -- IToastNotificationManagerStatics2
OLE  5caddc63-01d3-4c97-986f-0533483fee14 (0.0) -- IToastNotificationHistory
OLE  d133ce13-3537-48ba-93a7-afcd5d2053b4 (0.0) -- ITrayNotify
OLE  71ba143f-598e-49d0-84eb-8febaedcc195 (0.0) -- INetworkStatusChangedEventHandler
OLE  af581601-f71a-4a31-8f8d-91f7df79371f (0.0) -- __x_SharedStartModel_CIStartLayoutInitializationStatics
OLE  1bf3dc4c-07a0-4f3f-87f8-5a625cd2e7ad (0.0) -- IImmersiveAppCrusherNotification
OLE  76bb2cfb-c246-41ec-b9c3-671e5347cf51 (0.0) -- IHolographicViewTransitionNotification
OLE  c092cc2f-5eca-5a5d-9c9c-f050e892dd97 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountAddedEventArgs
OLE  dc8b9f35-216c-54ff-99db-cd7e04c6a074 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountChangedEventArgs
OLE  104e5d12-179f-597c-80ce-18627ceeb8b6 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountDeletePendingEventArgs
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
OLE  000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
OLE  27354133-7f64-5b0f-8f00-5d77afbe261e (0.0) -- IDiscRecorder2
OLE  27354132-7f64-5b0f-8f00-5d77afbe261e (0.0) -- IDiscRecorder2Ex
OLE  27354153-9f64-5b0f-8f00-5d77afbe261e (0.0) -- IDiscFormat2Data
OLE  e716b283-6be7-4e6f-a88f-1cde47d5e355 (0.0) -- IWpnPresentationTileSink
OLE  78c8b458-dd5a-4f32-9d8b-d45a19ae9e1f (0.0) -- IActiveZBandNotificationForMonitor
OLE  0000000c-0000-0000-c000-000000000046 (0.0) -- IStream
OLE  bfb02fed-4c71-40e1-b4f3-ce99c2ff0542 (0.0) -- IObjectWithFileHandle
OLE  c179334c-4295-40d3-bea1-c654d965605a (0.0) -- IVirtualDesktopNotification
OLE  2c1448e1-7540-41b2-9b0d-188c012da2f1 (0.0) -- IShellTargetingChangeNotification
OLE  000214e6-0000-0000-c000-000000000046 (0.0) -- IShellFolder
OLE  000214ea-0000-0000-c000-000000000046 (0.0) -- IPersistFolder
OLE  0000010c-0000-0000-c000-000000000046 (0.0) -- IPersist
OLE  321a6a6a-d61f-4bf3-97ae-14be2986bb36 (0.0) -- IObjectWithBackReferences
OLE  1ac3d9f0-175c-11d1-95be-00609797ea4f (0.0) -- IPersistFolder2
OLE  e014d578-d95e-4757-bffb-3bda010fe68a (0.0) -- IAutomaticDestinationList2
OLE  5632b1a4-e38a-400a-928a-d4cd63230295 (0.0) -- IObjectCollection
OLE  49a07732-e7b8-5c5b-9de7-22e33cb97004 (0.0) -- __FIEventHandler_1_Windows__CApplicationModel__CActivation__CBackgroundActivatedEventArgs
OLE  4f9c5cec-0197-49fe-b800-0d5a72a6c505 (0.0) -- IUiaWindowNotifierCallback
OLE  2dbdba9d-20da-519d-9078-09f835bc5bc7 (0.0) -- ITypedEventHandler<UISettings,IInspectable>
OLE  d4351e8c-208e-4c24-88ac-6e2add5f4bb1 (0.0) -- IApplicationViewBroker
OLE  2166ee67-71df-4476-8394-0ced2ed05274 (0.0) -- IInputHostManagerBroker
OLE  50ac103f-d235-4598-bbef-98fe4d1a3ad4 (0.0) -- IToastNotificationManagerStatics
OLE  75927b93-03f3-41ec-91d3-6e5bac1b38e7 (0.0) -- IToastNotificationManager
OLE  04124b20-82c6-4229-b109-fd9ed4662b53 (0.0) -- IToastNotificationFactory
OLE  a3fa4101-4713-4f91-a8f1-93a4573ec5a7 (0.0) -- IWpnNotification
OLE  bebf1b6f-4d08-4e3e-9902-a256a285c970 (0.0) -- ITransientNotificationDetails
OLE  4f38fd3e-2c10-4c00-9ec1-62bd536a1feb (0.0) -- IWpnToastFeedback
OLE  35176862-cfd4-44f8-ad64-f500fd896c3b (0.0) -- IToastFailedEventArgs
OLE  95e3e803-c969-5e3a-9753-ea2ad22a9a33 (0.0) -- ITypedEventHandler_2_Windows__CUI__CNotifications__CToastNotification_Windows__CUI__CNotifications__CToastFailedEventArgs
OLE  a7052211-8b56-43c4-8f26-12852f7303a3 (0.0) -- INowPlayingSessionManager
OLE  22ba7cc0-8e75-484f-844e-0b6d74105413 (0.0) -- IGlobalRudeWindowNotifications
OLE  b722bccb-4e68-101b-a2bc-00aa00404770 (0.0) -- IOleCommandTarget
OLE  7154c95d-c519-49bd-a97e-645bbfabe111 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CITrayMtcUvcFlyoutExperienceManager
OLE  8cecdf70-ced8-5bc7-84a7-d80615fedcdd (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CShell__CViewManagerInterop__CIClientWindowState_Windows__CInternal__CShell__CViewManagerInterop__CIClientWindowReadyForPresentationChangedEventArgs
OLE  0c40987c-7026-499e-adad-c164c0ffee84 (0.0) -- IActiveZBandNotification
OLE  8d4d1ec2-4740-4fc5-b4b1-6dc3722a2eeb (0.0) -- ILightDismissNotification
OLE  a5cd92ff-29be-454c-8d04-d82879fb3f1b (0.0) -- IVirtualDesktopManager
OLE  b196b284-bab4-101a-b69c-00aa00341d07 (0.0) -- IConnectionPointContainer
OLE  b196b286-bab4-101a-b69c-00aa00341d07 (0.0) -- IConnectionPoint
OLE  50a87baa-5f79-4c31-b6b3-28f6f2d097e6 (0.0) -- IExplorerHost
OLE  9c4960d4-7626-4e13-beec-1adad82ff5a0 (0.0) -- IThreadUndoManager
OLE  d001f200-ef97-11ce-9bc9-00aa00608e01 (0.0) -- IOleUndoManager
OLE  f2153260-232e-4474-9d0a-9f2ab153441d (0.0) -- IVerbStateTaskCallBack
OLE  35bd3360-1b35-4927-bae4-b10e70d99eff (0.0) -- IFrameTaskManager
OLE  cde725b0-ccc9-4519-917e-325d72fab4ce (0.0) -- IFolderView
OLE  76542021-fff8-43f3-acbd-bb46a60a94ca (0.0) -- IExplorerFrame
OLE  f66724ea-ae8f-41a2-b3f3-3d6581ea891c (0.0) -- IRibbonTabsetCallBack
OLE  b3a4b685-b685-4805-99d9-5dead2873236 (0.0) -- IParentAndItem
OLE  ef01eb89-5a19-42cb-bc8c-f10ed6c6791b (0.0) -- ISyncIntegrationManager
OLE  0002df05-0000-0000-c000-000000000046 (0.0) -- IWebBrowserApp
