Comparer le texte

Encuentra la diferencia entre dos archivos de texto

Real-time diff

Unified diff

Collapse lines

Highlight change

Syntax highlighting

Outils

Diffchecker Desktop The most secure way to run Diffchecker. Get the Diffchecker Desktop app: your diffs never leave your computer!Get Desktop

Untitled diff

Created 6 years agoDiff never expires

733 lines

730 lines

--------------------------------------------------------------------------------

[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000

[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000

--------------------------------------------------------------------------------

Interfaces :

Endpoints :

--------------------------------------------------------------------------------

Interfaces :

RPC 76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\windows\system32\wininit.exe

RPC 76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\WINDOWS\system32\wininit.exe

0 -> I_WMsgkSendMessage

1 -> I_WMsgkSendPSPMessage

RPC 894de0c0-0d55-11d3-a322-00c04fa321a1 (1.0) -- C:\windows\system32\wininit.exe

RPC 894de0c0-0d55-11d3-a322-00c04fa321a1 (1.0) -- C:\WINDOWS\system32\wininit.exe

0 -> s_BaseInitiateShutdown

1 -> s_BaseAbortShutdown

2 -> s_BaseInitiateShutdownEx

RPC d95afe70-a6d5-4259-822e-2c84da1ddb0d (1.0) -- C:\windows\system32\wininit.exe

RPC d95afe70-a6d5-4259-822e-2c84da1ddb0d (1.0) -- C:\WINDOWS\system32\wininit.exe

0 -> s_WsdrInitiateShutdown

1 -> s_WsdrAbortShutdown

2 -> s_WsdrCheckForHiberboot

RPC 76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\windows\system32\wininit.exe

RPC 76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\WINDOWS\system32\wininit.exe

0 -> I_WMsgSendMessage

1 -> I_WMsgSendPSPMessage

2 -> I_WMsgSendNotifyMessage

3 -> I_WMsgSendReconnectionUpdateMessage

Endpoints :

ncalrpc : WMsgKRpc0551A0

ncalrpc : WMsgKRpc017ED30

ncacn_np : \PIPE\InitShutdown

ncalrpc : WindowsShutdown

ncacn_ip_tcp : 49664

ncacn_ip_tcp : 1536

--------------------------------------------------------------------------------

Interfaces :

Endpoints :

--------------------------------------------------------------------------------

Interfaces :

RPC 76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\windows\system32\winlogon.exe

0 -> I_WMsgkSendMessage

1 -> I_WMsgkSendPSPMessage

RPC 76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\windows\system32\winlogon.exe

0 -> I_WMsgSendMessage

1 -> I_WMsgSendPSPMessage

2 -> I_WMsgSendNotifyMessage

3 -> I_WMsgSendReconnectionUpdateMessage

Endpoints :

ncalrpc : WMsgKRpc058201

--------------------------------------------------------------------------------

Interfaces :

RPC 367abb81-9844-35f1-ad32-98f038001003 (2.0) -- C:\windows\system32\services.exe

RPC 367abb81-9844-35f1-ad32-98f038001003 (2.0) -- C:\WINDOWS\system32\services.exe

0 -> RCloseServiceHandle

1 -> RControlService

2 -> RDeleteService

3 -> RLockServiceDatabase

4 -> RQueryServiceObjectSecurity

5 -> RSetServiceObjectSecurity

6 -> RQueryServiceStatus

7 -> RSetServiceStatus

8 -> RUnlockServiceDatabase

9 -> RNotifyBootConfigStatus

10 -> RI_ScSetServiceBitsW

11 -> RChangeServiceConfigW

12 -> RCreateServiceW

13 -> REnumDependentServicesW

14 -> REnumServicesStatusW

15 -> ROpenSCManagerW

16 -> ROpenServiceW

17 -> RQueryServiceConfigW

18 -> RQueryServiceLockStatusW

19 -> RStartServiceW

20 -> RGetServiceDisplayNameW

21 -> RGetServiceKeyNameW

22 -> CServiceRecord::GetStatusInternal

23 -> RChangeServiceConfigA

24 -> RCreateServiceA

25 -> REnumDependentServicesA

26 -> REnumServicesStatusA

27 -> ROpenSCManagerA

28 -> ROpenServiceA

29 -> RQueryServiceConfigA

30 -> RQueryServiceLockStatusA

31 -> RStartServiceA

32 -> RGetServiceDisplayNameA

33 -> RGetServiceKeyNameA

34 -> CServiceRecord::GetStatusInternal

35 -> REnumServiceGroupW

36 -> RChangeServiceConfig2A

37 -> RChangeServiceConfig2W

38 -> RQueryServiceConfig2A

39 -> RQueryServiceConfig2W

40 -> RQueryServiceStatusEx

41 -> REnumServicesStatusExA

42 -> REnumServicesStatusExW

43 -> RI_ScBroadcastServiceControlMessage

44 -> RCreateServiceWOW64A

45 -> RCreateServiceWOW64W

46 -> RI_ScQueryServiceTagInfo

47 -> RNotifyServiceStatusChange

48 -> RGetNotifyResults

49 -> RCloseNotifyHandle

50 -> RControlServiceExA

51 -> RControlServiceExW

52 -> RI_ScSendPnPMessage

53 -> RI_ScValidatePnPService

54 -> RI_ScOpenServiceStatusHandle

55 -> RI_ScQueryServiceConfig

56 -> RQueryServiceConfigEx

57 -> RI_ScRegisterPreshutdownRestart

58 -> RI_ScReparseServiceDatabase

59 -> RQueryUserServiceName

60 -> RCreateWowService

61 -> RGetServiceRegistryStateKey

62 -> RGetServiceDirectory

63 -> RGetServiceProcessToken

RPC a2c45f7c-7d32-46ad-96f5-adafb486be74 (1.0) -- C:\WINDOWS\system32\services.exe

RPC a2c45f7c-7d32-46ad-96f5-adafb486be74 (1.0) -- C:\windows\system32\services.exe

0 -> RI_ScOpenServiceChannelHandle

1 -> RI_ScSendResponseReceiveControls

2 -> RI_ScCloseServiceChannelHandle

RPC 93149ca2-973b-11d1-8c39-00c04fb984f9 (0.0) -- C:\windows\SYSTEM32\scesrv.dll

RPC 93149ca2-973b-11d1-8c39-00c04fb984f9 (0.0) -- C:\WINDOWS\SYSTEM32\scesrv.dll

0 -> SceSvcRpcQueryInfo

1 -> SceSvcRpcSetInfo

2 -> SceRpcSetupUpdateObject

3 -> SceRpcSetupMoveFile

4 -> SceRpcGenerateTemplate

5 -> SceRpcConfigureSystem

6 -> SceRpcGetDatabaseInfo

7 -> SceRpcGetObjectChildren

8 -> SceRpcOpenDatabase

9 -> SceRpcCloseDatabase

10 -> SceRpcGetDatabaseDescription

11 -> SceRpcGetDBTimeStamp

12 -> SceRpcGetObjectSecurity

13 -> SceRpcGetAnalysisSummary

14 -> SceRpcAnalyzeSystem

15 -> SceRpcUpdateDatabaseInfo

16 -> SceRpcUpdateObjectInfo

17 -> SceRpcStartTransaction

18 -> SceRpcCommitTransaction

19 -> SceRpcRollbackTransaction

20 -> SceRpcGetServerProductType

21 -> SceSvcRpcUpdateInfo

22 -> SceRpcCopyObjects

23 -> SceRpcSetupResetLocalPolicy

24 -> SceRpcNotifySaveChangesInGP

25 -> SceRpcControlNotificationQProcess

26 -> SceRpcBrowseDatabaseTable

27 -> SceRpcGetSystemSecurity

28 -> SceRpcGetSystemSecurity

29 -> SceRpcSetSystemSecurity

30 -> SceRpcSetSystemSecurity

31 -> SceRpcSetDatabaseSetting

32 -> SceRpcGetDatabaseSetting

33 -> SceRpcConfigureConvertedFileSecurityImmediately

Endpoints :

ncalrpc : ntsvcs

ncacn_np : \pipe\ntsvcs

ncacn_np : \PIPE\scerpc

ncacn_ip_tcp : 49677

ncacn_ip_tcp : 1543

--------------------------------------------------------------------------------

[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000

--------------------------------------------------------------------------------

['KeyIso', 'SamSs', 'VaultSvc']

Interfaces :

RPC 12345778-1234-abcd-ef00-0123456789ab (0.0) -- C:\windows\system32\lsasrv.dll

RPC 12345778-1234-abcd-ef00-0123456789ab (0.0) -- C:\WINDOWS\system32\lsasrv.dll

0 -> LsarClose

1 -> CredrRename

2 -> LsarEnumeratePrivileges

3 -> LsarQuerySecurityObject

4 -> LsarSetSecurityObject

5 -> LsaITestCall

6 -> LsarOpenPolicyRPC

7 -> LsarQueryInformationPolicy

8 -> LsarSetInformationPolicy

9 -> LsaITestCall

10 -> LsarCreateAccount

11 -> LsarEnumerateAccounts

12 -> LsarCreateTrustedDomain

13 -> LsarEnumerateTrustedDomains

14 -> LsarLookupNames

15 -> LsarLookupSids

16 -> LsarCreateSecret

17 -> LsarOpenAccount

18 -> LsarEnumeratePrivilegesAccount

19 -> LsarAddPrivilegesToAccount

20 -> LsarRemovePrivilegesFromAccount

21 -> LsarGetQuotasForAccount

22 -> LsarSetQuotasForAccount

23 -> LsarGetSystemAccessAccount

24 -> LsarSetSystemAccessAccount

25 -> LsarOpenTrustedDomain

26 -> LsarQueryInfoTrustedDomain

27 -> LsarSetInformationTrustedDomain

28 -> LsarOpenSecret

29 -> LsarSetSecret

30 -> LsarQuerySecret

31 -> LsarLookupPrivilegeValue

32 -> LsarLookupPrivilegeName

33 -> LsarLookupPrivilegeDisplayName

34 -> LsarDeleteObject

35 -> LsarEnumerateAccountsWithUserRight

36 -> LsarEnumerateAccountRights

37 -> LsarAddAccountRights

38 -> LsarRemoveAccountRights

39 -> LsarQueryTrustedDomainInfo

40 -> LsarSetTrustedDomainInfo

41 -> LsarDeleteTrustedDomain

42 -> LsarStorePrivateData

43 -> LsarRetrievePrivateData

44 -> LsarOpenPolicy2

45 -> LsarGetUserName

46 -> LsarQueryInformationPolicy2

47 -> LsarSetInformationPolicy2

48 -> LsarQueryTrustedDomainInfoByName

49 -> LsarSetTrustedDomainInfoByName

50 -> LsarEnumerateTrustedDomainsEx

51 -> LsarCreateTrustedDomainEx

52 -> LsaITestCall

53 -> LsarQueryDomainInformationPolicy

54 -> LsarSetDomainInformationPolicy

55 -> LsarOpenTrustedDomainByName

56 -> LsaITestCall

57 -> LsarLookupSids2

58 -> LsarLookupNames2

59 -> LsarCreateTrustedDomainEx2

60 -> CredrWrite

61 -> CredrRead

62 -> CredrEnumerate

63 -> CredrWriteDomainCredentials

64 -> CredrReadDomainCredentials

65 -> CredrDelete

66 -> CredrGetTargetInfo

67 -> CredrProfileLoaded

68 -> LsarLookupNames3

69 -> CredrGetSessionTypes

70 -> LsarRegisterAuditEvent

71 -> LsarGenAuditEvent

72 -> LsarUnregisterAuditEvent

73 -> LsarQueryForestTrustInformation

74 -> LsarSetForestTrustInformation

75 -> CredrRename

76 -> LsarLookupSids3

77 -> LsarLookupNames4

78 -> LsarOpenPolicySce

79 -> LsarAdtRegisterSecurityEventSource

80 -> LsarAdtUnregisterSecurityEventSource

81 -> LsarAdtReportSecurityEvent

82 -> CredrFindBestCredential

83 -> LsarSetAuditPolicy

84 -> LsarQueryAuditPolicy

85 -> LsarEnumerateAuditPolicy

86 -> LsarEnumerateAuditCategories

87 -> LsarEnumerateAuditSubCategories

88 -> LsarLookupAuditCategoryName

89 -> LsarLookupAuditSubCategoryName

90 -> LsarSetAuditSecurity

91 -> LsarQueryAuditSecurity

92 -> CredrReadByTokenHandle

93 -> CredrRestoreCredentials

94 -> CredrBackupCredentials

95 -> LsarManageSidNameMapping

96 -> CredrProfileUnloaded

97 -> CredrRename

98 -> CredrRename

99 -> CredrRename

100 -> CredrRename

101 -> CredrRename

102 -> LsarEfsGetSmartcardCredentials

103 -> LsarAuditSetGlobalSacl

104 -> LsarAuditQueryGlobalSacl

105 -> CredrProfileLoadedEx

106 -> LsarInteractiveSessionIsLoggedOff

107 -> LsarConfigureAutoLogonCredentials

108 -> LsarGetDeviceRegistrationInfo

109 -> LsaITestCall

110 -> LsarProfileDeleted

111 -> LsaITestCall

112 -> CredrRename

112 -> LsarMakeLogonSessionsSiblings

113 -> LsarValidateProcUniqueLuid

114 -> LsarIsArsoAllowedByPolicy

115 -> LsarIsArsoAllowedByConsent

116 -> LsarEnableArsoConsent

117 -> LsarDisableArsoConsent

118 -> LsarIsArsoAllowedByPolicy

119 -> LsarIsUserArsoEnabled

120 -> LsarEnableUserArso

121 -> LsarDisableUserArso

122 -> LsarConfigureUserArso

123 -> LsarGetInprocDispatchTable

124 -> LsarSetSharedUserSession

125 -> LsarClearSharedUserSession

126 -> LsarEnablePasswordLessCurrentUser

RPC ace1c026-8b3f-4711-8918-f345d17f5bff (1.0) -- C:\WINDOWS\system32\lsasrv.dll

127 -> LsarDisablePasswordLessCurrentUser

RPC ace1c026-8b3f-4711-8918-f345d17f5bff (1.0) -- C:\windows\system32\lsasrv.dll

0 -> S_RPC_LspUpdatePrivateData

1 -> S_RPC_LspReadPrivateData

RPC afc07e2e-311c-4435-808c-c483ffeec7c9 (1.0) -- C:\windows\system32\lsasrv.dll

RPC afc07e2e-311c-4435-808c-c483ffeec7c9 (1.0) -- C:\WINDOWS\system32\lsasrv.dll

0 -> LsarGetAvailableCAPIDs

1 -> LsarSetCAPs

2 -> LsarQueryCAPs

RPC c0d930f0-b787-4124-99bc-21f0ecb642ce (0.0) -- C:\windows\system32\lsasrv.dll

RPC c0d930f0-b787-4124-99bc-21f0ecb642ce (0.0) -- C:\WINDOWS\system32\lsasrv.dll

0 -> LsarConnectLocalUser

1 -> LsarDisconnectLocalUser

2 -> LsarCreateConnectedUser

3 -> LsarIsCurrentUserConnected

4 -> LsarRenewCertificate

5 -> LsarGetSSOAccountType

6 -> LsarIsUserMSA

RPC d25576e4-00d2-43f7-98f9-b4c0724158f9 (0.0) -- C:\windows\system32\lsasrv.dll

RPC d25576e4-00d2-43f7-98f9-b4c0724158f9 (0.0) -- C:\WINDOWS\system32\lsasrv.dll

0 -> LsarEasMarkUserControlled

1 -> LsarEasGetCallerPasswordComplexity

2 -> LsarEasGetControlledUsersInfo

RPC c681d488-d850-11d0-8c52-00c04fd90f7e (1.0) -- C:\windows\system32\efslsaext.dll

RPC c681d488-d850-11d0-8c52-00c04fd90f7e (1.0) -- C:\WINDOWS\system32\efslsaext.dll

0 -> EfsRpcOpenFileRaw_Downlevel

1 -> EfsRpcReadFileRaw_Downlevel

2 -> EfsRpcWriteFileRaw_Downlevel

3 -> EfsRpcCloseRaw_Downlevel

4 -> EfsRpcEncryptFileSrv_Downlevel

5 -> EfsRpcDecryptFileSrv_Downlevel

6 -> EfsRpcQueryUsersOnFile_Downlevel

7 -> EfsRpcQueryRecoveryAgents_Downlevel

8 -> EfsRpcRemoveUsersFromFile_Downlevel

9 -> EfsRpcAddUsersToFile_Downlevel

10 -> EfsRpcFileKeyInfoEx_Downlevel

11 -> EfsRpcFileKeyInfoEx_Downlevel

12 -> EfsRpcFileKeyInfo_Downlevel

13 -> EfsRpcDuplicateEncryptionInfoFile_Downlevel

14 -> EfsRpcFileKeyInfoEx_Downlevel

15 -> EfsRpcAddUsersToFileEx_Downlevel

16 -> EfsRpcFileKeyInfoEx_Downlevel

17 -> EfsRpcFileKeyInfoEx_Downlevel

18 -> EfsRpcFileKeyInfoEx_Downlevel

19 -> EfsRpcFileKeyInfoEx_Downlevel

20 -> EfsRpcFlushEfsCache_Downlevel

RPC fb8a0729-2d04-4658-be93-27b4ad553fac (1.0) -- C:\windows\system32\lsass.exe

RPC fb8a0729-2d04-4658-be93-27b4ad553fac (1.0) -- C:\WINDOWS\system32\lsass.exe

0 -> LsaLookuprOpenPolicy2

1 -> LsaLookuprClose

2 -> LsaLookuprTranslateSids2

3 -> LsaLookuprTranslateNames3

4 -> LsaLookuprManageCache

5 -> LsaLookuprGetDomainInfo

6 -> LsaLookuprUserAccountType

RPC 4f32adc8-6052-4a04-8701-293ccf2096f0 (1.0) -- C:\windows\SYSTEM32\SspiSrv.dll

RPC 4f32adc8-6052-4a04-8701-293ccf2096f0 (1.0) -- C:\WINDOWS\SYSTEM32\SspiSrv.dll

0 -> SspirConnectRpc

1 -> SspirDisconnectRpc

2 -> SspirDisconnectRpc

3 -> SspirCallRpc

4 -> SspirAcquireCredentialsHandle

5 -> SspirFreeCredentialsHandle

6 -> SspirProcessSecurityContext

7 -> SspirDeleteSecurityContext

8 -> SspirSslQueryCredentialsAttributes

9 -> SspirNegQueryContextAttributes

10 -> SspirSslSetCredentialsAttributes

11 -> SspirApplyControlToken

12 -> SspirLogonUser

13 -> SspirLookupAccountSid

14 -> SspirGetUserName

15 -> SspirGetInprocDispatchTable

RPC 11220835-5b26-4d94-ae86-c3e475a809de (1.0) -- C:\windows\system32\dpapisrv.dll

RPC 11220835-5b26-4d94-ae86-c3e475a809de (1.0) -- C:\WINDOWS\system32\dpapisrv.dll

0 -> s_SSCryptProtectData

1 -> s_SSCryptUnprotectData

2 -> s_SSCryptUpdateProtectedState

RPC 5cbe92cb-f4be-45c9-9fc9-33e73e557b20 (1.0) -- C:\windows\system32\dpapisrv.dll

RPC 5cbe92cb-f4be-45c9-9fc9-33e73e557b20 (1.0) -- C:\WINDOWS\system32\dpapisrv.dll

0 -> s_SSRecoverQueryStatus

1 -> s_SSRecoverImportRecoveryKey

2 -> s_SSRecoverPassword

RPC 7f1317a8-4dea-4fa2-a551-df5516ff8879 (1.0) -- C:\windows\system32\dpapisrv.dll

RPC 7f1317a8-4dea-4fa2-a551-df5516ff8879 (1.0) -- C:\WINDOWS\system32\dpapisrv.dll

0 -> s_LRpcSIDKeyProtect

1 -> s_LRpcSIDKeyUnprotect

RPC 3919286a-b10c-11d0-9ba8-00c04fd92ef5 (0.0) -- C:\windows\system32\lsasrv.dll

RPC 3919286a-b10c-11d0-9ba8-00c04fd92ef5 (0.0) -- C:\WINDOWS\system32\lsasrv.dll

0 -> DsRolerGetPrimaryDomainInformation

RPC 12345778-1234-abcd-ef00-0123456789ac (1.0) -- C:\windows\SYSTEM32\samsrv.dll

RPC 12345778-1234-abcd-ef00-0123456789ac (1.0) -- C:\WINDOWS\SYSTEM32\samsrv.dll

0 -> SamrConnect

1 -> SamrCloseHandle

2 -> SamrSetSecurityObject

3 -> SamrQuerySecurityObject

4 -> SamrShutdownSamServer

5 -> SamrLookupDomainInSamServer

6 -> SamrEnumerateDomainsInSamServer

7 -> SamrOpenDomain

8 -> SamrQueryInformationDomain

9 -> SamrSetInformationDomain

10 -> SamrCreateGroupInDomain

11 -> SamrEnumerateGroupsInDomain

12 -> SamrCreateUserInDomain

13 -> SamrEnumerateUsersInDomain

14 -> SamrCreateAliasInDomain

15 -> SamrEnumerateAliasesInDomain

16 -> SamrGetAliasMembership

17 -> SamrLookupNamesInDomain

18 -> SamrLookupIdsInDomain

19 -> SamrOpenGroup

20 -> SamrQueryInformationGroup

21 -> SamrSetInformationGroup

22 -> SamrAddMemberToGroup

23 -> SamrDeleteGroup

24 -> SamrRemoveMemberFromGroup

25 -> SamrGetMembersInGroup

26 -> SamrSetMemberAttributesOfGroup

27 -> SamrOpenAlias

28 -> SamrQueryInformationAlias

29 -> SamrSetInformationAlias

30 -> SamrDeleteAlias

31 -> SamrAddMemberToAlias

32 -> SamrRemoveMemberFromAlias

33 -> SamrGetMembersInAlias

34 -> SamrOpenUser

35 -> SamrDeleteUser

36 -> SamrQueryInformationUser

37 -> SamrSetInformationUser

38 -> SamrChangePasswordUser

39 -> SamrGetGroupsForUser

40 -> SamrQueryDisplayInformation

41 -> SamrGetDisplayEnumerationIndex

42 -> SamrTestPrivateFunctionsDomain

43 -> SamrTestPrivateFunctionsUser

44 -> SamrGetUserDomainPasswordInformation

45 -> SamrRemoveMemberFromForeignDomain

46 -> SamrQueryInformationDomain2

47 -> SamrQueryInformationUser2

48 -> SamrQueryDisplayInformation2

49 -> SamrGetDisplayEnumerationIndex2

50 -> SamrCreateUser2InDomain

51 -> SamrQueryDisplayInformation3

52 -> SamrAddMultipleMembersToAlias

53 -> SamrRemoveMultipleMembersFromAlias

54 -> SamrOemChangePasswordUser2

55 -> SamrUnicodeChangePasswordUser2

56 -> SamrGetDomainPasswordInformation

57 -> SamrConnect2

58 -> SamrSetInformationUser2

59 -> SamrSetBootKeyInformation

60 -> SamrGetBootKeyInformation

61 -> SamrConnect3

62 -> SamrConnect4

63 -> SamrUnicodeChangePasswordUser3

64 -> SamrConnect5

65 -> SamrRidToSid

66 -> SamrSetDSRMPassword

67 -> SamrValidatePassword

68 -> SamrQueryLocalizableAccountsInDomain

69 -> SamrPerformGenericOperation

70 -> SamrSyncDSRMPasswordFromAccount

71 -> SamrLookupNamesInDomain2

72 -> SamrEnumerateUsersInDomain2

RPC b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 (2.0) -- C:\windows\system32\keyiso.dll

RPC b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 (2.0) -- C:\WINDOWS\system32\keyiso.dll

0 -> s_SrvRpcCreateContext

1 -> s_SrvRpcReleaseContext

2 -> s_SrvRpcCryptOpenStorageProvider

3 -> s_SrvRpcCryptIsAlgSupported

4 -> s_SrvRpcCryptEnumAlgorithms

5 -> s_SrvRpcCryptEnumKeys

6 -> s_SrvRpcCryptFreeBuffer

7 -> s_SrvRpcCryptFreeProvider

8 -> s_SrvRpcCryptFreeKey

9 -> s_SrvRpcCryptOpenKey

10 -> s_SrvRpcCryptCreatePersistedKey

11 -> s_SrvRpcCryptGetProviderProperty

12 -> s_SrvRpcCryptSetProviderProperty

13 -> s_SrvRpcCryptGetKeyProperty

14 -> s_SrvRpcCryptSetKeyProperty

15 -> s_SrvRpcCryptFinalizeKey

16 -> s_SrvRpcCryptEncrypt

17 -> s_SrvRpcCryptDecrypt

18 -> s_SrvRpcCryptImportKey

19 -> s_SrvRpcCryptExportKey

20 -> s_SrvRpcCryptSignHash

21 -> s_SrvRpcCryptVerifySignature

22 -> s_SrvRpcCryptDeleteKey

23 -> s_SrvRpcCryptNotifyChangeKey

24 -> s_SrvRpcCryptSecretAgreement

25 -> s_SrvRpcCryptDeriveKey

26 -> s_SrvRpcCryptFreeSecret

27 -> s_SrvRpcCryptCipherEncrypt

28 -> s_SrvRpcCryptCipherDecrypt

29 -> s_SrvRpcCryptKeyDerivation

30 -> s_SrvRpcCryptCreateClaim

31 -> s_SrvRpcCryptVerifyClaim

RPC 8fb74744-b2ff-4c00-be0d-9ef9a191fe1b (1.0) -- C:\windows\system32\keyiso.dll

RPC 8fb74744-b2ff-4c00-be0d-9ef9a191fe1b (1.0) -- C:\WINDOWS\system32\keyiso.dll

0 -> s_GetSymmetricPopKeyTransportKey

1 -> s_GetSymmetricPopKeyTransportKeyName

2 -> s_DeleteSymmetricPopKeyTransportKey

3 -> s_ImportSymmetricPopKey

4 -> s_SignWithSymmetricPopKey

5 -> s_VerifyWithSymmetricPopKey

6 -> s_DecryptWithSymmetricPopKey

7 -> s_EncryptWithSymmetricPopKey

8 -> s_GetKeyAttestationForContainerService

9 -> s_RenewKeyAttestation

10 -> s_GetPregenUserKey

11 -> s_GetPregenKeyState

RPC 51a227ae-825b-41f2-b4a9-1ac9557a1018 (1.0) -- C:\windows\system32\keyiso.dll

RPC 51a227ae-825b-41f2-b4a9-1ac9557a1018 (1.0) -- C:\WINDOWS\system32\keyiso.dll

0 -> s_TokenBindingGenerateTpmKeyFromSoftware

RPC bb8b98e8-84dd-45e7-9f34-c3fb6155eeed (1.0) -- C:\Windows\System32\vaultsvc.dll

0 -> VltCreateItemType

1 -> VltDeleteItemType

2 -> VltEnumerateItemTypes

3 -> VltAddItem

4 -> VltFindItems

5 -> VltEnumerateItems

6 -> VltGetItem

7 -> VltRemoveItem

8 -> VltGetItemType

9 -> VltOpenVault

10 -> VltCloseVault

11 -> VltGetInformation

12 -> VltEnumerateVaults

13 -> VltEnumerateSettingUnits

14 -> VltGetSettingUnit

15 -> VltApplySettingUnit

16 -> VltRemoveSettingUnit

17 -> VltTriggerSync

18 -> VltGetSettingUnitInfo

Endpoints :

ncacn_np : \pipe\lsass

ncalrpc : audit

ncalrpc : securityevent

ncalrpc : LSARPC_ENDPOINT

ncalrpc : lsacap

ncalrpc : LSA_IDPEXT_ENDPOINT

ncalrpc : LSA_EAS_ENDPOINT

ncalrpc : lsapolicylookup

ncalrpc : lsasspirpc

ncalrpc : protected_storage

ncalrpc : SidKey Local End Point

ncalrpc : samss lpc

ncacn_ip_tcp : 49678

ncacn_ip_tcp : 1635

ncalrpc : Vault

--------------------------------------------------------------------------------

['PlugPlay']

Interfaces :

Endpoints :

--------------------------------------------------------------------------------

[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000

--------------------------------------------------------------------------------

[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000

--------------------------------------------------------------------------------

['BrokerInfrastructure', 'DcomLaunch', 'Power', 'SystemEventsBroker']

Interfaces :

RPC 6c9b7b96-45a8-4cca-9eb3-e21ccf8b5a89 (1.1) -- c:\windows\system32\umpo.dll

0 -> UmpoRpcGetPowerConfiguration

1 -> UmpoRpcReadFromSystemPowerKey

2 -> UmpoRpcReadFromUserPowerKey

3 -> UmpoRpcReadACValue

4 -> UmpoRpcReadDCValue

5 -> UmpoRpcWriteToSystemPowerKey

6 -> UmpoRpcWriteToUserPowerKey

7 -> UmpoRpcApplyPowerRequestOverride

8 -> UmpoRpcApplyPowerSetting

9 -> UmpoRpcSetActiveScheme

10 -> UmpoRpcGetActiveScheme

11 -> UmpoRpcSetActiveOverlayScheme

12 -> UmpoRpcGetActualOverlayScheme

13 -> UmpoRpcGetEffectiveOverlayScheme

14 -> UmpoRpcGetOverlaySchemes

15 -> UmpoRpcRestoreDefaultScheme

16 -> UmpoRpcRestoreDefaultSchemesAll

17 -> UmpoRpcDuplicateScheme

18 -> UmpoRpcDeleteScheme

19 -> UmpoRpcImportScheme

20 -> UmpoRpcReplaceDefaultPowerSchemes

21 -> UmpoRpcLegacyEventRegisterNotification

22 -> UmpoRpcEnumerate

23 -> UmpoRpcReadSecurityDescriptor

24 -> UmpoRpcWriteSecurityDescriptor

25 -> UmpoRpcSettingAccessCheck

26 -> UmpoRpcCreateSetting

27 -> UmpoRpcCreatePossibleSetting

28 -> UmpoRpcRemoveSetting

29 -> UmpoSetExpectedUserAwayIntervals

30 -> UmpoClearExpectedUserAwayIntervals

31 -> UmpoGetMinUserAwayPredictionInterval

32 -> UmpoRpcGetAdaptiveStandbyDiagnostics

RPC 9b8699ae-0e44-47b1-8e7f-86a461d7ecdc (0.0) -- c:\windows\system32\rpcss.dll

0 -> _LaunchActivatorServer

1 -> _LaunchRunAsServer

2 -> _LaunchService

3 -> _LaunchWinRTActivatorServer

3 -> LaunchWinRTActivatorServer

4 -> _LaunchWinRTRunAsServer

5 -> _LaunchWinRTService

6 -> _CertifyServerIdentity

7 -> _QueryNTService

8 -> _QueryNTServiceType

9 -> ControlNTService

10 -> PrivTranslateShareName

10 -> PrivRunAsSetWinstaDesktop

11 -> GenericStreamBase<IMarshalingStream,AllocationWrapper>::Commit

11 -> PrivRunAsRelease

12 -> IsPortOpen

12 -> PrivRunAsInvalidateAndRelease

13 -> TickleActivationSettings

13 -> PrivTranslateShareName

14 -> QueryProcessArchitecture

14 -> GenericMarshalingStreamWithContextAttributesViaCallback<<lambda_9644d90489056d7e1fb2e547ff4245ea> >::Clone

15 -> PrivilegedNotifyWinRTActivationStoreChanged

15 -> IsPortOpen

16 -> _QueryUserSidForSession

16 -> TickleActivationSettings

17 -> PrivActivatePsmServer

17 -> QueryProcessArchitecture

18 -> _PrivGetUserTokenForSession

18 -> PrivilegedNotifyWinRTActivationStoreChanged

19 -> PrivGetBrokerToken

19 -> _QueryUserSidForSession

20 -> PrivGetDesktopWinRTBrokerToken

20 -> PrivActivatePsmServer

21 -> PrivGetPsmToken

21 -> _PrivGetUserTokenForSession

22 -> GetSessionUserTokenCacheDetails

22 -> PrivGetBrokerToken

23 -> PrivilegedNotifyComClassChangesFromDeployment

23 -> PrivGetDesktopWinRTBrokerToken

24 -> PrivGetPsmTokenWithDynamicId

24 -> PrivGetPsmToken

25 -> PrivGetInteractiveUserToken

25 -> GetSessionUserTokenCacheDetails

26 -> PrivReportUnhealthyProcess

26 -> PrivilegedNotifyComClassChangesFromDeployment

27 -> PrivNormalizePsmTokenHostId

27 -> PrivGetPsmTokenWithDynamicId

28 -> PrivGetInteractiveUserToken

29 -> PrivReportUnhealthyProcess

RPC 4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvActivateApplication

1 -> PsmSrvCloseActivationChannel

2 -> PsmSrvOpenActivationChannel

3 -> PsmSrvRegisterProcess

RPC 085b0334-e454-4d91-9b8c-4134f9e793f3 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvOpenManagementChannel

0 -> PsmSrvInitializeExtension

1 -> PsmSrvSetApplicationState

1 -> PsmSrvOpenManagementChannel

2 -> PsmSrvSetApplicationPriority

2 -> PsmSrvSetApplicationState

3 -> PsmSrvReleaseCacheEntry

3 -> PsmSrvSetApplicationPriority

4 -> PsmSrvAcquireCachedEntries

4 -> PsmSrvReleaseCacheEntry

5 -> PsmSrvQueryApplicationSwapState

5 -> PsmSrvAcquireCachedEntries

6 -> PsmSrvCloseActivationChannel

6 -> PsmSrvQueryApplicationSwapState

7 -> PsmSrvSetApplicationProperties

7 -> PsmSrvCloseActivationChannel

8 -> PsmSrvQueryApplicationProperties

8 -> PsmSrvSetApplicationProperties

9 -> PsmSrvQueryApplicationResourceUsage

9 -> PsmSrvQueryApplicationProperties

10 -> PsmSrvQueryMemoryUsage

10 -> PsmSrvQueryApplicationResourceUsage

11 -> PsmSrvResetMaxMemoryUsage

11 -> PsmSrvQueryMemoryUsage

12 -> PsmSrvQuerySharedCommit

12 -> PsmSrvResetMaxMemoryUsage

13 -> PsmSrvQuerySharedCommit

RPC 8782d3b9-ebbd-4644-a3d8-e8725381919b (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvRegisterQuiesceResumeApp

1 -> PsmSrvQuiesceCallbacksComplete

2 -> PsmSrvCloseActivationChannel

RPC 3b338d89-6cfa-44b8-847e-531531bc9992 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvQueryApplicationPerformanceInformation

1 -> PsmSrvQueryQuotaInformation

RPC bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvOpenTcChannel

1 -> PsmSrvApplyTaskCompletion

2 -> PsmSrvRegisterDynamicProcess

3 -> PsmSrvCloseActivationChannel

4 -> PsmSrvGetSessionInfo

RPC 5824833b-3c1a-4ad2-bdfd-c31d19e23ed2 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvRegisterAppPriorityNotification

1 -> PsmSrvQueryApplicationResourceUsageForTimer

2 -> PsmSrvTimerStart

3 -> PsmSrvTimerCleanup

4 -> PsmSrvTimerRemainingResourceTimeGet

5 -> PsmSrvTimerElapsedResourceTimeGet

RPC 0361ae94-0316-4c6c-8ad8-c594375800e2 (1.0) -- c:\windows\system32\psmsrv.dll

0 -> PsmSrvQueryCurrentApplications

1 -> PsmSrvQueryApplicationHosts

2 -> PsmSrvQueryApplicationHostExecutionState

3 -> PsmSrvQueryApplicationHostJob

4 -> PsmSrvConnect

5 -> PsmSrvDisconnect

6 -> PsmSrvSubscribeToNotifications

7 -> PsmSrvUnsubscribeFromNotifications

RPC 2d98a740-581d-41b9-aa0d-a88b9d5ce938 (1.0) -- C:\windows\SYSTEM32\bisrv.dll

RPC 2d98a740-581d-41b9-aa0d-a88b9d5ce938 (1.0) -- c:\windows\system32\bisrv.dll

0 -> RBiSrvActivateDeferredWorkItem

1 -> RBiSrvActivateInBackground

2 -> RBiSrvActivateWorkItem

3 -> RBiSrvAssociateActivationProxy

4 -> RBiSrvAssociateApplicationExtensionClass

5 -> RBiSrvCancelWorkItem

6 -> RBiSrvCreateEvent

7 -> RBiSrvCreateEventForPackageName

8 -> RBiSrvDeleteEvent

9 -> RBiSrvDisassociateWorkItem

10 -> RBiSrvDiscardPendingActivations

11 -> RBiSrvEnumerateBrokeredEvents

12 -> RBiSrvEnumerateUserContexts

13 -> RBiSrvEnumerateUserSessions

14 -> RBiSrvEnumerateWorkItemsForPackageName

15 -> RBiPtSrvGetStatusStateNameFromBrokerEventId

15 -> RBiSrvQueryBrokeredEvent

16 -> RBiSrvQueryBrokeredEvent

16 -> RBiSrvQuerySystemStateBroadcastChannels

17 -> RBiSrvQuerySystemStateBroadcastChannels

17 -> RBiSrvQueryUserContext

18 -> RBiSrvQueryUserContext

18 -> RBiSrvQueryUserSession

19 -> RBiSrvQueryUserSession

19 -> RBiSrvQueryWorkItem

20 -> RBiSrvQueryWorkItem

20 -> RBiPtSrvQueryWorkItemStatusStateName

21 -> RBiPtSrvQueryWorkItemStatusStateName

21 -> RBiSrvSignalEvent

22 -> RBiSrvSignalEvent

22 -> RBiSrvSignalMultipleEvents

23 -> RBiSrvSignalMultipleEvents

23 -> RBiSrvSignalTriggerEvent

24 -> RBiSrvSignalTriggerEvent

24 -> RBiSrvUpdateEventParameters

25 -> RBiSrvUpdateEventParameters

25 -> RBiSrvUpdateEventFlags

26 -> RBiSrvUpdateEventFlags

26 -> RBiSrvUpdateEventInformation

27 -> RBiSrvUpdateEventInformation

RPC 8bfc3be1-6def-4e2d-af74-7c47cd0ade4a (1.0) -- c:\windows\system32\bisrv.dll

RPC 8bfc3be1-6def-4e2d-af74-7c47cd0ade4a (1.0) -- C:\windows\SYSTEM32\bisrv.dll

0 -> RBiSrvActivateWorkItemForUser

1 -> RBiSrvChangeApplicationStateForPackageNameForUser

2 -> RBiSrvChangeApplicationStateForPsmKeyForUser

3 -> RBiSrvChangeUserState

4 -> RBiSrvEnumerateWorkItemsForPackageNameAndUser

5 -> RBiSrvGetActiveBackgroundTasksEventForUser

6 -> RBiSrvGetCancellationTimeoutInMs

7 -> RBiSrvIsApplicationTerminateSensitiveForUser

8 -> RBiSrvNotifyEndSession

9 -> RBiSrvNotifyNewSession

10 -> RBiSrvNotifyNewSessionComplete

11 -> RBiSrvNotifyNewUser

12 -> RBiSrvQueryWorkItemForUser

13 -> RBiSrvResetActiveUserForPackage

14 -> RBiSrvSetActiveUserForPackage

15 -> RBiSrvTerminateApplicationHostForUser

16 -> RBiSrvUpdateBackgroundAccessApplicationsForUser

RPC 1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 (1.0) -- C:\windows\SYSTEM32\bisrv.dll

RPC 1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 (1.0) -- c:\windows\system32\bisrv.dll

0 -> RBiRtSrvAddWaitableEvent

1 -> RBiRtSrvAssociateWorkItem

2 -> RBiRtSrvCreateEvent

3 -> RBiRtSrvCreateEventForApp

4 -> RBiRtSrvCreateStatusStateName

5 -> RBiRtSrvDeleteEvent

6 -> RBiRtSrvDisassociateWorkItem

7 -> RBiRtSrvEnumerateBrokeredEvents

8 -> RBiRtSrvEnumerateWorkItems

9 -> RBiRtSrvGetWorkItemProperties

10 -> RBiRtSrvInitiatePause

11 -> RBiRtSrvQueryBrokerEventId

12 -> RBiRtSrvQueryBrokerEventIdFromWorkItem

13 -> RBiRtSrvRegisterWorkItem

14 -> RBiRtSrvSignalEvent

15 -> RBiRtSrvUpdateEventParameters

RPC c605f9fb-f0a3-4e2a-a073-73560f8d9e3e (1.0) -- c:\windows\system32\bisrv.dll

0 -> RBiSrvSignalEvent

RPC 0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e (1.0) -- c:\windows\system32\bisrv.dll

0 -> RBiPtSrvActivateDeferredWorkItem

1 -> RBiPtSrvActivateInBackground

2 -> RBiPtSrvActivateWorkItem

3 -> RBiPtSrvAssociateActivationProxy

4 -> RBiPtSrvAssociateApplicationEntryPoint

5 -> RBiPtSrvCancelWorkItem

6 -> RBiPtSrvCreateEvent

7 -> RBiPtSrvCreateEventForApp

8 -> RBiPtSrvCreateEventForPackageName

9 -> RBiPtSrvDeleteEvent

10 -> RBiPtSrvDisableWorkItem

11 -> RBiPtSrvDisassociateWorkItem

12 -> RBiPtSrvEnableWorkItem

13 -> RBiPtSrvEnumerateBrokeredEvents

14 -> RBiPtSrvEnumerateWorkItemsF

Les différences enregistrées

Texte d'origine

Ouvrir un fichier

--------------------------------------------------------------------------------
<WinProcess "smss.exe" pid 368 at 0x5306908L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 472 at 0x5306e48L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "wininit.exe" pid 548 at 0x5306780L>
64

Interfaces :
RPC  76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\windows\system32\wininit.exe
	0 -> I_WMsgkSendMessage
	1 -> I_WMsgkSendPSPMessage
RPC  894de0c0-0d55-11d3-a322-00c04fa321a1 (1.0) -- C:\windows\system32\wininit.exe
	0 -> s_BaseInitiateShutdown
	1 -> s_BaseAbortShutdown
	2 -> s_BaseInitiateShutdownEx
RPC  d95afe70-a6d5-4259-822e-2c84da1ddb0d (1.0) -- C:\windows\system32\wininit.exe
	0 -> s_WsdrInitiateShutdown
	1 -> s_WsdrAbortShutdown
	2 -> s_WsdrCheckForHiberboot
RPC  76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\windows\system32\wininit.exe
	0 -> I_WMsgSendMessage
	1 -> I_WMsgSendPSPMessage
	2 -> I_WMsgSendNotifyMessage
	3 -> I_WMsgSendReconnectionUpdateMessage
Endpoints :
ncalrpc         : WMsgKRpc0551A0
ncacn_np        : \PIPE\InitShutdown
ncalrpc         : WindowsShutdown
ncacn_ip_tcp    : 49664
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 564 at 0x53069e8L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "winlogon.exe" pid 644 at 0x5306860L>
64

Interfaces :
RPC  367abb81-9844-35f1-ad32-98f038001003 (2.0) -- C:\windows\system32\services.exe
	0 -> RCloseServiceHandle
	1 -> RControlService
	2 -> RDeleteService
	3 -> RLockServiceDatabase
	4 -> RQueryServiceObjectSecurity
	5 -> RSetServiceObjectSecurity
	6 -> RQueryServiceStatus
	7 -> RSetServiceStatus
	8 -> RUnlockServiceDatabase
	9 -> RNotifyBootConfigStatus
	10 -> RI_ScSetServiceBitsW
	11 -> RChangeServiceConfigW
	12 -> RCreateServiceW
	13 -> REnumDependentServicesW
	14 -> REnumServicesStatusW
	15 -> ROpenSCManagerW
	16 -> ROpenServiceW
	17 -> RQueryServiceConfigW
	18 -> RQueryServiceLockStatusW
	19 -> RStartServiceW
	20 -> RGetServiceDisplayNameW
	21 -> RGetServiceKeyNameW
	22 -> CServiceRecord::GetStatusInternal
	23 -> RChangeServiceConfigA
	24 -> RCreateServiceA
	25 -> REnumDependentServicesA
	26 -> REnumServicesStatusA
	27 -> ROpenSCManagerA
	28 -> ROpenServiceA
	29 -> RQueryServiceConfigA
	30 -> RQueryServiceLockStatusA
	31 -> RStartServiceA
	32 -> RGetServiceDisplayNameA
	33 -> RGetServiceKeyNameA
	34 -> CServiceRecord::GetStatusInternal
	35 -> REnumServiceGroupW
	36 -> RChangeServiceConfig2A
	37 -> RChangeServiceConfig2W
	38 -> RQueryServiceConfig2A
	39 -> RQueryServiceConfig2W
	40 -> RQueryServiceStatusEx
	41 -> REnumServicesStatusExA
	42 -> REnumServicesStatusExW
	43 -> RI_ScBroadcastServiceControlMessage
	44 -> RCreateServiceWOW64A
	45 -> RCreateServiceWOW64W
	46 -> RI_ScQueryServiceTagInfo
	47 -> RNotifyServiceStatusChange
	48 -> RGetNotifyResults
	49 -> RCloseNotifyHandle
	50 -> RControlServiceExA
	51 -> RControlServiceExW
	52 -> RI_ScSendPnPMessage
	53 -> RI_ScValidatePnPService
	54 -> RI_ScOpenServiceStatusHandle
	55 -> RI_ScQueryServiceConfig
	56 -> RQueryServiceConfigEx
	57 -> RI_ScRegisterPreshutdownRestart
	58 -> RI_ScReparseServiceDatabase
	59 -> RQueryUserServiceName
	60 -> RCreateWowService
	61 -> RGetServiceRegistryStateKey
	62 -> RGetServiceDirectory
	63 -> RGetServiceProcessToken
RPC  a2c45f7c-7d32-46ad-96f5-adafb486be74 (1.0) -- C:\windows\system32\services.exe
	0 -> RI_ScOpenServiceChannelHandle
	1 -> RI_ScSendResponseReceiveControls
	2 -> RI_ScCloseServiceChannelHandle
RPC  93149ca2-973b-11d1-8c39-00c04fb984f9 (0.0) -- C:\windows\SYSTEM32\scesrv.dll
	0 -> SceSvcRpcQueryInfo
	1 -> SceSvcRpcSetInfo
	2 -> SceRpcSetupUpdateObject
	3 -> SceRpcSetupMoveFile
	4 -> SceRpcGenerateTemplate
	5 -> SceRpcConfigureSystem
	6 -> SceRpcGetDatabaseInfo
	7 -> SceRpcGetObjectChildren
	8 -> SceRpcOpenDatabase
	9 -> SceRpcCloseDatabase
	10 -> SceRpcGetDatabaseDescription
	11 -> SceRpcGetDBTimeStamp
	12 -> SceRpcGetObjectSecurity
	13 -> SceRpcGetAnalysisSummary
	14 -> SceRpcAnalyzeSystem
	15 -> SceRpcUpdateDatabaseInfo
	16 -> SceRpcUpdateObjectInfo
	17 -> SceRpcStartTransaction
	18 -> SceRpcCommitTransaction
	19 -> SceRpcRollbackTransaction
	20 -> SceRpcGetServerProductType
	21 -> SceSvcRpcUpdateInfo
	22 -> SceRpcCopyObjects
	23 -> SceRpcSetupResetLocalPolicy
	24 -> SceRpcNotifySaveChangesInGP
	25 -> SceRpcControlNotificationQProcess
	26 -> SceRpcBrowseDatabaseTable
	27 -> SceRpcGetSystemSecurity
	28 -> SceRpcGetSystemSecurity
	29 -> SceRpcSetSystemSecurity
	30 -> SceRpcSetSystemSecurity
	31 -> SceRpcSetDatabaseSetting
	32 -> SceRpcGetDatabaseSetting
	33 -> SceRpcConfigureConvertedFileSecurityImmediately
Endpoints :
ncalrpc         : ntsvcs
ncacn_np        : \pipe\ntsvcs
ncacn_np        : \PIPE\scerpc
ncacn_ip_tcp    : 49677
--------------------------------------------------------------------------------
<WinProcess "lsass.exe" pid 692 at 0x53062b0L>
64
['KeyIso', 'SamSs', 'VaultSvc']

Interfaces :
RPC  12345778-1234-abcd-ef00-0123456789ab (0.0) -- C:\windows\system32\lsasrv.dll
	0 -> LsarClose
	1 -> CredrRename
	2 -> LsarEnumeratePrivileges
	3 -> LsarQuerySecurityObject
	4 -> LsarSetSecurityObject
	5 -> LsaITestCall
	6 -> LsarOpenPolicyRPC
	7 -> LsarQueryInformationPolicy
	8 -> LsarSetInformationPolicy
	9 -> LsaITestCall
	10 -> LsarCreateAccount
	11 -> LsarEnumerateAccounts
	12 -> LsarCreateTrustedDomain
	13 -> LsarEnumerateTrustedDomains
	14 -> LsarLookupNames
	15 -> LsarLookupSids
	16 -> LsarCreateSecret
	17 -> LsarOpenAccount
	18 -> LsarEnumeratePrivilegesAccount
	19 -> LsarAddPrivilegesToAccount
	20 -> LsarRemovePrivilegesFromAccount
	21 -> LsarGetQuotasForAccount
	22 -> LsarSetQuotasForAccount
	23 -> LsarGetSystemAccessAccount
	24 -> LsarSetSystemAccessAccount
	25 -> LsarOpenTrustedDomain
	26 -> LsarQueryInfoTrustedDomain
	27 -> LsarSetInformationTrustedDomain
	28 -> LsarOpenSecret
	29 -> LsarSetSecret
	30 -> LsarQuerySecret
	31 -> LsarLookupPrivilegeValue
	32 -> LsarLookupPrivilegeName
	33 -> LsarLookupPrivilegeDisplayName
	34 -> LsarDeleteObject
	35 -> LsarEnumerateAccountsWithUserRight
	36 -> LsarEnumerateAccountRights
	37 -> LsarAddAccountRights
	38 -> LsarRemoveAccountRights
	39 -> LsarQueryTrustedDomainInfo
	40 -> LsarSetTrustedDomainInfo
	41 -> LsarDeleteTrustedDomain
	42 -> LsarStorePrivateData
	43 -> LsarRetrievePrivateData
	44 -> LsarOpenPolicy2
	45 -> LsarGetUserName
	46 -> LsarQueryInformationPolicy2
	47 -> LsarSetInformationPolicy2
	48 -> LsarQueryTrustedDomainInfoByName
	49 -> LsarSetTrustedDomainInfoByName
	50 -> LsarEnumerateTrustedDomainsEx
	51 -> LsarCreateTrustedDomainEx
	52 -> LsaITestCall
	53 -> LsarQueryDomainInformationPolicy
	54 -> LsarSetDomainInformationPolicy
	55 -> LsarOpenTrustedDomainByName
	56 -> LsaITestCall
	57 -> LsarLookupSids2
	58 -> LsarLookupNames2
	59 -> LsarCreateTrustedDomainEx2
	60 -> CredrWrite
	61 -> CredrRead
	62 -> CredrEnumerate
	63 -> CredrWriteDomainCredentials
	64 -> CredrReadDomainCredentials
	65 -> CredrDelete
	66 -> CredrGetTargetInfo
	67 -> CredrProfileLoaded
	68 -> LsarLookupNames3
	69 -> CredrGetSessionTypes
	70 -> LsarRegisterAuditEvent
	71 -> LsarGenAuditEvent
	72 -> LsarUnregisterAuditEvent
	73 -> LsarQueryForestTrustInformation
	74 -> LsarSetForestTrustInformation
	75 -> CredrRename
	76 -> LsarLookupSids3
	77 -> LsarLookupNames4
	78 -> LsarOpenPolicySce
	79 -> LsarAdtRegisterSecurityEventSource
	80 -> LsarAdtUnregisterSecurityEventSource
	81 -> LsarAdtReportSecurityEvent
	82 -> CredrFindBestCredential
	83 -> LsarSetAuditPolicy
	84 -> LsarQueryAuditPolicy
	85 -> LsarEnumerateAuditPolicy
	86 -> LsarEnumerateAuditCategories
	87 -> LsarEnumerateAuditSubCategories
	88 -> LsarLookupAuditCategoryName
	89 -> LsarLookupAuditSubCategoryName
	90 -> LsarSetAuditSecurity
	91 -> LsarQueryAuditSecurity
	92 -> CredrReadByTokenHandle
	93 -> CredrRestoreCredentials
	94 -> CredrBackupCredentials
	95 -> LsarManageSidNameMapping
	96 -> CredrProfileUnloaded
	97 -> CredrRename
	98 -> CredrRename
	99 -> CredrRename
	100 -> CredrRename
	101 -> CredrRename
	102 -> LsarEfsGetSmartcardCredentials
	103 -> LsarAuditSetGlobalSacl
	104 -> LsarAuditQueryGlobalSacl
	105 -> CredrProfileLoadedEx
	106 -> LsarInteractiveSessionIsLoggedOff
	107 -> LsarConfigureAutoLogonCredentials
	108 -> LsarGetDeviceRegistrationInfo
	109 -> LsaITestCall
	110 -> LsarProfileDeleted
	111 -> LsaITestCall
	112 -> CredrRename
	113 -> LsarValidateProcUniqueLuid
	114 -> LsarIsArsoAllowedByPolicy
	115 -> LsarIsArsoAllowedByConsent
	116 -> LsarEnableArsoConsent
	117 -> LsarDisableArsoConsent
	118 -> LsarIsArsoAllowedByPolicy
	119 -> LsarIsUserArsoEnabled
	120 -> LsarEnableUserArso
	121 -> LsarDisableUserArso
	122 -> LsarConfigureUserArso
	123 -> LsarGetInprocDispatchTable
	124 -> LsarSetSharedUserSession
	125 -> LsarClearSharedUserSession
	126 -> LsarEnablePasswordLessCurrentUser
	127 -> LsarDisablePasswordLessCurrentUser
RPC  ace1c026-8b3f-4711-8918-f345d17f5bff (1.0) -- C:\windows\system32\lsasrv.dll
	0 -> S_RPC_LspUpdatePrivateData
	1 -> S_RPC_LspReadPrivateData
RPC  afc07e2e-311c-4435-808c-c483ffeec7c9 (1.0) -- C:\windows\system32\lsasrv.dll
	0 -> LsarGetAvailableCAPIDs
	1 -> LsarSetCAPs
	2 -> LsarQueryCAPs
RPC  c0d930f0-b787-4124-99bc-21f0ecb642ce (0.0) -- C:\windows\system32\lsasrv.dll
	0 -> LsarConnectLocalUser
	1 -> LsarDisconnectLocalUser
	2 -> LsarCreateConnectedUser
	3 -> LsarIsCurrentUserConnected
	4 -> LsarRenewCertificate
	5 -> LsarGetSSOAccountType
	6 -> LsarIsUserMSA
RPC  d25576e4-00d2-43f7-98f9-b4c0724158f9 (0.0) -- C:\windows\system32\lsasrv.dll
	0 -> LsarEasMarkUserControlled
	1 -> LsarEasGetCallerPasswordComplexity
	2 -> LsarEasGetControlledUsersInfo
RPC  c681d488-d850-11d0-8c52-00c04fd90f7e (1.0) -- C:\windows\system32\efslsaext.dll
	0 -> EfsRpcOpenFileRaw_Downlevel
	1 -> EfsRpcReadFileRaw_Downlevel
	2 -> EfsRpcWriteFileRaw_Downlevel
	3 -> EfsRpcCloseRaw_Downlevel
	4 -> EfsRpcEncryptFileSrv_Downlevel
	5 -> EfsRpcDecryptFileSrv_Downlevel
	6 -> EfsRpcQueryUsersOnFile_Downlevel
	7 -> EfsRpcQueryRecoveryAgents_Downlevel
	8 -> EfsRpcRemoveUsersFromFile_Downlevel
	9 -> EfsRpcAddUsersToFile_Downlevel
	10 -> EfsRpcFileKeyInfoEx_Downlevel
	11 -> EfsRpcFileKeyInfoEx_Downlevel
	12 -> EfsRpcFileKeyInfo_Downlevel
	13 -> EfsRpcDuplicateEncryptionInfoFile_Downlevel
	14 -> EfsRpcFileKeyInfoEx_Downlevel
	15 -> EfsRpcAddUsersToFileEx_Downlevel
	16 -> EfsRpcFileKeyInfoEx_Downlevel
	17 -> EfsRpcFileKeyInfoEx_Downlevel
	18 -> EfsRpcFileKeyInfoEx_Downlevel
	19 -> EfsRpcFileKeyInfoEx_Downlevel
	20 -> EfsRpcFlushEfsCache_Downlevel
RPC  fb8a0729-2d04-4658-be93-27b4ad553fac (1.0) -- C:\windows\system32\lsass.exe
	0 -> LsaLookuprOpenPolicy2
	1 -> LsaLookuprClose
	2 -> LsaLookuprTranslateSids2
	3 -> LsaLookuprTranslateNames3
	4 -> LsaLookuprManageCache
	5 -> LsaLookuprGetDomainInfo
	6 -> LsaLookuprUserAccountType
RPC  4f32adc8-6052-4a04-8701-293ccf2096f0 (1.0) -- C:\windows\SYSTEM32\SspiSrv.dll
	0 -> SspirConnectRpc
	1 -> SspirDisconnectRpc
	2 -> SspirDisconnectRpc
	3 -> SspirCallRpc
	4 -> SspirAcquireCredentialsHandle
	5 -> SspirFreeCredentialsHandle
	6 -> SspirProcessSecurityContext
	7 -> SspirDeleteSecurityContext
	8 -> SspirSslQueryCredentialsAttributes
	9 -> SspirNegQueryContextAttributes
	10 -> SspirSslSetCredentialsAttributes
	11 -> SspirApplyControlToken
	12 -> SspirLogonUser
	13 -> SspirLookupAccountSid
	14 -> SspirGetUserName
	15 -> SspirGetInprocDispatchTable
RPC  11220835-5b26-4d94-ae86-c3e475a809de (1.0) -- C:\windows\system32\dpapisrv.dll
	0 -> s_SSCryptProtectData
	1 -> s_SSCryptUnprotectData
	2 -> s_SSCryptUpdateProtectedState
RPC  5cbe92cb-f4be-45c9-9fc9-33e73e557b20 (1.0) -- C:\windows\system32\dpapisrv.dll
	0 -> s_SSRecoverQueryStatus
	1 -> s_SSRecoverImportRecoveryKey
	2 -> s_SSRecoverPassword
RPC  7f1317a8-4dea-4fa2-a551-df5516ff8879 (1.0) -- C:\windows\system32\dpapisrv.dll
	0 -> s_LRpcSIDKeyProtect
	1 -> s_LRpcSIDKeyUnprotect
RPC  3919286a-b10c-11d0-9ba8-00c04fd92ef5 (0.0) -- C:\windows\system32\lsasrv.dll
	0 -> DsRolerGetPrimaryDomainInformation
RPC  12345778-1234-abcd-ef00-0123456789ac (1.0) -- C:\windows\SYSTEM32\samsrv.dll
	0 -> SamrConnect
	1 -> SamrCloseHandle
	2 -> SamrSetSecurityObject
	3 -> SamrQuerySecurityObject
	4 -> SamrShutdownSamServer
	5 -> SamrLookupDomainInSamServer
	6 -> SamrEnumerateDomainsInSamServer
	7 -> SamrOpenDomain
	8 -> SamrQueryInformationDomain
	9 -> SamrSetInformationDomain
	10 -> SamrCreateGroupInDomain
	11 -> SamrEnumerateGroupsInDomain
	12 -> SamrCreateUserInDomain
	13 -> SamrEnumerateUsersInDomain
	14 -> SamrCreateAliasInDomain
	15 -> SamrEnumerateAliasesInDomain
	16 -> SamrGetAliasMembership
	17 -> SamrLookupNamesInDomain
	18 -> SamrLookupIdsInDomain
	19 -> SamrOpenGroup
	20 -> SamrQueryInformationGroup
	21 -> SamrSetInformationGroup
	22 -> SamrAddMemberToGroup
	23 -> SamrDeleteGroup
	24 -> SamrRemoveMemberFromGroup
	25 -> SamrGetMembersInGroup
	26 -> SamrSetMemberAttributesOfGroup
	27 -> SamrOpenAlias
	28 -> SamrQueryInformationAlias
	29 -> SamrSetInformationAlias
	30 -> SamrDeleteAlias
	31 -> SamrAddMemberToAlias
	32 -> SamrRemoveMemberFromAlias
	33 -> SamrGetMembersInAlias
	34 -> SamrOpenUser
	35 -> SamrDeleteUser
	36 -> SamrQueryInformationUser
	37 -> SamrSetInformationUser
	38 -> SamrChangePasswordUser
	39 -> SamrGetGroupsForUser
	40 -> SamrQueryDisplayInformation
	41 -> SamrGetDisplayEnumerationIndex
	42 -> SamrTestPrivateFunctionsDomain
	43 -> SamrTestPrivateFunctionsUser
	44 -> SamrGetUserDomainPasswordInformation
	45 -> SamrRemoveMemberFromForeignDomain
	46 -> SamrQueryInformationDomain2
	47 -> SamrQueryInformationUser2
	48 -> SamrQueryDisplayInformation2
	49 -> SamrGetDisplayEnumerationIndex2
	50 -> SamrCreateUser2InDomain
	51 -> SamrQueryDisplayInformation3
	52 -> SamrAddMultipleMembersToAlias
	53 -> SamrRemoveMultipleMembersFromAlias
	54 -> SamrOemChangePasswordUser2
	55 -> SamrUnicodeChangePasswordUser2
	56 -> SamrGetDomainPasswordInformation
	57 -> SamrConnect2
	58 -> SamrSetInformationUser2
	59 -> SamrSetBootKeyInformation
	60 -> SamrGetBootKeyInformation
	61 -> SamrConnect3
	62 -> SamrConnect4
	63 -> SamrUnicodeChangePasswordUser3
	64 -> SamrConnect5
	65 -> SamrRidToSid
	66 -> SamrSetDSRMPassword
	67 -> SamrValidatePassword
	68 -> SamrQueryLocalizableAccountsInDomain
	69 -> SamrPerformGenericOperation
	70 -> SamrSyncDSRMPasswordFromAccount
	71 -> SamrLookupNamesInDomain2
	72 -> SamrEnumerateUsersInDomain2
RPC  b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 (2.0) -- C:\windows\system32\keyiso.dll
	0 -> s_SrvRpcCreateContext
	1 -> s_SrvRpcReleaseContext
	2 -> s_SrvRpcCryptOpenStorageProvider
	3 -> s_SrvRpcCryptIsAlgSupported
	4 -> s_SrvRpcCryptEnumAlgorithms
	5 -> s_SrvRpcCryptEnumKeys
	6 -> s_SrvRpcCryptFreeBuffer
	7 -> s_SrvRpcCryptFreeProvider
	8 -> s_SrvRpcCryptFreeKey
	9 -> s_SrvRpcCryptOpenKey
	10 -> s_SrvRpcCryptCreatePersistedKey
	11 -> s_SrvRpcCryptGetProviderProperty
	12 -> s_SrvRpcCryptSetProviderProperty
	13 -> s_SrvRpcCryptGetKeyProperty
	14 -> s_SrvRpcCryptSetKeyProperty
	15 -> s_SrvRpcCryptFinalizeKey
	16 -> s_SrvRpcCryptEncrypt
	17 -> s_SrvRpcCryptDecrypt
	18 -> s_SrvRpcCryptImportKey
	19 -> s_SrvRpcCryptExportKey
	20 -> s_SrvRpcCryptSignHash
	21 -> s_SrvRpcCryptVerifySignature
	22 -> s_SrvRpcCryptDeleteKey
	23 -> s_SrvRpcCryptNotifyChangeKey
	24 -> s_SrvRpcCryptSecretAgreement
	25 -> s_SrvRpcCryptDeriveKey
	26 -> s_SrvRpcCryptFreeSecret
	27 -> s_SrvRpcCryptCipherEncrypt
	28 -> s_SrvRpcCryptCipherDecrypt
	29 -> s_SrvRpcCryptKeyDerivation
	30 -> s_SrvRpcCryptCreateClaim
	31 -> s_SrvRpcCryptVerifyClaim
RPC  8fb74744-b2ff-4c00-be0d-9ef9a191fe1b (1.0) -- C:\windows\system32\keyiso.dll
	0 -> s_GetSymmetricPopKeyTransportKey
	1 -> s_GetSymmetricPopKeyTransportKeyName
	2 -> s_DeleteSymmetricPopKeyTransportKey
	3 -> s_ImportSymmetricPopKey
	4 -> s_SignWithSymmetricPopKey
	5 -> s_VerifyWithSymmetricPopKey
	6 -> s_DecryptWithSymmetricPopKey
	7 -> s_EncryptWithSymmetricPopKey
	8 -> s_GetKeyAttestationForContainerService
	9 -> s_RenewKeyAttestation
	10 -> s_GetPregenUserKey
	11 -> s_GetPregenKeyState
RPC  51a227ae-825b-41f2-b4a9-1ac9557a1018 (1.0) -- C:\windows\system32\keyiso.dll
	0 -> s_TokenBindingGenerateTpmKeyFromSoftware
RPC  bb8b98e8-84dd-45e7-9f34-c3fb6155eeed (1.0) -- C:\Windows\System32\vaultsvc.dll
	0 -> VltCreateItemType
	1 -> VltDeleteItemType
	2 -> VltEnumerateItemTypes
	3 -> VltAddItem
	4 -> VltFindItems
	5 -> VltEnumerateItems
	6 -> VltGetItem
	7 -> VltRemoveItem
	8 -> VltGetItemType
	9 -> VltOpenVault
	10 -> VltCloseVault
	11 -> VltGetInformation
	12 -> VltEnumerateVaults
	13 -> VltEnumerateSettingUnits
	14 -> VltGetSettingUnit
	15 -> VltApplySettingUnit
	16 -> VltRemoveSettingUnit
	17 -> VltTriggerSync
	18 -> VltGetSettingUnitInfo
Endpoints :
ncacn_np        : \pipe\lsass
ncalrpc         : audit
ncalrpc         : securityevent
ncalrpc         : LSARPC_ENDPOINT
ncalrpc         : lsacap
ncalrpc         : LSA_IDPEXT_ENDPOINT
ncalrpc         : LSA_EAS_ENDPOINT
ncalrpc         : lsapolicylookup
ncalrpc         : lsasspirpc
ncalrpc         : protected_storage
ncalrpc         : SidKey Local End Point
ncalrpc         : samss lpc
ncacn_ip_tcp    : 49678
ncalrpc         : Vault
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 808 at 0x5306e10L>
64
['PlugPlay']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "fontdrvhost.exe" pid 832 at 0x5306ba8L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "fontdrvhost.exe" pid 828 at 0x5306898L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 844 at 0x53064a8L>
64
['BrokerInfrastructure', 'DcomLaunch', 'Power', 'SystemEventsBroker']

