| Server IP : 180.180.241.3 / Your IP : 216.73.216.127 Web Server : Microsoft-IIS/7.5 System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586 User : IUSR ( 0) PHP Version : 5.3.28 Disable Function : NONE MySQL : ON | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : C:/Windows/System32/ |
Upload File : |
MZ @ !L!This program cannot be run in DOS mode.
$ 2݀\\\Ɏ\؎\ώ\]\ߎ\Ȏ\͎\Rich\ PE L 8L P + ` = @ T p , ] 8 G @ p R .text IN P `.data ` T @ .rsrc p Z @ @.reloc , b @ BnLH LR L{ 1L{ &L (L L L ntdll.dll API-MS-Win-Core-LocalRegistry-L1-1-0.dll API-MS-Win-Core-ProcessThreads-L1-1-0.dll USER32.dll USERENV.dll msvcrt.dll KERNEL32.dll whAw]wTw %
w>!ww2wwOwuMw HwQ3w]7wwM w@ w 8wgww_ww>w}Pwbww|ww I0j@ ouoo7o6oooZoλoQooowo'o(oao'>oo+o'o /w1#w8ww`wwAw=w w
w\9w4w5w[wGwwwWAwcvwTw='w@wwFwGdw̼wTwFww|w ww=www<w3wwewc3wdw;ww UQM39 SV5H W SEP W։EuFX uX}sRh L ESj ҐS h e l l R e a d y E v e n t jPP h N L uT _^[3 U ` 3ʼnEESVW3WWjWx}}}$ jRX t&ht l E;thd Pp ;tjо< V8 h E+ SEJ WV5\ EWh WS C w $1 h, ` ;G1 E jWuu Wu u5 uuj8 P4 x. lPWEPh WW< ;th VP VT EPh Wh h $ 0 9}_^[t ut M33 U s e r I n i t M p r L o g o n S c r i p t U s e r I n i t L o g o n S c r i p t U s e r I n i t L o g o n S e r v e r ImmDisableIME i m m 3 2 . d l l ;
` < ÐS o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m uF 1 EtAEPVj h ` =` 81 P 5d } t^ j
X뾐U
` 3ʼnES VW}h" 3WYYth" WYYp h PDž h < t9u fEf3fPPE VV3j CVV#VPE #PDžD D ;M 9u =T 9tM_^3[ % S y s t e m R o o t % \ E x p l o r e r . E X E U`V3uuuuuuu܉u9u : 3@^ VV4 V# 3_ % % U,Ee SXVpW} +x @ + ًU yEuMRRS}- j WV{- jY}EE\ E$ ]h- }- } - uu@ - E - } tE 0_^[ = uԐ %p WEPh @ PH t u u؋T 3@; ES ;f90yPh( Ӎ< VǍ| Wj@| EUVWP uWu9
h( Wu+
3}EPWu0 EPun uuu u E;tuh \ u 9}t u 9} 9} 9} 9} } 3@[_\ \ P A T H 95` u2h# l ;h# Pp ` ; WӍD Pj@| ; WW@Pt 9u u ;t f93f j<_WPVP
El PPPDžT@ `dDž\ ` ;t9u T W o p e n UQQS3VW9] u5 u ֍ WÍ\ Sj@| tyuSVc WSV u SV 3E 9]uE Sh h SuuuSV} E;tV 9] E_^[ u 뛐\ H i d e L e g a c y L o g o n S c r i p t s UVuW3;7 3_@^] U4 ` 3ʼnEEd @0
