Analysis
| Category | Package | Started | Completed | Duration | Options | Log(s) |
|---|---|---|---|---|---|---|
| FILE | exe | 2025-06-13 03:32:19 | 2025-06-13 04:03:15 | 1856 seconds | Show Options | Show Analysis Log |
procmemdump=1
import_reconstruction=1
unpacker=2
norefer=1
no-iat=1
2024-11-25 13:37:15,100 [root] INFO: Date set to: 20250612T19:11:12, timeout set to: 1800 2025-06-12 20:11:12,216 [root] DEBUG: Starting analyzer from: C:\tmp_gell1p8 2025-06-12 20:11:12,216 [root] DEBUG: Storing results at: C:\boUvofCgHL 2025-06-12 20:11:12,216 [root] DEBUG: Pipe server name: \\.\PIPE\aQBjYU 2025-06-12 20:11:12,216 [root] DEBUG: Python path: C:\Users\Packager\AppData\Local\Programs\Python\Python310-32 2025-06-12 20:11:12,216 [root] INFO: analysis running as an admin 2025-06-12 20:11:12,216 [root] INFO: analysis package specified: "exe" 2025-06-12 20:11:12,216 [root] DEBUG: importing analysis package module: "modules.packages.exe"... 2025-06-12 20:11:13,137 [root] DEBUG: imported analysis package "exe" 2025-06-12 20:11:13,137 [root] DEBUG: initializing analysis package "exe"... 2025-06-12 20:11:13,137 [lib.common.common] INFO: wrapping 2025-06-12 20:11:13,137 [lib.core.compound] INFO: C:\Users\Packager\AppData\Local\Temp already exists, skipping creation 2025-06-12 20:11:13,137 [root] DEBUG: New location of moved file: C:\Users\Packager\AppData\Local\Temp\mighost.exe 2025-06-12 20:11:13,137 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option 2025-06-12 20:11:13,137 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option 2025-06-12 20:11:13,137 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option 2025-06-12 20:11:13,137 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option 2025-06-12 20:11:13,450 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-06-12 20:11:13,466 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig" 2025-06-12 20:11:13,497 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-06-12 20:11:13,513 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-06-12 20:11:13,513 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-06-12 20:11:13,513 [lib.api.screenshot] ERROR: No module named 'PIL' 2025-06-12 20:11:13,513 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-06-12 20:11:13,528 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-06-12 20:11:13,528 [root] DEBUG: Initialized auxiliary module "Browser" 2025-06-12 20:11:13,528 [root] DEBUG: attempting to configure 'Browser' from data 2025-06-12 20:11:13,528 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-06-12 20:11:13,528 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-06-12 20:11:13,528 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-06-12 20:11:13,528 [root] DEBUG: Initialized auxiliary module "DigiSig" 2025-06-12 20:11:13,528 [root] DEBUG: attempting to configure 'DigiSig' from data 2025-06-12 20:11:13,528 [root] DEBUG: module DigiSig does not support data configuration, ignoring 2025-06-12 20:11:13,528 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"... 2025-06-12 20:11:13,528 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature 2025-06-12 20:11:24,778 [modules.auxiliary.digisig] DEBUG: File has a valid signature 2025-06-12 20:11:24,778 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json 2025-06-12 20:11:24,778 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig 2025-06-12 20:11:24,778 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-06-12 20:11:24,778 [root] DEBUG: attempting to configure 'Disguise' from data 2025-06-12 20:11:24,778 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-06-12 20:11:24,794 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-06-12 20:11:24,794 [modules.auxiliary.disguise] INFO: Disguising GUID to c06db7d9-b0ac-435c-9ba2-302bf5f31f7e 2025-06-12 20:11:24,794 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-06-12 20:11:24,794 [root] DEBUG: Initialized auxiliary module "Human" 2025-06-12 20:11:24,794 [root] DEBUG: attempting to configure 'Human' from data 2025-06-12 20:11:24,794 [root] DEBUG: module Human does not support data configuration, ignoring 2025-06-12 20:11:24,794 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-06-12 20:11:24,794 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-06-12 20:11:24,794 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-06-12 20:11:24,794 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-06-12 20:11:24,794 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-06-12 20:11:24,794 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-06-12 20:11:24,794 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled 2025-06-12 20:11:24,794 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-06-12 20:11:24,794 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-06-12 20:11:24,794 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-06-12 20:11:24,794 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-06-12 20:11:24,794 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-06-12 20:11:24,794 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 696 2025-06-12 20:11:24,825 [lib.api.process] INFO: Monitor config for <Process 696 lsass.exe>: C:\tmp_gell1p8\dll\696.ini 2025-06-12 20:11:24,825 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor 2025-06-12 20:11:24,825 [lib.api.process] INFO: Option 'import_reconstruction' with value '1' sent to monitor 2025-06-12 20:11:24,825 [lib.api.process] INFO: Option 'unpacker' with value '2' sent to monitor 2025-06-12 20:11:24,825 [lib.api.process] INFO: Option 'norefer' with value '1' sent to monitor 2025-06-12 20:11:24,825 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2025-06-12 20:11:24,825 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-06-12 20:11:24,841 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp_gell1p8\dll\JHPnZzBU.dll, loader C:\tmp_gell1p8\bin\gzGeTvzK.exe 2025-06-12 20:11:24,903 [root] DEBUG: Loader: IAT patching disabled. 2025-06-12 20:11:24,919 [root] DEBUG: Loader: Injecting process 696 with C:\tmp_gell1p8\dll\JHPnZzBU.dll. 2025-06-12 20:11:24,950 [root] DEBUG: 696: Python path set to 'C:\Users\Packager\AppData\Local\Programs\Python\Python310-32'. 2025-06-12 20:11:24,950 [root] INFO: Disabling sleep skipping. 2025-06-12 20:11:24,950 [root] DEBUG: 696: Full process memory dumps enabled. 2025-06-12 20:11:24,966 [root] DEBUG: 696: Import reconstruction of process dumps enabled. 2025-06-12 20:11:24,966 [root] DEBUG: 696: Active unpacking of payloads enabled 2025-06-12 20:11:24,966 [root] DEBUG: 696: CAPE debug - unrecognised key norefer. 2025-06-12 20:11:24,966 [root] DEBUG: 696: TLS secret dump mode enabled. 2025-06-12 20:11:24,966 [root] DEBUG: 696: InternalYaraScan: Scanning 0x00007FF84A790000, size 0x1f4542 2025-06-12 20:11:24,981 [root] DEBUG: 696: InternalYaraScan hit: RtlInsertInvertedFunctionTable 2025-06-12 20:11:24,981 [root] DEBUG: 696: RtlInsertInvertedFunctionTable 0x00007FF84A7A090E, LdrpInvertedFunctionTableSRWLock 0x00007FF84A8FB4F0 2025-06-12 20:11:24,981 [root] DEBUG: 696: Monitor initialised: 64-bit capemon loaded in process 696 at 0x00007FF8234D0000, thread 6268, image base 0x00007FF60D500000, stack from 0x0000008EFAA74000-0x0000008EFAA80000 2025-06-12 20:11:24,981 [root] DEBUG: 696: Commandline: C:\Windows\system32\lsass.exe 2025-06-12 20:11:24,997 [root] DEBUG: 696: Hooked 5 out of 5 functions 2025-06-12 20:11:24,997 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-06-12 20:11:25,013 [root] DEBUG: Successfully injected DLL C:\tmp_gell1p8\dll\JHPnZzBU.dll. 2025-06-12 20:11:25,013 [lib.api.process] INFO: Injected into 64-bit <Process 696 lsass.exe> 2025-06-12 20:11:25, <truncated>
Machine
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win10-2 | win10-2 | KVM | 2025-06-13 03:32:19 | 2025-06-13 04:02:55 | none |
File Details
| File Name |
mighost.exe
|
|---|---|
| File Type | PE32+ executable (console) x86-64, for MS Windows |
| File Size | 266152 bytes |
| MD5 | 91cfba2810448592eb63f04a8e0c0805 |
| SHA1 | 2d93e8cdc84f865924d24ea1a0c6785e9490162e |
| SHA256 | 03dc58aa00e5773631c70e11766fad0b2e244798adf706e0967f54ab05570c1d [VT] [MWDB] [Bazaar] |
| SHA3-384 | 84c5069763ba65ac3b0c86a64bc5e98bc83393a6ed0fb8ccd138b17ee02f38ade5466d66a76e9e0b2ef86e52fce6d19a |
| CRC32 | 628C85F5 |
| TLSH | T1BD44D8C2BB45C6A3D41A0232485B57D72BB1B8561F16A38B2398736D9F337C0B7336A5 |
| Ssdeep | 6144:AYUW8Kw2pojDuUlMtq10Q8m7NNqM9N+hN1UFpfNS5iXjD56Gpovgp2H32nq54945:AYH86eDuUlEqatglsLb1 |
| PE | File Strings BinGraph Vba2Graph VirusTotal |
ToStringL
Sets the display nameW
FileComInterfaceProxyStubWWW\+
RepositorieshB
GetFileRepositoryObjectWp
@.data
ComponentTypeWWW
RegistryKeyW
Migrate and overwrite the destination with sourceW?
Gets configuration answer file that overrides an unattend.xml file<
Represents a generic file elementW+
Returns version scope attributeWWW
QualifiedSettingName4:
Returns display nameWW
Sets the file writeable typeWW!
</trustInfo>
EBuildWWW
iPPTP00D
AuthorsW
GetStartupInfoW
IMigrationSupportedComponentx
Sets creation time
#0DVcmiQueryGetComponentsFromIdentitiesW8
q*PublicKeyTokenWWL
cmiComponentSettingsd
Represents two values that is associated with each other.W#
Fetch the complete information regarding the objects that are being queriedWWWL
Gets the sid of a trusteeW
CurrentIP
MigHost: CMigPluginSurrogate::UnRegisterServerInThreadContext: CoDisconnectObject failed hr=0x%x on ThreadID=[0x%x].
|$ AUAVAWH
Returns the DataWW
CmiLanguageModeW
systemData type, file contents can change during installationW<
Sets the array of paths that defines this sequence1
u*9Q<|%
}}}yyytt
Get a component given an identityW
cmiQueryGetSettingOverridesForSettingDefinitionW8
InstallationStatusWW
MfSI*
CurrentInstanceW
SE_SECURITY_PRIVILEGEW
6ExcludeReference
Possible passes in an installationE
IReferenceFactoryW
Sets the installed repositoryW
AcmiTrusteeAccountWWW|
IFileRepositorySet interfaceWW
RegistrationCommandW
'DpOnlineFilePathW
cmiRegResourceListWW
Sets installer capability flags propertyWW)
+MoveFilesWWWd
Gets the class ID of the installer factory*
Returns file repository for packageWWW
Returns the description of category instanceWW)
GenericCommandWW
Move the repository to the new rootWWW-
type used to uniquely identify componentWW
RegSetValueExW
FileTypelibW$,
4BulkImporter
SearchRepositoryp
:RemoveByReferenceRangeWW
acmiReadWrite
FcmiQueryGetComponentSettingOverrides8
Sets the list of supported target processor architecturesW8
installer for localized driversWWW
Gets the owner of a trusteeWWW
Compares the existing version with another version/
Returns whether to create default value during install3
EffectiveSettingInstancesWWW$E
possible modules for loggingWW>
TlP0X
CompanyW
Returns comments that are useful for documentation purpose7
CLSIDFromString
SidTypeDomainW
Returns a list of IMigrationPatternWWW:
Sets the online environment variable set.W
AttributesWW
CommitTransactionWWW
Sets if the entry is enabled or notWWW&
VPPTP004:
RemoveByInstanceIdWW
IInstanceContextWW
Cleanup pass, which can happen in online installWW9
VWAVH
Discoverablex
HcmiDeferredW
method FinalizeWWW
InstallerManager propertyW
F^6JC
Possible types of privilege, defined in ntseapi.hW
171005173456Z
Packages components using the binaries and component carriers provided<
O0M0K
IsPublic
Microsoft Corporation
81pFileComClass
PcmiStockInstallerWWW
.Migration Plugins Type Library 2.0
LoadLibraryExW
Thales TSS ESN:843D-37F6-F1041%0#
ComClassesWW
qGatherSuccessWWWpb
InstallerIdWdK
cmiSecurityDescriptorReferenceWWd
vDowngradeWWW
_XcptFilter
RemoveAllWWW
ISettingInstanceWW
wwwwwx
_lock
Returns the local name
Migrate using default conflict resolution rulesWWW
Sets the current pass of an installationWW<
cmiTrusteeWellKnownGroup|
Sets the installation pass during which registration is to be run.H
Gets the fusion activation context inheritance flag for applicationsWWD
Interface to store information for sysprep moduleW
cmiDenyInteractiveLogonPrivilege
00)cmiRegQwordW
UsingCmiAdapterW\D
Sets the array of fallback languages stringsWW%
<?xml version='1.0' encoding='utf-8' standalone='yes'?>
Sets whether to omit xml declaration during serializeW=
performs setup of componentsWW+
MigHost: CSingletonClassFactory::RegisterClassObject: CoRegisterClassObject failed with hr=0x%x
Sets the installed repository .WWW3
MigHost: CMigPluginSurrogate::LoadAndRegisterServerInThreadContext: Loaded server(%s)
Sets if a dependency is optional or not.WW-
_8OfflineInstallerRepositoryWW
Returns the value/outer XML/etc of a custom infoWW-
XmlSerializerWWW
(cmiHasDiskImageW
#cmiLogFacilityRepositoryXM
_initterm
MigHost: CMigPluginSurrogate::LoadAndRegisterServerInThreadContext: DllGetClassObject(%s) failed hr=0x%x.
stdole2.tlbWWW
fD9,Bu
Adds a new item to the end of the collectionWW.