OLE  00000122-0000-0000-c000-000000000046 (0.0) -- IDropTarget
OLE  fc992f1f-debb-4596-b355-50c7a6dd1222 (0.0) -- IWaitCursorManager
OLE  0000010e-0000-0000-c000-000000000046 (0.0) -- IDataObject
OLE  00000103-0000-0000-c000-000000000046 (0.0) -- IEnumFORMATETC
OLE  1aba2312-77b6-44d7-b975-cce3f3d3fb2f (0.0) -- ISyncStatusProvider
OLE  ad6db2cf-0c8d-438b-b25d-9a9a82903b2b (0.0) -- IWindow
OLE  1b988c32-1bc7-52fa-83ba-0b97e79c878b (0.0) -- IAsyncOperationCompletedHandler<AppReputationResult>
OLE  7724f749-b79e-42a0-aa9e-878b498f26ec (0.0) -- IWsDocumentUpdate
OLE  a4ed5c81-76c9-40bd-8be6-b1d90fb20ae7 (0.0) -- IAsyncActionCompletedHandler
OLE  58a98b87-ed3c-4e12-b5df-c72bf4470aee (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIJumpViewExperienceManager
OLE  28536166-c75b-5df1-99ca-96967f7d999a (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CShell__CExperience__CJumpViewExperienceManager_Windows__CInternal__CShell__CExperience__CJumpViewExperienceEventArgs
OLE  6d5174ec-f425-4cd9-8643-cf36042987f1 (0.0) -- IOperationStatusService
OLE  4ae7498c-e1c0-475f-8573-41c26127c5d8 (0.0) -- IOperationStatusTile
OLE  000214e2-0000-0000-c000-000000000046 (0.0) -- IShellBrowser
OLE  831d1dff-7f57-4720-87e4-cb57d6214428 (0.0) -- IInvocationLocation
OLE  9536ca39-1acb-4ae6-ad27-2403d04ca28f (0.0) -- IShellItemBrowser
OLE  8f45ef43-0585-4881-a90d-f55d35ce7797 (0.0) -- IOperationInterrupt
OLE  6faf1156-8855-47b5-bdc8-4555d13c095f (0.0) -- IConflictInterrupt
OLE  c7c67cb1-44ae-4e71-9e69-2c92f8d732fc (0.0) -- IConflictItemDataCallback
OLE  b1604325-6b59-427b-bf1b-80a2db02d3d8 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CITrayClockFlyoutExperienceManager
OLE  d597bab3-5b9f-11d1-8dd2-00aa004abd5e (0.0) -- ISensLogon
OLE  c853771a-f336-4cf8-9a27-1570293ab52d (0.0) -- ILockScreenDirectorServiceProvider
OLE  6119bcc6-cac2-4d37-9bbf-76a34697e7fb (0.0) -- ILockScreenDirector
OLE  a2aa05aa-47af-4b4a-8e77-6cd6efe35cda (0.0) -- ILockScreenDirectorPrivate
OLE  c59766f7-d190-4f69-a822-05ca45b201e7 (0.0) -- ILockAppHost
OLE  a40cce11-67ee-4e74-8c46-91edb265261c (0.0) -- __x_Windows_CInternal_CShell_CExperience_CILockScreenExperienceManager
OLE  0689ac07-5db1-488b-bc6d-9dfbc2cf7911 (0.0) -- ILockAppHostSafeguard
OLE  a340ae45-86bf-4c9c-b6c8-6109ca1e2f29 (0.0) -- IImmersiveSessionIdleDetector
OLE  985c98a3-21f6-4585-9e13-f708cb0de4f2 (0.0) -- IImmersiveSessionIdleNotification
OLE  72163aa1-8a18-436a-9067-3a86aa7460dc (0.0) -- ILockAppHostShellInterop
OLE  053bf212-5a22-4a75-87eb-dfca4ea90e02 (0.0) -- ILockScreenViewManager
OLE  989e63bd-43c5-4815-b192-2251e9a6e452 (0.0) -- ILockScreenViewManagerNotificationCallback
OLE  7c7a3e75-4362-4d12-860d-68ee72909f83 (0.0) -- IImmersiveMonitorNotificationService
OLE  ce2ad461-c28a-4db3-b9d7-b7d8f6865657 (0.0) -- ILockAppHostEndpoint
OLE  3721d4ef-bca1-418a-98e2-ec3def272b2f (0.0) -- IAboveLockActivationManager
OLE  dcb00007-570f-4a9b-8d69-199fdba5723b (0.0) -- INetworkConnectionEvents
OLE  dcb00004-570f-4a9b-8d69-199fdba5723b (0.0) -- INetworkEvents
OLE  dcb00009-570f-4a9b-8d69-199fdba5723b (0.0) -- INetworkCostManagerEvents
OLE  880b26f8-9197-43d0-8045-8702d0d72000 (0.0) -- IImmersiveMonitor
OLE  fc413902-2a24-4522-ad1f-2d27c0ffee84 (0.0) -- IDesktopVisibilityChangesNotification
OLE  5ef7890f-319b-4259-8d0f-36e5ff0916ce (0.0) -- IImmersiveLauncherCortana
OLE  016f611a-b360-4768-8b28-6779ddfde2e0 (0.0) -- 
OLE  6ee8a11f-f5f0-4feb-8b78-a69aaa8a2a6a (0.0) -- IUpFrontConfirmation
OLE  47e7bb4d-2d83-4604-905c-0ee8eab077a4 (0.0) -- IConfirmationInterrupt
OLE  55272a00-42cb-11ce-8135-00aa004bb851 (0.0) -- IPropertyBag
OLE  9d923edc-b7a9-4f77-9933-284e7e2b2536 (0.0) -- IObjectWithOpenWithFlags
OLE  fc4801a3-2ba9-11cf-a229-00aa003d7352 (0.0) -- IObjectWithSite
OLE  1af3a467-214f-4298-908e-06b03e0b39f9 (0.0) -- IFolderView2
OLE  667708d1-a931-4a85-9999-609eaa7dd85a (0.0) -- ILocalCopyDownloadSettings
OLE  4d4c1e64-e410-4faa-bafa-59ca069bfec2 (0.0) -- IImmersiveMonitorManager
OLE  d770b2ad-8f5e-4b8e-b3df-f05a2ab5287c (0.0) -- IImmersiveLayout
OLE  b849acb5-8ac5-4fb8-88b6-55c749d25a44 (0.0) -- ILightDismissProvider
OLE  bf63999f-7411-40da-861c-df72c0ffee84 (0.0) -- IImmersiveApplicationManager
OLE  405444d2-baa5-48ed-abfe-a673f70be863 (0.0) -- IAltTabViewHost
OLE  c59a7a3c-0676-4526-8192-5d0bf9b89b95 (0.0) -- IMultitaskingViewVisibilityNotification
OLE  ff62716a-0bd0-4105-a6ec-83b09d864267 (0.0) -- IShellPositionerManager
OLE  95e1216b-c9d8-4d0c-aa1b-19a86de9aa5b (0.0) -- IShellPositionerProxy
OLE  2ad63a67-f12f-4bd7-b1bf-6213290a552a (0.0) -- IUIAutomationCrossThreadRelease
OLE  f7041e23-1a6c-41bb-89b2-b3425c51ccd5 (0.0) -- IExplorerWindowManager
OLE  00000135-0000-0000-c000-000000000046 (0.0) -- IInterfaceFromWindowProp
OLE  3d8b0590-f691-11d2-8ea9-006097df5bd4 (0.0) -- IDataObjectAsyncCapability
OLE  93f2f68c-1d1b-11d3-a30e-00c04f79abd1 (0.0) -- IShellFolder2
OLE  cef04fdf-fe72-11d2-87a5-00c04f6837cf (0.0) -- IPersistFolder3
OLE  0000000e-0000-0000-c000-000000000046 (0.0) -- IBindCtx