; ( SV5 Wh P= 3P SPDž Dž@ ׅ h0 P3PSPDž Dž@ ׅ1 h P֍P3SPDž Dž@ ; _^[M3 \ R e g i s t r y \ M a c h i n e \ S y s t e m \ C u r r e n t C o n t r o l S e t \ C o n t r o l \ G r a p h i c s D r i v e r s \ I n v a l i d D i s p l a y \ R e g i s t r y \ M a c h i n e \ S y s t e m \ C u r r e n t C o n t r o l S e t \ C o n t r o l \ G r a p h i c s D r i v e r s \ N e w D i s p l a y \ R e g i s t r y \ M a c h i n e \ S y s t e m \ C u r r e n t C o n t r o l S e t \ C o n t r o l \ G r a p h i c s D r i v e r s \ D e t e c t D i s p l a y %h ` QRPhR ZYU ` 3ʼnEESV5$ WP W3Sh h օ PWShd h օ j^PPPShc v ( h M_^3[ 9u뼉C L S I D \ { 1 6 d 1 2 7 3 6 - 7 a 9 e - 4 7 6 5 - b e c 6 - f 3 0 1 d 6 7 9 c a a a } U ` 3ʼnESW33]}fjEEXMQPSSSESEP` d @0
; u Vht! Sh H ; ^M_3[ ÐR a s A u t o d i a l N e w L o g o n U s e r UU 3t"w|EMhj ] W ߐUSVW؋33t?9E tftfAACCNM Gut3fMK _^[] IIOz ߐS o f t w a r e \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ W i n l o g o n e x p l o r e r . e x e e x p l o r e r UV5x Wj j ut.S?Pj@| t!WSuօ O; [_^] 3UU S3Vt7;w3]|3W}1 M_|U EV+j K_^[] W 3ؐV3ʅt$f9tFFJut^
+ʉøW s h e l l 3 2 . d l l ShellExecuteExW UVuV f>"h
^] U ESV5$ WEEP Wj hH" u u&EPEPEPj u E uu( EPWj h uօD
E_^[ UW W,M t_SV5 Pu؍\Sj@| t6uSVh(% SV=E 0SV1VW\ V 3@^[_] ; h PW% UEV3t%ft f"K uf t PP ^] S E E _ M A S K _ N O Z O N E C H E C K S f?,t>E f8 t>SuSuSPtE} f9 y 9] 3fGG@@븐UH
` 3ʼnESV5$ WPh 3Sh& WօJ 9 d @0
; 3GWSSSS( V uWSSWh" V~ NjM_^3[Ðs y s t e m \ c u r r e n t c o n t r o l s e t \ c o n t r o l \ s a f e b o o t \ o p t i o n U ES3VW@ Vj@]uE]]| };D 9] tu h W;ÉE EP39]h ShH" P$ uIEPWEPSuuu u#}Ef9\Gu( 9]u'9]u"EPh Sh h $ f9 uW _^[ u 9] 5 h( u]YYu#h" WYYth" WYYuE f9 9] ]}느h( h% \ Ð1 \ N E T L O G O N s h e l l Vj h% \ ^ÐUu ] U\` 3ʼnEh X > M33@)ÐUV395` tWEPjVh) h $ u6EPEPEPVh) uuE
u( 5` d ^ÐT S A p p C o m p a t S y s t e m \ C u r r e n t C o n t r o l S e t \ C o n t r o l \ T e r m i n a l S e r v e r f9 Qf?,GG鐐d h` 5d ` h` h` h` ` ÐhO 3Ð% hLQ d5 D$l$l$+SVW` 1E3PeuEEEEd Ð3ÐU` e e SWN@ ; VEP u3u 3d 3 3EP E3E3;t ` t5` ։5` ^_[þO@搐UVu3;u su
tу^]ø ` QRPhR ZY+jXh- 3ۉ]]EP EE d p` j VW 3F` ; ` 5` h - h, <YY2 ` ;uh, h, 3YY` uSW =d T 0u< M<"m P Yj FՐ v* 5- * F F UF iF MZ f9 < 8PE u|H P xtvf39 j` * P
`
` YY
d
d P=d 33룐h h YYÐUe SV5$ WEP Wj hH" h u(EPEPEPj h. uE u( EPWj hH" h օu(EPEPEPj h. uE u( EPWj h h օ EPWj h h օu(EPEPEPj h. uE u( E_^[ÐR u n L o g o n S c r i p t S y n c U ` 3ʼnEd @0W dh/ jKP3 |RVdP V `P\PWjjWWdPV ^u\( `uGM3_ÐS o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ E x p l o r e r \ S e s s i o n I n f o \ % d UM 3t>w6|0SVW}EPuqVW3 |;w _^[]øW ûz Uj t P! t@\f& jX]ËE]Ðj hH1 3Mt:t5!EMZ f9u!Q<| s
