| Server IP : 180.180.241.3 / Your IP : 216.73.216.252 Web Server : Microsoft-IIS/7.5 System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586 User : IUSR ( 0) PHP Version : 5.3.28 Disable Function : NONE MySQL : ON | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /Windows/System32/ |
Upload File : |
MZ @ !L!This program cannot be run in DOS mode.
$ Rich PE L w] ! ^ K1 p @ l l f < @ e @ .text ] ^ `.data p b @ .rsrc @ d @ @.reloc v j @ B l k k k k k k k k nk ^k Hk <k .k k j j j j j "l i j j j ,j @j i Tj ^j hj xj j j i i i i ~i `i Li 0i "i i h h h h h h nh Ph :h h Hj h >l Pl `l nl l l w] . / # C i r c u l a r S i z e F l a g s L e v e l G u i d Stopping FDR
Failed cleaning up Autoverifier settings
Stopping Autoverifier
FDR will be enabled
ProcessStartupSettingsUpdate failed
Verifier.dll loaded. Enabling Autoverifier.
r s \ K e r n e l O b j e c t s \ S y s t e m E r r o r P o r t R e a d y Autoverifier enabled flag is not present
A u t o v e r i f i e r E n a b l e d Autoverifier settings key is not present
S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ W i n d o w s E r r o r R e p o r t i n g \ P l u g i n s \ A u t o v e r i f i e r Failed getting current user registry path
NtAlpcSendWaitReceivePort failed with status 0x%x CAutoVerifierSettingsEngine::DisableHKCULookupForIFEO Service returned failure status 0x%x NtAlpcConnectPort timed out, failing the call with 0x%x NtAlpcConnectPort failed with status 0x%x RtlAllocateAndInitializeSid failed 0x%x
WaitForWerSvc timed out, failing the call with 0x%
x WaitForWerSvc failed 0x%x
SignalStartWerSvc failed 0x%x
PluginsNtGetRegStringValue failed 0x%x
E r r o r P o r t Failed opening registry key 0x%x
\ R e g i s t r y \ M a c h i n e \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ W i n d o w s E r r o r R e p o r t i n g Failed writing key value
Failed opening registry key
Verifier switched to light mode
WaitingThreadFailed switching to normal heap mode
WaitingThreadFailed obtaining VerifierForceNormalHeap function address
VerifierForceNormalHeap WaitingThreadFailed obtaining verifier.dll handle v e r i f i e r . d l l WaitingThreadThread failed to wait for the specified time; Disabling autoverifier
Failed deleting autovefier enabled flag
Failed deleting registry key
Failed creating timer thread
Failed reading key value
A u t o V e r i f i e r T i m e D u r a t i o n Failed writing registry value
A u t o V e r i f i e r C o u n t Failed getting process name
Handle to registry key is null
S o f t w a r e \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ I m a g e F i l e E x e c u t i o n O p t i o n s DFԓ@+f9vKtdgInvalid params Invalid params
Arithmetic overflow OOM Internal provider enabled for Level %u
Flags %lu
GetTraceEnableFlags failed
GetTraceEnableLevel failed
GetTraceLoggerHandle failed
Tracing disabled for internal provider
Provider not registered. RegisterTraceGuids failed with %d
Failed enabling trace provider 0x%x
Invalid argument: GUID structure cannot be null
CFDRShim::UpdateGUIDSettingsInvalid arguments: pointer to settings structure cannot be null
Failed reading string value from registry
PluginsNtSetRegStringValue failed with 0x%x
UtilRemoveAppCompatLayerFromList failed with 0x%x
F D R PluginsNtGetRegStringValue failed with 0x%x
S o f t w a r e \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ A p p C o m p a t F l a g s \ L a y e r s A p p P a t h S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ W i n d o w s E r r o r R e p o r t i n g \ P l u g i n s \ F D R \ C u r r e n t S e s s i o n Failed deleting session key
Failed opening session registry key
Invalid arguments; pointer to string buffer cannot be null
Failed writing process ID to registry
P r o c I D Get current process ID failed
Failed reading log file path value from registry
L o g P a t h Failed reading FDR settings value from registry
S e s s i o n S e t t i n g s Internal log message
Internal provider failed to log message Memory allocation for event failed.