CmiComponentType
method PostApplyWW
.idata$5
Returns the collection of assemblies associated with this assembly(
SE_DENY_BATCH_LOGON_NAMEWW
iPPTP00T=
Specifies a COM typelibWWW
OfflineInstallWWx
SearchPathsWp
PerUserVirtualizationWWW
SupportInformationWW
Valid component typesW+
MigHost: Failed to register surrogate class factory with CLSID[%s] and LogDir=[%s].
Returns the parent instance of this resolution, or NULLWWWE
Sets up the internal environment object for the specified setup typeWW(
TYPELIB
Sets whether a trustee is enabled or notWW/
[PPTP00
EndOfLifeWWW
6cmiFileRepositorySkipExistingFilesWW,3
Merge another configuration to this configurationW4
cmiMigrationInformationWd
cmiLogLevelInfoW
MigrationInformation`
ISysprepInformationWWW
Interface to replace tokens in the manifestWWW
.pdata
wcschr
ComponentsToAddW@Q
Returns batch commit sizeW
Creates reference redirection table based on the lower and upper version offset providedWW;
\ProxyStubClsid32
Microsoft
89dIInstallerManagerWWW8J
ErT,-468
wwwwww
Gets the factory used by an instance factoryWW,
Get the identities to which a given identity is redirected2
Sets the factory used by an reference factoryW
RegistryValuesWWh
cmiEventBulkImporterCommittedToTempFiles
SelectedInstancesWWW0C
SupportedTargets
IMigrationInformationW
ObjectToUninstallWWW8J
GetFileNameForComponentW\D
t$PHc
OeK?X #9
CMigPluginSurrogate::Init
*cmiFileDependencyWWWd
7cmiFullResolutionWWWDH
Valid writeable types.
.?AVCAtlException@ATL@@
$(.469=EFM
.?AVCSingletonClassFactory@@
Returns the flag that specifies if this command must run during install.WWE
BeginTransaction methodWWW
Represents Bulk Import$
$dExpandWW
cmiQueryGetSecuredSettingsForComponentsW8
(wcK'
Gets the security information of an assemblyWW,
.data$r$brc
IPreApply
cmiCategoryInstanceWd
method PostGatherWC
}}}yyyti=BF
Returns the name of a settingW
GetMessageW
cmiQueryGetComponentsByTypeW8
Sets the full name of a trusteeWWW!
tExcludeOptionalDependenciesWLO
Gets a list of members of a domain trustee*
SidTypeVirtualAccountW<
main libraryWW
SetEvent
_exit
Sets the manifest resource dependencyW(
cmiUtf16Encoding,
Sets the entity who adds this instance to a configurationW<
!ResolutionStageW
Sets the security descriptor reference of a fileWW6
cmiTrusteeAliasW|
Different types of share modes for a repositoryWWW+
Flushes internally cached componentWWW-
InstallerManagerEntryWWWtY
}}}yyyttppGW
0A^_^
InnerUnk N
_OldVersionMaxWWW
Validates this unattend file against a configurationWWB
Sets build type string, e.g. debug or releaseW2
Registers a log listener under a specified unique keyW#
cmiComponentPackagerP_
Returns a list setting instances for a componentWW6
MigHost: CMigPluginSurrogate::LoadDllServer in progress: BinaryPath=[%s], CLSID=[%s], ApartmentThreadingModel=[%d].
Returns if a dependency is optional or not.WWW(
Sets the optional passes to turn on/offWWW
Sets the proxy stub class IdWW
Legal_Policy_Statement
Represent an instance of IDependency or ICompositionWW(
cmiSettingInformationWWWd
IInstallContext interfaceW!
KDClassIdW
ReferenceFactory
Gets the full name of a trusteeWWW
Use symbolic links while copyingWW-
WWWtF>
AIInstallerFactoryWWW
8cmiLoadDriverPrivilegeWW
Sets if optional flag for this dependencyW
Sets the arguments to this resolverWWW
LcmiInfSerializerProcessAllModelsSections
Uhttp://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Verification%20PCA(1).crt0
mCategoryMembershipWW
Resolve at design time
00!cmiLanguageModeLangPackW
SE_NETWORK_LOGON_NAMEW
priority
Returns the list of filesW
}}}yyyttp
zItem
SE_DENY_NETWORK_LOGON_NAME
Sets the installation pass installer should performWWW
Returns the resolution stage of this reference+
SidTypeAliasWW
Types of installation.%
Returns a flag indicating whether a component is readonly or notWW%
defaultWWW'
0#/cmiEventOnInstanceAddedW
^cmiTcbPrivilegeW
eSelectedElements\D
2DestinationNameW
W\ApplyRedirection@Q
Sets the ownership flag.WW
%cmiQueryGetCategoryMembersWW8
MigrationPattern
NumberOfBytesWWW
nCipher NTS ESN:2665-4C3F-C5DE1+0)
lContentW
TFB=:953,&
CategorySelectionConstsWT
Default value.
Returns the definition of this referenceWW%
GetFileAttributesW
0c%%\\))8?GlQV
Microsoft Time-Stamp PCA 20100
Returns a list of IInstanceAnswerW@
Stage pass, which can happen in offline or online installW6
CMigPluginSurrogate::LoadAndRegisterServerInThreadContext
Represents an assembly dependencyW'
Sets the dependent category identityWW-
Represents an INF serializer and de-serializer8
Returns the reference identity which includes the from version&
method IsCanceledW
.rdata$r
>IRegistryKey
Represents category instanceWW,
</compatibility>
I0G0E
cmiCreatePagefilePrivilegeWW
svvvvvvvgA
Returns the culture for the resourcesW!
Sets the supported combination of InstallationTypeConstsWW
Returns the value of the variable with the specified name.7
.CRT$XIA
Get the list of identities filtered based on the first level identity attributesWW?
IMigrationPluginWW
0vCountWWW
ReferenceIdW|G
Given a setting type name, find all components that use this setting definition typeWW4
Get all components of a typeWW!
Skip missing files if the external attribute is set during import and exportWW=
RemoveWW
EventIdW
Returns whether the containing assembly owns this directoryWWW8
111019184142Z
=cmiLogFacilityResolverWWXM
ValidateAgainstWh[
DispatchMessageW
Sets the destination pathW
Sets the identity reference rangeW$
cmiPrivateTestPackagerWWd
Replaces the tokens for the given object & returns new objectW:
OpenEventW
UsersMigratingThisComponentW
Returns the replacement tokens
Typelibs
xgsTMJ
possible filter in the computation of effective settingsWW'
iCBeginTransaction
valid values of ICategoryDependency.SelectionW&
_PrivateTestPackagerEventsWW
Flags that control file repository behaviorWWW
Returns the installation pass installer should perform3
method GetOfflineStatusWWW
%Microsoft Windows Production PCA 2011
Get all setting definitions that have a particular visibility levelWWWR
FileDescription
Returns the count entries in the environmentWW-
CcmiMigrationTypeCreateOnlyWWH
Sets the fully qualified path to the file.$
IcmiMigrationSupportedComponentWWd
cmiDenyNetworkLogonPrivilege
ecmiMatch
cmiLogModuleSysprepW
This interface allows upgrading and downgrading objects.WW
SSS)}}}
MigHost: CMigPluginSurrogate::LoadAndRegisterServerInThreadContext: File is present, most likely it does not load on the current OS version
WISecurityDescriptorDefinitionWWW
Sets the CMI namespace1
Returns the typeWW
SE_SYSTEMTIME_PRIVILEGEWWW
Represents range of referencesD
Microsoft Corporation1
OptionalPassesWW
cmiFileRepositorySetd
InstallerWWW
/ParentPID:
Sets the file size0
method GetOfflineRegistryLocationW#
ObjectToSelectFromWW\D
Gets the list of supported target processor architecturesW9
1.0,0
LowerOffsetW
Sets the minimum number of instances need to selectWWW6
SE_AUDIT_PRIVILEGE
Returns the offline installer file repositoryW*
Microsoft America Operations1'0%
Represents a set of repositoriesWW
7DbNameWW
g_TranslateWWW
10.0.17763.1
iChildInstancesWW
IExcludeDependency interfaceWW
vswprintf_s
IMigrationPatternWWW
Sets the installation pass during which un-registration is to be run.W
Different types of access modes for a repositoryWW/
InitializeCriticalSection
Microsoft Time-Stamp PCA 2010
IPostGather
0H>cmiManifestResourceTokenReplacer
cmiRepositoryInitializerd
FacilitiesWW
CustomInformationsWW
pOfflineRegistryRootKeyW
8cmiNamespaceV2WW
#IPrivateTestPackagerlR
Describes a generic command which needs to be executed as part of the installation.WWWO
VersionWL
Sets the resolution status of this referenceWW
CMigPluginSurrogate::COMGenericThreadingHostThreadProc
performs conversion between object and inf+
Returns the algorithm used to compute the hash.WWW,
Represents private test packagers for componentsWW
EnabledW
IPrivateTestDriverPackagerWW
Adds an entry to the redirection tableC
cmiTakeOwnershipPrivilegeWWW
Sets the class ID of the installer factory5
method PreGatherWW
Return whether this is a partial version or notWWW/
IAssemblyW
installer for ACL and user account%
IDependencyWWW
Returns the unique hash of the file.WW!
Returns the current query flagsWWW$
PostProcessObjectWWW
<security>
!FileRepositoryWW
4<ReadOnlyL
cmiAssemblyDependencyWWWd
8ZNISettingInformationWx
set the revision numberWWW
!SecurityDescriptorReferenceW
EditSequenceNumberWW
=JiK28
ProcessorArchitectureWWWL
9cmiUnattendSemanticValidationWWW@Q
memmove_s
Sets the encoding (UTF-8/ UTF-16) to be used for serialization1
Sets the threading modelWW
@pOfflineRegistrySubkeyWW|`
Returns the read-only redirection table view from the reference range indexWWWD
IAssemblyDependencyWWW
Returns the identity of the component to apply the setting toW:
Selects elements from a specified object based on a path expressionWWW8
UnattendFile
$(.469=EFHJ
Sets the key nameW
closes the repositoryW
Returns a colon separated list of ownersWW%
Sets the typelib IDWWW$
Provides information common to all trustee typesWW
Different types of installersW
.?AUIClassFactory@@
LanguageL
cmiShutdownPrivilege
Gets the operation hint of a security descriptor definitionWWW;
/LogDir:
Returns the file attributesWWW
=ObjectToInstallW
Gets the value/
Sets the additional arguments for the event to be postedWWE
Returns the minimum number of instances need to select3
ExcludeComponents property$
NoInheritableWWWl
Valid file compression type.WW!
Specifies elements to be includedW#
cmiCustomAttributeWWd
Returns the binding redirects of this dependencyWW3
Provides information of a generic trusteeW
[(SerializeWWW
Returns the type of category selection#
Given a setting definition find out if it is securedWW9
100701213655Z
return the major version numberWWW
Second stage pass, which can happen in offline or online installWW"
Specifies a Windows classW&
SSSSSSSS
cmiRestorePrivilegeW
cmiInfSerializerGeneratePnpInfoW
!04ucmiQueryGetRedirectedToIdentitiesWWW8
TerminateProcess
Sets the textW
Resolve each language-specific dependency to based on langpackC
StringTableW
Always serialize component manifest while importing components1
IFileWindowClassWW
Gets the name of a security descriptor referenceWW0
cmiInfSerializerNoInstallConversionW
Returns the resource IDWWW
/>
Returns the fallback culture for the assemblyW*
Specifies information about a component which migration is supportedWW0
IEnvironmentWW
Gets log listener property+
Sets the resource type for this dependency<
Sets the base64 encoded hash of the fileWW/
Represents queryWW
cmiRestrictedWWW\+
""""z
ITokenReplacer
Sequence
Packages non-Driver components?
Microsoft Windows0
"cmiEventBulkImporterEndManifestShred
TimeoutW
wIFileTypelib<
cmiNotComparable
XcmiSpecializePassWWW
CarrierFilePaths
?http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
Represents both a root reference and a resolver contextWWW*
lIReferenceWW0C
\PPTP00
manages core object modelW*
ISettingInstance@
Sets the reference identity which includes the from version by valueWW>
*GenericCommandsW
Uses an answer file to help resolution.WWW4
Returns the repository
.text$x
wWinMain
HelpDirW<
bReferenceRedirectionRangeEntryWW
R!s4Z
Returns the collection of installable repositories.WWW%
0VID1
IInstanceAnswerWWW
heee"
0AycmiCmiLogConfigWd
cmiFileRepositoryDoNotOverwriteComponentsWWW,3
cmiLogFacilityObjectModelWWWXM
IRegistryValue
Represents an installation targetW"
Returns the value of released flag
ISysprepModule
4ICmiLogConfigWWW
Rebase file repository
.xdata$x
aMinorWWW
46*+5
GetModuleHandleW
85~FileWindowClassW
0'kcmiSystemProfilePrivilegeWWW
possible entities that add an instance to a configurationW<
Given a setting name, find all components that have a setting definition by this nameWT
Public installerWW
HEB=:953,&"\f
SE_ASSIGNPRIMARYTOKEN_PRIVILEGEWWW
Returns four part version valueWWW
Sets value for initializing other id in an answer file2
base\ntsetup\migration\migcore\mighost\mighost.cpp
.giats
Sets whether to create default value during installWWW0
Returns the migration plugin informationWW%
IManifestResourceTokenReplacerWW
LevelWWW,L
BindingRedirectWH&
0h6cmiLanguageModeOneWW
Returns the file repository associated with a componentWWW
Sets the category identity&
Returns the dependent assembly identityWWW$
OriginalFilename
"08vcmiUnattendPrimitiveNameValidationWW
0h5cmiNotEqualW
MigrationPluginW@8
Different types of token replacers
JConfigurationAnswerW@Q
cmiMigrationTypeRenameWW
Returns maximum disk file size
cmiGenericCommandWWWd
property UserSidString
cmiRegDwordLittleEndianW
cmiInteractiveLogonPrivilege
Represents a serializer and de-serializerW/
Text<
Serializes a CMI object to the given destinationWW.