OLE  8a4427de-b11b-4a61-8977-844a3a7bc63b (0.0) -- IJumpViewExecuteHelper
OLE  b3e7c340-ef97-11ce-9bc9-00aa00608e01 (0.0) -- IEnumOleUndoUnits
OLE  31e4fa78-02b4-419f-9430-7b7585237c77 (0.0) -- IFrameManager
OLE  b92b56a9-8b55-4e14-9a89-0199bbb6f93b (0.0) -- IDesktopWallpaper
OLE  4473e3a7-c2ad-4075-a1f8-935a584740a9 (0.0) -- IStateEvents
OLE  dcb07fdc-3bb5-451c-90be-966644fed7b0 (0.0) -- INewMenuClient
OLE  538317c5-5bad-4847-962d-42da294f5e0a (0.0) -- IHolographicViewManager
OLE  4fda780a-acd2-41f7-b4f2-ebe674c9bf2a (0.0) -- ITabletModeController
OLE  dcf1427b-9f2f-4bb5-8aa2-ec625e2b2082 (0.0) -- IJumpViewContextMenuWrapper
Endpoints :
ncalrpc         : OLE6540C7DFAE33DDD8108A8FDE0EE7
--------------------------------------------------------------------------------
<WinProcess "SynTPHelper.exe" pid 1892 at 0x5dd85f8L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "ClassicStartMenu.exe" pid 1900 at 0x5dd89b0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "ShellExperienceHost.exe" pid 2852 at 0x5dd8ba8L>
64

Interfaces :
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\Windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  92696c00-7578-48e1-ac1a-2ca909e2c8cf (0.0) -- __x_Windows_CApplicationModel_CCore_CIActivatableApplication
OLE  638bb2db-451d-4661-b099-414f34ffb9f1 (0.0) -- __x_Windows_CApplicationModel_CCore_CICoreApplicationView
OLE  49a07732-e7b8-5c5b-9de7-22e33cb97004 (0.0) -- __FIEventHandler_1_Windows__CApplicationModel__CActivation__CBackgroundActivatedEventArgs
OLE  2e5500b6-66ad-467f-abb5-022a64283d88 (0.0) -- __x_Windows_CApplicationModel_CCore_CICoreApplicationViewInternal
OLE  4f9c5cec-0197-49fe-b800-0d5a72a6c505 (0.0) -- IUiaWindowNotifierCallback
OLE  abadfe7f-04c1-4a9f-9b3c-a323f1c80178 (0.0) -- IScaleChangeSink
OLE  c50898f6-c536-5f47-8583-8b2c2438a13b (0.0) -- Windows.Foundation.IEventHandler<IInspectable>
OLE  2dbdba9d-20da-519d-9078-09f835bc5bc7 (0.0) -- ITypedEventHandler<UISettings,IInspectable>
OLE  7d56d344-8464-4faf-aa49-37ea6e2d7bd1 (0.0) -- __x_Windows_CApplicationModel_CDataTransfer_CDragDrop_CCore_CICoreDragDropManager
OLE  cd292360-2763-4085-8a9f-74b224a29175 (0.0) -- __x_Windows_CUI_CCore_CICoreWindowFactory
OLE  087ca5a4-8cfc-4264-b39d-da2bb2583a11 (0.0) -- ICoreWindowFactoryPriv
OLE  92cee296-66e6-4678-984a-579e02c88be6 (0.0) -- __x_Windows_CApplicationModel_CCore_CICoreApplicationViewForceMarshal
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
OLE  eb9d0454-25db-5620-98b8-be4c5d0dbc67 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserChangedEventArgs]
OLE  f5917e6f-5abf-5e65-b5b4-1b9c8d94e788 (0.0) -- ITypedEventHandler<AccessibilitySettings,IInspectable>
OLE  a5322dff-9ebc-5df1-953d-0237cea8614b (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CStateRepository__CPrimaryTileUserNotifier_Windows__CInternal__CStateRepository__CPrimaryTileUserChangedEventArgs
OLE  ccb96d97-791c-5741-8f33-fb7266d6ea33 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CStateRepository__CSecondaryTileUserNotifier_Windows__CInternal__CStateRepository__CSecondaryTileUserChangedEventArgs
OLE  fcaeac67-4e77-49c7-b856-dde934fc735b (0.0) -- ILanguageFontGroupFactory
OLE  00000037-0000-0000-c000-000000000046 (0.0) -- IWeakReference
OLE  a2cd1ad4-df0a-4566-9407-de425b84cc21 (0.0) -- IAsyncWPNInit
OLE  118ec4a0-443d-467d-b568-de895db52e7b (0.0) -- __x_Windows_CServices_CTargetedContent_CInternal_CINotifySubscription
OLE  00000038-0000-0000-c000-000000000046 (0.0) -- IWeakReferenceSource
OLE  06386a7a-e009-5b0b-ab68-a8e48b516647 (0.0) -- __FIAsyncOperationWithProgressCompletedHandler_2_Windows__CStorage__CStreams__CIBuffer_UINT32
OLE  9d4966fa-dbd1-4799-a07f-6a5e1991bda4 (0.0) -- IOplockCallbackEventHandler
OLE  1726f52d-2b8c-524a-98c6-f2cf0893c0f2 (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageStagingEventArgs
OLE  a8a900c6-da0b-5bcc-a71a-be0b9265d87a (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageInstallingEventArgs
OLE  c23e15f6-c618-522a-82ab-4fab36665ce5 (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageUpdatingEventArgs
OLE  b32d7d63-cd0e-5c2e-a251-fb8d290824e4 (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageStatusChangedEventArgs
OLE  f9e87849-b323-eefa-3204-8a2d2d2b4432 (0.0) -- IImageQueueManager
OLE  e716b283-6be7-4e6f-a88f-1cde47d5e355 (0.0) -- IWpnPresentationTileSink
OLE  6030e7c3-f93f-5e9c-9ba2-9a018d2b09c0 (0.0) -- __FIEventHandler_1_Windows__CSystem__CAppMemoryUsageLimitChangingEventArgs
OLE  24a0bf18-6849-4d99-9fc8-48bcabace467 (0.0) -- IHandleDuplicator
OLE  a4ed5c81-76c9-40bd-8be6-b1d90fb20ae7 (0.0) -- IAsyncActionCompletedHandler
OLE  2ad63a67-f12f-4bd7-b1bf-6213290a552a (0.0) -- IUIAutomationCrossThreadRelease
OLE  e2663f37-2e1b-500c-ad68-c3ed7a8f74c8 (0.0) -- MapChangedEventHandler<HSTRING,HSTRING>
OLE  60141efb-f2f9-5377-96fd-f8c60d9558b5 (0.0) -- IMapChangedEventArgs<HSTRING>
OLE  c1635471-1417-4750-811f-a6122953c5a3 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIShellExperiencePrivate
OLE  13c6456c-c8eb-4f83-91b8-9d425f546210 (0.0) -- INotificationControllerDataSink