Failed determining string length
Internal provider: FDR did not start yet; Message lost
Failed enabling internal trace provider Error 0x%x
StartTrace failed for the internal provider, %d
Failed copying string buffer
Unable to allocate %d bytes for properties structure.
F D R T r a c i n g S e s s i o n Invalid arguments: Log path cannot be null
Invalid args: The pair string cannot be null
Invalid args
Failed copying string
Failed getting string length
Invalid format: expected '='.
Failed obtaining string length
Invalid arguments: Buffer or separator character cannot be null
Failed copying characters to pair buffer
Out of resources allocating memory for string buffer
Failed making a copy of the original settings string
Failed obtaining the length of the input string
Invalid arguments: String buffer cannot be null
Failed extracting next pair from the current token
Failed extracting next token from settings string
Log file size was not specified; Logging will not be enabled
Failed updating settings; Parsing continues...
Error parsing current pair; Ignoring pair and continuing parsing
Invalid argument: settins string cannot be NULL
Session settings and/or FDR layer were not deleted successfuly
CFDRShim::CleanupSessionSettingsFailed deleting file
Failed appending process ID to log file name
% s _ % d Failed reading session settings, cannot delete log file
F D R s t a r t e d Failed to enable logging
Failed parsing settings string
Failed reading the session settings of updating the process ID
Unexpected event response or failed waiting for event
Flushing done, done signal sent
Failed setting event
Failed creating event
Failed concatenating strings
% s - % d F D R _ F L U S H _ M E S S A G E StartFDR failed 0x%x
Failed creating FDR thread
AppRecorder enabled flag is not present
A p p R e c o r d e r E n a b l e d AppRecorder settings key is not present
S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ W i n d o w s E r r o r R e p o r t i n g \ P l u g i n s \ A p p R e c o r d e r Failed to update App Recorder run count
Failed to update application appcompat layers
Failed to delete appcompat layers
A p p R e c o r d e r Failed to get application appcompat layers
Failed to open App Recorder layer key
Failed to get current process name
Failed to delete App Recorder key
A p p R e c o r d e r C o u n t Failed to create UAR process
Failed to create UAR process command line
% s / s t a r t / o u t p u t % s / g u i 0 / r e c o r d p i d % d / s t o p e v e n t % s / s c 0 / n o a r c 1 / w a i t o n p i d 1 Failed to create UAR executable image path
\ p s r . e x e Failed to get system folder path
Failed to register the log file with WER
Failed to create apprecorder temp file
Failed to create temp file name
. A p p R e c o r d e r D a t a . x m l Failed to get temp file name
W E R Failed to get temp folder path
Failed creating apprecorder event name string
% d - A p p R e c o r d e r E n a b l e d L o c a l \ { D F 2 B 7 F C A - C 5 B 0 - 4 6 3 8 - A 4 A D - 5 9 F 7 F 7 6 C E 5 4 0 } Failed creating AppRecorder thread
ADVAPI32.dll Failed closing registry key 0x%x
Invalid parameters
Failed extracting registry value %S
Out of resources allocating memory for key information structure
Failed writing to value %S
Failed deleting key
Invalid arguments: handle and value name cannot be null
Failed deleting specified value
Failed opening registry key0x%x
Arithmetic operation failed.
Failed concatenating strings: 0x%x
% s \ % s Insufficient resources
SizeTAdd Failed wi.
