DonatShell
Server IP : 180.180.241.3  /  Your IP : 216.73.216.127
Web Server : Microsoft-IIS/7.5
System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586
User : IUSR ( 0)
PHP Version : 5.3.28
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  C:/Windows/System32/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ HOME SHELL ]     

Current File : C:/Windows/System32/wininit.exe
MZ@	!L!This program cannot be run in DOS mode.

$\9?(/8=RichPEL[J	<:MP@`1`I8@+.textT:< `.dataP@@.rsrc`H@@.relocb@B/[JPo[J[[Jf[Jp[J[J[Jf[JA[JUSER32.dllmsvcrt.dllntdll.dllAPI-MS-Win-Core-LocalRegistry-L1-1-0.dllRPCRT4.dllKERNEL32.dllAPI-MS-Win-Security-LSALookup-L1-1-0.dllprofapi.dllyAwFw$w
!w$wqwwww9ww7wxwww{wRwwλoooZoao+o7oouoo6ooQoowo'o'o(o'>oaoooqo:w5wp\wZw1w wbww6wZwQwwIww'w+wwʤwww\?wP\wPXwPJw`XwEwJwFw\wGwHgww@w:w42w:w8~wwXwwTw@Vwbww@kw~kww0SwWSw*\w;wSw`RwwwTwګwwmwwIw?w\wIw?ww&wwwcwwww)wwԾw;wwƻw{w%мwww@&w)wsww
wswmww>tw2w~w}w4FwoRwl@w'wyQwwiwwowNwwTwwVwBwAwkw5wwHSwnwwwvwhwZw5ww- w^w'wp_w#
wwfw$wwswww we>w7*w(w7wwl.wswww?ww3w5+wPwDwww(wB1www<ww(w	6ww;8wg&wkew5w|9wuw]Mw]wwww|w}w7wawwww9w)ww\4wwwLww=w0wvwwM%w_wtw1wwwwzU<V339uWEPjj|.EPj8EPj
u|EEƁu;t"=VjhQVVj!VjhQVVj#סQ;Q;VV_^U$SW33S]}jEPj#]]]]E]P8]cEEPhSh0hjE_;N8]C9V^E8]fEP`E_[SYSTEM\CurrentControlSet\Control\WininitUVuP&^];
P?ÐUjuuj+uu]%Md
Y__^[]QÐjphEW3u؉uuj8VEPujY3}u܉uPjhjPE؅juPPEMQPPEP;t@txruWjppj[]ES"EPjuPEP;t@txrWjppjuEv=M}܄P;t@txrWjppQeE\EeServicesActivep;Pz;Aeb}t	uP}t	uPÐ%hYd5D$l$l$+SVWP1E3PeuEEEEdÐUU3t"w|EMhj]WߐUSVW؋33tC9EtftfAACCNMGut3fM^_^[]IIOzߐUUS3WtJ;wF}|Oe3V;t7f9t@@Nu;t)+΋E^|ES+jOA_[]WEW3ҐUuhx]EventLogjTZU@P3ʼnESVVP<؃tkW~P@u:PWP?hXWPPOwVPSHuSL_M^3[QÐbootex.logUQSVW3ShjSjhu]3XEu3u;u}u_^[U,EeSXVpW}+x@+ًU{E};{}M{uu2%{E){}tE0_^[%Sh'Ӄ=QuVWQQWV2|_^3[h:QRPh\+ZY$P萐%$PU4P3ʼnEVPh3VhhuMW=PPVjhVDžׅu9Z_M3^%LoadAppInit_DLLsSoftware\Microsoft\Windows NT\CurrentVersion\Windows