OLE  c30dfc1c-e392-4d02-ae09-a8ebf08cbc75 (0.0) -- SystemSettings.DataModel.ISettingsEnvironmentChangedHandler
OLE  1ada0e3e-e4a2-4123-b451-dc96bf800419 (0.0) -- __x_Windows_CApplicationModel_CCore_CICoreImmersiveApplication
OLE  dc471c97-550a-573c-9a01-f94a67aa3850 (0.0) -- __FITypedEventHandler_2_IInspectable_HSTRING
Endpoints :
ncalrpc         : OLE621C086970BFB63B18AFA3AA98E9
--------------------------------------------------------------------------------
<WinProcess "SearchUI.exe" pid 8484 at 0x5dd8048L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "nvtray.exe" pid 11888 at 0x5dd87b8L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "NvBackend.exe" pid 2112 at 0x5dd8630L>
32
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "MsiTrueColor.exe" pid 12528 at 0x5df2710L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "unsecapp.exe" pid 12240 at 0x5df2898L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "NetworkManager.exe" pid 3088 at 0x5df27f0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "IAStorIcon.exe" pid 1440 at 0x5df2208L>
32
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2540 at 0x57eddd8L>
64
['OneSyncSvc_184a7aba', 'PimIndexMaintenanceSvc_184a7aba', 'UnistoreSvc_184a7aba', 'UserDataSvc_184a7aba']

Interfaces :
RPC  d2716e94-25cb-4820-bc15-537866578562 (1.0) -- c:\windows\system32\aphostservice.dll
	0 -> ServerRPC_SubmitJob
	1 -> ServerRPC_GetPendingJobs
	2 -> ServerRPC_RetryJobById
	3 -> ServerRPC_CancelJobById
	4 -> ServerRPC_AdviseNotifications
	5 -> ServerRPC_SubscribeNextNotification
	6 -> ServerRPC_RegisterAppId
	7 -> ServerRPC_UnadviseNotifications
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
RPC  0c53aa2e-fb1c-49c5-bfb6-c54f8e5857cd (1.0) -- C:\Windows\System32\SyncController.dll
	0 -> ActiveSyncServer_QuerySyncStatusProps
	1 -> ActiveSyncServer_QueryLastSyncResult
	2 -> ActiveSyncServer_SetPassword
	3 -> ActiveSyncServer_CopyCredentials
	4 -> ActiveSyncServer_DeletePassword
	5 -> ActiveSyncServer_IsPasswordSet
	6 -> ActiveSyncServer_CreateDataStoreLock
	7 -> ActiveSyncServer_CloseDataStoreLock
	8 -> ActiveSyncServer_SetConversationSyncEnabled
	9 -> ActiveSyncServer_GetConversationSyncEnabled
	10 -> ActiveSyncServer_SetUnifiedInboxEnabled
	11 -> ActiveSyncServer_GetUnifiedInboxEnabled
	12 -> ActiveSyncServer_GetUnifiedInboxServerValue
	13 -> ActiveSyncServer_GetUserInfoForUnconfiguredAccount
RPC  e8748f69-a2a4-40df-9366-62dbeb696e26 (0.0) -- c:\windows\system32\unistore.dll
	0 -> USSvcImpl_Object_Close
	1 -> USSvcImpl_RegisterRundownProtection
	2 -> USSvcImpl_ConvertToOtherObject
	3 -> USSvcImpl_Manager_Create
	4 -> USSvcImpl_Manager_CreateStoreGrouping
	5 -> USSvcImpl_Manager_CreateStore
	6 -> USSvcImpl_Manager_GetDeviceStore
	7 -> USSvcImpl_Manager_GetDeviceStoreOid
	8 -> USSvcImpl_Manager_GetHighestStoreBitPosition
	9 -> USSvcImpl_Manager_GetStore
	10 -> USSvcImpl_Manager_GetStoreCollection
	11 -> USSvcImpl_Manager_Notify
	12 -> USSvcImpl_Manager_CustomNotify
	13 -> USSvcImpl_Manager_GetObjectByOid
	14 -> USSvcImpl_Manager_GetAllEmbeddedObjects
	15 -> USSvcImpl_Manager_GetAllItems
	16 -> USSvcImpl_Manager_GetTypeManager
	17 -> USSvcImpl_Manager_StartTransaction
	18 -> USSvcImpl_Manager_EndTransaction
	19 -> USSvcImpl_Manager_CleanupTombstones
	20 -> USSvcImpl_Manager_GetStreamFilePath
	21 -> USSvcImpl_Manager_CleanupTemporaryFolders
	22 -> USSvcImpl_Manager_GetAllAggregateObjects
	23 -> USSvcImpl_Manager_GetAllObjects
	24 -> USSvcImpl_Manager_GetBatchedPropValsFromIdsBlob
	25 -> USSvcImpl_Manager_GetPropValsFromIdBlob
	26 -> USSvcImpl_Manager_MapNamedProps
	27 -> USSvcImpl_Manager_GetDefaultPIMStoreId
	28 -> USSvcImpl_Manager_SetDefaultPIMStoreId
	29 -> USSvcImpl_Manager_GetUnistoreDatabaseRefreshTime
	30 -> USSvcImpl_ManagerPriv_put_DeviceStoreId
	31 -> USSvcImpl_ManagerPriv_GetNotificationsManager
	32 -> USSvcImpl_ManagerPriv_UnmapNamedProps
	33 -> USSvcImpl_ManagerPriv_GetPerfStats
	34 -> USSvcImpl_ManagerPriv_ResetPerfStats
	35 -> USSvcImpl_ManagerPriv_ToggleRecordingPerfStats
	36 -> USSvcImpl_ManagerPriv_BackupStoreVolume
	37 -> USSvcImpl_ManagerPriv_SetToSuspending
	38 -> USSvcImpl_ManagerPriv_SetToResumed
	39 -> USSvcImpl_NotificationManager_Advise
	40 -> USSvcImpl_NotificationManager_Unadvise
	41 -> USSvcImpl_NotificationManager_Notify
	42 -> USSvcImpl_NotificationManager_SuspendNotifications
	43 -> USSvcImpl_NotificationManager_ResumeNotifications
	44 -> USSvcImpl_NotificationManager_FilterProcessEventsForTests
	45 -> USSvcImpl_NotificationManager_GetAdviseContent
	46 -> USSvcImpl_Object_GetOid
	47 -> USSvcImpl_Object_Delete
	48 -> USSvcImpl_Object_GetPropValsBlob
	49 -> USSvcImpl_Object_GetAllPropValsBlob
	50 -> USSvcImpl_Object_SetPropVals
	51 -> USSvcImpl_Object_SetPropValsEx
	52 -> USSvcImpl_Object_SetStreamProperty
	53 -> USSvcImpl_Object_GetStreamProp
	54 -> USSvcImpl_Object_GetStore
	55 -> USSvcImpl_Object_GetStreamFilePath
	56 -> USSvcImpl_Object_GetAssociatedItems
	57 -> USSvcImpl_Object_CreateEmbeddedObject
	58 -> USSvcImpl_Object_DeleteEmbeddedObjects