cmiAtLeastOneWWWT
modules that do not fall into the following itemsW
Create an instance of the component of the specified IdWWW8
cmiLogModuleCryptWWW
cmiTrusteeInvalidWWW|
Sets the LanguageMode for resolving configurationW
method SetTelemetryDataPointWW
Gets the security descriptor reference of a registry keyWW8
Read all data and disconnect from data sourcesK
cmiInfSerializerProcessExcludeId
Returns the edit sequence when ComputeEffectiveSettingInstances is last called#
cmiFileAttributeArchiveW
$Microsoft Ireland Operations Limited1
180823202711Z
>ResetWWW
Reboot is recommendedW
PackageW
InstrumentationInformationWW
JResolutionModeWWTV
CmiCollectionWWW(#
InnerTextWWW
<!--This Id value indicates the application supports Windows 7/Server 2008 R2 functionality-->
\$8E3
Callback
Relies on client inputs for non-deterministic resolutions.'
level="asInvoker"
20180915214207Z0v0<
updates configurationW
Sets the flags that control serialization behavior&
Gets the additional arguments for the event posted8
wwwwp
Different CMI namespacesWW
M~S-Ogs",
IMigrationExcludeInformationWW
return the minor version numberWWW
Gets the installer that this sequence needs to be ahead of:
UVWATAUAVAWH
IRollbackTransactionW
CloseHandle
GetOfflineRegistryLocationWW
Returns the installation pass during which un-registration is to be run.WWE
0[ cmiAssignPrimaryTokenPrivilegeWW
Sets the import path for binary filesW%
@.reloc
NewW N
method DiscoverWWW
cmiZeroW$
Returns the namespace URI of a custom info'
@SUWH
IDomainTrustee
Resolve all the dependenciesWWA
VPPTP00l
PrivateTestDriverPackagerWWW|`
Gets the import path for binary filesW%
aLocalNameWWW
GenericTrusteeWW
z.9Wv
IRegistrationCommandWW
ResourcesWWW
LoadResource
cmiEventInstallerEndUninstallationWW
cmiDesignTimeWWW
Interface to specify unattend file recognizable to cmi$
IInstanceW
GetSystemTimeAsFileTime
cmiSysprepModuled
replicate source components to target source repositoryWWW:
DictionaryWW
Specialize pass, which can happen in online installWWW0
4CmiXmlEncodingTypesW
Overloads [propget] IAssembly.IdWW
Parent propertyWWW
%MapSourceFileLocationWWW
cmiQueryGetFileOwnersFromSourceNameW8
Returns the number of edits that have happened to this component instanceWF
MajorWWW
ulid\VL
ecmiReferenceFactoryWd
SupportedTypesWW4!
MigHost.exe {SurrogateCLSID} /InitDoneEvent:<event_name> /LogDir:<path> /ParentPID:<pid>
Returns the file sizeW
cmiDomainTrusteed
9AddEntry
IFileRepositoryPropertiesWWW,3
PreApply
DestinationWp
Gets the description of a trusteeW!
Sets the current query parametersW
||offZZZJj
PublicKeyTokensW
CmiFactoryWW`"
GetHashCodeW
Sets the localization informationW*
Marks external files with the external custom attributeWWWA
cmiInstalledRepositoryWWd
8DERepositoryInitializerWWW
Migrate only if element or object is missing on the destinationWWW-
cmiFileComClassWd
SettingOverrideInstances
MapAccessWWW
Different types of queries<
Gets the installer typeWWWL
lPrivilegeTypeWWW
^aUninstallWWW
Returns the base64 encoded hash of the fileWWW(
Gets the manifest resource dependencyW%
SetUnhandledExceptionFilter
GetAssemblyW<(
Returns the arguments to this resolver#
SE_INC_BASE_PRIORITY_PRIVILEGE
Sets the operation hint.WW$
IFileDependencyW
Interface to specify component settings in unattend fileWW,
!029cmiFileAttributeNotContentIndexedWWW
rITargetWpI
N!IsPartialWWW
.text
Sets the HRESULT for the event that was posted!
Returns the value of this settingW
SE_BATCH_LOGON_NAMEWWW
Version
CategoryDependencyWW
Returns the list of generic commands.W*
assembly which contains feature elementWWW3
cmiRegSz
Gets installer capability flags propertyWW(
Sets the description of category instanceW/
.rdata$brc
Represents regisry key
Sets the security information of an assemblyWWD
category dependencyWWW'
method ExpandEnvironmentVariablesW
Sets the value/outer XML/etc of a custom infoW0
Returns the identity reference rangeWW
<!--This Id value indicates the application supports Windows Vista/Server 2008 functionality -->
Return whether the identity is partial or notW8
!cmiZeroOrGreaterThanZero
Gets the installation pass this sequence applies toWWW3
LcmiEventPnpInstallerStartWaitForPnpW
8w%IdentityDefinitionWWx
GetOfflineRegistryLocationEx
Yq"\0
cmiCleanupPassWW
Sets the reboot indicatorWD
ISimpleIdentityW
Returns the source name of the dependency file.WWW,
HasElementWW0C
MigHost: Initialized successfully with CLSID[%s] and LogDir=[%s]
;InstanceAnswerWW\]
Gets the boolean flag indicating if the security descriptor reference is for offline modeWY
Represents an XML serializer and de-serializer8
MigHost: Failed to initialize surrogate with CLSID[%s] and LogDir=[%s].
Sets the name of a security descriptor referenceWW
XZUnregisterArgumentsW
An empty directory that need to be created during installation.WWW?
Returns the category identityW
.idata$4
Events interface for installer'
058cmiFileWindowClassWWd
CommandLineToArgvW failed, error=0x%x.
Indicates that the reference redirection table has been initializedWWW'
]CmiObjectsWW
IFileRepositoryWWW
Returns the installation pass during which registration is to be run.WB
SecurityDescriptorDefinitionT=
4cmiIdentityReferenced
InstanceDictionaryWW|G
UnattendFileValidationLevelW
cmiQueryGetCategoryMembershipsWW8
cmiDefaultResolverWW
~~vvpphc_
Checks whether the given component is present in the repository or not+
__dllonexit
YInstallerRegistrationWWW`;
SelectionMax0C
PairsWWW
Sets the module nameWW6
HashCode
Removes the files of the component from the repository6
.?AVCMigPluginSurrogate@@
Represents an identity referenceWW-
!0Q]cmiInfSerializerMarkExternalFilesWWW
MigHost: CMigPluginSurrogate::COMGenericThreadingHostThreadProc: ThreadID=[0x%x], Server=[%s], CLSID=[%s], ApartmentThreadingModel=[%d]
cmiInfSerializerFullRegistryConversionWW
Returns a list of IIdentity of top level instances"
cmiIdentityReferenceRangeWWWd
CmiEventArgs
Returns the optional passes to turn on/off'
IVariantMapWWW
ExcludeReferences property
Gets the HRESULT from the event handler for the event that was postedW.
~nnnnnnngx
KKKKQKT
7FileRepositoriesd2
Sets the source name of the dependency file.WW-
cmiStagePass
aIsPresentWWW
\\\;C
OmitDeclarationW,
FILE_ATTRIBUTE_HIDDENW
U>ThreadingModelWWt
__C_specific_handler
Specifies a COM class informationW
=ccc#
nnngwwp
Given a setting definition find all the setting overridesW5
Sets whether the containing assembly owns this directoryWW5
SE_MACHINE_ACCOUNT_PRIVILEGEWW
=CmiNamespacesWWWX
Gets the file repository containing the specified instance/
Shttp://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Verification%20PCA(1).crl0q
Sets language string (e.g. eng) or * for neutralWW/
SE_RESTORE_PRIVILEGEWW
InstanceIdWW
ExcludeReferencesWWWLO
!cmiFileBasedRepositoryWW 5
<application>
SISysprepInformationW4
8^&ManifestResourceTokenReplacerWWWt@
cmiRegistryValued
CreateEventW
Valid object types for ICmiFactory.CreateObject() methodWW3
ComponentSettingsWWW@Q
$(.46J
Returns a list of IReferenceAnswer!
Returns the list of elements as ICustomInformation2
LanguageModeDH
9*kq,#t
Gets the parent object of this valueWWS
855InstallerTypeConstsWdK
method IsHostAlive
.text$mn$00
\,ResetPluginTimer|`
cmiMachineAccountPrivilegeWW
IIdentityReferenceRangeWWW
Returns the collection of identities of the components present in the file repositoryWH
PresentW8
component that represents an atomic unit of distributionWW
Sets the identity of the component7
Sets the factory used by an instance factoryWW
InstallationType propertyW
.rsrc$01
IConfigurationWW$E
PassesWW$
CreateBulkImporterWW
Returns the setting information valueW"
Sets the import path for the INF fileW.
DHBinariesFilePathsWWW
FileCompressionTypeW
Resolution done and meets the constraints..
Provides a mechanism for instrumentation team to keep its data9
Returns the read-only list of registry valuesW8
Returns the file writeable typeWWW
Indicates whether the component is present in the file repository or notWW6
7cmiUnsolicitedInputPrivilege
MigHost: CMigPluginSurrogate::COMGenericThreadingHostThreadProc: LoadAndRegisterServerInThreadContext() succeeded.
TIQualifiedSettingNameWWWl
Information for resolving conflict in overridding a settingWWW2
cmiFileRepositorySkipMissingDriverCatalogFilesWW,3
Removes an entry from the redirection table using a reference rangeWWWE
Directory LogDir=%s does not exist.
RIIdentityWWWL
Returns the collection of selected instancesWW
Events interface for private test packagerA
MigHost: CMigPluginSurrogate::LoadAndRegisterServerInThreadContext: GetProcAddress(%s, DllGetClassObject) failed gle=0x%x.
Returns whether this is readonly or notWWW4
QHash
ExcludeInformationWW
NewRootPathW
Sets the fallback culture for the assembly+
5cmiUnattendFileWd
Sets the processor architecture path of infs used by this serializerWW2
Returns the identity of a parent or NULL for any parentWWW4
Sets the installer that this sequence needs to be ahead of5
Lct$`M
Interface to store information for sysprep#
=CmiSecurityInformationWW
Sets the name of a trustee
Returns the interface IDWW
property UserNameW
Types of packagers. Used while creating a private test packagerWWW*
cmiRegNoneWW
0r{cmiCreateGlobalPrivilege
XnContextW
MigHost: OpenProcess(%d) for parent process id failed.
_CxxThrowException
GetDefaultValueW
6wElementNameW
Sets the identity of this configurationWWW1
PluginWW
cmiCreateTokenPrivilegeW
WdsInitialize failed to initialize.
cmiMigrationTypeOverwriteWWWH
Factory which creates instance of various types of objects used by CMI
method ResetPluginTimerWWW
method LongRunningPluginWW
LeaveCriticalSection
hcmiSettingOverrideConflictInformationWWWd
cmiConfigurationAnswerWWd
RegistryValueWWWP-
IMigrationContext Interface provides migration context to pluginsW
SE_DENY_INTERACTIVE_LOGON_NAME
IMigrationPatternW
Online pass, which can happen in online installWWW6
Returns the fully qualified path to the executable.WWW0
Returns the CMI namespaceW
y;2uQ
D!d$PL!d$HD
\PPTP00h[
cmiSystemtimePrivilegeWW
IDiscovery
cmiDenyRemoteInteractiveLogonPrivilegeWW
vyReferenceAnswersLO
8cmiNamespaceV1WWX
Use file system and have limited query support*
Expands environment variables in a string.)
MMMMMMMMMMMM
Don't migrateW1
QueryTypeWWW8
Returns the most recently computed effective setting instances>
Microsoft Corporation. All rights reserved.
B$1_`ajbgA
lcmiLogModuleTool
IImagingInformationW4
Returns an enumerator of valuesWWW,
8SNIGroupTrusteeWWWD
Sets the fully qualified path to the execuable relative to component's root.WW)
`Trustees
pAdviseWW
IPrivateTestPackagerWW
Skip the file if it is present in destinationWQ
W7'''''7A
Exposes file repository properties
Returns a list of components to be addedWW*
InstallerCapabilityFlags,L
Get a list of components in the same order as the input list of identities$
.text$yd
Indicates that success is when return code is greater than or equal to 0WW
FallbackLanguagesWWW
Different types of reference resolution status/
MaxDiskFileSizeMBWWW81
urn:schemas-microsoft-com:asm.v1WW
Gets the factoryWW
Types of path supported by IPathTranslator&
0l6cmiEqual
VcmiBatchLogonPrivilegeWW
WdsSetupLogMessageW
ToVersionWWW
Sets copyright information
set the minor version numberWW
ExecuteW
LcA<E3
Sets the runtime path of a dependency file-
cmiBindingRedirectWWd
cmiInstallerSequenced
WriteableTypeWWWt
SE_REMOTE_SHUTDOWN_PRIVILEGEWW
MigHost: CSingletonClassFactory::RevokeInstance: CoRevokeClassObject failed with hr=0x%x
COMPRESSION_FORMAT_LZNT1WW
Use a file-based repository implementation9
Sets whether it is versioned or notWWW
RITrustee
Private installerW
{NamespaceWWW
_PPTP000
!cmiVariantMapWWWd
@.rsrc
cmiFileRepositorySerializeComponentManifests,3
Sets a list of members of a group trusteeW.
Sets the installer that this sequence needs to followW2
Returns nameWW
8mGDirectoryWWWD/
181005173456Z0p1
Event sink interface of ICmiFactoryWWW6
/cmiTrusteeDomain|
ICategoryDependencyWWW
Returns the string value of this versionWW
Returns the destination pathWW
Removes all items from the dictionaryW"
Computes the effective setting settingsWWW=
Sets the object for the event to be posted2
</application>
ConfigWW
*ILocalizationInformationl
IEnvironment
COMPRESSION_FORMAT_DEFAULT
FileAttributeTypeWWW
Returns the collection of resources elementWWW$
CoDisconnectObject
IBindingRedirectWW
LegalCopyright
utility toolWW"
cmiTrusteeDeletedAccount|
PAssemblyDependencyWW
cmiServiceLogonPrivilege
ComponentsToRemoveWW@Q
ComponentsToReplaceW@Q
Returns the namespace qualifierWWW
Returns the string value for matchingW"
Re-configuration pass, which can happen in online installW@
Sets the install for this dependencyWW/
cmiIdentityDefinitionWWWd
ReferenceRangeDictionary
ExportWW
cmiTargetWWWd
Gets the migration information of a registry keyWW0
IGenericTrusteeWWW
Represents a pattern for string matching.W*
Get the setting overrides specified in a component9
MigHost: RegisterMigrationIIDsAndTypeInfo: CreateVolatileRegValue(%s, %s, %s) failed gle=[0x%x].