E8PE E% F F Md
Y__^[]QÃ' É9f|F"3fLFD PFPV mS }3ɅX = 2F,EPEPEPj u E uu( f8 ȋWf9,uAAf9,tII3f9;tf9f:AABBf9 u_;3f
EPEPEPj h. uE u( .VD VT SV3ST @ f; WjYj@G }YEPEPSh SfSS|4 }5 h4 Wօ j EPjSEPuE1 E3 u( EPEPSh SSSh3 Wօ EPEPEPS3 VuE u5MEff;u f;tfPf;Quf;u3;u"jEPjSVu u SSSj[| u( _^[H o t k e y K e y b o a r d L a y o u t \ T o g g l e S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n o n c e c t f m o n . e x e / n 9ud 3fw33fCCjP X = # 9u 95` u2h# l ; h# Pp ` ; WӍD Pj@| ;\WW@PA9u u ;tf93t 3fCChj<_WVPE0 PDž@ $(Dž 6 ` ;t LW 9s3C d @0
; o9c=d SPhH VSPhG VVPPV` VV\ jP r u n a s 3}u h W'3f EPWEPSuuu uE( 9]$3A9MuEv
f9\GMEW EP8 r N DhXG u YYuE SuuuSVE ]f;t f.PP f;u3Sd u u ;uSuuuSVgV X }tSEPh Wh; h $ u+EPEPEPWh; uE u( } 5 9} 5x WWh`; ։E; Pj@| E; uPh`; օ EPh @WWuW` Eg ;_ 0VӃ~f>\u
f~\u;th V4` YYE9}' EP Vu8` MEPVu50` փ jh uփ Wjuփ EPjuE փ E܉EčEPu}@` YY h WWu<` ulu E0h( Ӎt6Pj@| E;t4M1VP|,h( Vu|E}!}"} u u uD` Y
34; VӍ\GSj@| e SW4 t;VSWaEPWuuu WuEh \ u W } t } t)
Ez\ r e p l \ i m p o r t \ s c r i p t s U S E R D N S D O M A I N A l l o w - L o g o n S c r i p t - N e t b i o s D i s a b l e d S O F T W A R E \ P o l i c i e s \ M i c r o s o f t \ W i n d o w s \ S y s t e m Wu VWt
9} t V tFf9> h PhB d 3PjPjPP( SSSSSh = 59yh PhA d SjSjPhXG B_% S y s t e m R o o t % \ S y s t e m 3 2 \ R u n D l l 3 2 . e x e % S y s t e m R o o t % \ S y s t e m 3 2 \ r o v e r . d l l , R u n M o n i t o r PPPShC Dž ( 9mPh ShC WօuUPPPShC Dž u f9u( @W3GWWWSSpC VWWWWSVSjSSSP3 PPPPjƅ :u ;u<h C
YSS\ 9 8u j8 E @ =< 9tX VPׅu,VP;}P8 P( 8u.d @0 hB ƅ h P
tW VPPׅu PVPe;KSjSSSPu hB M Y38jD PSSSX A
u
8 SjPS3Sh , 3h Q9t_C PSd ;t4h j@| ;t!Ph V QE PSd ;tVh j@| ;t!Ph V;t ;thB h@ SVSSx
V
9
9x
t s _ r e m o t e p r o g r a m s . c h m : : / h t m l / d 6 9 d e e e 5 - 8 4 5 7 - 4 3 2 7 - 9 2 b 0 - f 0 c 6 c 8 c 8 2 6 e f . h t m USERINIT: Failed to start ctfmon.exe in TS Single App mode !
USERINIT: Failed to set working directory %ws for SessionId %u
USERINIT: Logging off session since WinStationGetInitialApplication failed!
