1:45 PM 11/12/2025 ���� JFIF    �� �        "" $(4,$&1'-=-157:::#+?D?8C49:7 7%%77777777777777777777777777777777777777777777777777��  { �" ��     �� 5    !1AQa"q�2��BR��#b�������  ��  ��   ? ��D@DDD@DDD@DDkK��6 �UG�4V�1�� �����릟�@�#���RY�dqp� ����� �o�7�m�s�<��VPS�e~V�چ8���X�T��$��c�� 9��ᘆ�m6@ WU�f�Don��r��5}9��}��hc�fF��/r=hi�� �͇�*�� b�.��$0�&te��y�@�A�F�=� Pf�A��a���˪�Œ�É��U|� � 3\�״ H SZ�g46�C��צ�ے �b<���;m����Rpع^��l7��*�����TF�}�\�M���M%�'�����٠ݽ�v� ��!-�����?�N!La��A+[`#���M����'�~oR�?��v^)��=��h����A��X�.���˃����^Ə��ܯsO"B�c>; �e�4��5�k��/CB��.  �J?��;�҈�������������������~�<�VZ�ꭼ2/)Í”jC���ע�V�G�!���!�F������\�� Kj�R�oc�h���:Þ I��1"2�q×°8��Р@ז���_C0�ր��A��lQ��@纼�!7��F�� �]�sZ B�62r�v�z~�K�7�c��5�.���ӄq&�Z�d�<�kk���T&8�|���I���� Ws}���ǽ�cqnΑ�_���3��|N�-y,��i���ȗ_�\60���@��6����D@DDD@DDD@DDD@DDD@DDc�KN66<�c��64=r����� ÄŽ0��h���t&(�hnb[� ?��^��\��â|�,�/h�\��R��5�? �0�!צ܉-����G����٬��Q�zA���1�����V��� �:R���`�$��ik��H����D4�����#dk����� h�}����7���w%�������*o8wG�LycuT�.���ܯ7��I��u^���)��/c�,s�Nq�ۺ�;�ך�YH2���.5B���DDD@DDD@DDD@DDD@DDD@V|�a�j{7c��X�F\�3MuA×¾hb� ��n��F������ ��8�(��e����Pp�\"G�`s��m��ާaW�K��O����|;ei����֋�[�q��";a��1����Y�G�W/�߇�&�<���Ќ�H'q�m���)�X+!���=�m�ۚ丷~6a^X�)���,�>#&6G���Y��{����"" """ """ """ """ ""��at\/�a�8 �yp%�lhl�n����)���i�t��B�������������?��modskinlienminh.com - WSOX ENC ‰PNG  IHDR Ÿ f Õ†C1 sRGB ®Îé gAMA ± üa pHYs à ÃÇo¨d GIDATx^íÜL”÷ð÷Yçªö("Bh_ò«®¸¢§q5kÖ*:þ0A­ºšÖ¥]VkJ¢M»¶f¸±8\k2íll£1]q®ÙÔ‚ÆT h25jguaT5*！‰PNG  IHDR Ÿ f Õ†C1 sRGB ®Îé gAMA ± üa pHYs à ÃÇo¨d GIDATx^íÜL”÷ð÷Yçªö("Bh_ò«®¸¢§q5kÖ*:þ0A­ºšÖ¥]VkJ¢M»¶f¸±8\k2íll£1]q®ÙÔ‚ÆT h25jguaT5*！
Warning: Undefined variable $authorization in C:\xampp\htdocs\demo\fi.php on line 57

Warning: Undefined variable $translation in C:\xampp\htdocs\demo\fi.php on line 118

Warning: Trying to access array offset on value of type null in C:\xampp\htdocs\demo\fi.php on line 119

Warning: file_get_contents(https://raw.githubusercontent.com/Den1xxx/Filemanager/master/languages/ru.json): Failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found in C:\xampp\htdocs\demo\fi.php on line 120

Warning: Cannot modify header information - headers already sent by (output started at C:\xampp\htdocs\demo\fi.php:1) in C:\xampp\htdocs\demo\fi.php on line 247

Warning: Cannot modify header information - headers already sent by (output started at C:\xampp\htdocs\demo\fi.php:1) in C:\xampp\htdocs\demo\fi.php on line 248

Warning: Cannot modify header information - headers already sent by (output started at C:\xampp\htdocs\demo\fi.php:1) in C:\xampp\htdocs\demo\fi.php on line 249

Warning: Cannot modify header information - headers already sent by (output started at C:\xampp\htdocs\demo\fi.php:1) in C:\xampp\htdocs\demo\fi.php on line 250

Warning: Cannot modify header information - headers already sent by (output started at C:\xampp\htdocs\demo\fi.php:1) in C:\xampp\htdocs\demo\fi.php on line 251

Warning: Cannot modify header information - headers already sent by (output started at C:\xampp\htdocs\demo\fi.php:1) in C:\xampp\htdocs\demo\fi.php on line 252
#pragma autorecover #pragma namespace("\\\\.\\root\\Microsoft\\Windows\\Defender") Instance of __Win32Provider as $prov { Name = "ProtectionManagement"; ClsId = "{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}"; ImpersonationLevel = 1; HostingModel = "LocalServiceHost"; version = 1073741825; }; Instance of __MethodProviderRegistration { Provider = $prov; }; Instance of __EventProviderRegistration { Provider = $prov; eventQueryList = {"select * from MSFT_MpEvent"}; }; Instance of __InstanceProviderRegistration { Provider = $prov; supportsGet = TRUE; supportsPut = TRUE; supportsDelete = TRUE; supportsEnumeration = TRUE; QuerySupportLevels; }; [locale(1033)] class BaseStatus { }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpComputerStatus : BaseStatus { [read : ToSubclass,key] string ComputerID = ""; [BitMap{"0", "1", "2", "4", "8", "16"} : ToSubclass,read : ToSubclass] uint32 ComputerState = 0; [read : ToSubclass] string AMRunningMode = ""; [read : ToSubclass] string AMProductVersion = ""; [read : ToSubclass] string AMServiceVersion = ""; string AntispywareSignatureVersion = ""; [read : ToSubclass] uint32 AntispywareSignatureAge = 0; [read : ToSubclass] datetime AntispywareSignatureLastUpdated; [read : ToSubclass] string AntivirusSignatureVersion = ""; [read : ToSubclass] uint32 AntivirusSignatureAge = 0; [read : ToSubclass] datetime AntivirusSignatureLastUpdated; string NISSignatureVersion = ""; [read : ToSubclass] uint32 NISSignatureAge = 0; [read : ToSubclass] datetime NISSignatureLastUpdated; [read : ToSubclass] datetime FullScanStartTime; [read : ToSubclass] datetime FullScanEndTime; [read : ToSubclass] uint32 FullScanAge = 0; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 LastFullScanSource = 0; [ValueMap{"0", "1", "2"} : ToSubclass,read : ToSubclass] uint8 RealTimeScanDirection = 0; [read : ToSubclass] datetime QuickScanStartTime; [read : ToSubclass] datetime QuickScanEndTime; [read : ToSubclass] uint32 QuickScanAge = 0; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 LastQuickScanSource = 0; [read : ToSubclass] string