	59 -> USSvcImpl_Object_GetEmbeddedObjects
	60 -> USSvcImpl_Object_IncrementRevision
	61 -> USSvcImpl_Store_GetRootFolder
	62 -> USSvcImpl_Store_GetObjectByOid
	63 -> USSvcImpl_Store_CreateAssociateObject
	64 -> USSvcImpl_Store_GetAssociateObjects
	65 -> USSvcImpl_Store_GetEmbeddedObjects
	66 -> USSvcImpl_Store_GetTypeManager
	67 -> USSvcImpl_Store_Flush
	68 -> USSvcImpl_Store_AddSyncPartner
	69 -> USSvcImpl_Store_GetSyncPartner
	70 -> USSvcImpl_Store_GetSyncPartners
	71 -> USSvcImpl_Store_StartFetchSession
	72 -> USSvcImpl_Store_EndFetchSession
	73 -> USSvcImpl_Store_ThreadInFetchSession
	74 -> USSvcImpl_Store_CreateAggregateObject
	75 -> USSvcImpl_Store_GetAggregateObjects
	76 -> USSvcImpl_Store_GetDeletedRevisionItems
	77 -> USSvcImpl_Store_GetLongDeletedRevisionItems
	78 -> USSvcImpl_Store_ResetLongRevisionChangeTracking
	79 -> USSvcImpl_Store_UpdateLongRevisionChangeTracking
	80 -> USSvcImpl_Store_GetLongRevision
	81 -> USSvcImpl_Store_IsObjectRevisionTracked
	82 -> USSvcImpl_Store_GetFolders
	83 -> USSvcImpl_Store_GetStoreGrouping
	84 -> USSvcImpl_Folder_CreateFolder
	85 -> USSvcImpl_Folder_CreateItem
	86 -> USSvcImpl_Folder_DeleteItems
	87 -> USSvcImpl_Folder_GetChildFolders
	88 -> USSvcImpl_Folder_GetItems
	89 -> USSvcImpl_Folder_GetAllItems
	90 -> USSvcImpl_Folder_GetParent
	91 -> USSvcImpl_Folder_IsEmpty
	92 -> USSvcImpl_Folder_CopyToFolder
	93 -> USSvcImpl_Folder_MoveToFolder
	94 -> USSvcImpl_Item_DeleteWithFlags
	95 -> USSvcImpl_Item_GetParent
	96 -> USSvcImpl_Item_CopyToFolder
	97 -> USSvcImpl_Item_MoveToFolder
	98 -> USSvcImpl_Item_AssociateObject
	99 -> USSvcImpl_Item_DeleteAssociations
	100 -> USSvcImpl_Item_DeleteAllAssociations
	101 -> USSvcImpl_Item_GetAssociateObjects
	102 -> USSvcImpl_Item_GetAggregateObject
	103 -> USSvcImpl_Item_AggregateObject
	104 -> USSvcImpl_Item_DeleteAggregation
	105 -> USSvcImpl_EmbeddeObject_GetItem
	106 -> USSvcImpl_EmbeddedObject_GetObject
	107 -> USSvcImpl_AssociatedObject_HasItems
	108 -> USSvcImpl_AggregateObject_GetAggregatedObjects
	109 -> USSvcImpl_ObjectCollection_GetCount
	110 -> USSvcImpl_ObjectCollection_GetCurrentIndex
	111 -> USSvcImpl_ObjectCollection_GetObject
	112 -> USSvcImpl_ObjectCollection_GetPropValsBlob
	113 -> USSvcImpl_ObjectCollection_GetBatchedPropValsBlob
	114 -> USSvcImpl_ObjectCollection_SetPropValsOnAll
	115 -> USSvcImpl_ObjectCollection_GetAllPropValsBlob
	116 -> USSvcImpl_ObjectCollection_Oid
	117 -> USSvcImpl_ObjectCollection_GetBookmark
	118 -> USSvcImpl_ObjectCollection_Move
	119 -> USSvcImpl_ObjectCollection_DeleteAllObjects
	120 -> USSvcImpl_SyncPartnerEnum_Next
	121 -> USSvcImpl_SyncPartnerEnum_Skip
	122 -> USSvcImpl_SyncPartnerEnum_Reset
	123 -> USSvcImpl_SyncPartnerEnum_Clone
	124 -> USSvcImpl_TypeManager_MapNamedProps
	125 -> USSvcImpl_TypeManager_GetSchemaPropertiesFromObjectType
	126 -> USSvcImpl_Stream_Seek
	127 -> USSvcImpl_Stream_SetSize
	128 -> USSvcImpl_Stream_Commit
	129 -> USSvcImpl_Stream_Revert
	130 -> USSvcImpl_Stream_LockRegion
	131 -> USSvcImpl_Stream_UnlockRegion
	132 -> USSvcImpl_Stream_Stat
	133 -> USSvcImpl_Stream_Clone
	134 -> USSvcImpl_Stream_Read
	135 -> USSvcImpl_Stream_Write
	136 -> USSvcImpl_SyncPartner_GetPropsBlob
	137 -> USSvcImpl_SyncPartner_SetProps
	138 -> USSvcImpl_SyncPartner_GetName
	139 -> USSvcImpl_SyncPartner_GetGuid
	140 -> USSvcImpl_SyncPartner_GetStoreId
	141 -> USSvcImpl_SyncPartner_GetPartnerId
	142 -> USSvcImpl_SyncPartner_EnableFolderForSync
	143 -> USSvcImpl_SyncPartner_IsFolderEnabledForSync
	144 -> USSvcImpl_SyncPartner_HasChanges
	145 -> USSvcImpl_SyncPartner_GetChangeCount
	146 -> USSvcImpl_SyncPartner_StartSyncSession
	147 -> USSvcImpl_SyncPartner_StartSyncSessionNoContext
	148 -> USSvcImpl_SyncPartner_GetNextChange
	149 -> USSvcImpl_SyncPartner_GetChangeForObject
	150 -> USSvcImpl_SyncPartner_SetExceptionOnChange
	151 -> USSvcImpl_SyncPartner_SetExceptionOnChangeUnits
	152 -> USSvcImpl_SyncPartner_ResetChangeEnumeration
	153 -> USSvcImpl_SyncPartner_EndSyncSession
	154 -> USSvcImpl_SyncPartner_GetRootFolder
	155 -> USSvcImpl_SyncPartner_LookupFolderObjectId
	156 -> USSvcImpl_SyncPartner_LookupFolderRemoteId
	157 -> USSvcImpl_SyncPartner_GetFolders
	158 -> USSvcImpl_SyncPartner_LookupItemObjectId
	159 -> USSvcImpl_SyncPartner_UpdateSyncPartnerSchema
	160 -> USSvcImpl_SyncPartner_Delete
	161 -> USSvcImpl_SyncPartner_SetMeetingResponse
	162 -> USSvcImpl_SyncPartner_GetAllMeetingResponses
	163 -> USSvcImpl_SyncPartner_DefragmentKnowledge
	164 -> USSvcImpl_ObjectMetadata_GetPropsBlob
	165 -> USSvcImpl_ObjectMetadata_SetProps
	166 -> USSvcImpl_ObjectMetadata_GetObjectId
	167 -> USSvcImpl_ObjectMetadata_GetPartner
	168 -> USSvcImpl_ObjectMetadata_GetRemoteId
	169 -> USSvcImpl_ObjectMetadata_SetRemoteId
	170 -> USSvcImpl_ObjectMetadata_GetParent
	171 -> USSvcImpl_ObjectMetadata_SetParent
	172 -> USSvcImpl_ItemMetadata_Move
	173 -> USSvcImpl_ItemMetadata_SetMeetingResponse
	174 -> USSvcImpl_ItemMetadata_GetMeetingResponses
	175 -> USSvcImpl_ItemMetadata_Delete
	176 -> USSvcImpl_FolderMetadata_GetFolderName