FactoryW
*.**)
Sets if this installation is using cmiadapterW`
M0K0I
SE_INCREASE_QUOTA_PRIVILEGEWWW
+0> cmiQueryGetSettingDefinitionsForSettingNameW8
Install propertyWW
Converts only the identity of the driver packageWW)
~4Listener<Z
Sets environment to expand paths during import1
Sets the processor architecture installers are running onW5
MigHost.exe
SE_CREATE_PERMANENT_PRIVILEGEW
OfflineW
SourcePathWW
q_MergeWWW
This interface allows access to an entry in IInstallerManagerW!
HeapDestroy
.rdata$zzzdbg
SelectionWWW
Returns the flag indicating whether this dependency is optional or not)
ErrorW
0cmiInstallerCapabilityReplicateComponentsWWW
Gets whether a trustee is enabled or notWW(
Sets maximum disk file sizeWWW
Interface\
WAVAWH
.rdata
230038+2426910
??1type_info@@UEAA@XZ
SE_SYSTEM_PROFILE_PRIVILEGEWWW
GetFileRepositoryObject method&
cmiTrusteeUnknownWWW|
Bootstrapping pass, which can happen in online install/
Sets the description of a trusteeW
i=:953,&H
Returns the success code for the generic command to.WW.
Removes the specified item from the collection%
VDefaultSettingInstancesW
IGroupTrusteeW
TemporaryDirectoryWW81
Returns the fully qalified name for creating an empty directoryWWW<
cmiQualifiedSettingNameWd
Returns the online environment variable set.WW)
0f$cmiInstallerCapabilityNoneWW
L$ WH
D$$I;
FILE_ATTRIBUTE_TEMPORARYWW
Gets the fully qualified file name or manifest name for the given file of a component."
xCSingletonClassFactory::RevokeInstance
%cmiEffectiveSettingsNoFilter
fD9,Au
cmiInstallerCapabilityUnattended
%Microsoft Windows Production PCA 20110
Treat the INF file as inboxWWW
!"%,[M
Returns the temporary directoryWWW
WaitForSingleObject
Sets if the instance is enbaled or notB
Sets the dependency type for this dependencyWW8
Specifies elements to be excludedW:
MCreateWWH
Returns the help directory
DcmiEventPnpInstallerEndWaitForPnpWWW
lc%%\\))dd++ee//>nl
RebootIndicatorEnumW
Sets the offline installer file repository*
Sets upper bound for the version range)
Sets the identity of the instanceW)
cmiCompositionalResolutionWW$E
FILE_ATTRIBUTE_SPARSE_FILE"
Sets the flag that specifies if this command must run during install.WC
qN<*~
MessageBoxW
SVWATAUAVAWH
Sets the instance identity
ProxyNameWWW
FindResourceExW
CmiLogLevelW
D!d$PL!d$H
DomainWW|`
QcmiHiddenWWW\+
^cmiCompressionFormatNone
Returns the collection of category memberships%
MigHost: CMigPluginSurrogate::LoadDllServer finished: Result=[0x%x].
Create identity referenceW
ISettingDefinition#
ISecurityDescriptorDefinitionW
cmiLogModuleSmiW
.idata$3
Sets the replicated repository root pathWW:
261019185142Z0
MigHost: CMigPluginSurrogate::COMGenericThreadingHostThreadProc: CoInitializeEx(%s) failed hr=0x%x.
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
Returns the fully qualified path to the file.W*
Returns the COM classes implemented in this fileWW4
Resolves the installer for the specified object and invokes its install method.WWWQ
1cmiLogModuleOtherWWW
SE_LOCK_MEMORY_PRIVILEGEWW
Resolve at runtime$
SecondWW
4 part version of the repositoryWW6
Get members of a categoryW
SetErrorMode
DestroyW
cmiEventBulkImporterCommittedToStorageWW
IRepositoryInitializer
Get dependencies of a componentWWW/
MigHost: CMigPluginSurrogate::LoadAndRegisterServerInThreadContext: Successfully loaded and registered server(%s)
Executes the bulk importWW"
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
( 9cmiPairWd
cmiSecurityDescriptorDefinitionWd
SourceNameWW
Gets the security descriptor reference of a directoryW5
Valid migration typesW
"Microsoft Window
191123202711Z0
Returns the maximum verbosity level of log to receive..
cmiLogFacilityXmlWWWXM
Sets the algorithm used to generate the hashWW"
YcmiQueryGetSettingDefinitionsWithVisibilityForComponents8
Returns the reboot indicatorWW
CMigPluginSurrogate::FreeSurrogate
{00020424-0000-0000-C000-000000000046}
5EnvironmentW
cmiControlWW\+
ClearWWW
+OutputObject
HIInstallerManagerEntryWW
__setusermatherr
UATAUAVAWH
ManifestSearchPatternWWW
Sets the identity that qualifies a setting
HeapFree
EIInstallerSequenceWWl
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
cmiResolvingChildren
GetTickCount
Gets the namespace URI for the specified qualifier8
MigHost: CMigPluginSurrogate::LoadAndRegisterServerInThreadContext: LoadLibraryExW(%s, LOAD_WITH_ALTERED_SEARCH_PATH) failed gle=0x%x.
Specifies migration information of a component)
cmiTrusteeVirtualAccount
Get the identities or components that contain a particular fileWWW:
VersionScope
=:953,&
.CRT$XIY
CategoryInstanceh)
xA_NewEnum
$0:~cmiQueryGetIdentitiesByComponentType8
SupportedComponentsWx7
Returns the object typeWWW!
Sets the value of released flagWWW%
Gets the name of a trustee
UserSidStringWWW|`
Represents an identity definitionW
PrivateTestComponentPackager
DefaultIdentityWLO
UpperOffsetW
Returns a list of setting override references as ISettingOverrideInstanceW.
Gets the identifierWWW
SettingInformationWW
cmiTokenReplacerd
6|BaseInterfaceWWW
Sets the file attributesWW
" /A$
Selection is doneW'
DestinationPathW
FILE_ATTRIBUTE_SYSTEMW
Sets the string value for matchingD
Sets information about what to exclude during migrationWWW0
]CmiLogConfig
cmiInfSerializerd
Sets information about what to include during migrationWWW!
MigHost: Exiting process.
[PPTP00,
GetFullNameW
SidTypeComputerWWW
Sets the descriptionWW
Returns the COM typelibs embedded in this file3
OldVersionWW
Returns the instrumentation information from the assemblyW4
@VWAVH
20180914214207Z
,RegistrationCommands
Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
Represents read-only view of a setting definitionWC
SE_BACKUP_PRIVILEGEWWW
Returns the list of category instances
logTypeW
Sets the component where the setting is definedWWW-
Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a
ApplySuccess
sCmiEventsWWW
Returns the configuration of an installed repositoryWW1
ReportToUser
2"&,\45>
UTF-8 encoding
Gets the flags that control serialization behavior2
MigHost: Parent process ID has not been specified.
Gets the parent object of a custom information(
cmiNoneW
eiVn`
Returns the read-only redirection table view from the instance indexWW
Facility
IReferenceRedirectionTableWW
<requestedPrivileges>
possible functionalities in CMI for loggingWWW@
Sets the instance factoryW
SHELL32.dll
RepositoryTypeConstsX4
Returns the edit sequence when AllInstances is last modifiedWW*
yRich
Returns the algorithm used to generate the hashWWW,
method SendLogMessageW
ReturnValueW
8jZSysprepModuleWWW
NCmiResolutionModeWWWDH
IFileComInterfaceProxyStub
Returns the maximum number of instances need to select3
_PPTP00x7
Sets the reference factory&
uiAccess="false"
IPostApplyWW
6AD}II
Parent process ID ParentPID=%s is invalid.
Sets four part version valueWW,
Returns the per user virtualization valueW&
;Data
vIResolverWWWPF
method GetOfflineFileLocationW!
MigHost: CMigPluginSurrogate::LoadDllServer: Invalid argument: BinaryPath=[%s] does not exist.
cmiBootstrapPass
Sets the value of this version(
Interface to store information for imaging*
Gets the parent object or nullY
Event source interface of ICmiFactoryW#
Assign an identity definition to this identity referenceWW
GetFileNameW
0.ZcmiUnattendSyntacticValidationWW
Sets nameW
Returns the reference factoryW
ncmiRebootRequiredWWW
Interface to replace tokens in a manifest using resource manfiestW
Returns the hash code of thisW
WATAUAVAWH
Sets the number of edits that have happened to this component instance@
hMigrationElementInformationW
lpOfflineExecutionWWW|`
Returns if Component has element(s) of the specified pathW7
Downgrades an object.W*
(QuImagingInformationWW
~`{FXW
Returns the name this settingW
$`2X`F
&ComputeEffectiveSettingInstances$E
property DomainWWW!
IConfiguration
FInstanceFactoryWPF
Represents localization resources for a cultureWWW%
Sets the arguments for the un-registration.WWW0
/_]`n5>
Returns the installation passes during which this command must run.WWW@
A_A^A]A\_
.CRT$XCAA
IPostGather InterfaceW
MigHost: Failed to register interfaces and type info. Exiting process.
SE_DENY_SERVICE_LOGON_NAME
\$ UH
Returns the list of attributes as ICustomInformationWW2
ADVAPI32.dll
Sets old versionWW
Represents a string entry in the string tableW
dParentInstanceWW0C
SidTypeGroupWW
|^^ Yh
SidTypeDeleteAccountWW
OwnerWWW
CreateThread
CoRevokeClassObject
Returns the environment variable set.W"
.00cfg
Flags that control the caching and fetching policies of a queryWWW
Uninstalls an object.W8
cmiTrusteeComputerWW|
PostEventWWW
UserName|`
Different types of resolution stagesWW.
method MapSourceFileLocationWW"
FreeLibrary
%53,&
Provides IInstaller::Install call sequence of a list of installers3
Stock installerWWW
Returns the collection of instance identities selected,
Removes an item at the specified index
Sets comments that are useful for documentation purposeWWWI
fD93t
Returns the list of external COM proxy stubWWW%
Returns the input source of the assemblyWW%
8uLIPreGatherWW
Represents element specific migration informationW!
http://www.microsoft.com/windows0
LProcessorArchitecturesWW
Represents a collection of objects that can be accessed by indexWW
Generate PnP info during a no-install conversionWW.
180823202613Z
Returns repository for packagerWWW.
Configuration pass, which can happen in online install3
IQueryWWX
CompanyName
StageWWWX
Process ExcludeId directivesWW0
Replace existing value.WWW
Returns the display nameWW
GetCurrentThreadId
SettingOverrideConflictFlagW$E
/InitDoneEvent:<event_name> - if specified, event will be set when host completes initialization and enters into waiting state.
iDeserializeW\D
Sets descriptionWW
CSingletonClassFactory::RegisterClassObject
MembersWD
IVersion
Unregisters callback for CreateObjectW.
EntryTypeWWW
0r3cmiRegExpandSzWW
Represents a listener to logging from CMIW
ExpressionWW
cmiMigrationTypeNoMigrateWWWH
u HcA<H
`cmiLogLevelError
@SVWATAUAVAWH
KeyNameW
WdsInitialize
%pAccessModeWW
Returns the typelib ID
Returns the component which defines this instanceW%
Get all the secured setting definitions across componentsWC
8r3ICmiFactoryEventSourceWW,
calloc
CoRegisterClassObject
.ShowUIWW@
GetProcessHeap
Sets the boolean flag indicating if the security descriptor reference is for offline modeW0
Returns the identity of the supported component.WW-
Sleep
Represent four-part partial or full version valueW
Returns the processor architecture of infs used by this serializerD
Indicates that success is when return code is 0WWW9
ecmiLogFacilityInstallerW,L
eeCapabilities
&SimpleIdentityWW$^
_InstallerEvents
Creates a new object instance of the specified typeWWW%
default installer capabilities flagWWW(
&IInstallerRegistrationWW
TypeLib\{EE45FDEE-232D-4fae-92E9-9A9ED142C346}\2.0\0
FileRepositories propertyW.
Merge another setting with this settingWWW&
Invoked to post-process the internally created object.#
h)EWCk@
~~vvvlia<<
ISimpleIdentityWWW
RegisterMigrationIIDsAndTypeInfo
Returns the display name of category instanceW*
IInstallerRegistration
Represents a setting instanceW
ResourceIdWW<
Returns environment to expand paths during importWF
Returns the cannoncial string representation of thisWW
/953,&
Returns the factory used by an reference factoryWW-
Used to identify component from unattend file to instance identity
SE_CREATE_GLOBAL_PRIVILEGE
@SUVWAVAWH
Returns type attribute
SE_TAKE_OWNERSHIP_PRIVILEGEWWW
</security>
cmiRegDwordW
Sets the number of methods, or -1 if not specified
Sets the repositoryWWW/
IdentityReferenceWWW
8ssILocalizationResourcesWW
CIsCanceledWW|`
Sets the replacement tokensWWWA
Ignore missing catalog files in driver componentsW
CurrentInstance propertyWW
IIdentityDefinitionW
)Microsoft Root Certificate Authority 20100
_wtol
cmiLogModuleTrustWWW
IPreApply InterfaceWWW
PApplyToW
Provides information of a group trusteeWWW)
0A_A^A]
Events interface for configuration:
ImportWWd
IMigrationElementInformationWW
Get the custom information specified for a componentWWP
@cmiInstallerCapabilityForceDriversCriticalWW
Sets the namespace qualifierWW
1RepositorySetWWW0C
_wcsnicmp
LastUpdateTimeWW
OwnersWW
Returns the first value in a pair.
cmiPathFileW
Sets 16-byte public key token for the publisherWWW'
.?AUIUnknown@@
x!!ff
LockResource
Sets the namespace URI of a custom infoWWW
Returns if this instance is enabled or not'
cmiMigrationTypeInheritWH
Sets the discoverable flag.WWW-
[ReturnValWWW4!