AMEngineVersion = ""; [read : ToSubclass] boolean AMServiceEnabled = FALSE; [read : ToSubclass] boolean OnAccessProtectionEnabled = FALSE; [read : ToSubclass] boolean IoavProtectionEnabled = FALSE; [read : ToSubclass] boolean BehaviorMonitorEnabled = FALSE; [read : ToSubclass] boolean AntivirusEnabled = FALSE; [read : ToSubclass] boolean AntispywareEnabled = FALSE; [read : ToSubclass] boolean IsVirtualMachine = FALSE; [read : ToSubclass] boolean IsTamperProtected = FALSE; [read : ToSubclass] string TamperProtectionSource = ""; [read : ToSubclass] boolean RealTimeProtectionEnabled = FALSE; [read : ToSubclass] string NISEngineVersion = ""; [read : ToSubclass] boolean NISEnabled = FALSE; }; [Indication : ToSubclass DisableOverride,dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpEvent { [ValueMap{"1", "2", "4", "8"} : ToSubclass,read : ToSubclass,key] uint32 CategoryDiscriminant; [BitMap{"1", "2"} : ToSubclass,read : ToSubclass] uint32 ScanNotificationsValue; [BitMap{"1", "2", "4", "8", "16"} : ToSubclass,read : ToSubclass] uint32 ThreatNotificationsValue; [BitMap{"1"} : ToSubclass,read : ToSubclass] uint32 SignatureNotificationsValue; [BitMap{"1", "2", "4", "8", "16", "32", "64"} : ToSubclass,read : ToSubclass] uint32 ComputerNotificationsValue; [read : ToSubclass] datetime NotificationTime; [read : ToSubclass] uint32 AdditionalData; }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpHeartBeat { [implemented,static : ToSubclass DisableOverride] uint32 Send(); }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpPreference { [read : ToSubclass,key] string ComputerID = ""; boolean DisableAutoExclusions = FALSE; string ExclusionPath[]; string ExclusionExtension[]; string ExclusionProcess[]; string ExclusionIpAddress[]; uint32 QuarantinePurgeItemsAfterDelay; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 RealTimeScanDirection = 0; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 RemediationScheduleDay; datetime RemediationScheduleTime; uint32 ReportingAdditionalActionTimeOut; uint32 ReportingCriticalFailureTimeOut; uint32 ReportingNonCriticalTimeOut; uint8 ScanAvgCPULoadFactor; boolean CheckForSignaturesBeforeRunningScan; uint32 ScanPurgeItemsAfterDelay; boolean ScanOnlyIfIdleEnabled; [ValueMap{"1", "2"} : ToSubclass] uint8 ScanParameters; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 ScanScheduleDay; datetime ScanScheduleQuickScanTime; datetime ScanScheduleTime; uint32 SignatureFirstAuGracePeriod; uint32 SignatureAuGracePeriod; string SignatureDefinitionUpdateFileSharesSources; boolean SignatureDisableUpdateOnStartupWithoutEngine; string SignatureFallbackOrder; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 SignatureScheduleDay; datetime SignatureScheduleTime; uint32 SignatureUpdateCatchupInterval; uint32 SignatureUpdateInterval; string SignatureBlobFileSharesSources; uint32 SignatureBlobUpdateInterval; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 MAPSReporting; [ValueMap{"0", "1", "2", "3"} : ToSubclass] uint8 SubmitSamplesConsent; boolean DisablePrivacyMode; boolean RandomizeScheduleTaskTimes; uint32 SchedulerRandomizationTime; boolean DisableBehaviorMonitoring; boolean DisableIntrusionPreventionSystem; boolean DisableIOAVProtection; boolean DisableRealtimeMonitoring; boolean DisableScriptScanning; boolean DisableArchiveScanning; boolean DisableCatchupFullScan; boolean DisableCatchupQuickScan; boolean DisableEmailScanning; boolean DisableRemovableDriveScanning; boolean DisableRestorePoint; boolean DisableScanningMappedNetworkDrivesForFullScan; boolean DisableScanningNetworkFiles; boolean UILockdown; sint64 ThreatIDDefaultAction_Ids[]; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[]; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 UnknownThreatDefaultAction; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 LowThreatDefaultAction; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ModerateThreatDefaultAction; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 HighThreatDefaultAction; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 SevereThreatDefaultAction; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 PUAProtection; boolean DisableBlockAtFirstSeen; [ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] uint8 CloudBlockLevel; uint32 CloudExtendedTimeout; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 EnableNetworkProtection; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] uint8 EnableControlledFolderAccess; string AttackSurfaceReductionOnlyExclusions[]; string AttackSurfaceReductionRules_Ids[]; [ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[]; string ControlledFolderAccessAllowedApplications[]; string ControlledFolderAccessProtectedFolders[]; string SharedSignaturesPath; boolean EnableLowCpuPriority; boolean EnableFileHashComputation; boolean MeteredConnectionUpdates; boolean AllowNetworkProtectionOnWinServer; boolean DisableDatagramProcessing; boolean DisableCpuThrottleOnIdleScans; boolean EnableFullScanOnBatteryPower; string ProxyPacUrl; string ProxyServer; string ProxyBypass[]; boolean ForceUseProxyOnly; boolean DisableTlsParsing; boolean DisableHttpParsing; boolean