\[%\[\[ @L\[PLLLLLL@\[QRPh+NZY]+D&v%CjF4]+H` $HZ)H2HHHH 2HHH2HHHH\26HX.\0++++UQQSVW3jE])E";jSj
h$"LE;jEPj	E;jSSj	uEEP]9]jhQE;j@RVh@ E;jSh8Q5Q8Q5V5<QE;jE_^[765294BA-60BC-48B8-92E9-89FD77769D91Uuh Z]RPCSSVjs^j\h!E
3uhWj(VV5VE;-x3C QhQE;Axd@0hh1j%EP=PRVEPE6xHQ5LQu	E3;GxVhHQ5Q5VE;SxQSWSE=uu9u]xE\EC"%HMI	
ncacn_ip_tcp}(xÐP=Pt@txrhjpp7PM3G"8n$+DMU
"O!]+H`,c8#"X#r#h#BlH1\,F
HHHpH1\D
pH1\4F
HHHHpH2FHHHpH2Fp\UU[K\F\ [\[%$r#$1P%8n$+DpZզYB.,
]+H`%$%**pzPERpoSYSTEM\CurrentControlSet\Control\WinInitSoftware\Microsoft\Windows\CurrentVersion\Policies\SystemUM3t@w8|2SVW}EPuqVW3L|;wu3fw_^[]øWz吐UVEPh3VuuuEu;uEPEPEPVuu;tEE9u^t	uEUVW3j3Y}u9uOEEEPE%EEEsnu}J_^%ThYd5D$l$l$+SVWP1E3ʼnEPeuEEEEdÐUtP3ʼnESVh(E3Puj@j@EEjEPEPEuuuu;|Ju9ut@W=EPVEPu;EHQEPu9uu_ËM^3[\Security\WxApiPort%$U0SVW33ۍ}3FV]]Eu]]܉]ESSVXSSVTSSVSQVUh.P.5P%SjEPj	P|EPjPP%;t
@~Xh.P;t
@~Xh.SjSxE;XP;t
@X7E;X3@fPP;t
@X%XjXfPP;t
@RYhE;ZYPjYf
P;t@txrVjpp
m:E;PYP;t@txrVjpp<E;PYP;t@txrVjppl,P;t@txrVjpp|P;t@txrVjppTjEPE;XjXfPP;t@txrVjppEPhtQhpQEPhlQK2E;XjXfPEP/P;t@txrVjppS,P;t@t
xXu3P;t@txrVjppj>9E;zXP;t@txrVj!pp71E;sXmXP;t@txrVj&pp)EӃ}E4YP;t@txruVj(ppu)YP;t@txrVj*ppt؅(Yj
XfPP;t@txrVj,ppEr3ۉE;YP;t@txrVj.ppSEPE;YjXfP8?YP;t@txrVj1ppE;9Y3PPh0uPhPEPӅ3Y3PPh'PhPEPӅUYPjYf
P;t@txrVj4ppCj\Ymo MrȸKD~be,Global\FirstWinlogonCheckMicrosoft\UMStartupUV3uEuu95VuXSEP3CSVh%h;EE
PPtYtyrPh%jfqq[9uEV^ÐUjjEPuuj+uu3 ]SVWPP%;t@t
xR4?!RjXfPP;t@txrWjYpp ؅uVhP;t@txrWjZppg.P;t@txrWj[pp?_^[ÐPtjP5PÐVjnP=Pt@txrh0jpp^rDl]#MV!RRS}>ejWVOejY}EEX1E$]d=%(b08669ee-8cb5-43a5-a017-84fe%08XUTeWEPj(jEEE	EEEEEEEEEEEEEEE
EE#|jEPu}t	u_ÐV3Vh2h&hRYjVhIX^ÐDisableRemoteShutdownRPCInterfaceUu5PXUSVWPP;t@txrh0jppS=P`}`WUVu@jXFHu!PE8P_^;[t@txrh0jpp3]jVh `h4jjjxÐGlobal\UMSServicesStartedP2P(F ;t	cN$wW~(W~,WQPR_0F
*UVuF3+tH^cv RFVu^]UP=Pt@txrh0jppEP3]t9VEV9ucjPEPP׋;u}=9utuuVbuT