	177 -> USSvcImpl_FolderMetadata_GetFolderType
	178 -> USSvcImpl_FolderMetadata_GetRemoteKnowledge
	179 -> USSvcImpl_FolderMetadata_SetRemoteKnowledge
	180 -> USSvcImpl_FolderMetadata_AddItem
	181 -> USSvcImpl_FolderMetadata_LookupItemObjectId
	182 -> USSvcImpl_FolderMetadata_LookupItemRemoteId
	183 -> USSvcImpl_FolderMetadata_GetItems
	184 -> USSvcImpl_FolderMetadata_AddFolder
	185 -> USSvcImpl_FolderMetadata_LookupFolderObjectId
	186 -> USSvcImpl_FolderMetadata_LookupFolderRemoteId
	187 -> USSvcImpl_FolderMetadata_GetChildFolders
	188 -> USSvcImpl_FolderMetadata_Delete
	189 -> USSvcImpl_FolderMetadata_DeleteInBatches
	190 -> USSvcImpl_MeetingResponse_GetResponseId
	191 -> USSvcImpl_MeetingResponse_GetMeetingMetadata
	192 -> USSvcImpl_MeetingResponse_GetMeetingPermanentId
	193 -> USSvcImpl_MeetingResponse_GetMeetingInstanceId
	194 -> USSvcImpl_MeetingResponse_GetResponseType
	195 -> USSvcImpl_MeetingResponse_GetMeetingUserComments
	196 -> USSvcImpl_MeetingResponse_GetPlaceholderMeetingObjectId
	197 -> USSvcImpl_MeetingResponse_GetPropsBlob
	198 -> USSvcImpl_MeetingResponse_SetProps
	199 -> USSvcImpl_MeetingResponse_Delete
	200 -> USSvcImpl_ItemMetadataEnum_Next
	201 -> USSvcImpl_ItemMetadataEnum_Skip
	202 -> USSvcImpl_ItemMetadataEnum_Reset
	203 -> USSvcImpl_ItemMetadataEnum_Clone
	204 -> USSvcImpl_FolderMetadataEnum_Next
	205 -> USSvcImpl_FolderMetadataEnum_Skip
	206 -> USSvcImpl_FolderMetadataEnum_Reset
	207 -> USSvcImpl_FolderMetadataEnum_Clone
	208 -> USSvcImpl_EnumMeetingResponses_Next
	209 -> USSvcImpl_EnumMeetingResponses_Skip
	210 -> USSvcImpl_EnumMeetingResponses_Reset
	211 -> USSvcImpl_EnumMeetingResponses_Clone
RPC  c8ba73d2-3d55-429c-8e9a-c44f006f69fc (0.0) -- c:\windows\system32\userdataservice.dll
	0 -> UdmSvcImpl_CloseEnumHandle
	1 -> UdmSvcImpl_CloseSessionHandle
	2 -> UdmSvcImpl_OpenSession
	3 -> UdmSvcImpl_CreateSessionWithSameSecurityContext
	4 -> UdmSvcImpl_OpenCallHistorySession
	5 -> UdmSvcImpl_EnableProcessForTesting
	6 -> UdmSvcImpl_EnableUserDataServiceBackgroundNotification
	7 -> UdmSvcImpl_CheckObjectExistence
	8 -> UdmSvcImpl_GetObjectProperties
	9 -> UdmSvcImpl_GetObjectPropertiesWithScope
	10 -> UdmSvcImpl_GetAppointmentProperties
	11 -> UdmSvcImpl_GetCallHistoryEnum
	12 -> UdmSvcImpl_DeleteCallHistory
	13 -> UdmSvcImpl_MarkCallHistorySeen
	14 -> UdmSvcImpl_CreateCallHistoryItem
	15 -> UdmSvcImpl_GetUnseenCallCount
	16 -> UdmSvcImpl_UpdateCallDetails
	17 -> UdmSvcImpl_ResolveCalls
	18 -> UdmSvcImpl_GetCallHistoryEntryEnum
	19 -> UdmSvcImpl_UpdateEnumPropertySet
	20 -> UdmSvcImpl_EnumFetchObjects
	21 -> UdmSvcImpl_EnumFetchMatchingObjects
	22 -> UdmSvcImpl_EnumGetCount
	23 -> UdmSvcImpl_EnumGetState
	24 -> UdmSvcImpl_EnumMoveFirst
	25 -> UdmSvcImpl_EnumMoveLast
	26 -> UdmSvcImpl_CreateCallFavoriteItem
	27 -> UdmSvcImpl_DeleteCallFavorite
	28 -> UdmSvcImpl_MoveCallFavoriteItem
	29 -> UdmSvcImpl_ReorderGroups
	30 -> UdmSvcImpl_ResolveFavorites
	31 -> UdmSvcImpl_GetCallFavoriteEnum
	32 -> UdmSvcImpl_ControlSessionNotifies
	33 -> UdmSvcImpl_Advise
	34 -> UdmSvcImpl_Unadvise
	35 -> UdmSvcImpl_HasNotifications
	36 -> UdmSvcImpl_GetNotifyMessage
	37 -> UdmSvcImpl_GetFilePropertyStream
	38 -> UdmSvcImpl_UpdateCallHistoryObjects
	39 -> UdmSvcImpl_UpdateCalendarObjects
	40 -> UdmSvcImpl_GetUnexpandedAppointmentEnum
	41 -> UdmSvcImpl_GetCalendarEnum
	42 -> UdmSvcImpl_GetAppointmentEnum
	43 -> UdmSvcImpl_GetSingleAppointmentEnum
	44 -> UdmSvcImpl_GetAppointmentSearchEnum
	45 -> UdmSvcImpl_GetAppointmentExceptionEnum
	46 -> UdmSvcImpl_GetAppointmentRevisionEnum
	47 -> UdmSvcImpl_GetConflictInfoById
	48 -> UdmSvcImpl_GetConflictInfoByProperties
	49 -> UdmSvcImpl_GetAppointmentAppInfo
	50 -> UdmSvcImpl_GetLocalIdArrayFromAppointmentRemoteObjectId
	51 -> UdmSvcImpl_SetAutoReplySettings
	52 -> UdmSvcImpl_GetAutoReplySettings
	53 -> UdmSvcImpl_StartOrResetChangeTracking
	54 -> UdmSvcImpl_ValidateCallerAccess
	55 -> UdmSvcImpl_GenerateValidationToken
	56 -> UdmSvcImpl_RedeemValidationToken
	57 -> UdmSvcImpl_DeleteAllPackageData
	58 -> UdmSvcImpl_CleanupStaleAppData
	59 -> UdmSvcImpl_UpdateChatObjects
	60 -> UdmSvcImpl_UpdateChangeTracking
	61 -> UdmSvcImpl_ValidateChatMessage
	62 -> UdmSvcImpl_GetChatObjectProperties
	63 -> UdmSvcImpl_GetChatMessageEnum
	64 -> UdmSvcImpl_GetChatRevisionMessageEnum
	65 -> UdmSvcImpl_EnumFetchChatMessages
	66 -> UdmSvcImpl_GetChatConversationEnum
	67 -> UdmSvcImpl_GetChatSearchEnum
	68 -> UdmSvcImpl_GetChatConversationIdFromThreadingInfo
	69 -> UdmSvcImpl_GetChatTransports
	70 -> UdmSvcImpl_RegisterChatTransport
	71 -> UdmSvcImpl_GetChatApps
	72 -> UdmSvcImpl_GetDefaultChatApp
	73 -> UdmSvcImpl_SetDefaultChatApp
	74 -> UdmSvcImpl_NotifyChatApp
	75 -> UdmSvcImpl_UpdateAnnotationObjects
	76 -> UdmSvcImpl_GetContactMatchSuggestions
	77 -> UdmSvcImpl_UpdateContactObjects
	78 -> UdmSvcImpl_ContactLinking
	79 -> UdmSvcImpl_SetContactPreference
	80 -> UdmSvcImpl_SetRemoteIdentificationInformation
	81 -> UdmSvcImpl_GetMeContactId
	82 -> UdmSvcImpl_VCardToContact
	83 -> UdmSvcImpl_ContactToVCard