DisableDnsParsing; boolean DisableDnsOverTcpParsing; boolean DisableSshParsing; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 PlatformUpdatesChannel; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 EngineUpdatesChannel; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 SignaturesUpdatesChannel; boolean DisableGradualRelease; boolean AllowNetworkProtectionDownLevel; boolean AllowDatagramProcessingOnWinServer; boolean EnableDnsSinkhole; boolean DisableInboundConnectionFiltering; boolean DisableRdpParsing; [implemented,static : ToSubclass DisableOverride] uint32 Set([In] boolean DisableAutoExclusions,[In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] uint32 QuarantinePurgeItemsAfterDelay,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 RealTimeScanDirection,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 RemediationScheduleDay,[In] datetime RemediationScheduleTime,[In] uint32 ReportingAdditionalActionTimeOut,[In] uint32 ReportingCriticalFailureTimeOut,[In] uint32 ReportingNonCriticalTimeOut,[In] uint8 ScanAvgCPULoadFactor,[In] boolean CheckForSignaturesBeforeRunningScan,[In] uint32 ScanPurgeItemsAfterDelay,[In] boolean ScanOnlyIfIdleEnabled,[In,ValueMap{"1", "2"} : ToSubclass] uint8 ScanParameters,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 ScanScheduleDay,[In] datetime ScanScheduleQuickScanTime,[In] datetime ScanScheduleTime,[In] uint32 SignatureFirstAuGracePeriod,[In] uint32 SignatureAuGracePeriod,[In] string SignatureDefinitionUpdateFileSharesSources,[In] boolean SignatureDisableUpdateOnStartupWithoutEngine,[In] string SignatureFallbackOrder,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 SignatureScheduleDay,[In] datetime SignatureScheduleTime,[In] uint32 SignatureUpdateCatchupInterval,[In] string SignatureBlobFileSharesSources,[In] uint32 SignatureUpdateInterval,[In] uint32 SignatureBlobUpdateInterval,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 MAPSReporting,[In,ValueMap{"0", "1", "2", "3"} : ToSubclass] uint8 SubmitSamplesConsent,[In] boolean DisablePrivacyMode,[In] boolean RandomizeScheduleTaskTimes,[In] uint32 SchedulerRandomizationTime,[In] boolean DisableBehaviorMonitoring,[In] boolean DisableIntrusionPreventionSystem,[In] boolean DisableIOAVProtection,[In] boolean DisableRealtimeMonitoring,[In] boolean DisableScriptScanning,[In] boolean DisableArchiveScanning,[In] boolean DisableCatchupFullScan,[In] boolean DisableCatchupQuickScan,[In] boolean DisableEmailScanning,[In] boolean DisableRemovableDriveScanning,[In] boolean DisableRestorePoint,[In] boolean DisableScanningMappedNetworkDrivesForFullScan,[In] boolean DisableScanningNetworkFiles,[In] boolean UILockdown,[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 UnknownThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 LowThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ModerateThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 HighThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 SevereThreatDefaultAction,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 PUAProtection,[In] boolean DisableBlockAtFirstSeen,[In,ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] uint8 CloudBlockLevel,[In] uint32 CloudExtendedTimeout,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 EnableNetworkProtection,[In,ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] uint8 EnableControlledFolderAccess,[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[In] string SharedSignaturesPath,[In] boolean EnableLowCpuPriority,[In] boolean EnableFileHashComputation,[In] boolean MeteredConnectionUpdates,[In] boolean AllowNetworkProtectionOnWinServer,[In] boolean DisableDatagramProcessing,[In] boolean DisableCpuThrottleOnIdleScans,[In] boolean EnableFullScanOnBatteryPower,[In] string ProxyPacUrl,[In] string ProxyServer,[In] string ProxyBypass[],[In] boolean ForceUseProxyOnly,[In] boolean DisableTlsParsing,[In] boolean DisableHttpParsing,[In] boolean DisableDnsParsing,[In] boolean DisableDnsOverTcpParsing,[In] boolean DisableSshParsing,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 PlatformUpdatesChannel,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 EngineUpdatesChannel,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 SignaturesUpdatesChannel,[In] boolean DisableGradualRelease,[In] boolean AllowNetworkProtectionDownLevel,[In] boolean AllowDatagramProcessingOnWinServer,[In] boolean EnableDnsSinkhole,[In] boolean DisableInboundConnectionFiltering,[In] boolean DisableRdpParsing,[In] boolean Force); [implemented,static : ToSubclass DisableOverride] uint32 Remove([In] boolean DisableAutoExclusions,[In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] boolean QuarantinePurgeItemsAfterDelay,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean RealTimeScanDirection,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean RemediationScheduleDay,[In] boolean RemediationScheduleTime,[In] boolean ReportingAdditionalActionTimeOut,[In] boolean ReportingCriticalFailureTimeOut,[In] boolean ReportingNonCriticalTimeOut,[In] boolean ScanAvgCPULoadFactor,[In] boolean CheckForSignaturesBeforeRunningScan,[In] boolean