PVWP0]P;t@txrVjpp_^PQRPh<+ZYะPQRPh+ZYVW3WWh6;d_^ÐVWPP;t@txrWjppvP;t@txrWjppM_^SYSTEM\SetupFALSETRUECommonProgramFilesCommonFilesDirProgramFilesProgramFilesDirWinSta0

\[;ͷ@9wz~UU<f:<Vpf@@fu+D^t(f:;jPRuuj+uu' ]ېUE33҉H@HfPH]UQQE3SEVuW;uRSUuESUNt;;M_WOG3_^[hP;jP;3@ÐV3VVVP;>^ÐUhRjju]Uuj5P]UUjXt"w|EMhjL]WߐUUSWjXtJ;wF}|Oe3V;t7f9t@@Nu;t)+΋E^|ES+jO_[]WEW3ҐUQVW3h:}20E;!UWPdU9}t	EPW_^%SystemRoot%\temp<a<fWafɃW<a<fWyɃ0]UQ3E9Qu-VMQhPh:h3FY5Q^VÐSystem\CurrentControlSet\Control\MiniNT3@9Pt=Pt3ÐU|P3ʼnEjxEjPEPSjjExEPt=t33ҋM3ËEU쐐UVuW3;1YuW\;Y_^]Ph&VhQ5VQhQhQhQ`QÐh3Ð%|3ÐUPeeSWN@;h[VEPu3u333EPE3E3;tPt5P։5P^_[þO@P\PdPUEQ]UEV
PQZHtj
TQH
XQZH
\Qu
\QH
`QZH
dQZ@^hQZ]5PQ딐UQSV5@3W]uօ^3_^[9ucÐUSVWu<_ScuffFE
EFEFFPW8_^[]USW3SjEP3j#GP8]gVh)"EPhShhh]u6j^EPEPEPSh0?uu`gu;t@SSSSSj P=Pt
@DgS`PP3;HPuS^_3[NoDebugThreadQL$+#ȋ%;s	-Y$ÐUuj|u3@]3U0S3MQ@P3Sh AhE;PSSEPEPEPSSSSSSuPu\*E;PEEPC*E;PV3W=9]v^EE܋EEEPuEPSEPuVuׅo}PEHujuuuPF;ur]9]vREE܋EEEPuEPSEPuuuׅ}PEHHEE;Eru_^9]t	EPU9]t	EPGE[System\CurrentControlSet\Control\Session Manager\Environmentue(E;OjPuuVEP;O]j h`BE3ۉ]܉]؉]ԉ]}PE;`]3u;sVkMHQSp0M܉E܍9`@EF)CuЃj_VaE؅`j[SVP,E3u;us&E܋HQPjSuDE_FWEԅ `jP0Ejuju@E.`EE39}t/}u;vEM܍98t0 E9urEPp9}`ÐUEPS]U@P3ʼnEVuWPEPDžtjEPhpeV8Ph3WhDhSPPPjVDžuHSPPt/;s+jPV6P6u[M3_3@^Software\Microsoft\Windows\CurrentVersionU ,P3ʼnEES];VW}PHf?>WP(h$tGffPP3P|}tf8hpFW=Pׅt}hhFׅtlVP$PP|bPPS|I3@M_^3[BTMPTEMPVPTuwj3붐USVW=EPh3VhHSuu׉E;uGVVVhGuhGuVVVhGuEhGum9uuEuuEPhVh`GS׋;g19u19u19uu}E_^[Software\Policies\Microsoft\System\DNSclientNV DomainDomainNV HostnameHostnameSystem\CurrentControlSet\Services\Tcpip\ParametersUP3ʼnEMES]V5MMWMMMM UR|URMURM3QPSxMMֿE;uK}tE9Eu/u[!EtMQPEPjxSE^9uL/3;uuuuVuuE9uuE;,/|;(/9utE9Et	EP
ME_^3[<a<fWU0P3ʼnEESVWEЍEE؍EPh3WhM5QӅWWWWWWWWWEPEPuE	u܋;u\3ҊD<0<90L09Ƀ0;;MEBBrEPhWhL5QӅWWWWWWWWWEPEPuE	u܋;uj3ҊD<0z<9r0L0|	9a?f6ɃW;;MEBBrEPhWhL5QӅWWWWWWWWWEPEPuE	u܋;uv3ҊD<0|<9{F<a<fWL0|	9afɃW;R;JMEBBrEPhWhL5QӅWWWWWWWWWEPEPuE	u܋;uVu3ҊD<0.<9&0L09{Ƀ0;;FBBr3VTu@1r3@M_^3[DataGBGSkew1JDa|}fxɃWvɃ0<ADDADD3<ADDADD<ADDADD<ADDADDUVu3;usu