Failed obtaining string length: 0x%x
Failed copying string 0x%x
Invalid size returned
NtQueryInformationProcess failed
Failed with integer overflow
Failed determining string buffer length
Registry value %S is not of type string
RSDS_M M5^ad WerDiagController.pdb U4 Lp 3ʼnEEMV3FW9u P 39=p uB p # p 9=p tD9=p h + Yp n
ȸ #;u h + Y5p 9=p h + Y=p % k39} uX95p u/h x+ Yp w ȸ #;u:hl V+ Y-9=p u%h\ A+ YV* } u p M_3^ ̋UV3F} uj Vj 9u u=r uuVu 5r ^]}̋U,Ee SXVpW} +x @ + ًU yEu}5 RS* }tEj WV* u+jY}EE E$ ]t7MQj-W* u"p* ~t= uSj jVr* t E}u E 3} t-uu'* u(* t= uE u uS) } tE 0_^[ ̋UQQs
s s s 5s =s fs f
s f s fs f%s f-s s E s Es Es s r Lp s r r EPp h$ E( h j( ̋U
$ (;u
M3t=N@uO@]̡Lp t=N@uhLp Lp YУPp ;
Lp u ̋U} u3@] ̋U$Lp 3ʼnEVWT fED fE3fE܍}ޫj fj EPEPEnEEEEEEEE h ;u ~ ƋM_3^,̋U,VjFXjHfEXfEEE܍EP3h EPE0 E u؉uuu ;|&MEPVuE. u ^̋V t
P & 3^̋USVW3fE}fE3P]] #;uh ;EPSuh
+ #;uh EPh u' #;u
hx Y& Y 3@9EuE9]t EPQ' 9]tEP SEP E_^[̋U Lp 3ʼnES3VW3LPf@BfXPSSh T\X`]]]]]E%* @P #;u Vh TPhp X#- #;u VhH +;} Vh( ;} Vh ;uS Vh T P `PSSSSSSSjjEP ;} Vh V PLPSSSS`(h SP P\PDž( ,408<DžL
;} Vh| ;uS VhD H VdSPJ$ ~fdVffSPDž| $ fLPSHPPSdPh \fH ;|, t$9}h # 3
Vh n# YY9Tt TP' 9`t` `9\t\ \9Xt X4 M_^3[̋USVW3fE}fE3PM] #;uh <EPSuh 1' #;uhP Sh u$ #;u
h4 |" Y
M[39]t EPu# 9]tEP SEP _^[̋UVWu3fE}f3fE}f3W } h ! Yh` EP EPEPWW ;} h, ! Oh EP EPWEPu ;}h ujU;}h hp ! 3Y_^ ̋U$S3VW3fE]܍}્}f3f EPM]] #;u
h J EPSuh % EP #;uWh Y 9]uh Y < Ef9u h PJ' #;u
h EPuSu% #;u
hP EPh u! #;t?Ev HPh u" #;uh sEPh\ u! #;uh@ S9]vVjhigSu u EMQ Phu h : SSSSSu jp #;u
h Y;}w3EP/# #;u h YM#;u h Y39]t EP 9]t EP _^[̋USVW؋33t!9E tftfAACCNM GuuIIOz 3fMt9_^[] ̋U} wErw M3 E] ̋UE~ %
|@ ] ̋U ES3VW]]]; 9] u;| M ;uPf@@f;u+EMEPf@@f;u+E 9]5 ;- EPju EPEjYRP d u@0Spd ;uh uSP 6ǃ f9t}9]tE GGf? t9]tf9 t j XfFF]u uW` u#E Gf;tf u;}tvf9_uf;tfFFGGE f9 u3f3,h ( Y;tPd @0Sp\ h h W Y_^[ ̋UVuuW 6d @0j p\ & 3^] 3h PQ( , $ ̋UEtH !u !u h up u u u
h| 1 YLSRPp uh\ 5u 5u p u
h< YPPh [3] ̋UQQVW( P3VV0pEPjh Vh? @ E up ;tPh YY3_^̋UQSW3ۋ]9 vNVw~ u;$ F P6vjp 3ɅNtPh % EYYC ; r^E_%@ [̋3v 9 u@ JűU Lp 3ʼnEVWjYu}} u!Mfufu3ɀ|
uArk |jYu M_3^/ ̋UQQW3} fE}f_uh0 P YW uEP u EPh