ScanPurgeItemsAfterDelay,[In] boolean ScanOnlyIfIdleEnabled,[In,ValueMap{"1", "2"} : ToSubclass] boolean ScanParameters,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean ScanScheduleDay,[In] boolean ScanScheduleQuickScanTime,[In] boolean ScanScheduleTime,[In] boolean SignatureFirstAuGracePeriod,[In] boolean SignatureAuGracePeriod,[In] boolean SignatureDefinitionUpdateFileSharesSources,[In] boolean SignatureDisableUpdateOnStartupWithoutEngine,[In] boolean SignatureFallbackOrder,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean SignatureScheduleDay,[In] boolean SignatureScheduleTime,[In] boolean SignatureUpdateCatchupInterval,[In] boolean SignatureBlobFileSharesSources,[In] boolean SignatureUpdateInterval,[In] boolean SignatureBlobUpdateInterval,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean MAPSReporting,[In,ValueMap{"0", "1", "2", "3"} : ToSubclass] boolean SubmitSamplesConsent,[In] boolean DisablePrivacyMode,[In] boolean RandomizeScheduleTaskTimes,[In] boolean SchedulerRandomizationTime,[In] boolean DisableBehaviorMonitoring,[In] boolean DisableIntrusionPreventionSystem,[In] boolean DisableIOAVProtection,[In] boolean DisableRealtimeMonitoring,[In] boolean DisableScriptScanning,[In] boolean DisableArchiveScanning,[In] boolean DisableCatchupFullScan,[In] boolean DisableCatchupQuickScan,[In] boolean DisableEmailScanning,[In] boolean DisableRemovableDriveScanning,[In] boolean DisableRestorePoint,[In] boolean DisableScanningMappedNetworkDrivesForFullScan,[In] boolean DisableScanningNetworkFiles,[In] boolean UILockdown,[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean UnknownThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean LowThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean ModerateThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean HighThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean SevereThreatDefaultAction,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean PUAProtection,[In] boolean DisableBlockAtFirstSeen,[In,ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] boolean CloudBlockLevel,[In] boolean CloudExtendedTimeout,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean EnableNetworkProtection,[In,ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] boolean EnableControlledFolderAccess,[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[In] string SharedSignaturesPath,[In] boolean EnableLowCpuPriority,[In] boolean EnableFileHashComputation,[In] boolean MeteredConnectionUpdates,[In] boolean AllowNetworkProtectionOnWinServer,[In] boolean DisableDatagramProcessing,[In] boolean DisableCpuThrottleOnIdleScans,[In] boolean EnableFullScanOnBatteryPower,[In] boolean ProxyPacUrl,[In] boolean ProxyServer,[In] boolean ProxyBypass,[In] boolean ForceUseProxyOnly,[In] boolean DisableTlsParsing,[In] boolean DisableHttpParsing,[In] boolean DisableDnsParsing,[In] boolean DisableDnsOverTcpParsing,[In] boolean DisableSshParsing,[In] boolean PlatformUpdatesChannel,[In] boolean EngineUpdatesChannel,[In] boolean SignaturesUpdatesChannel,[In] boolean DisableGradualRelease,[In] boolean AllowNetworkProtectionDownLevel,[In] boolean AllowDatagramProcessingOnWinServer,[In] boolean EnableDnsSinkhole,[In] boolean DisableInboundConnectionFiltering,[In] boolean DisableRdpParsing,[In] boolean Force); [implemented,static : ToSubclass DisableOverride] uint32 Add([In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[in] string SharedSignaturesPath,[In] boolean Force); }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpScan { [implemented,static : ToSubclass DisableOverride] uint32 Start([In] uint8 ScanType,[In] string ScanPath); }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpSignature { [implemented,static : ToSubclass DisableOverride] uint32 Update([In] uint8 UpdateSource); }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpThreat : BaseStatus { [read : ToSubclass] string SchemaVersion = "1.0.0.0"; [key,read : ToSubclass] sint64 ThreatID; [read : ToSubclass] string ThreatName; [ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass,read : ToSubclass] uint8 SeverityID; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7,8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "36", "37", "38", "39", "40", "42", "43", "44", "45", "46", "47", "48"} : ToSubclass,read : ToSubclass] uint8 CategoryID; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 TypeID; [BitMap{"0", "1", "2", "4", "8", "16", "32"} : ToSubclass,read : ToSubclass] uint32 RollupStatus; [read : ToSubclass] string Resources[]; [read : ToSubclass] boolean DidThreatExecute = FALSE; [read : ToSubclass] boolean IsActive = FALSE; [implemented,static : ToSubclass DisableOverride] uint32 Remove(); }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpThreatCatalog : BaseStatus { [key,read : ToSubclass] sint64 ThreatID; [read : ToSubclass] string ThreatName; [ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass,read : ToSubclass] uint8 SeverityID; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7,8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "36", "37", "38", "39", "40", "42", "43", "44", "45", "46", "47", "48"} : ToSubclass,read : ToSubclass] uint8 CategoryID; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 TypeID; }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpThreatDetection : BaseStatus { [key,read : ToSubclass] string DetectionID; [key,read : ToSubclass] sint64 ThreatID; [read : ToSubclass] string ProcessName; [read : ToSubclass] string DomainUser; [ValueMap{"0", "1", "2", "3", "4", "5", "7", "8", "9"} : ToSubclass,read : ToSubclass] uint8 DetectionSourceTypeID; [read : ToSubclass] string Resources[]; [read : ToSubclass] datetime InitialDetectionTime; [read : ToSubclass] datetime LastThreatStatusChangeTime; [read : ToSubclass] datetime RemediationTime; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 CurrentThreatExecutionStatusID; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "Blocked", "102", "103", "104", "105", "107"} : ToSubclass,read : ToSubclass] uint8 ThreatStatusID; [read : ToSubclass] sint32 ThreatStatusErrorCode; [BitMap{"0", "1", "2", "3", "6", "8", "9", "10"} : ToSubclass,read : ToSubclass] uint8 CleaningActionID; [read : ToSubclass] string AMProductVersion = ""; [read : ToSubclass] boolean ActionSuccess = FALSE; [ValueMap{"0", "4", "8", "12", "16", "20", "24", "28", "32768", "32772", "32776", "32780", "32784", "32788", "32792", "32796"} : ToSubclass,read : ToSubclass] uint32 AdditionalActionsBitMask; }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpWDOScan { [implemented,static : ToSubclass DisableOverride] uint32 Start(); }; // This duplication of provider registration is required to support 'protectionManagement' class on defender #pragma namespace( "\\\\.\\root\\microsoft\\protectionManagement") Instance of __Win32Provider as $prov1 { Name = "ProtectionManagement"; ClsId = "{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}"; ImpersonationLevel = 1; HostingModel = "LocalServiceHost"; version = 1073741825; }; Instance of __MethodProviderRegistration { Provider = $prov1; }; Instance of __EventProviderRegistration { Provider = $prov1; eventQueryList = {"select * from MSFT_MpEvent"}; }; Instance of __InstanceProviderRegistration { Provider = $prov1; supportsGet = TRUE; supportsPut = TRUE; supportsDelete = TRUE; supportsEnumeration = TRUE; QuerySupportLevels; }; [locale(1033)] class BaseStatus { }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpComputerStatus : BaseStatus { [read : ToSubclass,key] string ComputerID = ""; [BitMap{"0", "1", "2", "4", "8", "16"} : ToSubclass,read : ToSubclass] uint32 ComputerState = 0; [read : ToSubclass] string AMRunningMode = ""; [read : ToSubclass] string AMProductVersion = ""; [read : ToSubclass] string AMServiceVersion = ""; string AntispywareSignatureVersion = ""; [read : ToSubclass] uint32 AntispywareSignatureAge = 0; [read : ToSubclass] datetime AntispywareSignatureLastUpdated; [read : ToSubclass] string AntivirusSignatureVersion = ""; [read : ToSubclass] uint32 AntivirusSignatureAge = 0; [read : ToSubclass] datetime AntivirusSignatureLastUpdated; string NISSignatureVersion = ""; [read : ToSubclass] uint32 NISSignatureAge = 0; [read : ToSubclass] datetime NISSignatureLastUpdated; [read : ToSubclass] datetime FullScanStartTime; [read : ToSubclass] datetime FullScanEndTime; [read : ToSubclass] uint32 FullScanAge = 0; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 LastFullScanSource = 0; [ValueMap{"0", "1", "2"} : ToSubclass,read : ToSubclass] uint8 RealTimeScanDirection = 0; [read : ToSubclass] datetime QuickScanStartTime; [read : ToSubclass] datetime QuickScanEndTime; [read : ToSubclass] uint32 QuickScanAge = 0; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 LastQuickScanSource = 0; [read : ToSubclass] string AMEngineVersion = ""; [read : ToSubclass] boolean AMServiceEnabled = FALSE; [read : ToSubclass] boolean OnAccessProtectionEnabled = FALSE; [read : ToSubclass] boolean IoavProtectionEnabled = FALSE; [read : ToSubclass] boolean BehaviorMonitorEnabled = FALSE; [read : ToSubclass] boolean AntivirusEnabled = FALSE; [read : ToSubclass] boolean AntispywareEnabled = FALSE; [read : ToSubclass] boolean IsVirtualMachine = FALSE; [read : ToSubclass] boolean IsTamperProtected = FALSE; [read : ToSubclass] string TamperProtectionSource = ""; [read : ToSubclass] boolean RealTimeProtectionEnabled = FALSE; [read : ToSubclass] string NISEngineVersion = ""; [read : ToSubclass] boolean NISEnabled = FALSE; }; [Indication : ToSubclass DisableOverride,dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpEvent { [ValueMap{"1", "2", "4", "8"} : ToSubclass,read : ToSubclass,key] uint32 CategoryDiscriminant; [BitMap{"1", "2"} : ToSubclass,read : ToSubclass] uint32 ScanNotificationsValue; [BitMap{"1", "2", "4", "8", "16"} : ToSubclass,read : ToSubclass] uint32 ThreatNotificationsValue; [BitMap{"1"} : ToSubclass,read : ToSubclass] uint32 SignatureNotificationsValue; [BitMap{"1", "2", "4", "8", "16", "32", "64"} : ToSubclass,read : ToSubclass] uint32 ComputerNotificationsValue; [read : ToSubclass] datetime NotificationTime; [read : ToSubclass] uint32 AdditionalData; }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpHeartBeat { [implemented,static : ToSubclass DisableOverride] uint32 