tу^]ÐjXhN"3ۉ]]EP EEdpxQjVW(H3F4Q;H4Q54QhNhNTYY/I4Q;uhNhNYY4QuSW=W3Hx0u< vf<"nHPpYkHF;p6<}1Eu5GEGj
XPVjhG5X}tVUQQV5PWPt+eNQjjMQjPVh7E6_^UVj
OE0NkFSWjASN5RPNkFjAWN5RPNkFjAhfN5RPNkFjAh N5RP]NkFjASN5QP?NkFjAWN5QP!FFEj0uN
_[^]UEMMHMH]UP3ʼnESVW=3|PhVhWS|ׅy)P=Pt@txrh%j?ppZ;)jXfPP)PPhVhhSׅuEPPPVhLVDž)VVhV;-P=Pt$@txrh%jBppVVjhVVh6P99)j	XfP95PZ)PhVhPVSׅT)PhVhUS;!+PhVhhUS;uD=VVVVh<U׋;tVVVVhU׋;*6VjhT?;+P=Pt$@txrh%jFppVVjSVjWP9A+j
XfP;+VjhT;C+P=Pt$@txrh%jHppDVVjSjjWKP9*jXfPP9A+M_^3[Ð%SystemRoot%\system32\lsm.exe%SystemRoot%\system32\lsass.exeShutdownStateSnapshotShutdownEventPendingSOFTWARE\Microsoft\Windows\CurrentVersion\ReliabilitySYSTEM\CurrentControlSet\Control\CrashControl\MachineCrashSYSTEM\CurrentControlSet\Control\Watchdog\Display%SystemRoot%\system32\services.exesystem\currentcontrolset\control\stagedbootUVu6j5P&^]UP3ʼnEVWVPjj=BPhxXVPjj|PhhXVPjj|PhPX׍Ph0X׋M_3^xÐALLUSERSPROFILEProgramDataPUBLICUSERPROFILE%9VE;E;8]X=Q]VUw395@Qu95DQu@QDQEPjh0VzYEPj
SfEE]<|?|WEP~E;#jxVuV褾>|zF,F(Flx~pF0F4
F@=@Qu'=DQuh0VCSFxPF<Flx莾EUS@~pPWx};@Q
DQ;;jhpVh0V0VSh@QdP@Q
DQ;5\PQPh R5Q5Vj5DQ5@Qh0R5Q5Vjփe^鰺QESUMVutIE=w?W3Ѕt*f99tAAJutt|+‰_^:^]W݃&WjhX[	3}}E9}BHQp;Bj[]VEPu$BVCE/E萺y[ÐUQQEPEPEPu4F}t}t	EPEP3@UVu6j5(Q&^]j(h\3}}Wh5REPj[Sh@5REPnjEP;5B]VEPu$bBVE3Ed\ÐjDhp]>3}}EWV5REPj[]Wh 5REPEWV5QEP9}AuEP;AEVEPu$BV*E.Ew]ÐUQjFEt(VukP0MAExt0E`^EEP퐐Uuj5(Q]jh_3uu܉uE0]3E0E0udup iAVWVh$7DM;APS]3E;Aj3bE;AVWVVVh_ӋM;AVWVVVh_ӋM;BPP;t@t
x&BE0E;VE0E;u{jE0E;AVE0dE;uRVE0iE;u@VVEPE0AP;t@txrhH7jppEGE2DefaultWinlogonshh`uDžx3ۉ|d3ef]]]]]]EEPSSSSSSSEP3GWEPWdP0jjXEP,WjuSjEP(SEPWdP$]dPxPV$`=EA9]t	u |TyÐj4hcE3ۈ]Ԉ]Ո]ֈ]׈]E]܈]݈]ވ]߈]E]̈]͈]Έ]ψ]E]Ĉ]ň]ƈ]Lj]E]SSS(Q;AhRSSSSSSSS3GWEP5։E;AhRSSSSSSh j jEP։E;BhQSSSSSSh#j jEP։E;BhQSSSSSSSjWEP։E;7BhRSSSSSSSjWEP։E;TBhRSSSSSSSSWEP։E;rBhRSSSSSSSjWEP։E;BhQSSSSSSSSWEP։E;BhQSSSSSSSjWEP։E;BhQSSSSSSSjWEP֋;B]E0E苿Ð)c8c***c]67+D&v%CjF4]+H`pdcHcd