̋UQS]Muhh YW V5 W}hP WYYuMSu `WhD WYYuu l YC:h8 WYYuu l YC h WYYuu l YM_3^[ ̋USVW3fE}3fEP]]]] EPSuh( #;u
hP EPh u #; 9] EP EPSuh [ #;tEPuu #;uWh` YgEPhX Su;}Wh$ YGE;t!f9t PuuA #;uWh uu 3%h A ;Y}9]tuu 9]t EP, 9]t EPP 9]t EPB 9]t EP
_^[̋U e VW3fE}fEP EPj uh( 1 #;uh EP #;uh | Y 3} t EPv _^̋U SW3fE}3۫]f9] 9] VEP EPSuh( #;uhP xuh u #;uh Yu h u #;uh :d @ ;uh Y@ +Pht u #;uhL | Y 3^9]t EPv h T YW _[ ̋UU 3tvW |EMhj ] ̋UU 3W tv|%}v U3f
uEMj _] ̋UM 3tvW |9SVW}EPuqVW3X |;wu
z 3fw_^[]̋UEW}tU w W }t' _] ̋UQu u uh Y EPhu}h ًESVD 6d @0WWj pd uh| pWj S f3C, { 3fCCE CC0ED PuC4P S5u 5u p t hT D Yh< 9 Ytd @0Sj p\ _^[3 ̋UW3 M8x9}uh YW t VEPVup;ljE}h YF EPVh J;ljE|ڋEMD StHzEd @0VWpd V;u
h g YmWS E33AK(C, { }x uClC@Cpx WcD K0MAQPS<E}
hp YlSh Vp tPh< YYE@ ?v6h jjjp tVh YYVE e td @0Sj p\ [E^_ ̋UQV39u 9u 9u SWEPSu;}h! j=ux YY;uh! o+uFt]9utXEPGSGW}hx! @ EuWuu}h`! NVuuu |3hP! W Y_[h ! o YW ^ ̋UVu } u
h" MQhPE}h" Y d @0S]W=d LQj pME 6CSP]E}
h" u ux +]YY6E3PC9Ed @0pu:\ ud & @0j pM uuP \ & } E;sAd
+ÉE D PA0j ptBMQM AQPE}h`! PvSd @0 Qj pMuhP" YE &KQuSPE}
h$" Ye } _[tud @0j p\ Eh! q W Y^ ̋U<Lp 3ʼnESVuW3ۉMj3Y}]uĉ]܉]ԉ];uhL$ YW 9 td @0=d h SpE;uhP" Y d @0h SpE;uhP" Y W 9 M؍EPj;V2; 9] ]]3}૫9]tud @0Sp\ ]܋M؍EPj,EP; 9]tKMh uh uu}h$ M؍EPEPuu} h#
Y9]m jYuMu9 E;u&h#
Y@ h`# h(#
YM؉A39]tud @0Sp\ 9]tud @0Sp\ ud @05\ Sp9]tud @0SpNjM_^3[ ̋U0S3VW3uЍ}ԫ3fE}fuuufEPEPn;ƉE}h8% Y E9u d @0h Vpd };uhP" i YE d p uh,% h W;ƉE}h$ xWEP VVEPu EE؍EPE uE@ uu| EP #;uh$ Y}9u}
h$ Yu=\ 9utud @0Vpu9utud @0Vpu9utud @0VpE_^[ ̋UQQSVW3}}EPEP;}h% 4EP;}h% !u;}
h%
Yjht% 3ۋ5\ 9}tud @0Wp։}9}tud @0Wp_^[̋U< Lp 3ʼnESV3;}Vh& S
YY6 d p d @0Wh Spd ;uhP"
Vh& h& h W:;}h& WSSS( ;uh& |5, @w = uN3Ʌ#Pօu0 uhp& hL& N 3h& @ @ Y_td @0j p\ M^3[̋U VW33u}EPEPVhQ VVVVVjup #;uh' Y3_^̋V3ʅtf9tFFJuuW ^t |+ʉÃ' ̋UW3t;U vW |
E' _] ̋USVW3fE}fE3P]] #;uh ;EPSuh' n #;uh|' EPhT' u7 #;u
h(' Y 3@9EuE9]t EP 9]tEP SEP E_^[̋U, Lp 3ʼnESVW3ff33fPDž@ #;u
h A PSh' l #;u
h|' Pt) W+ #;u
h(' P
#;u
hP) h PS$ u
h() PSh
#;u
h ) } PP
#;u
h( T WfGGf;u+ j h( P` uR9tDP Yt3DP Yuf| uu!3 O9t?SK ;r3f P'+t
|? HWP T?RLHQP 3f9u P #;uHh( 9PP #;u(hd( HPW #;u
