webshell

webshell

Ghost Exploiter Team Official

C:/Windows/SysWOW64/WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/

File / Folder	Size	Action
.	-
MSFT_NetEventNetworkAda...	4.654KB	edt ren
MSFT_NetEventNetworkAda...	2.328KB	edt ren
MSFT_NetEventPacketCapt...	9.448KB	edt ren
MSFT_NetEventPacketCapt...	5.264KB	edt ren
MSFT_NetEventProvider.c...	7.063KB	edt ren
MSFT_NetEventProvider.f...	2.607KB	edt ren
MSFT_NetEventSession.cdxml	7.07KB	edt ren
MSFT_NetEventSession.fo...	3.272KB	edt ren
MSFT_NetEventVFPProvide...	12.699KB	edt ren
MSFT_NetEventVFPProvide...	6.746KB	edt ren
MSFT_NetEventVmNetworkA...	4.051KB	edt ren
MSFT_NetEventVmNetworkA...	3.266KB	edt ren
MSFT_NetEventVmSwitch.c...	4.051KB	edt ren
MSFT_NetEventVmSwitch.f...	1.965KB	edt ren
MSFT_NetEventVmSwitchPr...	5.76KB	edt ren
MSFT_NetEventVmSwitchPr...	3.172KB	edt ren
MSFT_NetEventWFPCapture...	6.615KB	edt ren
MSFT_NetEventWFPCapture...	3.906KB	edt ren
NetEventPacketCapture.T...	5.738KB	edt ren
NetEventPacketCapture.psd1	2.713KB	edt ren

<?xml version="1.0" encoding="utf-8"?>
<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">
  <Class ClassName="root/StandardCimv2/MSFT_NetEventSession" ClassVersion="1.0">
    <Version>1.0</Version>
    <DefaultNoun>NetEventSession</DefaultNoun>
    <InstanceCmdlets>
      <GetCmdletParameters DefaultCmdletParameterSet="ByName">
        <QueryableProperties>
          <Property PropertyName="Name">
            <Type PSType="System.String" />
            <RegularQuery AllowGlobbing="true">
              <CmdletParameterMetadata IsMandatory="false" Position="0" ValueFromPipelineByPropertyName="true" CmdletParameterSets="ByName"/>
            </RegularQuery>
          </Property>
        </QueryableProperties>
        <QueryableAssociations>
          <Association Association="MSFT_NetEventSession_Provider" ResultRole="GroupComponent" SourceRole="PartComponent" >
            <AssociatedInstance>
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance" ETSType="Microsoft.Management.Infrastructure.CimInstance#root/standardcimv2/MSFT_NetEventProvider" />
              <CmdletParameterMetadata PSName="AssociatedEventProvider" ValueFromPipeline = "true"  CmdletParameterSets="ByProviderOfSession"/> 
            </AssociatedInstance>
          </Association> 
        </QueryableAssociations>
      </GetCmdletParameters>

<Cmdlet>
        <CmdletMetadata Verb="Remove" ConfirmImpact="High" />
        <Method MethodName="cim:DeleteInstance" />
        <GetCmdletParameters>
          <QueryableProperties>
            <Property PropertyName="Name">
              <Type PSType="System.String" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="true" Position="0" ValueFromPipelineByPropertyName="true" CmdletParameterSets="ByName"/>
              </RegularQuery>
            </Property>
          </QueryableProperties>
          <QueryableAssociations>
            <Association Association="MSFT_NetEventSession_Provider" ResultRole="GroupComponent" SourceRole="PartComponent" >
              <AssociatedInstance>
                <Type PSType="Microsoft.Management.Infrastructure.CimInstance" ETSType="Microsoft.Management.Infrastructure.CimInstance#root/standardcimv2/MSFT_NetEventProvider" />
                <CmdletParameterMetadata PSName="AssociatedEventProvider" ValueFromPipeline = "true"  CmdletParameterSets="ByProviderOfSession"/> 
              </AssociatedInstance>
            </Association> 
          </QueryableAssociations>
        </GetCmdletParameters>
      </Cmdlet>