dhdAH2HHHH 2HH.|d++USVu WtjƍP@u+@E e}tMǍP@u+@υju UVjRPQuuj+uu0_^[]E jXNULLU(P3ʼnEVEPEP3E.EPhpeM3^8ÐCOMPUTERNAMEUWEPj3Wh%h}fVfVE;hfVP5tQ@(juWjPTP=Pt@txrh%jmpprj5tQV}^t	u3_ÐSession0ViewerWindowProcHookwls0wndh.dllUjuu	]USVW3339uV6u(;V6_^[]UQSVWPP%;t@t
x|؅jXfPcEt*P;t@txruWjUppe3CP;totj%PQ
P;t@Yt;yr566uƒ=PP5PRWjVqq]_^[ÉP땐USEPh3Shhh]u8VEPEPEPShhVuE}'u^[ÐDisableLockWorkstationSoftware\Microsoft\Windows NT\CurrentVersion\WinlogonUeEPhjhp6hu,EPEPEPjhhiuEuEÐSetupTypeU4P3ʼnEEVW}PVP蔮}<Ut
=PPM_3^覫UQVup<6P;E#SWVPuӋA$;#E_[^Uuj5P]UXeSVWjD^VEjPXEj}3CÉEXfE؋EEEPEPEu3Vu
PVVVWV}}uE$;9u t] !E tVjLu t`WxEjjFEVFhuFPV؅VE(u%uE_^[$uۋMԋMݐU}]"EPf@@fuV+WtVt
VuW_^]UP3ʼnES3VhQ]]]]]E; hQSSSSSSSjjEP;!SSSP;!SSjSxP;!h8mh|QjShShmh&hE!5VhlX; M^3[ÐInitShutdownDisableShutdownNamedPipeWin32 SystemShutdown moduleWjhmj
hnlVhhVjjj5V3@PVPPu3^_WindowsShutdownncalrpcUEPf@@fuV+WtV\hnVWuVWjWj
hn4hahjjjuK3@Ph90PPu3W1_^]ncacn_np\PIPE\Uuj5P]UWEPh3Whxph;$VEPEPEPWhouE;_$}$PP;t@txrh0jppjLEPWWh0WWP;#u^_ÐSecureBootUS3C9]ulVWPP0;tXtxrVj
pp胥hQhjhxphd"hU\&"P_^[]System\CurrentControlSet\Control\LsaMZf9<8PEu|H&xtvf39jQnP
,Q
0QYY
W
V=V\&33룐hhYYÐUjtP!t@\f,&jX]ËE]Ðjhr.3Mt:t5!EMZf9u!Q<|s
E8PE%Eͣ͗їh4hPs艵uDž
3}V;&d@06vh0shP|{WPj
hn;%hVj(WW5V;%3C$QSVS=%9%EP`WMsgKRpc%X%X%X29%jj
X
 9HtjWX33E~NQMVJNA}vc\
PPAyPh%j<qq^sP=Pt@txrh%jdpp\3áP=Pt@txrh%jeEPEPEPVhuu;t=
PPYyPh%jgqq觺鋺39uVVsuoHeadlessEPEPEPWhvuE}}u9}`P=P@xh%jhpp$P=P@xPPVh%jipp6rP=Pb@XxNPPVh%jjpp26*P=P@xPPh%jkpp P=P@xPPh%jlppٸDisableS0Viewer9SDžPSVjhXxV=uC;td@0SVpd@0Vp;;f93tNf tf,u@@f;t3f tf,t
f;t@@f8 uf90t3f@@f90uPjhHx5R5RDž;td@0SVp[ @AppInit_DLLsEP}uuMMVVjhyuhxuuumuhucNV PrimaryDnsSuffixPrimaryDnsSuffixWjSppnP;@x}SWjTppiD3bWVPIhzVP-PhyEjP趬|EPVP| -winlogon %d -setupW@MW@WE P	SEEP=P@xuWh%j=pp;1hāVjVxP=Pt*@t$xr39Qh%j>pp蓴jPjVh||P=P8@.x$h%j@P=Pt@txrh%jApp&BX2P=P@xh%jC~=PhPPPVhDž9hPH=Bh|hP\PP	htPVjVtdV\PhPDž\`Džh@lphȀtPDžӍHf@@f;u=+PPjVtPhtPjPjVtP=jPVhh`h@nb;t!h0jP`P*9P=Pt$@txrh%jDppVVVSVj6WP9}P=Pm@cxYh%jEpp蕰<P=Po@ex[h%jG@Dž