h8( Y9t P 9t P 9t P 9tP SP M_^3[̋UU VuhVE|OUM +Sj V[t/+u Wu+tft f@@IOu_uHHz 3f[^] ̋U
Lp 3ʼnESVW3j@|VPx 3 3H, WVh fffffP N WjVV( u
@ O } h Yd p h , WP0;}h+ Y PVVV( ;u
h& PW u
h+ l PVh+ P u
h+ D P ht+ h P;}
hP+ Vh jVjh @P u
h$+ P4 jjPw ;}
h* WP u
h* h* WP;}
h* P P PPPh) WP ;}h) ;PxPVVVVVVPPDžxD u
h) Y69t4 9t4 39t;} 4 M_^3[q̋U SW33]}]gtQVEPEPShX SSSSSjp #;uh, c Y 39]t u4 ^_[̋D$L$ ȋL$ u D$ S؋D$d$؋D$[ % % % % %t %L %H %D %@ %< %8 % p QRPhe ZYคp p p p p p ̋UME ;r M3 E] ̋UVuuh- Y
.WP #;uWh, YY& 3_^] ̋U SW3fE}3f]9] 9] }Vu EP d @0jSpd ;uhH- .Y XEPjVjEPu ظ #;t~u F 3u h - YYd @0Vj p\ ^h- Y
_[ ̋UQQW3fE}f39} tP9}tKVu EP jEPjWEPu #;uu h- NYY3^h- 9Y
_ ̋UQQW3fE}f39} tk9}tf9}tau EP EHf@@f;u+VD PuEjWPu #;uu h- YY3^h- Y
_ ̋UVuuh- pY
,WP #;u
h- GY& 3_^] ̋UQQW3} fE}f_tD} t>Vu EP EPu #;u
h . Y3^h- Y
̋UVuu
"d 6@0j p\ t& ^] ̋U,SW3fE}3f3]]]9] E; V9] 5 EPVu ;} Wh. Y Yt EPVu;} Vh. Y Y C EPuu}h. Y EPju~ EjYMQRPp|md u@0VSpd ;uh. RY uu h. VWy;}Vhh. Y Y lW
hH. LuEP EE؍EE܍EPh? uE E@ ]] #;uVh$. YY3;td @0WSp\ ^h- |Y
_[ ̋U Lp 3ʼnEW}3h PfP[ } Vj h Pj+j }h0/ f9v h/ q3f BBHHf\tf/t f:t;wHHPu WG} P h. mYY3^h- XY
M3_ ̋UW3fE}f3}}}9} o 9}f SVu EP d @0 VWp=d uhH- Y EPVSjEPu #;uu h - Y {tu h/ MQC hP}ht/ Y EPju |eEPEjYRP|Nd u@0j pMuhP" 0K QuP}
h`! w3hT/ Yd @0Sj p\ ^[h- Y
_ , v p f f ,f Bf Xf pf f f f GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle A RegisterTraceGuidsW EnableTrace TraceEvent StartTraceW dg j X g 0l l k k k k k k k k nk ^k Hk <k .k k j j j j j "l i j j j ,j @j i Tj ^j hj xj j j i i i i ~i `i Li 0i "i i h h h h h h nh Ph :h h Hj h >l Pl `l nl l l DbgPrint f LdrDisableThreadCalloutsForDll NtTerminateProcess RtlUnhandledExceptionFilter RtlNtStatusToDosError > EtwEventWriteNoRegistration NtClose -NtWaitForSingleObject WNtOpenEvent RtlInitUnicodeString PRtlFreeUnicodeString ERtlFormatCurrentUserKeyPath NRtlFreeSid NtAlpcSendWaitReceivePort NtAlpcConnectPort cRtlAllocateAndInitializeSid memset t LdrGetProcedureAddress RtlInitAnsiString n LdrGetDllHandle NtDelayExecution RtlCreateUserThread M_vsnwprintf KRtlFreeHeap R_wcsnicmp eRtlAllocateHeap RRtlGUIDFromString Y_wtoi