Send(); }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpPreference { [read : ToSubclass,key] string ComputerID = ""; boolean DisableAutoExclusions = FALSE; string ExclusionPath[]; string ExclusionExtension[]; string ExclusionProcess[]; string ExclusionIpAddress[]; uint32 QuarantinePurgeItemsAfterDelay; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 RealTimeScanDirection = 0; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 RemediationScheduleDay; datetime RemediationScheduleTime; uint32 ReportingAdditionalActionTimeOut; uint32 ReportingCriticalFailureTimeOut; uint32 ReportingNonCriticalTimeOut; uint8 ScanAvgCPULoadFactor; boolean CheckForSignaturesBeforeRunningScan; uint32 ScanPurgeItemsAfterDelay; boolean ScanOnlyIfIdleEnabled; [ValueMap{"1", "2"} : ToSubclass] uint8 ScanParameters; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 ScanScheduleDay; datetime ScanScheduleQuickScanTime; datetime ScanScheduleTime; uint32 SignatureFirstAuGracePeriod; uint32 SignatureAuGracePeriod; string SignatureDefinitionUpdateFileSharesSources; boolean SignatureDisableUpdateOnStartupWithoutEngine; string SignatureFallbackOrder; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 SignatureScheduleDay; datetime SignatureScheduleTime; uint32 SignatureUpdateCatchupInterval; uint32 SignatureUpdateInterval; string SignatureBlobFileSharesSources; uint32 SignatureBlobUpdateInterval; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 MAPSReporting; [ValueMap{"0", "1", "2", "3"} : ToSubclass] uint8 SubmitSamplesConsent; boolean DisablePrivacyMode; boolean RandomizeScheduleTaskTimes; uint32 SchedulerRandomizationTime; boolean DisableBehaviorMonitoring; boolean DisableIntrusionPreventionSystem; boolean DisableIOAVProtection; boolean DisableRealtimeMonitoring; boolean DisableScriptScanning; boolean DisableArchiveScanning; boolean DisableCatchupFullScan; boolean DisableCatchupQuickScan; boolean DisableEmailScanning; boolean DisableRemovableDriveScanning; boolean DisableRestorePoint; boolean DisableScanningMappedNetworkDrivesForFullScan; boolean DisableScanningNetworkFiles; boolean UILockdown; sint64 ThreatIDDefaultAction_Ids[]; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[]; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 UnknownThreatDefaultAction; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 LowThreatDefaultAction; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ModerateThreatDefaultAction; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 HighThreatDefaultAction; [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 SevereThreatDefaultAction; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 PUAProtection; boolean DisableBlockAtFirstSeen; [ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] uint8 CloudBlockLevel; uint32 CloudExtendedTimeout; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 EnableNetworkProtection; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] uint8 EnableControlledFolderAccess; string AttackSurfaceReductionOnlyExclusions[]; string AttackSurfaceReductionRules_Ids[]; [ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[]; string ControlledFolderAccessAllowedApplications[]; string ControlledFolderAccessProtectedFolders[]; string SharedSignaturesPath; boolean EnableLowCpuPriority; boolean EnableFileHashComputation; boolean MeteredConnectionUpdates; boolean AllowNetworkProtectionOnWinServer; boolean DisableDatagramProcessing; boolean DisableCpuThrottleOnIdleScans; boolean EnableFullScanOnBatteryPower; string ProxyPacUrl; string ProxyServer; string ProxyBypass[]; boolean ForceUseProxyOnly; boolean DisableTlsParsing; boolean DisableHttpParsing; boolean DisableDnsParsing; boolean DisableDnsOverTcpParsing; boolean DisableSshParsing; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 PlatformUpdatesChannel; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 EngineUpdatesChannel; [ValueMap{"0", "1", "2"} : ToSubclass] uint8 SignaturesUpdatesChannel; boolean DisableGradualRelease; boolean AllowNetworkProtectionDownLevel; boolean AllowDatagramProcessingOnWinServer; boolean EnableDnsSinkhole; boolean DisableInboundConnectionFiltering; boolean DisableRdpParsing; [implemented,static : ToSubclass DisableOverride] uint32 Set([In] boolean DisableAutoExclusions,[In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] uint32 QuarantinePurgeItemsAfterDelay,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 RealTimeScanDirection,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 RemediationScheduleDay,[In] datetime RemediationScheduleTime,[In] uint32 ReportingAdditionalActionTimeOut,[In] uint32 ReportingCriticalFailureTimeOut,[In] uint32 ReportingNonCriticalTimeOut,[In] uint8 ScanAvgCPULoadFactor,[In] boolean CheckForSignaturesBeforeRunningScan,[In] uint32 ScanPurgeItemsAfterDelay,[In] boolean ScanOnlyIfIdleEnabled,[In,ValueMap{"1", "2"} : ToSubclass] uint8 ScanParameters,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 ScanScheduleDay,[In] datetime ScanScheduleQuickScanTime,[In] datetime ScanScheduleTime,[In] uint32 SignatureFirstAuGracePeriod,[In] uint32 SignatureAuGracePeriod,[In] string