Sets the second value in a pair.WW"
Gets a list of members of a group trusteeW)
Returns the log from which facilities to receive.W1
installer for PnP drivers and devicesW
Sets the processor architecture the target runs on-
cmiLogFacilityOtherWXM
Removes entries from the redirection table using a reference identityWC
RSDS V}&
Represents a private test packager for driver componentsWW6
Sets the migration typeWWW
vMigrationExcludeInformationW
SimpleId
IResolverW
Sets repository for packagerWW
Returns whether to write the byte order mark during serializeW:
NewPathW
Provides registration information about installerW*
Describes the files that need to be registered after the installation is done.3
Returns the visibility attribute of a settingW*
0jmcmiCompressionFormatDefaultW
VDirtyWWW
Gets the SDDL of a security descriptor definitionW1
Gets a list of privileges assigned to a trusteeWWW/
Sets the runtime name of a dependency file0
" NamespaceUri
Returns the entity who adds this instance to a configurationWW9
treat all driver components as criticalWWW
Sets the security descriptor reference of a registry keyWW1
UserWW
Returns the localization informationWW!
cmiZeroOrOneT
0#ucmiUserW
FreeSurrogateWWW
Prepend to existing value.$
|hK,_
Resolution has been deferred to actual instance to avoid cyclic references*
Returns if the installation is using cmiadapterWWW-
GetLocalizedComponentWWW\D
RRegistryKeys
Represents a reference to a security definitionWWW0
"VersionConstsWWW(#
hcmiQueryGetSettingDefinitionsForSettingTypeNameW8
Returns the collection of reference in of this instanceWWW
_BulkImporterEventsW
SettingOverrideConflictInformationWW
}cmiEffectiveSettingsOverridesOnlyWWW$E
WaitForMultipleObjects
Unadvise
GIFileComClassWWWt
Factory propertyWW+
Returns the proxy stub class IdWWW
Returns a list of components to be removed+
TcmiChangeNotifyPrivilege
cmiSelectionDone
Gets the parent of a registry keyW)
CreateInstallerW
IRepositoryInitializerWW
Returns the list of installer registrations.WW5
Represents a set of environment variables.:
SE_REMOTE_INTERACTIVE_LOGON_NAMEWW%
cmiRepositoryWWWd
KValueWWW
Sets display nameW
CreateObject
Returns the read only collection of all instancesW
Implemented by wrappers of CMI objects. Applicable only for those CMI objects which rely on internal interface rather than public interface for their implementationWW8
Gets the supported combination of InstallationTypeConstsWW8
Selects element based on a path expression.
Sets the file compression type=
DependencyId@
MigHost: Initialization completion event name has not been specified.
+AccessModeConsts
IPathTranslatorW
ISettingOverrideConflictInformationWWW
Returns the COM proxy stubs implemented in this fileWW.
0mzcmiLogFacilityInfWWWXM
pOfflineRegistryPath|`
OpenProcess
250701214655Z0|1
Gets the object for the event postedWW*
StringFromGUID2
IInstallerSequence
Sets the environment variable set.,
__set_app_type
PostGatherWW
Returns the secured attribute of a setting"
Sets type attributeWWW
DcmiNoMatchWW
@jCreateIdentityReferenceW`T
ExcludeOptionalDependencies propertyWW
E;SecuredW@
urResultWW
Gets the description of a security descriptor definitionWW8
Sets the installation passes during which this command must run.WW/
SE_CREATE_PAGEFILE_PRIVILEGEWW
LoadDllServerWWW
LocalizationResourcesWWW
040904B0
GetOfflineFileLocationWW
0cMcmiUtf8EncodingW
pSourceFilePathW
Returns the migration informationW
SettingOverrideInstanceW
cmiFileRepositoryWWWd
Returns the identity of this configuration'
Returns creation timeW
SizeofResource
CmiObjectTypeWWWd
installer for sysprepW'
Given a setting definition find the setting type nameWA
IGenericCommandWWW
FallbackCultureW
229879+4379540
8!(IDictionaryW
Sets the resolverW1
9cmiRegLinkWW
MCompressionW
YoTlbidWWW
wwwww
BeforeWWl
IIdentityReference
Removes all items from the collectionW,
cmiRegResourceRequirementsListWW
Removes all environment variable definitions.W*
HcA<H
ExcludeWow64Components propertyWWW@
;8721^.
A_A^A]A\_^]
ImportPathWW
SE_DENY_REMOTE_INTERACTIVE_LOGON_NAMEW1
Returns the reference redirection tableWWWX
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
Returns the name of the module
8q]QueryFlagsWW
IReference
IInstalledRepositoryWW
SourceWW
hPathTypeConstsWW
Applies the redirections from unattend file to configurationWW:
SHLWAPI.dll
PostApplyWWW
GenericTokenReplacer
cmiSystemEnvironmentPrivilegeWWW
?cmiSyncAgentPrivilegeWWW
""'xw
r%!k8S
Register propertyW9
PcmiSerializerWWWd
IFileWindowClass
cmiCompleteInstallWW
Returns locale independent nameWWW
WU'%]469=EFHJNl0#A
Sets the event ID for the event to be postedWW$
Sets source nameWW
COMPRESSION_FORMAT_NONEWWW
9AllInstances
ZcmiConnected
=IReferenceRedirectionTableEntryW
Returns the textWW
This interface allows installing and uninstalling objects.
SequencedPathsWW
InstallationType
$TargetProcessorArchitectureW
cmiZeroOrLessThanZeroWWW$
VarFileInfo
Removes the specified item from the dictionary%
_fmode
Sets the resolution stage of this referenceWWW
MigHost: OpenEvent(%s) failed.
ICategoryMembershipWWW
FcmiPathRegistryKeyWW
Returns the migration information of a directoryWW-
cmiHintReplaceWW\
Associates an setting name with a component to which the setting appliesWW-
CommitTransaction methodWW
wwwwwwx
IRepositorySet
ICmiFactoryWd
0.KcmiMigrationExcludeInformationWWd
8|bICmiCollectionWW
cmiMigrationPatternWd
Returns whether the dependency is needed for offline installWW9
0P-cmiLocalizationInformationWWd
property WorkingDirWWW
IPreGather InterfaceWW
</requestedPrivileges>
Returns the search paths of infs used by this serializerWW4
H0F0D
Returns value for initializing other id in an answer fileW6
hIFileRepositorySetWW
method LoadDllServerWW
IDiscovery InterfaceWW
ResumeThread
IFileRepositorySet
Returns the type of file repository this object implements.WWWV
InfImportPathWWW,
DefinitionsW0\
Registers an installer factory using IInstallerRegistration.WWG
TestersW
IIdentityDefinitionWWW
cmiOnlineInstall
20180914213626Z
Represents category membership
cmiCustomElementd
Executes the query and returns9
ICmiExtensionWWW
cmiEventInstallerEndInstallation
Resolver$E
Sets the operation hint of a security descriptor definitionWWW9
<requestedExecutionLevel
microsoft1-0+
LookupNamespaceW
0oicmiAuditPrivilegeWWW
SetTelemetryDataPointWWW
skrkh
IdentitiesWWd
qResolveInstaller
IMigPluginSurrogate
bCategoryInstancesWWW
KProgidWWt
cmiResolverWd
Sets the value
set the major version numberWW
cmiPrivateInstallerWdK
4cmiImagingInformationWWWd
pFieldWW
Represents a collection of key-and-value pairs%
A^_^][
Returns a list of IMigrationSupportedComponent!
Switch %s is unsupport.
cmiMediaFileRepositoryWWd
Associates a setting with the component to which the setting appliesWW=
IRedirectInformationWW
"ComponentWWW
1pSourceUserSidStringsWWW
Sets the instrumentation information of the assemblyWW
IReferenceFactoryWWW
Represents a private test packager for non-driver componentsWW8
Returns information about what to exclude during migration7
+#-28<
Win32 file attribute that can be represented as a flag.WWW
SendLogMessageWW
zmg]/0
cmiBackupPrivilegeWW
CoUninitialize
QueryTypeGenericQueryWWW
RollbackTransaction method
MigHost.exe: Error:
Returns processor architecture string, e.g. x86WWW,
ShareModeWWW
ReferenceAnswerW
Returns the key nameWW
EntryIdW
10.0.17763.1 (WinBuild.160101.0800)
RegistryValueTypeWWW
Sets the imaging informationWW.
IXmlSerializer
Defines registry value types.W
Flushes internally cached localized componentW9
DeleteCriticalSection
RaiseException
cmiLogModuleClrW
IGenericTrusteeWD
SysprepInformationWW<A
scmiNetworkLogonPrivilege
Gets the import path for the INF fileW%
RtlCaptureContext
4cmiRemoteInteractiveLogonPrivilegeWW
@IDomainTrusteeWW
CIMigrationInformationWWW
$(.469F
160211232409Z
x ATAVAWH
V11oF
ClearLocalizedComponentW\D
Returns 16-byte public key token for the publisher/
,99InrospRQNmChHSG4LZKNRGFbAt7p8Jq4zRZ3G+Gb4=0Z
Sets the installation pass this sequence applies toWWW:
ISecurityDescriptorReferenceWW
Specifies a COM interface proxy stubWW
UnregisterPassWWP
FTargetWW
IImagingInformationWWW
Waiting for selectionW
Error, Warning, Info and Trace(
D$@I;
0YdcmiHintDefaultWW\
SE_CHANGE_NOTIFY_PRIVILEGE
8n6PrivateTestPackagerTypeConstsWWW
8mlIInstallContextW
\ProxyStubClsid
CreateDependencyReferenceWWW
Returns the resolver identityW
CE=+FU
Sets the name of a settingB
Upgrades an object.WWW
MigHost
8R*FileRepositoryFlagsW,3
8^3ICmiEventWWW
InfSerializerWWWp0
cmiCategoryComponent
2cmiFileAttributeHiddenWW
$(.469=ET
0aKcmiStage2PassWWW
MigHost: CMigPluginSurrogate::FreeSurrogate: hThread=0x%x, ThreadId=0x%x, timeout.
Types of configuration resolution modesWWW3
Returns the repository flagsWW
ICmiLogConfigW
cmiDenyBatchLogonPrivilegeWW
Thales TSS ESN:C3B0-0F6A-41111%0#
Installer capabilities flagsWW
Gets the fully qualified file name or manifest name for the given file of a component identity.WWWU
Returns the file repositories associated with this repositoryW7
7OldPathW
SubElementsW
ICmiEventArgsWWW
Installs an object.WWW
Returns if the instance is enabled or notW&
HeapReAlloc
IFileW
.7DefinitionWW
[cmiQueryGetAllIdentities8
Sets the migration informationF
InstanceSourceWW
Types of language resolution modes1
Sets the previously installed instance during servicingWWW:
0LongRunningPluginWWW|`
MigrateW
Sets the identity of the supported component.W1
+cmiCategoryMembershipWWWd
wwwwwwwwwx
NuNlI
8=?IExcludeReferenceWWW
A_A^_
'InstallerTypeWWW
ICmiLogListenerW
Represents an entry in the reference redirection table!
Microsoft Corporation1200
Returns the dependency type for this dependencyWWW,
Returns the type of a custom infoW*
cmiOfflineInstallWWW
iPPTP00
cmiFileAttributeNormalWW
SE_SYSTEM_ENVIRONMENT_PRIVILEGEWWW
Washington1
cmiFileRepositorySkipMissingExternalFilesWWW,3
~~vvphh
]IdWW
Returns the destination file name.
A_A^A\
AssembliesWW
ICategoryMembershipW
Returns a colon separated list of authorsW&
IInstalledRepository
Represents a store of metadata and data (files) of componentsW+
WDSCORE.dll
+RedirectInformationW
cmiInstanceFactoryWWd
(U=ReferenceRedirectionTableWWW$E
Returns the map access valueWW
pValueWW
InstallerProcessorArchitectureWW
nnwww
~{onyR
Sets the typelib flags
]:953,&
VisibilityWW
Sets the definition of a reference7
Returns the current installer associated with the element nameD
cmiLogModuleCmiW
cmiMigrationPluginWWd
cmiImpersonatePrivilegeW
Sets the fusion activation context inheritance flag for applicationsWWB
Returns whether to omit xml declaration during serializeWW5
hComputeEffectiveChangesW
O0CreationTime
Registers callback for CreateObjectWWW%
TypeLib\{EE45FDEE-232D-4fae-92E9-9A9ED142C346}\2.0\FLAGS
IMigrationSupportedComponentWW
ComInterfaceExternalProxyStubsWW
Sets the first value in a pair.WWW!