A p p S e t u p A l t e r n a t e S h e l l s y s t e m \ c u r r e n t c o n t r o l s e t \ c o n t r o l \ s a f e b o o t U s e A l t e r n a t e S h e l l 9}t3FhTE l ;h<E Sp ;tSt VjVuuVuEj^tP|PpPWhE u|t u/9pu'9|t hD j2EPWjWWWEPu( p r o q u o t a . e x e E n a b l e P r o f i l e Q u o t a TermsrvCheckNewIniFiles t s a p p c m p . d l l MQjW u} ~t= u2j jVtEVE cuS b;u
3FSh L .j @ Yohd
Yj jj d < Fu39MMFuE MPQ YYËeEܣ` =` uP =d u E` 3@ËeE Á 39 h+ Y3@Ëe3E1f3@]Å)У` s. c m d . b a t c t f m o n . e x e v m a p p l e t M e s s a g e H e l p W n d C l a s s H ` G LQ U ` 3ʼnEh j P2 PDž t3@8Eu E u3M3AÐU< ` 3ʼnEVPh 3VhI h $ PPPPPPPPVPPDž , u895d thd Ph ud 3Fd ( t3h# l t"h|I Vp t jQVt M33@^RegenerateUserEnvironment V o l a t i l e E n v i r o n m e n t UVh j@| u3.uVh uu u` u V = w^] UQQSEPj3ShJ h ]$ t2@VuE PVEPSh@G u u}uE 3fLFu( ^[ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n U4 ` 3ʼnEVPh, Pjj3VJ t
E tFM3^LÐVhpK j jH tVD VT ^S h e l l D e s k t o p S w i t c h E v e n t UE Ht#Rt]%l j j 5d u 3@EPu
d jul ] U0j0Ej P8EEd E EPE0 EإK p UE @ VtQ39u tJWuu uVu VVVVh V5d Vx uuuV` Vt _uuuu ` ^] % UM 3tvW |@ES3Vt&UW++Ѝ 7t
t@Nu_uHz ^[] U ` 3ʼnEEVPh 3VhN h WPPPVV Dž uAEuWP HO;FPW3Ʌ( _3M3^ CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32 U ` 3ʼnE
d S] VW}uW9
d uOP5 tP֣d
d u!h O ȉ
d ud 3%d ujQp d tuuSWЋM_^3[ hhctrl.ocx ` QRPhR <ZY` QRPhR $ZY%` $` QRPhS ZY%$` ` ݐ% ` (` ː%(` D` QRPh$S ZY<` @` 0` ڸ8` Ӹ4` ̐UE 8csmu+xu%@= t=!t="t= @u 3] % UMMZ f9t3]ËA<8PE u3ҹ f9H]ÐUEH<ASVq3WDv} H ;r X;r
B(;r3_^[]Ðjh Q e VbYt=E+PVYYt+@$ ЃE E 3= ËeE3IÐ P
Q % Uuuu uh h` ]ËU( a
a a a 5a =a a
a a a %a -a a E a Ea Ea (a a ` ` ` ` ` j hPR h @ P Ð` (a % %t %X % pS ` ` S S ` ` S S ` ` S S ` ` S S ` ` S S ` 0` T dwmapi.dll CRYPT32.dll logoncli.dll netutils.dll WINSTA.dll WLDAP32.dll s (T <T LT `T xT T I X . CryptProtectData DsGetDcNameW NetApiBufferFree WinStationFreeMemory S WinStationQueryInformationW WinStationGetInitialApplication U U V U $V U 4 @V U P tV tU |V hU V XU KERNEL32.dll msvcrt.dll USERENV.dll USER32.dll API-MS-Win-Core-ProcessThreads-L1-1-0.dll API-MS-Win-Core-LocalRegistry-L1-1-0.dll ntdll.dll W W W W W W W W X X "X 6X JX ^X nX X X X X X X X X Y Y ,Y @Y PY bY zY Y Y Y Y Y Y Y Y Y Y Y Z Z $Z 6Z JZ dZ rZ Z Z Z Z Z Z [ [ 0[ N[ `[ v[ [ [ [ [ [ [ \ $\ <\ N\ f\ |\ \ \ \ \ \ \ \ ] ] 0] >] T] f] v] ] ] ] ] ] ] DbgPrint RtlInitUnicodeString ZNtOpenKey NtClose RegCreateKeyExW RegDeleteTreeW % RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryInfoKeyW $ SetThreadPriority GetCurrentThread CreateThread