SignatureDefinitionUpdateFileSharesSources,[In] boolean SignatureDisableUpdateOnStartupWithoutEngine,[In] string SignatureFallbackOrder,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 SignatureScheduleDay,[In] datetime SignatureScheduleTime,[In] uint32 SignatureUpdateCatchupInterval,[In] string SignatureBlobFileSharesSources,[In] uint32 SignatureUpdateInterval,[In] uint32 SignatureBlobUpdateInterval,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 MAPSReporting,[In,ValueMap{"0", "1", "2", "3"} : ToSubclass] uint8 SubmitSamplesConsent,[In] boolean DisablePrivacyMode,[In] boolean RandomizeScheduleTaskTimes,[In] uint32 SchedulerRandomizationTime,[In] boolean DisableBehaviorMonitoring,[In] boolean DisableIntrusionPreventionSystem,[In] boolean DisableIOAVProtection,[In] boolean DisableRealtimeMonitoring,[In] boolean DisableScriptScanning,[In] boolean DisableArchiveScanning,[In] boolean DisableCatchupFullScan,[In] boolean DisableCatchupQuickScan,[In] boolean DisableEmailScanning,[In] boolean DisableRemovableDriveScanning,[In] boolean DisableRestorePoint,[In] boolean DisableScanningMappedNetworkDrivesForFullScan,[In] boolean DisableScanningNetworkFiles,[In] boolean UILockdown,[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 UnknownThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 LowThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ModerateThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 HighThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 SevereThreatDefaultAction,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 PUAProtection,[In] boolean DisableBlockAtFirstSeen,[In,ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] uint8 CloudBlockLevel,[In] uint32 CloudExtendedTimeout,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 EnableNetworkProtection,[In,ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] uint8 EnableControlledFolderAccess,[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[In] string SharedSignaturesPath,[In] boolean EnableLowCpuPriority,[In] boolean EnableFileHashComputation,[In] boolean MeteredConnectionUpdates,[In] boolean AllowNetworkProtectionOnWinServer,[In] boolean DisableDatagramProcessing,[In] boolean DisableCpuThrottleOnIdleScans,[In] boolean EnableFullScanOnBatteryPower,[In] string ProxyPacUrl,[In] string ProxyServer,[In] string ProxyBypass[],[In] boolean ForceUseProxyOnly,[In] boolean DisableTlsParsing,[In] boolean DisableHttpParsing,[In] boolean DisableDnsParsing,[In] boolean DisableDnsOverTcpParsing,[In] boolean DisableSshParsing,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 PlatformUpdatesChannel,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 EngineUpdatesChannel,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 SignaturesUpdatesChannel,[In] boolean DisableGradualRelease,[In] boolean AllowNetworkProtectionDownLevel,[In] boolean AllowDatagramProcessingOnWinServer,[In] boolean EnableDnsSinkhole,[In] boolean DisableInboundConnectionFiltering,[In] boolean DisableRdpParsing,[In] boolean Force); [implemented,static : ToSubclass DisableOverride] uint32 Remove([In] boolean DisableAutoExclusions,[In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] boolean QuarantinePurgeItemsAfterDelay,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean RealTimeScanDirection,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean RemediationScheduleDay,[In] boolean RemediationScheduleTime,[In] boolean ReportingAdditionalActionTimeOut,[In] boolean ReportingCriticalFailureTimeOut,[In] boolean ReportingNonCriticalTimeOut,[In] boolean ScanAvgCPULoadFactor,[In] boolean CheckForSignaturesBeforeRunningScan,[In] boolean ScanPurgeItemsAfterDelay,[In] boolean ScanOnlyIfIdleEnabled,[In,ValueMap{"1", "2"} : ToSubclass] boolean ScanParameters,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean ScanScheduleDay,[In] boolean ScanScheduleQuickScanTime,[In] boolean ScanScheduleTime,[In] boolean SignatureFirstAuGracePeriod,[In] boolean SignatureAuGracePeriod,[In] boolean SignatureDefinitionUpdateFileSharesSources,[In] boolean SignatureDisableUpdateOnStartupWithoutEngine,[In] boolean SignatureFallbackOrder,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean SignatureScheduleDay,[In] boolean SignatureScheduleTime,[In] boolean SignatureUpdateCatchupInterval,[In] boolean SignatureBlobFileSharesSources,[In] boolean SignatureUpdateInterval,[In] boolean SignatureBlobUpdateInterval,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean MAPSReporting,[In,ValueMap{"0", "1", "2", "3"} : ToSubclass] boolean SubmitSamplesConsent,[In] boolean DisablePrivacyMode,[In] boolean RandomizeScheduleTaskTimes,[In] boolean SchedulerRandomizationTime,[In] boolean DisableBehaviorMonitoring,[In] boolean DisableIntrusionPreventionSystem,[In] boolean DisableIOAVProtection,[In] boolean DisableRealtimeMonitoring,[In] boolean DisableScriptScanning,[In] boolean DisableArchiveScanning,[In] boolean DisableCatchupFullScan,[In] boolean DisableCatchupQuickScan,[In] boolean DisableEmailScanning,[In] boolean DisableRemovableDriveScanning,[In] boolean DisableRestorePoint,[In] boolean DisableScanningMappedNetworkDrivesForFullScan,[In] boolean