	84 -> UdmSvcImpl_SetContactNameOrder
	85 -> UdmSvcImpl_SetContactNameIncludeMiddle
	86 -> UdmSvcImpl_ToggleContactMaintenance
	87 -> UdmSvcImpl_GetObjectByRemoteId
	88 -> UdmSvcImpl_GetAnnotationListEnum
	89 -> UdmSvcImpl_GetContactListEnum
	90 -> UdmSvcImpl_GetContactEnum
	91 -> UdmSvcImpl_GetAnnotationEnum
	92 -> UdmSvcImpl_GetContactRevisionEnum
	93 -> UdmSvcImpl_UpdateEmailObjects
	94 -> UdmSvcImpl_GetEmailFolderMessageCounts
	95 -> UdmSvcImpl_GetEmailMailboxEnum
	96 -> UdmSvcImpl_GetEmailFolderEnum
	97 -> UdmSvcImpl_GetEmailRevisionEnum
	98 -> UdmSvcImpl_GetEmailMessageEnum
	99 -> UdmSvcImpl_GetEmailConversationEnum
	100 -> UdmSvcImpl_IsChangeTrackingEnabled
	101 -> UdmSvcImpl_EmptyEmailFolder
	102 -> UdmSvcImpl_CreateResponseMessage
	103 -> UdmSvcImpl_MoveFolder
	104 -> UdmSvcImpl_CreateFolder
	105 -> UdmSvcImpl_RespondToMeeting
	106 -> UdmSvcImpl_ForwardMeeting
	107 -> UdmSvcImpl_ProposeNewTimeForMeeting
	108 -> UdmSvcImpl_ResolveRecipients
	109 -> UdmSvcImpl_ValidateCertificates
	110 -> UdmSvcImpl_GetMessageIdFromAttachmentId
	111 -> UdmSvcImpl_RegisterSyncManager
	112 -> UdmSvcImpl_SyncObject
	113 -> UdmSvcImpl_GetUserDataAccountEnum
	114 -> UdmSvcImpl_UpdateUserDataAccountObjects
	115 -> UdmSvcImpl_MakeDefaultAccount
	116 -> UdmSvcImpl_GetCachedChatCapabilities
	117 -> UdmSvcImpl_GetChatCapabilitiesFromNetwork
	118 -> UdmSvcImpl_GetRcsServiceStatus
	119 -> UdmSvcImpl_SendLocalParticipantComposing
	120 -> UdmSvcImpl_RaiseRemoteParticipantComposing
	121 -> UdmSvcImpl_AdviseForConversationComposingStatusChanges
	122 -> UdmSvcImpl_UnadviseFromConversationComposingStatusChanges
	123 -> UdmSvcImpl_GetChatCloudServiceSettings
	124 -> UdmSvcImpl_SetChatCloudServiceSettings
	125 -> UdmSvcImpl_UpdateRcsEndUserMessage
	126 -> UdmSvcImpl_StartCloudServiceSync
	127 -> UdmSvcImpl_UpdateTaskObjects
	128 -> UdmSvcImpl_GetTaskListEnum
	129 -> UdmSvcImpl_GetTaskEnum
	130 -> UdmSvcImpl_UpdateContactGroupObjects
	131 -> UdmSvcImpl_GetContactGroupEnum
	132 -> UdmSvcImpl_GetContactGroupMemberEnum
RPC  43890c94-bfd7-4655-ad6a-b4a68397cdcb (0.0) -- c:\windows\system32\pimindexmaintenance.dll
	0 -> PimIMService_UpdateStores
	1 -> PimIMService_UpdateItems
	2 -> PimIMService_RebuildAggregateCache
	3 -> PimIMService_Suspend
	4 -> PimIMService_Resume
	5 -> PimIMService_CacheAggregateCacheFileMapping
	6 -> PimIMService_LoadAggregateCache
	7 -> PimIMService_CreateIndexedFilter
	8 -> PimIMService_SetStaticFilter
	9 -> PimIMService_GetIndexedProperties
	10 -> PimIMService_FindNextServerMatch
	11 -> PimIMService_SetFilter
	12 -> PimIMService_Reset
	13 -> PimIMService_CloseIndexedFilter
RPC  923c9623-db7f-4b34-9e6d-e86580f8ca2a (1.0) -- C:\Windows\System32\SyncController.dll
	0 -> AccountsMgmtRpcCreateAccount
	1 -> AccountsMgmtRpcDeleteAccount
	2 -> AccountsMgmtRpcConvertWebAccountIdFromAppSpecificId
	3 -> AccountsMgmtRpcConvertWebAccountIdToAppSpecificId
	4 -> AccountsMgmtRpcSyncAccount
	5 -> AccountsMgmtRpcSyncAccountAndWaitForCompletion
	6 -> AccountsMgmtRpcQueryAccountProperties
	7 -> AccountsMgmtRpcSaveAccountProperties
	8 -> AccountsMgmtRpcEnumAccounts
	9 -> AccountsMgmtRpcAdviseAccount
	10 -> AccountsMgmtRpcUnadviseAccount
	11 -> AccountsMgmtRpcGetNotifications
	12 -> AccountsMgmtRpcDiscoverExchangeServerConfig
	13 -> AccountsMgmtRpcDiscoverExchangeServerAuthType
	14 -> AccountsMgmtRpcVerifyExchangeMailBoxTokenAuth
	15 -> AccountsMgmtRpcDiscoverInternetMailServerConfig
	16 -> AccountsMgmtRpcCancelDiscoverInternetMailServerConfig
	17 -> AccountsMgmtRpcMayIgnoreInvalidServerCertificate
OLE  c092cc2f-5eca-5a5d-9c9c-f050e892dd97 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountAddedEventArgs
OLE  dc8b9f35-216c-54ff-99db-cd7e04c6a074 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountChangedEventArgs
OLE  df3657fc-19c8-5e99-b48f-4a59b98d4e8a (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountDeletedEventArgs
OLE  51aa6c40-b054-5c68-801e-03b75f43e2a1 (0.0) -- __FIAsyncOperationCompletedHandler_1_Windows__CInternal__CSecurity__CAuthentication__CWeb__CGetDefaultSignInAccountResult
OLE  9477622b-1340-5574-81fc-5013581f57c9 (0.0) -- __FIAsyncOperationCompletedHandler_1_Windows__CSecurity__CCredentials__CWebAccountProvider
OLE  4bd6f1e5-ca89-5240-8f3d-7f1b54ae90a7 (0.0) -- __FIAsyncOperationCompletedHandler_1_Windows__CSecurity__CCredentials__CWebAccount
OLE  eb9d0454-25db-5620-98b8-be4c5d0dbc67 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserChangedEventArgs]
OLE  deb54b22-70f2-55ab-97c0-6cbdc5ddb6f0 (0.0) -- __FIAsyncOperationCompletedHandler_1_Windows__CSecurity__CAuthentication__CWeb__CCore__CWebTokenRequestResult
OLE  ac7f26f2-feb7-5b2a-8ac4-345bc62caede (0.0) -- IMapView<HSTRING,HSTRING>
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  e9bdaaf0-cbf6-5c72-be90-29cbf3a1319b (0.0) -- IIterable<IKeyValuePair<HSTRING,HSTRING> >
OLE  05eb86f1-7140-5517-b88d-cbaebe57e6b1 (0.0) -- IIterator<IKeyValuePair<HSTRING,HSTRING> >
OLE  60310303-49c5-52e6-abc6-a9b36eccc716 (0.0) -- IKeyValuePair<HSTRING,HSTRING>