Interfaces :
RPC  6c9b7b96-45a8-4cca-9eb3-e21ccf8b5a89 (1.1) -- c:\windows\system32\umpo.dll
	0 -> UmpoRpcGetPowerConfiguration
	1 -> UmpoRpcReadFromSystemPowerKey
	2 -> UmpoRpcReadFromUserPowerKey
	3 -> UmpoRpcReadACValue
	4 -> UmpoRpcReadDCValue
	5 -> UmpoRpcWriteToSystemPowerKey
	6 -> UmpoRpcWriteToUserPowerKey
	7 -> UmpoRpcApplyPowerRequestOverride
	8 -> UmpoRpcApplyPowerSetting
	9 -> UmpoRpcSetActiveScheme
	10 -> UmpoRpcGetActiveScheme
	11 -> UmpoRpcSetActiveOverlayScheme
	12 -> UmpoRpcGetActualOverlayScheme
	13 -> UmpoRpcGetEffectiveOverlayScheme
	14 -> UmpoRpcGetOverlaySchemes
	15 -> UmpoRpcRestoreDefaultScheme
	16 -> UmpoRpcRestoreDefaultSchemesAll
	17 -> UmpoRpcDuplicateScheme
	18 -> UmpoRpcDeleteScheme
	19 -> UmpoRpcImportScheme
	20 -> UmpoRpcReplaceDefaultPowerSchemes
	21 -> UmpoRpcLegacyEventRegisterNotification
	22 -> UmpoRpcEnumerate
	23 -> UmpoRpcReadSecurityDescriptor
	24 -> UmpoRpcWriteSecurityDescriptor
	25 -> UmpoRpcSettingAccessCheck
	26 -> UmpoRpcCreateSetting
	27 -> UmpoRpcCreatePossibleSetting
	28 -> UmpoRpcRemoveSetting
	29 -> UmpoSetExpectedUserAwayIntervals
	30 -> UmpoClearExpectedUserAwayIntervals
	31 -> UmpoGetMinUserAwayPredictionInterval
	32 -> UmpoRpcGetAdaptiveStandbyDiagnostics
RPC  9b8699ae-0e44-47b1-8e7f-86a461d7ecdc (0.0) -- c:\windows\system32\rpcss.dll
	0 -> _LaunchActivatorServer
	1 -> _LaunchRunAsServer
	2 -> _LaunchService
	3 -> _LaunchWinRTActivatorServer
	4 -> _LaunchWinRTRunAsServer
	5 -> _LaunchWinRTService
	6 -> _CertifyServerIdentity
	7 -> _QueryNTService
	8 -> _QueryNTServiceType
	9 -> ControlNTService
	10 -> PrivTranslateShareName
	11 -> GenericStreamBase<IMarshalingStream,AllocationWrapper>::Commit
	12 -> IsPortOpen
	13 -> TickleActivationSettings
	14 -> QueryProcessArchitecture
	15 -> PrivilegedNotifyWinRTActivationStoreChanged
	16 -> _QueryUserSidForSession
	17 -> PrivActivatePsmServer
	18 -> _PrivGetUserTokenForSession
	19 -> PrivGetBrokerToken
	20 -> PrivGetDesktopWinRTBrokerToken
	21 -> PrivGetPsmToken
	22 -> GetSessionUserTokenCacheDetails
	23 -> PrivilegedNotifyComClassChangesFromDeployment
	24 -> PrivGetPsmTokenWithDynamicId
	25 -> PrivGetInteractiveUserToken
	26 -> PrivReportUnhealthyProcess
	27 -> PrivNormalizePsmTokenHostId
RPC  4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvActivateApplication
	1 -> PsmSrvCloseActivationChannel
	2 -> PsmSrvOpenActivationChannel
	3 -> PsmSrvRegisterProcess
RPC  085b0334-e454-4d91-9b8c-4134f9e793f3 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvOpenManagementChannel
	1 -> PsmSrvSetApplicationState
	2 -> PsmSrvSetApplicationPriority
	3 -> PsmSrvReleaseCacheEntry
	4 -> PsmSrvAcquireCachedEntries
	5 -> PsmSrvQueryApplicationSwapState
	6 -> PsmSrvCloseActivationChannel
	7 -> PsmSrvSetApplicationProperties
	8 -> PsmSrvQueryApplicationProperties
	9 -> PsmSrvQueryApplicationResourceUsage
	10 -> PsmSrvQueryMemoryUsage
	11 -> PsmSrvResetMaxMemoryUsage
	12 -> PsmSrvQuerySharedCommit
RPC  8782d3b9-ebbd-4644-a3d8-e8725381919b (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvRegisterQuiesceResumeApp
	1 -> PsmSrvQuiesceCallbacksComplete
	2 -> PsmSrvCloseActivationChannel
RPC  3b338d89-6cfa-44b8-847e-531531bc9992 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvQueryApplicationPerformanceInformation
	1 -> PsmSrvQueryQuotaInformation
RPC  bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvOpenTcChannel
	1 -> PsmSrvApplyTaskCompletion
	2 -> PsmSrvRegisterDynamicProcess
	3 -> PsmSrvCloseActivationChannel
	4 -> PsmSrvGetSessionInfo
RPC  5824833b-3c1a-4ad2-bdfd-c31d19e23ed2 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvRegisterAppPriorityNotification
	1 -> PsmSrvQueryApplicationResourceUsageForTimer
	2 -> PsmSrvTimerStart
	3 -> PsmSrvTimerCleanup
	4 -> PsmSrvTimerRemainingResourceTimeGet
	5 -> PsmSrvTimerElapsedResourceTimeGet
RPC  0361ae94-0316-4c6c-8ad8-c594375800e2 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvQueryCurrentApplications
	1 -> PsmSrvQueryApplicationHosts
	2 -> PsmSrvQueryApplicationHostExecutionState
	3 -> PsmSrvQueryApplicationHostJob
	4 -> PsmSrvConnect
	5 -> PsmSrvDisconnect
	6 -> PsmSrvSubscribeToNotifications
	7 -> PsmSrvUnsubscribeFromNotifications
RPC  2d98a740-581d-41b9-aa0d-a88b9d5ce938 (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> RBiSrvActivateDeferredWorkItem
	1 -> RBiSrvActivateInBackground
	2 -> RBiSrvActivateWorkItem
	3 -> RBiSrvAssociateActivationProxy
	4 -> RBiSrvAssociateApplicationExtensionClass
	5 -> RBiSrvCancelWorkItem
	6 -> RBiSrvCreateEvent
	7 -> RBiSrvCreateEventForPackageName
	8 -> RBiSrvDeleteEvent
	9 -> RBiSrvDisassociateWorkItem
	10 -> RBiSrvDiscardPendingActivations
	11 -> RBiSrvEnumerateBrokeredEvents
	12 -> RBiSrvEnumerateUserContexts
	13 -> RBiSrvEnumerateUserSessions
	14 -> RBiSrvEnumerateWorkItemsForPackageName
	15 -> RBiPtSrvGetStatusStateNameFromBrokerEventId
	16 -> RBiSrvQueryBrokeredEvent
	17 -> RBiSrvQuerySystemStateBroadcastChannels
	18 -> RBiSrvQueryUserContext
	19 -> RBiSrvQueryUserSession
	20 -> RBiSrvQueryWorkItem
	21 -> RBiPtSrvQueryWorkItemStatusStateName
	22 -> RBiSrvSignalEvent
	23 -> RBiSrvSignalMultipleEvents
	24 -> RBiSrvSignalTriggerEvent
	25 -> RBiSrvUpdateEventParameters
	26 -> RBiSrvUpdateEventFlags
	27 -> RBiSrvUpdateEventInformation
RPC  8bfc3be1-6def-4e2d-af74-7c47cd0ade4a (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> RBiSrvActivateWorkItemForUser
	1 -> RBiSrvChangeApplicationStateForPackageNameForUser
	2 -> RBiSrvChangeApplicationStateForPsmKeyForUser
	3 -> RBiSrvChangeUserState
	4 -> RBiSrvEnumerateWorkItemsForPackageNameAndUser
	5 -> RBiSrvGetActiveBackgroundTasksEventForUser
	6 -> RBiSrvGetCancellationTimeoutInMs
	7 -> RBiSrvIsApplicationTerminateSensitiveForUser
	8 -> RBiSrvNotifyEndSession
	9 -> RBiSrvNotifyNewSession
	10 -> RBiSrvNotifyNewSessionComplete
	11 -> RBiSrvNotifyNewUser
	12 -> RBiSrvQueryWorkItemForUser
	13 -> RBiSrvResetActiveUserForPackage
	14 -> RBiSrvSetActiveUserForPackage
	15 -> RBiSrvTerminateApplicationHostForUser
	16 -> RBiSrvUpdateBackgroundAccessApplicationsForUser
RPC  1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> RBiRtSrvAddWaitableEvent
	1 -> RBiRtSrvAssociateWorkItem
	2 -> RBiRtSrvCreateEvent
	3 -> RBiRtSrvCreateEventForApp
	4 -> RBiRtSrvCreateStatusStateName
	5 -> RBiRtSrvDeleteEvent
	6 -> RBiRtSrvDisassociateWorkItem
	7 -> RBiRtSrvEnumerateBrokeredEvents
	8 -> RBiRtSrvEnumerateWorkItems
	9 -> RBiRtSrvGetWorkItemProperties
	10 -> RBiRtSrvInitiatePause
	11 -> RBiRtSrvQueryBrokerEventId
	12 -> RBiRtSrvQueryBrokerEventIdFromWorkItem
	13 -> RBiRtSrvRegisterWorkItem
	14 -> RBiRtSrvSignalEvent
	15 -> RBiRtSrvUpdateEventParameters
RPC  c605f9fb-f0a3-4e2a-a073-73560f8d9e3e (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> RBiSrvSignalEvent
RPC  0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> RBiPtSrvActivateDeferredWorkItem
	1 -> RBiPtSrvActivateInBackground
	2 -> RBiPtSrvActivateWorkItem
	3 -> RBiPtSrvAssociateActivationProxy
	4 -> RBiPtSrvAssociateApplicationEntryPoint
	5 -> RBiPtSrvCancelWorkItem
	6 -> RBiPtSrvCreateEvent
	7 -> RBiPtSrvCreateEventForApp
	8 -> RBiPtSrvCreateEventForPackageName
	9 -> RBiPtSrvDeleteEvent
	10 -> RBiPtSrvDisableWorkItem
	11 -> RBiPtSrvDisassociateWorkItem
	12 -> RBiPtSrvEnableWorkItem
	13 -> RBiPtSrvEnumerateBrokeredEvents
	14 -> RBiPtSrvEnumerateWorkItemsForPackageName
	15 -> RBiPtSrvGetStatusStateNameFromBrokerEventId
	16 -> RBiPtSrvQueryBrokeredEvent
	17 -> RBiPtSrvQueryBrokerEventId
	18 -> RBiPtSrvQuerySystemStateBroadcastChannels
	19 -> RBiPtSrvQueryWorkItem
	20 -> RBiPtSrvQueryWorkItemStatusStateName
	21 -> RBiPtSrvSignalEvent
	22 -> RBiPtSrvSignalMultipleEvents
	23 -> RBiPtSrvSignalTriggerEvent
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
RPC  2513bcbe-6cd4-4348-855e-7efb3c336dd3 (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> SrvOdbCreateSession
	1 -> SrvOdbCompleteSession
	2 -> SrvOdbLaunchBackgroundTask
	3 -> SrvOdbCancelBackgroundTask
	4 -> SrvOdbCancelBackgroundTasksForPackage
RPC  20c40295-8dba-48e6-aebf-3e78ef3bb144 (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> SrvOdbPtCreateSession
	1 -> SrvOdbPtCompleteSession
	2 -> SrvOdbPtLaunchBackgroundTask
	3 -> SrvOdbPtCancelBackgroundTask
	4 -> SrvOdbPtCancelBackgroundTasksForPackage
RPC  b8cadbaf-e84b-46b9-84f2-6f71c03f9e55 (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> SrvOdbLbPublishLegacyExitCode
RPC  857fb1be-084f-4fb5-b59c-4b2c4be5f0cf (1.0) -- C:\windows\SYSTEM32\bisrv.dll
	0 -> SrvOdbPrivGetLaunchInfo
RPC  55e6b932-1979-45d6-90c5-7f6270724112 (1.0) -- C:\windows\SYSTEM32\resourcepolicyserver.dll
	0 -> Srv_GetResourcePolicyKey
	1 -> Srv_GetResourcePolicyInformation
	2 -> Srv_CreateResourcePolicy
	3 -> Srv_GetResourcePolicyName
	4 -> Srv_CreatePolicyEngineClientContext
	5 -> Srv_ClosePolicyEngineClientContext
	6 -> Srv_RegisterForPackageEnergyStateChangeNotifications
	7 -> Srv_IsPackageInGoodEnergyState
	8 -> Srv_InterruptiveUIStateChanged_Subscribe
	9 -> Srv_InterruptiveUIStateChanged_Unsubscribe
RPC  76c217bc-c8b4-4201-a745-373ad9032b1a (1.0) -- C:\windows\SYSTEM32\resourcepolicyserver.dll
	0 -> Srv_QueryApplicationEnergyUsage
	1 -> Srv_GetDeviceSpecificConversionFactor
	2 -> Srv_ResetTotalEnergyUsage
RPC  88abcbc3-34ea-76ae-8215-767520655a23 (0.0) -- C:\windows\SYSTEM32\resourcepolicyserver.dll
	0 -> GcsSrv_GetGameConfigSize
	1 -> GcsSrv_GetGameConfig
	2 -> GcsSrv_GetGameConfigSizeForClientProcess
	3 -> GcsSrv_GetGameConfigForClientProcess
	4 -> GcsSrv_ModifyGameConfig
	5 -> GcsSrv_AddGameConfig
	6 -> GcsSrv_RemoveGameConfig
	7 -> GcsSrv_GetGameIdByAUMID
	8 -> GcsSrv_GetGameIdByPID
	9 -> GcsSrv_GetGameIdCount
	10 -> GcsSrv_GetAllGameIds
	11 -> GcsSrv_GetGameIdsByExeNameCount
	12 -> GcsSrv_GetGameIdsByExeName
	13 -> GcsSrv_GetGameProperty
	14 -> GcsSrv_GetGamePropertySize
	15 -> GcsSrv_SetGameProperty
	16 -> GcsSrv_GetGlobalProperty
	17 -> GcsSrv_GetGlobalPropertySize
	18 -> GcsSrv_SetGlobalProperty
	19 -> GcsSrv_SetGamePropertyUserOverride
	20 -> GcsSrv_GetGamePropertyIsUserOverride
RPC  2c7fd9ce-e706-4b40-b412-953107ef9bb0 (0.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> RmgrSrv_RegisterWithServer
	1 -> RmgrSrv_RmSetMemoryUsageLimit
	2 -> RmgrSrv_RmRegisterResource
	3 -> RmgrSrv_RmAccessCheck
	4 -> RmgrSrv_RmAccessCheckOnCaller
	5 -> RmgrSrv_RmAvailabilityCheck
	6 -> RmgrSrv_RmAcquireResources
	7 -> RmgrSrv_RmGetNotification
	8 -> RmgrSrv_RmReleaseResources
RPC  c521facf-09a9-42c5-b155-72388595cbf0 (0.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> RmtSrv_RM_ConnectToServer
	1 -> RmtSrv_RM_DisconnectFromServer
	2 -> RmtSrv_RM_AcquireResourceSet
	3 -> RmtSrv_RS_Apply
	4 -> RmtSrv_RS_ReleaseResources
	5 -> ExecutionModel::BaseResourceSet::OnAccessLost
	6 -> RmtSrv_RS_SetExternalResourcePriorities
	7 -> ExecutionModel::BaseResourceSet::OnAccessLost
RPC  1832bcf6-cab8-41d4-85d2-c9410764f75a (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> RmCoreRpcSrvConnectToRmServer
	1 -> RmCoreRpcSrvDisconnectFromRmServer
	2 -> RmCoreRpcSrvRegisterActivityHostCallbacks
	3 -> RmCoreRpcSrvUnregisterActivityHostCallbacks
	4 -> RmCoreRpcSrvAcquireResourceSet
	5 -> RmCoreRpcSrvApplyResourceSet
	6 -> RmCoreRpcSrvReleaseResourceSet
	7 -> CrmRpcSrvActivityRenew
	8 -> RmCoreRpcSrvQueryHostMemoryLimitValues
RPC  4dace966-a243-4450-ae3f-9b7bcb5315b8 (2.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> RmGameModeSrvRegisterProcess
	1 -> RmGameModeSrvUnregisterProcess
	2 -> RmGameModeSrvDisableForRegisteredProcess
	3 -> RmGameModeSrvReenableForRegisteredProcess
	4 -> RmGameModeSrvGetLargestValidResourceRequest
	5 -> RmGameModeSrvRegisterPairedAuxiliaryProcess
RPC  178d84be-9291-4994-82c6-3f909aca5a03 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> RmGameModeRSrvRegisterProcess
	1 -> RmGameModeRSrvUnregisterProcess
	2 -> RmGameModeRSrvDisableForRegisteredProcess
	3 -> RmGameModeRSrvReenableForRegisteredProcess
	4 -> RmGameModeRSrvRegisterPairedAuxiliaryProcess
RPC  e53d94ca-7464-4839-b044-09a2fb8b3ae5 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnect
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvCreateActivity
	3 -> HamRpcSrvCreateActivityForProcess
	4 -> HamRpcSrvCreateAutoRestartActivity
	5 -> HamRpcSrvStartActivityAsync
	6 -> HamRpcSrvStopActivity
	7 -> HamRpcSrvUpdateActivityProperties
	8 -> HamRpcSrvTerminateActivityHost
	9 -> HamRpcSrvSetExternalResourcePriority
	10 -> HamRpcSrvResetExternalResourcePriority
	11 -> HamRpcSrvCloseActivity
	12 -> HamRpcSrvIsHostBeingDebugged
	13 -> HamRpcSrvTerminateHostOnProcessExit
	14 -> HamRpcSrvGetApplicationInterruptiveUIState
	15 -> HamRpcSrvGetPackageInterruptiveUIState
	16 -> HamRpcSrvGetInterruptiveUIStateForAumid
RPC  fae436b0-b864-4a87-9eda-298547cd82f2 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectDebugging
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvDebugOpenPackageHandle
	3 -> HamRpcSrvDebugClosePackageHandle
	4 -> HamRpcSrvDebugModeEnable
	5 -> HamRpcSrvDebugTerminatePackage
	6 -> HamRpcSrvDebugQueryPackageState
	7 -> HamRpcSrvDebugSuspendPackage
RPC  082a3471-31b6-422a-b931-a54401960c62 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectExtendedExecution
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvIsHostHamManaged
	3 -> HamRpcSrvQueryTaskCompletionsForTerminateGraph
	4 -> HamRpcSrvCreateExtendedExecution
	5 -> HamRpcSrvStartExtendedExecutionAsync
	6 -> HamRpcSrvCloseActivity
	7 -> HamRpcSrvAddDependency
	8 -> HamRpcSrvRemoveDependency
	9 -> HamRpcSrvAddHostDependency
	10 -> HamRpcSrvRemoveHostDependency
	11 -> HamRpcSrvTerminateSelf
	12 -> HamRpcSrvTerminateSelfOnRequiredProcessExit
	13 -> HamRpcSrvTryEstimateRemainingQuiesceTime
RPC  6982a06e-5fe2-46b1-b39c-a2c545bfa069 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectFullTrust
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvFullTrustOpenPackageHandle
	3 -> HamRpcSrvDebugClosePackageHandle
	4 -> HamRpcSrvDebugTerminatePackage
RPC  0ff1f646-13bb-400a-ab50-9a78f2b7a85a (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvFindOrCreateHostId
	1 -> HamRpcSrvCreateSingleUseHostId
	2 -> HamRpcSrvRetrieveDynamicIdForHostId
RPC  4ed8abcc-f1e2-438b-981f-bb0e8abc010c (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectStateChangeNotifications
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvGetApplicationStateForPsmKey
	3 -> HamRpcSrvTerminateIfSuspendedByProcess
RPC  95406f0b-b239-4318-91bb-cea3a46ff0dc (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectServicing
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvFullTrustOpenPackageHandle
	3 -> HamRpcSrvDebugClosePackageHandle
	4 -> HamRpcSrvServicingQueryActiveAppsInPackage
	5 -> HamRpcSrvServicingEnableServicing
	6 -> HamRpcSrvDebugTerminatePackage
RPC  0d47017b-b33b-46ad-9e18-fe96456c5078 (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectSessionState
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvSessionStateLogoffUser
	3 -> HamRpcSrvSessionStateLogoffSession
RPC  dd59071b-3215-4c59-8481-972edadc0f6a (1.0) -- C:\windows\SYSTEM32\psmserviceexthost.dll
	0 -> CrmRpcSrvRegister
	1 -> CrmRpcSrvUnregister
	2 -> CrmRpcSrvActivityAllocate
	3 -> CrmRpcSrvActivityQueryWindowClosedReasons
	4 -> CrmRpcSrvActivityFree
	5 -> CrmRpcSrvActivityStart
	6 -> CrmRpcSrvActivityRenew
	7 -> CrmRpcSrvActivityStop
	8 -> CrmRpcSrvActivityWindowClosedReasonSubscribe
	9 -> CrmRpcSrvActivityWindowClosedReasonUnsubscribe
RPC  d09bdeb5-6171-4a34-bfe2-06fa82652568 (1.0) -- c:\windows\system32\BrokerLib.dll
	0 -> _BriCreateEvent
	1 -> _BriDeleteEvent
	2 -> BriDisableEvent
	3 -> BriEnableEvent
	4 -> BriSignalEvent
RPC  9b008953-f195-4bf9-bde0-4471971e58ed (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> SebiEnumerateEvents
	1 -> _SebiEnumerateEventsByType
	2 -> _SebiQueryEventData
	3 -> SebiQueryEventPackage
	4 -> _SebiSignalSyncEventEx
	5 -> SebiGetUserPresenceHistory
RPC  697dcda9-3ba9-4eb2-9247-e11f1901b0d2 (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> CSebiCreateWellKnownEvent
	1 -> _CSebiCreatePrivateEvent
	2 -> _CSebiDeleteEvent
	3 -> CSebiEnumerateEvents
	4 -> CSebiQueryEventData
	5 -> CSebiCreateCustomEvent
RPC  1377d115-98fd-4034-b574-111156ca239c (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> _CSebiRegisterPublisher
	1 -> CSebiPublisherUpdateLevelEvent
	2 -> CSebiUnregisterPublisher
RPC  7419cf08-91a7-4afd-8f5e-1dd76de094fd (1.0) -- c:\windows\system32\DAB.dll
	0 -> s_DabRpcRegisterTriggerConsumer
	1 -> s_DabRpcUnregisterTriggerConsumer
	2 -> s_DabRpcGetLastScheduledRunTime
RPC  fc48cd89-98d6-4628-9839-86f7a3e4161a (1.0) -- C:\Windows\System32\ACPBackgroundManagerPolicy.dll
	0 -> MVoipSrvNotifyVoipActiveCall
	1 -> MVoipSrvNotifyVoipActivityCompleted
	2 -> MVoipSrvHoldActiveCall
	3 -> MVoipSrvUnholdActiveCall
	4 -> MVoipSrvNotifyIncomingCallDialogDisplayed
	5 -> MVoipSrvNotifyIncomingCallDialogDismissed
	6 -> MVoipSrvLaunchVoipRtcTask
	7 -> MVoipSrvLaunchVoipActivity
	8 -> MVoipSrvCancelVoipCall
OLE  7656cfa4-b63a-4542-a8de-ef402bac895d (0.0) -- IUserApplicationStateChangeHandler
OLE  43c6b434-c1be-4ad2-af03-c0deaccebd1f (0.0) -- IBackgroundAccessStateChangeHandler
OLE  0166231b-fd21-4e33-a713-75eb3207a138 (0.0) -- IBackgroundWorkItemInstanceRemote
Endpoints :
ncalrpc         : umpo
ncalrpc         : actkernel
ncalrpc         : LRPC-52052fd65c5c272467
ncalrpc         : OLE0B4A1FCA316D75160A1E9D74EAA9
ncalrpc         : LRPC-4ab018e2789c955e4e
ncalrpc         : LRPC-10ae42bf2b12c862e5
ncalrpc         : LRPC-72ebfc69859a71292b
ncalrpc         : LRPC-841d50e1fe23b6a7d7
ncalrpc         : LRPC-b950717adfd86cb405
ncalrpc         : csebpub
ncalrpc         : dabrpc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 940 at 0x5306550L>
64
['RpcEptMapper', 'RpcSs']

Interfaces :
RPC  e1af8308-5d1f-11c9-91a4-08002b14a0fa (3.0) -- c:\windows\system32\rpcepmap.dll
	0 -> ept_delete
	1 -> ept_delete
	2 -> ept_lookup
	3 -> ept_map
	4 -> ept_lookup_handle_free
	5 -> ept_delete
	6 -> ept_delete
	7 -> ept_map_auth
	8 -> ept_map_auth_async
RPC  0b0a6584-9e0f-11cf-a3cf-00805f68cb1b (1.1) -- c:\windows\system32\rpcepmap.dll
	0 -> OpenEndpointMapper
	1 -> AllocateReservedIPPort
	2 -> ept_insert_ex
	3 -> ept_delete_ex
	4 -> SetRestrictRemoteClients
	5 -> ResetWithNoAuthException
RPC  1d55b526-c137-46c5-ab79-638f2a68e869 (1.0) -- c:\windows\system32\rpcepmap.dll
	0 -> RemoteGetCellByDebugCellID
	1 -> RemoteOpenRPCDebugCallInfoEnumeration
	2 -> RemoteGetNextRPCDebugCallInfo
	3 -> RemoteFinishRPCDebugCallInfoEnumeration
	4 -> RemoteOpenRPCDebugEndpointInfoEnumeration
	5 -> RemoteGetNextRPCDebugEndpointInfo
	6 -> RemoteFinishRPCDebugEndpointInfoEnumeration
	7 -> RemoteOpenRPCDebugThreadInfoEnumeration
	8 -> RemoteGetNextRPCDebugThreadInfo
	9 -> RemoteFinishRPCDebugThreadInfoEnumeration
	10 -> RemoteOpenRPCDebugClientCallInfoEnumeration
	11 -> RemoteGetNextRPCDebugClientCallInfo
	12 -> RemoteFinishRPCDebugClientCallInfoEnumeration
RPC  64fe0b7f-9ef5-4553-a7db-9a1975777554 (1.0) -- C:\windows\system32\RpcRtRemote.dll
	0 -> FwConnectToManager
	1 -> FwSubscribeForNewRulesNotification
	2 -> FwInterfaceRegistered
RPC  e60c73e6-88f9-11cf-9af1-0020af6e72f4 (2.0) -- c:\windows\system32\rpcss.dll
	0 -> _Connect
	1 -> _SetAppID
	2 -> GetDefaultSecurityPermissions
	3 -> _AllocateReservedIds
	4 -> _BulkUpdateOIDs
	5 -> _ClientResolveOXID
	6 -> _ServerAllocateOXIDAndOIDs
	7 -> _ServerAllocateOIDs
	8 -> _ServerFreeOXIDAndOIDs
	9 -> _SetServerOIDFlags
	10 -> _Disconnect
	11 -> GetUpdatedResolverBindings
RPC  99fcfec4-5260-101b-bbcb-00aa0021347a (0.0) -- c:\windows\system32\rpcss.dll
	0 -> ResolveOxid
	1 -> SimplePing
	2 -> ComplexPing
	3 -> ServerAlive
	4 -> ResolveOxid2
	5 -> ServerAlive2
RPC  b9e79e60-3d52-11ce-aaa1-00006901293f (0.2) -- c:\windows\system32\rpcss.dll
	0 -> IrotRegister
	1 -> IrotRevoke
	2 -> IrotIsRunning
	3 -> IrotGetObject
	4 -> IrotNoteChangeTime
	5 -> IrotGetTimeOfLastChange
	6 -> IrotEnumRunning
	7 -> IMgotRegister
	8 -> IMgotRevoke
	9 -> IMgotGetObject
	10 -> IMgotEnumRunning
RPC  412f241e-c12a-11ce-abff-0020af6e7a17 (0.2) -- c:\windows\system32\rpcss.dll
	0 -> ServerRegisterClsid
	1 -> ServerRevokeClsid
	2 -> ServerRegisterActivatableClasses
	3 -> ServerRevokeActivatableClasses
	4 -> GetThreadID
	5 -> UpdateActivationSettings
	6 -> RegisterWindowPropInterface
	7 -> GetWindowPropInterface
	8 -> EnableDisableDynamicIPTracking
	9 -> GetCurrentAddrExclusionList
	10 -> SetAddrExclusionList
	11 -> FlushSCMBindings
	12 -> RetireServer
	13 -> NotifyDDStartOrStop
	14 -> QueryDragDropActive
	15 -> SetOrRevokeForcedDropTarget
	16 -> IsObjectCreationAllowed
	17 -> ControlTracingForProcess
	18 -> QueryPIDForActivation
	19 -> NotifyWinRTActivationStoreChanged
	20 -> DecodeProxy
	21 -> NotifyPsmResume
	22 -> QueryServerProcessHandleHeld
	23 -> RegisterRacActivationToken
	24 -> RevokeRacActivationToken
	25 -> RegisterConsoleHandles
	26 -> RevokeConsoleHandles
	27 -> NotifyComClassChangesFromDeployment
DCOM 00000136-0000-0000-c000-000000000046 (0.0) -- ISCMLocalActivator
RPC  c6f3ee72-ce7e-11d1-b71e-00c04fc3111a (1.0) -- c:\windows\system32\rpcss.dll
	0 -> ProcessActivatorStarted
	1 -> ProcessActivatorInitializing
	2 -> ProcessActivatorReady
	3 -> ProcessActivatorStopped
	4 -> ProcessActivatorPaused
	5 -> ProcessActivatorResumed
	6 -> ProcessActivatorUserInitializing
RPC  4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 (0.0) -- c:\windows\system32\rpcss.dll
	0 -> RemoteActivation
DCOM 000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
RPC  cb40a179-20e1-43f0-97fb-3c5c6ff37ec3 (0.0) -- c:\windows\system32\rpcss.dll
	0 -> CrossContainerActivation
Endpoints :
ncalrpc         : epmapper
ncacn_ip_tcp    : 135
ncacn_np        : \pipe\epmapper
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 980 at 0x5306cc0L>
64
['LSM']

Interfaces :
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
RPC  11f25515-c879-400a-989e-b074d5f092fe (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcGetUserToken
	1 -> RpcConnectTerminal
	2 -> RpcSystemShutdownStarted
	3 -> RpcConsumeCacheSession
	4 -> RpcGetRequestForWinlogon
	5 -> RpcReportWinlogonReply
	6 -> RpcGetReconnectId
	7 -> RpcCreateWorkerSession
	8 -> RpcGetWorkerSessionGpuLuid
RPC  1e665584-40fe-4450-8f6e-802362399694 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcBroadcastSystemMessage
	1 -> RpcSendWindowMessage
	2 -> RpcCreateSession
	3 -> RpcTerminateSession
RPC  484809d6-4239-471b-b5bc-61df8c23ac48 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcOpenSession
	1 -> RpcCloseSession
	2 -> RpcConnect
	3 -> RpcDisconnect
	4 -> RpcLogoff
	5 -> RpcGetUserName
	6 -> RpcGetTerminalName
	7 -> RpcGetState
	8 -> RpcIsSessionDesktopLocked
	9 -> RpcShowMessageBox
	10 -> RpcGetTimes
	11 -> RpcGetSessionCounters
	12 -> RpcGetSessionInformation
	13 -> RpcSwitchToServicesSession
	14 -> RpcRevertFromServicesSession
	15 -> RpcGetLoggedOnCount
	16 -> RpcGetSessionType
	17 -> RpcGetSessionInformationEx
	18 -> RpcIsTerminalRemote
	19 -> RpcIsBoundToCacheTerminal
	20 -> RpcConnectAndLockTargetDesktop
RPC  e3907f22-c899-44e7-9d11-9d8b3d924832 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcEnableChildSessions
	1 -> RpcIsChildSessionsEnabled
	2 -> RpcGetChildSessionId
	3 -> RpcGetParentSessionId
	4 -> RpcGetAllUserSessions
RPC  53825514-1183-4934-a0f4-cfdc51c3389b (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcIsCurrentSessionTerminalRemote
	1 -> RpcGetCurrentSessionTerminalName
	2 -> RpcGetCurrentSessionInformation
	3 -> RpcGetCurrentSessionCapabilities
	4 -> RpcGetCurrentSessionType
RPC  11899a43-2b68-4a76-92e3-a3d6ad8c26ce (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcWaitForSessionState
	1 -> RpcRegisterAsyncNotification
	2 -> RpcWaitAsyncNotification
	3 -> RpcUnRegisterAsyncNotification
RPC  c2d15ccf-a416-46dc-ba58-4624ac7a9123 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcRegisterCurrentSessionAsyncNotification
	1 -> RpcWaitAsyncNotificationEx
	2 -> RpcUnRegisterAsyncNotificationEx
RPC  88143fd0-c28d-4b2b-8fef-8d882f6a9390 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcOpenEnum
	1 -> RpcCloseEnum
	2 -> RpcFilterByState
	3 -> RpcFilterByCallersName
	4 -> RpcEnumAddFilter
	5 -> RpcGetEnumResult
	6 -> RpcFilterBySessionType
	7 -> RpcFilterByLicenseType
	8 -> RpcGetSessionIds
	9 -> RpcGetEnumResultEx
	10 -> RpcGetAllSessions
	11 -> RpcGetAllSessionsEx
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  517f87fe-597a-4672-8555-6daf1c8c788d (0.0) -- ISessionManager
OLE  75a446c5-40b7-41d3-8d53-292652c04121 (0.0) -- ITSEventDispatcher
OLE  959c5a99-177c-478e-8c3b-77e07e9bf3aa (0.0) -- ISessionList
OLE  a8105b4f-7d5a-402b-aac0-fd85daecf94c (0.0) -- ISessionEnum
OLE  a1b7de7a-4e77-43db-ae78-96fc182fed4a (0.0) -- ITSSession
OLE  1a8a5d71-d95b-4dcd-915e-f9f6d31879ad (0.0) -- ITerminal
OLE  6344a5b7-ef1c-47ba-98b7-28c664427793 (0.0) -- IGlassTerminal
OLE  c2d3e131-c587-49b4-8bae-f0ee269eeb31 (0.0) -- ITSSessionAttribute
OLE  35481b58-f46c-4254-b52c-fdc3001484c3 (0.0) -- IRestrictedCalls
OLE  4d10b48b-c531-4731-9bde-b03c28e9c61c (0.0) -- IUserName
Endpoints :
ncalrpc         : LRPC-6b49de762b15890702
ncalrpc         : LSMApi
ncacn_np        : \pipe\LSM_API_service
ncalrpc         : OLE3F9B241B15C1D6F0A2B264568291
--------------------------------------------------------------------------------
<WinProcess "LogonUI.exe" pid 420 at 0x5306278L>
64

Interfaces :
RPC  f3f09ffd-fbcf-4291-944d-70ad6e0e73bb (1.0) -- C:\windows\System32\logoncontroller.dll
	0 -> WluirAbort
	1 -> WluirSecureDisplayLocked
	2 -> WluirDisplayLocked
	3 -> WluirWaitForLockScreenDismiss
	4 -> WluirDisplayMessage
	5 -> WluirDisplayRequestCredentialsError
	6 -> WluirDisplaySecurityOptions
	7 -> WluirDisplayStatus
	8 -> WluirDisplayTSDisconnectOptions
	9 -> WluirDisplayWelcome
	10 -> WluirNotifyIsReadyForDesktopSwitch
	11 -> WluirPromptForCredentials
	12 -> WluirReleaseContext
	13 -> WluirClearUIState
	14 -> WluirReportResult
	15 -> WluirRequestCredentials
	16 -> WluirDisplayTSDisconnectUI
	17 -> WluirDisplayTSReconnectUI
	18 -> WluirNotifyUserIsLoggedOn
	19 -> WluirFinishOperation
	20 -> WluirInformLogonUI
	21 -> WluirDelayLocked
	22 -> WluirSecureDelayLocked
	23 -> WluirGetShutdownResolverInfo
	24 -> WluirSignalShutdown
	25 -> WluirPrepareWebDialog
	26 -> WluirWaitForWebDialogComplete
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  0000000c-0000-0000-c000-000000000046 (0.0) -- IStream
OLE  06386a7a-e009-5b0b-ab68-a8e48b516647 (0.0) -- __FIAsyncOperationWithProgressCompletedHandler_2_Windows__CStorage__CStreams__CIBuffer_UINT32
OLE  30d5a829-7fa4-4026-83bb-d75bae4ea99e (0.0) -- IClosable
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  ce17c10a-90f9-42e5-a43b-4ffee2f937a0 (0.0) -- IObjectWithRWLock
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
OLE  947aab5f-0a5c-4c13-b4d6-4bf7836fc9f8 (0.0) -- IFileOperation
Endpoints :
ncalrpc         : LRPC-7ad18c0181b776e795
ncalrpc         : OLE273901A57D58B270B18B090D94E5
--------------------------------------------------------------------------------
<WinProcess "dwm.exe" pid 416 at 0x53068d0L>
64

Interfaces :
RPC  df4df73a-c52d-4e3a-8003-8437fdf8302a (0.0) -- c:\windows\system32\coremessaging.dll
	0 -> ServerValidateWindowId
	1 -> ServerValidateWindowIdAndOwner
Endpoints :
ncalrpc         : LRPC-0004450a441212400f
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1104 at 0x53067f0L>
64
['NcbService']

Interfaces :
RPC  d09bdeb5-6171-4a34-bfe2-06fa82652568 (1.0) -- c:\windows\system32\BrokerLib.dll
	0 -> _BriCreateEvent
	1 -> _BriDeleteEvent
	2 -> BriDisableEvent
	3 -> BriEnableEvent
	4 -> BriSignalEvent
RPC  5222821f-d5e2-4885-84f1-5f6185a0ec41 (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> RpcSrvRegisterControlChannelReset
	1 -> RpcSrvUnregisterControlChannelReset
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\Windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
RPC  880fd55e-43b9-11e0-b1a8-cf4edfd72085 (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> KapiRegisterProvider
	1 -> KapiDeregisterProvider
	2 -> KapiUpdateKaSample
	3 -> KapiReceiveKaUpdateRequest
RPC  e40f7b57-7a25-4cd3-a135-7f7d3df9d16b (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> RpcSrvCreateSession
	1 -> RpcSrvDestroySession
	2 -> RpcSrvStartBrokeredActivation
	3 -> RpcSrvSetServerKeepAliveInterval
	4 -> RpcSrvGetCurrentKeepAliveInterval
	5 -> RpcSrvDecreaseKeepAliveInterval
	6 -> RpcSrvUsingTransport
	7 -> RpcSrvIndicateSlotAllocation
	8 -> RpcSrvSBCreatePushEnabledContext
	9 -> RpcSrvSBTransferOwnership
	10 -> RpcSrvSBRetrieveSocket
	11 -> RpcSrvSBCompleteRetrieveSocket
	12 -> RpcSrvSBRetrieveContext
	13 -> RpcSrvSBEnumSockets
	14 -> RpcSrvHotspotRegisterHotspotApp
	15 -> RpcSrvHotspotFindEventForPackage
	16 -> RpcSrvHotspotTriggerBackgroundEvent
	17 -> RpcSrvHotspotIsAppInstalled
	18 -> RpcSrvFirewallWcmSetFirewallRule
	19 -> RpcSrvFirewallWcmSetFirewallRuleFlags
	20 -> RpcSrvFirewallWcmDeleteFirewallRule
Endpoints :
ncalrpc         : LRPC-c671927dd9659a0385
ncalrpc         : LRPC-b104ee7e9393d8bf7f
ncalrpc         : OLE9C9313BE9E1E2574A19C7FAC69FC
ncalrpc         : LRPC-0c5aafc72066fcc0c4
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1176 at 0x5306978L>
64
['TimeBrokerSvc']

Interfaces :
RPC  82273fdc-e32a-18c3-3f78-827929dc23ea (0.0) -- c:\windows\system32\wevtsvc.dll
	0 -> ElfrClearELFW
	1 -> ElfrBackupELFW
	2 -> ElfrCloseEL
	3 -> ElfrDeregisterEventSource
	4 -> ElfrNumberOfRecords
	5 -> ElfrOldestRecord
	6 -> ElfrChangeNotify
	7 -> ElfrOpenELW
	8 -> ElfrRegisterEventSourceW
	9 -> ElfrOpenBELW
	10 -> ElfrReadELW
	11 -> ElfrReportEventW
	12 -> ElfrClearELFA
	13 -> ElfrBackupELFA
	14 -> ElfrOpenELA
	15 -> ElfrRegisterEventSourceA
	16 -> ElfrOpenBELA
	17 -> ElfrReadELA
	18 -> ElfrReportEventA
	19 -> ElfrRegisterClusterSvc
	20 -> ElfrDeregisterClusterSvc
	21 -> ElfrWriteClusterEvents
	22 -> ElfrGetLogInformation
	23 -> ElfrFlushEL
	24 -> ElfrReportEventAndSourceW
	25 -> ElfrReportEventExW
	26 -> ElfrReportEventExA
RPC  f6beaff7-1e19-4fbb-9f8f-b89e2018337c (1.0) -- c:\windows\system32\wevtsvc.dll
	0 -> _EvtRpcRegisterRemoteSubscription
	1 -> _EvtRpcRemoteSubscriptionNextAsync
	2 -> _EvtRpcRemoteSubscriptionNext
	3 -> EvtRpcRemoteSubscriptionWaitAsync
	4 -> EvtRpcRegisterControllableOperation
	5 -> _EvtRpcRegisterLogQuery
	6 -> EvtRpcClearLog
	7 -> EvtRpcExportLog
	8 -> EvtRpcLocalizeExportLog
	9 -> _EvtRpcMessageRender
	10 -> EvtRpcMessageRenderDefault
	11 -> _EvtRpcQueryNext
	12 -> _EvtRpcQuerySeek
	13 -> EvtRpcClose
	14 -> EvtRpcCancel
	15 -> _EvtRpcAssertConfig
	16 -> EvtRpcRetractConfig
	17 -> _EvtRpcOpenLogHandle
	18 -> _EvtRpcGetLogFileInfo
	19 -> _EvtRpcGetChannelList
	20 -> _EvtRpcGetChannelConfig
	21 -> EvtRpcPutChannelConfig
	22 -> _EvtRpcGetPublisherList
	23 -> EvtRpcGetPublisherListForChannel
	24 -> _EvtRpcGetPublisherMetadata
	25 -> _EvtRpcGetPublisherResourceMetadata
	26 -> EvtRpcGetEventMetadataEnum
	27 -> EvtRpcGetNextEventMetadata
	28 -> _EvtRpcGetClassicLogDisplayName
Endpoints :
ncalrpc         : eventlog
ncacn_np        : \pipe\eventlog
ncacn_ip_tcp    : 49665
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1288 at 0x5306400L>
64
['vmickvpexchange']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1308 at 0x53060b8L>
64
['vmicrdv']

Interfaces :
RPC  f763c91c-2ab1-47fa-868f-7de7efd42194 (1.0) -- C:\windows\system32\vmrdvcore.dll
	0 -> VmGetAppAllowListEntryByAlias
	1 -> VmVerifyAppAllowed
Endpoints :
ncalrpc         : RdvVmAllowListRpc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1348 at 0x53062e8L>
64
['vmicshutdown']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1372 at 0x53069b0L>
64
['vmictimesync']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1392 at 0x5306ac8L>
64
['UmRdpService']

Interfaces :
RPC  7212a04b-b463-402e-9649-2ba477394676 (1.0) -- c:\windows\system32\umrdp.dll
	0 -> CTSEventFilterBlockAllEvents::AllowTSEvent
	1 -> RpcOpenDevice
	2 -> RpcCloseDevice
	3 -> RpcGetSessionId
	4 -> RpcGetInterfaceGuids
	5 -> RpcGetClientDeviceId
	6 -> RpcGetDeviceCaps
RPC  c80066a8-7579-44fc-b9b2-8466930791b0 (1.0) -- c:\windows\system32\umrdp.dll
	0 -> RpcPrintDrvGetInfo
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : RemoteDevicesLPC_API
ncalrpc         : TSUMRPD_PRINT_DRV_LPC_API
ncalrpc         : OLEF239C965B5F7A486BA655D8FB6B3
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1408 at 0x5306b00L>
64
['vmicvss']

Interfaces :
RPC  326731e3-c1c0-4a69-ae20-7d9044a4ea5c (1.0) -- c:\windows\system32\profsvc.dll
	0 -> DropClientContext
	1 -> ReleaseClientContext
	2 -> LoadUserProfileServer
	3 -> UnloadUserProfileServer
	4 -> DeleteProfileServer
	5 -> RemapProfileServer
	6 -> CreateProfileServer
	7 -> ProcessWmiSettingsServer
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
Endpoints :
ncalrpc         : IUserProfile2
ncalrpc         : OLE578C3DF3149721A3389842CC648C
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1604 at 0x5306be0L>
64
['nsi']

Interfaces :
RPC  7ea70bcf-48af-4f6a-8968-6a440754d5fa (1.0) -- c:\windows\system32\nsisvc.dll
	0 -> RpcNsiGetParameter
	1 -> RpcNsiGetAllParameters
	2 -> RpcNsiEnumerateObjectsAllParameters
	3 -> RpcNsiSetParameter
	4 -> RpcNsiSetAllParameters
	5 -> RpcNsiRegisterChangeNotification
	6 -> RpcNsiDeregisterChangeNotification
	7 -> RpcNsiRequestChangeNotification
	8 -> RpcNsiParameterChange
Endpoints :
ncalrpc         : LRPC-743e6bda820abcb648
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1652 at 0x53063c8L>
64
['EventSystem']

Interfaces :
RPC  b58aa02e-2884-4e97-8176-4ee06d794184 (1.0) -- c:\windows\system32\sysmain.dll
	0 -> PfRpcServerExecuteCommand
Endpoints :
ncalrpc         : LRPC-7489ddaf2de31ec276
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1684 at 0x5306080L>
64
['Themes']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "Memory Compression" pid 1932 at 0x5306da0L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1980 at 0x5306518L>
64
['Dhcp']

Interfaces :
RPC  3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 (1.0) -- C:\windows\system32\dhcpcore6.dll
	0 -> RpcSrvRequestPrefixEx
	1 -> RpcSrvRenewPrefixEx
	2 -> RpcSrvReleasePrefixEx
	3 -> RpcSrvCancelOperation
	4 -> RpcSrvEnablev6Tracing
	5 -> RpcSrvRequestParams
	6 -> RpcSrvAcquireParametersv6
	7 -> RpcSrvReleaseParametersv6
	8 -> RpcSrvQueryLeaseInfov6
	9 -> RpcSrvGetTraceArray
	10 -> RpcSrvSetUserClass
	11 -> RpcSrvQueryLeaseInfov6Array
	12 -> RpcSrvEnableDhcpv6
RPC  3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 (1.0) -- c:\windows\system32\dhcpcore.dll
	0 -> RpcSrvEnableDhcp
	1 -> RpcSrvRenewLease
	2 -> RpcSrvDeleteStaticAddressAndDefaultGateways
	3 -> RpcSrvCheckServerAvailability
	4 -> RpcSrvRenewLeaseByBroadcast
	5 -> RpcSrvReleaseLease
	6 -> RpcSrvSetFallbackParams
	7 -> RpcSrvGetFallbackParams
	8 -> RpcSrvFallbackRefreshParams
	9 -> RpcSrvStaticRefreshParams
	10 -> RpcSrvRemoveDnsRegistrations
	11 -> RpcSrvRequestParams
	12 -> RpcSrvPersistentRequestParams
	13 -> RpcSrvRegisterParams
	14 -> RpcSrvDeRegisterParams
	15 -> RpcSrvEnumInterfaces
	16 -> RpcSrvQueryLeaseInfo
	17 -> RpcSrvQueryLeaseInfoArray
	18 -> RpcSrvSetClassId
	19 -> RpcSrvGetClassId
	20 -> RpcSrvSetClientId
	21 -> RpcSrvGetClientId
	22 -> RpcSrvNotifyMediaReconnected
	23 -> RpcSrvGetOriginalSubnetMask
	24 -> RpcSrvSetMSFTVendorSpecificOptions
	25 -> RpcSrvRequestCachedParams
	26 -> RpcSrvRegisterConnectionStateNotification
	27 -> RpcSrvDeRegisterConnectionStateNotification
	28 -> RpcSrvGetNotificationStatus
	29 -> RpcSrvGetDhcpServicedConnections
	30 -> RpcSrvGetTraceArray
	31 -> RpcSrvEnableTracing
	32 -> RpcSrvLeaseIpAddressEx
	33 -> RpcSrvRenewIpAddressLeaseEx
	34 -> RpcSrvReleaseIpAddressLeaseEx
	35 -> RpcSrvMadcapApiStartup
	36 -> RpcSrvMadcapApiCleanup
	37 -> RpcSrvMadcapEnumerateScopes
	38 -> RpcSrvMadcapGenUID
	39 -> RpcSrvMadcapRequestAddress
	40 -> RpcSrvMadcapRenewAddress
	41 -> RpcSrvMadcapReleaseAddress
Endpoints :
ncalrpc         : dhcpcsvc6
ncalrpc         : dhcpcsvc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1132 at 0x5306ef0L>
64
['CertPropSvc']

Interfaces :
RPC  30b044a5-a225-43f0-b3a4-e060df91f9c1 (1.0) -- c:\windows\system32\certprop.dll
	0 -> s_RPC_SmartCardRootCertsNotifyService
	1 -> s_RPC_SmartCardCertsNotifyService
Endpoints :
ncalrpc         : LRPC-0bf0ff1ef1a9db2596
--------------------------------------------------------------------------------
<WinProcess "VSSVC.exe" pid 404 at 0x5306a20L>
64
['VSS']