MethodCountW
#>ModuleNameWW
]]>2{
NoInheritWWW
Returns old versionWWW
RBindingRedirects@
smServerNameWW
Various comparision resultsWWW2
__wgetmainargs
LAdditionalArgsWW
Returns the value of end-of-life flagW"
tcmiInfSerializerInfIsInboxWW
cmiLogLevelNoneW
InstallContextWW
Defines the types of file repositories that can be created.WWW;
u$L97t
RtlLookupFunctionEntry
Returns the IIdentity to ISettingInstance mapW0
Sets the culture for the assemblyW
Returns the id for a configuration generated by this answer fileWW=
0,WcmiDirectoryd
QueryPerformanceCounter
IPostApply
rICustomInformationWW
CmiLogMessageWWW
Returns the class-public key token map=
This interface allows metadata repository initialization.W)
Returns the definition of a referenceW"
cmiInstrumentationInformationWWW
IMigrationPlugin0*
IRegistryValueWW
8BinariesDirectoryPathsWW
Returns the previously installed instance during servicing7
msvcrt.dll
0~RepositoryNameWW
StringFileInfo
Returns the dependencies of this file.E
Sets the sid of a trusteeW
Returns the list of installer paths ordered by Install call sequenceWW=
ole32.dll
7zResourceTypex
cmiCompressionFormatDontCare
GenericCommandSuccessCodeConstsW$
InstallationPass
05[cmiEnableDelegationPrivilege
<!-- This Id value indicates the application supports Windows Threshold functionality-->
YIPreApplyWWWDa
Sets the migration information of a directoryW7
{{]^///^^^^Q
Sets the display name of category instance,
SE_DEBUG_PRIVILEGE
IFileWWW
SettingOverrides@
IVersionWW
Gets the fusion activation context inheritance flag for assembliesB
XYYYYO#
Returns the list of setting definitions, each as ISettingDefinitionWWW=
IDependencyWx
Returns the second value in a pair.WWW
MigHost: CMigPluginSurrogate::COMGenericThreadingHostThreadProc: Exiting ThreadID=[0x%x].
.text$mn
$(.46%A
ICategoryInstanceW
Sets the value of end-of-life flagI
Generic token replacer typeWWW%
cmiRegistryKeyWWd
i=;:953,M
Sets the destination file name.WWW
Returns the runtime path of a dependency fileW*
SE_CREATE_TOKEN_PRIVILEGEW
No namespaceWW
Returns the resource type for this dependencyW*
Sets company nameW
Sets the fusion activation context inheritance flag for assemblies#
cmiRegBinary
CMigPluginSurrogate::LoadDllServer
Returns the arguments for the executable.W&
Sets the value/inner XML/etc of a custom infoW4
%'CultureWt'
Returns the discoverable flag.
MIGHOST
Gets the display name of a security descriptor definitionW9
Dependencies
ReferenceRangeWW
cmiLogLevelTrace,L
.:><1
Returns the user specified setting overrides for this instanceN
Returns the tybelib ID5
D;JmN
TDirectoriesW
xthbZQO;?
Gets the installer that this sequence needs to followW5
Sets the security descriptor reference of a directoryW0
3FactoryClsid
.ZpContext
ICmiSecurityInformationW
OpenThread
Sets if this instance is enbaled or notWWW'
Sets the maximum number of instances need to selectWWW6
Resolve only compositional dependencies and language dependenciesW'
8http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
InstallerRegistrationsWW
CmiLogModuleFlagsWWW
SettingOverrideConflictInformationsW\D
performs conversion between object and xml*
Converts only internal files and ignores Include/Needs directivesWQ
lManifestResourceDependencyWW
CreateQueryW
cmiSecurityPrivilege
ReferencedBy$E
8I0ISecurityDescriptorReference
-IsHostAliveWF
cmiAssemblyWd
0-K4B
VMigrationTypeWWWH
Child instances are not fully resolved.WWWJ
"""'z
CPPTP00l9
SelectionMin0C
4IMigrationContextWWW|`
manifestVersion="1.0"
ICategoryInstanceWWW
cmiManageVolumePrivilege
Possible types of trustee, defined in ntseapi.h SID_NAME_USEWW
IFileTypelibWW
"MembershipsW
UTF-16 encodingWWW%
cmiNotStartedWWW
t$ ;t$P
Represents security information define in a componentW
Valid events that CMI objects supportW
all the overrides and the default are mergedWW;
IPostApply InterfaceWW
Reboot is required)
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
Sets a colon separated list of authors:
cmiIncreaseBasePriorityPrivilege
iSHp6
RHEB=:953,&
method GetOfflineRegistryLocationExWWW
Returns the path of a file when the owning assembly is being importedWB
Event interface for CMIWWW
Returns the file repositoryWWW
?[8?GOQY
ClsidWWWt
RtlVirtualUnwind
RegisterListener
20180915045247.656Z0
_wcmdln
Returns the default setting instances from the componentWW>
8[YFileRepositoryTypeConsts
Sets the search path of infs used by this serializerWWB
Represents data required for automatic resolution of a referenceWW%
GetModuleFileNameW
IExcludeReferenceW
cmiFileAttributeOfflineW
dependency between componentsW+
Returns the fully qualified path to the execuable relative to component's root.WWWL
fD9<Zu
Returns copyright informationW
Describes the assemblies that should be replaced by the owner assembly@
xBpTargetFilePathW|`
Get all the identities of a typeWWJ
.(LogListenerW
Returns the processor architecture installers are running onWW9
MigHost: CMigPluginSurrogate::LoadAndRegisterServerInThreadContext: FreeLibrary(%s) failed gle=0x%x.
Applies this unattend file to a configurationW)
Returns the configuration an instance is contained inW*
ClientProcessorArchitectureW
0cmiInstanceAnswerWWWd
SettingDefinitionWWW
ModuleWW
Sets the interface IDW
/LogDir:<path> - if specified, path to log directory, used to initialize panther logging.
Get a all identities in the databaseWW4
SE_UNDOCK_PRIVILEGEWWW
Operation hints for registry values.WW
Returns the value/inner XML/etc of a custom infoWW-
f0RemoveByReferenceIdW
Gets a dictionary of trusteesW4
8a.ISysprepModuleWW
!d"(.469=EFHJMTr
Sets locale independent nameWW
Returns the timeout for registration in seconds.WW-
SubObjectWWW
.CRT$XCA
Set the program ID
Sets the subcategory of category instanceW-
Returns the ownership flag.WWW
CommandLine is NULL
cmiLogModuleLocDrvWWXM
KERNEL32.dll
Revision
Get Identities of the dependents of a componentWWW
4SubCategoryW
Returns the operation hint.WWW
AssignIdentityDefinition
mighost.pdb
6|xU<
DependencyWW
Returns the resolution status of this referenceWWW,
Sets whether UI should be shown for this settingWW!
eReferenceWWW
cmiEventInstallerBeginUninstallation
Imports all the files for the given componentW(
RebaseWW
UnhandledExceptionFilter
pOfflineFilePath|`
Manifest resource token replacer typeW"
Returns the identity of the instanceWW!
cmiExcludeReferenceWd
pDependencyTypeWW
Removes all the files of the components the repository+
rcmiLanguageModeNoneW
Returns the description for this dependencyWWW(
@cmiFileAttributeReadOnly
IGenericTokenReplacerWWW
Microsoft Time-Stamp Service0
U0S0Q
Creates and initializes a new repository.W<
cmiWriteableTypeSystemDataWW
Sets processor architecture string, e.g. x86WW0
Returns the estimated size of a componentW&
Returns the source pathWWW
cmiQueryGetComponentDependentsWW8
IDiscoveryWW
Returns a repository import object=
cmiDefaultRepositoryX4
0h-cmiQueryGetComponentFromIdWW8
MigHost: CMigPluginSurrogate::Init: Successfully initialized surrogate.
Returns the language stringWWW
0cmiQueryGetIdentitiesFilteredOnIdentityAttributesWWW8
OcmiCategoryDependencyWWWd
VS_VERSION_INFO
IBulkImporterWWW81
Represents data required to customize an instanceW$
LocalizationInformationW
functionalities that do not fall into the following categories
Sets the batch transaction setting
Migrate and rename if a collision is detectedW
IRepositorySetWW
_PPTP00L6
Returns the INF file search repository#
.CRT$XCZ
stores and manages components in repositoryWWW
cmiReferenceAnswerWWd
SidW|
8nDDbih/[g
SerializerWW
IComponentSettings
IndexWWW
!/CopyrightWWW
/InitDoneEvent:
Gets the map of installer ID and the InstallationPassW6
Software\Classes\
lDomainTrusteeWWWH?
ISerializerW
MachineNameW
SE_SYNC_AGENT_PRIVILEGEWWW
VersionedWWW
Creates an installer instance for the specified element.WW<
hN?!#u
ICmiWrapperW
Sets the algorithm used to compute the hash.WW+
Provides information of a domain trusteeWW*
Sets language stringWW/
lIRepositoryW
Gets the event ID for the event posted,
cmiRemoteShutdownPrivilegeWW
MessageW
Reference factory interfaceWWW0
$(.469+A
?cmiOnlinePassWWW
Sets the base interface nameWW
L$pE3
RResolveW
IInstallerManagerW
IEventArgumentsWWW
.data
Sets whether to write the byte order mark during serialize
cmiEventArgumentsWWWd
RInstance
Returns the descriptionWWW
Represents a file repositoryWW
Returns the installation status of an instance
cmiInstallContextWWWd
MigHost: CMigPluginSurrogate::LoadDllServer: Invalid argument: BinaryPath == NULL.
Represent an resolver of IReference(s)%
Gets a list of ICustomInformationW9
DescriptionWx
Resolve a referenceWWW&
CMigPluginSurrogate::WaitForHostTermination
HEB=:953-\2
Removes the given component from repositoryWWW0
Dooo'MMM
.GetInnerObjectWW
Sets the global log listener.W5
_PPTP00h
Sets the unique hash of the file.W/
memset
'nComponentIdentityWWW
Assembly
IdentityReferenceRangeWW
Returns the collection of instance identities available for selectionW6
method UsersMigratingThisComponent
R:953,&
cmiShare
cmiFileRepositoryCreateLinks,3
Represents the reference redirection tableK
possible set of values to indicate rebootW
HEB=:`^[@
WIComponentSettingsWW
IBindingRedirect interface
Append to existing value.W
;cmiNoRebootRequiredW
BinaryImportPathp
WServicingReferenceInstanceWW
Posts an event to the subscribersW-
cmiNamespaceNoneX
Flags that control the inf serializer behaviorD
InstallersWW
GetProcAddress
GetAssemblyIdsWW
Adds a new item to the dictionaryW.
InputObjectW
ComInterfaceProxyStubsWW
Returns the threading modelWWW
Reset the resolution status of a reference's parentsWW,
cmiVersionWWd
ProductName
installer for settings
MigHost: CMigPluginSurrogate::LoadAndRegisterServerInThreadContext: CoRegisterClassObject(%s) failed hr=0x%x.
{Hint
yCarrierDirectoryPathsWWW
PartialW
Returns the name of the file of the plugin'
Microsoft Corporation1.0,
IQualifiedSettingNameW
Returns the log from which modules to receive.1
IInfSerializerWWp
.idata$6
IRepositoryWWW
HashAlgorithmWWW
gIIdentityReferenceRangeW|G
)cmiLogFacilityConfigurationWXM
Ysssssss
vGroupTrustee
Usage:
MigHost started with command line: %s
Generalize pass, which can happen in online installWWW3
method PreApplyWWW
SE_LOAD_DRIVER_PRIVILEGEWW
Sets the display name of a security descriptor definitionW8
$Microsoft Root Certificate Authority0
Returns the valueW
Microsoft Time-Stamp Service
0PutValue\
Returns the current query type
Returns the subobject of this category instanceWWW!
Sets whether the dependency is needed for offline installW(
ValuesWW
Sets the definition of this referenceW(
set the build numberWW
D$HE3
ucmiReferenced
Sets the fully qalified name for creating an empty directoryWW;
*cmiGenericTokenReplacerW(<
Sets the estimated size of a component
Returns the component where the setting is defined/
Types of resolvers. Used while creating the resolverWW
Sets the escaped textual representation for xml elementsWW.
Represents a configuration answer file9
Gets a dictionary of security descriptor definitionsWW,
Microsoft Corporation1+0)
FileVersion
Indicates that success is when return code is less than 0W<
Gets the list of IInstallerSequences of the installers9
HeapSize
MigHost: CMigPluginSurrogate::Init: failed to create event gle=0x%x
0FgcmiFeatureComponentW
CLSIDFromStringfailed, error=0x%x.
fD9$Au
}zwmmhvLHFFHJMZ
BuildTypeWWWL
cmiPublicInstallerWWdK
NoneWW
rAddW
Microsoft Corporation1&0$
SidTypeWellKnownGroupW
IConfigurationAnswerLO
p AWH
1(0&0
Various success codesW4
Resolve each language-specific dependency to all matched componentsWWW"
"Microsoft Windows Verification PCA0
180703204550Z
Returns the type name of a setting
Returns if the entry is enabled or not"
ModulesW
1SearchPatternWWW81
Returns the window classes implemented in this fileWWW&
REncoding
Returns the enumerator of ICmiPair@
{EE45FDEE-232D-4fae-92E9-9A9ED142C346}
<930>
CloseWWWd
Returns the array of fallback languages stringsWWW,
Resolves the installer for the specified object and invokes its uninstall method.W>
Sets a colon separated list of ownersW)
Returns build type string, e.g. debug or releaseWW-
InstallW@
IAssemblyWWW
IUpgraderWWW N
property PerUserSupportWWW
xmlns="urn:schemas-microsoft-com:asm.v1"
Sets new versionWW
A_A^_
memcpy_s
cmiGenericTrusteeWWWd
RepositoryDispatchWW
cmiSimpleIdentityWWWd
\TypeLib
Returns the class IDWW
Returns the runtime name of a dependency fileW*
?cmiEnvironmentWWd
FILE_ATTRIBUTE_ARCHIVE
777\;
hcmiLocalizationResourcesd
Returns company nameWW
Sets file repository for packageWW#
"}ExtraArgumentsWW
8,%EffectiveSettingsFilterTypeW
Sets the arguments for the registration.WW.
SHDeleteKeyW
cmiConfigurationPass
Sets the redirect informationW
Returns the base interface nameWWW
Events interface for bulk importer"
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
cmiStringTableEntryWd
cmiQueryGetComponentDependencies8
Levels of validation for an unattend fileW4
Returns the arguments for the registration.WWW(
Flags for IFileTypelib.FlagsWW?