DisableScanningNetworkFiles,[In] boolean UILockdown,[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean UnknownThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean LowThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean ModerateThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean HighThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean SevereThreatDefaultAction,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean PUAProtection,[In] boolean DisableBlockAtFirstSeen,[In,ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] boolean CloudBlockLevel,[In] boolean CloudExtendedTimeout,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean EnableNetworkProtection,[In,ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] boolean EnableControlledFolderAccess,[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[In] string SharedSignaturesPath,[In] boolean EnableLowCpuPriority,[In] boolean EnableFileHashComputation,[In] boolean MeteredConnectionUpdates,[In] boolean AllowNetworkProtectionOnWinServer,[In] boolean DisableDatagramProcessing,[In] boolean DisableCpuThrottleOnIdleScans,[In] boolean EnableFullScanOnBatteryPower,[In] boolean ProxyPacUrl,[In] boolean ProxyServer,[In] boolean ProxyBypass,[In] boolean ForceUseProxyOnly,[In] boolean DisableTlsParsing,[In] boolean DisableHttpParsing,[In] boolean DisableDnsParsing,[In] boolean DisableDnsOverTcpParsing,[In] boolean DisableSshParsing,[In] boolean PlatformUpdatesChannel,[In] boolean EngineUpdatesChannel,[In] boolean SignaturesUpdatesChannel,[In] boolean DisableGradualRelease,[In] boolean AllowNetworkProtectionDownLevel,[In] boolean AllowDatagramProcessingOnWinServer,[In] boolean EnableDnsSinkhole,[In] boolean DisableInboundConnectionFiltering,[In] boolean DisableRdpParsing,[In] boolean Force); [implemented,static : ToSubclass DisableOverride] uint32 Add([In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[in] string SharedSignaturesPath,[In] boolean Force); }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpScan { [implemented,static : ToSubclass DisableOverride] uint32 Start([In] uint8 ScanType,[In] string ScanPath); }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpSignature { [implemented,static : ToSubclass DisableOverride] uint32 Update([In] uint8 UpdateSource); }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpThreat : BaseStatus { [read : ToSubclass] string SchemaVersion = "1.0.0.0"; [key,read : ToSubclass] sint64 ThreatID; [read : ToSubclass] string ThreatName; [ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass,read : ToSubclass] uint8 SeverityID; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7,8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "36", "37", "38", "39", "40", "42", "43", "44", "45", "46", "47", "48"} : ToSubclass,read : ToSubclass] uint8 CategoryID; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 TypeID; [BitMap{"0", "1", "2", "4", "8", "16", "32"} : ToSubclass,read : ToSubclass] uint32 RollupStatus; [read : ToSubclass] string Resources[]; [read : ToSubclass] boolean DidThreatExecute = FALSE; [read : ToSubclass] boolean IsActive = FALSE; [implemented,static : ToSubclass DisableOverride] uint32 Remove(); }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpThreatCatalog : BaseStatus { [key,read : ToSubclass] sint64 ThreatID; [read : ToSubclass] string ThreatName; [ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass,read : ToSubclass] uint8 SeverityID; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7,8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "36", "37", "38", "39", "40", "42", "43", "44", "45", "46", "47", "48"} : ToSubclass,read : ToSubclass] uint8 CategoryID; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 TypeID; }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpThreatDetection : BaseStatus { [key,read : ToSubclass] string DetectionID; [key,read : ToSubclass] sint64 ThreatID; [read : ToSubclass] string ProcessName; [read : ToSubclass] string DomainUser; [ValueMap{"0", "1", "2", "3", "4", "5", "7", "8", "9"} : ToSubclass,read : ToSubclass] uint8 DetectionSourceTypeID; [read : ToSubclass] string Resources[]; [read : ToSubclass] datetime InitialDetectionTime; [read : ToSubclass] datetime LastThreatStatusChangeTime; [read : ToSubclass] datetime RemediationTime; [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 CurrentThreatExecutionStatusID; [ValueMap{"0", "1", "2", "3", "4", "5", "6", "Blocked", "102", "103", "104", "105", "107"} : ToSubclass,read : ToSubclass] uint8 ThreatStatusID; [read : ToSubclass] sint32 ThreatStatusErrorCode; [BitMap{"0", "1", "2", "3", "6", "8", "9", "10"} : ToSubclass,read : ToSubclass] uint8 CleaningActionID; [read : ToSubclass] string AMProductVersion = ""; [read : ToSubclass] boolean ActionSuccess = FALSE; [ValueMap{"0", "4", "8", "12", "16", "20", "24", "28", "32768", "32772", "32776", "32780", "32784", "32788", "32792", "32796"} : ToSubclass,read : ToSubclass] uint32 AdditionalActionsBitMask; }; [dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] class MSFT_MpWDOScan { [implemented,static : ToSubclass DisableOverride] uint32 Start(); };