Interfaces :
RPC  0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> ItSrvRegisterIdleTask
	1 -> ItSrvUnregisterIdleTask
	2 -> ItSrvProcessIdleTasks
	3 -> ItSrvSetDetectionParameters
	4 -> ItSrvSetRuntimeOverrides
RPC  1ff70682-0a51-30e8-076d-740be8cee98b (1.0) -- C:\windows\system32\taskcomp.dll
	0 -> NetrJobAdd
	1 -> NetrJobDel
	2 -> NetrJobEnum
	3 -> NetrJobGetInfo
RPC  378e52b0-c0a9-11cf-822d-00aa0051e40f (1.0) -- C:\windows\system32\taskcomp.dll
	0 -> SASetAccountInformation
	1 -> SASetNSAccountInformation
	2 -> SAGetNSAccountInformation
	3 -> SAGetAccountInformation
RPC  2a82bb21-e44f-4791-9aa1-dfae788e2f43 (1.0) -- c:\windows\system32\UBPM.dll
	0 -> s_UbpmRpcOpenTaskHostChannel
	1 -> s_UbpmRpcCloseTaskHostChannel
	2 -> s_UbpmRpcTaskHostSendResponseReceiveCommand
	3 -> s_UbpmRpcTaskHostReportTaskStatus
RPC  33d84484-3626-47ee-8c6f-e7e98b113be1 (2.0) -- C:\windows\SYSTEM32\WPTaskScheduler.dll
	0 -> s_TaskSchedulerCreateSchedule
	1 -> s_TaskSchedulerDeleteSchedule
	2 -> s_TaskSchedulerFindFirstSchedule
	3 -> s_TaskSchedulerFindNextSchedule
	4 -> s_TaskSchedulerFindScheduleClose
	5 -> s_TaskSchedulerGetSchedule
	6 -> s_TaskSchedulerEnableSchedule
	7 -> s_TaskSchedulerExecuteSchedule
	8 -> s_TaskSchedulerAdvanceSchedule
	9 -> s_TaskSchedulerAdvanceScheduleIntervals
	10 -> s_TaskSchedulerSnoozeSchedule
	11 -> s_TaskSchedulerGetPublishStateName
	12 -> s_TaskSchedulerServiceControl
RPC  86d35949-83c9-4044-b424-db363231fd0c (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> SchRpcHighestVersion
	1 -> _SchRpcRegisterTask
	2 -> SchRpcRetrieveTask
	3 -> SchRpcCreateFolder
	4 -> SchRpcSetSecurity
	5 -> SchRpcGetSecurity
	6 -> SchRpcEnumFolders
	7 -> SchRpcEnumTasks
	8 -> SchRpcEnumInstances
	9 -> SchRpcGetInstanceInfo
	10 -> SchRpcStopInstance
	11 -> SchRpcStop
	12 -> SchRpcRun
	13 -> SchRpcDelete
	14 -> SchRpcRename
	15 -> SchRpcScheduledRuntimes
	16 -> SchRpcGetLastRunInfo
	17 -> _SchRpcGetTaskInfo
	18 -> SchRpcGetNumberOfMissedRuns
	19 -> SchRpcEnableTask
RPC  3a9ef155-691d-4449-8d05-09ad57031823 (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> I_pSchRpcRegisterTask
	1 -> I_pSchRpcEnumTasks
	2 -> I_pSchRpcGetTaskInfo
	3 -> I_pSchRpcAquireTaskStateNotificationsName
	4 -> I_pAcquireBackgroundExecutionMode
	5 -> I_pReleaseBackgroundExecutionMode
	6 -> I_pSetTaskDisabledForCurrentUser
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-69ba40d97baa37e78b
ncacn_np        : \PIPE\atsvc
ncalrpc         : ubpmtaskhostchannel
ncalrpc         : LRPC-1eae62186b2bb71d85
ncacn_ip_tcp    : 49666
ncalrpc         : OLEB9967DDCAAC08A0219EA8093CC24
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2056 at 0x5306828L>
64
['SENS']

Interfaces :
RPC  63fbe424-2029-11d1-8db8-00aa004abd5e (1.0) -- c:\windows\system32\sens.dll
	0 -> RPC_IsNetworkAlive
	1 -> RPC_IsDestinationReachableA
	2 -> RPC_IsDestinationReachableA
RPC  a0bc4698-b8d7-4330-a28f-7709e18b6108 (4.0) -- c:\windows\system32\sens.dll
	0 -> RPC_SensNotifyWinlogonEvent
	1 -> RPC_SensNotifyRasEvent
	2 -> RPC_SensNotifyNetconEvent
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  97312c82-d4c2-11d1-b682-00805fc79216 (0.0) -- ICollectionNotify
Endpoints :
ncalrpc         : senssvc
ncalrpc         : LRPC-cc6192df9611677bb5
ncalrpc         : OLE12DBE078CDEC19CDB2151EB60065
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2132 at 0x5306fd0L>
64
['AudioEndpointBuilder']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2156 at 0x5319898L>
64
['FontCache']

Interfaces :
RPC  f2c9b409-c1c9-4100-8639-d8ab1486694a (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> ClusterConnectUpcall
	1 -> ClusterDisConnectUpcall
RPC  eb081a0d-10ee-478a-a1dd-50995283e7a8 (3.0) -- c:\windows\system32\wkssvc.dll
	0 -> GetWitnessNodes
RPC  6bffd098-a112-3610-9833-46c3f87e345a (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> NetrWkstaGetInfo
	1 -> NetrWkstaSetInfo
	2 -> NetrWkstaUserEnum
	3 -> NetrWkstaUserGetInfo
	4 -> NetrWkstaUserSetInfo
	5 -> NetrWkstaTransportEnum
	6 -> NetrWkstaTransportAdd
	7 -> NetrWkstaTransportDel
	8 -> NetrUseAdd
	9 -> NetrUseGetInfo
	10 -> NetrUseDel
	11 -> NetrUseEnum
	12 -> I_NetrLogonDomainNameAdd
	13 -> NetrWorkstationStatisticsGet
	14 -> I_NetrLogonDomainNameAdd
	15 -> I_NetrLogonDomainNameAdd
	16 -> I_NetrLogonDomainNameAdd
	17 -> I_NetrLogonDomainNameAdd
	18 -> I_NetrLogonDomainNameAdd
	19 -> I_NetrLogonDomainNameAdd
	20 -> NetrGetJoinInformation
	21 -> I_NetrLogonDomainNameAdd
	22 -> NetrJoinDomain2
	23 -> NetrUnjoinDomain2
	24 -> NetrRenameMachineInDomain2
	25 -> NetrValidateName2
	26 -> NetrGetJoinableOUs2
	27 -> NetrAddAlternateComputerName
	28 -> NetrRemoveAlternateComputerName
	29 -> NetrSetPrimaryComputerName
	30 -> NetrEnumerateComputerNames
RPC  7f1343fe-50a9-4927-a778-0c5859517bac (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> DfsDsGetDcName
	1 -> DfsDsIsDomainController
	2 -> DfsCredWrite
	3 -> DfsCredDelete
Endpoints :
ncalrpc         : LRPC-28f9e92a2d2927492b
ncacn_np        : \PIPE\wkssvc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2256 at 0x5319cc0L>
64
['NlaSvc']

Interfaces :
RPC  aa411582-9bdf-48fb-b42b-faa1eee33949 (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> PMuxRpcPluginRegister
	1 -> PMuxRpcPluginUnregister
	2 -> PMuxRpcPluginDataIndicate
RPC  c33b9f46-2088-4dbc-97e3-6125f127661c (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> AppSrv_NlaOpenQuery
	1 -> AppSrv_NlaAsyncIndicate
	2 -> AppSrv_NlaRefreshQuery
	3 -> AppSrv_NlaCloseQuery
	4 -> RpcNlaIndicateReprobe
	5 -> RpcNlaGetCaptivePortalHosts
RPC  4c8d0bef-d7f1-49f0-9102-caa05f58d114 (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> RPCQueryLANIds
Endpoints :
ncalrpc         : nlaplg
ncalrpc         : nlaapi
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2308 at 0x5319f60L>
64
['Dnscache']

Interfaces :
RPC  45776b01-5956-4485-9f80-f428f7d60129 (2.0) -- c:\windows\system32\dnsrslvr.dll
	0 -> CRrReadCache
	1 -> R_ResolverGetConfig
	2 -> R_ResolverFlushCache
	3 -> R_ResolverFlushCacheEntry
	4 -> R_ResolverQuery
	5 -> R_DnsRegisterLocal
	6 -> R_DnsDeRegisterLocal
	7 -> R_DnsStartMulticastQuery
	8 -> R_DnsGetMulticastData
	9 -> R_DnsStopMulticastQuery
	10 -> R_ResolverSimpleOp
	11 -> R_DnsGetProxyInformation
	12 -> R_DnsGetPolicyTableInfo
	13 -> R_DnsSetConnectionPolicyInfo
	14 -> R_DnsDeleteConnectionPolicyInfo
	15 -> R_DnsGetSettings
	16 -> R_DnsSetSettings
	17 -> R_DnsGetInterfaceSettings
	18 -> R_DnsSetInterfaceSettings
	19 -> R_DnsGetAdaptersInfo
Endpoints :
ncalrpc         : DNSResolver
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2360 at 0x5319da0L>
64
['Audiosrv']

Interfaces :
RPC  09704557-82c0-416b-b6e4-c85b8f789803 (2.8) -- c:\windows\system32\audiosrv.dll
	0 -> AudioServerGetMixFormat
	1 -> AudioServerIsFormatSupported
	2 -> AudioServerGetDevicePeriod
	3 -> AudioServerIsOffloadCapable
	4 -> AudioServerInitialize
	5 -> AudioServerDisconnect
	6 -> AudioServerGetAudioSession
	7 -> AudioServerCreateStream
	8 -> AudioServerStartStream
	9 -> AudioServerStopStream
	10 -> AudioServerPreStartStream
	11 -> AudioServerStartStreamAborted
	12 -> AudioServerResetEndpoint
	13 -> AudioServerDestroyStream
	14 -> AudioServerGetEndpointBufferSize
	15 -> AudioServerGetStreamLatency
	16 -> AudioServerSetStreamSampleRate
	17 -> AudioServerGetChannelCount
	18 -> AudioServerSetChannelVolume
	19 -> AudioServerGetChannelVolume
	20 -> AudioServerSetAllVolumes
	21 -> AudioServerGetAllVolumes
	22 -> AudioServerSetAllInitialVolumesWithRamp
	23 -> AudioSessionGetId
	24 -> AudioSessionGetInstanceId
	25 -> AudioSessionGetStreamSwitchId
	26 -> AudioSessionGetProcessId
	27 -> AudioSessionGetState
	28 -> AudioSessionGetLastActivation
	29 -> AudioSessionGetLastInactivation
	30 -> AudioSessionIsSystemSoundsSession
	31 -> AudioSessionGetDisplayOptions
	32 -> AudioSessionGetDisplayName
	33 -> AudioSessionSetDisplayName
	34 -> AudioSessionGetIconPath
	35 -> AudioSessionSetIconPath
	36 -> AudioSessionGetGroupingParam
	37 -> AudioSessionSetGroupingParam
	38 -> AudioSessionGetVolume
	39 -> AudioSessionSetVolume
	40 -> AudioSessionGetMute
	41 -> AudioSessionSetMute
	42 -> AudioSessionGetChannelCount
	43 -> AudioSessionSetChannelVolume
	44 -> AudioSessionGetChannelVolume
	45 -> AudioSessionSetAllVolumes
	46 -> AudioSessionGetAllVolumes
	47 -> AudioSessionPropertyStoreCommit
	48 -> AudioSessionPropertyStoreGetAt
	49 -> AudioSessionPropertyStoreGetCount
	50 -> AudioSessionPropertyStoreGetValue
	51 -> AudioSessionPropertyStoreSetValue
	52 -> AudioSessionSetDuckingPreference
	53 -> AudioSessionGetDuckingState
	54 -> AudioSessionGetIsComms
	55 -> AudioSessionDestroy
	56 -> AudioSessionMeterGetPeakValue
	57 -> AudioSessionMeterGetMeteringChannelCount
	58 -> AudioSessionMeterGetChannelsPeakValues
	59 -> AudioSessionSetWindowId
	60 -> PolicyConfigGetMixFormat
	61 -> PolicyConfigGetDeviceFormat
	62 -> PolicyConfigSetDeviceFormat
	63 -> PolicyConfigResetDeviceFormat
	64 -> PolicyConfigGetProcessingPeriod
	65 -> PolicyConfigSetProcessingPeriod
	66 -> PolicyConfigGetShareMode
	67 -> PolicyConfigSetShareMode
	68 -> PolicyConfigGetPropertyValue
	69 -> PolicyConfigSetPropertyValue
	70 -> PolicyConfigSetDefaultEndpoint
	71 -> PolicyConfigSetEndpointVisibility
	72 -> PolicyConfigSetEndpointAbilityToBeDefault
	73 -> PolicyConfigSetAccessibilityAudioMonoMixState
	74 -> PolicyConfigGetAccessibilityAudioMonoMixState
	75 -> PolicyConfigValidateSpatialAudioSettings
	76 -> PolicyConfigReportSpatialLicenseChanged
	77 -> PolicyConfigSetMixedRealitySpatialAudioFormatPolicy
	78 -> PolicyConfigGetDeviceFormatAndSpatialSettings
	79 -> PolicyConfigSetDeviceSpatialSettings
	80 -> PolicyConfigAddDynamicRoutingRule
	81 -> PolicyConfigRemoveDynamicRoutingRule
	82 -> PolicyConfigUpdateDynamicRoutingRule
	83 -> PolicyConfigGetDynamicRoutingRule
	84 -> GetAudioSessionManager
	85 -> AudioSessionManagerDestroy
	86 -> AudioSessionManagerGetAudioSessions
	87 -> AudioSessionManagerGetCurrentSession
	88 -> AudioSessionManagerGetExistingSession
	89 -> AudioSessionManagerGetSessionForStreamSwitch
	90 -> AudioSessionManagerAddAudioSessionClientNotification
	91 -> AudioSessionManagerDeleteAudioSessionClientNotification
	92 -> AudioSessionManagerAddVolumeDuckNotification
	93 -> AudioSessionManagerDeleteVolumeDuckNotification
	94 -> AudioVolumeConnect
	95 -> AudioVolumeDisconnect
	96 -> AudioVolumeQueryHardwareSupport
	97 -> AudioVolumeGetVolumeRange
	98 -> AudioVolumeGetChannelCount
	99 -> AudioVolumeSetMasterVolumeLevel
	100 -> AudioVolumeSetMasterVolumeLevelScalar
	101 -> AudioVolumeGetMasterVolumeLevel
	102 -> AudioVolumeGetMasterVolumeLevelScalar
	103 -> AudioVolumeSetChannelVolumeLevel
	104 -> AudioVolumeSetChannelVolumeLevelScalar
	105 -> AudioVolumeGetChannelVolumeLevel
	106 -> AudioVolumeGetChannelVolumeLevelScalar
	107 -> AudioVolumeSetMute
	108 -> AudioVolumeGetMute
	109 -> AudioVolumeAddMasterVolumeNotification
	110 -> AudioVolumeDeleteMasterVolumeNotification
	111 -> AudioMeterGetPeakValue
	112 -> AudioMeterGetMeteringChannelCount
	113 -> AudioMeterGetChannelsPeakValues
	114 -> AudioVolumeGetStepInfo
	115 -> AudioVolumeStepUp
	116 -> AudioVolumeStepDown
	117 -> AudioServerGetBufferSizeLimits
	118 -> AudioServerSetLastBufferInProgress
	119 -> AudioServerIsRawStreamSupported
	120 -> AudioServerDeriveStreamCategory
	121 -> AudioServerGetStreamVpoContext
	122 -> AudioServerGetEndpointVpoContext
	123 -> AudioServerCloseVpoContext
	124 -> AudioServerGetCurrentSharedModeEnginePeriod
	125 -> AudioServerGetSharedModeEnginePeriod
	126 -> AudioServerRequestSpatialDynamicObjects
	127 -> AudioServerSetAmbMetadata
	128 -> AudioServerSetAmbHeadTracking
	129 -> AudioServerGetAmbHeadTracking
	130 -> AudioServerSetAmbRotation
	131 -> asm_GetApplicationSubmixContext
	132 -> asm_GetApplicationSubmixContextFromPID
	133 -> asm_GetApplicationSubmixContextForProcessTree
	134 -> asm_ApplicationSubmixContextDestroy
	135 -> asm_GetApplicationSubmixes
	136 -> asm_ApplicationSubmixDestroy
	137 -> asm_AudioServerGetApplicationSubmixFormat
	138 -> asm_AudioServerGetApplicationSubmixPeriod
	139 -> asm_AudioServerGetApplicationSubmixId
	140 -> asm_GetApplicationSubmixFromId
	141 -> asm_AudioServerInitializeStream
	142 -> AudioServerTelephonyControlStartSession
	143 -> AudioServerTelephonyControlIsSessionStarted
	144 -> AudioServerTelephonyControlEndSession
	145 -> AudioServerTelephonyControlSetRoutingPolicy
	146 -> AudioServerTelephonyControlGetRoutingPolicy
	147 -> AudioServerTelephonyControlSetCallState
	148 -> AudioServerTelephonyControlGetCallState
	149 -> AudioServerTelephonyControlProviderChange
	150 -> AudioServerTelephonyControlSetMute
	151 -> AudioServerTelephonyControlGetMute
	152 -> AudioServerTelephonyControlSetVOIPMute
	153 -> AudioServerTelephonyControlGetVOIPMute
	154 -> AudioServerTelephonyControlSetVolume
	155 -> AudioServerTelephonyControlGetMaxCallInstanceCount
	156 -> AudioServerTelephonyControlGetValidTelephonyInstance
	157 -> AudioServerGetAudioHistoryProducerHandle
	158 -> AudioServerReleaseAudioHistoryProducerHandle
	159 -> AudioServerGetAudioHistoryProducerInfo
	160 -> AudioServerPopulateAudioHistoryForStream
	161 -> PolicyConfigGetEndpointExtendedSpatialLicenseInfo
RPC  7c69ac10-fa12-4dbf-90d9-c7f1e40f5dc5 (1.6) -- c:\windows\system32\audiosrv.dll
	0 -> s_winmmGetPnpInfo
	1 -> s_mmeNotifyDeviceStateChanged
	2 -> s_mmeNotifyDeviceAdded
	3 -> s_mmeNotifyDeviceRemoved
	4 -> s_mmeNotifyDefaultDeviceChanged
	5 -> s_tsSessionGetAudioProtocol
	6 -> s_tsRegisterAudioProtocolNotification
	7 -> s_tsUnregisterAudioProtocolNotification
	8 -> s_sndevtResolveSoundAlias
	9 -> s_pbmRegisterPlaybackManagerNotifications
	10 -> s_pbmUnregisterPlaybackManagerNotifications
	11 -> s_pbmSetSmtcSubscriptionState
	12 -> s_pbmGetSoundLevel
	13 -> s_ccCreateHandsfreeHidFileFromAudioId
	14 -> s_pbmRegisterAppClosureNotification
	15 -> s_pbmUnregisterAppClosureNotification
	16 -> s_pbmPlayToStreamStateChanged
	17 -> s_pbmIsPlaying
	18 -> s_pbmCastingAppStateChanged
	19 -> s_pbmVoipCallStateChanged
	20 -> s_pbmLaunchBackgroundTask
	21 -> s_pbmRegisterAsBackgroundTask
	22 -> s_afxOpenAudioEffectsWatcher
	23 -> s_afxCloseAudioEffectsWatcher
	24 -> s_midiOpenPort
	25 -> s_rtgGetDefaultAudioEndpoint
	26 -> s_apmRegisterProxyAudioProcess
	27 -> s_apmSetDuckingGainForId
	28 -> s_apmSetLayoutGainForId
	29 -> s_apmSetVolumeGroupGainForId
	30 -> s_apmSetVolumeGroupGainScalarForId
	31 -> s_apmSetVolumeGroupMuteForId
	32 -> s_setRingerVibrateState
	33 -> s_getRingerVibrateState
	34 -> s_getEmergencyCallbackMode
	35 -> s_setEmergencyCallbackMode
	36 -> s_apmSetPersistedDefaultAudioEndpoint
	37 -> s_apmGetPersistedDefaultAudioEndpoint
	38 -> s_apmClearAllPersistedApplicationDefaultEndpoints
	39 -> s_apmRegisterAudioStateMonitor
	40 -> s_apmUnregisterAudioStateMonitor
	41 -> s_apmHandleEuVolumeNotificationResponse
	42 -> AudioServerTelephonyControlGetCallStateSync
	43 -> AudioServerTelephonyControlGetMuteSync
	44 -> s_apmSetBalanceGroupBalanceForId
	45 -> s_apmSetPreferredChatApplication
	46 -> s_apmResetPreferredChatApplication
	47 -> s_CreateHolographicDisplay
	48 -> s_DestroyHolographicDisplay
	49 -> s_GetHeadRotation
RPC  910562c3-ebd9-46b9-baba-1d45842a0ceb (1.0) -- c:\windows\system32\audiosrv.dll
	0 -> s_pbmReportAppInteractivityChange
	1 -> CHybridPropertyStore::Commit
	2 -> s_pbmAllowMediaPlaybackForApp
	3 -> s_CapabilityAccessManagerNotification
	4 -> s_pbmRegisterAppManagerNotification
	5 -> s_pbmUnregisterAppManagerNotification
	6 -> s_pbmReportAppClosing
	7 -> s_pbmReportHostedAppStateChange
	8 -> s_SetScreenReaderState
	9 -> s_pbmSwitchSoftNonInteractiveAppsToHardNonInteractive
	10 -> s_pbmReportApplicationState
	11 -> s_pbmSetApplicationViewPosition
RPC  cba4c918-e55a-46ee-aa62-cade158e9165 (1.0) -- c:\windows\system32\audiosrv.dll
	0 -> s_adGetDeviceGraphWnfStateName
RPC  c7ce3826-891f-4376-b161-c63d2403142c (1.0) -- c:\windows\system32\audiosrv.dll
	0 -> s_RequestHrtfData
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  a8a900c6-da0b-5bcc-a71a-be0b9265d87a (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageInstallingEventArgs
OLE  bd636cf1-541f-53ea-8efc-e1604a395b1a (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageUninstallingEventArgs
OLE  2f732065-eff0-4c7c-8fc1-363851b1f1d7 (0.0) -- iaudiographcallback
Endpoints :
ncalrpc         : AudioClientRpc
ncalrpc         : Audiosrv
ncalrpc         : PlaybackManagerRpc
ncalrpc         : AudioSrvDiagnosticsRpc
ncalrpc         : SpatialSoundDataManagerRpc
ncalrpc         : OLEA1694B7BE165BE08A75BA4D67625
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2440 at 0x5319a58L>
64
['SessionEnv']

Interfaces :
RPC  3473dd4d-2e88-4006-9cba-22570909dd10 (5.1) -- c:\windows\system32\winhttp.dll
	0 -> GetProxyForUrl
	1 -> ResetAutoProxy
	2 -> SaveProxyCredentials
	3 -> StoreSavedProxyCredentialsForCurrentUser
	4 -> DeleteSavedProxyCredentials
	5 -> ReindicateAllProxies
	6 -> ReadProxySettings
	7 -> WriteProxySettings
	8 -> ConnectionUpdateIfIndexTable
	9 -> ConnectionSetPolicyEntries
	10 -> ConnectionDeletePolicyEntries
RPC  824d8d77-a27f-4915-a536-36e9283dce29 (5.1) -- c:\windows\system32\winhttp.dll
	0 -> s_PacWorkerCallbackInitSessionRpc
	1 -> s_PacWorkerCallbackCloseSessionRpc
	2 -> s_PacWorkerCallbackIsResolvableRpc
	3 -> s_PacWorkerCallbackIsResolvableExRpc
	4 -> s_PacWorkerCallbackIsInNetRpc
	5 -> s_PacWorkerCallbackIsInNetExRpc
	6 -> s_PacWorkerCallbackDnsResolveRpc
	7 -> s_PacWorkerCallbackDnsResolveExRpc
	8 -> s_PacWorkerCallbackMyIpAddressRpc
	9 -> s_PacWorkerCallbackMyIpAddressExRpc
	10 -> s_PacWorkerCallbackSortIpAddressListRpc
Endpoints :
ncalrpc         : LRPC-1106d284665f4b3d5d
ncalrpc         : a13b2b26-4e2b-4250-bff3-06ba3da81956
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2252 at 0x5319240L>
64
['Wcmsvc']

Interfaces :
RPC  abfb6ca3-0c5e-4734-9285-0aee72fe8d1c (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcOpenHandle
	1 -> RpcCloseHandle
	2 -> RpcEnumInterfaces
	3 -> RpcQueryParameter
	4 -> RpcSetParameter
	5 -> RpcQueryPublicParameter
	6 -> RpcSetPublicParameter
	7 -> RpcSetProfileList
	8 -> RpcGetProfileList
	9 -> RpcGetProfileListByPurpose
	10 -> RpcGetTokens
	11 -> RpcOrderConnection
	12 -> RpcBeginIgnoreProfileList
	13 -> RpcResetIgnoreProfileList
	14 -> RpcEndIgnoreProfileList
	15 -> RpcOpenOnDemandRequestHandle
	16 -> RpcOpenOnDemandRequestHandleByWwanProfileName
	17 -> RpcStartOnDemandRequest
	18 -> RpcCancelOnDemandRequest
	19 -> RpcCloseOnDemandRequestHandle
	20 -> RpcQueryOnDemandRequestStateInfo
RPC  b37f900a-eae4-4304-a2ab-12bb668c0188 (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcRegisterForNotifications
	1 -> RpcGetPendingNotification
	2 -> RpcCloseNotificationsHandle
	3 -> RpcAcquireSelectableConnectionAsync
	4 -> RpcReleaseSelectableConnection
	5 -> RpcGetSelectableConnectionList
	6 -> RpcGetInterfaceContextTable
	7 -> RpcAddRoutePolicy
	8 -> RpcRemoveRoutePolicy
	9 -> RpcRemoveMatchingRoutePolicy
	10 -> RpcGetRoutingHint
	11 -> RpcCheckCapabilityStatus
RPC  e7f76134-9ef5-4949-a2d6-3368cc0988f3 (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcEnterConnectedStandby
	1 -> RpcExitConnectedStandby
	2 -> RpcEnterNetQuiet
	3 -> RpcExitNetQuiet
RPC  7aeb6705-3ae6-471a-882d-f39c109edc12 (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcSetOperatorDataplanStatus
	1 -> RpcSetOperatorConnectionCost
	2 -> RpcSetOperatorCycleData
RPC  f44e62af-dab1-44c2-8013-049a9de417d6 (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcUpdateCapabilityAccess
	1 -> RpcDeprovisionCapability
RPC  c2d1b5dd-fa81-4460-9dd6-e7658b85454b (1.0) -- c:\windows\system32\wcmsvc.dll
	0 -> RpcSetProxyInformation
	1 -> RpcDeleteProxyInformation
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-96b557c995f0059b6f
ncalrpc         : OLE961E91843456DD6F0DD0A79DF5BB
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2464 at 0x5319978L>
64
['DusmSvc']

Interfaces :
RPC  c27f3c08-92ba-478c-b446-b419c4cef0e2 (1.0) -- c:\windows\system32\dusmsvc.dll
	0 -> DusmRpcEnumConnectionList
	1 -> DusmRpcEnumProfileList
	2 -> DusmRpcQueryConnectionProperties
	3 -> DusmRpcQueryCost
	4 -> DusmRpcQueryUserCost
	5 -> DusmRpcQueryOperatorCost
	6 -> DusmRpcSetUserCost
	7 -> DusmRpcSetOperatorCost
	8 -> DusmRpcQueryDataPlan
	9 -> DusmRpcQueryUserDataPlan
	10 -> DusmRpcQueryOperatorDataPlan
	11 -> DusmRpcSetUserDataPlan
	12 -> DusmRpcSetOperatorDataPlan
	13 -> DusmRpcQuerySource
	14 -> DusmRpcSetSource
	15 -> DusmRpcQueryBackgroundRestriction
	16 -> DusmRpcSetBackgroundRestriction
	17 -> DusmRpcQueryGlobalDpuState
	18 -> DusmRpcGetAttributedNetworkUsage
	19 -> DusmRpcGetConnectionListNetworkUsage
	20 -> DusmRpcGetNetworkUsage
	21 -> DusmRpcGetProviderNetworkUsage
	22 -> DusmRpcSetAttributionMapping
	23 -> DusmRpcResetNetworkUsage
	24 -> DusmRpcFlushCostCache
Endpoints :
ncalrpc         : LRPC-fe377b929e997d74df
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2608 at 0x5319c88L>
64
['ShellHWDetection']

Interfaces :
RPC  12345678-1234-abcd-ef00-0123456789ab (1.0) -- C:\windows\System32\spoolsv.exe
	0 -> RpcEnumPrinters
	1 -> RpcOpenPrinter
	2 -> RpcSetJob
	3 -> RpcGetJob
	4 -> RpcEnumJobs
	5 -> RpcAddPrinter
	6 -> RpcDeletePrinter
	7 -> RpcSetPrinter
	8 -> RpcGetPrinter
	9 -> RpcAddPrinterDriver
	10 -> RpcEnumPrinterDrivers
	11 -> RpcGetPrinterDriver
	12 -> RpcGetPrinterDriverDirectory
	13 -> RpcDeletePrinterDriver
	14 -> RpcAddPrintProcessor
	15 -> RpcEnumPrintProcessors
	16 -> RpcGetPrintProcessorDirectory
	17 -> RpcStartDocPrinter
	18 -> RpcStartPagePrinter
	19 -> RpcWritePrinter
	20 -> RpcEndPagePrinter
	21 -> RpcAbortPrinter
	22 -> RpcReadPrinter
	23 -> RpcEndDocPrinter
	24 -> RpcAddJob
	25 -> RpcScheduleJob
	26 -> RpcGetPrinterData
	27 -> RpcSetPrinterData
	28 -> RpcWaitForPrinterChange
	29 -> RpcClosePrinter
	30 -> RpcAddForm
	31 -> RpcDeleteForm
	32 -> RpcGetForm
	33 -> RpcSetForm
	34 -> RpcEnumForms
	35 -> RpcEnumPorts
	36 -> RpcEnumMonitors
	37 -> RpcAddPort
	38 -> RpcConfigurePort
	39 -> RpcDeletePort
	40 -> RpcCreatePrinterIC
	41 -> RpcPlayGdiScriptOnPrinterIC
	42 -> RpcDeletePrinterIC
	43 -> RpcAddPrinterConnection
	44 -> RpcDeletePrinterConnection
	45 -> RpcPrinterMessageBox
	46 -> RpcAddMonitor
	47 -> RpcDeleteMonitor
	48 -> RpcDeletePrintProcessor
	49 -> RpcAddPrintProvidor
	50 -> RpcDeletePrintProvidor
	51 -> RpcEnumPrintProcessorDatatypes
	52 -> RpcResetPrinter
	53 -> RpcGetPrinterDriver2
	54 -> RpcClientFindFirstPrinterChangeNotification
	55 -> RpcFindNextPrinterChangeNotification
	56 -> RpcFindClosePrinterChangeNotification
	57 -> NThreadingLibrary::TWorkItem::NotifyCancel
	58 -> RpcReplyOpenPrinter
	59 -> RpcRouterReplyPrinter
	60 -> RpcReplyClosePrinter
	61 -> RpcAddPortEx
	62 -> RpcRemoteFindFirstPrinterChangeNotification
	63 -> RpcSetAllocFailCount
	64 -> RpcResetPrinterEx
	65 -> RpcRemoteFindFirstPrinterChangeNotificationEx
	66 -> RpcRouterReplyPrinterEx
	67 -> RpcRouterRefreshPrinterChangeNotification
	68 -> RpcSetAllocFailCount
	69 -> RpcOpenPrinterEx
	70 -> RpcAddPrinterEx
	71 -> RpcSetPort
	72 -> RpcEnumPrinterData
	73 -> RpcDeletePrinterData
	74 -> NThreadingLibrary::TWorkItem::NotifyCancel
	75 -> NThreadingLibrary::TWorkItem::NotifyCancel
	76 -> NThreadingLibrary::TWorkItem::NotifyCancel
	77 -> RpcSetPrinterDataEx
	78 -> RpcGetPrinterDataEx
	79 -> RpcEnumPrinterDataEx
	80 -> RpcEnumPrinterKey
	81 -> RpcDeletePrinterDataEx
	82 -> RpcDeletePrinterKey
	83 -> RpcSeekPrinter
	84 -> RpcDeletePrinterDriverEx
	85 -> RpcAddPerMachineConnection
	86 -> RpcDeletePerMachineConnection
	87 -> RpcEnumPerMachineConnections
	88 -> RpcXcvData
	89 -> RpcAddPrinterDriverEx
	90 -> RpcSplOpenPrinter
	91 -> RpcGetSpoolFileInfo
	92 -> RpcCommitSpoolData
	93 -> RpcGetSpoolFileInfo2
	94 -> RpcCommitSpoolData2
	95 -> RpcCloseSpoolFileHandle
	96 -> RpcFlushPrinter
	97 -> RpcSendRecvBidiData
	98 -> RpcAddDriverCatalog
	99 -> RpcAddPrinterConnection2
	100 -> RpcInstallPrinterDriverFromPackage
	101 -> RpcUploadPrinterDriverPackage
	102 -> RpcGetCorePrinterDrivers
	103 -> RpcCorePrinterDriverInstalled
	104 -> RpcGetPrinterDriverPackagePath
	105 -> RpcDeletePrinterDriverPackage
	106 -> RpcFindCompatibleDriver
	107 -> RpcReportJobProcessingProgress
	108 -> RpcSetSpoolerPolicy
	109 -> RpcInternalGetPrinterDriver
	110 -> RpcGetJobNamedPropertyValue
	111 -> RpcSetJobNamedProperty
	112 -> RpcDeleteJobNamedProperty
	113 -> RpcEnumJobNamedProperties
	114 -> RpcCreateAppSandbox
	115 -> RpcGetUserPropertyBag
	116 -> RpcLogJobInfoForBranchOffice
RPC  0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 (1.0) -- C:\windows\System32\spoolsv.exe
	0 -> IRPCAsyncNotify_RegisterClient
	1 -> IRPCAsyncNotify_UnregisterClient
	2 -> IRPCAsyncNotify_GetServerRefferal
	3 -> IRPCAsyncNotify_GetNewChannel
	4 -> IRPCAsyncNotify_GetNotificationSendResponse
	5 -> IRPCAsyncNotify_GetNotification
	6 -> IRPCAsyncNotify_CloseChannel
RPC  ae33069b-a2a8-46ee-a235-ddfd339be281 (1.0) -- C:\windows\System32\spoolsv.exe
	0 -> IRPCRemoteObject_Create
	1 -> IRPCRemoteObject_Delete
RPC  4a452661-8290-4b36-8fbe-7f4093a94978 (1.0) -- C:\windows\System32\spoolsv.exe
	0 -> IRPCAsyncNotifyChannel_CreateChannel
	1 -> IRPCAsyncNotifyChannel_SendNotification
	2 -> IRPCAsyncNotifyChannel_SendNotificationGetResponse
	3 -> IRPCAsyncNotifyChannel_CloseChannel
RPC  76f03f96-cdfd-44fc-a22c-64950a001209 (1.0) -- C:\windows\System32\spoolsv.exe
	0 -> RpcAsyncOpenPrinter
	1 -> RpcAsyncAddPrinter
	2 -> RpcAsyncSetJob
	3 -> RpcAsyncGetJob
	4 -> RpcAsyncEnumJobs
	5 -> RpcAsyncAddJob
	6 -> RpcAsyncScheduleJob
	7 -> RpcAsyncDeletePrinter
	8 -> RpcAsyncSetPrinter
	9 -> RpcAsyncGetPrinter
	10 -> RpcAsyncStartDocPrinter
	11 -> RpcAsyncStartPagePrinter
	12 -> RpcAsyncWritePrinter
	13 -> RpcAsyncEndPagePrinter
	14 -> RpcAsyncEndDocPrinter
	15 -> RpcAsyncAbortPrinter
	16 -> RpcAsyncGetPrinterData
	17 -> RpcAsyncGetPrinterDataEx
	18 -> RpcAsyncSetPrinterData
	19 -> RpcAsyncSetPrinterDataEx
	20 -> RpcAsyncClosePrinter
	21 -> RpcAsyncAddForm
	22 -> RpcAsyncDeleteForm
	23 -> RpcAsyncGetForm
	24 -> RpcAsyncSetForm
	25 -> RpcAsyncEnumForms
	26 -> RpcAsyncGetPrinterDriver
	27 -> RpcAsyncEnumPrinterData
	28 -> RpcAsyncEnumPrinterDataEx
	29 -> RpcAsyncEnumPrinterKey
	30 -> RpcAsyncDeletePrinterData
	31 -> RpcAsyncDeletePrinterDataEx
	32 -> RpcAsyncDeletePrinterKey
	33 -> RpcAsyncXcvData
	34 -> RpcAsyncSendRecvBidiData
	35 -> RpcAsyncCreatePrinterIC
	36 -> RpcAsyncPlayGdiScriptOnPrinterIC
	37 -> RpcAsyncDeletePrinterIC
	38 -> RpcAsyncEnumPrinters
	39 -> RpcAsyncAddPrinterDriver
	40 -> RpcAsyncEnumPrinterDrivers
	41 -> RpcAsyncGetPrinterDriverDirectory
	42 -> RpcAsyncDeletePrinterDriver
	43 -> RpcAsyncDeletePrinterDriverEx
	44 -> RpcAsyncAddPrintProcessor
	45 -> RpcAsyncEnumPrintProcessors
	46 -> RpcAsyncGetPrintProcessorDirectory
	47 -> RpcAsyncEnumPorts
	48 -> RpcAsyncEnumMonitors
	49 -> RpcAsyncAddPort
	50 -> RpcAsyncSetPort
	51 -> RpcAsyncAddMonitor
	52 -> RpcAsyncDeleteMonitor
	53 -> RpcAsyncDeletePrintProcessor
	54 -> RpcAsyncEnumPrintProcessorDatatypes
	55 -> RpcAsyncAddPerMachineConnection
	56 -> RpcAsyncDeletePerMachineConnection
	57 -> RpcAsyncEnumPerMachineConnections
	58 -> RpcSyncRegisterForRemoteNotifications
	59 -> RpcSyncUnRegisterForRemoteNotifications
	60 -> RpcSyncRefreshRemoteNotifications
	61 -> RpcAsyncGetRemoteNotifications
	62 -> RpcAsyncInstallPrinterDriverFromPackage
	63 -> RpcAsyncUploadPrinterDriverPackage
	64 -> RpcAsyncGetCorePrinterDrivers
	65 -> RpcAsyncCorePrinterDriverInstalled
	66 -> RpcAsyncGetPrinterDriverPackagePath
	67 -> RpcAsyncDeletePrinterDriverPackage
	68 -> RpcAsyncReadPrinter
	69 -> RpcAsyncResetPrinter
	70 -> RpcAsyncGetJobNamedPropertyValue
	71 -> RpcAsyncSetJobNamedProperty
	72 -> RpcAsyncDeleteJobNamedProperty
	73 -> RpcAsyncEnumJobNamedProperties
	74 -> RpcAsyncLogJobInfoForBranchOffice
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-a7109f2c2cdeefba97
ncacn_np        : \pipe\spoolss
ncacn_ip_tcp    : 49676
ncalrpc         : OLE2D77958200DDBE189A720E9EED55
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3120 at 0x5319eb8L>
64
['BFE', 'mpssvc']

Interfaces :
RPC  dd490425-5325-4565-b774-7e27d6c09c24 (1.0) -- c:\windows\system32\bfe.dll
	0 -> BfeRpcGetNextNotificationBatch
	1 -> BfeRpcNotifyComplete
	2 -> BfeRpcEngineOpen
	3 -> BfeRpcEngineClose
	4 -> BfeRpcEngineGetOption
	5 -> BfeRpcEngineSetOption
	6 -> BfeRpcEngineGetSecurityInfo
	7 -> BfeRpcEngineSetSecurityInfo
	8 -> BfeRpcSessionCreateEnumHandle
	9 -> BfeRpcAleEndpointEnum
	10 -> BfeRpcAleEndpointDestroyEnumHandle
	11 -> BfeRpcTransactionBegin
	12 -> BfeRpcTransactionCommit
	13 -> BfeRpcTransactionAbort
	14 -> BfeRpcProviderAdd
	15 -> BfeRpcProviderDeleteByKey
	16 -> BfeRpcProviderGetByKey
	17 -> BfeRpcProviderCreateEnumHandle
	18 -> BfeRpcAleEndpointEnum
	19 -> BfeRpcAleEndpointDestroyEnumHandle
	20 -> BfeRpcProviderGetSecurityInfoByKey
	21 -> BfeRpcProviderSetSecurityInfoByKey
	22 -> BfeRpcProviderSubscribeChanges
	23 -> BfeRpcProviderUnsubscribeChanges
	24 -> BfeRpcProviderSubscriptionsGet
	25 -> BfeRpcProviderContextAdd
	26 -> BfeRpcProviderContextDeleteById
	27 -> BfeRpcProviderContextDeleteByKey
	28 -> BfeRpcProviderContextGetById
	29 -> BfeRpcProviderContextGetByKey
	30 -> BfeRpcProviderContextCreateEnumHandle
	31 -> BfeRpcAleEndpointEnum
	32 -> BfeRpcAleEndpointDestroyEnumHandle
	33 -> BfeRpcProviderContextGetSecurityInfoByKey
	34 -> BfeRpcProviderContextSetSecurityInfoByKey
	35 -> BfeRpcProviderContextSubscribeChanges
	36 -> BfeRpcProviderContextUnsubscribeChanges
	37 -> BfeRpcProviderContextSubscriptionsGet
	38 -> BfeRpcSubLayerAdd
	39 -> BfeRpcSubLayerDeleteByKey
	40 -> BfeRpcSubLayerGetByKey
	41 -> BfeRpcSubLayerCreateEnumHandle
	42 -> BfeRpcAleEndpointEnum
	43 -> BfeRpcAleEndpointDestroyEnumHandle
	44 -> BfeRpcSubLayerGetSecurityInfoByKey
	45 -> BfeRpcSubLayerSetSecurityInfoByKey
	46 -> BfeRpcSubLayerSubscribeChanges
	47 -> BfeRpcSubLayerUnsubscribeChanges
	48 -> BfeRpcSubLayerSubscriptionsGet
	49 -> BfeRpcLayerGetById
	50 -> BfeRpcLayerGetByKey
	51 -> BfeRpcLayerCreateEnumHandle
	52 -> BfeRpcAleEndpointEnum
	53 -> BfeRpcAleEndpointDestroyEnumHandle
	54 -> BfeRpcLayerGetSecurityInfoByKey
	55 -> BfeRpcLayerSetSecurityInfoByKey
	56 -> BfeRpcCalloutAdd
	57 -> BfeRpcCalloutDeleteById
	58 -> BfeRpcCalloutDeleteByKey
	59 -> BfeRpcCalloutGetById
	60 -> BfeRpcCalloutGetByKey
	61 -> BfeRpcCalloutCreateEnumHandle
	62 -> BfeRpcAleEndpointEnum
	63 -> BfeRpcAleEndpointDestroyEnumHandle
	64 -> BfeRpcCalloutGetSecurityInfoByKey
	65 -> BfeRpcCalloutSetSecurityInfoByKey
	66 -> BfeRpcCalloutSubscribeChanges
	67 -> BfeRpcCalloutUnsubscribeChanges
	68 -> BfeRpcCalloutSubscriptionsGet
	69 -> BfeRpcFilterAdd
	70 -> BfeRpcFilterDeleteById
	71 -> BfeRpcFilterDeleteByKey
	72 -> BfeRpcFilterGetById
	73 -> BfeRpcFilterGetByKey
	74 -> BfeRpcFilterCreateEnumHandle
	75 -> BfeRpcAleEndpointEnum
	76 -> BfeRpcAleEndpointDestroyEnumHandle
	77 -> BfeRpcFilterGetSecurityInfoByKey
	78 -> BfeRpcFilterSetSecurityInfoByKey
	79 -> BfeRpcFilterSubscribeChanges
	80 -> BfeRpcFilterUnsubscribeChanges
	81 -> BfeRpcFilterSubscriptionsGet
	82 -> BfeRpcBfeIPsecOffloadDone
	83 -> BfeRpcBfeIPsecDosFWUsed
	84 -> BfeRpcBfeIPsecGetStatistics
	85 -> BfeRpcBfeIPsecSaContextCreate
	86 -> BfeRpcBfeIPsecSaContextDeleteById
	87 -> BfeRpcBfeIPsecSaContextGetById
	88 -> BfeRpcBfeIPsecSaContextGetOrSetSpi
	89 -> BfeRpcBfeIPsecSaContextAddInbound
	90 -> BfeRpcBfeIPsecSaContextAddOutbound
	91 -> BfeRpcBfeIPsecSaContextUpdate
	92 -> BfeRpcBfeIPsecSaContextExpire
	93 -> BfeRpcBfeIPsecSaContextCreateEnumHandle
	94 -> BfeRpcAleEndpointEnum
	95 -> BfeRpcAleEndpointDestroyEnumHandle
	96 -> BfeRpcBfeIPsecSaContextSubscribe
	97 -> BfeRpcBfeIPsecSaContextUnsubscribe
	98 -> BfeRpcBfeIPsecSaContextSubscriptionsGet
	99 -> BfeRpcBfeIPsecSaCreateEnumHandle
	100 -> BfeRpcAleEndpointEnum
	101 -> BfeRpcAleEndpointDestroyEnumHandle
	102 -> BfeRpcBfeIPsecSaDbGetSecurityInfo
	103 -> BfeRpcBfeIPsecSaDbSetSecurityInfo
	104 -> BfeRpcBfeIPsecDospGetStatistics
	105 -> BfeRpcBfeIPsecDospStateCreateEnumHandle
	106 -> BfeRpcAleEndpointEnum
	107 -> BfeRpcBfeIPsecDospStateDestroyEnumHandle
	108 -> BfeRpcBfeIPsecDospGetSecurityInfo
	109 -> BfeRpcBfeIPsecDospSetSecurityInfo
	110 -> BfeRpcNetEventCreateEnumHandle
	111 -> BfeRpcAleEndpointEnum
	112 -> BfeRpcAleEndpointDestroyEnumHandle
	113 -> BfeRpcNetEventsGetSecurityInfo
	114 -> BfeRpcNetEventsSetSecurityInfo
	115 -> BfeRpcNetEventSubscribe
	116 -> BfeRpcNetEventUnsubscribe
	117 -> BfeRpcNetEventSubscriptionsGet
	118 -> BfeRpcNetEventsLost
	119 -> BfeRpcConnectionGetById
	120 -> BfeRpcConnectionGetByIPsecInfo
	121 -> BfeRpcConnectionGetByS2STunnelId
	122 -> BfeRpcConnectionCreateEnumHandle
	123 -> BfeRpcAleEndpointEnum
	124 -> BfeRpcAleEndpointDestroyEnumHandle
	125 -> BfeRpcConnectionGetSecurityInfo
	126 -> BfeRpcConnectionSetSecurityInfo
	127 -> BfeRpcConnectionGetS2STunnelId
	128 -> BfeRpcConnectionSubscribe
	129 -> BfeRpcConnectionUnsubscribe
	130 -> BfeRpcConnectionSubscriptionsGet
	131 -> BfeRpcConnectionsLost
	132 -> BfeRpcClassify
	133 -> BfeRpcAddLayerReplica
	134 -> BfeRpcDeleteLayerReplica
	135 -> BfeRpcSecureSocketAdd
	136 -> BfeRpcBfeIPsecTunnelDeleteByKey
	137 -> BfeRpcBfeIPsecTunnelAdd
	138 -> BfeRpcBfeIPsecTunnelAddConditions
	139 -> BfeRpcBfeIPsecS2STunnelAddConditions
	140 -> BfeRpcBfeIPsecS2STunnelRemoveConditions
	141 -> BfeRpcBfeIPsecTunnelDeleteByKey
	142 -> BfeRpcBfeIPsecS2STunnelAddInterfaceToCompartment
	143 -> BfeRpcBfeIPsecS2STunnelGetInterfaceForCompartment
	144 -> BfeRpcBfeIPsecS2STunnelRemoveInterfaceFromCompartment
	145 -> BfeRpcBfeIPsecSaInitiateAsync
	146 -> BfeRpcOpenToken
	147 -> BfeRpcCloseToken
	148 -> BfeRpcAleExplicitCredentialsQuery
	149 -> BfeRpcAleEndpointGetById
	150 -> BfeRpcAleEndpointCreateEnumHandle
	151 -> BfeRpcAleEndpointEnum
	152 -> BfeRpcAleEndpointDestroyEnumHandle
	153 -> BfeRpcAleEndpointGetSecurityInfo
	154 -> BfeRpcAleEndpointSetSecurityInfo
	155 -> BfeRpcAleGetPortStatus
	156 -> BfeRpcIsUserAuthConfigured
	157 -> BfeRpcKeyModuleAdd
	158 -> BfeRpcKeyModuleDeleteByKey
	159 -> BfeRpcKeyModuleUpdateAcquire
	160 -> BfeRpcKeyDictatorCheck
	161 -> BfeRpcGetKeyFromDictator
	162 -> BfeRpcNotifyKey
	163 -> BfeRpcKeyManagerAdd
	164 -> BfeRpcKeyManagerDeleteByKey
	165 -> BfeRpcKeyManagersGet
	166 -> BfeRpcKeyManagerGetSecurityInfoByKey
	167 -> BfeRpcKeyManagerSetSecurityInfoByKey
	168 -> BfeRpcvSwitchEventFire
	169 -> BfeRpcvSwitchEventsGetSecurityInfo
	170 -> BfeRpcvSwitchEventsSetSecurityInfo
	171 -> BfeRpcvSwitchEventSubscribe
	172 -> BfeRpcvSwitchEventUnsubscribe
	173 -> BfeRpcvSwitchEventSubscriptionsGet
	174 -> BfeRpcBfeIPsecDriverInitiateAcquire
	175 -> BfeRpcBfeIPsecDriverExpire
	176 -> BfeRpcBfeIPsecDriverSaOffloaded
	177 -> BfeRpcBfeIPsecDriverProcessClearTextResponse
	178 -> BfeRpcBfeProcessNameResolutionEvent
	179 -> BfeRpcVpnTriggerEventFire
	180 -> BfeRpcVpnTriggerEventSubscribe
	181 -> BfeRpcVpnTriggerEventUnsubscribe
	182 -> BfeRpcVpnTriggerAddAppSids
	183 -> BfeRpcVpnTriggerRemoveAppSids
	184 -> BfeRpcVpnTriggerAddFilePaths
	185 -> BfeRpcVpnTriggerRemoveFilePaths
	186 -> BfeRpcVpnTriggerAddSecurityDescriptor
	187 -> BfeRpcVpnTriggerRemoveSecurityDescriptor
	188 -> BfeRpcVpnTriggerSetStateDisconnected
	189 -> BfeRpcVpnTriggerInitializeNrptTriggering
	190 -> BfeRpcVpnTriggerUninitializeNrptTriggering
	191 -> BfeRpcVpnTriggerResetNrptTriggering
	192 -> BfeRpcVpnTriggerConfigureParameters
	193 -> BfeRpcBitmapIndexGet
	194 -> BfeRpcBitmapIndexFree
RPC  7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_FWIndicatePortInUse
	1 -> RPC_FWGetIndicatedPortInUse
	2 -> RPC_FWIndicateTupleInUse
	3 -> RPC_FWResetIndicatedTupleInUse
	4 -> RPC_FWIndicateProxyForUrl
	5 -> CNetProfileEventSink::NetworkAdded
	6 -> RPC_FWIsTargetAProxy
	7 -> RPC_NetworkIsolationSetupAppContainerBinaries
	8 -> RPC_NetworkIsolationRegisterForAppContainerChanges
	9 -> Rpc_NetworkIsolationRegistrationGetLastEvent
	10 -> RPC_NetworkIsolationUnregisterForAppContainerChanges
	11 -> RPC_NetworkIsolationGetAppContainer
	12 -> RPC_NetworkIsolationEnumAppContainers
	13 -> RPC_NetworkIsolationAddAllowEnterpriseIdRule
	14 -> RPC_NetworkIsolationCreateAllInterfacesContainer
	15 -> RPC_NetworkIsolationCreateInterfaceContainer
	16 -> RPC_NetworkIsolationDeleteAllInterfacesContainer
	17 -> RPC_NetworkIsolationDeleteInterfaceContainer
RPC  f47433c3-3e9d-4157-aad4-83aa1f5c2d4c (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_NetworkIsolationDiagnoseConnectFailure
	1 -> RPC_NetworkIsolationGetEnterpriseIdAsync
	2 -> RPC_NetworkIsolationCreateContainer
	3 -> RPC_NetworkIsolationDeleteContainer
	4 -> RPC_NetworkIsolationGetAppContainerConfig
	5 -> RPC_NetworkIsolationSetAppContainerConfig
	6 -> RPC_NetworkIsolationCreateAppContainer
	7 -> RPC_NetworkIsolationDeleteAppContainer
	8 -> RPC_NetworkIsolationCreateAppContainerLoopbackRules
	9 -> RPC_NetworkIsolationDeleteAppContainerLoopbackRules
RPC  2fb92682-6599-42dc-ae13-bd2ca89bd11c (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_FWOpenPolicyStore
	1 -> RPC_FWClosePolicyStore
	2 -> RPC_FWRestoreDefaults
	3 -> RPC_FWGetGlobalConfig
	4 -> RPC_FWSetGlobalConfig
	5 -> RPC_FWAddFirewallRule
	6 -> RPC_FWSetFirewallRule
	7 -> RPC_FWDeleteFirewallRule
	8 -> RPC_FWDeleteAllFirewallRules
	9 -> RPC_FWEnumFirewallRules
	10 -> RPC_FWGetConfig
	11 -> RPC_FWSetConfig
	12 -> RPC_FWNotifyUnsupportedAttempt
	13 -> RPC_FWAddConnectionSecurityRule
	14 -> RPC_FWSetConnectionSecurityRule
	15 -> RPC_FWDeleteConnectionSecurityRule
	16 -> RPC_FWDeleteAllConnectionSecurityRules
	17 -> RPC_FWEnumConnectionSecurityRules
	18 -> RPC_FWAddAuthenticationSet
	19 -> RPC_FWSetAuthenticationSet
	20 -> RPC_FWDeleteAuthenticationSet
	21 -> RPC_FWDeleteAllAuthenticationSets
	22 -> RPC_FWEnumAuthenticationSets
	23 -> RPC_FWAddCryptoSet
	24 -> RPC_FWSetCryptoSet
	25 -> RPC_FWDeleteCryptoSet
	26 -> RPC_FWDeleteAllCryptoSets
	27 -> RPC_FWEnumCryptoSets
	28 -> RPC_FWEnumPhase1SAs
	29 -> RPC_FWEnumPhase2SAs
	30 -> RPC_FWDeletePhase1SAs
	31 -> RPC_FWDeletePhase2SAs
	32 -> RPC_FWRegisterProduct
	33 -> RPC_FWUnregisterProduct
	34 -> RPC_FWEnumProducts
	35 -> RPC_FWAddMainModeRule
	36 -> RPC_FWSetMainModeRule
	37 -> RPC_FWDeleteMainModeRule
	38 -> RPC_FWDeleteAllMainModeRules
	39 -> RPC_FWEnumMainModeRules
	40 -> RPC_FWQueryFirewallRules
	41 -> RPC_FWQueryConnectionSecurityRules2_10
	42 -> RPC_FWQueryMainModeRules
	43 -> RPC_FWQueryAuthenticationSets
	44 -> RPC_FWQueryCryptoSets
	45 -> RPC_FWEnumNetworks
	46 -> RPC_FWEnumAdapters
	47 -> RPC_FWGetGlobalConfig2_10
	48 -> RPC_FWGetConfig2_10
	49 -> RPC_FWAddFirewallRule2_10
	50 -> RPC_FWSetFirewallRule2_10
	51 -> RPC_FWEnumFirewallRules2_10
	52 -> RPC_FWAddConnectionSecurityRule2_10
	53 -> RPC_FWSetConnectionSecurityRule2_10
	54 -> RPC_FWEnumConnectionSecurityRules2_10
	55 -> RPC_FWAddAuthenticationSet2_10
	56 -> RPC_FWSetAuthenticationSet2_10
	57 -> RPC_FWEnumAuthenticationSets2_10
	58 -> RPC_FWAddCryptoSet2_10
	59 -> RPC_FWSetCryptoSet2_10
	60 -> RPC_FWEnumCryptoSets2_10
	61 -> RPC_FWDiagGetAppList
	62 -> RPC_FWAddConnectionSecurityRule2_20
	63 -> RPC_FWSetConnectionSecurityRule2_20
	64 -> RPC_FWEnumConnectionSecurityRules2_20
	65 -> RPC_FWQueryConnectionSecurityRules2_20
	66 -> RPC_FWAddAuthenticationSet2_20
	67 -> RPC_FWSetAuthenticationSet2_20
	68 -> RPC_FWEnumAuthenticationSets2_20
	69 -> RPC_FWQueryAuthenticationSets2_20
	70 -> RPC_FWAddFirewallRule2_20
	71 -> RPC_FWSetFirewallRule2_20
	72 -> RPC_FWEnumFirewallRules2_20
	73 -> RPC_FWQueryFirewallRules2_20
	74 -> RPC_FWQueryIsolationType
	75 -> RPC_FWSelectConSecRule
	76 -> RPC_FWAddFirewallRule2_24
	77 -> RPC_FWSetFirewallRule2_24
	78 -> RPC_FWEnumFirewallRules2_24
	79 -> RPC_FWQueryFirewallRules2_24
	80 -> RPC_FWAddFirewallRule2_25
	81 -> RPC_FWSetFirewallRule2_25
	82 -> RPC_FWEnumFirewallRules2_25
	83 -> RPC_FWQueryFirewallRules2_25
	84 -> RPC_FWAddFirewallRule2_26
	85 -> RPC_FWSetFirewallRule2_26
	86 -> RPC_FWEnumFirewallRules2_26
	87 -> RPC_FWQueryFirewallRules2_26
	88 -> RPC_FWAddFirewallRule2_27
	89 -> RPC_FWSetFirewallRule2_27
	90 -> RPC_FWEnumFirewallRules2_27
	91 -> RPC_FWQueryFirewallRules2_27
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
Endpoints :
ncalrpc         : LRPC-ed9d7ac604d40c5ebd
ncalrpc         : LRPC-f160739feac8ff62a5
ncalrpc         : LRPC-ea0c57f873808f128d
ncalrpc         : LRPC-f0d73120b1337b746d
ncalrpc         : OLE1A85C7A80535A4E0EF0B2D03A60F
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3196 at 0x5319d30L>
64
['CryptSvc']