Create dependency referenceWWW7
ProxyStubClsid32
cmiHintAppendWWW\
Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0
<!--This Id value indicates the application supports Windows 8/Server 2012 functionality-->
191123202613Z0
}FileTypelibFlags\+
Represents localization informationWWW-
Sets the value of the variable with the specified name.WWW,
Returns the readonly collection of references to an instanceWW7
20180915213626Z0w0=
cmiLockMemoryPrivilegeWW
Returns the identity that qualifies a settingW*
m:::::::R
Returns the list of registration commands.,
zEntryValueWW
Do not clean up if import failsWWW+
IStringTableEntryW
PrivilegesWW
%cmiFileAttributeTemporaryWWW
Sets the versionWW
Gets the ResolutionMode for resolving configurationWWW3
Sets the timeout for registration in seconds.W
Gets the installer registration of an entryWWW
TrusteeTypeW|
.?AUIMigPluginSurrogate@@
cmiAnswerFileResolverWWWHX
ICmiPairWW
Sets the type of category selectionWWW!
Resolve each language-specific dependency to one component>
Sets the migration information of a registry keyWW!
@UVWH
Represents an instance of an IComponentWWW1
Sets the repository flagsW
CoInitializeEx
CompareW
cmiDebugPrivilegeWWW
Sets the repository to be used with the instance factoryWW
Sets the class IDW
FullName
ReferencesWW
Returns the number of methods, or -1 if not specifiedW2
ISettingInformationWWW
8HdIXmlSerializerWW,
wqBatchTransactionOnWW
pLogMessageW|`
Sets the ResolutionMode for resolving configurationWWW5
+cmiTrusteeGroupW|
8SelectionInstancesWW0C
HeapAlloc
ExecutableNameWW
HCmiLogFacilityFlagsWXM
Returns the processor architecture the target runs onW2
ICmiFactoryCallbackW,
Encodings supported by XML serializerWA
cmiSettingOverrideInstanceWWd
Returns the subobject of this dependencyWW9
.cmiWriteableTypeStaticWW
method GatherW
.data$brc
ConfigurationWWW\D
Returns whether UI should be shown for this settingWWW0
Returns an enumerator of name value pairsW
IFileComInterfaceProxyStubWW
WorkingDirWW|`
ILocalizationInformationWW
H3E H3E
InternalName
IMigPluginSurrogateW
Gets the name of a security descriptor definitionW1
method ReportToUserWWW
qqqqqqq)A
Implement by client to provide return instancesWWW,
Register
Sets the map access valueW
RebootIndicatorW
InstallerSequenceWWW
pluginBinaryPath
Returns a list of components to be replacedWWW-
IInfSerializer
.rsrc$02
Types of repositories. Used while creating the repositoryW
Identityd
IConfigurationAnswerWW
4cmiAssemblyComponent
_unlock
SecurityInformationW
cmiInstanceWd
Sets a list of capabilities of a group trustee(
cmiRegFullResourceDescriptor
Forces conversion of all registry entriesW
Sets the resolver identity*
use symbolic links for file installationWW7
FILE_ATTRIBUTE_READONLYWWW
Returns the dependent category identityWWW$
ed))dd++ee///^^^O
Sets the name this setting3
TypeLib\{EE45FDEE-232D-4fae-92E9-9A9ED142C346}\2.0\0\win32
SE_SERVICE_LOGON_NAMEW
IPreGather
Sets assembly IdWW
Sets the SDDL of a security descriptor definitionW;
Sets the registry valueWWW
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
Returns the current pass of an installationWWW(
ITokenReplacerWW
&cmiHintPrependWW
Return an error when importing a component already present in the file repositoryWL
SidTypeUnknown
Returns the list of assembly identities that should be replaced.WW
.?AUIHostingTask@@
.text$di
IAssemblyDependencyW@
Returns the instance identityW#
Returns the list of setting types, each as ICustomInformationW%
Sets version scope attributeWW!
MethodNameWW
PerUserSupportWW
Indicates that success is when return code is greater than 0WWE
*UPreGatherWWWpb
Represents a log configuration from CMIWWW
luunniiDu
TokenReplacerWWW
JcmiEventInstallerBeginInstallationWW
RootPathd
Indicates that success is when return code is less than or equal to 0WH
UnregisterClassA
0KscmiExclusive
Sets the simple identity of the componentW0
Returns the default value of a settingD
/ParentPID:<pid> - if specified, host process will exit if parent process unexpectedly terminates.
ZInitializedW
"Microsoft Time Source Master Clock0
GetCurrentProcessId
Returns the component type of this assemblyWWWB
cmiQueryGetSettingTypeForSettingDefinitionWW8
Receives log. Prefix Cmi to avoid conflict with logging in SetupWW
RegCreateKeyExW
Sets the path of a file when the owning assembly is being imported/
&,[\C
I0G1-0+
IMigrationExcludeInformationh
Returns setting overrides of ISettingInstance type.WWW'
InstallationTypeConstsWW
Returns the most recently computed override conflictsW<
Returns the subcategory of category instanceWW)
AssemblyIdsW
Creates and returns a bulk importer, if supportedW0
WindowClassesWWW
0o|cmiProfileSingleProcessPrivilege
0%6cmiIncreaseQuotaPrivilegeWWW
use unattend installationW
GetSequencedPathsWWW
cmiDependencyWWWd
InnerContent
Sets last update timeW"
Returns a colon separated list of testersW&
NewVersionWW
rollback operations if they are supported by the installer'
8:<ShareModeConstsW
j}ArgumentsWWW
Returns the versionWWW
Resolution of a reference is not startedWW
ResolverTypeConstsWW
tMigrationSupportedComponentW
Removes entries from the redirection table using an instance identityWE
;;;Ueee
Cmi20WWW
Gets the LanguageMode for resolving configurationW1
ccmiMigrationTypeMigrateWH
Returns the simple identity of the componentWW)
Returns last update timeWW
CPPTP00p0
SuccessCodeW
oFlagsWWW
Returns the install for this dependencyWWW$
Returns the migration type
Returns identities of all assemblies in the repository2
Returns the component language
cmiRebootRecommended
cmiCompressionFormatLznt1WWW
Gets the security descriptor reference of a fileWW0
IdReferenceRange(U
Sets the key owner-
IRegistryKeyWW
IInstallerWW
0i:cmiRegMultiSzWWW
IMigrationIncludeInformationWW
qDiscover
uee*))))00
cmiConfigurationd
cmiResolvedW
ISettingOverrideInstance
Sets the trustee typeW(
Returns upper bound for the version rangeW&
Returns the redirect informationWW
PostThreadMessageW
possible levels of verbosity for loggingWW6
ByteOrderMarkWWW
ExcludeWow64ComponentsWW
base\ntsetup\migration\migcore\mighost\surrogate.cpp
Useful constant for the default valueW
Sets the description of a security descriptor definitionWW0
.CRT$XIZ
!sExcludeComponentsWWWLO
InstalledRepositoryW
ReplaceTokensWWW
cmiQueryGetFileOwnersWWW8
}cmiQueryGetComponentCustomInformationWWW8
)Comments
pXmlStreamWW
Forces processing of un-decorated models sections even if decorations are presentW0
FileNamed
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
cmiReconfigurationPassWW
05^cmiGeneralizePassWWW
E@A!EH!
DllGetClassObject
!This program cannot be run in DOS mode.
Elements
ISettingDefinitionWW
ICmiSecurityInformationWWW
SettingInstanceWl9
RepositoryWWL
IRedirectInformation`
tPopulateReferenceRedirectionTableWWW
Sets the local nameWWW/
Returns the current setting for transactionsWW"
IGenericCommandW
cmiDefaultFileRepository
Microsoft America Operations1&0$
Returns the arguments for the un-registration.+
Gets a list of capabilities of a group trustee.
SE_TCB_PRIVILEGEWW
_PPTP00
Get category memberships declared by a componentWW
Returns the value by indexed by a keyW:
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
A_A^A]A\_^[
wwwwwwww
mcmiLogLevelWarningWW
SE_SHUTDOWN_PRIVILEGEW
Redmond1
>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
Sets the migration plugin informationW.
Sets the success code for the generic command.N
CommandLine doesn't contains mandatory CLSID.
FiltersW
nStringTableEntry
Sets the identity of a parent or NULL for any parentWW1
Definition propertyWWW
Sets batch commit size
Sets the class id of the pluginWWW(
USER32.dll
SE_ENABLE_DELEGATION_PRIVILEGE
cmiTrusteeUserWW|
GetComponentType
Use the same actions as parent element or objectWW/
This interface manages the association between installable objects and installers.6
Sets the per user virtualization value
Sets the component languageWWW8
Returns the component which defines this instance with all language-specific tokens substituted.WWC
R@55B
cmiLanguageModeAllWW$E
SidTypeUserWWW
IMigrationContext
cmiLogModulePnpW
IDirecotry
r~akow
Released
Sets the source pathWW
[InstallerManager
bIncludeInformationWW0
cmiUndockPrivilegeWW
IInstanceAnswerWxP
HeapSetInformation
ZgOptionalx
_IInstanceFactory
f9H\u
EnterCriticalSection
cmiPrivatePackagerNeedSelectionForFileOwnerW(<
EventArgumentsWW
Represents registry valueW
IRegistrationCommand
>IDirectoryWW
urn:schemas-microsoft-com:asm.v3WW
Error and WarningW
BatchCommitSizeW81
GetInstanceFileRepositoryWWW
Sets manifest file search patternW
ResolverIdWW\D
cmiFirstLevelInformation81
Returns the count of key-and-value pairs in the dictionary!
Returns if conflicting overrides are applied to this instanceW5
\PPTP00LO
Sets the identity of the component to apply the setting toH
Returns source nameWWW
installer for catalogs and certificatesWWW
Sets a list of privileges assigned to a trusteeWWW)
oK0D$"<
b_pOnlineRegistryPathW
EntryWWW
Sets the type name of category
Resolve each language-specific dependency to zero componentWWW:
IUnattendFileWWW
Returns connection string to the repositoryWWW
GetCurrentProcess
cmiFileTypelibWWd
Returns if it is the key owner
wXFilesWWW
static type, file contents do not change during installationWW
<assembly
Creates and returns the requested query object, if supportedWW1
Registration
jcmiCompleteInformationWW
cmiFileAttributeSparseFileWW
=ReplicatedRepositoryRootPath
IInstrumentationInformationW
_vscwprintf
Returns the installer associated with the specified installable object.WWWO
TypeName
Sets a colon separated list of testers)
EnableBatchTransactionWW
LocalFree
Returns the current query parametersWW!
D$8E3
IFileDependencyWWW
Returns the root path of the installed repositoryW"
]0[0Y
Open the repository at the specified root path
</assembly>
cmiAutoW\D
Identifies the default CMI file repository.WWW%
)::::EMT
cmiRunTimeWW0C
Sets the description for this dependencyWWF
MigrationIncludeInformationWL6
InstanceAnswersWLO
Translation
QCmiCompareConsts
IUnattendFileW
Target propertyWWWR
EstimatedSizeWWW
CPPTP00
Returns the file compression typeW
cmiLessThanW
GatherWWDa
Returns the list of repositoriesWW4
MigHost: RegisterMigrationIIDsAndTypeInfo: GetModuleFileName failed gle=[0x%x].
Returns whether it is versioned or not#
_ConfigurationEvents
InstallerSequencesWW
Sets the help directoryWWW
Base interface for all extensible CMI interfaceWWW
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
ITargetWWW
SettingTypes
TranslatedValueWLO
Sets the current query flagsWW
MigHost: CMigPluginSurrogate::UnRegisterServerInThreadContext: CoRevokeClassObject failed hr=0x%x on ThreadID=[0x%x].
/ICmiPair
Sets the owner of a trusteeWWW'
Fetch only the first level information of the objects that are being queriedWW?
Sets the factoryWW=
8'wIStringTableEntryWWW
TokenReplacerTypesWW(<
No reboot is requiredW
zcmiExactlyOneWWWT
ParentWWL
]:::::::M
TokensWWL
Returns the identity of the componentW"
fD9<Gu
Ignore compression processingW
IIdentityReferenceWW
Returns the value indexWWW
ProductVersion
zFirstWWW@
#cmiFileRepositoryNoCleanupOnImportFailureWWW
cmiLessThanZeroW$
IcmiRepositorySetd
ExpandEnvironmentVariablesWW
(YSResolutionStatus
ybB?y
Exports the files for the given identityWW_
FileRepositorySet property
ISettingOverrideConflictInformationWlR
__CxxFrameHandler3
_onexit
Sets the name of the file of the pluginWWW"
C#[/>iiD>8!#7
cmiFileWd
.CRT$XIAA
$YpluginCLSIDW
Sets the id for a configuration generated by this answer fileW
ICustomInformation
cmiFileAttributeSystemWW
Sets the setting information value-
>
performs dependency resolution
SelectWW
cmiReadOnlyW
Represents a file dependency.W/
%pUserMessage|`
Windows
CMigPluginSurrogate::UnRegisterServerInThreadContext
dnzzqqmhcd
Sets the name of a security descriptor definitionW1
cmiSysprepInformationWWWd
return the revision number
Returns the requested assembly from the repositoryF
WdsTerminate
ResolverWW9
Sets the fully qualified path to the executable.WW+
Returns the installed repository .
SidTypeInvalid
SE_IMPERSONATE_PRIVILEGEWW
Sets the arguments for the executable.H
=L9o<
cmiFileRepositoryUseAlternateSetupPolicyLocation,3
&0#rcmiInstallerCapabilityUseSymbolicLinksWW
Sets the temporary directoryWW,
Swwwj=B>
Returns the resolverWW
Computes effective changes without performing installation;
Deserializes a CMI object from the given sourceWWW0
.idata$2
CPPTP00,
pTargetUserSidStringsWWW|`
Use alternate setup policy location in fusion file repositoryW>
x AVH
cmiGreaterThanZeroWW$
.CRT$XCL
SecurityDescriptorDefinitionsWWW
SettingNameW\D
1/0-0
Returns the number of valuesWW
Returns the encoding (UTF-8/ UTF-16) to be used for serializationW>
0b3cmiRegDwordBigEndian
DcmiCreatePermanentPrivilegeW
IFileComClassW
ConstructPartialMsgVW
TypeLib\{EE45FDEE-232D-4fae-92E9-9A9ED142C346}\2.0
cmiGreaterThanWW
Returns the class id of the plugin
<!-- This Id value indicates the application supports Windows Blue/Server 2012 R2 functionality-->
e0c0a
+cmiDenyServiceLogonPrivilege
/GetInstaller
3InfSerializerFlagsWW
ObjectTypeWW
Get the identities or components that contain a file with a particular source name
assembly which contains categoryDefinitions elementWWW
fD94Cu
IBindingRedirect
fPatternsh
NInitializeWW
Returns the list of directoriesWWW!