<Cmdlet>
        <CmdletMetadata Verb="Set" ConfirmImpact="Medium" />
        <Method MethodName="cim:ModifyInstance">
          <Parameters>
            <Parameter ParameterName="CaptureMode">
              <Type PSType="NetEventPacketCapture.CaptureModes" />
              <CmdletParameterMetadata Aliases="cm" IsMandatory="false" />
            </Parameter>
            <Parameter ParameterName="LocalFilePath">
              <Type PSType="System.String" />
              <CmdletParameterMetadata Aliases="lfp" IsMandatory="false" />
            </Parameter>
            <Parameter ParameterName="MaxFileSize">
              <Type PSType="System.UInt32" />
              <CmdletParameterMetadata IsMandatory="false" />
            </Parameter>
            <Parameter ParameterName="MaxNumberOfBuffers">
              <Type PSType="System.Byte" />
              <CmdletParameterMetadata IsMandatory="false" />
            </Parameter>
            <Parameter ParameterName="TraceBufferSize">
              <Type PSType="System.UInt32" />
              <CmdletParameterMetadata IsMandatory="false" />
            </Parameter>
          </Parameters>
        </Method>
      </Cmdlet>

<Cmdlet>
        <CmdletMetadata Verb="Start" ConfirmImpact="High" />
        <Method MethodName="Start" />
        <GetCmdletParameters>
          <QueryableProperties>
            <Property PropertyName="Name">
              <Type PSType="System.String" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="true" Position="0" ValueFromPipelineByPropertyName="true" CmdletParameterSets="ByName"/>
              </RegularQuery>
            </Property>
          </QueryableProperties>
        </GetCmdletParameters>
      </Cmdlet>

<Cmdlet>
        <CmdletMetadata Verb="Stop" ConfirmImpact="High" />
        <Method MethodName="Stop" />
        <GetCmdletParameters>
          <QueryableProperties>
            <Property PropertyName="Name">
              <Type PSType="System.String" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="true" Position="0" ValueFromPipelineByPropertyName="true" CmdletParameterSets="ByName"/>
              </RegularQuery>
            </Property>
          </QueryableProperties>
        </GetCmdletParameters>
      </Cmdlet>

</InstanceCmdlets>

<StaticCmdlets>
      <Cmdlet>
        <CmdletMetadata Verb="New" ConfirmImpact="High"/>
        <Method MethodName="cim:CreateInstance">
          <Parameters>
            <Parameter ParameterName="Name">
              <Type PSType="System.String" />
              <CmdletParameterMetadata IsMandatory="true" Position="0">
                <ValidateNotNull />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CaptureMode" DefaultValue="SaveToFile">
              <Type PSType="NetEventPacketCapture.CaptureModes" />
              <CmdletParameterMetadata Aliases="cm" IsMandatory="false" />
            </Parameter>
            <Parameter ParameterName="LocalFilePath">
              <Type PSType="System.String" />
              <CmdletParameterMetadata Aliases="lfp" IsMandatory="false" />
            </Parameter>
            <Parameter ParameterName="MaxFileSize" DefaultValue="250">
              <Type PSType="uint32" />
              <CmdletParameterMetadata IsMandatory="false" />
            </Parameter>
            <Parameter ParameterName="MaxNumberOfBuffers">
              <Type PSType="byte" />
              <CmdletParameterMetadata IsMandatory="false" />
            </Parameter>
            <Parameter ParameterName="TraceBufferSize">
              <Type PSType="uint32" />
              <CmdletParameterMetadata IsMandatory="false" />
            </Parameter>
          </Parameters>
        </Method>
      </Cmdlet>
   </StaticCmdlets>

</Class>

<Enums>

<Enum EnumName="NetEventPacketCapture.CaptureModes" UnderlyingType="System.Byte">
      <Value Name="RealtimeRPC"    Value="0" />
      <Value Name="SaveToFile"     Value="1" />
      <Value Name="RealtimeLocal"  Value="2" />
    </Enum>

<Enum EnumName="NetEventPacketCapture.ESessionStatus" UnderlyingType="System.Byte">
      <Value Name="Running"     Value="0" />
      <Value Name="NotRunning"  Value="1" />
      <Value Name="HasProblem"  Value="2" />
    </Enum>

</Enums>

</PowerShellMetadata>