=P=P-@#xh%jIppPP;@xh%jJppP;t@txrh%jKpp֕j;uP;t@txrh%jLpp藕H -k -c SaveDumpStart%SystemRoot%\system32\WerFault.exeTempDestinationDumpFile\Registry\Machine\System\CurrentControlSet\Control\CrashControl\MachineCrash\MEMORY.DMPEventFlagSession0TimeStagedBootCompletionEventWjWpp谓ҭPءP;V@LxBSWjXppE.xxVj
ppUexxVjpp8eEP;Y@OxEuVjppˬ*xHVj
ppے5P;@xuVjppwx Vjpp臒
P;t&@t xrPPVjpp&EfP3f	r"MSEEPjhjM_9]_^[t	u+(ExVjpp鑦P;t"@txruVjpp芫P]xP;t"@txruVjppWP]邦P;@xuVjP;z@pxfuVjpP;N@Dx:uVjDVjppJP;@xuVj P;@xuVj"ا39QuS5tQVP;t@txrVj#ppBEPEP(E9QuS5pQ9]t,P;H@>x4uVj$>}jXfP7P;2@
xVj%pp諏P;@xuVj'ӉEP;@x|uVj)P;t@txrSVj+ppSEiP;@ԦxʦuVj-pp躨鯦P;@xuVj/pp胨PP;t@txrVj0pp胎s锦SEPjhj+\]驦P;@xPPVj2pp鍦P;@xPPVj3pp賧kEt;P;t@txruVj5pp聧hP8jXfPP;t@txrVj6ppmh'P;t@txrVj7pp@8;hȉN'EP53u#P;t@txrVj8ppPEteEjYAMjYf
P}tuP39]m;t@txrVj9pp蛌SS+ZjjhYP;t@txrVj:ppch؉v&u(hd&p'0%P;t@txrVj;ppu5)P=P@xuWjP=P@xuWjP=P@xuWj~P=Pt}@twxrquWj^P=Pt]@tWxrQuWj>P=Pt=@t7xr1uWj P=Pt@txruWj!pp~9]9Qt;hQ(t&P=Pt@txrWj"ppeQ38QSEPjhjX鶔P=P+@!xVh"j#ppϣP=P@xۦh"j$ppĦu]P=P@xWh"jppPP=P@xWh"j,P=Pg@]xSWh"jpp;j^P=P@xVh"j
,P=P@xVh"jpphP=Pt@txrh"j%ppfVxP=Pt@txrh"j&j^QDP=P6@,x"Vh"j'pp¡
P=P@xh"j(pp贇3P=Pt@txrhj
pp~3P=Pt@txrhjppMEP?PEtBWP=Pt@txrhjppEPeP=P{@qxghj
pp躆Pj
^jj	jjhHuRWj	Wj3鱪O:BAG:BAD:PAI(A;;FA;;;SY)(A;IOCIOI;GA;;;SY)(A;;FA;;;BA)(A;OICIIO;GA;;;BA)(A;CI;0x100026;;;BU)(A;OICIIO;GA;;;CO)jEPjSVu]PSE\;KSEPEPVu`0EVWSSEh@j\R3
Vhu
PPtAtyrPhjqq虞3"uuEPIڋMfLP=PZ@PxFuuhjpp')MfdP=P_@UxKuuhjppW'.PDd<F7zrFɃ7~v<F7FɃ70鐹<F7遹yFɃ7铹鋹<F7FɃ7
P;thYtGyrAPPVjpp
P;t<YtyrPVjqq誜
P;tYt8YrVj
qq赂Sj(SZP;t@txrQVjppPjjj<P;t*@t$xrPPh0jpp?p2P=Pt@txrh0jpp`
PPAyPh0jqq胛
PPAyPh0jqqEuj_u5VZP=PK@ Ax7Vh\j.ppP=P@ xVh\j/pp蜚̒P4;EӦju68;t҉黦&d@08XEPEPEPShԕu}uE9]E|E;Q}5N@FD"jVSQP`PKE
TracingControlLevel4~P25Q_~P耑5Q[~MQjWMu5~t=u2jjVtE黄EȄuSDŽ;u