Gets the installer id of an entryW+
pEnvironmentVariable|`
cmiSettingInstanceWWd
ILocalizationResources
.xdata
.gfids
"cmiCmiSecurityInformationWWWd
Returns a list of component settingsWW(
H SUVWAVH
Returns new versionWWW
xJNewObjectWWW
SE_MANAGE_VOLUME_PRIVILEGE
installer for managed componentsWW
Sets the INF file search repositoryWWW%
SetupEnvironment
"Microsoft Windows Verification PCA
SysprepModulesWW,L
190726204550Z0p1
DefaultValue
IInstrumentationInformationWWW8
IMigPluginSurrogate interface for migration plugins sandboxing onlyWWW
Operating System
method FreeSurrogateWW
Migration Plugins host program
Returns the string tableWW%
20180915045248.854Z0
0$bApartmentThreadingModel
Gets the type of elements in this collectionWW&
N0L0J
-cmiMigrationElementInformationWWd
Returns the typelib flagsW
Returns information about what to include during migration7
cmiEventBulkImporterBeginManifestShredWW
PUpgradeW
wwwwx
GetOfflineStatus
Gets the array of paths that defines this sequence2
Return an installer registration entry in installer manager by element name.WW
IFileRepositoryWd
FileRepositorySetWWWX4
SettingInstances@Q
_cexit
Sets the value of this settingsWWW'
RemoveAtX
Identifies the media file repository.W;
OnlineEnvironmentWWW
^::::::;M
SE_PROF_SINGLE_PROCESS_PRIVILEGEWW
Returns support informationWWW
pValL
cmiRegQwordLittleEndianW
Sets configuration answer file that overrides an unattend.xml fileB
OperationHintWWW\
|$0E3
IMigrationIncludeInformation
210509232813Z0
Microsoft Corporation1%0#
Returns the identity of this resolverW
ocmiVersionAnyWWWT$
GetLastError
_commode
SecurityDescriptorWW
Given a setting definition find the default value for the settingWU
cmiQueryGetDefaultValueForSettingDefinitionW8
Sets a list of members of a domain trustee)
Returns the root pathW.
_amsg_exit
cmiRegistrationCommandWWd
Returns the imaging informationWWW
Interface to replace user specified tokens in the manifest*
IPostGatherWpb
return the build numberWWW
?terminate@@YAXXZ
Sets the dependent assembly identityWW0
GlobalLogListenerWWW
}}}yyyttpD
IPrivateTestComponentPackagerWWW4S
FILE_ATTRIBUTE_NOT_CONTENT_INDEXED7
Keep the connection open to the data sources and read data on demandWW.
8>wIMigrationElementInformation
SE_UNSOLICITED_INPUT_PRIVILEGE
Represents a definition of a security descriptorWW1
uFileWriteableTypeWWW
cmiInfSerializerProcessIdentityOnlyW
Sets support informationWW)
cmiDisconnectedW
cmiAllWWT
CommandLineToArgvW
ISettingOverrideInstanceWW
XAfterWWWl
InstallableRepositoriesW
8}5FileDependencyWW|.
Returns manifest file search patternWW!
Error, Warning and InfoWWW
ICategoryDependencyWT
Event argumentsWWW&
cmiGroupTrusteeWd
MigHost: CMigPluginSurrogate::WaitForHostTermination: Parent process unexpectedly exited. Terminating host.
IReferenceAnswer
cmiFileComInterfaceProxyStubd
Returns the list of sysprep modulesWWW
hA_A^_^][
SelectFromObject
Returns the program ID
cmiInstallerCapabilityRollbackWW
ApInputSourceW(
ClearComponentWW\D
Represents custom XML information present in the manifestW!
cmiMigrationIncludeInformationWWd
IReferenceAnswerWW
scmiRedirectInformationWWd
SE_INTERACTIVE_LOGON_NAMEW
DisplayNameW
Returns list of run-time dependenciesW
opens the repository for reading or writingWWW
Returns the language string or * for neutralWW0
SidTypeAccount
MigHost: CMigPluginSurrogate::COMGenericThreadingHostThreadProc: LoadAndRegisterServerInThreadContext() failed hr=0x%x.
cmiInstallerManagerWd
Sets the input source of the assemblyW>
A_A^A]A\]
AADIN
.ObjectWW
Returns the qualifier + localName + instance IdWWW0
Gets the trustee typeW
Completely deletes the specified repository from the system.WW+
_qv}"
cmiEventOnInstanceRemovedWWW
Returns the list of registry keysW+
Returns the type name of categoryW
`.rdata
f9<Bu
Returns the replicated repository root pathWWW(
Close the repositoryWW#
Sets the file repositoryWW
cmiQueryGetSecuredAttributeForSettingDefinitionW8
IInstanceFactoryWW
RegCloseKey
iQualifierWWW
SettingDefinitionsWWx
IInstanceWWW\D
Represents an installed repository4
all the overrides only are merged, but not with the defaultWWW8
cmiWaitingForSelectionWW
.uy}"
GetRegistrationEntry
Sets the resource IDWW
Returns the instance factoryWW
This interface allows creation of installer instances.:
0;6cmiSettingDefinitiond
cmiInstallerRegistration
PE Information
| Image Base | Entry Point | Reported Checksum | Actual Checksum | Minimum OS Version | PDB Path | Compile Time | Import Hash | Icon | Icon Exact Hash | Icon Similarity Hash | Icon DHash |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 0x140000000 | 0x00005370 | 0x00042ff6 | 0x00042ff6 | 10.0 | mighost.pdb | 2047-06-03 02:40:30 | 1a2e6fbe71caa18e49b7aebbc2eac135 |  |
3443874fd60a0379eb7e45e9587cba62 | 74a89ee598283ed8bf17c360ddd8423e | e862eae6b696c6cc |
Version Infos
| CompanyName | Microsoft Corporation |
|---|---|
| FileDescription | Migration Plugins host program |
| FileVersion | 10.0.17763.1 (WinBuild.160101.0800) |
| InternalName | MigHost |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | MigHost.exe |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 10.0.17763.1 |
| Translation | 0x0409 0x04b0 |
Sections
| Name | RAW Address | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
|---|---|---|---|---|---|---|
| .text | 0x00000400 | 0x00001000 | 0x0000522c | 0x00005400 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 5.97 |
| .rdata | 0x00005800 | 0x00007000 | 0x00003d0e | 0x00003e00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.62 |
| .data | 0x00009600 | 0x0000b000 | 0x00000830 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 2.94 |
| .pdata | 0x00009800 | 0x0000c000 | 0x00000420 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 3.10 |
| .rsrc | 0x00009e00 | 0x0000d000 | 0x00032b40 | 0x00032c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.29 |
| .reloc | 0x0003ca00 | 0x00040000 | 0x00000088 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 1.71 |
Overlay
| Offset | 0x0003cc00 |
| Size | 0x000043a8 |
| Name | Offset | Size | Language | Sub-language | Entropy | File type |
|---|---|---|---|---|---|---|
| TYPELIB | 0x00013928 | 0x0002bc1c | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.01 | None |
| RT_ICON | 0x0000d6b8 | 0x00000668 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.18 | None |
| RT_ICON | 0x0000dd20 | 0x000002e8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.35 | None |
| RT_ICON | 0x0000e008 | 0x00000128 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.08 | None |
| RT_ICON | 0x0000e130 | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 6.51 | None |
| RT_ICON | 0x0000efd8 | 0x000008a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 6.72 | None |
| RT_ICON | 0x0000f880 | 0x00000568 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.62 | None |
| RT_ICON | 0x0000fde8 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.11 | None |
| RT_ICON | 0x00012390 | 0x000010a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.62 | None |
| RT_ICON | 0x00013438 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 6.05 | None |
| RT_GROUP_ICON | 0x000138a0 | 0x00000084 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.89 | None |
| RT_VERSION | 0x0000d310 | 0x000003a4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.44 | None |
| RT_MANIFEST | 0x0003f548 | 0x000005f6 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.89 | None |
Imports
| Name | Address |
|---|---|
| RegCreateKeyExW | 0x140007228 |
| RegSetValueExW | 0x140007230 |
| RegCloseKey | 0x140007238 |
| Name | Address |
|---|---|
| _exit | 0x140007458 |
| _onexit | 0x140007460 |
| __dllonexit | 0x140007468 |
| _unlock | 0x140007470 |
| _lock | 0x140007478 |
| ?terminate@@YAXXZ | 0x140007480 |
| ??1type_info@@UEAA@XZ | 0x140007488 |
| __setusermatherr | 0x140007490 |
| _commode | 0x140007498 |
| _fmode | 0x1400074a0 |
| _wcmdln | 0x1400074a8 |
| _initterm | 0x1400074b0 |
| _CxxThrowException | 0x1400074b8 |
| _XcptFilter | 0x1400074c0 |
| _amsg_exit | 0x1400074c8 |
| __wgetmainargs | 0x1400074d0 |
| exit | 0x1400074d8 |
| calloc | 0x1400074e0 |
| free | 0x1400074e8 |
| vswprintf_s | 0x1400074f0 |
| _vscwprintf | 0x1400074f8 |
| memcpy_s | 0x140007500 |
| memmove_s | 0x140007508 |
| wcschr | 0x140007510 |
| _wtol | 0x140007518 |
| _wcsnicmp | 0x140007520 |
| __C_specific_handler | 0x140007528 |
| __CxxFrameHandler3 | 0x140007530 |
| __set_app_type | 0x140007538 |
| _cexit | 0x140007540 |
| memset | 0x140007548 |
| Name | Address |
|---|---|
| CoRegisterClassObject | 0x140007558 |
| CoRevokeClassObject | 0x140007560 |
| CoInitializeEx | 0x140007568 |
| CLSIDFromString | 0x140007570 |
| StringFromGUID2 | 0x140007578 |
| CoUninitialize | 0x140007580 |
| CoDisconnectObject | 0x140007588 |
| Name | Address |
|---|---|
| DispatchMessageW | 0x1400073f8 |
| GetMessageW | 0x140007400 |
| PostThreadMessageW | 0x140007408 |
| MessageBoxW | 0x140007410 |
| UnregisterClassA | 0x140007418 |
| Name | Address |
|---|---|
| CommandLineToArgvW | 0x1400073d8 |
| Name | Address |
|---|---|
| SHDeleteKeyW | 0x1400073e8 |
| Name | Address |
|---|---|
| ConstructPartialMsgVW | 0x140007428 |
| CurrentIP | 0x140007430 |
| WdsSetupLogMessageW | 0x140007438 |
| WdsInitialize | 0x140007440 |
| WdsTerminate | 0x140007448 |
Usage
Processing ( 32.13 seconds )
- 31.241 ProcessMemory
- 0.837 CAPE
- 0.032 AnalysisInfo
- 0.016 BehaviorAnalysis
- 0.002 Debug
Signatures ( 0.05 seconds )
- 0.008 ransomware_files
- 0.005 antianalysis_detectfile
- 0.005 antiav_detectreg
- 0.005 ransomware_extensions
- 0.003 ursnif_behavior
- 0.002 antiav_detectfile
- 0.002 infostealer_ftp
- 0.002 infostealer_im
- 0.002 poullight_files
- 0.002 territorial_disputes_sigs
- 0.001 antianalysis_detectreg
- 0.001 antivm_vbox_files
- 0.001 antivm_vbox_keys
- 0.001 geodo_banking_trojan
- 0.001 browser_security
- 0.001 disables_backups
- 0.001 disables_browser_warn
- 0.001 disables_power_options
- 0.001 azorult_mutexes
- 0.001 infostealer_bitcoin
- 0.001 cryptbot_files
- 0.001 echelon_files
- 0.001 infostealer_mail
- 0.001 masquerade_process_name
- 0.001 revil_mutexes
- 0.001 modirat_behavior
Reporting ( 0.01 seconds )
- 0.005 CAPASummary
- 0.001 JsonDump
Signatures
The PE file contains a PDB path
pdbpath: mighost.pdb
SetUnhandledExceptionFilter detected (possible anti-debug)
Yara detections observed in process dumps, payloads or dropped files
Hit: PID 4012 triggered the Yara rule 'shellcode_get_eip' with data '['{ E8 00 00 00 00 59 }']'
Anomalous binary characteristics
anomaly: Entrypoint of binary is located outside of any mapped sections
Binary compilation timestomping detected
anomaly: Compilation timestamp is in the future
Screenshots
No screenshots available.Hosts
No hosts contacted.
DNS
No domains contacted.
Summary
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C:\Users\Packager\AppData\Local\Temp\mighost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableUmpdBufferSizeCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C:\Users\Packager\AppData\Local\Temp\mighost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableUmpdBufferSizeCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableUmpdBufferSizeCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableUmpdBufferSizeCheck
ntdll.dll.RtlWow64GetCurrentMachine
ntdll.dll.RtlWow64IsWowGuestMachineSupported
ntdll.dll.RtlWow64IsWowGuestMachineSupported
Sorry! No behavior.
Sorry! No strace.
Sorry! No tracee.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
HTTP Requests
No HTTP(s) requests performed.
SMTP traffic
No SMTP traffic performed.
IRC traffic
No IRC requests performed.
No ICMP traffic performed.
CIF Results
No CIF Results
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Suricata HTTP
No Suricata HTTP
Sorry! No Suricata Extracted files.
Sorry! No dropped files.
Sorry! No process dumps.
Sorry! No process dumps.