Interfaces :
RPC  0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 (1.0) -- c:\windows\system32\cryptsvc.dll
	0 -> s_SSCertProtectFunction
RPC  2579ff35-0ab0-4e5a-88fa-1d88c4e0cb92 (2.0) -- C:\Windows\System32\crypttpmeksvc.dll
	0 -> s_SSTpmEndorsementKeyGetInfo
	1 -> s_SSTpmEndorsementKeyDecryptChallenge
	2 -> s_SSTpmAttestationCapable
	3 -> s_SSTpmGetAttestationForAik
	4 -> s_SSTpmGetManufacturerInfo
RPC  f50aac00-c7f3-428e-a022-a6b71bfb9d43 (2.0) -- C:\Windows\System32\cryptcatsvc.dll
	0 -> s_SSCatDBAddCatalog
	1 -> s_SSCatDBDeleteCatalog
	2 -> s_SSCatDBEnumCatalogs
	3 -> s_SSCatDBPauseResumeService
	4 -> s_SSCatDBRebuildDatabase
	5 -> s_SSCatDBPrepareForCall
	6 -> s_SSCatDBAddCatalog2
	7 -> s_SSCatDBSmartlockerDefenderCheck
RPC  1495a2be-b7a8-4299-9d3b-8825e5bcbfb9 (1.0) -- C:\Windows\System32\webauthn.dll
	0 -> s_SSCtapCommand
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : keysvc
ncalrpc         : OLE037BD8768B2F1438658B1D7E91E0
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3208 at 0x5319fd0L>
64
['DiagTrack']

Interfaces :
RPC  4c9dbf19-d39e-4bb9-90ee-8f7179b20283 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcApi_IsScenarioActive
	1 -> UtcApi_EscalateScenario
	2 -> UtcApi_EscalateScenarioAsync
	3 -> UtcApi_IsEscalationRunning
	4 -> UtcApi_DownloadLatestSettingsForNamespace
	5 -> UtcApi_DownloadLatestSettingsForNamespaceAsync
	6 -> UtcApi_GetActiveScenarioList
	7 -> UtcApi_ForceUpload
	8 -> UtcApi_ResetUsageMetrics
	9 -> UtcApi_IsTraceRunning
	10 -> UtcApi_GetActiveTraceRuntime
	11 -> UtcApi_GetKnownTraceList
	12 -> UtcApi_DownloadLatestSettings
	13 -> UtcApi_ReloadSettings
	14 -> UtcApi_UpdateTimerConfiguration
	15 -> UtcApi_ClearTimerConfiguration
	16 -> UtcApi_GetNextScheduledFireTime
	17 -> UtcApi_GetTimerConfiguration
	18 -> UtcApi_GetCustomTraceList
	19 -> UtcApi_StartCustomTrace
	20 -> UtcApi_SnapCustomTrace
	21 -> UtcApi_StopCustomTrace
	22 -> UtcApi_EscalateScenario2
	23 -> UtcApi_EscalateScenarioAsync2
	24 -> UtcApi_GetActiveTraceInfo
	25 -> UtcApi_EnableWERLocalReports
	26 -> UtcApi_RestoreWERLocalReportsSettings
	27 -> UtcApi_QueryWERLocalReportsEnabled
	28 -> UtcApi_IsEscalationRunningEx
	29 -> UtcApi_QueryDiagnosticCollectionState
RPC  fd8be72b-a9cd-4b2c-a9ca-4ded242fbe4d (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcApi_SendSyntheticTrigger
	1 -> UtcApi_ChangeEtmPauseState
RPC  95095ec8-32ea-4eb0-a3e2-041f97b36168 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcTelemetryOptInApi_SetTelemetryOptIn
RPC  e38f5360-8572-473e-b696-1b46873beeab (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcTenantApi_RegisterTelemetryTenant
	1 -> UtcTenantApi_UnregisterTelemetryTenant
	2 -> UtcTenantApi_UpdateDailyUploadQuota
	3 -> UtcTenantApi_ForceUpload
RPC  d22895ef-aff4-42c5-a5b2-b14466d34ab4 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcEventTranscriptApi_FetchTranscriptStats
	1 -> Microsoft::Diagnostics::FileWrapStream::Commit
	2 -> UtcEventTranscriptApi_FetchTranscriptRecordPayload
	3 -> UtcEventTranscriptApi_FetchKnownTags
	4 -> UtcEventTranscriptApi_FetchEventTags
	5 -> UtcEventTranscriptApi_IsSampledIn
	6 -> UtcEventTranscriptApi_FetchTranscriptRecordsPage2
	7 -> UtcEventTranscriptApi_CancelFetchOperations
RPC  98cd761e-e77d-41c8-a3c0-0fb756d90ec2 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcWerHelperApi_FetchReportCount
	1 -> UtcWerHelperApi_FetchReportData
	2 -> UtcWerHelperApi_EnableWerLocalReports
	3 -> UtcWerHelperApi_RestoreWerLocalReportsSettings
	4 -> UtcWerHelperApi_QueryWerLocalReportsEnabled
	5 -> UtcWerHelperApi_FetchReportData2
	6 -> UtcWerHelperApi_ExtractReport
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-50e83a038203afe3bc
ncalrpc         : OLEFE3287CB2905D0734C098267C24F
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3216 at 0x53198d0L>
64
['iphlpsvc']

Interfaces :
RPC  552d076a-cb29-4e44-8b6a-d15e59e2c0af (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> IpTransitionProtocolApplyConfigChanges
	1 -> IpTransitionProtocolApplyConfigChangesEx
	2 -> IpTransitionCreatev6Inv4Tunnel
	3 -> IpTransitionDeletev6Inv4Tunnel
RPC  ecbdb051-f208-46b9-8c8b-648d9d3f3944 (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> RefreshTeredoState
	1 -> ResetDisabledComponentsForTeredo
RPC  1fff8faa-ec23-4e3f-a8ce-4b2f8707e636 (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> TeredoCreateConsumerHandle
	1 -> TeredoCloseConsumerHandle
RPC  2e6035b2-e8f1-41a7-a044-656b439c4c34 (1.0) -- C:\windows\system32\httpprxm.dll
	0 -> ProxyMgrProviderRegisterForEventNotification
	1 -> ProxyMgrProviderUnregisterEventNotification
	2 -> ProxyMgrProviderGetNotification
	3 -> ProxyMgrGetProxyEventInformation
	4 -> ProxyMgrSetProxyConfiguration
	5 -> ProxyMgrSetProxyCredentials
RPC  c36be077-e14b-4fe9-8abc-e856ef4f048b (1.0) -- C:\windows\system32\httpprxm.dll
	0 -> RpcSrvProxyMgrClientRegisterForEventNotification
	1 -> RpcSrvProxyMgrClientGetNotification
	2 -> RpcSrvProxyMgrClientUnregisterEventNotification
	3 -> RpcSrvProxyMgrClientGetProxyForUrl
	4 -> RpcSrvProxyMgrClientGetProxyCredentials
	5 -> RpcSrvProxyMgrClientGetAllProxiesForUrl
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
RPC  c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 (1.0) -- C:\windows\system32\adhsvc.dll
	0 -> Rpc_AdhEngineOpen
	1 -> Rpc_AdhEngineClose
	2 -> Rpc_AdhStatusEventSubscribe
	3 -> Rpc_AdhStatusEventSubscriptionGetLastEvent
	4 -> Rpc_AdhStatusEventUnsubscribe
	5 -> Rpc_AdhGetConfig
	6 -> Rpc_AdhGetEvidenceCollectorResult
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
Endpoints :
ncalrpc         : LRPC-3d9f14cbe3d5f73628
ncalrpc         : TeredoDiagnostics
ncalrpc         : TeredoControl
ncalrpc         : OLE3960B3F4B2DDB5FB88EAA7555C75
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3228 at 0x5319080L>
64
['DPS']

Interfaces :
RPC  98716d03-89ac-44c7-bb8c-285824e51c4a (1.0) -- c:\windows\system32\srvsvc.dll
	0 -> XsOpenPrinter
	1 -> XsClosePrinter
	2 -> XsAddJob
	3 -> XsScheduleJob
	4 -> XsProcessPnp
	5 -> XsProcDownLevelAPI
RPC  1a0d010f-1c33-432c-b0f5-8cf4e8053099 (1.0) -- c:\windows\system32\srvsvc.dll
	0 -> IdSegRequestNextSequence
	1 -> IdSegRequestNodeInvalidation
RPC  4b324fc8-1670-01d3-1278-5a47bf6ee188 (3.0) -- c:\windows\system32\srvsvc.dll
	0 -> NetrCharDevControl
	1 -> NetrCharDevControl
	2 -> NetrCharDevControl
	3 -> NetrCharDevControl
	4 -> NetrCharDevControl
	5 -> NetrCharDevControl
	6 -> NetrCharDevControl
	7 -> NetrCharDevControl
	8 -> NetrConnectionEnum
	9 -> NetrFileEnum
	10 -> NetrFileGetInfo
	11 -> NetrFileClose
	12 -> NetrSessionEnum
	13 -> NetrSessionDel
	14 -> NetrShareAdd
	15 -> NetrShareEnum
	16 -> NetrShareGetInfo
	17 -> NetrShareSetInfo
	18 -> NetrShareDel
	19 -> NetrShareDelSticky
	20 -> NetrShareCheck
	21 -> NetrServerGetInfo
	22 -> NetrServerSetInfo
	23 -> NetrServerDiskEnum
	24 -> NetrServerStatisticsGet
	25 -> NetrServerTransportAdd
	26 -> NetrServerTransportEnum
	27 -> NetrServerTransportDel
	28 -> NetrRemoteTOD
	29 -> I_NetrServerSetServiceBits
	30 -> NetprPathType
	31 -> NetprPathCanonicalize
	32 -> NetprPathCompare
	33 -> NetprNameValidate
	34 -> NetprNameCanonicalize
	35 -> NetprNameCompare
	36 -> NetrShareEnumSticky
	37 -> NetrShareDelStart
	38 -> NetrShareDelCommit
	39 -> NetrpGetFileSecurity
	40 -> NetrpSetFileSecurity
	41 -> NetrServerTransportAddEx
	42 -> I_NetrServerSetServiceBitsEx
	43 -> NetrDfsGetVersion
	44 -> NetrCharDevControl
	45 -> NetrCharDevControl
	46 -> NetrCharDevControl
	47 -> NetrCharDevControl
	48 -> NetrCharDevControl
	49 -> NetrCharDevControl
	50 -> NetrCharDevControl
	51 -> NetrCharDevControl
	52 -> NetrCharDevControl
	53 -> NetrServerTransportDelEx
	54 -> NetrServerAliasAdd
	55 -> NetrServerAliasEnum
	56 -> NetrServerAliasDel
	57 -> NetrShareDelEx
	58 -> LocalrSessionEnum
	59 -> LocalrSessionGetInfo
	60 -> LocalrSessionDel
	61 -> LocalrFileEnum
	62 -> LocalrFileGetInfo
	63 -> LocalrFileClose
	64 -> LocalrShareEnum
	65 -> LocalrShareGetInfo
	66 -> LocalrShareSetInfo
	67 -> LocalrShareAdd
	68 -> LocalrShareDelEx
	69 -> LocalrAliasGet
	70 -> NetrServerTransportAddForInstance
	71 -> NetrServerTransportDelForInstance
Endpoints :
ncalrpc         : LRPC-4f1d5488ca14ed3f91
ncacn_np        : \PIPE\srvsvc
--------------------------------------------------------------------------------
<WinProcess "WaAppAgent.exe" pid 3268 at 0x5319860L>
64
['RdAgent']

Interfaces :
RPC  300f3532-38cc-11d0-a3f0-0020af6b0add (1.2) -- c:\windows\system32\trkwks.dll
	0 -> Stubold_LnkMendLink
	1 -> StubGetFileTrackingInformation
	2 -> StubGetFileTrackingInformation
	3 -> StubLnkSetVolumeId
	4 -> StubGetFileTrackingInformation
	5 -> StubGetFileTrackingInformation
	6 -> StubGetFileTrackingInformation
	7 -> StubGetFileTrackingInformation
	8 -> StubLnkOnRestore
	9 -> StubLnkMendLink
	10 -> StubGetFileTrackingInformation
	11 -> StubGetFileTrackingInformation
	12 -> StubLnkSearchMachine
Endpoints :
ncacn_np        : \pipe\trkwks
ncalrpc         : trkwks
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3300 at 0x5319550L>
64
['W32Time']

Interfaces :
RPC  8fb6d884-2388-11d0-8c35-00c04fda2795 (4.1) -- c:\windows\system32\w32time.dll
	0 -> s_W32TimeSync
	1 -> s_W32TimeGetNetlogonServiceBits
	2 -> s_W32TimeQueryProviderStatus
	3 -> s_W32TimeQuerySource
	4 -> s_W32TimeQueryProviderConfiguration
	5 -> s_W32TimeQueryConfiguration
	6 -> s_W32TimeQueryStatus
	7 -> s_W32TimeLog
Endpoints :
ncalrpc         : W32TIME_ALT
ncacn_np        : \PIPE\W32TIME_ALT
--------------------------------------------------------------------------------
<WinProcess "MsMpEng.exe" pid 3328 at 0x53197b8L>
64
['WinDefend']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4008 at 0x53199b0L>
64
['wuauserv']

Interfaces :
RPC  30adc50c-5cbc-46ce-9a0e-91914789e23c (1.0) -- c:\windows\system32\nrpsrv.DLL
	0 -> RpcNrpGetAddrInfo
	1 -> RpcNrpGetNameInfo
Endpoints :
ncalrpc         : LRPC-f6938ea0eb3f3baa4e
--------------------------------------------------------------------------------
<WinProcess "NisSrv.exe" pid 5104 at 0x5319320L>
64
['WdNisSvc']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4488 at 0x5319be0L>
64
['pla']

Interfaces :
RPC  647d4452-9f33-4a18-b2be-c5c0e920e94e (1.0) -- c:\windows\system32\pla.dll
	0 -> PlaiSrvControl
	1 -> PlaiSrvQuerySession
	2 -> PlaiSrvGetStatus
	3 -> PlaiSrvRegisterCollectorSet
	4 -> PlaiSrvUpdateMetadata
	5 -> PlaiSrvSwitchToCompiling
	6 -> PlaiSrvCloseCollectorSet
Endpoints :
ncalrpc         : {F14A3514-198A-4DF9-88B3-EEA099B470F4}
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 5672 at 0x5319198L>
64
['SSDPSRV']

Interfaces :
RPC  4b112204-0e19-11d3-b42b-0000f81feb9f (1.0) -- c:\windows\system32\ssdpsrv.dll
	0 -> _SSDPOpenRpc
	1 -> _SSDPCloseRpc
	2 -> RegisterServiceExRpc
	3 -> _DeregisterServiceRpc
	4 -> CleanupCacheRpc
	5 -> BeginSearchRpc
	6 -> GetSearchNotificationRpc
	7 -> CancelSearchRpc
	8 -> CloseSearchRpc
	9 -> EnableNotificationRpc
	10 -> _InitializeSyncHandle
	11 -> _RemoveSyncHandle
	12 -> RegisterNotificationRpc
	13 -> RegisterNotificationAsyncRpc
	14 -> _GetNotificationRpc
	15 -> _WakeupGetNotificationRpc
	16 -> DeregisterNotificationRpc
	17 -> SetICSInterfaces
	18 -> SetICSOff
	19 -> EnableFirewallRuleRpc
	20 -> DisableFirewallRuleRpc
Endpoints :
ncalrpc         : LRPC-7739fe9ede05529e24
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 4128 at 0x5319438L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "winlogon.exe" pid 956 at 0x5319668L>
64

Interfaces :
RPC  76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\windows\system32\winlogon.exe
	0 -> I_WMsgkSendMessage
	1 -> I_WMsgkSendPSPMessage
RPC  76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\windows\system32\winlogon.exe
	0 -> I_WMsgSendMessage
	1 -> I_WMsgSendPSPMessage
	2 -> I_WMsgSendNotifyMessage
	3 -> I_WMsgSendReconnectionUpdateMessage
RPC  12e65dd8-887f-41ef-91bf-8d816c42c2e7 (1.0) -- C:\windows\system32\winlogon.exe
	0 -> WlSecureDesktoprPromptingRequest
	1 -> WlSecureDesktoprConfirmationRequest
	2 -> WlSecureDesktoprCredmanBackupRequest
	3 -> WlSecureDesktoprCredmanRestoreRequest
	4 -> WlSecureDesktoprSimulateSAS
Endpoints :
ncalrpc         : WMsgKRpc0920722
--------------------------------------------------------------------------------
<WinProcess "fontdrvhost.exe" pid 3992 at 0x5319e48L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "dwm.exe" pid 4176 at 0x5319b38L>
64

Interfaces :
RPC  169c453b-5955-4672-be44-21f61e9ef18f (1.0) -- c:\windows\system32\scdeviceenum.dll
	0 -> s_NgcCtnrEnumCreateNode
	1 -> s_NgcCtnrEnumDeleteNode
Endpoints :
ncalrpc         : LRPC-d51e953fcdc5765dda
--------------------------------------------------------------------------------
<WinProcess "rdpclip.exe" pid 820 at 0x53192e8L>
64

Interfaces :
RPC  10bd2718-13bd-4b84-8e7d-8b5c83770a86 (1.0) -- C:\windows\System32\rdpclip.exe
	0 -> RpcSetRenderHint
	1 -> RpcGetStartMenuRect
RPC  de79fc6c-dc6f-43c7-a48e-63bbc8d4009d (1.0) -- C:\windows\System32\rdpclip.exe
	0 -> UMRDP_SHChangeNotify
	1 -> UMRDP_WNetAddConnection2
	2 -> UMRDP_WNetCancelConnection2
	3 -> UMRDP_StorePrinterConfig
	4 -> UMRDP_StoreDefaultPrinter
	5 -> UMRDP_RestoreDefaultPrinter
	6 -> UMRDP_SetDefaultPrinter
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000135-0000-0000-c000-000000000046 (0.0) -- IInterfaceFromWindowProp
OLE  0000010e-0000-0000-c000-000000000046 (0.0) -- IDataObject
OLE  0000000c-0000-0000-c000-000000000046 (0.0) -- IStream
Endpoints :
ncalrpc         : HintApiRPCEntry#2
ncalrpc         : UMRdpEndpoint_2
ncalrpc         : OLED61FC11976D6B4EE1BE5E9B46B15
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1004 at 0x5319e10L>
64
['CDPUserSvc_9c09e']

Interfaces :
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
OLE  cb728b20-f786-11ce-92ad-00aa00a74cd0 (0.0) -- IProfferService
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
OLE  00000001-0000-0000-c000-000000000046 (0.0) -- IClassFactory
OLE  6d5140c1-7436-11ce-8034-00aa006009fa (0.0) -- IServiceProvider
OLE  e7fb793d-3581-4b54-a798-ab8e9d69c963 (0.0) -- IBackgroundActivationSessionManagerEvents
OLE  e12fe107-2d78-46a1-bca8-d93e4c2ab2bc (0.0) -- IPlmStateChangeNotifications
OLE  428d4ddd-3462-43df-9395-1eff13ae7a4b (0.0) -- IBackgroundAccessManagerService
OLE  fc99c60d-d59b-4b2b-b73d-3a1cc9f2aafa (0.0) -- ILifetimeManagerRemote
OLE  d7a5d1cc-fcbc-4e54-9deb-45ef67293cf8 (0.0) -- IHostIdStore
OLE  69c083b1-7f6f-490d-9d77-c0219a95b25d (0.0) -- IProcessLifetimeManagerControl
OLE  7656cfa4-b63a-4542-a8de-ef402bac895d (0.0) -- IUserApplicationStateChangeHandler
RPC  8ec21e98-b5ce-4916-a3d6-449fa428a007 (0.0) -- C:\Windows\System32\modernexecserver.dll
	0 -> FmMuxSrvRegisterCoreUIEndpoints
	1 -> FmMuxSrvGenerateTaskInstanceId
	2 -> FmMuxSrvLaunchTask
	3 -> FmMuxSrvResumeTask
	4 -> FmMuxSrvPauseTask
	5 -> FmMuxSrvCancelTask
	6 -> FmMuxSrvAbortTask
	7 -> FmMuxSrvGetTaskPid
	8 -> FmMuxSrvSetTaskDehydrationEligibility
	9 -> FmMuxSrvSetTaskProperty
	10 -> FmMuxSrvResolveApplicationUri
	11 -> FmMuxSrvGetActivationPolicy
	12 -> FmMuxSrvLogoffUser
	13 -> FmMuxSrvShutdown
	14 -> FmMuxSrvSetForegroundTaskInstanceId
	15 -> FmMuxSrvGenerateActivationInstanceId
	16 -> FmMuxSrvActivationPrerequisitePhase
	17 -> FmMuxSrvIsCBETask
	18 -> FmMuxSrvIsValidTaskPid
	19 -> FmMuxSrvResumePrerequisitePhase
	20 -> FmMuxSrvGetForegroundTaskInstanceId
	21 -> FmMuxSrvActivationBypass
	22 -> FmMuxSrvIsActivationDehydrated
	23 -> FmMuxSrvRequestResourceSet
RPC  0fc77b1a-95d8-4a2e-a0c0-cff54237462b (0.0) -- C:\Windows\System32\modernexecserver.dll
	0 -> FmMuxSrvRegisterFGNotificationCoreUIEndpoint
	1 -> FmMuxSrvUnRegisterFGNotificationCoreUIEndpoint
	2 -> FmMuxSrvGetForegroundProductId
	3 -> FmMuxSrvIsForegroundProductId
	4 -> FmMuxSrvGetProductIdFromProcessId
	5 -> FmMuxSrvGenerateWatsonReport
	6 -> FmMuxSrvGetProcessProductId
	7 -> FmMuxSrvDehydrateHost
	8 -> FmMuxSrvIsCallingProcessForeground
RPC  b1ef227e-dfa5-421e-82bb-67a6a129c496 (0.0) -- C:\Windows\System32\modernexecserver.dll
	0 -> FmMuxSrvIsActivationBeingDebugged
	1 -> FmMuxSrvIsForegroundActivation
	2 -> FmMuxSrvGetForegroundActivationInstanceId
	3 -> FmMuxSrvGetApplicationId
	4 -> FmMuxSrvGetPackageFamilyName
	5 -> FmMuxSrvGetPackageFullName
	6 -> FmMuxSrvGetPSMKey
	7 -> FmMuxSrvDehydrateApplication
	8 -> FmMuxSrvSetAutoDehydrateFlag
	9 -> FmMuxSrvGetAutoDehydrateFlag
	10 -> FmMuxSrvReloadSettings
OLE  eb9d0454-25db-5620-98b8-be4c5d0dbc67 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserChangedEventArgs]
OLE  9ec3d9d5-b413-51df-8c64-640e3356e351 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserAuthenticationStatusChangingEventArgs]
OLE  a478f456-5d69-41d4-8fd5-a414c516c781 (0.0) -- IUserPackageStateChangeHandler
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  5e75aba7-c424-4076-9d47-409a1eda087f (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIWindowStatics
OLE  882d9981-e3b3-4275-a857-00c3910fb5c3 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewStatics
OLE  c5230dad-4d49-4c07-aafa-7bafbbff72b0 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIWindowWatcher
OLE  3169ab14-dd32-4d2f-b943-0e53446f5085 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewWatcher
OLE  998d66a2-4a54-496c-9e18-268890860004 (0.0) -- IApplicationActivationManagerPriv
OLE  e7a5f14e-0650-44f2-9168-35cd1d04fe20 (0.0) -- IApplicationActivationPhonePriv
OLE  a5447aa8-063b-4ddc-8b81-021591a43bf1 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewChangedEventArgs
OLE  dac0a812-87a6-4f5a-8493-b80e07a89344 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewActivationRequestedEventArgs
OLE  5c19477e-81ef-4d21-baa4-c3040ad2ea6b (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewRequestEventArgs
OLE  add68ce2-bfd3-4208-a2c8-d48fb2e32c41 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppView
OLE  90ea19c8-8014-484d-a9f3-c1aecb25e39b (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppModel
OLE  43c44496-73a7-4b25-b876-1df2708e3e45 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIUniversalAppModel
OLE  ecc8094d-d468-4860-9d61-260400aa9829 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CISplashScreen
OLE  402af51f-a72c-45b8-8fe3-cff04ed914f1 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIUniversalTitleBar
OLE  05f3eb97-d7d7-4f49-919d-368bc0323fb4 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewBehaviorStatics
OLE  266d6f6f-822f-4304-b3b6-9dc7fec054a5 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewActivationRequestedEventArgsPreview
OLE  cdb5efb3-5788-509d-9be1-71ccb8a3362a (0.0) -- IAsyncOperation<boolean>
OLE  9345de75-e838-4721-9f20-7b09ac8be053 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewExecutionStateChangedEventArgs
OLE  57e9a04f-e685-491c-b433-f71b7b334bd3 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewUniversalPropertyChangedEventArgs
OLE  0f4accb1-d8f9-4011-ba37-2557925a78cf (0.0) -- IServiceHostBrokerProvider
OLE  d98fd14a-522a-4d59-b875-811e83919a9e (0.0) -- IApplicationActivationBroker
OLE  cd292360-2763-4085-8a9f-74b224a29175 (0.0) -- __x_Windows_CUI_CCore_CICoreWindowFactory
OLE  83140d1c-7e82-4cfb-96e4-f997cede7e10 (0.0) -- IUiaManagerWindowRegistration
OLE  6dc8c1be-86e5-4eef-8335-72cab53f06c8 (0.0) -- IUiaWindowRegistrationToken
OLE  317be656-a8be-48a0-95c9-cd02915bc9de (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIWindowChangedEventArgs
OLE  4f6719dc-762f-41da-b4e8-d3a037bca583 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIWindow
OLE  087ca5a4-8cfc-4264-b39d-da2bb2583a11 (0.0) -- ICoreWindowFactoryPriv
OLE  d928b176-b291-4bd6-9f6f-2e21e3ef6cbc (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIWindowBehaviorStatics
OLE  b6652262-46bb-521f-89f6-e890430bff3e (0.0) -- __FIReference_1_Windows__CInternal__CApplicationModel__CWindowManagement__CAppModelFrameworkKind
OLE  7fb024b8-0c52-44f0-aa7b-442557825557 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIUniversalBatch
OLE  a768d72d-edbd-4f38-b426-72f9f42ec757 (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewVisibilityChangedEventArgs
OLE  445289d9-2bba-4b3d-9f41-09683cc27200 (0.0) -- IBackgroundTaskCapabilityInternal
OLE  cf651713-cd08-4fd8-b697-a281b6544e2e (0.0) -- __x_Windows_CApplicationModel_CActivation_CIActivatedEventArgs
OLE  a2add09a-fb9b-4e6e-bc69-0b810eeb0ab4 (0.0) -- IBackgroundActivationContext
OLE  601d51e3-801e-49c9-bbfa-fe29a662aead (0.0) -- IConfigureWindowFactory
OLE  0e0da070-2224-4934-8090-041f7ff223eb (0.0) -- ISplashScreen
OLE  ca4d975c-d4d6-43f0-97c0-0833c6391c24 (0.0) -- __x_Windows_CApplicationModel_CActivation_CISplashScreen
OLE  0e8c8da1-11b5-4fad-975a-14f51015e07a (0.0) -- ISplashScreenPriv
OLE  fc4801a3-2ba9-11cf-a229-00aa003d7352 (0.0) -- IObjectWithSite
OLE  8690f4ac-60ec-4d4b-93b3-ab71fbbecf80 (0.0) -- IApplicationActivationImpl
OLE  98057f1b-132b-473d-ac4b-aee7ac87887a (0.0) -- __x_Windows_CInternal_CApplicationModel_CWindowManagement_CIAppViewPreview
OLE  1f79f7de-20bf-4591-930a-d490b78fb09f (0.0) -- __x_Windows_CInternal_COneCore_CViewEventHandlers_CICoreCUIBroker
OLE  62a9407f-345a-4300-8cdd-4847dee60f48 (0.0) -- IApplicationInstanceManager
OLE  2f3eca0f-a0a7-445b-8f88-f6260a7dac04 (0.0) -- IPlmDataQuery
OLE  36c8be08-bca4-4431-b5c0-b07bc0baf3c8 (0.0) -- IPlmPackageServicing
OLE  85a098aa-ef5a-451b-b332-c1b795431bc3 (0.0) -- IContractActivation
OLE  2931fe47-4c9a-4e70-8de4-b80394ff42c1 (0.0) -- __x_Windows_CApplicationModel_CContracts_CInternal_CIContractBrokerPartialTrustStatics
OLE  98fba1b6-2909-418d-9ecf-c21600fa7822 (0.0) -- __x_Windows_CApplicationModel_CContracts_CInternal_CIContractBrokerBaseTrustAccessibleServer
OLE  c218afae-7884-4151-873f-631e82388d0d (0.0) -- IContractBrokerGetStreamReadyEvent
OLE  4bb67095-515f-4e53-b6bb-ddeb70df3cc4 (0.0) -- IContractBrokerGetStream
OLE  9eb0164f-16c5-45a6-9d11-6ba6b20d9635 (0.0) -- __x_Windows_CSystem_CInternal_CLaunch_CILauncherQueryInfoStatics
OLE  8246ed12-33e8-52b3-a5c5-19779de9999e (0.0) -- __FIVectorView_1_Windows__CApplicationModel__CAppInfo
OLE  cf7f59b3-6a09-4de8-a6c0-5792d56880d1 (0.0) -- __x_Windows_CApplicationModel_CIAppInfo
OLE  fed95700-f716-4950-bcac-8e2e1ca1b307 (0.0) -- IClipboardProtectionServices
OLE  48f4e2d1-eeba-461e-8f8f-6353da1a3aca (0.0) -- IApplicationStateChangeOutOfProcNotificationService
OLE  ee046ed5-6eaf-4fba-bdf6-0965545fedb8 (0.0) -- IUiaManagerEndpointStateNotifierSinkRegistration
OLE  fcbc010e-a314-43e9-b40a-49690a0c8b78 (0.0) -- IUiaManagerEndpointStateNotifierSinkRegistrationToken
Endpoints :
ncalrpc         : OLE560FA880F9111C2398064EEE6CEA
ncalrpc         : LRPC-dfe947b7652251660a
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 5556 at 0x5319128L>
64
['WpnUserService_9c09e']

Interfaces :
RPC  cad784cb-4c1b-4d96-b8f7-4716b568b13c (1.0) -- C:\windows\system32\wininet.dll
	0 -> s_UrlCacheGetManagerInterface
	1 -> StaticProxyResolver::CancelAll
	2 -> s_UrlCacheOpenContainer
	3 -> s_UrlCacheCloseContainer
	4 -> s_UrlCacheSetContainerEntryMaximumAge
	5 -> s_UrlCacheAddUrl
	6 -> s_UrlCacheLookupUrl
	7 -> s_UrlCacheCheckUrlsExist
	8 -> s_UrlCacheGetUrlBinaryBlob
	9 -> s_UrlCacheAddUrlBinaryBlob
	10 -> s_UrlCacheDeleteUrl
	11 -> s_UrlCacheUnlockUrl
	12 -> s_UrlCacheUpdateUrl
	13 -> s_UrlCacheEntryEnum
	14 -> s_UrlCacheEntryEnumClose
	15 -> s_UrlCacheEntryEnumNext
	16 -> s_UrlCacheCleanupUrls
	17 -> s_UrlCacheCleanupHttpsUrls
	18 -> s_UrlCacheGetSize
	19 -> s_UrlCacheGetLimit
	20 -> s_UrlCacheSetLimit
	21 -> s_UrlCacheGetCrossContainerContentTotalSizeAndLimit
	22 -> s_UrlCacheCleanupCrossContainers
	23 -> s_UrlCacheGetBloomFilter
	24 -> s_UrlCacheReleaseBloomFilter
	25 -> s_UrlCacheGetNextDirectory
	26 -> s_UrlCacheAddLeakFile
	27 -> s_UrlCacheCreateGroup
	28 -> s_UrlCacheDeleteGroup
	29 -> s_UrlCacheGetGroupIds
	30 -> s_UrlCacheGetGroup
	31 -> s_UrlCacheUpdateGroup
	32 -> s_UrlCacheSetUrlGroup
	33 -> s_UrlCacheGetContentContainerDirectories
	34 -> s_UrlCacheCreateExtensibleContainer
	35 -> s_UrlCacheDeleteExtensibleContainer
	36 -> s_UrlCacheGetExtensibleContainersList
	37 -> s_UrlCacheRpcSetGlobalLimit
	38 -> s_UrlCacheRpcGetGlobalLimit
	39 -> s_UrlCacheRpcReloadSettings
	40 -> s_UrlCacheGetGlobalCounters
	41 -> s_AppCacheOpenContainer
	42 -> s_AppCacheCloseContainer
	43 -> s_AppCacheRpcCheckManifest
	44 -> s_AppCacheRpcLookup
	45 -> s_AppCacheRpcDeleteGroup
	46 -> s_AppCacheRpcDeleteIeGroup
	47 -> s_AppCacheRpcGetFallbackUrl
	48 -> s_AppCacheRpcGetDownloadList
	49 -> s_AppCacheRpcCloseHandle
	50 -> s_AppCacheRpcInvalidate
	51 -> s_AppCacheRpcGetInfo
	52 -> s_AppCacheRpcGetGroupsList
	53 -> s_AppCacheRpcFreeSpace
	54 -> s_AppCacheRpcGetIeGroupList
	55 -> s_AppCacheRpcFreeIeSpace
	56 -> s_AppCacheRpcRetrieveUrl
	57 -> s_AppCacheRpcCommitUrl
	58 -> s_AppCacheRpcUpdateExtraData
	59 -> s_AppCacheRpcFinalize
	60 -> s_DependencyStoreOpenContainer
	61 -> s_DependencyStoreCloseContainer
	62 -> s_DependencyStoreUpdateUrl
	63 -> s_DependencyStoreRetrieveUrl
	64 -> s_DependencyStoreDeleteContainer
	65 -> s_HstsOpenContainer
	66 -> s_HstsCloseContainer
	67 -> s_HstsGetHstsEntries
	68 -> s_HstsSetHstsEntries
	69 -> s_HstsPurgeContainer
	70 -> s_CookieOpenContainer
	71 -> s_CookieCloseContainer
	72 -> s_CookieGetCookies
	73 -> s_CookieGetAllCookies
	74 -> s_CookieUpdateCookies
	75 -> s_CookiePurgeContainer
	76 -> s_BlobOpenContainer
	77 -> s_BlobCloseContainer
	78 -> s_BlobGetEntries
	79 -> s_BlobGetEntry
	80 -> s_BlobSetEntry
	81 -> s_BlobDeleteEntry
	82 -> s_BlobPurgeContainer
RPC  9d420415-b8fb-4f4a-8c53-4502ead30ca9 (1.0) -- C:\windows\System32\PlaySndSrv.dll
	0 -> I_PlaySoundkPostMessage
Endpoints :
ncalrpc         : webcache_{031b98cf-4a69-4c31-ab42-fd9b3c199407}_S-1-5-21-4197069449-1782053943-1514089459-500
ncalrpc         : PlaySoundKRpc2
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 5776 at 0x5319e80L>
64
['TokenBroker']

Interfaces :
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  b07904dd-31f6-452c-a738-fa5a2fda337b (0.0) -- __x_Windows_CInternal_CStateRepository_CIUserStatics
OLE  bb7966ba-e363-4f5d-b1bf-901fabfb603b (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageStatics
OLE  5232f8ea-49c7-4840-bfbb-66e785689e88 (0.0) -- __x_Windows_CInternal_CStateRepository_CIUser
OLE  d239aef3-1f67-43ec-be5e-8fbc2cb72000 (0.0) -- __x_Windows_CInternal_CStateRepository_CITileViewStatics
OLE  78662bbb-1464-4279-b5ff-ffccb2bc6529 (0.0) -- __x_Windows_CInternal_CStateRepository_CIApplicationExtensionStatics
OLE  35215f68-9b34-5676-b602-3814bf0e57f6 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CPackage
OLE  ab19c2c5-9694-5644-a825-7976f20063b1 (0.0) -- __FIIterable_1_Windows__CInternal__CStateRepository__CPackage
OLE  e09b3138-ae27-5c5f-a744-0ddf9881cee6 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CApplicationExtension
OLE  7d4d0de5-3dc0-58c1-a31e-572e2eba5228 (0.0) -- __FIIterator_1_Windows__CInternal__CStateRepository__CPackage
OLE  81aba04c-0d4b-422d-b790-3de217afde4d (0.0) -- __x_Windows_CInternal_CStateRepository_CIApplicationExtension
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  8e69aa27-aa66-456a-8ca9-6ce89f1bf043 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackage
OLE  b17fc34b-d906-4cd1-ad70-c16d125d1686 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileUserNotificationChannelStatics
OLE  8a43ed9f-f4e6-4421-acf9-1dab2986820c (0.0) -- IPropertySet
OLE  1b0d3570-0877-5ec2-8a2c-3b9539506aca (0.0) -- IMap<HSTRING,IInspectable>
OLE  366a9874-5ea2-436a-828f-0145bd6cf463 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileUserNotificationChannel
OLE  fe39030f-8455-4bf4-af4a-a34c336e4c13 (0.0) -- __x_Windows_CInternal_CStateRepository_CISecondaryTileUserNotificationChannelStatics
OLE  b15abd7e-4d7e-49e4-9cda-d564220fef0c (0.0) -- __x_Windows_CInternal_CStateRepository_CIApplication
OLE  100e0fe5-f8e6-4211-b7ad-21085e53a12e (0.0) -- __x_Windows_CInternal_CStateRepository_CISecondaryTileUserNotificationChannel
OLE  f7e80409-27e5-4514-805f-a431c4ce3b96 (0.0) -- __x_Windows_CInternal_CStateRepository_CIMrtApplicationStatics
OLE  8afe010a-b611-484e-944d-5ea6e4a23569 (0.0) -- __x_Windows_CInternal_CStateRepository_CIMrtApplication
OLE  ede4711a-0c90-4d5b-acf3-58af696d9425 (0.0) -- __x_Windows_CInternal_CStateRepository_CIMrtPackageStatics
OLE  e15958e5-d7fd-435b-a075-0b959b6788d5 (0.0) -- __x_Windows_CInternal_CStateRepository_CIMrtPackage
OLE  d81e96f1-a89c-417e-9335-59531026309d (0.0) -- __x_Windows_CInternal_CStateRepository_CIApplicationStatics
OLE  4fe0a6ff-aa6b-4cb3-9241-dd477a7abb84 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageFamily
OLE  3f593a63-8c13-4aaf-b4c6-840d3dda9e89 (0.0) -- __x_Windows_CInternal_CStateRepository_CISecondaryTileUserStatics
OLE  a859fc78-67cd-447a-9e17-5d0e14176a71 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageUserStatics
OLE  306b5ee3-4a11-5d18-8d6a-c5a60b606905 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CPackageUser
OLE  05088a81-8af6-41e9-a3af-77321cc3c6ea (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageUser
OLE  02f69653-707a-4bce-a0ae-b6053e3b17cd (0.0) -- __x_Windows_CInternal_CStateRepository_CManagement_CIRepositoryManager
OLE  8645456f-d9a2-4b82-afec-58f0e8df0acf (0.0) -- __x_Windows_CInternal_CStateRepository_CIFileTypeAssociationStatics
OLE  89bc3f49-f8d9-5103-ba13-de497e609167 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CFileTypeAssociation
OLE  1bb373e7-f9b5-5c96-a392-cb957cb3ee66 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CApplication
OLE  9519f1d6-cf33-4920-8419-688881b44f79 (0.0) -- __x_Windows_CInternal_CStateRepository_CITileViewQueryFilter
OLE  5b80a794-e1ba-5917-9ed5-63e7cde8ee9a (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CTileView
OLE  db5abad9-b595-50ca-9ae4-28e796601256 (0.0) -- __FIIterable_1_Windows__CInternal__CStateRepository__CTileView
OLE  0d2a8ed4-fa32-5dfa-a177-3898968b4290 (0.0) -- __FIIterator_1_Windows__CInternal__CStateRepository__CTileView
OLE  314e4199-1c0b-40d1-b47e-163300700e4c (0.0) -- __x_Windows_CInternal_CStateRepository_CITileView
OLE  4cc8fe6a-5976-4ece-ac32-62e2a5497f46 (0.0) -- __x_Windows_CInternal_CStateRepository_CIFileTypeAssociation
OLE  0f2f217e-7957-4262-a74c-df03d9e9e9c1 (0.0) -- __x_Windows_CInternal_CStateRepository_CIProtocolStatics
OLE  63624def-cd42-5bcf-96e6-e27614e5d807 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CProtocol
OLE  fdd7e51e-d1cc-41d9-ae36-a5fac6fe5216 (0.0) -- __x_Windows_CInternal_CStateRepository_CIProtocol
OLE  dd4cd077-46ac-4e8f-9afb-f0055ae35b32 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageLocationStatics
OLE  86f5b0ee-9560-4d76-a06a-ca4c8bfe4426 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageFamilyStatics
OLE  a39a796c-2c0e-4530-bf70-d633ee369785 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageLocation
OLE  7fe36c7d-c0d2-4ed2-970c-95f671367f20 (0.0) -- __x_Windows_CInternal_CStateRepository_CIApplicationPropertyStatics
OLE  f7a88ec3-6f33-46bf-83b8-78aaf94ac396 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackagePolicyStatics
OLE  500f5564-558d-5886-ba4a-b41ffeb39322 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CPackagePolicy
OLE  7619d03f-b9b1-446c-aeb9-f126825fd333 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackagePolicy
OLE  76b8f79f-34a1-4d59-bfaa-1472aba872e5 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileUserStatics
OLE  6dd00567-b07e-59ee-ad82-d9d8ec4c2914 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CPrimaryTileUserDataChange
OLE  da069297-d440-588a-8550-8302e7e879b8 (0.0) -- __FIIterable_1_Windows__CInternal__CStateRepository__CPrimaryTileUserDataChange
OLE  15b2bc91-0a52-5ba5-8f3a-9302adfa28a6 (0.0) -- __FIIterator_1_Windows__CInternal__CStateRepository__CPrimaryTileUserDataChange
OLE  16462b61-3298-441c-af1b-1c0995748cf7 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileUserDataChange
OLE  c9e5352e-a07a-4e91-8309-46904e20888c (0.0) -- __x_Windows_CInternal_CStateRepository_CIDependencyGraphStatics
OLE  66d2ce49-2ebb-5cb4-8f27-ddbd019099a5 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CDependencyGraph
OLE  6a94ad8a-dd00-5816-a025-016d0ba262b6 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CSecondaryTileUserDataChange
OLE  d54e91cc-2033-5964-b69d-bd0f2459c396 (0.0) -- __FIIterable_1_Windows__CInternal__CStateRepository__CSecondaryTileUserDataChange
OLE  3c310f81-daa9-5425-baa9-7e7958c75b5f (0.0) -- __FIIterator_1_Windows__CInternal__CStateRepository__CSecondaryTileUserDataChange
OLE  cb3a2a28-41c0-4687-9ea6-c248191321de (0.0) -- __x_Windows_CInternal_CStateRepository_CITargetDeviceFamilyStatics
OLE  e5dbfeae-3a40-4926-920c-a1ad8882663e (0.0) -- __x_Windows_CInternal_CStateRepository_CITargetDeviceFamily
OLE  804eb537-d7e6-4945-bba0-e6137d421ae4 (0.0) -- __x_Windows_CInternal_CStateRepository_CIAppUriHandlerStatics
OLE  be14c746-e9c8-5ef4-8811-68272ca94e59 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CAppUriHandler
OLE  21f54ca7-3fe6-447a-a4dc-a9afc49c4999 (0.0) -- __x_Windows_CInternal_CStateRepository_CIAppUriHandler
OLE  2f2cd542-df5a-4f71-a46d-6d694f32fa97 (0.0) -- __x_Windows_CInternal_CStateRepository_CIXapStatics
OLE  04222ebf-3c08-5a6f-b227-d886a2b52873 (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CProtocolLauncherInfo
OLE  219c82b0-40f6-4f7e-a532-4373bb075ed7 (0.0) -- __x_Windows_CInternal_CStateRepository_CIProtocolLauncherInfo
OLE  01e6e15a-7659-4e66-8f82-223e1831afc8 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPackageFamilyPolicyStatics
OLE  96362321-f8c2-591f-b3ef-32979d06a8bb (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CPackageFamilyPolicy
OLE  d88678cf-e543-4953-b04d-bc5da7b90592 (0.0) -- __x_Windows_CInternal_CStateRepository_CISecondaryTileViewStatics
OLE  15f99879-aa48-571f-845d-144893440cfd (0.0) -- __FIVectorView_1_Windows__CInternal__CStateRepository__CFileTypeAssociationLauncherInfo
OLE  79f51b1c-f79f-4c22-8bc2-a5b3875f4a63 (0.0) -- __x_Windows_CInternal_CStateRepository_CIDependencyGraph
OLE  82122bea-b05d-4ca4-9607-7c215e0435f5 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileViewStatics
OLE  e9d7d323-3b8c-472f-bf0c-97b8da53abf6 (0.0) -- __x_Windows_CInternal_CStateRepository_CIPrimaryTileView
Endpoints :
ncalrpc         : OLEA2BB2B5D88474E7280BE090CB33D
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1416 at 0x5319ac8L>
64
['TabletInputService']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1840 at 0x5319710L>
64
['CDPSvc']

Texte modifié

Ouvrir un fichier

--------------------------------------------------------------------------------
<WinProcess "smss.exe" pid 520 at 0x5db0c50L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 776 at 0x5db0908L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "wininit.exe" pid 876 at 0x5db0e48L>
64

Interfaces :
RPC  76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\WINDOWS\system32\wininit.exe
	0 -> I_WMsgkSendMessage
	1 -> I_WMsgkSendPSPMessage
RPC  894de0c0-0d55-11d3-a322-00c04fa321a1 (1.0) -- C:\WINDOWS\system32\wininit.exe
	0 -> s_BaseInitiateShutdown
	1 -> s_BaseAbortShutdown
	2 -> s_BaseInitiateShutdownEx
RPC  d95afe70-a6d5-4259-822e-2c84da1ddb0d (1.0) -- C:\WINDOWS\system32\wininit.exe
	0 -> s_WsdrInitiateShutdown
	1 -> s_WsdrAbortShutdown
	2 -> s_WsdrCheckForHiberboot
RPC  76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\WINDOWS\system32\wininit.exe
	0 -> I_WMsgSendMessage
	1 -> I_WMsgSendPSPMessage
	2 -> I_WMsgSendNotifyMessage
	3 -> I_WMsgSendReconnectionUpdateMessage
Endpoints :
ncalrpc         : WMsgKRpc017ED30
ncacn_np        : \PIPE\InitShutdown
ncalrpc         : WindowsShutdown
ncacn_ip_tcp    : 1536
--------------------------------------------------------------------------------
<WinProcess "services.exe" pid 948 at 0x5db0f28L>
64

Interfaces :
RPC  367abb81-9844-35f1-ad32-98f038001003 (2.0) -- C:\WINDOWS\system32\services.exe
	0 -> RCloseServiceHandle
	1 -> RControlService
	2 -> RDeleteService
	3 -> RLockServiceDatabase
	4 -> RQueryServiceObjectSecurity
	5 -> RSetServiceObjectSecurity
	6 -> RQueryServiceStatus
	7 -> RSetServiceStatus
	8 -> RUnlockServiceDatabase
	9 -> RNotifyBootConfigStatus
	10 -> RI_ScSetServiceBitsW
	11 -> RChangeServiceConfigW
	12 -> RCreateServiceW
	13 -> REnumDependentServicesW
	14 -> REnumServicesStatusW
	15 -> ROpenSCManagerW
	16 -> ROpenServiceW
	17 -> RQueryServiceConfigW
	18 -> RQueryServiceLockStatusW
	19 -> RStartServiceW
	20 -> RGetServiceDisplayNameW
	21 -> RGetServiceKeyNameW
	22 -> CServiceRecord::GetStatusInternal
	23 -> RChangeServiceConfigA
	24 -> RCreateServiceA
	25 -> REnumDependentServicesA
	26 -> REnumServicesStatusA
	27 -> ROpenSCManagerA
	28 -> ROpenServiceA
	29 -> RQueryServiceConfigA
	30 -> RQueryServiceLockStatusA
	31 -> RStartServiceA
	32 -> RGetServiceDisplayNameA
	33 -> RGetServiceKeyNameA
	34 -> CServiceRecord::GetStatusInternal
	35 -> REnumServiceGroupW
	36 -> RChangeServiceConfig2A
	37 -> RChangeServiceConfig2W
	38 -> RQueryServiceConfig2A
	39 -> RQueryServiceConfig2W
	40 -> RQueryServiceStatusEx
	41 -> REnumServicesStatusExA
	42 -> REnumServicesStatusExW
	43 -> RI_ScBroadcastServiceControlMessage
	44 -> RCreateServiceWOW64A
	45 -> RCreateServiceWOW64W
	46 -> RI_ScQueryServiceTagInfo
	47 -> RNotifyServiceStatusChange
	48 -> RGetNotifyResults
	49 -> RCloseNotifyHandle
	50 -> RControlServiceExA
	51 -> RControlServiceExW
	52 -> RI_ScSendPnPMessage
	53 -> RI_ScValidatePnPService
	54 -> RI_ScOpenServiceStatusHandle
	55 -> RI_ScQueryServiceConfig
	56 -> RQueryServiceConfigEx
	57 -> RI_ScRegisterPreshutdownRestart
	58 -> RI_ScReparseServiceDatabase
	59 -> RQueryUserServiceName
	60 -> RCreateWowService
	61 -> RGetServiceRegistryStateKey
	62 -> RGetServiceDirectory
RPC  a2c45f7c-7d32-46ad-96f5-adafb486be74 (1.0) -- C:\WINDOWS\system32\services.exe
	0 -> RI_ScOpenServiceChannelHandle
	1 -> RI_ScSendResponseReceiveControls
	2 -> RI_ScCloseServiceChannelHandle
RPC  93149ca2-973b-11d1-8c39-00c04fb984f9 (0.0) -- C:\WINDOWS\SYSTEM32\scesrv.dll
	0 -> SceSvcRpcQueryInfo
	1 -> SceSvcRpcSetInfo
	2 -> SceRpcSetupUpdateObject
	3 -> SceRpcSetupMoveFile
	4 -> SceRpcGenerateTemplate
	5 -> SceRpcConfigureSystem
	6 -> SceRpcGetDatabaseInfo
	7 -> SceRpcGetObjectChildren
	8 -> SceRpcOpenDatabase
	9 -> SceRpcCloseDatabase
	10 -> SceRpcGetDatabaseDescription
	11 -> SceRpcGetDBTimeStamp
	12 -> SceRpcGetObjectSecurity
	13 -> SceRpcGetAnalysisSummary
	14 -> SceRpcAnalyzeSystem
	15 -> SceRpcUpdateDatabaseInfo
	16 -> SceRpcUpdateObjectInfo
	17 -> SceRpcStartTransaction
	18 -> SceRpcCommitTransaction
	19 -> SceRpcRollbackTransaction
	20 -> SceRpcGetServerProductType
	21 -> SceSvcRpcUpdateInfo
	22 -> SceRpcCopyObjects
	23 -> SceRpcSetupResetLocalPolicy
	24 -> SceRpcNotifySaveChangesInGP
	25 -> SceRpcControlNotificationQProcess
	26 -> SceRpcBrowseDatabaseTable
	27 -> SceRpcGetSystemSecurity
	28 -> SceRpcGetSystemSecurity
	29 -> SceRpcSetSystemSecurity
	30 -> SceRpcSetSystemSecurity
	31 -> SceRpcSetDatabaseSetting
	32 -> SceRpcGetDatabaseSetting
	33 -> SceRpcConfigureConvertedFileSecurityImmediately
Endpoints :
ncalrpc         : ntsvcs
ncacn_np        : \pipe\ntsvcs
ncacn_np        : \PIPE\scerpc
ncacn_ip_tcp    : 1543
--------------------------------------------------------------------------------
<WinProcess "LsaIso.exe" pid 968 at 0x5db0c88L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "lsass.exe" pid 980 at 0x5e18358L>
64
['KeyIso', 'SamSs', 'VaultSvc']

