webshell

Ghost Exploiter Team Official

C:/Windows/SysWOW64/WindowsPowerShell/v1.0/Modules/Wdac/

File / Folder	Size	Action
.	-
MSFT_OdbcDriverTask_v1....	17.209KB	edt ren
MSFT_OdbcDsnTask_v1.0.c...	25.917KB	edt ren
MSFT_OdbcPerfCounterTas...	18.526KB	edt ren
MSFT_WdacBidTraceTask_v...	30.864KB	edt ren
Wdac.format.ps1xml	33.483KB	edt ren
Wdac.psd1	1.344KB	edt ren
Wdac.types.ps1xml	13.544KB	edt ren

<?xml version="1.0" encoding="utf-8"?>

<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">
  <Class ClassName="Root/Microsoft/Windows/Wdac/MSFT_WdacBidTraceTask" ClassVersion="1.0">
    <Version>1.0</Version>
    <DefaultNoun>WdacBidTrace</DefaultNoun>
    <StaticCmdlets>
      <Cmdlet>
        <CmdletMetadata Verb="Disable" DefaultCmdletParameterSet="InputObject" ConfirmImpact="Medium" />
        <Method MethodName="DisableByAllApp" CmdletParameterSet="AllApp">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="PassThru">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata>
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="IncludeAllApplications">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata IsMandatory="true" ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Platform">
              <Type PSType="System.String" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
                <ValidateSet>
                  <AllowedValue>32-bit</AllowedValue>
                  <AllowedValue>64-bit</AllowedValue>
                  <AllowedValue>All</AllowedValue>
                </ValidateSet>
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
        <Method MethodName="DisableByFolder" CmdletParameterSet="Folder">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="PassThru">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata>
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Folder">
              <Type PSType="System.String" />
              <CmdletParameterMetadata Aliases="ApplicationFolder" IsMandatory="true" ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Platform">
              <Type PSType="System.String" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
                <ValidateSet>
                  <AllowedValue>32-bit</AllowedValue>
                  <AllowedValue>64-bit</AllowedValue>
                  <AllowedValue>All</AllowedValue>
                </ValidateSet>
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
        <Method MethodName="DisableByInputObject" CmdletParameterSet="InputObject">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="PassThru">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata>
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="InputObject">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletParameterMetadata Aliases="BidTrace" IsMandatory="true" Position="0" ValueFromPipeline="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
        <Method MethodName="DisableByPath" CmdletParameterSet="Path">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="PassThru">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata>
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Path">
              <Type PSType="System.String" />
              <CmdletParameterMetadata Aliases="ApplicationPath" IsMandatory="true" Position="0" ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="ProcessId">
              <Type PSType="System.UInt32" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Platform">
              <Type PSType="System.String" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
                <ValidateSet>
                  <AllowedValue>32-bit</AllowedValue>
                  <AllowedValue>64-bit</AllowedValue>
                  <AllowedValue>All</AllowedValue>
                </ValidateSet>
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
      </Cmdlet>
      <Cmdlet>
        <CmdletMetadata Verb="Enable" DefaultCmdletParameterSet="InputObject" ConfirmImpact="Medium" />
        <Method MethodName="EnableByAllApp" CmdletParameterSet="AllApp">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="PassThru">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata>
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="IncludeAllApplications">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata IsMandatory="true" ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Platform">
              <Type PSType="System.String" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
                <ValidateSet>
                  <AllowedValue>32-bit</AllowedValue>
                  <AllowedValue>64-bit</AllowedValue>
                  <AllowedValue>All</AllowedValue>
                </ValidateSet>
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
        <Method MethodName="EnableByFolder" CmdletParameterSet="Folder">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="PassThru">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata>
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Platform">
              <Type PSType="System.String" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
                <ValidateSet>
                  <AllowedValue>32-bit</AllowedValue>
                  <AllowedValue>64-bit</AllowedValue>
                  <AllowedValue>All</AllowedValue>
                </ValidateSet>
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Folder">
              <Type PSType="System.String" />
              <CmdletParameterMetadata Aliases="ApplicationFolder" IsMandatory="true" ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
        <Method MethodName="EnableByInputObject" CmdletParameterSet="InputObject">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="PassThru">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata>
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="InputObject">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletParameterMetadata Aliases="BidTrace" IsMandatory="true" Position="0" ValueFromPipeline="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
        <Method MethodName="EnableByPath" CmdletParameterSet="Path">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="PassThru">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata>
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Path">
              <Type PSType="System.String" />
              <CmdletParameterMetadata Aliases="ApplicationPath" IsMandatory="true" Position="0" ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Platform">
              <Type PSType="System.String" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
                <ValidateSet>
                  <AllowedValue>32-bit</AllowedValue>
                  <AllowedValue>64-bit</AllowedValue>
                  <AllowedValue>All</AllowedValue>
                </ValidateSet>
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="ProcessId">
              <Type PSType="System.UInt32" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
      </Cmdlet>
      <Cmdlet>
        <CmdletMetadata Verb="Get" DefaultCmdletParameterSet="Path" />
        <Method MethodName="GetByAllApp" CmdletParameterSet="AllApp">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="Platform">
              <Type PSType="System.String" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
                <ValidateSet>
                  <AllowedValue>32-bit</AllowedValue>
                  <AllowedValue>64-bit</AllowedValue>
                  <AllowedValue>All</AllowedValue>
                </ValidateSet>
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="IncludeAllApplications">
              <Type PSType="System.Management.Automation.SwitchParameter" />
              <CmdletParameterMetadata IsMandatory="true" ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
        <Method MethodName="GetByFolder" CmdletParameterSet="Folder">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="Platform">
              <Type PSType="System.String" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
                <ValidateSet>
                  <AllowedValue>32-bit</AllowedValue>
                  <AllowedValue>64-bit</AllowedValue>
                  <AllowedValue>All</AllowedValue>
                </ValidateSet>
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Folder">
              <Type PSType="System.String" />
              <CmdletParameterMetadata Aliases="ApplicationFolder" IsMandatory="true" ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
        <Method MethodName="GetByPath" CmdletParameterSet="Path">
          <ReturnValue>
            <Type PSType="System.Int32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <Parameters>
            <Parameter ParameterName="Platform">
              <Type PSType="System.String" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
                <ValidateSet>
                  <AllowedValue>32-bit</AllowedValue>
                  <AllowedValue>64-bit</AllowedValue>
                  <AllowedValue>All</AllowedValue>
                </ValidateSet>
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="Path">
              <Type PSType="System.String" />
              <CmdletParameterMetadata Aliases="ApplicationPath" Position="0" ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="ProcessId">
              <Type PSType="System.UInt32" />
              <CmdletParameterMetadata ValueFromPipelineByPropertyName="true">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <Parameter ParameterName="CmdletOutput">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" ETSType="Microsoft.Management.Infrastructure.CimInstance#MSFT_WdacBidTrace" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
      </Cmdlet>
    </StaticCmdlets>
  </Class>
</PowerShellMetadata>