GetCurrentProcess CreateProcessW OpenProcessToken 1 CharNextW >GetKeyboardLayout ~GetSystemMetrics ExitWindowsEx MessageBoxW LoadStringW LoadRemoteFonts DefWindowProcW MRegisterClassExW DestroyWindow n CreateWindowExW SystemParametersInfoW _ismbblead j _XcptFilter b_exit _cexit exit _wcsicmp memset memmove _vsnwprintf _initterm _acmdln _amsg_exit __setusermatherr __p__fmode __set_app_type 7 ?terminate@@YAXXZ Y_except_handler4_common '_controlfp __getmainargs __p__commode wGetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter GetCurrentProcessId GetTickCount QueryPerformanceCounter GetModuleHandleA SetUnhandledExceptionFilter `GetStartupInfoA InterlockedExchange ;LoadLibraryA RegOpenKeyExA RegQueryValueExA ExpandEnvironmentStringsA <LoadLibraryExA InterlockedCompareExchange DelayLoadFailureHook HeapSetInformation ISetCurrentDirectoryW ]FormatMessageW GetFileAttributesExW nGetSystemDirectoryW nSetLastError ExpandEnvironmentStringsW GetUserDefaultLangID USetEvent sOpenEventW Sleep WaitForSingleObject R CloseHandle GetLastError SSetEnvironmentVariableW SearchPathW GetCurrentThreadId ` CompareFileTime >LoadLibraryW BGetProcAddress aFreeLibrary GetEnvironmentVariableW CLocalAlloc GLocalFree GetVersionExW JlstrlenW 8L % $^ $R 8L5~
^ R ~RSDSRo&=Cr X& userinit.pdb + } O 0O vO SO O O O O O O O N@D T e m p P a g e F i l e S y s t e m \ C u r r e n t C o n t r o l S e t \ C o n t r o l \ S e s s i o n M a n a g e r \ M e m o r y M a n a g e m e n t 4G (G lG ( @ X p v s p M U I <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright (c) Microsoft Corporation -->
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<description>Userinit Logon Application</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"
/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
4 V S _ V E R S I O N _ I N F O jD jD ? S t r i n g F i l e I n f o 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n ^ F i l e D e s c r i p t i o n U s e r i n i t L o g o n A p p l i c a t i o n r ) F i l e V e r s i o n 6 . 1 . 7 6 0 1 . 1 7 5 1 4 ( w i n 7 s p 1 _ r t m . 1 0 1 1 1 9 - 1 8 5 0 ) 2 I n t e r n a l N a m e u s e r i n i t . L e g a l C o p y r i g h t M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . B
O r i g i n a l F i l e n a m e U S E R I N I T . E X E j % P r o d u c t N a m e M i c r o s o f t W i n d o w s O p e r a t i n g S y s t e m B P r o d u c t V e r s i o n 6 . 1 . 7 6 0 1 . 1 7 5 1 4 D V a r F i l e I n f o $ T r a n s l a t i o n O. 6$GGcL.Eqm . M U I M U I e n - U S 11112 2)2G2n2v22222222223=3Q3X3y3333333415;5A5O5U5555555z66=7T7_77777g8w8~88888889$9Z9`9i9w9999999::::::
; ;0;o;;%<V<\<k<< =y?~?????? 0.0H00,1I1U12 3
444I4T4~44444455E5|56#68666k77778 8*8>8[8`8s8888888;9K9x99999999w:|:::::::::::::";I;U;];e;q;;;;;;;<$<.<><K<Y<^<c<w<<<<<<<<<<< = =(=,===H=N===========>>&>=>R>^>|>>>>>>/?O?t??? 0 000\1`11112d2y2222222223#393V3g33334444555"5'555E555 6R666667:7E7f7o7778 858@8V8f8o888888 9A9^99999:.:f::::::;;;:<U<r<<<<<====>+>J>m>?!???[???? @ c000
1 1S1l1111)4/4>4E4R4444456"6p6v6666666 7777'8_8y8888899%919:9@9K9R9h999:.:<:W:`:::L;V;c;j;;;;;<*<0<r<y<<<<<8=[=f====a>l>>>>>>>>>>>?#?1?;?O?T?^?r?w??????????? P ` 0$0004181C1^1c1}1111111111111111111122 2*2/252@2G2P2T2_2j2u22 ` ( 0000 0$0(0004080<0@0D0444