Interfaces :
RPC  12345778-1234-abcd-ef00-0123456789ab (0.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> LsarClose
	1 -> CredrRename
	2 -> LsarEnumeratePrivileges
	3 -> LsarQuerySecurityObject
	4 -> LsarSetSecurityObject
	5 -> LsaITestCall
	6 -> LsarOpenPolicyRPC
	7 -> LsarQueryInformationPolicy
	8 -> LsarSetInformationPolicy
	9 -> LsaITestCall
	10 -> LsarCreateAccount
	11 -> LsarEnumerateAccounts
	12 -> LsarCreateTrustedDomain
	13 -> LsarEnumerateTrustedDomains
	14 -> LsarLookupNames
	15 -> LsarLookupSids
	16 -> LsarCreateSecret
	17 -> LsarOpenAccount
	18 -> LsarEnumeratePrivilegesAccount
	19 -> LsarAddPrivilegesToAccount
	20 -> LsarRemovePrivilegesFromAccount
	21 -> LsarGetQuotasForAccount
	22 -> LsarSetQuotasForAccount
	23 -> LsarGetSystemAccessAccount
	24 -> LsarSetSystemAccessAccount
	25 -> LsarOpenTrustedDomain
	26 -> LsarQueryInfoTrustedDomain
	27 -> LsarSetInformationTrustedDomain
	28 -> LsarOpenSecret
	29 -> LsarSetSecret
	30 -> LsarQuerySecret
	31 -> LsarLookupPrivilegeValue
	32 -> LsarLookupPrivilegeName
	33 -> LsarLookupPrivilegeDisplayName
	34 -> LsarDeleteObject
	35 -> LsarEnumerateAccountsWithUserRight
	36 -> LsarEnumerateAccountRights
	37 -> LsarAddAccountRights
	38 -> LsarRemoveAccountRights
	39 -> LsarQueryTrustedDomainInfo
	40 -> LsarSetTrustedDomainInfo
	41 -> LsarDeleteTrustedDomain
	42 -> LsarStorePrivateData
	43 -> LsarRetrievePrivateData
	44 -> LsarOpenPolicy2
	45 -> LsarGetUserName
	46 -> LsarQueryInformationPolicy2
	47 -> LsarSetInformationPolicy2
	48 -> LsarQueryTrustedDomainInfoByName
	49 -> LsarSetTrustedDomainInfoByName
	50 -> LsarEnumerateTrustedDomainsEx
	51 -> LsarCreateTrustedDomainEx
	52 -> LsaITestCall
	53 -> LsarQueryDomainInformationPolicy
	54 -> LsarSetDomainInformationPolicy
	55 -> LsarOpenTrustedDomainByName
	56 -> LsaITestCall
	57 -> LsarLookupSids2
	58 -> LsarLookupNames2
	59 -> LsarCreateTrustedDomainEx2
	60 -> CredrWrite
	61 -> CredrRead
	62 -> CredrEnumerate
	63 -> CredrWriteDomainCredentials
	64 -> CredrReadDomainCredentials
	65 -> CredrDelete
	66 -> CredrGetTargetInfo
	67 -> CredrProfileLoaded
	68 -> LsarLookupNames3
	69 -> CredrGetSessionTypes
	70 -> LsarRegisterAuditEvent
	71 -> LsarGenAuditEvent
	72 -> LsarUnregisterAuditEvent
	73 -> LsarQueryForestTrustInformation
	74 -> LsarSetForestTrustInformation
	75 -> CredrRename
	76 -> LsarLookupSids3
	77 -> LsarLookupNames4
	78 -> LsarOpenPolicySce
	79 -> LsarAdtRegisterSecurityEventSource
	80 -> LsarAdtUnregisterSecurityEventSource
	81 -> LsarAdtReportSecurityEvent
	82 -> CredrFindBestCredential
	83 -> LsarSetAuditPolicy
	84 -> LsarQueryAuditPolicy
	85 -> LsarEnumerateAuditPolicy
	86 -> LsarEnumerateAuditCategories
	87 -> LsarEnumerateAuditSubCategories
	88 -> LsarLookupAuditCategoryName
	89 -> LsarLookupAuditSubCategoryName
	90 -> LsarSetAuditSecurity
	91 -> LsarQueryAuditSecurity
	92 -> CredrReadByTokenHandle
	93 -> CredrRestoreCredentials
	94 -> CredrBackupCredentials
	95 -> LsarManageSidNameMapping
	96 -> CredrProfileUnloaded
	97 -> CredrRename
	98 -> CredrRename
	99 -> CredrRename
	100 -> CredrRename
	101 -> CredrRename
	102 -> LsarEfsGetSmartcardCredentials
	103 -> LsarAuditSetGlobalSacl
	104 -> LsarAuditQueryGlobalSacl
	105 -> CredrProfileLoadedEx
	106 -> LsarInteractiveSessionIsLoggedOff
	107 -> LsarConfigureAutoLogonCredentials
	108 -> LsarGetDeviceRegistrationInfo
	109 -> LsaITestCall
	110 -> LsarProfileDeleted
	111 -> LsaITestCall
	112 -> LsarMakeLogonSessionsSiblings
	113 -> LsarValidateProcUniqueLuid
	114 -> LsarIsArsoAllowedByPolicy
	115 -> LsarIsArsoAllowedByConsent
	116 -> LsarEnableArsoConsent
	117 -> LsarDisableArsoConsent
	118 -> LsarIsArsoAllowedByPolicy
	119 -> LsarIsUserArsoEnabled
	120 -> LsarEnableUserArso
	121 -> LsarDisableUserArso
	122 -> LsarConfigureUserArso
	123 -> LsarGetInprocDispatchTable
	124 -> LsarSetSharedUserSession
	125 -> LsarClearSharedUserSession
RPC  ace1c026-8b3f-4711-8918-f345d17f5bff (1.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> S_RPC_LspUpdatePrivateData
	1 -> S_RPC_LspReadPrivateData
RPC  afc07e2e-311c-4435-808c-c483ffeec7c9 (1.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> LsarGetAvailableCAPIDs
	1 -> LsarSetCAPs
	2 -> LsarQueryCAPs
RPC  c0d930f0-b787-4124-99bc-21f0ecb642ce (0.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> LsarConnectLocalUser
	1 -> LsarDisconnectLocalUser
	2 -> LsarCreateConnectedUser
	3 -> LsarIsCurrentUserConnected
	4 -> LsarRenewCertificate
	5 -> LsarGetSSOAccountType
	6 -> LsarIsUserMSA
RPC  d25576e4-00d2-43f7-98f9-b4c0724158f9 (0.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> LsarEasMarkUserControlled
	1 -> LsarEasGetCallerPasswordComplexity
	2 -> LsarEasGetControlledUsersInfo
RPC  c681d488-d850-11d0-8c52-00c04fd90f7e (1.0) -- C:\WINDOWS\system32\efslsaext.dll
	0 -> EfsRpcOpenFileRaw_Downlevel
	1 -> EfsRpcReadFileRaw_Downlevel
	2 -> EfsRpcWriteFileRaw_Downlevel
	3 -> EfsRpcCloseRaw_Downlevel
	4 -> EfsRpcEncryptFileSrv_Downlevel
	5 -> EfsRpcDecryptFileSrv_Downlevel
	6 -> EfsRpcQueryUsersOnFile_Downlevel
	7 -> EfsRpcQueryRecoveryAgents_Downlevel
	8 -> EfsRpcRemoveUsersFromFile_Downlevel
	9 -> EfsRpcAddUsersToFile_Downlevel
	10 -> EfsRpcFileKeyInfoEx_Downlevel
	11 -> EfsRpcFileKeyInfoEx_Downlevel
	12 -> EfsRpcFileKeyInfo_Downlevel
	13 -> EfsRpcDuplicateEncryptionInfoFile_Downlevel
	14 -> EfsRpcFileKeyInfoEx_Downlevel
	15 -> EfsRpcAddUsersToFileEx_Downlevel
	16 -> EfsRpcFileKeyInfoEx_Downlevel
	17 -> EfsRpcFileKeyInfoEx_Downlevel
	18 -> EfsRpcFileKeyInfoEx_Downlevel
	19 -> EfsRpcFileKeyInfoEx_Downlevel
	20 -> EfsRpcFlushEfsCache_Downlevel
RPC  fb8a0729-2d04-4658-be93-27b4ad553fac (1.0) -- C:\WINDOWS\system32\lsass.exe
	0 -> LsaLookuprOpenPolicy2
	1 -> LsaLookuprClose
	2 -> LsaLookuprTranslateSids2
	3 -> LsaLookuprTranslateNames3
	4 -> LsaLookuprManageCache
	5 -> LsaLookuprGetDomainInfo
	6 -> LsaLookuprUserAccountType
RPC  4f32adc8-6052-4a04-8701-293ccf2096f0 (1.0) -- C:\WINDOWS\SYSTEM32\SspiSrv.dll
	0 -> SspirConnectRpc
	1 -> SspirDisconnectRpc
	2 -> SspirDisconnectRpc
	3 -> SspirCallRpc
	4 -> SspirAcquireCredentialsHandle
	5 -> SspirFreeCredentialsHandle
	6 -> SspirProcessSecurityContext
	7 -> SspirDeleteSecurityContext
	8 -> SspirSslQueryCredentialsAttributes
	9 -> SspirNegQueryContextAttributes
	10 -> SspirSslSetCredentialsAttributes
	11 -> SspirApplyControlToken
	12 -> SspirLogonUser
	13 -> SspirLookupAccountSid
	14 -> SspirGetUserName
	15 -> SspirGetInprocDispatchTable
RPC  11220835-5b26-4d94-ae86-c3e475a809de (1.0) -- C:\WINDOWS\system32\dpapisrv.dll
	0 -> s_SSCryptProtectData
	1 -> s_SSCryptUnprotectData
	2 -> s_SSCryptUpdateProtectedState
RPC  5cbe92cb-f4be-45c9-9fc9-33e73e557b20 (1.0) -- C:\WINDOWS\system32\dpapisrv.dll
	0 -> s_SSRecoverQueryStatus
	1 -> s_SSRecoverImportRecoveryKey
	2 -> s_SSRecoverPassword
RPC  7f1317a8-4dea-4fa2-a551-df5516ff8879 (1.0) -- C:\WINDOWS\system32\dpapisrv.dll
	0 -> s_LRpcSIDKeyProtect
	1 -> s_LRpcSIDKeyUnprotect
RPC  3919286a-b10c-11d0-9ba8-00c04fd92ef5 (0.0) -- C:\WINDOWS\system32\lsasrv.dll
	0 -> DsRolerGetPrimaryDomainInformation
RPC  12345778-1234-abcd-ef00-0123456789ac (1.0) -- C:\WINDOWS\SYSTEM32\samsrv.dll
	0 -> SamrConnect
	1 -> SamrCloseHandle
	2 -> SamrSetSecurityObject
	3 -> SamrQuerySecurityObject
	4 -> SamrShutdownSamServer
	5 -> SamrLookupDomainInSamServer
	6 -> SamrEnumerateDomainsInSamServer
	7 -> SamrOpenDomain
	8 -> SamrQueryInformationDomain
	9 -> SamrSetInformationDomain
	10 -> SamrCreateGroupInDomain
	11 -> SamrEnumerateGroupsInDomain
	12 -> SamrCreateUserInDomain
	13 -> SamrEnumerateUsersInDomain
	14 -> SamrCreateAliasInDomain
	15 -> SamrEnumerateAliasesInDomain
	16 -> SamrGetAliasMembership
	17 -> SamrLookupNamesInDomain
	18 -> SamrLookupIdsInDomain
	19 -> SamrOpenGroup
	20 -> SamrQueryInformationGroup
	21 -> SamrSetInformationGroup
	22 -> SamrAddMemberToGroup
	23 -> SamrDeleteGroup
	24 -> SamrRemoveMemberFromGroup
	25 -> SamrGetMembersInGroup
	26 -> SamrSetMemberAttributesOfGroup
	27 -> SamrOpenAlias
	28 -> SamrQueryInformationAlias
	29 -> SamrSetInformationAlias
	30 -> SamrDeleteAlias
	31 -> SamrAddMemberToAlias
	32 -> SamrRemoveMemberFromAlias
	33 -> SamrGetMembersInAlias
	34 -> SamrOpenUser
	35 -> SamrDeleteUser
	36 -> SamrQueryInformationUser
	37 -> SamrSetInformationUser
	38 -> SamrChangePasswordUser
	39 -> SamrGetGroupsForUser
	40 -> SamrQueryDisplayInformation
	41 -> SamrGetDisplayEnumerationIndex
	42 -> SamrTestPrivateFunctionsDomain
	43 -> SamrTestPrivateFunctionsUser
	44 -> SamrGetUserDomainPasswordInformation
	45 -> SamrRemoveMemberFromForeignDomain
	46 -> SamrQueryInformationDomain2
	47 -> SamrQueryInformationUser2
	48 -> SamrQueryDisplayInformation2
	49 -> SamrGetDisplayEnumerationIndex2
	50 -> SamrCreateUser2InDomain
	51 -> SamrQueryDisplayInformation3
	52 -> SamrAddMultipleMembersToAlias
	53 -> SamrRemoveMultipleMembersFromAlias
	54 -> SamrOemChangePasswordUser2
	55 -> SamrUnicodeChangePasswordUser2
	56 -> SamrGetDomainPasswordInformation
	57 -> SamrConnect2
	58 -> SamrSetInformationUser2
	59 -> SamrSetBootKeyInformation
	60 -> SamrGetBootKeyInformation
	61 -> SamrConnect3
	62 -> SamrConnect4
	63 -> SamrUnicodeChangePasswordUser3
	64 -> SamrConnect5
	65 -> SamrRidToSid
	66 -> SamrSetDSRMPassword
	67 -> SamrValidatePassword
	68 -> SamrQueryLocalizableAccountsInDomain
	69 -> SamrPerformGenericOperation
	70 -> SamrSyncDSRMPasswordFromAccount
	71 -> SamrLookupNamesInDomain2
	72 -> SamrEnumerateUsersInDomain2
RPC  b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 (2.0) -- C:\WINDOWS\system32\keyiso.dll
	0 -> s_SrvRpcCreateContext
	1 -> s_SrvRpcReleaseContext
	2 -> s_SrvRpcCryptOpenStorageProvider
	3 -> s_SrvRpcCryptIsAlgSupported
	4 -> s_SrvRpcCryptEnumAlgorithms
	5 -> s_SrvRpcCryptEnumKeys
	6 -> s_SrvRpcCryptFreeBuffer
	7 -> s_SrvRpcCryptFreeProvider
	8 -> s_SrvRpcCryptFreeKey
	9 -> s_SrvRpcCryptOpenKey
	10 -> s_SrvRpcCryptCreatePersistedKey
	11 -> s_SrvRpcCryptGetProviderProperty
	12 -> s_SrvRpcCryptSetProviderProperty
	13 -> s_SrvRpcCryptGetKeyProperty
	14 -> s_SrvRpcCryptSetKeyProperty
	15 -> s_SrvRpcCryptFinalizeKey
	16 -> s_SrvRpcCryptEncrypt
	17 -> s_SrvRpcCryptDecrypt
	18 -> s_SrvRpcCryptImportKey
	19 -> s_SrvRpcCryptExportKey
	20 -> s_SrvRpcCryptSignHash
	21 -> s_SrvRpcCryptVerifySignature
	22 -> s_SrvRpcCryptDeleteKey
	23 -> s_SrvRpcCryptNotifyChangeKey
	24 -> s_SrvRpcCryptSecretAgreement
	25 -> s_SrvRpcCryptDeriveKey
	26 -> s_SrvRpcCryptFreeSecret
	27 -> s_SrvRpcCryptCipherEncrypt
	28 -> s_SrvRpcCryptCipherDecrypt
	29 -> s_SrvRpcCryptKeyDerivation
	30 -> s_SrvRpcCryptCreateClaim
	31 -> s_SrvRpcCryptVerifyClaim
RPC  8fb74744-b2ff-4c00-be0d-9ef9a191fe1b (1.0) -- C:\WINDOWS\system32\keyiso.dll
	0 -> s_GetSymmetricPopKeyTransportKey
	1 -> s_GetSymmetricPopKeyTransportKeyName
	2 -> s_DeleteSymmetricPopKeyTransportKey
	3 -> s_ImportSymmetricPopKey
	4 -> s_SignWithSymmetricPopKey
	5 -> s_VerifyWithSymmetricPopKey
	6 -> s_DecryptWithSymmetricPopKey
	7 -> s_EncryptWithSymmetricPopKey
	8 -> s_GetKeyAttestationForContainerService
	9 -> s_RenewKeyAttestation
	10 -> s_GetPregenUserKey
	11 -> s_GetPregenKeyState
RPC  51a227ae-825b-41f2-b4a9-1ac9557a1018 (1.0) -- C:\WINDOWS\system32\keyiso.dll
	0 -> s_TokenBindingGenerateTpmKeyFromSoftware
RPC  bb8b98e8-84dd-45e7-9f34-c3fb6155eeed (1.0) -- C:\Windows\System32\vaultsvc.dll
	0 -> VltCreateItemType
	1 -> VltDeleteItemType
	2 -> VltEnumerateItemTypes
	3 -> VltAddItem
	4 -> VltFindItems
	5 -> VltEnumerateItems
	6 -> VltGetItem
	7 -> VltRemoveItem
	8 -> VltGetItemType
	9 -> VltOpenVault
	10 -> VltCloseVault
	11 -> VltGetInformation
	12 -> VltEnumerateVaults
	13 -> VltEnumerateSettingUnits
	14 -> VltGetSettingUnit
	15 -> VltApplySettingUnit
	16 -> VltRemoveSettingUnit
	17 -> VltTriggerSync
	18 -> VltGetSettingUnitInfo
Endpoints :
ncacn_np        : \pipe\lsass
ncalrpc         : audit
ncalrpc         : securityevent
ncalrpc         : LSARPC_ENDPOINT
ncalrpc         : lsacap
ncalrpc         : LSA_IDPEXT_ENDPOINT
ncalrpc         : LSA_EAS_ENDPOINT
ncalrpc         : lsapolicylookup
ncalrpc         : lsasspirpc
ncalrpc         : protected_storage
ncalrpc         : SidKey Local End Point
ncalrpc         : samss lpc
ncacn_ip_tcp    : 1635
ncalrpc         : Vault
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 672 at 0x5e18a90L>
64
['PlugPlay']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 748 at 0x5e18d68L>
64
['BrokerInfrastructure', 'DcomLaunch', 'Power', 'SystemEventsBroker']

Interfaces :
RPC  6c9b7b96-45a8-4cca-9eb3-e21ccf8b5a89 (1.1) -- c:\windows\system32\umpo.dll
	0 -> UmpoRpcGetPowerConfiguration
	1 -> UmpoRpcReadFromSystemPowerKey
	2 -> UmpoRpcReadFromUserPowerKey
	3 -> UmpoRpcReadACValue
	4 -> UmpoRpcReadDCValue
	5 -> UmpoRpcWriteToSystemPowerKey
	6 -> UmpoRpcWriteToUserPowerKey
	7 -> UmpoRpcApplyPowerRequestOverride
	8 -> UmpoRpcApplyPowerSetting
	9 -> UmpoRpcSetActiveScheme
	10 -> UmpoRpcGetActiveScheme
	11 -> UmpoRpcSetActiveOverlayScheme
	12 -> UmpoRpcGetActualOverlayScheme
	13 -> UmpoRpcGetEffectiveOverlayScheme
	14 -> UmpoRpcGetOverlaySchemes
	15 -> UmpoRpcRestoreDefaultScheme
	16 -> UmpoRpcRestoreDefaultSchemesAll
	17 -> UmpoRpcDuplicateScheme
	18 -> UmpoRpcDeleteScheme
	19 -> UmpoRpcImportScheme
	20 -> UmpoRpcReplaceDefaultPowerSchemes
	21 -> UmpoRpcLegacyEventRegisterNotification
	22 -> UmpoRpcEnumerate
	23 -> UmpoRpcReadSecurityDescriptor
	24 -> UmpoRpcWriteSecurityDescriptor
	25 -> UmpoRpcSettingAccessCheck
	26 -> UmpoRpcCreateSetting
	27 -> UmpoRpcCreatePossibleSetting
	28 -> UmpoRpcRemoveSetting
	29 -> UmpoSetExpectedUserAwayIntervals
	30 -> UmpoClearExpectedUserAwayIntervals
	31 -> UmpoGetMinUserAwayPredictionInterval
	32 -> UmpoRpcGetAdaptiveStandbyDiagnostics
RPC  9b8699ae-0e44-47b1-8e7f-86a461d7ecdc (0.0) -- c:\windows\system32\rpcss.dll
	0 -> _LaunchActivatorServer
	1 -> _LaunchRunAsServer
	2 -> _LaunchService
	3 -> LaunchWinRTActivatorServer
	4 -> _LaunchWinRTRunAsServer
	5 -> _LaunchWinRTService
	6 -> _CertifyServerIdentity
	7 -> _QueryNTService
	8 -> _QueryNTServiceType
	9 -> ControlNTService
	10 -> PrivRunAsSetWinstaDesktop
	11 -> PrivRunAsRelease
	12 -> PrivRunAsInvalidateAndRelease
	13 -> PrivTranslateShareName
	14 -> GenericMarshalingStreamWithContextAttributesViaCallback<<lambda_9644d90489056d7e1fb2e547ff4245ea> >::Clone
	15 -> IsPortOpen
	16 -> TickleActivationSettings
	17 -> QueryProcessArchitecture
	18 -> PrivilegedNotifyWinRTActivationStoreChanged
	19 -> _QueryUserSidForSession
	20 -> PrivActivatePsmServer
	21 -> _PrivGetUserTokenForSession
	22 -> PrivGetBrokerToken
	23 -> PrivGetDesktopWinRTBrokerToken
	24 -> PrivGetPsmToken
	25 -> GetSessionUserTokenCacheDetails
	26 -> PrivilegedNotifyComClassChangesFromDeployment
	27 -> PrivGetPsmTokenWithDynamicId
	28 -> PrivGetInteractiveUserToken
	29 -> PrivReportUnhealthyProcess
RPC  4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvActivateApplication
	1 -> PsmSrvCloseActivationChannel
	2 -> PsmSrvOpenActivationChannel
	3 -> PsmSrvRegisterProcess
RPC  085b0334-e454-4d91-9b8c-4134f9e793f3 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvInitializeExtension
	1 -> PsmSrvOpenManagementChannel
	2 -> PsmSrvSetApplicationState
	3 -> PsmSrvSetApplicationPriority
	4 -> PsmSrvReleaseCacheEntry
	5 -> PsmSrvAcquireCachedEntries
	6 -> PsmSrvQueryApplicationSwapState
	7 -> PsmSrvCloseActivationChannel
	8 -> PsmSrvSetApplicationProperties
	9 -> PsmSrvQueryApplicationProperties
	10 -> PsmSrvQueryApplicationResourceUsage
	11 -> PsmSrvQueryMemoryUsage
	12 -> PsmSrvResetMaxMemoryUsage
	13 -> PsmSrvQuerySharedCommit
RPC  8782d3b9-ebbd-4644-a3d8-e8725381919b (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvRegisterQuiesceResumeApp
	1 -> PsmSrvQuiesceCallbacksComplete
	2 -> PsmSrvCloseActivationChannel
RPC  3b338d89-6cfa-44b8-847e-531531bc9992 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvQueryApplicationPerformanceInformation
	1 -> PsmSrvQueryQuotaInformation
RPC  bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvOpenTcChannel
	1 -> PsmSrvApplyTaskCompletion
	2 -> PsmSrvRegisterDynamicProcess
	3 -> PsmSrvCloseActivationChannel
	4 -> PsmSrvGetSessionInfo
RPC  5824833b-3c1a-4ad2-bdfd-c31d19e23ed2 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvRegisterAppPriorityNotification
	1 -> PsmSrvQueryApplicationResourceUsageForTimer
	2 -> PsmSrvTimerStart
	3 -> PsmSrvTimerCleanup
	4 -> PsmSrvTimerRemainingResourceTimeGet
	5 -> PsmSrvTimerElapsedResourceTimeGet
RPC  0361ae94-0316-4c6c-8ad8-c594375800e2 (1.0) -- c:\windows\system32\psmsrv.dll
	0 -> PsmSrvQueryCurrentApplications
	1 -> PsmSrvQueryApplicationHosts
	2 -> PsmSrvQueryApplicationHostExecutionState
	3 -> PsmSrvQueryApplicationHostJob
	4 -> PsmSrvConnect
	5 -> PsmSrvDisconnect
	6 -> PsmSrvSubscribeToNotifications
	7 -> PsmSrvUnsubscribeFromNotifications
RPC  2d98a740-581d-41b9-aa0d-a88b9d5ce938 (1.0) -- c:\windows\system32\bisrv.dll
	0 -> RBiSrvActivateDeferredWorkItem
	1 -> RBiSrvActivateInBackground
	2 -> RBiSrvActivateWorkItem
	3 -> RBiSrvAssociateActivationProxy
	4 -> RBiSrvAssociateApplicationExtensionClass
	5 -> RBiSrvCancelWorkItem
	6 -> RBiSrvCreateEvent
	7 -> RBiSrvCreateEventForPackageName
	8 -> RBiSrvDeleteEvent
	9 -> RBiSrvDisassociateWorkItem
	10 -> RBiSrvDiscardPendingActivations
	11 -> RBiSrvEnumerateBrokeredEvents
	12 -> RBiSrvEnumerateUserContexts
	13 -> RBiSrvEnumerateUserSessions
	14 -> RBiSrvEnumerateWorkItemsForPackageName
	15 -> RBiSrvQueryBrokeredEvent
	16 -> RBiSrvQuerySystemStateBroadcastChannels
	17 -> RBiSrvQueryUserContext
	18 -> RBiSrvQueryUserSession
	19 -> RBiSrvQueryWorkItem
	20 -> RBiPtSrvQueryWorkItemStatusStateName
	21 -> RBiSrvSignalEvent
	22 -> RBiSrvSignalMultipleEvents
	23 -> RBiSrvSignalTriggerEvent
	24 -> RBiSrvUpdateEventParameters
	25 -> RBiSrvUpdateEventFlags
	26 -> RBiSrvUpdateEventInformation
RPC  8bfc3be1-6def-4e2d-af74-7c47cd0ade4a (1.0) -- c:\windows\system32\bisrv.dll
	0 -> RBiSrvActivateWorkItemForUser
	1 -> RBiSrvChangeApplicationStateForPackageNameForUser
	2 -> RBiSrvChangeApplicationStateForPsmKeyForUser
	3 -> RBiSrvChangeUserState
	4 -> RBiSrvEnumerateWorkItemsForPackageNameAndUser
	5 -> RBiSrvGetActiveBackgroundTasksEventForUser
	6 -> RBiSrvGetCancellationTimeoutInMs
	7 -> RBiSrvIsApplicationTerminateSensitiveForUser
	8 -> RBiSrvNotifyEndSession
	9 -> RBiSrvNotifyNewSession
	10 -> RBiSrvNotifyNewSessionComplete
	11 -> RBiSrvNotifyNewUser
	12 -> RBiSrvQueryWorkItemForUser
	13 -> RBiSrvResetActiveUserForPackage
	14 -> RBiSrvSetActiveUserForPackage
	15 -> RBiSrvTerminateApplicationHostForUser
	16 -> RBiSrvUpdateBackgroundAccessApplicationsForUser
RPC  1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 (1.0) -- c:\windows\system32\bisrv.dll
	0 -> RBiRtSrvAddWaitableEvent
	1 -> RBiRtSrvAssociateWorkItem
	2 -> RBiRtSrvCreateEvent
	3 -> RBiRtSrvCreateEventForApp
	4 -> RBiRtSrvCreateStatusStateName
	5 -> RBiRtSrvDeleteEvent
	6 -> RBiRtSrvDisassociateWorkItem
	7 -> RBiRtSrvEnumerateBrokeredEvents
	8 -> RBiRtSrvEnumerateWorkItems
	9 -> RBiRtSrvGetWorkItemProperties
	10 -> RBiRtSrvInitiatePause
	11 -> RBiRtSrvQueryBrokerEventId
	12 -> RBiRtSrvQueryBrokerEventIdFromWorkItem
	13 -> RBiRtSrvRegisterWorkItem
	14 -> RBiRtSrvSignalEvent
	15 -> RBiRtSrvUpdateEventParameters
RPC  c605f9fb-f0a3-4e2a-a073-73560f8d9e3e (1.0) -- c:\windows\system32\bisrv.dll
	0 -> RBiSrvSignalEvent
RPC  0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e (1.0) -- c:\windows\system32\bisrv.dll
	0 -> RBiPtSrvActivateDeferredWorkItem
	1 -> RBiPtSrvActivateInBackground
	2 -> RBiPtSrvActivateWorkItem
	3 -> RBiPtSrvAssociateActivationProxy
	4 -> RBiPtSrvAssociateApplicationEntryPoint
	5 -> RBiPtSrvCancelWorkItem
	6 -> RBiPtSrvCreateEvent
	7 -> RBiPtSrvCreateEventForApp
	8 -> RBiPtSrvCreateEventForPackageName
	9 -> RBiPtSrvDeleteEvent
	10 -> RBiPtSrvDisableWorkItem
	11 -> RBiPtSrvDisassociateWorkItem
	12 -> RBiPtSrvEnableWorkItem
	13 -> RBiPtSrvEnumerateBrokeredEvents
	14 -> RBiPtSrvEnumerateWorkItemsForPackageName
	15 -> RBiPtSrvQueryBrokeredEvent
	16 -> RBiPtSrvQueryBrokerEventId
	17 -> RBiPtSrvQuerySystemStateBroadcastChannels
	18 -> RBiPtSrvQueryWorkItem
	19 -> RBiPtSrvQueryWorkItemStatusStateName
	20 -> RBiPtSrvSignalEvent
	21 -> RBiPtSrvSignalMultipleEvents
	22 -> RBiPtSrvSignalTriggerEvent
RPC  55e6b932-1979-45d6-90c5-7f6270724112 (1.0) -- C:\WINDOWS\SYSTEM32\resourcepolicyserver.dll
	0 -> Srv_GetResourcePolicyKey
	1 -> Srv_GetResourcePolicyInformation
	2 -> Srv_CreateResourcePolicy
	3 -> Srv_GetResourcePolicyName
	4 -> Srv_CreatePolicyEngineClientContext
	5 -> Srv_ClosePolicyEngineClientContext
	6 -> Srv_AcquireResources
	7 -> Srv_ResSet_Apply
	8 -> Srv_ResSet_ReleaseResources
	9 -> Srv_ResSet_SetProperty
	10 -> Srv_ResSet_GetProperty
	11 -> Srv_ResSet_SetExternalPriorities
	12 -> Srv_ResSet_NotifyPendingTransition
	13 -> Srv_ResSet_CreateTerminalResourceSet
	14 -> Srv_ResSet_UpdateImportanceAndResourceLimits
	15 -> Srv_RegisterForPackageEnergyStateChangeNotifications
	16 -> Srv_IsPackageInGoodEnergyState
	17 -> Srv_ResourcePolicy_SetProcessAffinityMask
	18 -> Srv_ResourcePolicy_RevertProcessAffinityMask
	19 -> Srv_ResourcePolicy_GetProcessGroupCount
	20 -> Srv_ResourcePolicy_GetProcessAffinityMask
	21 -> Srv_ResourcePolicy_SetGlobalProcessAffinityMask
	22 -> Srv_ResourcePolicy_GetGlobalGroupCount
	23 -> Srv_ResourcePolicy_GetGlobalProcessAffinityMask
	24 -> Srv_QueryPackageInterruptiveUIState
	25 -> Srv_QueryApplicationInterruptiveUIState
	26 -> Srv_QueryApplicationInterruptiveUIStateByPsmKey
	27 -> Srv_InterruptiveUIStateChanged_Subscribe
	28 -> Srv_InterruptiveUIStateChanged_Unsubscribe
RPC  76c217bc-c8b4-4201-a745-373ad9032b1a (1.0) -- C:\WINDOWS\SYSTEM32\resourcepolicyserver.dll
	0 -> Srv_QueryApplicationEnergyUsage
	1 -> Srv_GetDeviceSpecificConversionFactor
	2 -> Srv_ResetTotalEnergyUsage
RPC  88abcbc3-34ea-76ae-8215-767520655a23 (0.0) -- C:\WINDOWS\SYSTEM32\resourcepolicyserver.dll
	0 -> GcsSrv_GetGameConfigSize
	1 -> GcsSrv_GetGameConfig
	2 -> GcsSrv_GetGameConfigSizeForClientProcess
	3 -> GcsSrv_GetGameConfigForClientProcess
	4 -> GcsSrv_ModifyGameConfig
	5 -> GcsSrv_AddGameConfig
	6 -> GcsSrv_RemoveGameConfig
	7 -> GcsSrv_GetGameIdByAUMID
	8 -> GcsSrv_GetGameIdByPID
	9 -> GcsSrv_GetGameIdCount
	10 -> GcsSrv_GetAllGameIds
	11 -> GcsSrv_GetGameIdsByExeNameCount
	12 -> GcsSrv_GetGameIdsByExeName
	13 -> GcsSrv_GetGameProperty
	14 -> GcsSrv_GetGamePropertySize
	15 -> GcsSrv_SetGameProperty
	16 -> GcsSrv_GetGlobalProperty
	17 -> GcsSrv_GetGlobalPropertySize
	18 -> GcsSrv_SetGlobalProperty
	19 -> GcsSrv_SetGamePropertyUserOverride
	20 -> GcsSrv_GetGamePropertyIsUserOverride
RPC  2c7fd9ce-e706-4b40-b412-953107ef9bb0 (0.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> RmgrSrv_RegisterWithServer
	1 -> RmgrSrv_RmSetMemoryUsageLimit
	2 -> RmgrSrv_RmRegisterResource
	3 -> RmgrSrv_RmAccessCheck
	4 -> RmgrSrv_RmAccessCheckOnCaller
	5 -> RmgrSrv_RmAvailabilityCheck
	6 -> RmgrSrv_RmAcquireResources
	7 -> RmgrSrv_RmGetNotification
	8 -> RmgrSrv_RmReleaseResources
RPC  c521facf-09a9-42c5-b155-72388595cbf0 (0.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> RmtSrv_RM_ConnectToServer
	1 -> RmtSrv_RM_DisconnectFromServer
	2 -> RmtSrv_RM_AcquireResourceSet
	3 -> RmtSrv_RS_Apply
	4 -> RmtSrv_RS_ReleaseResources
	5 -> RmtSrv_RS_CreateTerminalResourceSet
	6 -> RmtSrv_RS_SetExternalResourcePriorities
	7 -> RmtSrv_RS_SetAutoRelease
RPC  1832bcf6-cab8-41d4-85d2-c9410764f75a (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> RmCoreRpcSrvConnectToRmServer
	1 -> RmCoreRpcSrvDisconnectFromRmServer
	2 -> RmCoreRpcSrvRegisterActivityHostCallbacks
	3 -> RmCoreRpcSrvUnregisterActivityHostCallbacks
	4 -> RmCoreRpcSrvAcquireResourceSet
	5 -> RmCoreRpcSrvApplyResourceSet
	6 -> RmCoreRpcSrvReleaseResourceSet
	7 -> RmCoreRpcSrvSetHostLimits
	8 -> RmCoreRpcSrvQueryHostMemoryLimitValues
RPC  4dace966-a243-4450-ae3f-9b7bcb5315b8 (2.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> RmGameModeSrvRegisterProcess
	1 -> RmGameModeSrvUnregisterProcess
	2 -> RmGameModeSrvDisableForRegisteredProcess
	3 -> RmGameModeSrvReenableForRegisteredProcess
	4 -> RmGameModeSrvGetLargestValidResourceRequest
	5 -> RmGameModeSrvRegisterPairedAuxiliaryProcess
RPC  e53d94ca-7464-4839-b044-09a2fb8b3ae5 (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnect
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvCreateActivity
	3 -> HamRpcSrvCreateActivityForProcess
	4 -> HamRpcSrvStartActivityAsync
	5 -> HamRpcSrvStopActivity
	6 -> HamRpcSrvUpdateActivityProperties
	7 -> HamRpcSrvTerminateActivityHost
	8 -> HamRpcSrvSetExternalResourcePriority
	9 -> HamRpcSrvResetExternalResourcePriority
	10 -> HamRpcSrvCloseActivity
	11 -> HamRpcSrvIsHostBeingDebugged
	12 -> HamRpcSrvTerminateHostOnProcessExit
	13 -> HamRpcSrvGetApplicationInterruptiveUIState
	14 -> HamRpcSrvGetPackageInterruptiveUIState
	15 -> HamRpcSrvGetInterruptiveUIStateForAumid
RPC  082a3471-31b6-422a-b931-a54401960c62 (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectExtendedExecution
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvIsHostHamManaged
	3 -> HamRpcSrvQueryTaskCompletionsForTerminateGraph
	4 -> HamRpcSrvCreateExtendedExecution
	5 -> HamRpcSrvStartExtendedExecutionAsync
	6 -> HamRpcSrvCloseActivity
	7 -> HamRpcSrvAddDependency
	8 -> HamRpcSrvRemoveDependency
	9 -> HamRpcSrvAddHostDependency
	10 -> HamRpcSrvRemoveHostDependency
	11 -> HamRpcSrvTerminateSelf
	12 -> HamRpcSrvTryEstimateRemainingQuiesceTime
RPC  4ed8abcc-f1e2-438b-981f-bb0e8abc010c (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectStateChangeNotifications
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvGetApplicationStateForPsmKey
	3 -> HamRpcSrvTerminateIfSuspendedByProcess
RPC  95406f0b-b239-4318-91bb-cea3a46ff0dc (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectServicing
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvDebugOpenPackageHandle
	3 -> HamRpcSrvDebugClosePackageHandle
	4 -> HamRpcSrvServicingQueryActiveAppsInPackage
	5 -> HamRpcSrvServicingEnableServicing
	6 -> HamRpcSrvDebugTerminatePackage
RPC  fae436b0-b864-4a87-9eda-298547cd82f2 (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectDebugging
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvDebugOpenPackageHandle
	3 -> HamRpcSrvDebugClosePackageHandle
	4 -> HamRpcSrvDebugModeEnable
	5 -> HamRpcSrvDebugTerminatePackage
	6 -> HamRpcSrvDebugQueryPackageState
	7 -> HamRpcSrvDebugSuspendPackage
RPC  178d84be-9291-4994-82c6-3f909aca5a03 (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> RmGameModeRSrvRegisterProcess
	1 -> RmGameModeRSrvUnregisterProcess
	2 -> RmGameModeRSrvDisableForRegisteredProcess
	3 -> RmGameModeRSrvReenableForRegisteredProcess
	4 -> RmGameModeRSrvRegisterPairedAuxiliaryProcess
RPC  0d47017b-b33b-46ad-9e18-fe96456c5078 (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> HamRpcSrvConnectSessionState
	1 -> HamRpcSrvDisconnect
	2 -> HamRpcSrvSessionStateLogoffUser
	3 -> HamRpcSrvSessionStateLogoffSession
RPC  dd59071b-3215-4c59-8481-972edadc0f6a (1.0) -- C:\WINDOWS\SYSTEM32\psmserviceexthost.dll
	0 -> CrmRpcSrvSubscribe
	1 -> CrmRpcSrvUnsubscribe
	2 -> CrmRpcSrvWorkStart
	3 -> CrmRpcSrvWorkStop
RPC  2513bcbe-6cd4-4348-855e-7efb3c336dd3 (1.0) -- c:\windows\system32\bisrv.dll
	0 -> SrvOdbCreateSession
	1 -> SrvOdbCompleteSession
	2 -> SrvOdbLaunchBackgroundTask
	3 -> SrvOdbCancelBackgroundTask
	4 -> SrvOdbCancelBackgroundTasksForPackage
RPC  20c40295-8dba-48e6-aebf-3e78ef3bb144 (1.0) -- c:\windows\system32\bisrv.dll
	0 -> SrvOdbPtCreateSession
	1 -> SrvOdbPtCompleteSession
	2 -> SrvOdbPtLaunchBackgroundTask
	3 -> SrvOdbPtCancelBackgroundTask
	4 -> SrvOdbPtCancelBackgroundTasksForPackage
RPC  b8cadbaf-e84b-46b9-84f2-6f71c03f9e55 (1.0) -- c:\windows\system32\bisrv.dll
	0 -> SrvOdbLbPublishLegacyExitCode
RPC  857fb1be-084f-4fb5-b59c-4b2c4be5f0cf (1.0) -- c:\windows\system32\bisrv.dll
	0 -> SrvOdbPrivGetLaunchInfo
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
RPC  d09bdeb5-6171-4a34-bfe2-06fa82652568 (1.0) -- c:\windows\system32\BrokerLib.dll
	0 -> _BriCreateEvent
	1 -> _BriDeleteEvent
	2 -> BriDisableEvent
	3 -> BriEnableEvent
	4 -> BriSignalEvent
RPC  9b008953-f195-4bf9-bde0-4471971e58ed (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> SebiEnumerateEvents
	1 -> _SebiEnumerateEventsByType
	2 -> SebiQueryEventData
	3 -> SebiQueryEventPackage
	4 -> SebiSignalSyncEventEx
	5 -> SebiGetUserPresenceHistory
RPC  697dcda9-3ba9-4eb2-9247-e11f1901b0d2 (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> CSebiCreateWellKnownEvent
	1 -> _CSebiCreatePrivateEvent
	2 -> _CSebiDeleteEvent
	3 -> CSebiEnumerateEvents
	4 -> CSebiQueryEventData
	5 -> CSebiCreateCustomEvent
RPC  1377d115-98fd-4034-b574-111156ca239c (1.0) -- c:\windows\system32\systemeventsbrokerserver.dll
	0 -> _CSebiRegisterPublisher
	1 -> CSebiPublisherUpdateLevelEvent
	2 -> CSebiUnregisterPublisher
RPC  7419cf08-91a7-4afd-8f5e-1dd76de094fd (1.0) -- c:\windows\system32\DAB.dll
	0 -> s_DabRpcRegisterTriggerConsumer
	1 -> s_DabRpcUnregisterTriggerConsumer
	2 -> s_DabRpcGetLastScheduledRunTime
RPC  fc48cd89-98d6-4628-9839-86f7a3e4161a (1.0) -- C:\Windows\System32\ACPBackgroundManagerPolicy.dll
	0 -> MVoipSrvNotifyVoipActiveCall
	1 -> MVoipSrvNotifyVoipActivityCompleted
	2 -> MVoipSrvHoldActiveCall
	3 -> MVoipSrvUnholdActiveCall
	4 -> MVoipSrvNotifyIncomingCallDialogDisplayed
	5 -> MVoipSrvNotifyIncomingCallDialogDismissed
	6 -> MVoipSrvLaunchVoipRtcTask
	7 -> MVoipSrvCancelVoipRtcTask
OLE  7656cfa4-b63a-4542-a8de-ef402bac895d (0.0) -- IUserApplicationStateChangeHandler
OLE  43c6b434-c1be-4ad2-af03-c0deaccebd1f (0.0) -- IBackgroundAccessStateChangeHandler
OLE  eb9d0454-25db-5620-98b8-be4c5d0dbc67 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserChangedEventArgs]
OLE  0166231b-fd21-4e33-a713-75eb3207a138 (0.0) -- IBackgroundWorkItemInstanceRemote
OLE  839d7762-5121-4009-9234-4f0d19394f04 (0.0) -- ITaskHandler
Endpoints :
ncalrpc         : umpo
ncalrpc         : actkernel
ncalrpc         : LRPC-a0c225312c664cbe52
ncalrpc         : LRPC-9117321b1f3e68b3ea
ncalrpc         : LRPC-c415227320dbc2b224
ncalrpc         : OLE725BEDE187C9611C6F16D2B71ED3
ncalrpc         : LRPC-ad9f8eadd07cbdf162
ncalrpc         : LRPC-77924dd5092f1575c4
ncalrpc         : LRPC-c3073d1124937de4cc
ncalrpc         : csebpub
ncalrpc         : dabrpc
--------------------------------------------------------------------------------
<WinProcess "WUDFHost.exe" pid 744 at 0x5e18828L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1120 at 0x5e18438L>
64
['RpcEptMapper', 'RpcSs']

Interfaces :
RPC  e1af8308-5d1f-11c9-91a4-08002b14a0fa (3.0) -- c:\windows\system32\rpcepmap.dll
	0 -> ept_delete
	1 -> ept_delete
	2 -> ept_lookup
	3 -> ept_map
	4 -> ept_lookup_handle_free
	5 -> ept_delete
	6 -> ept_delete
	7 -> ept_map_auth
	8 -> ept_map_auth_async
RPC  0b0a6584-9e0f-11cf-a3cf-00805f68cb1b (1.1) -- c:\windows\system32\rpcepmap.dll
	0 -> OpenEndpointMapper
	1 -> AllocateReservedIPPort
	2 -> ept_insert_ex
	3 -> ept_delete_ex
	4 -> SetRestrictRemoteClients
	5 -> ResetWithNoAuthException
RPC  1d55b526-c137-46c5-ab79-638f2a68e869 (1.0) -- c:\windows\system32\rpcepmap.dll
	0 -> RemoteGetCellByDebugCellID
	1 -> RemoteOpenRPCDebugCallInfoEnumeration
	2 -> RemoteGetNextRPCDebugCallInfo
	3 -> RemoteFinishRPCDebugCallInfoEnumeration
	4 -> RemoteOpenRPCDebugEndpointInfoEnumeration
	5 -> RemoteGetNextRPCDebugEndpointInfo
	6 -> RemoteFinishRPCDebugEndpointInfoEnumeration
	7 -> RemoteOpenRPCDebugThreadInfoEnumeration
	8 -> RemoteGetNextRPCDebugThreadInfo
	9 -> RemoteFinishRPCDebugThreadInfoEnumeration
	10 -> RemoteOpenRPCDebugClientCallInfoEnumeration
	11 -> RemoteGetNextRPCDebugClientCallInfo
	12 -> RemoteFinishRPCDebugClientCallInfoEnumeration
RPC  64fe0b7f-9ef5-4553-a7db-9a1975777554 (1.0) -- c:\windows\system32\RpcRtRemote.dll
	0 -> FwConnectToManager
	1 -> FwSubscribeForNewRulesNotification
	2 -> FwInterfaceRegistered
RPC  e60c73e6-88f9-11cf-9af1-0020af6e72f4 (2.0) -- c:\windows\system32\rpcss.dll
	0 -> _Connect
	1 -> _SetAppID
	2 -> GetDefaultSecurityPermissions
	3 -> _AllocateReservedIds
	4 -> BulkUpdateOIDs
	5 -> _ClientResolveOXID
	6 -> _ServerAllocateOXIDAndOIDs
	7 -> _ServerAllocateOIDs
	8 -> ServerFreeOXIDAndOIDs
	9 -> _SetServerOIDFlags
	10 -> _Disconnect
RPC  99fcfec4-5260-101b-bbcb-00aa0021347a (0.0) -- c:\windows\system32\rpcss.dll
	0 -> ResolveOxid
	1 -> SimplePing
	2 -> ComplexPing
	3 -> ServerAlive
	4 -> ResolveOxid2
	5 -> ServerAlive2
RPC  b9e79e60-3d52-11ce-aaa1-00006901293f (0.2) -- c:\windows\system32\rpcss.dll
	0 -> IrotRegister
	1 -> IrotRevoke
	2 -> IrotIsRunning
	3 -> IrotGetObject
	4 -> IrotNoteChangeTime
	5 -> IrotGetTimeOfLastChange
	6 -> IrotEnumRunning
	7 -> IMgotRegister
	8 -> IMgotRevoke
	9 -> IMgotGetObject
	10 -> IMgotEnumRunning
RPC  412f241e-c12a-11ce-abff-0020af6e7a17 (0.2) -- c:\windows\system32\rpcss.dll
	0 -> ServerRegisterClsid
	1 -> ServerRevokeClsid
	2 -> ServerRegisterActivatableClasses
	3 -> ServerRevokeActivatableClasses
	4 -> GetThreadID
	5 -> UpdateActivationSettings
	6 -> RegisterWindowPropInterface
	7 -> GetWindowPropInterface
	8 -> EnableDisableDynamicIPTracking
	9 -> GetCurrentAddrExclusionList
	10 -> SetAddrExclusionList
	11 -> FlushSCMBindings
	12 -> RetireServer
	13 -> NotifyDDStartOrStop
	14 -> QueryDragDropActive
	15 -> SetOrRevokeForcedDropTarget
	16 -> IsObjectCreationAllowed
	17 -> ControlTracingForProcess
	18 -> QueryPIDForActivation
	19 -> NotifyWinRTActivationStoreChanged
	20 -> DecodeProxy
	21 -> NotifyPsmResume
	22 -> QueryServerProcessHandleHeld
	23 -> RegisterRacActivationToken
	24 -> RevokeRacActivationToken
	25 -> RegisterConsoleHandles
	26 -> RevokeConsoleHandles
	27 -> NotifyComClassChangesFromDeployment
DCOM 00000136-0000-0000-c000-000000000046 (0.0) -- ISCMLocalActivator
RPC  c6f3ee72-ce7e-11d1-b71e-00c04fc3111a (1.0) -- c:\windows\system32\rpcss.dll
	0 -> ProcessActivatorStarted
	1 -> ProcessActivatorInitializing
	2 -> ProcessActivatorReady
	3 -> ProcessActivatorStopped
	4 -> ProcessActivatorPaused
	5 -> ProcessActivatorResumed
	6 -> ProcessActivatorUserInitializing
RPC  4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 (0.0) -- c:\windows\system32\rpcss.dll
	0 -> RemoteActivation
DCOM 000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
Endpoints :
ncalrpc         : epmapper
ncacn_ip_tcp    : 135
ncacn_np        : \pipe\epmapper
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1164 at 0x5e18748L>
64
['LSM']

Interfaces :
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
RPC  11f25515-c879-400a-989e-b074d5f092fe (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcGetUserToken
	1 -> RpcConnectTerminal
	2 -> RpcSystemShutdownStarted
	3 -> RpcGetRequestForWinlogon
	4 -> RpcReportWinlogonReply
	5 -> RpcGetReconnectId
	6 -> RpcCreateWorkerSession
	7 -> RpcGetWorkerSessionGpuLuid
RPC  1e665584-40fe-4450-8f6e-802362399694 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcBroadcastSystemMessage
	1 -> RpcSendWindowMessage
	2 -> RpcCreateSession
	3 -> RpcTerminateSession
RPC  484809d6-4239-471b-b5bc-61df8c23ac48 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcOpenSession
	1 -> RpcCloseSession
	2 -> RpcConnect
	3 -> RpcDisconnect
	4 -> RpcLogoff
	5 -> RpcGetUserName
	6 -> RpcGetTerminalName
	7 -> RpcGetState
	8 -> RpcIsSessionDesktopLocked
	9 -> RpcShowMessageBox
	10 -> RpcGetTimes
	11 -> RpcGetSessionCounters
	12 -> RpcGetSessionInformation
	13 -> RpcSwitchToServicesSession
	14 -> RpcRevertFromServicesSession
	15 -> RpcGetLoggedOnCount
	16 -> RpcGetSessionType
	17 -> RpcGetSessionInformationEx
	18 -> RpcIsTerminalRemote
	19 -> RpcConnectAndLockTargetDesktop
RPC  e3907f22-c899-44e7-9d11-9d8b3d924832 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcEnableChildSessions
	1 -> RpcIsChildSessionsEnabled
	2 -> RpcGetChildSessionId
	3 -> RpcGetParentSessionId
	4 -> RpcGetAllUserSessions
RPC  53825514-1183-4934-a0f4-cfdc51c3389b (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcIsCurrentSessionTerminalRemote
	1 -> RpcGetCurrentSessionTerminalName
	2 -> RpcGetCurrentSessionInformation
	3 -> RpcGetCurrentSessionCapabilities
	4 -> RpcGetCurrentSessionType
RPC  11899a43-2b68-4a76-92e3-a3d6ad8c26ce (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcWaitForSessionState
	1 -> RpcRegisterAsyncNotification
	2 -> RpcWaitAsyncNotification
	3 -> RpcUnRegisterAsyncNotification
RPC  c2d15ccf-a416-46dc-ba58-4624ac7a9123 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcRegisterCurrentSessionAsyncNotification
	1 -> RpcWaitAsyncNotificationEx
	2 -> RpcUnRegisterAsyncNotificationEx
RPC  88143fd0-c28d-4b2b-8fef-8d882f6a9390 (1.0) -- c:\windows\system32\lsm.dll
	0 -> RpcOpenEnum
	1 -> RpcCloseEnum
	2 -> RpcFilterByState
	3 -> RpcFilterByCallersName
	4 -> RpcEnumAddFilter
	5 -> RpcGetEnumResult
	6 -> RpcFilterBySessionType
	7 -> RpcFilterByLicenseType
	8 -> RpcGetSessionIds
	9 -> RpcGetEnumResultEx
	10 -> RpcGetAllSessions
	11 -> RpcGetAllSessionsEx
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  517f87fe-597a-4672-8555-6daf1c8c788d (0.0) -- ISessionManager
OLE  75a446c5-40b7-41d3-8d53-292652c04121 (0.0) -- ITSEventDispatcher
OLE  959c5a99-177c-478e-8c3b-77e07e9bf3aa (0.0) -- ISessionList
OLE  a8105b4f-7d5a-402b-aac0-fd85daecf94c (0.0) -- ISessionEnum
OLE  a1b7de7a-4e77-43db-ae78-96fc182fed4a (0.0) -- ITSSession
OLE  1a8a5d71-d95b-4dcd-915e-f9f6d31879ad (0.0) -- ITerminal
OLE  6344a5b7-ef1c-47ba-98b7-28c664427793 (0.0) -- IGlassTerminal
OLE  c2d3e131-c587-49b4-8bae-f0ee269eeb31 (0.0) -- ITSSessionAttribute
OLE  35481b58-f46c-4254-b52c-fdc3001484c3 (0.0) -- IRestrictedCalls
OLE  4d10b48b-c531-4731-9bde-b03c28e9c61c (0.0) -- IUserName
Endpoints :
ncalrpc         : LRPC-56fe77ce659d43da99
ncalrpc         : LSMApi
ncacn_np        : \pipe\LSM_API_service
ncalrpc         : OLE72598D8A0D6838E6A3EBF8662F4B
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1396 at 0x5e18908L>
64
['TermService']

Interfaces :
RPC  ae55c4c0-64ce-11dd-ad8b-0800200c9a66 (1.0) -- c:\windows\system32\bdesvc.dll
	0 -> BdeSvcApipAddRecoveryPassword
	1 -> BdeSvcApipConversionEncrypt
	2 -> BdeSvcApipEventTrigger
	3 -> BdeSvcApipChangeProtector
	4 -> BdeSvcApipConversionEncryptEx
	5 -> BdeSvcApipCheckADSchema
	6 -> BdeSvcApipQueryCachedEASProtectionStatus
	7 -> BdeSvcApipDoTurnOnDeviceEncryption
	8 -> BdeSvcApipEnableSilentDeviceEncryption
	9 -> BdeSvcApipEnableSilentBitLocker
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-33b5f6eebf56b84252
ncalrpc         : OLEE2E87CED3CCC1206BBA6ED3A58AB
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1508 at 0x5e181d0L>
64
['NcbService']

Interfaces :
RPC  d09bdeb5-6171-4a34-bfe2-06fa82652568 (1.0) -- c:\windows\system32\BrokerLib.dll
	0 -> _BriCreateEvent
	1 -> _BriDeleteEvent
	2 -> BriDisableEvent
	3 -> BriEnableEvent
	4 -> BriSignalEvent
RPC  5222821f-d5e2-4885-84f1-5f6185a0ec41 (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> RpcSrvRegisterControlChannelReset
	1 -> RpcSrvUnregisterControlChannelReset
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
RPC  880fd55e-43b9-11e0-b1a8-cf4edfd72085 (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> KapiRegisterProvider
	1 -> KapiDeregisterProvider
	2 -> KapiUpdateKaSample
	3 -> KapiReceiveKaUpdateRequest
RPC  e40f7b57-7a25-4cd3-a135-7f7d3df9d16b (1.0) -- c:\windows\system32\ncbservice.dll
	0 -> RpcSrvCreateSession
	1 -> RpcSrvDestroySession
	2 -> RpcSrvStartBrokeredActivation
	3 -> RpcSrvSetServerKeepAliveInterval
	4 -> RpcSrvGetCurrentKeepAliveInterval
	5 -> RpcSrvDecreaseKeepAliveInterval
	6 -> RpcSrvUsingTransport
	7 -> RpcSrvIndicateSlotAllocation
	8 -> RpcSrvSBCreatePushEnabledContext
	9 -> RpcSrvSBTransferOwnership
	10 -> RpcSrvSBRetrieveSocket
	11 -> RpcSrvSBCompleteRetrieveSocket
	12 -> RpcSrvSBRetrieveContext
	13 -> RpcSrvSBEnumSockets
	14 -> RpcSrvCreateRadioDevice
	15 -> RpcSrvDeleteRadioDevice
	16 -> RpcSrvHotspotRegisterHotspotApp
	17 -> RpcSrvHotspotFindEventForPackage
	18 -> RpcSrvHotspotTriggerBackgroundEvent
	19 -> RpcSrvHotspotIsAppInstalled
	20 -> RpcSrvFirewallWcmSetFirewallRule
	21 -> RpcSrvFirewallWcmSetFirewallRuleFlags
	22 -> RpcSrvFirewallWcmDeleteFirewallRule
Endpoints :
ncalrpc         : LRPC-313331d19214b6495c
ncalrpc         : LRPC-fb5f696445160b36fd
ncalrpc         : OLE9764AD9A03F54AA6A31D01B9E095
ncalrpc         : LRPC-613198ad3a2d3b1d80
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1516 at 0x5e188d0L>
64
['TimeBrokerSvc']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1636 at 0x5e18cc0L>
64
['HvHost']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1716 at 0x5e18e10L>
64
['EventLog']

Interfaces :
RPC  82273fdc-e32a-18c3-3f78-827929dc23ea (0.0) -- c:\windows\system32\wevtsvc.dll
	0 -> ElfrClearELFW
	1 -> ElfrBackupELFW
	2 -> ElfrCloseEL
	3 -> ElfrDeregisterEventSource
	4 -> ElfrNumberOfRecords
	5 -> ElfrOldestRecord
	6 -> ElfrChangeNotify
	7 -> ElfrOpenELW
	8 -> ElfrRegisterEventSourceW
	9 -> ElfrOpenBELW
	10 -> ElfrReadELW
	11 -> ElfrReportEventW
	12 -> ElfrClearELFA
	13 -> ElfrBackupELFA
	14 -> ElfrOpenELA
	15 -> ElfrRegisterEventSourceA
	16 -> ElfrOpenBELA
	17 -> ElfrReadELA
	18 -> ElfrReportEventA
	19 -> ElfrRegisterClusterSvc
	20 -> ElfrDeregisterClusterSvc
	21 -> ElfrWriteClusterEvents
	22 -> ElfrGetLogInformation
	23 -> ElfrFlushEL
	24 -> ElfrReportEventAndSourceW
	25 -> ElfrReportEventExW
	26 -> ElfrReportEventExA
RPC  f6beaff7-1e19-4fbb-9f8f-b89e2018337c (1.0) -- c:\windows\system32\wevtsvc.dll
	0 -> _EvtRpcRegisterRemoteSubscription
	1 -> _EvtRpcRemoteSubscriptionNextAsync
	2 -> _EvtRpcRemoteSubscriptionNext
	3 -> EvtRpcRemoteSubscriptionWaitAsync
	4 -> EvtRpcRegisterControllableOperation
	5 -> _EvtRpcRegisterLogQuery
	6 -> EvtRpcClearLog
	7 -> EvtRpcExportLog
	8 -> EvtRpcLocalizeExportLog
	9 -> _EvtRpcMessageRender
	10 -> EvtRpcMessageRenderDefault
	11 -> _EvtRpcQueryNext
	12 -> _EvtRpcQuerySeek
	13 -> EvtRpcClose
	14 -> EvtRpcCancel
	15 -> _EvtRpcAssertConfig
	16 -> _EvtRpcRetractConfig
	17 -> _EvtRpcOpenLogHandle
	18 -> _EvtRpcGetLogFileInfo
	19 -> _EvtRpcGetChannelList
	20 -> _EvtRpcGetChannelConfig
	21 -> EvtRpcPutChannelConfig
	22 -> _EvtRpcGetPublisherList
	23 -> EvtRpcGetPublisherListForChannel
	24 -> _EvtRpcGetPublisherMetadata
	25 -> _EvtRpcGetPublisherResourceMetadata
	26 -> EvtRpcGetEventMetadataEnum
	27 -> EvtRpcGetNextEventMetadata
	28 -> _EvtRpcGetClassicLogDisplayName
Endpoints :
ncalrpc         : eventlog
ncacn_np        : \pipe\eventlog
ncacn_ip_tcp    : 1537
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1944 at 0x5e184e0L>
64
['nsi']

Interfaces :
RPC  7ea70bcf-48af-4f6a-8968-6a440754d5fa (1.0) -- c:\windows\system32\nsisvc.dll
	0 -> RpcNsiGetParameter
	1 -> RpcNsiGetAllParameters
	2 -> RpcNsiEnumerateObjectsAllParameters
	3 -> RpcNsiSetParameter
	4 -> RpcNsiSetAllParameters
	5 -> RpcNsiRegisterChangeNotification
	6 -> RpcNsiDeregisterChangeNotification
	7 -> RpcNsiRequestChangeNotification
	8 -> RpcNsiParameterChange
Endpoints :
ncalrpc         : LRPC-a9e30291416fef1f94
--------------------------------------------------------------------------------
<WinProcess "NVDisplay.Container.exe" pid 1964 at 0x5e184a8L>
64
['NVDisplay.ContainerLocalSystem']

Interfaces :
RPC  3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 (1.0) -- c:\windows\system32\dhcpcore6.dll
	0 -> RpcSrvRequestPrefixEx
	1 -> RpcSrvRenewPrefixEx
	2 -> RpcSrvReleasePrefixEx
	3 -> RpcSrvCancelOperation
	4 -> RpcSrvEnablev6Tracing
	5 -> RpcSrvRequestParams
	6 -> RpcSrvAcquireParametersv6
	7 -> RpcSrvReleaseParametersv6
	8 -> RpcSrvQueryLeaseInfov6
	9 -> RpcSrvGetTraceArray
	10 -> RpcSrvSetUserClass
	11 -> RpcSrvQueryLeaseInfov6Array
	12 -> RpcSrvEnableDhcpv6
RPC  3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 (1.0) -- c:\windows\system32\dhcpcore.dll
	0 -> RpcSrvEnableDhcp
	1 -> RpcSrvRenewLease
	2 -> RpcSrvDeleteStaticAddressAndDefaultGateways
	3 -> RpcSrvCheckServerAvailability
	4 -> RpcSrvRenewLeaseByBroadcast
	5 -> RpcSrvReleaseLease
	6 -> RpcSrvSetFallbackParams
	7 -> RpcSrvGetFallbackParams
	8 -> RpcSrvFallbackRefreshParams
	9 -> RpcSrvStaticRefreshParams
	10 -> RpcSrvRemoveDnsRegistrations
	11 -> RpcSrvRequestParams
	12 -> RpcSrvPersistentRequestParams
	13 -> RpcSrvRegisterParams
	14 -> RpcSrvDeRegisterParams
	15 -> RpcSrvEnumInterfaces
	16 -> RpcSrvQueryLeaseInfo
	17 -> RpcSrvQueryLeaseInfoArray
	18 -> RpcSrvSetClassId
	19 -> RpcSrvGetClassId
	20 -> RpcSrvSetClientId
	21 -> RpcSrvGetClientId
	22 -> RpcSrvNotifyMediaReconnected
	23 -> RpcSrvGetOriginalSubnetMask
	24 -> RpcSrvSetMSFTVendorSpecificOptions
	25 -> RpcSrvRequestCachedParams
	26 -> RpcSrvRegisterConnectionStateNotification
	27 -> RpcSrvDeRegisterConnectionStateNotification
	28 -> RpcSrvGetNotificationStatus
	29 -> RpcSrvGetDhcpServicedConnections
	30 -> RpcSrvGetTraceArray
	31 -> RpcSrvEnableTracing
	32 -> RpcSrvLeaseIpAddressEx
	33 -> RpcSrvRenewIpAddressLeaseEx
	34 -> RpcSrvReleaseIpAddressLeaseEx
	35 -> RpcSrvMadcapApiStartup
	36 -> RpcSrvMadcapApiCleanup
	37 -> RpcSrvMadcapEnumerateScopes
	38 -> RpcSrvMadcapGenUID
	39 -> RpcSrvMadcapRequestAddress
	40 -> RpcSrvMadcapRenewAddress
	41 -> RpcSrvMadcapReleaseAddress
Endpoints :
ncalrpc         : dhcpcsvc6
ncalrpc         : dhcpcsvc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 768 at 0x5e18048L>
64
['UmRdpService']