OLE  199e065c-8195-55da-9c10-8aeaf9ac1062 (0.0) -- __FIVectorView_1_Windows__CSecurity__CAuthentication__CWeb__CCore__CWebTokenResponse
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
OLE  8142b78c-3c08-53fe-a74e-506063c49063 (0.0) -- __FIAsyncOperationCompletedHandler_1_PhoneInternal__CExperiences__CSync__CAccount
OLE  a4ed5c81-76c9-40bd-8be6-b1d90fb20ae7 (0.0) -- IAsyncActionCompletedHandler
OLE  62e9e23a-de30-5736-b0e5-9e9925442328 (0.0) -- __FIAsyncOperationCompletedHandler_1_PhoneInternal__CExperiences__CSync__CAccountStatus
OLE  826bd12f-c1bb-5730-bf72-05db739871ae (0.0) -- __FIAsyncOperationCompletedHandler_1_PhoneInternal__CExperiences__CSync__CAccountErrorInformation
OLE  c1f995d7-c911-57c7-99e0-38239f48cfe1 (0.0) -- __FIAsyncOperationCompletedHandler_1_PhoneInternal__CExperiences__CSync__CAccountSyncScheduleInformation
Endpoints :
ncalrpc         : LRPC-a792c135343a94d522
ncalrpc         : OLEB787535FB75A9891F1EF1878FDC8
--------------------------------------------------------------------------------
<WinProcess "ProcessHacker.exe" pid 372 at 0x5df26d8L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "TrustedInstaller.exe" pid 5924 at 0x5df23c8L>
64
['TrustedInstaller']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "OpenWith.exe" pid 11228 at 0x5df2550L>
64

Interfaces :
RPC  30adc50c-5cbc-46ce-9a0e-91914789e23c (1.0) -- c:\windows\system32\nrpsrv.DLL
	0 -> RpcNrpGetAddrInfo
	1 -> RpcNrpGetNameInfo
Endpoints :
ncalrpc         : LRPC-64bba7c0828029142e
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11996 (DEAD) at 0x5df2f60L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 13272 at 0x5df2a90L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 4892 at 0x5df2da0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11184 at 0x5df2b38L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 6400 at 0x5df2ef0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 1424 at 0x5df22b0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 8248 at 0x5df2630L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 12400 at 0x5df2cc0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 5412 at 0x5df2518L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11528 at 0x5df26a0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 4572 at 0x5df29b0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11864 at 0x5df2908L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 7156 at 0x5df2ba8L>
64
['WinHttpAutoProxySvc']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 2024 at 0x5df2390L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 10584 at 0x5df2e48L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 6860 at 0x5df2160L>
--------------------------------------------------------------------------------
<WinProcess "audiodg.exe" pid 12832 at 0x5df24a8L>
64

Interfaces :
RPC  de3b9bc8-bef7-4578-a0de-f089048442db (1.0) -- C:\WINDOWS\system32\AUDIODG.EXE
	0 -> AudioDGShutdownADG
	1 -> AudioDGGetStartupStatus
	2 -> AudioDGChallenge
	3 -> AudioDGGetStreamVpoDescription
	4 -> AudioDGSetStreamVpoPolicySchemas
	5 -> AudioDGCloseStreamVpo
	6 -> AudioDGGetDeviceGraphWnfStateName
	7 -> AudioDGGetVpoFromVpoContext
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
OLE  69fed9b6-5405-48b8-3db0-4ca492fc3677 (0.0) -- IAPOWrapperSrv
OLE  fd7f2b29-24d0-4b5c-b177-592c39f9ca10 (0.0) -- iaudioprocessingobject
OLE  816e5b3e-5523-4efc-9223-98ec4214c3a0 (0.0) -- IStreamGroup
OLE  5d857e80-f074-4ad8-a9ce-0ddca68d8212 (0.0) -- IProcessSubmix
OLE  d81229b1-5a43-480c-92f7-be0f7f4eab60 (0.0) -- iaudiovolume
OLE  885c7b80-3fa2-4e5a-be07-cf01e1d6e2cd (0.0) -- iaudiomuteapo
OLE  419b26e3-fa99-4408-83de-cc1276efa489 (0.0) -- iaudiometer
OLE  69e1f79f-6eae-4517-be9f-13aa90e30014 (0.0) -- iaudioprocessingobjectinternal
OLE  3c169ff7-37b2-484c-b199-c3155590f316 (0.0) -- iaudiodevicegraph
OLE  610c5f91-da25-52b0-ae7d-2d3a45cdf4ef (0.0) -- ITypedEventHandler_2_Windows__CMedia__CDevices__CInternal__CAudioDeviceBroker_Windows__CMedia__CDevices__CInternal__CAudioDeviceBrokerChangedEventArgs
Endpoints :
ncalrpc         : AudioDeviceGraph
ncalrpc         : OLEFC07AE218C36E20B32DDF1039276
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 8164 at 0x5df2860L>
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11404 at 0x5df2358L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 2116 at 0x5df2828L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 7632 at 0x5df2d68L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11116 at 0x5df29e8L>
--------------------------------------------------------------------------------
<WinProcess "SystemSettingsBroker.exe" pid 5100 at 0x5df2978L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "SearchProtocolHost.exe" pid 6808 at 0x5df2780L>
--------------------------------------------------------------------------------
<WinProcess "SearchFilterHost.exe" pid 12844 at 0x5df2a58L>
--------------------------------------------------------------------------------
<WinProcess "python.exe" pid 8052 at 0x5df2588L>
64

Interfaces :
Endpoints :