P_wcsicmp {memcpy wcschr NtDeleteFile RtlDosPathNameToNtPathName_U }memmove misspace ntdll.dll DelayLoadFailureHook DGetProcAddress GetLastError cFreeLibrary InterlockedCompareExchange >LoadLibraryExA S CloseHandle \SetEvent WaitForSingleObject CreateEventW GetModuleFileNameW CreateProcessW KGetProcessId GetCurrentProcess pGetSystemDirectoryW
WerRegisterFile CreateFileW DeleteFileW GetTempFileNameW GetTempPathW uOpenEventW KERNEL32.dll NtQueryValueKey NtSetValueKey NtDeleteKey NtDeleteValueKey \NtOpenKey NtQueryInformationProcess Dv] l l l l [ YS m m WerDiagController.dll StartAppRecorder StartFDR P D 8 , r N@DP D 8 \ \ ] ] ] '] 1] 0 H ` 4 V S _ V E R S I O N _ I N F O _ _ ? : S t r i n g F i l e I n f o 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n \ F i l e D e s c r i p t i o n W E R D i a g n o s t i c C o n t r o l l e r 0 F i l e V e r s i o n 6 . 1 . 7 6 0 1 . 2 4 5 2 1 ( w i n 7 s p 1 _ l d r _ e s c r o w . 1 9 0 9 0 9 - 1 7 0 4 ) T I n t e r n a l N a m e W E R D i a g n o s t i c C o n t r o l l e r . L e g a l C o p y r i g h t M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . T O r i g i n a l F i l e n a m e W E R D i a g C o n t r o l l e r . d l l j % P r o d u c t N a m e M i c r o s o f t W i n d o w s O p e r a t i n g S y s t e m B P r o d u c t V e r s i o n 6 . 1 . 7 6 0 1 . 2 4 5 2 1 D V a r F i l e I n f o $ T r a n s l a t i o n $2(2 0 , 01090E0O0U0]0h0s0000000000 1101h1}1111122222222223
333 3(30353:3?3E3O3Y3e3j33334
4E4445.5K5V5v5555555(636P6666677/7H7`7|777888889,9F9999999::I:R:]:g:w::::::::&;8;J;[;i;~;;;;;< <2<N<`<e<p<z<<<<i>t>>$?I?T?[???? @ 0 000 010<0D0J0P0Y0k0000001,1~122(2L2c2l22222223$3;3I3|333334444475D5[5e5z55555556B7H7O7t7777778
8878h888889Z9h9u9999999:N:[::::: ;@;_;;;;<Y<<<<<=4=W=n==>J>k>>>>>????? P $ 0%020A0h0t0000=1U1s11111,2=2R2W2p22222233@3x333J4Z4i4y444444C5S5k5{55555566@6~666617^7~7778889*9F9_9z9999999999:=:G:S:n:::::::::(;1;M;g;;;;; <\<h<t<<<<<<<<<<<< =
== =(=2=~===>>#>F>l>>>>>??_?????? ` T
0S0`0t000=1p1111 222O2a222222M3X3r333Y4r444444X5|5555 p ( 0000$0T0\0d0l00000000