Interfaces :
RPC  326731e3-c1c0-4a69-ae20-7d9044a4ea5c (1.0) -- c:\windows\system32\profsvc.dll
	0 -> DropClientContext
	1 -> ReleaseClientContext
	2 -> LoadUserProfileServer
	3 -> UnloadUserProfileServer
	4 -> DeleteProfileServer
	5 -> RemapProfileServer
	6 -> CreateProfileServer
	7 -> ProcessWmiSettingsServer
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
Endpoints :
ncalrpc         : IUserProfile2
ncalrpc         : OLE6F8BDD12948DEBD71B04215252FE
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 1840 at 0x5e18898L>
64
['SysMain']

Interfaces :
RPC  b58aa02e-2884-4e97-8176-4ee06d794184 (1.0) -- c:\windows\system32\sysmain.dll
	0 -> PfRpcServerExecuteCommand
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-0e6f1aa3c02f3f32a5
ncalrpc         : OLE723934C840209383EF7E4D981BAC
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2064 at 0x5e18b00L>
64
['Themes']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2076 at 0x5e18c88L>
64
['EventSystem']

Interfaces :
RPC  aa411582-9bdf-48fb-b42b-faa1eee33949 (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> PMuxRpcPluginRegister
	1 -> PMuxRpcPluginUnregister
	2 -> PMuxRpcPluginDataIndicate
RPC  c33b9f46-2088-4dbc-97e3-6125f127661c (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> AppSrv_NlaOpenQuery
	1 -> AppSrv_NlaAsyncIndicate
	2 -> AppSrv_NlaRefreshQuery
	3 -> AppSrv_NlaCloseQuery
	4 -> RpcNlaIndicateReprobe
RPC  4c8d0bef-d7f1-49f0-9102-caa05f58d114 (1.0) -- c:\windows\system32\nlasvc.dll
	0 -> RPCQueryLANIds
Endpoints :
ncalrpc         : nlaplg
ncalrpc         : nlaapi
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2248 at 0x5e18e80L>
64
['CertPropSvc']

Interfaces :
RPC  30b044a5-a225-43f0-b3a4-e060df91f9c1 (1.0) -- c:\windows\system32\certprop.dll
	0 -> s_RPC_SmartCardRootCertsNotifyService
	1 -> s_RPC_SmartCardCertsNotifyService
Endpoints :
ncalrpc         : LRPC-efec9fc562caac861f
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2320 at 0x5e187f0L>
64
['Schedule']

Interfaces :
RPC  0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> ItSrvRegisterIdleTask
	1 -> ItSrvUnregisterIdleTask
	2 -> ItSrvProcessIdleTasks
	3 -> ItSrvSetDetectionParameters
	4 -> ItSrvSetRuntimeOverrides
RPC  1ff70682-0a51-30e8-076d-740be8cee98b (1.0) -- C:\WINDOWS\system32\taskcomp.dll
	0 -> NetrJobAdd
	1 -> NetrJobDel
	2 -> NetrJobEnum
	3 -> NetrJobGetInfo
RPC  378e52b0-c0a9-11cf-822d-00aa0051e40f (1.0) -- C:\WINDOWS\system32\taskcomp.dll
	0 -> SASetAccountInformation
	1 -> SASetNSAccountInformation
	2 -> SAGetNSAccountInformation
	3 -> SAGetAccountInformation
RPC  2a82bb21-e44f-4791-9aa1-dfae788e2f43 (1.0) -- c:\windows\system32\UBPM.dll
	0 -> s_UbpmRpcOpenTaskHostChannel
	1 -> s_UbpmRpcCloseTaskHostChannel
	2 -> s_UbpmRpcTaskHostSendResponseReceiveCommand
	3 -> s_UbpmRpcTaskHostReportTaskStatus
RPC  33d84484-3626-47ee-8c6f-e7e98b113be1 (2.0) -- C:\WINDOWS\SYSTEM32\WPTaskScheduler.dll
	0 -> s_TaskSchedulerCreateSchedule
	1 -> s_TaskSchedulerDeleteSchedule
	2 -> s_TaskSchedulerFindFirstSchedule
	3 -> s_TaskSchedulerFindNextSchedule
	4 -> s_TaskSchedulerFindScheduleClose
	5 -> s_TaskSchedulerGetSchedule
	6 -> s_TaskSchedulerEnableSchedule
	7 -> s_TaskSchedulerExecuteSchedule
	8 -> s_TaskSchedulerAdvanceSchedule
	9 -> s_TaskSchedulerAdvanceScheduleIntervals
	10 -> s_TaskSchedulerSnoozeSchedule
	11 -> s_TaskSchedulerGetPublishStateName
	12 -> s_TaskSchedulerServiceControl
RPC  86d35949-83c9-4044-b424-db363231fd0c (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> SchRpcHighestVersion
	1 -> SchRpcRegisterTask
	2 -> SchRpcRetrieveTask
	3 -> SchRpcCreateFolder
	4 -> SchRpcSetSecurity
	5 -> SchRpcGetSecurity
	6 -> SchRpcEnumFolders
	7 -> SchRpcEnumTasks
	8 -> SchRpcEnumInstances
	9 -> SchRpcGetInstanceInfo
	10 -> SchRpcStopInstance
	11 -> SchRpcStop
	12 -> SchRpcRun
	13 -> SchRpcDelete
	14 -> SchRpcRename
	15 -> SchRpcScheduledRuntimes
	16 -> SchRpcGetLastRunInfo
	17 -> SchRpcGetTaskInfo
	18 -> SchRpcGetNumberOfMissedRuns
	19 -> SchRpcEnableTask
RPC  3a9ef155-691d-4449-8d05-09ad57031823 (1.0) -- c:\windows\system32\schedsvc.dll
	0 -> I_pSchRpcRegisterTask
	1 -> I_pSchRpcEnumTasks
	2 -> I_pSchRpcGetTaskInfo
	3 -> I_pSchRpcAquireTaskStateNotificationsName
	4 -> I_pAcquireBackgroundExecutionMode
	5 -> I_pReleaseBackgroundExecutionMode
	6 -> I_pSetTaskDisabledForCurrentUser
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-51c51864fe6e0c48ac
ncacn_np        : \PIPE\atsvc
ncalrpc         : ubpmtaskhostchannel
ncalrpc         : LRPC-c2989cc83b76aaef0e
ncacn_ip_tcp    : 1538
ncalrpc         : OLEFCCE0CD6FC139AAA2578089FB67F
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2464 at 0x5e18550L>
64
['SENS']

Interfaces :
RPC  63fbe424-2029-11d1-8db8-00aa004abd5e (1.0) -- c:\windows\system32\sens.dll
	0 -> RPC_IsNetworkAlive
	1 -> RPC_IsDestinationReachableA
	2 -> RPC_IsDestinationReachableA
RPC  a0bc4698-b8d7-4330-a28f-7709e18b6108 (4.0) -- c:\windows\system32\sens.dll
	0 -> RPC_SensNotifyWinlogonEvent
	1 -> RPC_SensNotifyRasEvent
	2 -> RPC_SensNotifyNetconEvent
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  97312c82-d4c2-11d1-b682-00805fc79216 (0.0) -- ICollectionNotify
Endpoints :
ncalrpc         : senssvc
ncalrpc         : LRPC-acd8265eed74c34dcd
ncalrpc         : OLEC47EA283FE69A099E22AC7CA613A
--------------------------------------------------------------------------------
<WinProcess "Memory Compression" pid 2480 at 0x5e18a20L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "igfxCUIService.exe" pid 2600 at 0x5e189e8L>
64
['igfxCUIService2.0.0.0']

Interfaces :
RPC  f2c9b409-c1c9-4100-8639-d8ab1486694a (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> ClusterConnectUpcall
	1 -> ClusterDisConnectUpcall
RPC  eb081a0d-10ee-478a-a1dd-50995283e7a8 (3.0) -- c:\windows\system32\wkssvc.dll
	0 -> GetWitnessNodes
RPC  6bffd098-a112-3610-9833-46c3f87e345a (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> NetrWkstaGetInfo
	1 -> NetrWkstaSetInfo
	2 -> NetrWkstaUserEnum
	3 -> NetrWkstaUserGetInfo
	4 -> NetrWkstaUserSetInfo
	5 -> NetrWkstaTransportEnum
	6 -> NetrWkstaTransportAdd
	7 -> NetrWkstaTransportDel
	8 -> NetrUseAdd
	9 -> NetrUseGetInfo
	10 -> NetrUseDel
	11 -> NetrUseEnum
	12 -> I_NetrLogonDomainNameAdd
	13 -> NetrWorkstationStatisticsGet
	14 -> I_NetrLogonDomainNameAdd
	15 -> I_NetrLogonDomainNameAdd
	16 -> I_NetrLogonDomainNameAdd
	17 -> I_NetrLogonDomainNameAdd
	18 -> I_NetrLogonDomainNameAdd
	19 -> I_NetrLogonDomainNameAdd
	20 -> NetrGetJoinInformation
	21 -> I_NetrLogonDomainNameAdd
	22 -> NetrJoinDomain2
	23 -> NetrUnjoinDomain2
	24 -> NetrRenameMachineInDomain2
	25 -> NetrValidateName2
	26 -> NetrGetJoinableOUs2
	27 -> NetrAddAlternateComputerName
	28 -> NetrRemoveAlternateComputerName
	29 -> NetrSetPrimaryComputerName
	30 -> NetrEnumerateComputerNames
RPC  7f1343fe-50a9-4927-a778-0c5859517bac (1.0) -- c:\windows\system32\wkssvc.dll
	0 -> DfsDsGetDcName
	1 -> DfsDsIsDomainController
	2 -> DfsCredWrite
	3 -> DfsCredDelete
Endpoints :
ncalrpc         : LRPC-ae939f8a0790b55959
ncacn_np        : \PIPE\wkssvc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2708 at 0x5e18278L>
64
['UserManager']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2912 at 0x5e182b0L>
64
['FontCache']

Interfaces :
RPC  45776b01-5956-4485-9f80-f428f7d60129 (2.0) -- c:\windows\system32\dnsrslvr.dll
	0 -> CRrReadCache
	1 -> R_ResolverGetConfig
	2 -> R_ResolverFlushCache
	3 -> R_ResolverFlushCacheEntry
	4 -> R_ResolverQuery
	5 -> R_DnsRegisterLocal
	6 -> R_DnsDeRegisterLocal
	7 -> R_DnsStartMulticastQuery
	8 -> R_DnsGetMulticastData
	9 -> R_DnsStopMulticastQuery
	10 -> R_ResolverSimpleOp
	11 -> R_DnsGetProxyInformation
	12 -> R_DnsGetPolicyTableInfo
	13 -> R_DnsSetConnectionPolicyInfo
	14 -> R_DnsDeleteConnectionPolicyInfo
Endpoints :
ncalrpc         : DNSResolver
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3096 at 0x5e180b8L>
64
['Audiosrv']

Interfaces :
RPC  c27f3c08-92ba-478c-b446-b419c4cef0e2 (1.0) -- c:\windows\system32\dusmsvc.dll
	0 -> DusmRpcEnumConnectionList
	1 -> DusmRpcEnumProfileList
	2 -> DusmRpcQueryConnectionProperties
	3 -> DusmRpcQueryCost
	4 -> DusmRpcQueryUserCost
	5 -> DusmRpcQueryOperatorCost
	6 -> DusmRpcSetUserCost
	7 -> DusmRpcSetOperatorCost
	8 -> DusmRpcQueryDataPlan
	9 -> DusmRpcQueryUserDataPlan
	10 -> DusmRpcQueryOperatorDataPlan
	11 -> DusmRpcSetUserDataPlan
	12 -> DusmRpcSetOperatorDataPlan
	13 -> DusmRpcQuerySource
	14 -> DusmRpcSetSource
	15 -> DusmRpcQueryBackgroundRestriction
	16 -> DusmRpcSetBackgroundRestriction
	17 -> DusmRpcQueryGlobalDpuState
	18 -> DusmRpcGetAttributedNetworkUsage
	19 -> DusmRpcGetConnectionListNetworkUsage
	20 -> DusmRpcGetNetworkUsage
	21 -> DusmRpcGetProviderNetworkUsage
	22 -> DusmRpcSetAttributionMapping
	23 -> DusmRpcResetNetworkUsage
	24 -> DusmRpcFlushCostCache
Endpoints :
ncalrpc         : LRPC-321ce10e1e312e06be
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3240 at 0x5e18ba8L>
64
['Wcmsvc']

Interfaces :
RPC  25952c5d-7976-4aa1-a3cb-c35f7ae79d1b (1.1) -- c:\windows\system32\wlansvc.dll
	0 -> Srv_WDiagRpcInitSession
	1 -> Srv_WDiagRpcEndSession
	2 -> Srv_WDiagRpcQueryStatistics
	3 -> Srv_WDiagRpcQueryConnectionContextInfo
	4 -> Srv_WDiagRpcAutoConfigGetInterfaceInfo
	5 -> Srv_WDiagRpcGetExtensibilityInfo
RPC  c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 (1.0) -- c:\windows\system32\SYSNTFY.dll
	0 -> s_OnInitialConnection
	1 -> s_OnCreateSession
	2 -> s_OnStartScreenSaverAsDefaultUser
	3 -> s_OnStopScreenSaverAsDefaultUser
	4 -> s_OnLogon
	5 -> s_OnLock
	6 -> s_OnUnlock
	7 -> s_OnStartScreenSaverAsUser
	8 -> s_OnStopScreenSaverAsUser
	9 -> s_OnDisconnect
	10 -> s_OnReconnect
	11 -> s_OnLogoff
	12 -> s_OnTerminateSession
	13 -> s_OnStartShell
	14 -> s_OnEndShell
RPC  266f33b4-c7c1-4bd1-8f52-ddb8f2214ea9 (1.0) -- c:\windows\system32\wlansvc.dll
	0 -> RpcOpenHandle
	1 -> RpcCloseHandle
	2 -> RpcEnumInterfaces
	3 -> RpcSetAutoConfigParameter
	4 -> RpcQueryAutoConfigParameter
	5 -> RpcGetInterfaceCapability
	6 -> RpcSetInterface
	7 -> RpcQueryInterface
	8 -> RpcIhvControl
	9 -> RpcScan
	10 -> RpcGetAvailableNetworkList
	11 -> RpcPrivateGetAvailableNetworkList
	12 -> RpcPrivateClearAnqpCache
	13 -> RpcPrivateRefreshAnqpCache
	14 -> RpcPrivateGetAnqpCacheResponse
	15 -> RpcPrivateParseAnqpRawData
	16 -> RpcPrivateGetAnqpOSUProviderList
	17 -> RpcPrivateEnableAnqpOsuRegistration
	18 -> RpcPrivateGetAnqpOsuRegistrationStatus
	19 -> RpcGetNetworkBssList
	20 -> RpcConnect
	21 -> RpcConnectEx
	22 -> RpcDisconnect
	23 -> RpcRegisterNotification
	24 -> RpcAsyncGetNotification
	25 -> RpcSetProfileEapUserData
	26 -> RpcSetProfile
	27 -> RpcGetProfile
	28 -> RpcDeleteProfile
	29 -> RpcRenameProfile
	30 -> RpcSetProfileList
	31 -> RpcSetProfileListForOffload
	32 -> RpcGetProfileList
	33 -> RpcSetProfilePosition
	34 -> RpcSetProfileCustomUserData
	35 -> RpcGetProfileCustomUserData
	36 -> RpcSetFilterList
	37 -> RpcGetFilterList
	38 -> RpcSetPsdIEDataList
	39 -> RpcSaveTemporaryProfile
	40 -> RpcIsUIRequestPending
	41 -> RpcSetUIForwardingNetworkList
	42 -> RpcIsNetworkSuppressed
	43 -> RpcRemoveUIForwardingNetworkList
	44 -> RpcQueryExtUIRequest
	45 -> RpcUIResponse
	46 -> RpcGetProfileKeyInfo
	47 -> RpcAsyncDoPlap
	48 -> RpcQueryPlapCredentials
	49 -> RpcCancelPlap
	50 -> RpcSetSecuritySettings
	51 -> RpcGetSecuritySettings
	52 -> RpcHostedNetworkPerformOperation
	53 -> RpcHostedNetworkHlpQueryEverUsed
	54 -> RpcHostedNetworkSetProperty
	55 -> RpcHostedNetworkQueryProperty
	56 -> RpcHostedNetworkQueryStatus
	57 -> RpcHostedNetworkQueryWCNSettings
	58 -> RpcHostedNetworkSetWCNSettings
	59 -> RpcGetProfileEapUserDataInfo
	60 -> RpcQueryPreConnectInput
	61 -> RpcConnectWithInput
	62 -> RpcRefreshConnections
	63 -> RpcInternalScan
	64 -> RpcHostedNetworkSetSecondaryKey
	65 -> RpcHostedNetworkQuerySecondaryKey
	66 -> RpcRegisterVirtualStationNotification
	67 -> RpcEnumAllInterfaces
	68 -> RpcQueryInterfacePortType
	69 -> RpcWFDDiscoverDevices
	70 -> RpcWFDGetVisibleDevices
	71 -> RpcWFDStopDiscoverDevices
	72 -> RpcWFDStartBackgroundDiscovery
	73 -> RpcWFDStopBackgroundDiscovery
	74 -> RpcWFDDiscoverDeviceServiceInformation
	75 -> RpcWFDOpenHandle
	76 -> RpcWFDRegisterVMgrCaller
	77 -> RpcWFDUnregisterVMgrCaller
	78 -> RpcWFDQueryProperty
	79 -> RpcWFDSetProperty
	80 -> RpcWFDSetSecondaryDeviceTypeList
	81 -> RpcWFDPairEnumerateCeremonies
	82 -> RpcWFDPairSelectCeremony
	83 -> RpcWFDPairWithDevice
	84 -> RpcWFDPairCancel
	85 -> RpcWFDPairCancelByDeviceAddress
	86 -> RpcWFDOpenSession
	87 -> RpcWFDGetSessionEndpointPairs
	88 -> RpcWFDConfigureFirewallForSession
	89 -> RpcWFDCancelOpenSession
	90 -> RpcWFDCloseSession
	91 -> RpcWFDAbortSession
	92 -> RpcWFDForceDisconnect
	93 -> RpcWFDForceDisconnectLegacyPeer
	94 -> RpcWFDAcceptGroupRequestAndOpenSession
	95 -> RpcWFDDeclineGroupRequest
	96 -> RpcWFDSetWCNSettings
	97 -> RpcWFDAcceptConnectRequestAndOpenSession
	98 -> RpcWFDDeclineConnectRequest
	99 -> RpcWFDGetPeerInfo
	100 -> RpcWFDGetDefaultGroupProfile
	101 -> RpcWFDGetProfileKeyInfo
	102 -> RpcWFDStartUsingGroup
	103 -> RpcWFDStopUsingGroup
	104 -> RpcWFDOpenLegacySessionWithProfile
	105 -> RpcWFDCloseLegacySession
	106 -> RpcWFDIsInterfaceWiFiDirect
	107 -> RpcIsWiFiDirectRunningOnWiFiAdapter
	108 -> RpcWFDUpdateDeviceVisibility
	109 -> RpcWFDOpenLegacySession
	110 -> RpcWFDFlushVisibleDeviceList
	111 -> RpcWlanNotifyVsIeProvider
	112 -> RpcWlanNotifyVsIeProviderEx
	113 -> RpcWFDGetDeviceDescriptorForPendingRequest
	114 -> RpcWFDStartOffloadedDiscovery
	115 -> RpcWFDStopOffloadedDiscovery
	116 -> RpcWFDGetPrimaryAdapterState
	117 -> RpcWFDDiscoverDevicesEx
	118 -> RpcWFDGetVisibleDevicesEx
	119 -> RpcWFDStopDiscoverDevicesEx
	120 -> RpcWFDSetSelectedWfdMgr
	121 -> RpcWFDSetSelectedWfdMgrWithoutClientContext
	122 -> RpcWFDResetSelectedWfdMgr
	123 -> RpcWiFiDisplaySetSinkClientHandle
	124 -> RpcWiFiDisplaySetSinkState
	125 -> RpcWiFiDisplayResetSinkState
	126 -> RpcSetProfileMetadata
	127 -> RpcGetProfileMetadata
	128 -> RpcWCMGetProfileList
	129 -> RpcWcmSetProfile
	130 -> RpcWcmSetInterface
	131 -> RpcWcmGetInterface
	132 -> RpcWcmDisconnect
	133 -> RpcStoreRadioState
	134 -> RpcGetStoredRadioState
	135 -> RpcGetRadioInformation
	136 -> RpcGetProfileIndex
	137 -> RpcGetMFPNegotiated
	138 -> RpcPrivateQueryInterface
	139 -> RpcPrivateSetInterface
	140 -> RpcUpdateBasicProfileSecurity
	141 -> RpcPrivateQuery11adPairedConfig
	142 -> RpcGetSupportedDeviceServices
	143 -> RpcDeviceServiceCommand
RPC  266f33b4-c7c1-4bd1-8f52-ddb8f2214eb0 (1.0) -- c:\windows\system32\wlansvc.dll
	0 -> RpcLowPrivOpenHandle
	1 -> RpcLowPrivCloseHandle
	2 -> RpcLowPrivRegisterNotification
	3 -> RpcLowPrivAsyncGetNotification
	4 -> RpcLowPrivSetInterface
	5 -> RpcLowPrivQueryInterface
	6 -> RpcLowPrivEnumInterfaces
	7 -> RpcWfdLowPrivIsWfdSupported
	8 -> RpcWfdLowPrivOpenHandle
	9 -> RpcWfdLowPrivCancelOpenSession
	10 -> RpcWfdLowPrivCloseSession
	11 -> RpcWfdLowPrivGetSessionEndpointPairs
	12 -> RpcWfdLowPrivConfigureFirewallForSession
	13 -> RpcWfdLowPrivOpenLegacySessionWithProfile
	14 -> RpcWfdLowPrivCloseLegacySession
	15 -> RpcWfdLowPrivQueryProperty
	16 -> RpcWfdLowPrivSetProperty
	17 -> RpcWfdLowPrivStartUsingGroup
	18 -> RpcWfdLowPrivStopUsingGroup
	19 -> RpcWlanLowPrivNotifyVsIeProvider
	20 -> RpcWfdLowPrivOpenSessionByDafObjectId
	21 -> RpcWfdLowPrivDeclineDeviceApiConnectionRequest
	22 -> RpcWfdLowPrivStartDeviceApiConnectionRequestListener
	23 -> RpcWfdLowPrivStopDeviceApiConnectionRequestListener
	24 -> RpcWFDSvcLowPrivPublishService
	25 -> RpcWFDSvcLowPrivUnpublishService
	26 -> RpcWfdSvcLowPrivOpenSeekerSession
	27 -> RpcWfdSvcLowPrivOpenAdvertiserSession
	28 -> RpcWfdSvcLowPrivGetProvisioningInfo
	29 -> RpcWfdSvcLowPrivConnectSession
	30 -> RpcWfdSvcLowPrivCancelSession
	31 -> RpcWfdSvcLowPrivAcceptSession
	32 -> RpcWfdSvcLowPrivConfigureSession
	33 -> RpcWfdSvcLowPrivCloseSession
	34 -> RpcWfdSvcLowPrivGetSessionEndpointPairs
	35 -> RpcWfdLowPrivRegisterVMgrCaller
	36 -> RpcWfdLowPrivUnregisterVMgrCaller
	37 -> RpcWlanVMgrQueryCurrentScenarios
	38 -> RpcWfdLowPrivGetPendingGroupRequestDetails
RPC  c3f42c6e-d4cc-4e5a-938b-9c5e8a5d8c2e (1.0) -- c:\windows\system32\WLANMSM.DLL
	0 -> RpcDot11ExtRegisterIhvProcess
	1 -> RpcDot11ExtPreAssociateCompletion
	2 -> RpcDot11ExtPostAssociateCompletion
	3 -> RpcDot11ExtSendUIRequest
	4 -> RpcDot11ExtSendNotification
	5 -> RpcDot11ExtGetProfileCustomUserData
	6 -> RpcDot11ExtSetProfileCustomUserData
	7 -> RpcDot11ExtNotifyChangeState
	8 -> RpcDot11ExtSetCurrentProfile
	9 -> RpcDot11ExtStartOneX
	10 -> RpcDot11ExtStopOneX
	11 -> RpcDot11ExtProcessSecurityPacket
	12 -> RpcDot11ExtRequestVirtualStation
	13 -> RpcDot11ExtReleaseVirtualStation
	14 -> RpcDot11ExtSetVirtualStationAPProperties
RPC  a111f1c6-5923-47c0-9a68-d0bafb577901 (1.0) -- C:\Windows\System32\NetSetupShim.dll
	0 -> RpcNetSetup_NotifyHost_Connect
	1 -> RpcNetSetup_NotifyHost_Disconnect
	2 -> RpcNetSetup_Isolation_ExecuteInfSection
	3 -> RpcNetSetup_NotifyObject_Load
	4 -> RpcNetSetup_NotifyObject_Unload
	5 -> RpcNetSetup_ComponentControl_Initialize
	6 -> RpcNetSetup_ComponentControl_ApplyChanges
	7 -> RpcNetSetup_ComponentControl_ApplyPnpChanges
	8 -> RpcNetSetup_ComponentControl_CancelChanges
	9 -> RpcNetSetup_ComponentSetup_Install
	10 -> RpcNetSetup_ComponentSetup_Upgrade
	11 -> RpcNetSetup_ComponentSetup_Removing
	12 -> RpcNetSetup_NotifyBinding_QueryBindingPath
	13 -> RpcNetSetup_NotifyBinding_NotifyBindingPath
	14 -> RpcNetSetup_NotifyGlobal_GetSupportedNotifications
	15 -> RpcNetSetup_NotifyGlobal_SysQueryBindingPath
	16 -> RpcNetSetup_NotifyGlobal_SysNotifyBindingPath
	17 -> RpcNetSetup_NotifyGlobal_SysNotifyComponent
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-980e251dff6123d053
ncalrpc         : LRPC-1584350eef00c3a38a
ncalrpc         : OLE70A9045440095781F084FEE0B79C
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3452 at 0x5e18b70L>
64
['BFE', 'CoreMessagingRegistrar', 'mpssvc']

Interfaces :
RPC  df4df73a-c52d-4e3a-8003-8437fdf8302a (0.0) -- c:\windows\system32\coremessaging.dll
	0 -> ServerValidateWindowId
	1 -> ServerValidateWindowIdAndOwner
RPC  dd490425-5325-4565-b774-7e27d6c09c24 (1.0) -- c:\windows\system32\bfe.dll
	0 -> BfeRpcGetNextNotificationBatch
	1 -> BfeRpcNotifyComplete
	2 -> BfeRpcEngineOpen
	3 -> BfeRpcEngineClose
	4 -> BfeRpcEngineGetOption
	5 -> BfeRpcEngineSetOption
	6 -> BfeRpcEngineGetSecurityInfo
	7 -> BfeRpcEngineSetSecurityInfo
	8 -> BfeRpcSessionCreateEnumHandle
	9 -> BfeRpcAleEndpointEnum
	10 -> BfeRpcAleEndpointDestroyEnumHandle
	11 -> BfeRpcTransactionBegin
	12 -> BfeRpcTransactionCommit
	13 -> BfeRpcTransactionAbort
	14 -> BfeRpcProviderAdd
	15 -> BfeRpcProviderDeleteByKey
	16 -> BfeRpcProviderGetByKey
	17 -> BfeRpcProviderCreateEnumHandle
	18 -> BfeRpcAleEndpointEnum
	19 -> BfeRpcAleEndpointDestroyEnumHandle
	20 -> BfeRpcProviderGetSecurityInfoByKey
	21 -> BfeRpcProviderSetSecurityInfoByKey
	22 -> BfeRpcProviderSubscribeChanges
	23 -> BfeRpcProviderUnsubscribeChanges
	24 -> BfeRpcProviderSubscriptionsGet
	25 -> BfeRpcProviderContextAdd
	26 -> BfeRpcProviderContextDeleteById
	27 -> BfeRpcProviderContextDeleteByKey
	28 -> BfeRpcProviderContextGetById
	29 -> BfeRpcProviderContextGetByKey
	30 -> BfeRpcProviderContextCreateEnumHandle
	31 -> BfeRpcAleEndpointEnum
	32 -> BfeRpcAleEndpointDestroyEnumHandle
	33 -> BfeRpcProviderContextGetSecurityInfoByKey
	34 -> BfeRpcProviderContextSetSecurityInfoByKey
	35 -> BfeRpcProviderContextSubscribeChanges
	36 -> BfeRpcProviderContextUnsubscribeChanges
	37 -> BfeRpcProviderContextSubscriptionsGet
	38 -> BfeRpcSubLayerAdd
	39 -> BfeRpcSubLayerDeleteByKey
	40 -> BfeRpcSubLayerGetByKey
	41 -> BfeRpcSubLayerCreateEnumHandle
	42 -> BfeRpcAleEndpointEnum
	43 -> BfeRpcAleEndpointDestroyEnumHandle
	44 -> BfeRpcSubLayerGetSecurityInfoByKey
	45 -> BfeRpcSubLayerSetSecurityInfoByKey
	46 -> BfeRpcSubLayerSubscribeChanges
	47 -> BfeRpcSubLayerUnsubscribeChanges
	48 -> BfeRpcSubLayerSubscriptionsGet
	49 -> BfeRpcLayerGetById
	50 -> BfeRpcLayerGetByKey
	51 -> BfeRpcLayerCreateEnumHandle
	52 -> BfeRpcAleEndpointEnum
	53 -> BfeRpcAleEndpointDestroyEnumHandle
	54 -> BfeRpcLayerGetSecurityInfoByKey
	55 -> BfeRpcLayerSetSecurityInfoByKey
	56 -> BfeRpcCalloutAdd
	57 -> BfeRpcCalloutDeleteById
	58 -> BfeRpcCalloutDeleteByKey
	59 -> BfeRpcCalloutGetById
	60 -> BfeRpcCalloutGetByKey
	61 -> BfeRpcCalloutCreateEnumHandle
	62 -> BfeRpcAleEndpointEnum
	63 -> BfeRpcAleEndpointDestroyEnumHandle
	64 -> BfeRpcCalloutGetSecurityInfoByKey
	65 -> BfeRpcCalloutSetSecurityInfoByKey
	66 -> BfeRpcCalloutSubscribeChanges
	67 -> BfeRpcCalloutUnsubscribeChanges
	68 -> BfeRpcCalloutSubscriptionsGet
	69 -> BfeRpcFilterAdd
	70 -> BfeRpcFilterDeleteById
	71 -> BfeRpcFilterDeleteByKey
	72 -> BfeRpcFilterGetById
	73 -> BfeRpcFilterGetByKey
	74 -> BfeRpcFilterCreateEnumHandle
	75 -> BfeRpcAleEndpointEnum
	76 -> BfeRpcAleEndpointDestroyEnumHandle
	77 -> BfeRpcFilterGetSecurityInfoByKey
	78 -> BfeRpcFilterSetSecurityInfoByKey
	79 -> BfeRpcFilterSubscribeChanges
	80 -> BfeRpcFilterUnsubscribeChanges
	81 -> BfeRpcFilterSubscriptionsGet
	82 -> BfeRpcBfeIPsecOffloadDone
	83 -> BfeRpcBfeIPsecDosFWUsed
	84 -> BfeRpcBfeIPsecGetStatistics
	85 -> BfeRpcBfeIPsecSaContextCreate
	86 -> BfeRpcBfeIPsecSaContextDeleteById
	87 -> BfeRpcBfeIPsecSaContextGetById
	88 -> BfeRpcBfeIPsecSaContextGetOrSetSpi
	89 -> BfeRpcBfeIPsecSaContextAddInbound
	90 -> BfeRpcBfeIPsecSaContextAddOutbound
	91 -> BfeRpcBfeIPsecSaContextUpdate
	92 -> BfeRpcBfeIPsecSaContextExpire
	93 -> BfeRpcBfeIPsecSaContextCreateEnumHandle
	94 -> BfeRpcAleEndpointEnum
	95 -> BfeRpcAleEndpointDestroyEnumHandle
	96 -> BfeRpcBfeIPsecSaContextSubscribe
	97 -> BfeRpcBfeIPsecSaContextUnsubscribe
	98 -> BfeRpcBfeIPsecSaContextSubscriptionsGet
	99 -> BfeRpcBfeIPsecSaCreateEnumHandle
	100 -> BfeRpcAleEndpointEnum
	101 -> BfeRpcAleEndpointDestroyEnumHandle
	102 -> BfeRpcBfeIPsecSaDbGetSecurityInfo
	103 -> BfeRpcBfeIPsecSaDbSetSecurityInfo
	104 -> BfeRpcBfeIPsecDospGetStatistics
	105 -> BfeRpcBfeIPsecDospStateCreateEnumHandle
	106 -> BfeRpcAleEndpointEnum
	107 -> BfeRpcBfeIPsecDospStateDestroyEnumHandle
	108 -> BfeRpcBfeIPsecDospGetSecurityInfo
	109 -> BfeRpcBfeIPsecDospSetSecurityInfo
	110 -> BfeRpcNetEventCreateEnumHandle
	111 -> BfeRpcAleEndpointEnum
	112 -> BfeRpcAleEndpointDestroyEnumHandle
	113 -> BfeRpcNetEventsGetSecurityInfo
	114 -> BfeRpcNetEventsSetSecurityInfo
	115 -> BfeRpcNetEventSubscribe
	116 -> BfeRpcNetEventUnsubscribe
	117 -> BfeRpcNetEventSubscriptionsGet
	118 -> BfeRpcNetEventsLost
	119 -> BfeRpcConnectionGetById
	120 -> BfeRpcConnectionGetByIPsecInfo
	121 -> BfeRpcConnectionGetByS2STunnelId
	122 -> BfeRpcConnectionCreateEnumHandle
	123 -> BfeRpcAleEndpointEnum
	124 -> BfeRpcAleEndpointDestroyEnumHandle
	125 -> BfeRpcConnectionGetSecurityInfo
	126 -> BfeRpcConnectionSetSecurityInfo
	127 -> BfeRpcConnectionGetS2STunnelId
	128 -> BfeRpcConnectionSubscribe
	129 -> BfeRpcConnectionUnsubscribe
	130 -> BfeRpcConnectionSubscriptionsGet
	131 -> BfeRpcConnectionsLost
	132 -> BfeRpcClassify
	133 -> BfeRpcAddLayerReplica
	134 -> BfeRpcDeleteLayerReplica
	135 -> BfeRpcSecureSocketAdd
	136 -> BfeRpcBfeIPsecTunnelDeleteByKey
	137 -> BfeRpcBfeIPsecTunnelAdd
	138 -> BfeRpcBfeIPsecTunnelAddConditions
	139 -> BfeRpcBfeIPsecS2STunnelAddConditions
	140 -> BfeRpcBfeIPsecS2STunnelRemoveConditions
	141 -> BfeRpcBfeIPsecTunnelDeleteByKey
	142 -> BfeRpcBfeIPsecS2STunnelAddInterfaceToCompartment
	143 -> BfeRpcBfeIPsecS2STunnelGetInterfaceForCompartment
	144 -> BfeRpcBfeIPsecS2STunnelRemoveInterfaceFromCompartment
	145 -> BfeRpcBfeIPsecSaInitiateAsync
	146 -> BfeRpcOpenToken
	147 -> BfeRpcCloseToken
	148 -> BfeRpcAleExplicitCredentialsQuery
	149 -> BfeRpcAleEndpointGetById
	150 -> BfeRpcAleEndpointCreateEnumHandle
	151 -> BfeRpcAleEndpointEnum
	152 -> BfeRpcAleEndpointDestroyEnumHandle
	153 -> BfeRpcAleEndpointGetSecurityInfo
	154 -> BfeRpcAleEndpointSetSecurityInfo
	155 -> BfeRpcAleGetPortStatus
	156 -> BfeRpcIsUserAuthConfigured
	157 -> BfeRpcKeyModuleAdd
	158 -> BfeRpcKeyModuleDeleteByKey
	159 -> BfeRpcKeyModuleUpdateAcquire
	160 -> BfeRpcKeyDictatorCheck
	161 -> BfeRpcGetKeyFromDictator
	162 -> BfeRpcNotifyKey
	163 -> BfeRpcKeyManagerAdd
	164 -> BfeRpcKeyManagerDeleteByKey
	165 -> BfeRpcKeyManagersGet
	166 -> BfeRpcKeyManagerGetSecurityInfoByKey
	167 -> BfeRpcKeyManagerSetSecurityInfoByKey
	168 -> BfeRpcvSwitchEventFire
	169 -> BfeRpcvSwitchEventsGetSecurityInfo
	170 -> BfeRpcvSwitchEventsSetSecurityInfo
	171 -> BfeRpcvSwitchEventSubscribe
	172 -> BfeRpcvSwitchEventUnsubscribe
	173 -> BfeRpcvSwitchEventSubscriptionsGet
	174 -> BfeRpcBfeIPsecDriverInitiateAcquire
	175 -> BfeRpcBfeIPsecDriverExpire
	176 -> BfeRpcBfeIPsecDriverSaOffloaded
	177 -> BfeRpcBfeIPsecDriverProcessClearTextResponse
	178 -> BfeRpcBfeProcessNameResolutionEvent
	179 -> BfeRpcVpnTriggerEventFire
	180 -> BfeRpcVpnTriggerEventSubscribe
	181 -> BfeRpcVpnTriggerEventUnsubscribe
	182 -> BfeRpcVpnTriggerAddAppSids
	183 -> BfeRpcVpnTriggerRemoveAppSids
	184 -> BfeRpcVpnTriggerAddFilePaths
	185 -> BfeRpcVpnTriggerRemoveFilePaths
	186 -> BfeRpcVpnTriggerAddSecurityDescriptor
	187 -> BfeRpcVpnTriggerRemoveSecurityDescriptor
	188 -> BfeRpcVpnTriggerSetStateDisconnected
	189 -> BfeRpcVpnTriggerInitializeNrptTriggering
	190 -> BfeRpcVpnTriggerUninitializeNrptTriggering
	191 -> BfeRpcVpnTriggerResetNrptTriggering
	192 -> BfeRpcVpnTriggerConfigureParameters
	193 -> BfeRpcBitmapIndexGet
	194 -> BfeRpcBitmapIndexFree
RPC  7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_FWIndicatePortInUse
	1 -> RPC_FWGetIndicatedPortInUse
	2 -> RPC_FWIndicateTupleInUse
	3 -> RPC_FWResetIndicatedTupleInUse
	4 -> RPC_FWIndicateProxyForUrl
	5 -> CNetProfileEventSink::NetworkAdded
	6 -> RPC_FWIsTargetAProxy
	7 -> RPC_NetworkIsolationSetupAppContainerBinaries
	8 -> RPC_NetworkIsolationRegisterForAppContainerChanges
	9 -> Rpc_NetworkIsolationRegistrationGetLastEvent
	10 -> RPC_NetworkIsolationUnregisterForAppContainerChanges
	11 -> RPC_NetworkIsolationGetAppContainer
	12 -> RPC_NetworkIsolationEnumAppContainers
	13 -> RPC_NetworkIsolationAddAllowEnterpriseIdRule
	14 -> RPC_NetworkIsolationCreateAllInterfacesContainer
	15 -> RPC_NetworkIsolationCreateInterfaceContainer
	16 -> RPC_NetworkIsolationDeleteAllInterfacesContainer
	17 -> RPC_NetworkIsolationDeleteInterfaceContainer
RPC  f47433c3-3e9d-4157-aad4-83aa1f5c2d4c (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_NetworkIsolationDiagnoseConnectFailure
	1 -> RPC_NetworkIsolationGetEnterpriseIdAsync
	2 -> RPC_NetworkIsolationCreateContainer
	3 -> RPC_NetworkIsolationDeleteContainer
	4 -> RPC_NetworkIsolationGetAppContainerConfig
	5 -> RPC_NetworkIsolationSetAppContainerConfig
	6 -> RPC_NetworkIsolationCreateAppContainer
	7 -> RPC_NetworkIsolationDeleteAppContainer
	8 -> RPC_NetworkIsolationCreateAppContainerLoopbackRules
	9 -> RPC_NetworkIsolationDeleteAppContainerLoopbackRules
RPC  2fb92682-6599-42dc-ae13-bd2ca89bd11c (1.0) -- c:\windows\system32\mpssvc.dll
	0 -> RPC_FWOpenPolicyStore
	1 -> RPC_FWClosePolicyStore
	2 -> RPC_FWRestoreDefaults
	3 -> RPC_FWGetGlobalConfig
	4 -> RPC_FWSetGlobalConfig
	5 -> RPC_FWAddFirewallRule
	6 -> RPC_FWSetFirewallRule
	7 -> RPC_FWDeleteFirewallRule
	8 -> RPC_FWDeleteAllFirewallRules
	9 -> RPC_FWEnumFirewallRules
	10 -> RPC_FWGetConfig
	11 -> RPC_FWSetConfig
	12 -> RPC_FWNotifyUnsupportedAttempt
	13 -> RPC_FWAddConnectionSecurityRule
	14 -> RPC_FWSetConnectionSecurityRule
	15 -> RPC_FWDeleteConnectionSecurityRule
	16 -> RPC_FWDeleteAllConnectionSecurityRules
	17 -> RPC_FWEnumConnectionSecurityRules
	18 -> RPC_FWAddAuthenticationSet
	19 -> RPC_FWSetAuthenticationSet
	20 -> RPC_FWDeleteAuthenticationSet
	21 -> RPC_FWDeleteAllAuthenticationSets
	22 -> RPC_FWEnumAuthenticationSets
	23 -> RPC_FWAddCryptoSet
	24 -> RPC_FWSetCryptoSet
	25 -> RPC_FWDeleteCryptoSet
	26 -> RPC_FWDeleteAllCryptoSets
	27 -> RPC_FWEnumCryptoSets
	28 -> RPC_FWEnumPhase1SAs
	29 -> RPC_FWEnumPhase2SAs
	30 -> RPC_FWDeletePhase1SAs
	31 -> RPC_FWDeletePhase2SAs
	32 -> RPC_FWRegisterProduct
	33 -> RPC_FWUnregisterProduct
	34 -> RPC_FWEnumProducts
	35 -> RPC_FWAddMainModeRule
	36 -> RPC_FWSetMainModeRule
	37 -> RPC_FWDeleteMainModeRule
	38 -> RPC_FWDeleteAllMainModeRules
	39 -> RPC_FWEnumMainModeRules
	40 -> RPC_FWQueryFirewallRules
	41 -> RPC_FWQueryConnectionSecurityRules2_10
	42 -> RPC_FWQueryMainModeRules
	43 -> RPC_FWQueryAuthenticationSets
	44 -> RPC_FWQueryCryptoSets
	45 -> RPC_FWEnumNetworks
	46 -> RPC_FWEnumAdapters
	47 -> RPC_FWGetGlobalConfig2_10
	48 -> RPC_FWGetConfig2_10
	49 -> RPC_FWAddFirewallRule2_10
	50 -> RPC_FWSetFirewallRule2_10
	51 -> RPC_FWEnumFirewallRules2_10
	52 -> RPC_FWAddConnectionSecurityRule2_10
	53 -> RPC_FWSetConnectionSecurityRule2_10
	54 -> RPC_FWEnumConnectionSecurityRules2_10
	55 -> RPC_FWAddAuthenticationSet2_10
	56 -> RPC_FWSetAuthenticationSet2_10
	57 -> RPC_FWEnumAuthenticationSets2_10
	58 -> RPC_FWAddCryptoSet2_10
	59 -> RPC_FWSetCryptoSet2_10
	60 -> RPC_FWEnumCryptoSets2_10
	61 -> RPC_FWDiagGetAppList
	62 -> RPC_FWAddConnectionSecurityRule2_20
	63 -> RPC_FWSetConnectionSecurityRule2_20
	64 -> RPC_FWEnumConnectionSecurityRules2_20
	65 -> RPC_FWQueryConnectionSecurityRules2_20
	66 -> RPC_FWAddAuthenticationSet2_20
	67 -> RPC_FWSetAuthenticationSet2_20
	68 -> RPC_FWEnumAuthenticationSets2_20
	69 -> RPC_FWQueryAuthenticationSets2_20
	70 -> RPC_FWAddFirewallRule2_20
	71 -> RPC_FWSetFirewallRule2_20
	72 -> RPC_FWEnumFirewallRules2_20
	73 -> RPC_FWQueryFirewallRules2_20
	74 -> RPC_FWQueryIsolationType
	75 -> RPC_FWSelectConSecRule
	76 -> RPC_FWAddFirewallRule2_24
	77 -> RPC_FWSetFirewallRule2_24
	78 -> RPC_FWEnumFirewallRules2_24
	79 -> RPC_FWQueryFirewallRules2_24
	80 -> RPC_FWAddFirewallRule2_25
	81 -> RPC_FWSetFirewallRule2_25
	82 -> RPC_FWEnumFirewallRules2_25
	83 -> RPC_FWQueryFirewallRules2_25
	84 -> RPC_FWAddFirewallRule2_26
	85 -> RPC_FWSetFirewallRule2_26
	86 -> RPC_FWEnumFirewallRules2_26
	87 -> RPC_FWQueryFirewallRules2_26
	88 -> RPC_FWAddFirewallRule2_27
	89 -> RPC_FWSetFirewallRule2_27
	90 -> RPC_FWEnumFirewallRules2_27
	91 -> RPC_FWQueryFirewallRules2_27
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
Endpoints :
ncalrpc         : LRPC-d9f8936950b36b0b95
ncalrpc         : LRPC-85eb860f11f29b9b01
ncalrpc         : LRPC-4ef3a62e074c9cae5b
ncalrpc         : LRPC-514e2a0c21b20b4d9a
ncalrpc         : LRPC-135f73867046c3d66f
ncalrpc         : OLE7306F1ABD36F90ECF223B73622E2
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3524 at 0x5e18470L>
64
['ShellHWDetection']

Interfaces :
RPC  12345678-1234-abcd-ef00-0123456789ab (1.0) -- C:\WINDOWS\System32\spoolsv.exe
	0 -> RpcEnumPrinters
	1 -> RpcOpenPrinter
	2 -> RpcSetJob
	3 -> RpcGetJob
	4 -> RpcEnumJobs
	5 -> RpcAddPrinter
	6 -> RpcDeletePrinter
	7 -> RpcSetPrinter
	8 -> RpcGetPrinter
	9 -> RpcAddPrinterDriver
	10 -> RpcEnumPrinterDrivers
	11 -> RpcGetPrinterDriver
	12 -> RpcGetPrinterDriverDirectory
	13 -> RpcDeletePrinterDriver
	14 -> RpcAddPrintProcessor
	15 -> RpcEnumPrintProcessors
	16 -> RpcGetPrintProcessorDirectory
	17 -> RpcStartDocPrinter
	18 -> RpcStartPagePrinter
	19 -> RpcWritePrinter
	20 -> RpcEndPagePrinter
	21 -> RpcAbortPrinter
	22 -> RpcReadPrinter
	23 -> RpcEndDocPrinter
	24 -> RpcAddJob
	25 -> RpcScheduleJob
	26 -> RpcGetPrinterData
	27 -> RpcSetPrinterData
	28 -> RpcWaitForPrinterChange
	29 -> RpcClosePrinter
	30 -> RpcAddForm
	31 -> RpcDeleteForm
	32 -> RpcGetForm
	33 -> RpcSetForm
	34 -> RpcEnumForms
	35 -> RpcEnumPorts
	36 -> RpcEnumMonitors
	37 -> RpcAddPort
	38 -> RpcConfigurePort
	39 -> RpcDeletePort
	40 -> RpcCreatePrinterIC
	41 -> RpcPlayGdiScriptOnPrinterIC
	42 -> RpcDeletePrinterIC
	43 -> RpcAddPrinterConnection
	44 -> RpcDeletePrinterConnection
	45 -> RpcPrinterMessageBox
	46 -> RpcAddMonitor
	47 -> RpcDeleteMonitor
	48 -> RpcDeletePrintProcessor
	49 -> RpcAddPrintProvidor
	50 -> RpcDeletePrintProvidor
	51 -> RpcEnumPrintProcessorDatatypes
	52 -> RpcResetPrinter
	53 -> RpcGetPrinterDriver2
	54 -> RpcClientFindFirstPrinterChangeNotification
	55 -> RpcFindNextPrinterChangeNotification
	56 -> RpcFindClosePrinterChangeNotification
	57 -> NThreadingLibrary::TWorkItem::NotifyCancel
	58 -> RpcReplyOpenPrinter
	59 -> RpcRouterReplyPrinter
	60 -> RpcReplyClosePrinter
	61 -> RpcAddPortEx
	62 -> RpcRemoteFindFirstPrinterChangeNotification
	63 -> RpcSetAllocFailCount
	64 -> RpcResetPrinterEx
	65 -> RpcRemoteFindFirstPrinterChangeNotificationEx
	66 -> RpcRouterReplyPrinterEx
	67 -> RpcRouterRefreshPrinterChangeNotification
	68 -> RpcSetAllocFailCount
	69 -> RpcOpenPrinterEx
	70 -> RpcAddPrinterEx
	71 -> RpcSetPort
	72 -> RpcEnumPrinterData
	73 -> RpcDeletePrinterData
	74 -> NThreadingLibrary::TWorkItem::NotifyCancel
	75 -> NThreadingLibrary::TWorkItem::NotifyCancel
	76 -> NThreadingLibrary::TWorkItem::NotifyCancel
	77 -> RpcSetPrinterDataEx
	78 -> RpcGetPrinterDataEx
	79 -> RpcEnumPrinterDataEx
	80 -> RpcEnumPrinterKey
	81 -> RpcDeletePrinterDataEx
	82 -> RpcDeletePrinterKey
	83 -> RpcSeekPrinter
	84 -> RpcDeletePrinterDriverEx
	85 -> RpcAddPerMachineConnection
	86 -> RpcDeletePerMachineConnection
	87 -> RpcEnumPerMachineConnections
	88 -> RpcXcvData
	89 -> RpcAddPrinterDriverEx
	90 -> RpcSplOpenPrinter
	91 -> RpcGetSpoolFileInfo
	92 -> RpcCommitSpoolData
	93 -> RpcGetSpoolFileInfo2
	94 -> RpcCommitSpoolData2
	95 -> RpcCloseSpoolFileHandle
	96 -> RpcFlushPrinter
	97 -> RpcSendRecvBidiData
	98 -> RpcAddDriverCatalog
	99 -> RpcAddPrinterConnection2
	100 -> RpcInstallPrinterDriverFromPackage
	101 -> RpcUploadPrinterDriverPackage
	102 -> RpcGetCorePrinterDrivers
	103 -> RpcCorePrinterDriverInstalled
	104 -> RpcGetPrinterDriverPackagePath
	105 -> RpcDeletePrinterDriverPackage
	106 -> RpcFindCompatibleDriver
	107 -> RpcReportJobProcessingProgress
	108 -> RpcSetSpoolerPolicy
	109 -> RpcInternalGetPrinterDriver
	110 -> RpcGetJobNamedPropertyValue
	111 -> RpcSetJobNamedProperty
	112 -> RpcDeleteJobNamedProperty
	113 -> RpcEnumJobNamedProperties
	114 -> RpcCreateAppSandbox
	115 -> RpcGetUserPropertyBag
	116 -> RpcLogJobInfoForBranchOffice
RPC  0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 (1.0) -- C:\WINDOWS\System32\spoolsv.exe
	0 -> IRPCAsyncNotify_RegisterClient
	1 -> IRPCAsyncNotify_UnregisterClient
	2 -> IRPCAsyncNotify_GetServerRefferal
	3 -> IRPCAsyncNotify_GetNewChannel
	4 -> IRPCAsyncNotify_GetNotificationSendResponse
	5 -> IRPCAsyncNotify_GetNotification
	6 -> IRPCAsyncNotify_CloseChannel
RPC  ae33069b-a2a8-46ee-a235-ddfd339be281 (1.0) -- C:\WINDOWS\System32\spoolsv.exe
	0 -> IRPCRemoteObject_Create
	1 -> IRPCRemoteObject_Delete
RPC  4a452661-8290-4b36-8fbe-7f4093a94978 (1.0) -- C:\WINDOWS\System32\spoolsv.exe
	0 -> IRPCAsyncNotifyChannel_CreateChannel
	1 -> IRPCAsyncNotifyChannel_SendNotification
	2 -> IRPCAsyncNotifyChannel_SendNotificationGetResponse
	3 -> IRPCAsyncNotifyChannel_CloseChannel
RPC  76f03f96-cdfd-44fc-a22c-64950a001209 (1.0) -- C:\WINDOWS\System32\spoolsv.exe
	0 -> RpcAsyncOpenPrinter
	1 -> RpcAsyncAddPrinter
	2 -> RpcAsyncSetJob
	3 -> RpcAsyncGetJob
	4 -> RpcAsyncEnumJobs
	5 -> RpcAsyncAddJob
	6 -> RpcAsyncScheduleJob
	7 -> RpcAsyncDeletePrinter
	8 -> RpcAsyncSetPrinter
	9 -> RpcAsyncGetPrinter
	10 -> RpcAsyncStartDocPrinter
	11 -> RpcAsyncStartPagePrinter
	12 -> RpcAsyncWritePrinter
	13 -> RpcAsyncEndPagePrinter
	14 -> RpcAsyncEndDocPrinter
	15 -> RpcAsyncAbortPrinter
	16 -> RpcAsyncGetPrinterData
	17 -> RpcAsyncGetPrinterDataEx
	18 -> RpcAsyncSetPrinterData
	19 -> RpcAsyncSetPrinterDataEx
	20 -> RpcAsyncClosePrinter
	21 -> RpcAsyncAddForm
	22 -> RpcAsyncDeleteForm
	23 -> RpcAsyncGetForm
	24 -> RpcAsyncSetForm
	25 -> RpcAsyncEnumForms
	26 -> RpcAsyncGetPrinterDriver
	27 -> RpcAsyncEnumPrinterData
	28 -> RpcAsyncEnumPrinterDataEx
	29 -> RpcAsyncEnumPrinterKey
	30 -> RpcAsyncDeletePrinterData
	31 -> RpcAsyncDeletePrinterDataEx
	32 -> RpcAsyncDeletePrinterKey
	33 -> RpcAsyncXcvData
	34 -> RpcAsyncSendRecvBidiData
	35 -> RpcAsyncCreatePrinterIC
	36 -> RpcAsyncPlayGdiScriptOnPrinterIC
	37 -> RpcAsyncDeletePrinterIC
	38 -> RpcAsyncEnumPrinters
	39 -> RpcAsyncAddPrinterDriver
	40 -> RpcAsyncEnumPrinterDrivers
	41 -> RpcAsyncGetPrinterDriverDirectory
	42 -> RpcAsyncDeletePrinterDriver
	43 -> RpcAsyncDeletePrinterDriverEx
	44 -> RpcAsyncAddPrintProcessor
	45 -> RpcAsyncEnumPrintProcessors
	46 -> RpcAsyncGetPrintProcessorDirectory
	47 -> RpcAsyncEnumPorts
	48 -> RpcAsyncEnumMonitors
	49 -> RpcAsyncAddPort
	50 -> RpcAsyncSetPort
	51 -> RpcAsyncAddMonitor
	52 -> RpcAsyncDeleteMonitor
	53 -> RpcAsyncDeletePrintProcessor
	54 -> RpcAsyncEnumPrintProcessorDatatypes
	55 -> RpcAsyncAddPerMachineConnection
	56 -> RpcAsyncDeletePerMachineConnection
	57 -> RpcAsyncEnumPerMachineConnections
	58 -> RpcSyncRegisterForRemoteNotifications
	59 -> RpcSyncUnRegisterForRemoteNotifications
	60 -> RpcSyncRefreshRemoteNotifications
	61 -> RpcAsyncGetRemoteNotifications
	62 -> RpcAsyncInstallPrinterDriverFromPackage
	63 -> RpcAsyncUploadPrinterDriverPackage
	64 -> RpcAsyncGetCorePrinterDrivers
	65 -> RpcAsyncCorePrinterDriverInstalled
	66 -> RpcAsyncGetPrinterDriverPackagePath
	67 -> RpcAsyncDeletePrinterDriverPackage
	68 -> RpcAsyncReadPrinter
	69 -> RpcAsyncResetPrinter
	70 -> RpcAsyncGetJobNamedPropertyValue
	71 -> RpcAsyncSetJobNamedProperty
	72 -> RpcAsyncDeleteJobNamedProperty
	73 -> RpcAsyncEnumJobNamedProperties
	74 -> RpcAsyncLogJobInfoForBranchOffice
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
OLE  00000001-0000-0000-c000-000000000046 (0.0) -- IClassFactory
Endpoints :
ncalrpc         : LRPC-86933dfe29009d4e26
ncacn_np        : \pipe\spoolss
ncacn_ip_tcp    : 1541
ncalrpc         : OLEA8008E976AAC9D631AC104F46EEF
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3968 at 0x5e18208L>
64
['DiagTrack']

Interfaces :
RPC  4c9dbf19-d39e-4bb9-90ee-8f7179b20283 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcApi_IsScenarioActive
	1 -> UtcApi_EscalateScenario
	2 -> UtcApi_EscalateScenarioAsync
	3 -> UtcApi_IsEscalationRunning
	4 -> UtcApi_DownloadLatestSettingsForNamespace
	5 -> UtcApi_DownloadLatestSettingsForNamespaceAsync
	6 -> UtcApi_GetActiveScenarioList
	7 -> UtcApi_ForceUpload
	8 -> UtcApi_ResetUsageMetrics
	9 -> UtcApi_IsTraceRunning
	10 -> UtcApi_GetActiveTraceRuntime
	11 -> UtcApi_GetKnownTraceList
	12 -> UtcApi_DownloadLatestSettings
	13 -> UtcApi_ReloadSettings
	14 -> UtcApi_UpdateTimerConfiguration
	15 -> UtcApi_ClearTimerConfiguration
	16 -> UtcApi_GetNextScheduledFireTime
	17 -> UtcApi_GetTimerConfiguration
	18 -> UtcApi_GetCustomTraceList
	19 -> UtcApi_StartCustomTrace
	20 -> UtcApi_SnapCustomTrace
	21 -> UtcApi_StopCustomTrace
	22 -> UtcApi_EscalateScenario2
	23 -> UtcApi_EscalateScenarioAsync2
	24 -> UtcApi_GetActiveTraceInfo
	25 -> UtcApi_EnableWERLocalReports
	26 -> UtcApi_RestoreWERLocalReportsSettings
	27 -> UtcApi_QueryWERLocalReportsEnabled
	28 -> UtcApi_IsEscalationRunningEx
RPC  fd8be72b-a9cd-4b2c-a9ca-4ded242fbe4d (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcApi_SendSyntheticTrigger
	1 -> UtcApi_ChangeEtmPauseState
RPC  95095ec8-32ea-4eb0-a3e2-041f97b36168 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcTelemetryOptInApi_SetTelemetryOptIn
RPC  e38f5360-8572-473e-b696-1b46873beeab (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcTenantApi_RegisterTelemetryTenant
	1 -> UtcTenantApi_UnregisterTelemetryTenant
	2 -> UtcTenantApi_UpdateDailyUploadQuota
	3 -> UtcTenantApi_ForceUpload
RPC  d22895ef-aff4-42c5-a5b2-b14466d34ab4 (1.0) -- c:\windows\system32\diagtrack.dll
	0 -> UtcEventTranscriptApi_FetchTranscriptStats
	1 -> UtcEventTranscriptApi_FetchTranscriptRecordsPage
	2 -> UtcEventTranscriptApi_FetchTranscriptRecordPayload
	3 -> UtcEventTranscriptApi_FetchKnownTags
	4 -> UtcEventTranscriptApi_FetchEventTags
	5 -> UtcEventTranscriptApi_IsSampledIn
	6 -> UtcEventTranscriptApi_FetchTranscriptRecordsPage2
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  ac7f26f2-feb7-5b2a-8ac4-345bc62caede (0.0) -- IMapView<HSTRING,HSTRING>
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  e9bdaaf0-cbf6-5c72-be90-29cbf3a1319b (0.0) -- IIterable<IKeyValuePair<HSTRING,HSTRING> >
OLE  05eb86f1-7140-5517-b88d-cbaebe57e6b1 (0.0) -- IIterator<IKeyValuePair<HSTRING,HSTRING> >
OLE  60310303-49c5-52e6-abc6-a9b36eccc716 (0.0) -- IKeyValuePair<HSTRING,HSTRING>
OLE  199e065c-8195-55da-9c10-8aeaf9ac1062 (0.0) -- __FIVectorView_1_Windows__CSecurity__CAuthentication__CWeb__CCore__CWebTokenResponse
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
Endpoints :
ncalrpc         : LRPC-cb86006467d51636ea
ncalrpc         : OLE2D17161BF24248D2919A6BE91941
--------------------------------------------------------------------------------
<WinProcess "Sysmon.exe" pid 3980 at 0x5e18160L>
64
['Sysmon']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "EvtEng.exe" pid 4020 at 0x5e18588L>
64
['EvtEng']
[!!] Invalid rpcrt4 base: 0x1c4427e0000 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4036 at 0x5e186a0L>
64
['TrkWks']

Interfaces :
RPC  0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 (1.0) -- c:\windows\system32\cryptsvc.dll
	0 -> s_SSCertProtectFunction
RPC  2579ff35-0ab0-4e5a-88fa-1d88c4e0cb92 (2.0) -- C:\Windows\System32\crypttpmeksvc.dll
	0 -> s_SSTpmEndorsementKeyGetInfo
	1 -> s_SSTpmEndorsementKeyDecryptChallenge
	2 -> s_SSTpmAttestationCapable
	3 -> s_SSTpmGetAttestationForAik
	4 -> s_SSTpmGetManufacturerInfo
RPC  f50aac00-c7f3-428e-a022-a6b71bfb9d43 (2.0) -- C:\Windows\System32\cryptcatsvc.dll
	0 -> s_SSCatDBAddCatalog
	1 -> s_SSCatDBDeleteCatalog
	2 -> s_SSCatDBEnumCatalogs
	3 -> s_SSCatDBPauseResumeService
	4 -> s_SSCatDBRebuildDatabase
	5 -> s_SSCatDBPrepareForCall
	6 -> s_SSCatDBAddCatalog2
	7 -> s_SSCatDBSmartlockerDefenderCheck
RPC  1495a2be-b7a8-4299-9d3b-8825e5bcbfb9 (1.0) -- C:\Windows\System32\webauthn.dll
	0 -> s_SSCtapCommand
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : keysvc
ncalrpc         : OLE114FFE22F3EBA1BDE1F447BE0387
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4044 at 0x5e18b38L>
64
['DPS']

Interfaces :
RPC  78e5d322-59a2-4324-ae3f-8bc8de32bdfc (1.0) -- c:\windows\system32\sstpsvc.dll
	0 -> SstpSvcSetConfig
	1 -> SstpSvcGetConfig
	2 -> SstpSvcCreateUpdateTenantGatewayMapping
	3 -> SstpSvcRemoveTenantGatewayMapping
	4 -> SstpSvcGetTenantGatewayMapping
Endpoints :
ncalrpc         : SstpSvcRpc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4068 at 0x5e185f8L>
64
['stisvc']

Interfaces :
RPC  8c7a6de0-788d-11d0-9edf-444553540000 (2.0) -- c:\windows\system32\wiaservc.dll
	0 -> R_StiApiGetVersion
	1 -> R_StiApiEnableHwNotifications
	2 -> R_StiApiGetHwNotificationState
	3 -> R_StiApiLaunchApplication
	4 -> R_StiApiOpenDevice
	5 -> R_StiApiSubscribe
	6 -> R_StiApiGetLastNotificationData
	7 -> R_StiApiUnSubscribe
	8 -> R_StiApiCloseDevice
	9 -> R_StiApiLockDevice
	10 -> R_StiApiUnlockDevice
	11 -> R_WiaGetEventDataAsync
	12 -> OpenClientConnection
	13 -> CloseClientConnection
	14 -> RegisterUnregisterForEventNotification
	15 -> WiaGetRuntimetEventDataAsync
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
Endpoints :
ncalrpc         : STI_LRPC
ncalrpc         : OLE1E06AB5CC832699E14B490289211
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4080 at 0x5e18198L>
64
['WpnService']

Interfaces :
RPC  850cee52-3038-4277-b9b4-e05db8b2c35c (1.0) -- c:\windows\system32\das.dll
	0 -> DasCreateAssociationContextForApp
	1 -> DasCreateAssociationContextFromOobBlob
	2 -> DasStartEnumCeremonies
	3 -> DasSelectCeremony
	4 -> DasStartReadCeremonyData
	5 -> DasStartWriteCeremonyData
	6 -> DasStartFinalize
	7 -> DasStartDeviceStatusNotification
	8 -> DasCloseAssociationContext
	9 -> DasStartRemoveAssociation
	10 -> DasCreateImportExportContext
	11 -> DasStartAepImport
	12 -> DasStartAepExport
	13 -> DasCloseImportExportContext
RPC  a1d4eae7-39f8-4bca-8e72-832767f5082a (1.0) -- c:\windows\system32\das.dll
	0 -> DasCreateInboundContext
	1 -> DasStartListenForInboundAssociations
	2 -> DasGetInboundAssociationResult
	3 -> DasCloseInboundContext
	4 -> DasRegisterForInboundAssociationsAppActivation
	5 -> DasGetInboundAssociationResultForAppActivation
RPC  2e7d4935-59d2-4312-a2c8-41900aa5495f (1.0) -- c:\windows\system32\das.dll
	0 -> DasCreateChallengeContext
	1 -> DasStartChallengeDevicePresence
	2 -> DasCloseChallengeContext
RPC  bd84cd86-9825-4376-813d-334c543f89b1 (1.0) -- c:\windows\system32\das.dll
	0 -> RpcDevQueryCreate
	1 -> RpcDevQueryClose
	2 -> RpcDevQueryGetResult
	3 -> RpcDevPropertySet
RPC  5b665b9a-a086-4e26-ae24-96ab050b0ec3 (1.0) -- c:\windows\system32\das.dll
	0 -> DasCreateAepStoreAep
	1 -> DasDeleteAepStoreAep
	2 -> DasSetAepStoreAepProperties
Endpoints :
ncalrpc         : LRPC-84704d3fc3ab9c25d8
--------------------------------------------------------------------------------
<WinProcess "MsiTrueColorService.exe" pid 3116 at 0x5e18e48L>
64
['MsiTrueColorService']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "ZeroConfigService.exe" pid 4132 at 0x5e189b0L>
64
['ZeroConfigService']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "IntelCpHDCPSvc.exe" pid 4180 at 0x5dd8550L>
64
['cplspcon']

Interfaces :
RPC  2f5f6520-ca46-1067-b319-00dd010662da (1.0) -- c:\windows\system32\tapisrv.dll
	0 -> ClientAttach
	1 -> ClientRequest
	2 -> ClientDetach
RPC  2f5f6521-cb55-1059-b446-00df0bce31db (1.0) -- c:\windows\system32\unimdm.tsp
	0 -> notifSendFrame
Endpoints :
ncacn_np        : \pipe\tapsrv
ncalrpc         : tapsrvlpc
ncalrpc         : unimdmsvc
--------------------------------------------------------------------------------
<WinProcess "vmnetdhcp.exe" pid 4560 at 0x5dd8cc0L>
32
['VMnetDHCP']
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "vmnat.exe" pid 4604 at 0x5dd8cf8L>
32
['VMware NAT Service']
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "vmware-authd.exe" pid 4716 at 0x5dd8ac8L>
32
['VMAuthdService']
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 4728 at 0x5dd8b70L>
64
['WdiServiceHost']

Interfaces :
RPC  98716d03-89ac-44c7-bb8c-285824e51c4a (1.0) -- c:\windows\system32\srvsvc.dll
	0 -> XsOpenPrinter
	1 -> XsClosePrinter
	2 -> XsAddJob
	3 -> XsScheduleJob
	4 -> XsProcessPnp
	5 -> XsProcDownLevelAPI
RPC  1a0d010f-1c33-432c-b0f5-8cf4e8053099 (1.0) -- c:\windows\system32\srvsvc.dll
	0 -> IdSegRequestNextSequence
	1 -> IdSegRequestNodeInvalidation
RPC  4b324fc8-1670-01d3-1278-5a47bf6ee188 (3.0) -- c:\windows\system32\srvsvc.dll
	0 -> NetrCharDevControl
	1 -> NetrCharDevControl
	2 -> NetrCharDevControl
	3 -> NetrCharDevControl
	4 -> NetrCharDevControl
	5 -> NetrCharDevControl
	6 -> NetrCharDevControl
	7 -> NetrCharDevControl
	8 -> NetrConnectionEnum
	9 -> NetrFileEnum
	10 -> NetrFileGetInfo
	11 -> NetrFileClose
	12 -> NetrSessionEnum
	13 -> NetrSessionDel
	14 -> NetrShareAdd
	15 -> NetrShareEnum
	16 -> NetrShareGetInfo
	17 -> NetrShareSetInfo
	18 -> NetrShareDel
	19 -> NetrShareDelSticky
	20 -> NetrShareCheck
	21 -> NetrServerGetInfo
	22 -> NetrServerSetInfo
	23 -> NetrServerDiskEnum
	24 -> NetrServerStatisticsGet
	25 -> NetrServerTransportAdd
	26 -> NetrServerTransportEnum
	27 -> NetrServerTransportDel
	28 -> NetrRemoteTOD
	29 -> I_NetrServerSetServiceBits
	30 -> NetprPathType
	31 -> NetprPathCanonicalize
	32 -> NetprPathCompare
	33 -> NetprNameValidate
	34 -> NetprNameCanonicalize
	35 -> NetprNameCompare
	36 -> NetrShareEnumSticky
	37 -> NetrShareDelStart
	38 -> NetrShareDelCommit
	39 -> NetrpGetFileSecurity
	40 -> NetrpSetFileSecurity
	41 -> NetrServerTransportAddEx
	42 -> I_NetrServerSetServiceBitsEx
	43 -> NetrDfsGetVersion
	44 -> NetrCharDevControl
	45 -> NetrCharDevControl
	46 -> NetrCharDevControl
	47 -> NetrCharDevControl
	48 -> NetrCharDevControl
	49 -> NetrCharDevControl
	50 -> NetrCharDevControl
	51 -> NetrCharDevControl
	52 -> NetrCharDevControl
	53 -> NetrServerTransportDelEx
	54 -> NetrServerAliasAdd
	55 -> NetrServerAliasEnum
	56 -> NetrServerAliasDel
	57 -> NetrShareDelEx
	58 -> LocalrSessionEnum
	59 -> LocalrSessionGetInfo
	60 -> LocalrSessionDel
	61 -> LocalrFileEnum
	62 -> LocalrFileGetInfo
	63 -> LocalrFileClose
	64 -> LocalrShareEnum
	65 -> LocalrShareGetInfo
	66 -> LocalrShareSetInfo
	67 -> LocalrShareAdd
	68 -> LocalrShareDelEx
	69 -> LocalrAliasGet
	70 -> NetrServerTransportAddForInstance
	71 -> NetrServerTransportDelForInstance
Endpoints :
ncalrpc         : LRPC-f4d5bafb48cb6d0b45
ncacn_np        : \PIPE\srvsvc
--------------------------------------------------------------------------------
<WinProcess "vmms.exe" pid 4780 at 0x5dd88d0L>
64
['vmms']

Interfaces :
RPC  552d076a-cb29-4e44-8b6a-d15e59e2c0af (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> IpTransitionProtocolApplyConfigChanges
	1 -> IpTransitionProtocolApplyConfigChangesEx
RPC  ecbdb051-f208-46b9-8c8b-648d9d3f3944 (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> RefreshTeredoState
	1 -> ResetDisabledComponentsForTeredo
RPC  1fff8faa-ec23-4e3f-a8ce-4b2f8707e636 (1.0) -- c:\windows\system32\iphlpsvc.dll
	0 -> TeredoCreateConsumerHandle
	1 -> TeredoCloseConsumerHandle
RPC  2e6035b2-e8f1-41a7-a044-656b439c4c34 (1.0) -- C:\WINDOWS\system32\httpprxm.dll
	0 -> ProxyMgrProviderRegisterForEventNotification
	1 -> ProxyMgrProviderUnregisterEventNotification
	2 -> ProxyMgrProviderGetNotification
	3 -> ProxyMgrGetProxyEventInformation
	4 -> ProxyMgrSetProxyConfiguration
	5 -> ProxyMgrSetProxyCredentials
RPC  c36be077-e14b-4fe9-8abc-e856ef4f048b (1.0) -- C:\WINDOWS\system32\httpprxm.dll
	0 -> RpcSrvProxyMgrClientRegisterForEventNotification
	1 -> RpcSrvProxyMgrClientGetNotification
	2 -> RpcSrvProxyMgrClientUnregisterEventNotification
	3 -> RpcSrvProxyMgrClientGetProxyForUrl
	4 -> RpcSrvProxyMgrClientGetProxyCredentials
	5 -> RpcSrvProxyMgrClientGetAllProxiesForUrl
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
RPC  c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 (1.0) -- C:\WINDOWS\system32\adhsvc.dll
	0 -> Rpc_AdhEngineOpen
	1 -> Rpc_AdhEngineClose
	2 -> Rpc_AdhStatusEventSubscribe
	3 -> Rpc_AdhStatusEventSubscriptionGetLastEvent
	4 -> Rpc_AdhStatusEventUnsubscribe
	5 -> Rpc_AdhGetConfig
	6 -> Rpc_AdhGetEvidenceCollectorResult
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
Endpoints :
ncalrpc         : LRPC-468ba3aa8e54f640a8
ncalrpc         : TeredoDiagnostics
ncalrpc         : TeredoControl
ncalrpc         : OLE8D3C864969A59979DAAEDA313AF1
--------------------------------------------------------------------------------
<WinProcess "vmware-usbarbitrator64.exe" pid 4808 at 0x5dd8f28L>
64
['VMUSBArbService']

Interfaces :
RPC  20610036-fa22-11cf-9823-00a0c911e5df (1.0) -- c:\windows\system32\rasmans.dll
	0 -> RasRpcPortEnum
	1 -> RasRpcDeviceEnum
	2 -> RasRpcGetDevConfig
	3 -> RasRpcPortGetInfo
	4 -> RasRpcEnumConnections
	5 -> RasRpcDeleteEntry
	6 -> RasRpcGetErrorString
	7 -> RasRpcGetCountryInfo
	8 -> RasRpcGetInstalledProtocols
	9 -> RasRpcGetUserPreferences
	10 -> RasRpcSetUserPreferences
	11 -> RasRpcGetSystemDirectory
	12 -> RasRpcSubmitRequest
	13 -> RasRpcSubmitRequestLocal
	14 -> RasRpcGetInstalledProtocolsEx
	15 -> RasRpcGetVersion
RPC  81ee95a8-882e-4615-888a-53344ca149e4 (1.0) -- C:\WINDOWS\system32\vpnike.dll
	0 -> VpnikeCreateTunnel
	1 -> VpnikeUpdateTunnel
	2 -> VpnikeCloseTunnel
	3 -> VpnikeGetCfgPayloadRequest
	4 -> VpnikeProcessCfgPayloadReply
	5 -> VpnikeProcessCfgPayloadRequest
	6 -> VpnikeNewRasIncomingCall
	7 -> VpnikeGetTsRequest
	8 -> VpnikeProcessTsReply
	9 -> VpnikeProcessTsRequest
	10 -> VpnikeRemoveTs
	11 -> VpnikeGetServerEapAuthRequestPacket
	12 -> VpnikeProcessEapAuthPacket
	13 -> VpnikeQueryEapAuthAttributes
	14 -> VpnIkeProcessAdditionalAddressNotification
	15 -> VpnikeCreateIDPayload
	16 -> VpnikeTunnelAuthDone
	17 -> VpnikeCreateOptionalIDrPayload
RPC  650a7e26-eab8-5533-ce43-9c1dfce11511 (1.0) -- C:\WINDOWS\system32\rascustom.dll
	0 -> Rpc_VpnProtEngOpen
	1 -> Rpc_VpnProtEngClose
	2 -> Rpc_VpnProtEngEventSubscribe
	3 -> Rpc_VpnProtEngEventSubscriptionGetLastEvent
	4 -> Rpc_VpnProtEngEventUnsubscribe
	5 -> Rpc_VpnProtEngSendGetCredentialsRequest
	6 -> Rpc_VpnProtEngSendNegotiatingNetworkRequest
	7 -> Rpc_VpnProtEngSendInterfaceCreateRequest
	8 -> Rpc_VpnProtEngSendInterfaceDestroyRequest
	9 -> Rpc_VpnProtEngSendConnectError
	10 -> Rpc_VpnProtEngGetConfiguration
	11 -> Rpc_VpnProtEngGetBestCostInterface
	12 -> Rpc_VpnProtEngGetStatementOfHealth
	13 -> Rpc_VpnProtEngSetKeepAliveFrequencyOverrideRequest
	14 -> Rpc_VpnProtEngSendGetCustomPromptRequest
	15 -> Rpc_VpnProtEngSendGetCertificateConsentBlankUiRequest
	16 -> Rpc_VpnProtEngSendCloseCertificateConsentBlankUiRequest
	17 -> Rpc_VpnProtEngPluginInstall
	18 -> Rpc_VpnProtEngPluginUninstall
	19 -> Rpc_VpnProtEngSetCostNetworkSettings
	20 -> Rpc_VpnProtEngGetCostNetworkSettings
	21 -> Rpc_VpnProtEngExecuteAndCaptureLogs
	22 -> Rpc_VpnProtEngGetInterface
	23 -> Rpc_VpnProtEngPluginEnumerate
	24 -> Rpc_VpnProtEngAddProfileFromXml
	25 -> Rpc_VpnProtEngWinRtConnect
	26 -> Rpc_VpnProtEngWinRtDisconnect
	27 -> Rpc_VpnProtEngWinRtEnumerate
	28 -> Rpc_VpnProtEngWinRtGetEapBlob
	29 -> Rpc_VpnProtEngWinRtGetEapXml
	30 -> Rpc_VpnProtEngWinRtGetMoniker
	31 -> Rpc_VpnProtEngWinRtGetConnectionStatus
	32 -> Rpc_VpnProtEngWinRtUpdateRegistryProfileList
	33 -> Rpc_VpnProtEngGetProxyForUrlAndSingleSessionDeviceUser
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
Endpoints :
ncacn_np        : \PIPE\ROUTER
ncalrpc         : RasmanLrpc
ncalrpc         : VpnikeRpc
ncalrpc         : LRPC-ac14c3be97f6e49e09
ncalrpc         : OLEE9C19143A346A740C8B1E9E8B3E7
--------------------------------------------------------------------------------
<WinProcess "dasHost.exe" pid 5088 at 0x5dd8978L>
64

Interfaces :
RPC  eeee008d-5c99-4e4b-861b-547a26e8abd0 (1.0) -- C:\WINDOWS\system32\dashost.exe
	0 -> DasHostLoadProvider
	1 -> DasHostSetDasProcessHandle
	2 -> DasHostUnloadProvider
	3 -> DasHostShutdown
	4 -> DasHostCreateProviderQuery
	5 -> DasHostCloseQuery
	6 -> DasHostProviderQueryGetResult
	7 -> DasHostCreateAssociationContext
	8 -> DasHostCreateAssociationContextFromOobBlob
	9 -> DasHostStartEnumCeremonies
	10 -> DasHostSelectCeremony
	11 -> DasHostStartReadCeremonyData
	12 -> DasHostStartWriteCeremonyData
	13 -> DasHostStartFinalize
	14 -> DasHostDeviceStatusNotification
	15 -> DasHostStartRemoveAssociation
	16 -> DasHostCloseAssociationContext
	17 -> DasHostCreateDevnodeManagementContext
	18 -> DasHostStartDevnodeManagement
	19 -> DasHostEndDevnodeManagement
	20 -> DasHostPickupDevnodeManagementOperation
	21 -> DasHostGetDevnodeFactoryOperationInfo
	22 -> DasHostCompleteDevnodeFactoryOperation
	23 -> DasHostGetDevnodeOperationInfo
	24 -> DasHostCompleteDevnodeOperation
	25 -> DasHostCloseDevnodeManagementContext
	26 -> DasHostCreateChallengeContext
	27 -> DasHostStartChallengeDevicePresence
	28 -> DasHostCloseChallengeContext
	29 -> DasHostCreateImportExportContext
	30 -> DasHostStartImport
	31 -> DasHostStartExport
	32 -> DasHostCloseImportExportContext
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : DasHostCC{8d6a4f7a-48c7-4547-be8ba9c99a2bab25}
ncalrpc         : OLED67D46C9255848EC676551EAFAA7
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 5932 at 0x5dd8080L>
64
['PolicyAgent']

Interfaces :
RPC  12345678-1234-abcd-ef00-0123456789ab (1.0) -- c:\windows\system32\ipsecsvc.dll
	0 -> RpcAddTransportFilter
	1 -> RpcDeleteTransportFilter
	2 -> RpcEnumTransportFilters
	3 -> RpcSetTransportFilter
	4 -> RpcGetTransportFilter
	5 -> RpcAddQMPolicy
	6 -> RpcDeleteQMPolicy
	7 -> RpcEnumQMPolicies
	8 -> RpcSetQMPolicy
	9 -> RpcGetQMPolicy
	10 -> RpcAddMMPolicy
	11 -> RpcDeleteMMPolicy
	12 -> RpcEnumMMPolicies
	13 -> RpcSetMMPolicy
	14 -> RpcGetMMPolicy
	15 -> RpcAddMMFilter
	16 -> RpcDeleteMMFilter
	17 -> RpcEnumMMFilters
	18 -> RpcSetMMFilter
	19 -> RpcGetMMFilter
	20 -> RpcMatchMMFilter
	21 -> RpcMatchTransportFilter
	22 -> RpcGetQMPolicyByID
	23 -> RpcGetMMPolicyByID
	24 -> RpcAddMMAuthMethods
	25 -> RpcDeleteMMAuthMethods
	26 -> RpcEnumMMAuthMethods
	27 -> RpcSetMMAuthMethods
	28 -> RpcGetMMAuthMethods
	29 -> RpcAddSAs
	30 -> RpcAddSAs
	31 -> RpcAddSAs
	32 -> RpcEnumMMSAs
	33 -> RpcDeleteMMSAs
	34 -> RpcDeleteQMSAs
	35 -> RpcQueryIKEStatistics
	36 -> RpcAddSAs
	37 -> RpcAddSAs
	38 -> RpcAddSAs
	39 -> RpcQueryIPSecStatistics
	40 -> RpcEnumQMSAs
	41 -> RpcAddTunnelFilter
	42 -> RpcDeleteTunnelFilter
	43 -> RpcEnumTunnelFilters
	44 -> RpcSetTunnelFilter
	45 -> RpcGetTunnelFilter
	46 -> RpcMatchTunnelFilter
	47 -> RpcOpenMMFilterHandle
	48 -> RpcCloseMMFilterHandle
	49 -> RpcOpenTransportFilterHandle
	50 -> RpcCloseTransportFilterHandle
	51 -> RpcOpenTunnelFilterHandle
	52 -> RpcCloseTunnelFilterHandle
	53 -> RpcEnumIpsecInterfaces
	54 -> RpcAddSAs
	55 -> RpcSetConfigurationVariables
	56 -> RpcGetConfigurationVariables
	57 -> RpcQuerySpdPolicyState
	58 -> RpcAddMMFilterEx
	59 -> RpcEnumMMFiltersEx
	60 -> RpcSetMMFilterEx
	61 -> RpcGetMMFilterEx
	62 -> RpcMatchMMFilterEx
	63 -> RpcOpenMMFilterHandleEx
	64 -> RpcAddTransportFilterEx
	65 -> RpcEnumTransportFiltersEx
	66 -> RpcSetTransportFilterEx
	67 -> RpcGetTransportFilterEx
	68 -> RpcMatchTransportFilterEx
	69 -> RpcOpenTransportFilterHandleEx
	70 -> RpcQueryRemoteFWRunning
Endpoints :
ncalrpc         : ipsec
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 5940 at 0x5dd8c50L>
64
['SSDPSRV']

Interfaces :
RPC  4b112204-0e19-11d3-b42b-0000f81feb9f (1.0) -- c:\windows\system32\ssdpsrv.dll
	0 -> _SSDPOpenRpc
	1 -> _SSDPCloseRpc
	2 -> RegisterServiceExRpc
	3 -> _DeregisterServiceRpc
	4 -> CleanupCacheRpc
	5 -> BeginSearchRpc
	6 -> GetSearchNotificationRpc
	7 -> CancelSearchRpc
	8 -> CloseSearchRpc
	9 -> EnableNotificationRpc
	10 -> _InitializeSyncHandle
	11 -> _RemoveSyncHandle
	12 -> RegisterNotificationRpc
	13 -> RegisterNotificationAsyncRpc
	14 -> _GetNotificationRpc
	15 -> _WakeupGetNotificationRpc
	16 -> DeregisterNotificationRpc
	17 -> SetICSInterfaces
	18 -> SetICSOff
	19 -> EnableFirewallRuleRpc
	20 -> DisableFirewallRuleRpc
Endpoints :
ncalrpc         : LRPC-5e723fcc225d082187
--------------------------------------------------------------------------------
<WinProcess "WmiPrvSE.exe" pid 5452 at 0x5dd8588L>
64

Interfaces :
RPC  e7a216af-1ec1-447f-8d3f-a87278db564d (1.0) -- C:\WINDOWS\system32\vmcompute.exe
	0 -> HcsRpc_EnumerateSystems
	1 -> HcsRpc_CreateSystem
	2 -> HcsRpc_OpenSystem
	3 -> HcsRpc_StartSystem
	4 -> HcsRpc_ShutdownSystem
	5 -> HcsRpc_TerminateSystem
	6 -> HcsRpc_PauseSystem
	7 -> HcsRpc_ResumeSystem
	8 -> HcsRpc_SaveSystem
	9 -> HcsRpc_GetSystemProperties
	10 -> HcsRpc_ModifySystem
	11 -> HcsRpc_AddSystemResource
	12 -> HcsRpc_ModifySystemResource
	13 -> HcsRpc_RemoveSystemResource
	14 -> HcsRpc_RegisterSystemNotifications
	15 -> HcsRpc_UnregisterSystemNotifications
	16 -> HcsRpc_QuerySystemNotification
	17 -> HcsRpc_CloseSystem
	18 -> HcsRpc_CreateProcess
	19 -> HcsRpc_OpenProcess
	20 -> HcsRpc_SignalProcess
	21 -> HcsRpc_GetProcessInfo
	22 -> HcsRpc_GetProcessProperties
	23 -> HcsRpc_ModifyProcess
	24 -> HcsRpc_RegisterProcessNotifications
	25 -> HcsRpc_UnregisterProcessNotifications
	26 -> HcsRpc_QueryProcessNotification
	27 -> HcsRpc_CloseProcess
	28 -> HcsRpc_GetServiceProperties
	29 -> HcsRpc_ModifyServiceSettings
Endpoints :
ncalrpc         : LRPC-4068c498fbc5b167b0
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 6888 at 0x5dd8b38L>
64
['hns']

Interfaces :
RPC  0767a036-0d22-48aa-ba69-b619480f38cb (1.0) -- c:\windows\system32\pcasvc.dll
	0 -> RAiMonitorProcess
	1 -> RAiSendToService
	2 -> RAiNotifyMsiInstall
	3 -> RAiLinkChildToParent
	4 -> RAiGetFileInfoFromPath
Endpoints :
ncalrpc         : LRPC-3dbea9ac2075148991
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 7148 at 0x5dd8dd8L>
64
['SharedAccess']

Interfaces :
RPC  e64b9aee-f372-4312-9a14-8f1502b5c8e3 (1.0) -- c:\windows\system32\ipnathlp.dll
	0 -> IpNatHlpRpcServerGetConnectedDevices
	1 -> IpNatHlpRpcServerStartSharing
	2 -> IpNatHlpRpcServerStopSharing
	3 -> IpNatHlpRpcServerStartDhcpServer
	4 -> IpNatHlpRpcServerStopDhcpServer
	5 -> IpNatHlpRpcServerUpdateSharingSettingsFromStorage
	6 -> V2IpNatHlpRpcServerStartSharingByInternalPrefix
	7 -> V2IpNatHlpRpcServerStopSharingByInternalPrefix
	8 -> V2IpNatHlpRpcServerStartDhcpServer
	9 -> V2IpNatHlpRpcServerStopDhcpServer
	10 -> V2IpNatHlpRpcServerStartDnsServer
	11 -> V2IpNatHlpRpcServerStopDnsServer
	12 -> V2IpNatHlpRpcServerEnumDhcpState
	13 -> V2IpNatHlpRpcServerEnumDnsState
	14 -> V2IpNatHlpRpcServerCreateStaticMapping
	15 -> V2IpNatHlpRpcServerDeleteStaticMapping
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-50c214ea8705fbab3a
ncalrpc         : OLE2DC3BB3BCF471E67CEF1904EADCD
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 3436 at 0x5dd8f60L>
64
['nvagent']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 6992 at 0x5dd86d8L>
64
['TabletInputService']

Interfaces :
RPC  0497b57d-2e66-424f-a0c6-157cd5d41700 (1.0) -- c:\windows\system32\appinfo.dll
	0 -> RAiLaunchProcessWithIdentity
	1 -> RAiGetPackageActivationToken
	2 -> RAiFinishPackageActivation
	3 -> RAiEnsurePackageShutdown
RPC  201ef99a-7fa0-444c-9399-19ba84f12a1a (1.0) -- c:\windows\system32\appinfo.dll
	0 -> RAiLaunchAdminProcess
	1 -> RAiProcessRunOnce
	2 -> RAiLogonWithSmartCardCreds
	3 -> RAiOverrideDesktopPromptPolicy
	4 -> RAiDisableElevationForSession
	5 -> RAiEnableElevationForSession
	6 -> RAiForceElevationPromptForCOM
RPC  5f54ce7d-5b79-4175-8584-cb65313a0e98 (1.0) -- c:\windows\system32\appinfo.dll
	0 -> RAiGetTokenForCOM
RPC  fd7a0523-dc70-43dd-9b2e-9c5ed48225b1 (1.0) -- c:\windows\system32\appinfo.dll
	0 -> RAiGetTokenForMSI
RPC  58e604e8-9adb-4d2e-a464-3b0683fb1480 (1.0) -- c:\windows\system32\appinfo.dll
	0 -> RAiGetTokenForAxIS
Endpoints :
ncalrpc         : LRPC-2c336e65039e36772a
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 8844 at 0x5dd8f98L>
64
['TokenBroker']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "IAStorDataMgrSvc.exe" pid 9152 at 0x5dd82e8L>
32
['IAStorDataMgrSvc']
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "SgrmBroker.exe" pid 11100 at 0x5dd8390L>
64
['SgrmBroker']

Interfaces :
RPC  7a20fcec-dec4-4c59-be57-212e8f65d3de (1.0) -- C:\WINDOWS\system32\SgrmBroker.exe
	0 -> s_SgrmGetReport
	1 -> s_SgrmRegisterSense
	2 -> s_SgrmUnregisterSense
Endpoints :
ncalrpc         : SgrmRpc
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 6612 at 0x5dd87f0L>
64
['wscsvc']

Interfaces :
RPC  be7f785e-0e3a-4ab7-91de-7e46e443be29 (0.0) -- c:\windows\system32\storsvc.dll
	0 -> SvcMountVolume
	1 -> SvcDismountVolume
	2 -> SvcFormatVolume
	3 -> SvcGetStorageInstanceCount
	4 -> SvcGetStorageDeviceInfo
	5 -> CCleanupPolicy::CleanupItem
	6 -> SvcResetPhone
	7 -> SvcRebootToFlashingMode
	8 -> SvcRebootToUosFlashing
	9 -> SvcFinalizeVolume
	10 -> SvcGetStorageSettings
	11 -> SvcResetStoragePolicySettings
	12 -> SvcSetStorageSettings
	13 -> SvcTriggerStorageCleanup
	14 -> SvcTriggerLowStorageNotification
	15 -> SvcMoveFileInheritSecurity
	16 -> SvcScanVolume
	17 -> SvcProcessStorageCardChange
	18 -> SvcProvisionForAppInstall
	19 -> SvcGetStorageInstanceCountForMaps
	20 -> SvcGetStoragePolicySettings
	21 -> SvcSetStoragePolicySettings
	22 -> SvcTriggerStoragePolicies
	23 -> SvcPredictStorageHealth
RPC  54b4c689-969a-476f-8dc2-990885e9f562 (0.0) -- c:\windows\system32\storsvc.dll
	0 -> SvcOpenStorageType
	1 -> SvcSelectStorageVolumeEx
	2 -> SvcSelectStorageVolume
	3 -> SvcFindNextStorageType
	4 -> SvcFindNextStorageTypeEx
	5 -> SvcCloseFindStorage
	6 -> SvcGetStorageDebugInfo
	7 -> SvcGetStorageExecutionInfo
	8 -> SvcGetTopFolders
	9 -> SvcFindNextStorageTypeExAsync
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-916a7dc50d8ab310bd
ncalrpc         : OLE2CDE8F840013580E84B91408DB75
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 13288 at 0x5dd82b0L>
64
['LicenseManager']

Interfaces :
RPC  98e96949-bc59-47f1-92d1-8c25b46f85c7 (1.0) -- C:\WINDOWS\system32\WLANExt.exe
	0 -> RpcDot11ExtIhvInitService
	1 -> RpcDot11ExtIhvDeinitService
	2 -> RpcDot11ExtIhvInitAdapter
	3 -> RpcDot11ExtIhvDeinitAdapter
	4 -> RpcDot11ExtIhvProcessSessionChange
	5 -> RpcDot11ExtIhvIsUIRequestPending
	6 -> RpcDot11ExtIhvPerformCapabilityMatch
	7 -> RpcDot11ExtIhvValidateProfile
	8 -> RpcDot11ExtIhvPerformPreAssociate
	9 -> RpcDot11ExtIhvAdapterReset
	10 -> RpcDot11ExtIhvCreateDiscoveryProfiles
	11 -> RpcDot11ExtIhvProcessUIResponse
	12 -> RpcDot11ExtIhvQueryUIRequest
	13 -> RpcDot11ExtIhvOnexIndicateResult
	14 -> RpcDot11ExtIhvControl
RPC  a111f1c6-5923-47c0-9a68-d0bafb577901 (1.0) -- C:\Windows\System32\NetSetupShim.dll
	0 -> RpcNetSetup_NotifyHost_Connect
	1 -> RpcNetSetup_NotifyHost_Disconnect
	2 -> RpcNetSetup_Isolation_ExecuteInfSection
	3 -> RpcNetSetup_NotifyObject_Load
	4 -> RpcNetSetup_NotifyObject_Unload
	5 -> RpcNetSetup_ComponentControl_Initialize
	6 -> RpcNetSetup_ComponentControl_ApplyChanges
	7 -> RpcNetSetup_ComponentControl_ApplyPnpChanges
	8 -> RpcNetSetup_ComponentControl_CancelChanges
	9 -> RpcNetSetup_ComponentSetup_Install
	10 -> RpcNetSetup_ComponentSetup_Upgrade
	11 -> RpcNetSetup_ComponentSetup_Removing
	12 -> RpcNetSetup_NotifyBinding_QueryBindingPath
	13 -> RpcNetSetup_NotifyBinding_NotifyBindingPath
	14 -> RpcNetSetup_NotifyGlobal_GetSupportedNotifications
	15 -> RpcNetSetup_NotifyGlobal_SysQueryBindingPath
	16 -> RpcNetSetup_NotifyGlobal_SysNotifyBindingPath
	17 -> RpcNetSetup_NotifyGlobal_SysNotifyComponent
Endpoints :
ncalrpc         : LRPC-88cce70afd054e6103
--------------------------------------------------------------------------------
<WinProcess "conhost.exe" pid 5808 at 0x5dd89e8L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 9728 at 0x5dd8eb8L>
64
['wlidsvc']

Interfaces :
RPC  cc105610-da03-467e-bc73-5b9e2937458d (1.0) -- c:\windows\system32\wlidsvc.dll
	0 -> WLIDPublishService
	1 -> WLIDUnpublishService
	2 -> WLIDResolveDevice
	3 -> WLIDResolveUser
	4 -> WLIDConnectIdentity
	5 -> WLIDUpdateConnectedIdentity
	6 -> WLIDCompleteConnect
	7 -> WLIDDisconnectIdentity
	8 -> WLIDCreateIdentity
	9 -> WLIDDeleteIdentity
	10 -> WLIDImportIdentity
	11 -> WLIDGetLocalDeviceName
	12 -> WLIDCreateContext
	13 -> WLIDCreateContextWithLogonId
	14 -> WLIDSetAuthData
	15 -> WLIDDeleteContext
	16 -> WLIDGetServiceConfig
	17 -> WLIDAcquireTokens
	18 -> WLIDUpdateToken
	19 -> WLIDAddOrDeleteColorSetCookie
	20 -> WLIDWatsonReport
	21 -> WLIDGetCachedTokens
	22 -> WLIDGetExtendedError
	23 -> WLIDGetUserExtendedProperty
	24 -> WLIDSetUserExtendedProperty
	25 -> WLIDGetIdentityProperty
	26 -> WLIDSetOptions
	27 -> WLIDEnumIdentities
	28 -> WLIDHasPersistedCredential
	29 -> WLIDPersistCredential
	30 -> WLIDPersistCredentialForConnectedUser
	31 -> WLIDRemovePersistedCredential
	32 -> WLIDVerifyAssertion
	33 -> WLIDGetDeviceId
	34 -> WLIDProvisionDeviceId
	35 -> WLIDGetDeviceIdEx
	36 -> WLIDRenewDeviceId
	37 -> WLIDDeProvisionDeviceId
	38 -> WLIDEnumDevices
	39 -> WLIDAssociateDeviceToUser
	40 -> WLIDDisassociateDeviceFromUser
	41 -> WLIDEnumerateUserAssociatedDevices
	42 -> WLIDUpdateUserAssociatedDeviceProperties
	43 -> WLIDCreateContextForLinkedIdentity
	44 -> WLIDAddUserToSsoGroup
	45 -> WLIDGetUsersFromSsoGroup
	46 -> WLIDRemoveUserFromSsoGroup
	47 -> WLIDGetAuthError
	48 -> WLIDGetDeviceShortLivedToken
	49 -> WLIDGetHIPChallenge
	50 -> WLIDSetHIPSolution
	51 -> WLIDSetDefaultUserForTarget
	52 -> WLIDGetDefaultUserForTarget
	53 -> WLIDIsKioskMode
	54 -> WLIDGetConfigString
	55 -> WLIDGetSvcEnvironment
	56 -> WLIDGetIdName
	57 -> WLIDGetConfigDWORDValue
	58 -> WLIDGetUserPropertiesFromSystemStore
	59 -> WLIDSetUserPropertiesToSystemStore
	60 -> WLIDInitializeEx
	61 -> WLIDEnableTrace
	62 -> WLIDDisableTrace
	63 -> WLIDGetOneTimeCredential
	64 -> WLIDGetIssuerCertificate
	65 -> WLIDCreateContextWithChallenge
	66 -> WLIDGetDefaultUserForTargetEx
	67 -> WLIDSendOneTimeCode
	68 -> WLIDGetUserPropertiesFromHandle
	69 -> WLIDGetKeyLatest
	70 -> WLIDGetKeyWithVersion
	71 -> WLIDGetOpenHandlesData
	72 -> WLIDGetSignedTokens
	73 -> WLIDGetDeviceDAToken
	74 -> WLIDGetProofOfPossessionTokens
	75 -> WLIDRegisterUserIdkey
	76 -> WLIDUpdateDeviceLicenseInfo
	77 -> WLIDManageApprover
	78 -> WLIDListSessions
	79 -> WLIDApproveSession
	80 -> WLIDGetScenarioInlineUrlWithContextData
	81 -> WLIDGetInlineUrlContextData
	82 -> WLIDAcquireTokensWithNGC
	83 -> WLIDGetTotpCode
	84 -> WLIDCleanupIdentity
	85 -> WLIDGetAppData
RPC  faf2447b-b348-4feb-8dbe-beee5b7f7778 (1.0) -- c:\windows\system32\wlidsvc.dll
	0 -> RenewCertificate
RPC  572e35b4-1344-4565-96a1-f5df3bfa89bb (1.0) -- c:\windows\system32\wlidsvc.dll
	0 -> WLIDNCreateContext
	1 -> WLIDNDeleteContext
	2 -> WLIDNGetNextNotification
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
Endpoints :
ncalrpc         : LRPC-a88769e55cac7e04eb
ncalrpc         : liveidsvcnotify
ncalrpc         : OLE843CCE9586FB30A70A5793E2BFE5
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 11728 at 0x5dd8828L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "winlogon.exe" pid 1324 at 0x5dd8278L>
64

Interfaces :
RPC  76f226c3-ec14-4325-8a99-6a46348418ae (1.0) -- C:\WINDOWS\System32\WinLogon.exe
	0 -> I_WMsgkSendMessage
	1 -> I_WMsgSendPSPMessage
RPC  76f226c3-ec14-4325-8a99-6a46348418af (1.0) -- C:\WINDOWS\System32\WinLogon.exe
	0 -> I_WMsgSendMessage
	1 -> I_WMsgSendPSPMessage
	2 -> I_WMsgSendNotifyMessage
	3 -> I_WMsgSendReconnectionUpdateMessage
RPC  12e65dd8-887f-41ef-91bf-8d816c42c2e7 (1.0) -- C:\WINDOWS\System32\WinLogon.exe
	0 -> WlSecureDesktoprPromptingRequest
	1 -> WlSecureDesktoprConfirmationRequest
	2 -> WlSecureDesktoprCredmanBackupRequest
	3 -> WlSecureDesktoprCredmanRestoreRequest
	4 -> WlSecureDesktoprSimulateSAS
Endpoints :
ncalrpc         : WMsgKRpc01841F46E2
--------------------------------------------------------------------------------
<WinProcess "fontdrvhost.exe" pid 5920 at 0x5dd8198L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "dwm.exe" pid 3952 at 0x5dd81d0L>
64

Interfaces :
RPC  9d420415-b8fb-4f4a-8c53-4502ead30ca9 (1.0) -- C:\WINDOWS\System32\PlaySndSrv.dll
	0 -> I_PlaySoundkPostMessage
RPC  cad784cb-4c1b-4d96-b8f7-4716b568b13c (1.0) -- C:\WINDOWS\system32\wininet.dll
	0 -> s_UrlCacheGetManagerInterface
	1 -> StaticProxyResolver::CancelAll
	2 -> s_UrlCacheOpenContainer
	3 -> s_UrlCacheCloseContainer
	4 -> s_UrlCacheSetContainerEntryMaximumAge
	5 -> s_UrlCacheAddUrl
	6 -> s_UrlCacheLookupUrl
	7 -> s_UrlCacheCheckUrlsExist
	8 -> s_UrlCacheGetUrlBinaryBlob
	9 -> s_UrlCacheAddUrlBinaryBlob
	10 -> s_UrlCacheDeleteUrl
	11 -> s_UrlCacheUnlockUrl
	12 -> s_UrlCacheUpdateUrl
	13 -> s_UrlCacheEntryEnum
	14 -> s_UrlCacheEntryEnumClose
	15 -> s_UrlCacheEntryEnumNext
	16 -> s_UrlCacheCleanupUrls
	17 -> s_UrlCacheCleanupHttpsUrls
	18 -> s_UrlCacheGetSize
	19 -> s_UrlCacheGetLimit
	20 -> s_UrlCacheSetLimit
	21 -> s_UrlCacheGetCrossContainerContentTotalSizeAndLimit
	22 -> s_UrlCacheCleanupCrossContainers
	23 -> s_UrlCacheGetBloomFilter
	24 -> s_UrlCacheReleaseBloomFilter
	25 -> s_UrlCacheGetNextDirectory
	26 -> s_UrlCacheAddLeakFile
	27 -> s_UrlCacheCreateGroup
	28 -> s_UrlCacheDeleteGroup
	29 -> s_UrlCacheGetGroupIds
	30 -> s_UrlCacheGetGroup
	31 -> s_UrlCacheUpdateGroup
	32 -> s_UrlCacheSetUrlGroup
	33 -> s_UrlCacheGetContentContainerDirectories
	34 -> s_UrlCacheCreateExtensibleContainer
	35 -> s_UrlCacheDeleteExtensibleContainer
	36 -> s_UrlCacheGetExtensibleContainersList
	37 -> s_UrlCacheRpcSetGlobalLimit
	38 -> s_UrlCacheRpcGetGlobalLimit
	39 -> s_UrlCacheRpcReloadSettings
	40 -> s_UrlCacheGetGlobalCounters
	41 -> s_AppCacheOpenContainer
	42 -> s_AppCacheCloseContainer
	43 -> s_AppCacheRpcCheckManifest
	44 -> s_AppCacheRpcLookup
	45 -> s_AppCacheRpcDeleteGroup
	46 -> s_AppCacheRpcDeleteIeGroup
	47 -> s_AppCacheRpcGetFallbackUrl
	48 -> s_AppCacheRpcGetDownloadList
	49 -> s_AppCacheRpcCloseHandle
	50 -> s_AppCacheRpcInvalidate
	51 -> s_AppCacheRpcGetInfo
	52 -> s_AppCacheRpcGetGroupsList
	53 -> s_AppCacheRpcFreeSpace
	54 -> s_AppCacheRpcGetIeGroupList
	55 -> s_AppCacheRpcFreeIeSpace
	56 -> s_AppCacheRpcRetrieveUrl
	57 -> s_AppCacheRpcCommitUrl
	58 -> s_AppCacheRpcUpdateExtraData
	59 -> s_AppCacheRpcFinalize
	60 -> s_DependencyStoreOpenContainer
	61 -> s_DependencyStoreCloseContainer
	62 -> s_DependencyStoreUpdateUrl
	63 -> s_DependencyStoreRetrieveUrl
	64 -> s_DependencyStoreDeleteContainer
	65 -> s_HstsOpenContainer
	66 -> s_HstsCloseContainer
	67 -> s_HstsGetHstsEntries
	68 -> s_HstsSetHstsEntries
	69 -> s_HstsPurgeContainer
	70 -> s_CookieOpenContainer
	71 -> s_CookieCloseContainer
	72 -> s_CookieGetCookies
	73 -> s_CookieGetAllCookies
	74 -> s_CookieUpdateCookies
	75 -> s_CookiePurgeContainer
	76 -> s_BlobOpenContainer
	77 -> s_BlobCloseContainer
	78 -> s_BlobGetEntries
	79 -> s_BlobGetEntry
	80 -> s_BlobSetEntry
	81 -> s_BlobDeleteEntry
	82 -> s_BlobPurgeContainer
Endpoints :
ncalrpc         : PlaySoundKRpc2
ncalrpc         : webcache_{031b98cf-4a69-4c31-ab42-fd9b3c199407}_S-1-5-21-4215984009-642367717-812980365-1001
--------------------------------------------------------------------------------
<WinProcess "SynTPEnh.exe" pid 6452 at 0x5dd8160L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "igfxEM.exe" pid 11140 at 0x5dd8be0L>
64

Interfaces :
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  de8ed432-fd92-47a6-9c73-738c7b466c69 (0.0) -- IAppReadinessTaskCallback
OLE  76c0dbbb-15e0-4e7b-b61b-20eeea2001e0 (0.0) -- IAccPropServer
OLE  00000160-0000-0000-c000-000000000046 (0.0) -- IPrivDragDrop
OLE  eb9d0454-25db-5620-98b8-be4c5d0dbc67 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserChangedEventArgs]
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
OLE  8b14e88b-5663-4caf-b196-c31479262831 (0.0) -- IImmersiveApplication
OLE  cb728b20-f786-11ce-92ad-00aa00a74cd0 (0.0) -- IProfferService
OLE  6d5140c1-7436-11ce-8034-00aa006009fa (0.0) -- IServiceProvider
OLE  7702e77c-66f6-479b-af2b-e316cff5f814 (0.0) -- IAsyncCallbackDispatcher
OLE  000214e3-0000-0000-c000-000000000046 (0.0) -- IShellView
OLE  00000114-0000-0000-c000-000000000046 (0.0) -- IOleWindow
OLE  cd17328b-e4ef-4215-a92d-62a914658f82 (0.0) -- IObjectWithCachedState
OLE  d1b9407f-a351-5319-bce5-178ee5585391 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CShell__CViewManagerInterop__CIViewWrapper_Windows__CInternal__CShell__CViewManagerInterop__CIViewEventArgs
OLE  b755e6e0-b048-49cc-8911-11a041216f5f (0.0) -- IApplicationStateChangeHandler
OLE  940c223d-5bdc-49db-968c-e4f3ef9b9270 (0.0) -- IImmersiveMonitorNotification
OLE  727f9e97-76ee-497b-a942-b6371328485c (0.0) -- IApplicationViewChangeListener
OLE  ea8a389b-437d-4791-aa14-5dca004bc92a (0.0) -- IAsyncCallback
OLE  6592b66a-4a51-5ccc-82c5-9042acf93a44 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CShell__CExperience__CShellExperienceDispatcher_Windows__CInternal__CShell__CExperience__CIShellExperienceViewStateChangedEventArgs
OLE  1b7781cd-1b97-4728-8b6e-67a7e55cc53c (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIPeopleBarFlyoutExperienceManager
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  ab65b025-ff88-470a-9513-b62bcd7ce879 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIPeopleBarJumpViewExperienceManager
OLE  8667db0d-6960-465f-b9a4-c461863efa91 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIShoulderTapExperienceManager
OLE  df65db57-d504-456e-8bd7-004ce308d8d9 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIActionCenterExperienceManager
OLE  87324ffd-bd0a-4de8-840a-b60e345a336f (0.0) -- ISettingsFlowController
OLE  90adbab9-cdb8-43dd-8daa-ba1180be5215 (0.0) -- IMultitaskingViewServiceProvider
OLE  103231ae-04cb-4e5e-b63d-e3ce47cd0f0a (0.0) -- IImmersiveAppCrusher
OLE  373e56cf-0a1b-4b4a-a1a4-a46b25ffd7e3 (0.0) -- ITabletModeViewManager
OLE  fff59320-db70-4865-8fed-8b502d692f12 (0.0) -- ISnapServiceProvider
OLE  6a5e657d-223a-4875-838b-c311ed73523b (0.0) -- IImmersiveLayoutChanges
OLE  6584ce6b-7d82-49c2-89c9-c6bc02ba8c38 (0.0) -- IAppVisibilityEvents
OLE  00000001-0000-0000-c000-000000000046 (0.0) -- IClassFactory
OLE  e87e2bc9-ec45-4ddb-95e1-b275d66cbeaa (0.0) -- IApplicationPreLaunch
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
OLE  537b455d-1240-433b-82af-10929138b8be (0.0) -- IMultitaskingViewManager
OLE  a5322dff-9ebc-5df1-953d-0237cea8614b (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CStateRepository__CPrimaryTileUserNotifier_Windows__CInternal__CStateRepository__CPrimaryTileUserChangedEventArgs
OLE  ccb96d97-791c-5741-8f33-fb7266d6ea33 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CStateRepository__CSecondaryTileUserNotifier_Windows__CInternal__CStateRepository__CSecondaryTileUserChangedEventArgs
OLE  6e6c3c52-5a5e-4b4b-a0f8-7fe12621a93e (0.0) -- IEdgeUiManager
OLE  bcf1f74f-2413-46b3-8707-ec2fca11965d (0.0) -- IImmersiveLauncherTrayNotify
OLE  5090de35-ed23-43be-9714-586c5041026a (0.0) -- IHolographicViewTransitionNotificationService
OLE  d8d60399-a0f1-f987-5551-321fd1b49864 (0.0) -- IImmersiveLauncher
OLE  c50898f6-c536-5f47-8583-8b2c2438a13b (0.0) -- Windows.Foundation.IEventHandler<IInspectable>
OLE  99fc44e3-ce9a-4284-bf04-76331d1b1788 (0.0) -- __x_Windows_CApplicationModel_CActivation_CIInitializeActivatedEventArgs
OLE  cf651713-cd08-4fd8-b697-a281b6544e2e (0.0) -- __x_Windows_CApplicationModel_CActivation_CIActivatedEventArgs
OLE  7ca84d06-f54c-4ba8-bd6f-9abaf9380d51 (0.0) -- __x_Windows_CApplicationModel_CActivation_CIMultiviewActivationProperties
OLE  0c44717b-19f7-48d6-b046-cf22826eaa74 (0.0) -- __x_Windows_CApplicationModel_CActivation_CIPrelaunchActivatedEventArgs
OLE  fbc93e26-a14a-4b4f-82b0-33bed920af52 (0.0) -- __x_Windows_CApplicationModel_CActivation_CILaunchActivatedEventArgs
OLE  9767060c-9476-42e2-8f7b-2f10fd13765c (0.0) -- IImmersiveShellBroker
OLE  fec0a504-8e6c-40ff-8a92-f7d693afdcf0 (0.0) -- IShellExperienceBroker
OLE  99e01be7-d840-6dfb-694f-8814c2ec727e (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIStartExperienceBroker
OLE  a16f3786-6cb0-4258-a21e-d949edaa7a18 (0.0) -- IApplicationGlomBroker
OLE  796be4b3-0fb1-415d-9984-0bc8b72e5fa2 (0.0) -- IFullScreenBroker
OLE  988881d6-4fa0-4554-86b0-25911104973a (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIStartUserInfoBroker
OLE  905a0fe1-bc53-11df-8c49-001e4fc686da (0.0) -- __x_Windows_CFoundation_CIByteSeeker
OLE  bb94daad-7836-4d62-9557-2a7b83839b7b (0.0) -- ISafeSaveHandleManager
OLE  f4ee3175-aba2-4df7-b53c-93c4e4e2b0a3 (0.0) -- IRefCountedClosable
OLE  5e0ebc87-bece-4f2a-8d36-3673758f6c55 (0.0) -- IFileHandle
OLE  fa9812c4-0b34-47d0-9b0b-157fb5b5fdf2 (0.0) -- IDuplicateHandleProvider
OLE  04c2542d-3c28-4510-a0c0-8db0e0a3a526 (0.0) -- IDuplicateHandleProvider2
OLE  68766f36-3808-42f9-a18f-0abde6391172 (0.0) -- IAdviseOplockCallback
OLE  2e8fcb18-a0ee-41ad-8ef8-77fb3a370ca5 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIShellExperienceManagerFactory
OLE  599db028-e1d3-433d-9f90-32468634d59e (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIInputDialExperienceManager
OLE  13c6456c-c8eb-4f83-91b8-9d425f546210 (0.0) -- INotificationControllerDataSink
OLE  85cb6900-4d95-11cf-960c-0080c7f4ee85 (0.0) -- IShellWindows
OLE  00020400-0000-0000-c000-000000000046 (0.0) -- IDispatch
OLE  71538e01-5877-4d2d-ac1a-ff42b6da910d (0.0) -- IWpnSettingCallback
OLE  1ec5d3ef-a8bf-4311-9eeb-33ba50f461fe (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIBaseExperienceManager
OLE  3c4367fa-99ac-52c0-964d-0dcd1a9ba729 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CShell__CExperience__CIBaseExperienceManager_Windows__CInternal__CShell__CExperience__CIVisibilityChangedEventArgs
OLE  7ab93c52-0e48-4750-ba9d-1a4113981847 (0.0) -- IToastNotificationManagerStatics2
OLE  5caddc63-01d3-4c97-986f-0533483fee14 (0.0) -- IToastNotificationHistory
OLE  d133ce13-3537-48ba-93a7-afcd5d2053b4 (0.0) -- ITrayNotify
OLE  71ba143f-598e-49d0-84eb-8febaedcc195 (0.0) -- INetworkStatusChangedEventHandler
OLE  af581601-f71a-4a31-8f8d-91f7df79371f (0.0) -- __x_SharedStartModel_CIStartLayoutInitializationStatics
OLE  1bf3dc4c-07a0-4f3f-87f8-5a625cd2e7ad (0.0) -- IImmersiveAppCrusherNotification
OLE  76bb2cfb-c246-41ec-b9c3-671e5347cf51 (0.0) -- IHolographicViewTransitionNotification
OLE  c092cc2f-5eca-5a5d-9c9c-f050e892dd97 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountAddedEventArgs
OLE  dc8b9f35-216c-54ff-99db-cd7e04c6a074 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountChangedEventArgs
OLE  104e5d12-179f-597c-80ce-18627ceeb8b6 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountDeletePendingEventArgs
OLE  1299cf18-c4f5-4b6a-bb0f-2299f0398e27 (0.0) -- INotifyNetworkListManagerEvents
OLE  22d2e146-1a68-40b8-949c-8fd848b415e6 (0.0) -- INotifyNetworkEvents
OLE  2abc0864-9677-42e5-882a-d415c556c284 (0.0) -- INotifyNetworkInterfaceEvents
OLE  733b7764-5c0c-4ad6-bb4b-d0585e993e0e (0.0) -- INotifyNetworkGlobalCostEvents
OLE  000001a0-0000-0000-c000-000000000046 (0.0) -- ISystemActivator
OLE  27354133-7f64-5b0f-8f00-5d77afbe261e (0.0) -- IDiscRecorder2
OLE  27354132-7f64-5b0f-8f00-5d77afbe261e (0.0) -- IDiscRecorder2Ex
OLE  27354153-9f64-5b0f-8f00-5d77afbe261e (0.0) -- IDiscFormat2Data
OLE  e716b283-6be7-4e6f-a88f-1cde47d5e355 (0.0) -- IWpnPresentationTileSink
OLE  78c8b458-dd5a-4f32-9d8b-d45a19ae9e1f (0.0) -- IActiveZBandNotificationForMonitor
OLE  0000000c-0000-0000-c000-000000000046 (0.0) -- IStream
OLE  bfb02fed-4c71-40e1-b4f3-ce99c2ff0542 (0.0) -- IObjectWithFileHandle
OLE  c179334c-4295-40d3-bea1-c654d965605a (0.0) -- IVirtualDesktopNotification
OLE  2c1448e1-7540-41b2-9b0d-188c012da2f1 (0.0) -- IShellTargetingChangeNotification
OLE  000214e6-0000-0000-c000-000000000046 (0.0) -- IShellFolder
OLE  000214ea-0000-0000-c000-000000000046 (0.0) -- IPersistFolder
OLE  0000010c-0000-0000-c000-000000000046 (0.0) -- IPersist
OLE  321a6a6a-d61f-4bf3-97ae-14be2986bb36 (0.0) -- IObjectWithBackReferences
OLE  1ac3d9f0-175c-11d1-95be-00609797ea4f (0.0) -- IPersistFolder2
OLE  e014d578-d95e-4757-bffb-3bda010fe68a (0.0) -- IAutomaticDestinationList2
OLE  5632b1a4-e38a-400a-928a-d4cd63230295 (0.0) -- IObjectCollection
OLE  49a07732-e7b8-5c5b-9de7-22e33cb97004 (0.0) -- __FIEventHandler_1_Windows__CApplicationModel__CActivation__CBackgroundActivatedEventArgs
OLE  4f9c5cec-0197-49fe-b800-0d5a72a6c505 (0.0) -- IUiaWindowNotifierCallback
OLE  2dbdba9d-20da-519d-9078-09f835bc5bc7 (0.0) -- ITypedEventHandler<UISettings,IInspectable>
OLE  d4351e8c-208e-4c24-88ac-6e2add5f4bb1 (0.0) -- IApplicationViewBroker
OLE  2166ee67-71df-4476-8394-0ced2ed05274 (0.0) -- IInputHostManagerBroker
OLE  50ac103f-d235-4598-bbef-98fe4d1a3ad4 (0.0) -- IToastNotificationManagerStatics
OLE  75927b93-03f3-41ec-91d3-6e5bac1b38e7 (0.0) -- IToastNotificationManager
OLE  04124b20-82c6-4229-b109-fd9ed4662b53 (0.0) -- IToastNotificationFactory
OLE  a3fa4101-4713-4f91-a8f1-93a4573ec5a7 (0.0) -- IWpnNotification
OLE  bebf1b6f-4d08-4e3e-9902-a256a285c970 (0.0) -- ITransientNotificationDetails
OLE  4f38fd3e-2c10-4c00-9ec1-62bd536a1feb (0.0) -- IWpnToastFeedback
OLE  35176862-cfd4-44f8-ad64-f500fd896c3b (0.0) -- IToastFailedEventArgs
OLE  95e3e803-c969-5e3a-9753-ea2ad22a9a33 (0.0) -- ITypedEventHandler_2_Windows__CUI__CNotifications__CToastNotification_Windows__CUI__CNotifications__CToastFailedEventArgs
OLE  a7052211-8b56-43c4-8f26-12852f7303a3 (0.0) -- INowPlayingSessionManager
OLE  22ba7cc0-8e75-484f-844e-0b6d74105413 (0.0) -- IGlobalRudeWindowNotifications
OLE  b722bccb-4e68-101b-a2bc-00aa00404770 (0.0) -- IOleCommandTarget
OLE  7154c95d-c519-49bd-a97e-645bbfabe111 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CITrayMtcUvcFlyoutExperienceManager
OLE  8cecdf70-ced8-5bc7-84a7-d80615fedcdd (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CShell__CViewManagerInterop__CIClientWindowState_Windows__CInternal__CShell__CViewManagerInterop__CIClientWindowReadyForPresentationChangedEventArgs
OLE  0c40987c-7026-499e-adad-c164c0ffee84 (0.0) -- IActiveZBandNotification
OLE  8d4d1ec2-4740-4fc5-b4b1-6dc3722a2eeb (0.0) -- ILightDismissNotification
OLE  a5cd92ff-29be-454c-8d04-d82879fb3f1b (0.0) -- IVirtualDesktopManager
OLE  b196b284-bab4-101a-b69c-00aa00341d07 (0.0) -- IConnectionPointContainer
OLE  b196b286-bab4-101a-b69c-00aa00341d07 (0.0) -- IConnectionPoint
OLE  50a87baa-5f79-4c31-b6b3-28f6f2d097e6 (0.0) -- IExplorerHost
OLE  9c4960d4-7626-4e13-beec-1adad82ff5a0 (0.0) -- IThreadUndoManager
OLE  d001f200-ef97-11ce-9bc9-00aa00608e01 (0.0) -- IOleUndoManager
OLE  f2153260-232e-4474-9d0a-9f2ab153441d (0.0) -- IVerbStateTaskCallBack
OLE  35bd3360-1b35-4927-bae4-b10e70d99eff (0.0) -- IFrameTaskManager
OLE  cde725b0-ccc9-4519-917e-325d72fab4ce (0.0) -- IFolderView
OLE  76542021-fff8-43f3-acbd-bb46a60a94ca (0.0) -- IExplorerFrame
OLE  f66724ea-ae8f-41a2-b3f3-3d6581ea891c (0.0) -- IRibbonTabsetCallBack
OLE  b3a4b685-b685-4805-99d9-5dead2873236 (0.0) -- IParentAndItem
OLE  ef01eb89-5a19-42cb-bc8c-f10ed6c6791b (0.0) -- ISyncIntegrationManager
OLE  0002df05-0000-0000-c000-000000000046 (0.0) -- IWebBrowserApp
OLE  00000122-0000-0000-c000-000000000046 (0.0) -- IDropTarget
OLE  fc992f1f-debb-4596-b355-50c7a6dd1222 (0.0) -- IWaitCursorManager
OLE  0000010e-0000-0000-c000-000000000046 (0.0) -- IDataObject
OLE  00000103-0000-0000-c000-000000000046 (0.0) -- IEnumFORMATETC
OLE  1aba2312-77b6-44d7-b975-cce3f3d3fb2f (0.0) -- ISyncStatusProvider
OLE  ad6db2cf-0c8d-438b-b25d-9a9a82903b2b (0.0) -- IWindow
OLE  1b988c32-1bc7-52fa-83ba-0b97e79c878b (0.0) -- IAsyncOperationCompletedHandler<AppReputationResult>
OLE  7724f749-b79e-42a0-aa9e-878b498f26ec (0.0) -- IWsDocumentUpdate
OLE  a4ed5c81-76c9-40bd-8be6-b1d90fb20ae7 (0.0) -- IAsyncActionCompletedHandler
OLE  58a98b87-ed3c-4e12-b5df-c72bf4470aee (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIJumpViewExperienceManager
OLE  28536166-c75b-5df1-99ca-96967f7d999a (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CShell__CExperience__CJumpViewExperienceManager_Windows__CInternal__CShell__CExperience__CJumpViewExperienceEventArgs
OLE  6d5174ec-f425-4cd9-8643-cf36042987f1 (0.0) -- IOperationStatusService
OLE  4ae7498c-e1c0-475f-8573-41c26127c5d8 (0.0) -- IOperationStatusTile
OLE  000214e2-0000-0000-c000-000000000046 (0.0) -- IShellBrowser
OLE  831d1dff-7f57-4720-87e4-cb57d6214428 (0.0) -- IInvocationLocation
OLE  9536ca39-1acb-4ae6-ad27-2403d04ca28f (0.0) -- IShellItemBrowser
OLE  8f45ef43-0585-4881-a90d-f55d35ce7797 (0.0) -- IOperationInterrupt
OLE  6faf1156-8855-47b5-bdc8-4555d13c095f (0.0) -- IConflictInterrupt
OLE  c7c67cb1-44ae-4e71-9e69-2c92f8d732fc (0.0) -- IConflictItemDataCallback
OLE  b1604325-6b59-427b-bf1b-80a2db02d3d8 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CITrayClockFlyoutExperienceManager
OLE  d597bab3-5b9f-11d1-8dd2-00aa004abd5e (0.0) -- ISensLogon
OLE  c853771a-f336-4cf8-9a27-1570293ab52d (0.0) -- ILockScreenDirectorServiceProvider
OLE  6119bcc6-cac2-4d37-9bbf-76a34697e7fb (0.0) -- ILockScreenDirector
OLE  a2aa05aa-47af-4b4a-8e77-6cd6efe35cda (0.0) -- ILockScreenDirectorPrivate
OLE  c59766f7-d190-4f69-a822-05ca45b201e7 (0.0) -- ILockAppHost
OLE  a40cce11-67ee-4e74-8c46-91edb265261c (0.0) -- __x_Windows_CInternal_CShell_CExperience_CILockScreenExperienceManager
OLE  0689ac07-5db1-488b-bc6d-9dfbc2cf7911 (0.0) -- ILockAppHostSafeguard
OLE  a340ae45-86bf-4c9c-b6c8-6109ca1e2f29 (0.0) -- IImmersiveSessionIdleDetector
OLE  985c98a3-21f6-4585-9e13-f708cb0de4f2 (0.0) -- IImmersiveSessionIdleNotification
OLE  72163aa1-8a18-436a-9067-3a86aa7460dc (0.0) -- ILockAppHostShellInterop
OLE  053bf212-5a22-4a75-87eb-dfca4ea90e02 (0.0) -- ILockScreenViewManager
OLE  989e63bd-43c5-4815-b192-2251e9a6e452 (0.0) -- ILockScreenViewManagerNotificationCallback
OLE  7c7a3e75-4362-4d12-860d-68ee72909f83 (0.0) -- IImmersiveMonitorNotificationService
OLE  ce2ad461-c28a-4db3-b9d7-b7d8f6865657 (0.0) -- ILockAppHostEndpoint
OLE  3721d4ef-bca1-418a-98e2-ec3def272b2f (0.0) -- IAboveLockActivationManager
OLE  dcb00007-570f-4a9b-8d69-199fdba5723b (0.0) -- INetworkConnectionEvents
OLE  dcb00004-570f-4a9b-8d69-199fdba5723b (0.0) -- INetworkEvents
OLE  dcb00009-570f-4a9b-8d69-199fdba5723b (0.0) -- INetworkCostManagerEvents
OLE  880b26f8-9197-43d0-8045-8702d0d72000 (0.0) -- IImmersiveMonitor
OLE  fc413902-2a24-4522-ad1f-2d27c0ffee84 (0.0) -- IDesktopVisibilityChangesNotification
OLE  5ef7890f-319b-4259-8d0f-36e5ff0916ce (0.0) -- IImmersiveLauncherCortana
OLE  016f611a-b360-4768-8b28-6779ddfde2e0 (0.0) -- 
OLE  6ee8a11f-f5f0-4feb-8b78-a69aaa8a2a6a (0.0) -- IUpFrontConfirmation
OLE  47e7bb4d-2d83-4604-905c-0ee8eab077a4 (0.0) -- IConfirmationInterrupt
OLE  55272a00-42cb-11ce-8135-00aa004bb851 (0.0) -- IPropertyBag
OLE  9d923edc-b7a9-4f77-9933-284e7e2b2536 (0.0) -- IObjectWithOpenWithFlags
OLE  fc4801a3-2ba9-11cf-a229-00aa003d7352 (0.0) -- IObjectWithSite
OLE  1af3a467-214f-4298-908e-06b03e0b39f9 (0.0) -- IFolderView2
OLE  667708d1-a931-4a85-9999-609eaa7dd85a (0.0) -- ILocalCopyDownloadSettings
OLE  4d4c1e64-e410-4faa-bafa-59ca069bfec2 (0.0) -- IImmersiveMonitorManager
OLE  d770b2ad-8f5e-4b8e-b3df-f05a2ab5287c (0.0) -- IImmersiveLayout
OLE  b849acb5-8ac5-4fb8-88b6-55c749d25a44 (0.0) -- ILightDismissProvider
OLE  bf63999f-7411-40da-861c-df72c0ffee84 (0.0) -- IImmersiveApplicationManager
OLE  405444d2-baa5-48ed-abfe-a673f70be863 (0.0) -- IAltTabViewHost
OLE  c59a7a3c-0676-4526-8192-5d0bf9b89b95 (0.0) -- IMultitaskingViewVisibilityNotification
OLE  ff62716a-0bd0-4105-a6ec-83b09d864267 (0.0) -- IShellPositionerManager
OLE  95e1216b-c9d8-4d0c-aa1b-19a86de9aa5b (0.0) -- IShellPositionerProxy
OLE  2ad63a67-f12f-4bd7-b1bf-6213290a552a (0.0) -- IUIAutomationCrossThreadRelease
OLE  f7041e23-1a6c-41bb-89b2-b3425c51ccd5 (0.0) -- IExplorerWindowManager
OLE  00000135-0000-0000-c000-000000000046 (0.0) -- IInterfaceFromWindowProp
OLE  3d8b0590-f691-11d2-8ea9-006097df5bd4 (0.0) -- IDataObjectAsyncCapability
OLE  93f2f68c-1d1b-11d3-a30e-00c04f79abd1 (0.0) -- IShellFolder2
OLE  cef04fdf-fe72-11d2-87a5-00c04f6837cf (0.0) -- IPersistFolder3
OLE  0000000e-0000-0000-c000-000000000046 (0.0) -- IBindCtx
OLE  8a4427de-b11b-4a61-8977-844a3a7bc63b (0.0) -- IJumpViewExecuteHelper
OLE  b3e7c340-ef97-11ce-9bc9-00aa00608e01 (0.0) -- IEnumOleUndoUnits
OLE  31e4fa78-02b4-419f-9430-7b7585237c77 (0.0) -- IFrameManager
OLE  b92b56a9-8b55-4e14-9a89-0199bbb6f93b (0.0) -- IDesktopWallpaper
OLE  4473e3a7-c2ad-4075-a1f8-935a584740a9 (0.0) -- IStateEvents
OLE  dcb07fdc-3bb5-451c-90be-966644fed7b0 (0.0) -- INewMenuClient
OLE  538317c5-5bad-4847-962d-42da294f5e0a (0.0) -- IHolographicViewManager
OLE  4fda780a-acd2-41f7-b4f2-ebe674c9bf2a (0.0) -- ITabletModeController
OLE  dcf1427b-9f2f-4bb5-8aa2-ec625e2b2082 (0.0) -- IJumpViewContextMenuWrapper
Endpoints :
ncalrpc         : OLE6540C7DFAE33DDD8108A8FDE0EE7
--------------------------------------------------------------------------------
<WinProcess "SynTPHelper.exe" pid 1892 at 0x5dd85f8L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "ClassicStartMenu.exe" pid 1900 at 0x5dd89b0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "ShellExperienceHost.exe" pid 2852 at 0x5dd8ba8L>
64

Interfaces :
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\Windows\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  92696c00-7578-48e1-ac1a-2ca909e2c8cf (0.0) -- __x_Windows_CApplicationModel_CCore_CIActivatableApplication
OLE  638bb2db-451d-4661-b099-414f34ffb9f1 (0.0) -- __x_Windows_CApplicationModel_CCore_CICoreApplicationView
OLE  49a07732-e7b8-5c5b-9de7-22e33cb97004 (0.0) -- __FIEventHandler_1_Windows__CApplicationModel__CActivation__CBackgroundActivatedEventArgs
OLE  2e5500b6-66ad-467f-abb5-022a64283d88 (0.0) -- __x_Windows_CApplicationModel_CCore_CICoreApplicationViewInternal
OLE  4f9c5cec-0197-49fe-b800-0d5a72a6c505 (0.0) -- IUiaWindowNotifierCallback
OLE  abadfe7f-04c1-4a9f-9b3c-a323f1c80178 (0.0) -- IScaleChangeSink
OLE  c50898f6-c536-5f47-8583-8b2c2438a13b (0.0) -- Windows.Foundation.IEventHandler<IInspectable>
OLE  2dbdba9d-20da-519d-9078-09f835bc5bc7 (0.0) -- ITypedEventHandler<UISettings,IInspectable>
OLE  7d56d344-8464-4faf-aa49-37ea6e2d7bd1 (0.0) -- __x_Windows_CApplicationModel_CDataTransfer_CDragDrop_CCore_CICoreDragDropManager
OLE  cd292360-2763-4085-8a9f-74b224a29175 (0.0) -- __x_Windows_CUI_CCore_CICoreWindowFactory
OLE  087ca5a4-8cfc-4264-b39d-da2bb2583a11 (0.0) -- ICoreWindowFactoryPriv
OLE  92cee296-66e6-4678-984a-579e02c88be6 (0.0) -- __x_Windows_CApplicationModel_CCore_CICoreApplicationViewForceMarshal
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
OLE  eb9d0454-25db-5620-98b8-be4c5d0dbc67 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserChangedEventArgs]
OLE  f5917e6f-5abf-5e65-b5b4-1b9c8d94e788 (0.0) -- ITypedEventHandler<AccessibilitySettings,IInspectable>
OLE  a5322dff-9ebc-5df1-953d-0237cea8614b (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CStateRepository__CPrimaryTileUserNotifier_Windows__CInternal__CStateRepository__CPrimaryTileUserChangedEventArgs
OLE  ccb96d97-791c-5741-8f33-fb7266d6ea33 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CStateRepository__CSecondaryTileUserNotifier_Windows__CInternal__CStateRepository__CSecondaryTileUserChangedEventArgs
OLE  fcaeac67-4e77-49c7-b856-dde934fc735b (0.0) -- ILanguageFontGroupFactory
OLE  00000037-0000-0000-c000-000000000046 (0.0) -- IWeakReference
OLE  a2cd1ad4-df0a-4566-9407-de425b84cc21 (0.0) -- IAsyncWPNInit
OLE  118ec4a0-443d-467d-b568-de895db52e7b (0.0) -- __x_Windows_CServices_CTargetedContent_CInternal_CINotifySubscription
OLE  00000038-0000-0000-c000-000000000046 (0.0) -- IWeakReferenceSource
OLE  06386a7a-e009-5b0b-ab68-a8e48b516647 (0.0) -- __FIAsyncOperationWithProgressCompletedHandler_2_Windows__CStorage__CStreams__CIBuffer_UINT32
OLE  9d4966fa-dbd1-4799-a07f-6a5e1991bda4 (0.0) -- IOplockCallbackEventHandler
OLE  1726f52d-2b8c-524a-98c6-f2cf0893c0f2 (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageStagingEventArgs
OLE  a8a900c6-da0b-5bcc-a71a-be0b9265d87a (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageInstallingEventArgs
OLE  c23e15f6-c618-522a-82ab-4fab36665ce5 (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageUpdatingEventArgs
OLE  b32d7d63-cd0e-5c2e-a251-fb8d290824e4 (0.0) -- __FITypedEventHandler_2_Windows__CApplicationModel__CPackageCatalog_Windows__CApplicationModel__CPackageStatusChangedEventArgs
OLE  f9e87849-b323-eefa-3204-8a2d2d2b4432 (0.0) -- IImageQueueManager
OLE  e716b283-6be7-4e6f-a88f-1cde47d5e355 (0.0) -- IWpnPresentationTileSink
OLE  6030e7c3-f93f-5e9c-9ba2-9a018d2b09c0 (0.0) -- __FIEventHandler_1_Windows__CSystem__CAppMemoryUsageLimitChangingEventArgs
OLE  24a0bf18-6849-4d99-9fc8-48bcabace467 (0.0) -- IHandleDuplicator
OLE  a4ed5c81-76c9-40bd-8be6-b1d90fb20ae7 (0.0) -- IAsyncActionCompletedHandler
OLE  2ad63a67-f12f-4bd7-b1bf-6213290a552a (0.0) -- IUIAutomationCrossThreadRelease
OLE  e2663f37-2e1b-500c-ad68-c3ed7a8f74c8 (0.0) -- MapChangedEventHandler<HSTRING,HSTRING>
OLE  60141efb-f2f9-5377-96fd-f8c60d9558b5 (0.0) -- IMapChangedEventArgs<HSTRING>
OLE  c1635471-1417-4750-811f-a6122953c5a3 (0.0) -- __x_Windows_CInternal_CShell_CExperience_CIShellExperiencePrivate
OLE  13c6456c-c8eb-4f83-91b8-9d425f546210 (0.0) -- INotificationControllerDataSink
OLE  c30dfc1c-e392-4d02-ae09-a8ebf08cbc75 (0.0) -- SystemSettings.DataModel.ISettingsEnvironmentChangedHandler
OLE  1ada0e3e-e4a2-4123-b451-dc96bf800419 (0.0) -- __x_Windows_CApplicationModel_CCore_CICoreImmersiveApplication
OLE  dc471c97-550a-573c-9a01-f94a67aa3850 (0.0) -- __FITypedEventHandler_2_IInspectable_HSTRING
Endpoints :
ncalrpc         : OLE621C086970BFB63B18AFA3AA98E9
--------------------------------------------------------------------------------
<WinProcess "SearchUI.exe" pid 8484 at 0x5dd8048L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "nvtray.exe" pid 11888 at 0x5dd87b8L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "NvBackend.exe" pid 2112 at 0x5dd8630L>
32
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "MsiTrueColor.exe" pid 12528 at 0x5df2710L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "unsecapp.exe" pid 12240 at 0x5df2898L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "NetworkManager.exe" pid 3088 at 0x5df27f0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "IAStorIcon.exe" pid 1440 at 0x5df2208L>
32
[!!] Invalid bitness
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 2540 at 0x57eddd8L>
64
['OneSyncSvc_184a7aba', 'PimIndexMaintenanceSvc_184a7aba', 'UnistoreSvc_184a7aba', 'UserDataSvc_184a7aba']

Interfaces :
RPC  d2716e94-25cb-4820-bc15-537866578562 (1.0) -- c:\windows\system32\aphostservice.dll
	0 -> ServerRPC_SubmitJob
	1 -> ServerRPC_GetPendingJobs
	2 -> ServerRPC_RetryJobById
	3 -> ServerRPC_CancelJobById
	4 -> ServerRPC_AdviseNotifications
	5 -> ServerRPC_SubscribeNextNotification
	6 -> ServerRPC_RegisterAppId
	7 -> ServerRPC_UnadviseNotifications
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
RPC  0c53aa2e-fb1c-49c5-bfb6-c54f8e5857cd (1.0) -- C:\Windows\System32\SyncController.dll
	0 -> ActiveSyncServer_QuerySyncStatusProps
	1 -> ActiveSyncServer_QueryLastSyncResult
	2 -> ActiveSyncServer_SetPassword
	3 -> ActiveSyncServer_CopyCredentials
	4 -> ActiveSyncServer_DeletePassword
	5 -> ActiveSyncServer_IsPasswordSet
	6 -> ActiveSyncServer_CreateDataStoreLock
	7 -> ActiveSyncServer_CloseDataStoreLock
	8 -> ActiveSyncServer_SetConversationSyncEnabled
	9 -> ActiveSyncServer_GetConversationSyncEnabled
	10 -> ActiveSyncServer_SetUnifiedInboxEnabled
	11 -> ActiveSyncServer_GetUnifiedInboxEnabled
	12 -> ActiveSyncServer_GetUnifiedInboxServerValue
	13 -> ActiveSyncServer_GetUserInfoForUnconfiguredAccount
RPC  e8748f69-a2a4-40df-9366-62dbeb696e26 (0.0) -- c:\windows\system32\unistore.dll
	0 -> USSvcImpl_Object_Close
	1 -> USSvcImpl_RegisterRundownProtection
	2 -> USSvcImpl_ConvertToOtherObject
	3 -> USSvcImpl_Manager_Create
	4 -> USSvcImpl_Manager_CreateStoreGrouping
	5 -> USSvcImpl_Manager_CreateStore
	6 -> USSvcImpl_Manager_GetDeviceStore
	7 -> USSvcImpl_Manager_GetDeviceStoreOid
	8 -> USSvcImpl_Manager_GetHighestStoreBitPosition
	9 -> USSvcImpl_Manager_GetStore
	10 -> USSvcImpl_Manager_GetStoreCollection
	11 -> USSvcImpl_Manager_Notify
	12 -> USSvcImpl_Manager_CustomNotify
	13 -> USSvcImpl_Manager_GetObjectByOid
	14 -> USSvcImpl_Manager_GetAllEmbeddedObjects
	15 -> USSvcImpl_Manager_GetAllItems
	16 -> USSvcImpl_Manager_GetTypeManager
	17 -> USSvcImpl_Manager_StartTransaction
	18 -> USSvcImpl_Manager_EndTransaction
	19 -> USSvcImpl_Manager_CleanupTombstones
	20 -> USSvcImpl_Manager_GetStreamFilePath
	21 -> USSvcImpl_Manager_CleanupTemporaryFolders
	22 -> USSvcImpl_Manager_GetAllAggregateObjects
	23 -> USSvcImpl_Manager_GetAllObjects
	24 -> USSvcImpl_Manager_GetBatchedPropValsFromIdsBlob
	25 -> USSvcImpl_Manager_GetPropValsFromIdBlob
	26 -> USSvcImpl_Manager_MapNamedProps
	27 -> USSvcImpl_Manager_GetDefaultPIMStoreId
	28 -> USSvcImpl_Manager_SetDefaultPIMStoreId
	29 -> USSvcImpl_Manager_GetUnistoreDatabaseRefreshTime
	30 -> USSvcImpl_ManagerPriv_put_DeviceStoreId
	31 -> USSvcImpl_ManagerPriv_GetNotificationsManager
	32 -> USSvcImpl_ManagerPriv_UnmapNamedProps
	33 -> USSvcImpl_ManagerPriv_GetPerfStats
	34 -> USSvcImpl_ManagerPriv_ResetPerfStats
	35 -> USSvcImpl_ManagerPriv_ToggleRecordingPerfStats
	36 -> USSvcImpl_ManagerPriv_BackupStoreVolume
	37 -> USSvcImpl_ManagerPriv_SetToSuspending
	38 -> USSvcImpl_ManagerPriv_SetToResumed
	39 -> USSvcImpl_NotificationManager_Advise
	40 -> USSvcImpl_NotificationManager_Unadvise
	41 -> USSvcImpl_NotificationManager_Notify
	42 -> USSvcImpl_NotificationManager_SuspendNotifications
	43 -> USSvcImpl_NotificationManager_ResumeNotifications
	44 -> USSvcImpl_NotificationManager_FilterProcessEventsForTests
	45 -> USSvcImpl_NotificationManager_GetAdviseContent
	46 -> USSvcImpl_Object_GetOid
	47 -> USSvcImpl_Object_Delete
	48 -> USSvcImpl_Object_GetPropValsBlob
	49 -> USSvcImpl_Object_GetAllPropValsBlob
	50 -> USSvcImpl_Object_SetPropVals
	51 -> USSvcImpl_Object_SetPropValsEx
	52 -> USSvcImpl_Object_SetStreamProperty
	53 -> USSvcImpl_Object_GetStreamProp
	54 -> USSvcImpl_Object_GetStore
	55 -> USSvcImpl_Object_GetStreamFilePath
	56 -> USSvcImpl_Object_GetAssociatedItems
	57 -> USSvcImpl_Object_CreateEmbeddedObject
	58 -> USSvcImpl_Object_DeleteEmbeddedObjects
	59 -> USSvcImpl_Object_GetEmbeddedObjects
	60 -> USSvcImpl_Object_IncrementRevision
	61 -> USSvcImpl_Store_GetRootFolder
	62 -> USSvcImpl_Store_GetObjectByOid
	63 -> USSvcImpl_Store_CreateAssociateObject
	64 -> USSvcImpl_Store_GetAssociateObjects
	65 -> USSvcImpl_Store_GetEmbeddedObjects
	66 -> USSvcImpl_Store_GetTypeManager
	67 -> USSvcImpl_Store_Flush
	68 -> USSvcImpl_Store_AddSyncPartner
	69 -> USSvcImpl_Store_GetSyncPartner
	70 -> USSvcImpl_Store_GetSyncPartners
	71 -> USSvcImpl_Store_StartFetchSession
	72 -> USSvcImpl_Store_EndFetchSession
	73 -> USSvcImpl_Store_ThreadInFetchSession
	74 -> USSvcImpl_Store_CreateAggregateObject
	75 -> USSvcImpl_Store_GetAggregateObjects
	76 -> USSvcImpl_Store_GetDeletedRevisionItems
	77 -> USSvcImpl_Store_GetLongDeletedRevisionItems
	78 -> USSvcImpl_Store_ResetLongRevisionChangeTracking
	79 -> USSvcImpl_Store_UpdateLongRevisionChangeTracking
	80 -> USSvcImpl_Store_GetLongRevision
	81 -> USSvcImpl_Store_IsObjectRevisionTracked
	82 -> USSvcImpl_Store_GetFolders
	83 -> USSvcImpl_Store_GetStoreGrouping
	84 -> USSvcImpl_Folder_CreateFolder
	85 -> USSvcImpl_Folder_CreateItem
	86 -> USSvcImpl_Folder_DeleteItems
	87 -> USSvcImpl_Folder_GetChildFolders
	88 -> USSvcImpl_Folder_GetItems
	89 -> USSvcImpl_Folder_GetAllItems
	90 -> USSvcImpl_Folder_GetParent
	91 -> USSvcImpl_Folder_IsEmpty
	92 -> USSvcImpl_Folder_CopyToFolder
	93 -> USSvcImpl_Folder_MoveToFolder
	94 -> USSvcImpl_Item_DeleteWithFlags
	95 -> USSvcImpl_Item_GetParent
	96 -> USSvcImpl_Item_CopyToFolder
	97 -> USSvcImpl_Item_MoveToFolder
	98 -> USSvcImpl_Item_AssociateObject
	99 -> USSvcImpl_Item_DeleteAssociations
	100 -> USSvcImpl_Item_DeleteAllAssociations
	101 -> USSvcImpl_Item_GetAssociateObjects
	102 -> USSvcImpl_Item_GetAggregateObject
	103 -> USSvcImpl_Item_AggregateObject
	104 -> USSvcImpl_Item_DeleteAggregation
	105 -> USSvcImpl_EmbeddeObject_GetItem
	106 -> USSvcImpl_EmbeddedObject_GetObject
	107 -> USSvcImpl_AssociatedObject_HasItems
	108 -> USSvcImpl_AggregateObject_GetAggregatedObjects
	109 -> USSvcImpl_ObjectCollection_GetCount
	110 -> USSvcImpl_ObjectCollection_GetCurrentIndex
	111 -> USSvcImpl_ObjectCollection_GetObject
	112 -> USSvcImpl_ObjectCollection_GetPropValsBlob
	113 -> USSvcImpl_ObjectCollection_GetBatchedPropValsBlob
	114 -> USSvcImpl_ObjectCollection_SetPropValsOnAll
	115 -> USSvcImpl_ObjectCollection_GetAllPropValsBlob
	116 -> USSvcImpl_ObjectCollection_Oid
	117 -> USSvcImpl_ObjectCollection_GetBookmark
	118 -> USSvcImpl_ObjectCollection_Move
	119 -> USSvcImpl_ObjectCollection_DeleteAllObjects
	120 -> USSvcImpl_SyncPartnerEnum_Next
	121 -> USSvcImpl_SyncPartnerEnum_Skip
	122 -> USSvcImpl_SyncPartnerEnum_Reset
	123 -> USSvcImpl_SyncPartnerEnum_Clone
	124 -> USSvcImpl_TypeManager_MapNamedProps
	125 -> USSvcImpl_TypeManager_GetSchemaPropertiesFromObjectType
	126 -> USSvcImpl_Stream_Seek
	127 -> USSvcImpl_Stream_SetSize
	128 -> USSvcImpl_Stream_Commit
	129 -> USSvcImpl_Stream_Revert
	130 -> USSvcImpl_Stream_LockRegion
	131 -> USSvcImpl_Stream_UnlockRegion
	132 -> USSvcImpl_Stream_Stat
	133 -> USSvcImpl_Stream_Clone
	134 -> USSvcImpl_Stream_Read
	135 -> USSvcImpl_Stream_Write
	136 -> USSvcImpl_SyncPartner_GetPropsBlob
	137 -> USSvcImpl_SyncPartner_SetProps
	138 -> USSvcImpl_SyncPartner_GetName
	139 -> USSvcImpl_SyncPartner_GetGuid
	140 -> USSvcImpl_SyncPartner_GetStoreId
	141 -> USSvcImpl_SyncPartner_GetPartnerId
	142 -> USSvcImpl_SyncPartner_EnableFolderForSync
	143 -> USSvcImpl_SyncPartner_IsFolderEnabledForSync
	144 -> USSvcImpl_SyncPartner_HasChanges
	145 -> USSvcImpl_SyncPartner_GetChangeCount
	146 -> USSvcImpl_SyncPartner_StartSyncSession
	147 -> USSvcImpl_SyncPartner_StartSyncSessionNoContext
	148 -> USSvcImpl_SyncPartner_GetNextChange
	149 -> USSvcImpl_SyncPartner_GetChangeForObject
	150 -> USSvcImpl_SyncPartner_SetExceptionOnChange
	151 -> USSvcImpl_SyncPartner_SetExceptionOnChangeUnits
	152 -> USSvcImpl_SyncPartner_ResetChangeEnumeration
	153 -> USSvcImpl_SyncPartner_EndSyncSession
	154 -> USSvcImpl_SyncPartner_GetRootFolder
	155 -> USSvcImpl_SyncPartner_LookupFolderObjectId
	156 -> USSvcImpl_SyncPartner_LookupFolderRemoteId
	157 -> USSvcImpl_SyncPartner_GetFolders
	158 -> USSvcImpl_SyncPartner_LookupItemObjectId
	159 -> USSvcImpl_SyncPartner_UpdateSyncPartnerSchema
	160 -> USSvcImpl_SyncPartner_Delete
	161 -> USSvcImpl_SyncPartner_SetMeetingResponse
	162 -> USSvcImpl_SyncPartner_GetAllMeetingResponses
	163 -> USSvcImpl_SyncPartner_DefragmentKnowledge
	164 -> USSvcImpl_ObjectMetadata_GetPropsBlob
	165 -> USSvcImpl_ObjectMetadata_SetProps
	166 -> USSvcImpl_ObjectMetadata_GetObjectId
	167 -> USSvcImpl_ObjectMetadata_GetPartner
	168 -> USSvcImpl_ObjectMetadata_GetRemoteId
	169 -> USSvcImpl_ObjectMetadata_SetRemoteId
	170 -> USSvcImpl_ObjectMetadata_GetParent
	171 -> USSvcImpl_ObjectMetadata_SetParent
	172 -> USSvcImpl_ItemMetadata_Move
	173 -> USSvcImpl_ItemMetadata_SetMeetingResponse
	174 -> USSvcImpl_ItemMetadata_GetMeetingResponses
	175 -> USSvcImpl_ItemMetadata_Delete
	176 -> USSvcImpl_FolderMetadata_GetFolderName
	177 -> USSvcImpl_FolderMetadata_GetFolderType
	178 -> USSvcImpl_FolderMetadata_GetRemoteKnowledge
	179 -> USSvcImpl_FolderMetadata_SetRemoteKnowledge
	180 -> USSvcImpl_FolderMetadata_AddItem
	181 -> USSvcImpl_FolderMetadata_LookupItemObjectId
	182 -> USSvcImpl_FolderMetadata_LookupItemRemoteId
	183 -> USSvcImpl_FolderMetadata_GetItems
	184 -> USSvcImpl_FolderMetadata_AddFolder
	185 -> USSvcImpl_FolderMetadata_LookupFolderObjectId
	186 -> USSvcImpl_FolderMetadata_LookupFolderRemoteId
	187 -> USSvcImpl_FolderMetadata_GetChildFolders
	188 -> USSvcImpl_FolderMetadata_Delete
	189 -> USSvcImpl_FolderMetadata_DeleteInBatches
	190 -> USSvcImpl_MeetingResponse_GetResponseId
	191 -> USSvcImpl_MeetingResponse_GetMeetingMetadata
	192 -> USSvcImpl_MeetingResponse_GetMeetingPermanentId
	193 -> USSvcImpl_MeetingResponse_GetMeetingInstanceId
	194 -> USSvcImpl_MeetingResponse_GetResponseType
	195 -> USSvcImpl_MeetingResponse_GetMeetingUserComments
	196 -> USSvcImpl_MeetingResponse_GetPlaceholderMeetingObjectId
	197 -> USSvcImpl_MeetingResponse_GetPropsBlob
	198 -> USSvcImpl_MeetingResponse_SetProps
	199 -> USSvcImpl_MeetingResponse_Delete
	200 -> USSvcImpl_ItemMetadataEnum_Next
	201 -> USSvcImpl_ItemMetadataEnum_Skip
	202 -> USSvcImpl_ItemMetadataEnum_Reset
	203 -> USSvcImpl_ItemMetadataEnum_Clone
	204 -> USSvcImpl_FolderMetadataEnum_Next
	205 -> USSvcImpl_FolderMetadataEnum_Skip
	206 -> USSvcImpl_FolderMetadataEnum_Reset
	207 -> USSvcImpl_FolderMetadataEnum_Clone
	208 -> USSvcImpl_EnumMeetingResponses_Next
	209 -> USSvcImpl_EnumMeetingResponses_Skip
	210 -> USSvcImpl_EnumMeetingResponses_Reset
	211 -> USSvcImpl_EnumMeetingResponses_Clone
RPC  c8ba73d2-3d55-429c-8e9a-c44f006f69fc (0.0) -- c:\windows\system32\userdataservice.dll
	0 -> UdmSvcImpl_CloseEnumHandle
	1 -> UdmSvcImpl_CloseSessionHandle
	2 -> UdmSvcImpl_OpenSession
	3 -> UdmSvcImpl_CreateSessionWithSameSecurityContext
	4 -> UdmSvcImpl_OpenCallHistorySession
	5 -> UdmSvcImpl_EnableProcessForTesting
	6 -> UdmSvcImpl_EnableUserDataServiceBackgroundNotification
	7 -> UdmSvcImpl_CheckObjectExistence
	8 -> UdmSvcImpl_GetObjectProperties
	9 -> UdmSvcImpl_GetObjectPropertiesWithScope
	10 -> UdmSvcImpl_GetAppointmentProperties
	11 -> UdmSvcImpl_GetCallHistoryEnum
	12 -> UdmSvcImpl_DeleteCallHistory
	13 -> UdmSvcImpl_MarkCallHistorySeen
	14 -> UdmSvcImpl_CreateCallHistoryItem
	15 -> UdmSvcImpl_GetUnseenCallCount
	16 -> UdmSvcImpl_UpdateCallDetails
	17 -> UdmSvcImpl_ResolveCalls
	18 -> UdmSvcImpl_GetCallHistoryEntryEnum
	19 -> UdmSvcImpl_UpdateEnumPropertySet
	20 -> UdmSvcImpl_EnumFetchObjects
	21 -> UdmSvcImpl_EnumFetchMatchingObjects
	22 -> UdmSvcImpl_EnumGetCount
	23 -> UdmSvcImpl_EnumGetState
	24 -> UdmSvcImpl_EnumMoveFirst
	25 -> UdmSvcImpl_EnumMoveLast
	26 -> UdmSvcImpl_CreateCallFavoriteItem
	27 -> UdmSvcImpl_DeleteCallFavorite
	28 -> UdmSvcImpl_MoveCallFavoriteItem
	29 -> UdmSvcImpl_ReorderGroups
	30 -> UdmSvcImpl_ResolveFavorites
	31 -> UdmSvcImpl_GetCallFavoriteEnum
	32 -> UdmSvcImpl_ControlSessionNotifies
	33 -> UdmSvcImpl_Advise
	34 -> UdmSvcImpl_Unadvise
	35 -> UdmSvcImpl_HasNotifications
	36 -> UdmSvcImpl_GetNotifyMessage
	37 -> UdmSvcImpl_GetFilePropertyStream
	38 -> UdmSvcImpl_UpdateCallHistoryObjects
	39 -> UdmSvcImpl_UpdateCalendarObjects
	40 -> UdmSvcImpl_GetUnexpandedAppointmentEnum
	41 -> UdmSvcImpl_GetCalendarEnum
	42 -> UdmSvcImpl_GetAppointmentEnum
	43 -> UdmSvcImpl_GetSingleAppointmentEnum
	44 -> UdmSvcImpl_GetAppointmentSearchEnum
	45 -> UdmSvcImpl_GetAppointmentExceptionEnum
	46 -> UdmSvcImpl_GetAppointmentRevisionEnum
	47 -> UdmSvcImpl_GetConflictInfoById
	48 -> UdmSvcImpl_GetConflictInfoByProperties
	49 -> UdmSvcImpl_GetAppointmentAppInfo
	50 -> UdmSvcImpl_GetLocalIdArrayFromAppointmentRemoteObjectId
	51 -> UdmSvcImpl_SetAutoReplySettings
	52 -> UdmSvcImpl_GetAutoReplySettings
	53 -> UdmSvcImpl_StartOrResetChangeTracking
	54 -> UdmSvcImpl_ValidateCallerAccess
	55 -> UdmSvcImpl_GenerateValidationToken
	56 -> UdmSvcImpl_RedeemValidationToken
	57 -> UdmSvcImpl_DeleteAllPackageData
	58 -> UdmSvcImpl_CleanupStaleAppData
	59 -> UdmSvcImpl_UpdateChatObjects
	60 -> UdmSvcImpl_UpdateChangeTracking
	61 -> UdmSvcImpl_ValidateChatMessage
	62 -> UdmSvcImpl_GetChatObjectProperties
	63 -> UdmSvcImpl_GetChatMessageEnum
	64 -> UdmSvcImpl_GetChatRevisionMessageEnum
	65 -> UdmSvcImpl_EnumFetchChatMessages
	66 -> UdmSvcImpl_GetChatConversationEnum
	67 -> UdmSvcImpl_GetChatSearchEnum
	68 -> UdmSvcImpl_GetChatConversationIdFromThreadingInfo
	69 -> UdmSvcImpl_GetChatTransports
	70 -> UdmSvcImpl_RegisterChatTransport
	71 -> UdmSvcImpl_GetChatApps
	72 -> UdmSvcImpl_GetDefaultChatApp
	73 -> UdmSvcImpl_SetDefaultChatApp
	74 -> UdmSvcImpl_NotifyChatApp
	75 -> UdmSvcImpl_UpdateAnnotationObjects
	76 -> UdmSvcImpl_GetContactMatchSuggestions
	77 -> UdmSvcImpl_UpdateContactObjects
	78 -> UdmSvcImpl_ContactLinking
	79 -> UdmSvcImpl_SetContactPreference
	80 -> UdmSvcImpl_SetRemoteIdentificationInformation
	81 -> UdmSvcImpl_GetMeContactId
	82 -> UdmSvcImpl_VCardToContact
	83 -> UdmSvcImpl_ContactToVCard
	84 -> UdmSvcImpl_SetContactNameOrder
	85 -> UdmSvcImpl_SetContactNameIncludeMiddle
	86 -> UdmSvcImpl_ToggleContactMaintenance
	87 -> UdmSvcImpl_GetObjectByRemoteId
	88 -> UdmSvcImpl_GetAnnotationListEnum
	89 -> UdmSvcImpl_GetContactListEnum
	90 -> UdmSvcImpl_GetContactEnum
	91 -> UdmSvcImpl_GetAnnotationEnum
	92 -> UdmSvcImpl_GetContactRevisionEnum
	93 -> UdmSvcImpl_UpdateEmailObjects
	94 -> UdmSvcImpl_GetEmailFolderMessageCounts
	95 -> UdmSvcImpl_GetEmailMailboxEnum
	96 -> UdmSvcImpl_GetEmailFolderEnum
	97 -> UdmSvcImpl_GetEmailRevisionEnum
	98 -> UdmSvcImpl_GetEmailMessageEnum
	99 -> UdmSvcImpl_GetEmailConversationEnum
	100 -> UdmSvcImpl_IsChangeTrackingEnabled
	101 -> UdmSvcImpl_EmptyEmailFolder
	102 -> UdmSvcImpl_CreateResponseMessage
	103 -> UdmSvcImpl_MoveFolder
	104 -> UdmSvcImpl_CreateFolder
	105 -> UdmSvcImpl_RespondToMeeting
	106 -> UdmSvcImpl_ForwardMeeting
	107 -> UdmSvcImpl_ProposeNewTimeForMeeting
	108 -> UdmSvcImpl_ResolveRecipients
	109 -> UdmSvcImpl_ValidateCertificates
	110 -> UdmSvcImpl_GetMessageIdFromAttachmentId
	111 -> UdmSvcImpl_RegisterSyncManager
	112 -> UdmSvcImpl_SyncObject
	113 -> UdmSvcImpl_GetUserDataAccountEnum
	114 -> UdmSvcImpl_UpdateUserDataAccountObjects
	115 -> UdmSvcImpl_MakeDefaultAccount
	116 -> UdmSvcImpl_GetCachedChatCapabilities
	117 -> UdmSvcImpl_GetChatCapabilitiesFromNetwork
	118 -> UdmSvcImpl_GetRcsServiceStatus
	119 -> UdmSvcImpl_SendLocalParticipantComposing
	120 -> UdmSvcImpl_RaiseRemoteParticipantComposing
	121 -> UdmSvcImpl_AdviseForConversationComposingStatusChanges
	122 -> UdmSvcImpl_UnadviseFromConversationComposingStatusChanges
	123 -> UdmSvcImpl_GetChatCloudServiceSettings
	124 -> UdmSvcImpl_SetChatCloudServiceSettings
	125 -> UdmSvcImpl_UpdateRcsEndUserMessage
	126 -> UdmSvcImpl_StartCloudServiceSync
	127 -> UdmSvcImpl_UpdateTaskObjects
	128 -> UdmSvcImpl_GetTaskListEnum
	129 -> UdmSvcImpl_GetTaskEnum
	130 -> UdmSvcImpl_UpdateContactGroupObjects
	131 -> UdmSvcImpl_GetContactGroupEnum
	132 -> UdmSvcImpl_GetContactGroupMemberEnum
RPC  43890c94-bfd7-4655-ad6a-b4a68397cdcb (0.0) -- c:\windows\system32\pimindexmaintenance.dll
	0 -> PimIMService_UpdateStores
	1 -> PimIMService_UpdateItems
	2 -> PimIMService_RebuildAggregateCache
	3 -> PimIMService_Suspend
	4 -> PimIMService_Resume
	5 -> PimIMService_CacheAggregateCacheFileMapping
	6 -> PimIMService_LoadAggregateCache
	7 -> PimIMService_CreateIndexedFilter
	8 -> PimIMService_SetStaticFilter
	9 -> PimIMService_GetIndexedProperties
	10 -> PimIMService_FindNextServerMatch
	11 -> PimIMService_SetFilter
	12 -> PimIMService_Reset
	13 -> PimIMService_CloseIndexedFilter
RPC  923c9623-db7f-4b34-9e6d-e86580f8ca2a (1.0) -- C:\Windows\System32\SyncController.dll
	0 -> AccountsMgmtRpcCreateAccount
	1 -> AccountsMgmtRpcDeleteAccount
	2 -> AccountsMgmtRpcConvertWebAccountIdFromAppSpecificId
	3 -> AccountsMgmtRpcConvertWebAccountIdToAppSpecificId
	4 -> AccountsMgmtRpcSyncAccount
	5 -> AccountsMgmtRpcSyncAccountAndWaitForCompletion
	6 -> AccountsMgmtRpcQueryAccountProperties
	7 -> AccountsMgmtRpcSaveAccountProperties
	8 -> AccountsMgmtRpcEnumAccounts
	9 -> AccountsMgmtRpcAdviseAccount
	10 -> AccountsMgmtRpcUnadviseAccount
	11 -> AccountsMgmtRpcGetNotifications
	12 -> AccountsMgmtRpcDiscoverExchangeServerConfig
	13 -> AccountsMgmtRpcDiscoverExchangeServerAuthType
	14 -> AccountsMgmtRpcVerifyExchangeMailBoxTokenAuth
	15 -> AccountsMgmtRpcDiscoverInternetMailServerConfig
	16 -> AccountsMgmtRpcCancelDiscoverInternetMailServerConfig
	17 -> AccountsMgmtRpcMayIgnoreInvalidServerCertificate
OLE  c092cc2f-5eca-5a5d-9c9c-f050e892dd97 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountAddedEventArgs
OLE  dc8b9f35-216c-54ff-99db-cd7e04c6a074 (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountChangedEventArgs
OLE  df3657fc-19c8-5e99-b48f-4a59b98d4e8a (0.0) -- __FITypedEventHandler_2_Windows__CInternal__CSecurity__CAuthentication__CWeb__CTokenBrokerInternal_Windows__CInternal__CSecurity__CAuthentication__CWeb__CWebAccountDeletedEventArgs
OLE  51aa6c40-b054-5c68-801e-03b75f43e2a1 (0.0) -- __FIAsyncOperationCompletedHandler_1_Windows__CInternal__CSecurity__CAuthentication__CWeb__CGetDefaultSignInAccountResult
OLE  9477622b-1340-5574-81fc-5013581f57c9 (0.0) -- __FIAsyncOperationCompletedHandler_1_Windows__CSecurity__CCredentials__CWebAccountProvider
OLE  4bd6f1e5-ca89-5240-8f3d-7f1b54ae90a7 (0.0) -- __FIAsyncOperationCompletedHandler_1_Windows__CSecurity__CCredentials__CWebAccount
OLE  eb9d0454-25db-5620-98b8-be4c5d0dbc67 (0.0) -- Windows.Foundation.TypedEventHandler[Windows.System.UserWatcher, Windows.System.UserChangedEventArgs]
OLE  deb54b22-70f2-55ab-97c0-6cbdc5ddb6f0 (0.0) -- __FIAsyncOperationCompletedHandler_1_Windows__CSecurity__CAuthentication__CWeb__CCore__CWebTokenRequestResult
OLE  ac7f26f2-feb7-5b2a-8ac4-345bc62caede (0.0) -- IMapView<HSTRING,HSTRING>
OLE  af86e2e0-b12d-4c6a-9c5a-d7aa65101e90 (0.0) -- IInspectable
OLE  e9bdaaf0-cbf6-5c72-be90-29cbf3a1319b (0.0) -- IIterable<IKeyValuePair<HSTRING,HSTRING> >
OLE  05eb86f1-7140-5517-b88d-cbaebe57e6b1 (0.0) -- IIterator<IKeyValuePair<HSTRING,HSTRING> >
OLE  60310303-49c5-52e6-abc6-a9b36eccc716 (0.0) -- IKeyValuePair<HSTRING,HSTRING>
OLE  199e065c-8195-55da-9c10-8aeaf9ac1062 (0.0) -- __FIVectorView_1_Windows__CSecurity__CAuthentication__CWeb__CCore__CWebTokenResponse
OLE  00000141-0000-0000-c000-000000000046 (0.0) -- IDLLHost
OLE  00000035-0000-0000-c000-000000000046 (0.0) -- IActivationFactory
OLE  8142b78c-3c08-53fe-a74e-506063c49063 (0.0) -- __FIAsyncOperationCompletedHandler_1_PhoneInternal__CExperiences__CSync__CAccount
OLE  a4ed5c81-76c9-40bd-8be6-b1d90fb20ae7 (0.0) -- IAsyncActionCompletedHandler
OLE  62e9e23a-de30-5736-b0e5-9e9925442328 (0.0) -- __FIAsyncOperationCompletedHandler_1_PhoneInternal__CExperiences__CSync__CAccountStatus
OLE  826bd12f-c1bb-5730-bf72-05db739871ae (0.0) -- __FIAsyncOperationCompletedHandler_1_PhoneInternal__CExperiences__CSync__CAccountErrorInformation
OLE  c1f995d7-c911-57c7-99e0-38239f48cfe1 (0.0) -- __FIAsyncOperationCompletedHandler_1_PhoneInternal__CExperiences__CSync__CAccountSyncScheduleInformation
Endpoints :
ncalrpc         : LRPC-a792c135343a94d522
ncalrpc         : OLEB787535FB75A9891F1EF1878FDC8
--------------------------------------------------------------------------------
<WinProcess "ProcessHacker.exe" pid 372 at 0x5df26d8L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "TrustedInstaller.exe" pid 5924 at 0x5df23c8L>
64
['TrustedInstaller']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "OpenWith.exe" pid 11228 at 0x5df2550L>
64

Interfaces :
RPC  30adc50c-5cbc-46ce-9a0e-91914789e23c (1.0) -- c:\windows\system32\nrpsrv.DLL
	0 -> RpcNrpGetAddrInfo
	1 -> RpcNrpGetNameInfo
Endpoints :
ncalrpc         : LRPC-64bba7c0828029142e
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11996 (DEAD) at 0x5df2f60L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 13272 at 0x5df2a90L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 4892 at 0x5df2da0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11184 at 0x5df2b38L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 6400 at 0x5df2ef0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 1424 at 0x5df22b0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 8248 at 0x5df2630L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 12400 at 0x5df2cc0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 5412 at 0x5df2518L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11528 at 0x5df26a0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 4572 at 0x5df29b0L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11864 at 0x5df2908L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 7156 at 0x5df2ba8L>
64
['WinHttpAutoProxySvc']

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 2024 at 0x5df2390L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 10584 at 0x5df2e48L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "svchost.exe" pid 6860 at 0x5df2160L>
--------------------------------------------------------------------------------
<WinProcess "audiodg.exe" pid 12832 at 0x5df24a8L>
64

Interfaces :
RPC  de3b9bc8-bef7-4578-a0de-f089048442db (1.0) -- C:\WINDOWS\system32\AUDIODG.EXE
	0 -> AudioDGShutdownADG
	1 -> AudioDGGetStartupStatus
	2 -> AudioDGChallenge
	3 -> AudioDGGetStreamVpoDescription
	4 -> AudioDGSetStreamVpoPolicySchemas
	5 -> AudioDGCloseStreamVpo
	6 -> AudioDGGetDeviceGraphWnfStateName
	7 -> AudioDGGetVpoFromVpoContext
OLE  00000134-0000-0000-c000-000000000046 (0.0) -- IRundown
RPC  18f70770-8e64-11cf-9af1-0020af6e72f4 (0.0) -- C:\WINDOWS\System32\combase.dll
	0 -> _UseProtseq
	1 -> _GetCustomProtseqInfo
	2 -> _UpdateResolverBindings
	3 -> _NotifyFDT
	4 -> _ControlTracing
OLE  00000131-0000-0000-c000-000000000046 (0.0) -- IRemUnknown
OLE  00000143-0000-0000-c000-000000000046 (0.0) -- IRemUnknown2
OLE  00000132-0000-0000-c000-000000000046 (0.0) -- ILocalSystemActivator
OLE  69fed9b6-5405-48b8-3db0-4ca492fc3677 (0.0) -- IAPOWrapperSrv
OLE  fd7f2b29-24d0-4b5c-b177-592c39f9ca10 (0.0) -- iaudioprocessingobject
OLE  816e5b3e-5523-4efc-9223-98ec4214c3a0 (0.0) -- IStreamGroup
OLE  5d857e80-f074-4ad8-a9ce-0ddca68d8212 (0.0) -- IProcessSubmix
OLE  d81229b1-5a43-480c-92f7-be0f7f4eab60 (0.0) -- iaudiovolume
OLE  885c7b80-3fa2-4e5a-be07-cf01e1d6e2cd (0.0) -- iaudiomuteapo
OLE  419b26e3-fa99-4408-83de-cc1276efa489 (0.0) -- iaudiometer
OLE  69e1f79f-6eae-4517-be9f-13aa90e30014 (0.0) -- iaudioprocessingobjectinternal
OLE  3c169ff7-37b2-484c-b199-c3155590f316 (0.0) -- iaudiodevicegraph
OLE  610c5f91-da25-52b0-ae7d-2d3a45cdf4ef (0.0) -- ITypedEventHandler_2_Windows__CMedia__CDevices__CInternal__CAudioDeviceBroker_Windows__CMedia__CDevices__CInternal__CAudioDeviceBrokerChangedEventArgs
Endpoints :
ncalrpc         : AudioDeviceGraph
ncalrpc         : OLEFC07AE218C36E20B32DDF1039276
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 8164 at 0x5df2860L>
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11404 at 0x5df2358L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 2116 at 0x5df2828L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 7632 at 0x5df2d68L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "chrome.exe" pid 11116 at 0x5df29e8L>
--------------------------------------------------------------------------------
<WinProcess "SystemSettingsBroker.exe" pid 5100 at 0x5df2978L>
64

Interfaces :
Endpoints :
--------------------------------------------------------------------------------
<WinProcess "SearchProtocolHost.exe" pid 6808 at 0x5df2780L>
--------------------------------------------------------------------------------
<WinProcess "SearchFilterHost.exe" pid 12844 at 0x5df2a58L>
--------------------------------------------------------------------------------
<WinProcess "python.exe" pid 8052 at 0x5df2588L>
64

Interfaces :
Endpoints :

Words removed	185
Total words	2238
Words removed (%)	8.27

Words added	188
Total words	2241
Words added (%)	8.39