3FthOj*kY鐷hWjYjjjW驷< %FuE X=QuOPt39MM邷Fu錷E	MPQiYYËeEܣX=QuPh=XudEX3@ËeEM~Á39NhT<Y3@Ëe3E+f3@]ÅУPڤF颜J]<VPVEP׋釐5PQXQ`Q25dQ8hQ>PP=P@zxph`jnP=PQ@Gx=h`j;P=PX
xh`jpp\38豃:P=P@~xtuh`jP=PUXLxBuh`jP=P#Xxuh`jP=PXxއuh`j\P=P‡Xxuh`j-P=PXxuh`jppfu·P=P=@3x)PPhj
ppȔVP=P&@xVhj
pp胔ӉEP;L|@B|x8|uWjGӉEP;|@|x|uWjP;{@{8X{uWjEP;{@{8X{uWjP;{@{8X{uWjMP;d{@Z{8XQ{QWjeEP;7{@-{8X${uWj6ӉE临9Et7P;{@zxzuWjppzM9MvEzP;t@txrQWjpp’jdEdsyP=Pt@txrWhH7j
pp~}
sEd
}S飠uuP=Pt"@txruVhH7jpp`
sCd
}_W7HjEP=P@|xruhH7jpp訑XEP=P9X0x&uhH7jppb|P=P@zxp|hH7jppS3EP=PѽXȽxuhH7jppȐ餽EP=PX|xruhH7jpp肐XEWVuEP胱EP=P@8XuhH7jpp"EP=P̽@½8XuhH7jpp܏韽jXP=Pt@txrhH7jppuEW骿EP=Pt!@txruhH7j
ppa9ukE_P=PO@Ex;uhH7jpp!P=P@xuhH7jEP=Pؾ@ξxľuhH7jEP=P@xuhH7jKhH7jpptýP;X@NxDuhH7jE)3u};t	P7};t	P7};MP 7?
PPAy۹Phpjqq藍ùP=PE@;x1hpjppsP=Pˠj[X8Xhpj
ppMs韠P=Pj[X8Xzhpj¡P=Paj[XU8XLhpj딡P=P3X*8X!uhpj
pp舌EP=PX8Xޟhpj#P=PtXt8Xruhpjpp#EP`陟9}t	EPMuPlџEHPEP=P.@$xuhj
pp衋PEP=P@ܾxҾuhjPEP=P@xuhjyPEP=Po@ex[uhj
<PEP=P2@(xuhjPEP=P@xuhjPEP=P@xuhjPEP=P{@qxguhjHPEP=P>@4x*uhjVEP=P@xVhjZ0;$H/d@08XO9u9]銘xVhjpp隘55qqNULL<NULL>SetupShutdownRequired%d&@<qp:[@AFاhSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogonlsass.exeSystem%SystemRoot%\system32\userinit.exeuserinit.exenddeagntuserinitNddeagnt.exeUserinit}y-Ogut3ЀbWgtȐD$BF)]+H`%\%\\
\[L[)[\[(([4
6666
6\[%\%\%\  )T[ )Td[d
\[K\F\ [[\LH2HHHH 2HHH2HHHH\26HXxR+D&v%CjF4]+H`

\[%\[\[ @L\[PLLLLLL@\[U=/67_>\юΏN4DdS:oXHPثYUUt%f:ujVpf@@fu+D^j
Xt
f:ujjMQPRuuj+uui(]UVutƍP@u+@jX΅uejjURPQuuj+uu?i(^]V5PWP;u (FNtQPff6uމ=P_^ÐUQWS3WWvNVEP6t	}t"6WWHW;tšWC;r^u3@jhjWP3=_[ÐUP=Pt@txrh%j\pphS]V3F=PW}tAV>EPhjhp6huhuu73=Pu>S7؉?u
[8;u73_^3[]Ujju4]UQSVWPP%;t@txruWjbppEPhjhhh؅u$jEPjShuu$P;t@txrSWjcpp芀_^[ShutdownFlagsPtHP<u6P=Pt*@t$xrPPh%jopp%PÐPtP%PÐ
RRV3^tRQ%R%RÐUR
Rt(uQPtjju5R5R]UR
RЃt?uQPt0eeEEEPjuE5R5RUQQSVW3VVjVxE%;u6MP=Pt&@t xrPPSjNpp~VE?utVVp=jhut
PPt-At'yr!PPVSjOppg
PPtAtyrP0SjRqq@M3_^[Ë
PPt AtyrSjPqqc
P
P}뇋
PPtAtyr0SjQqq>8tP1pW _USVWu3PP%;t@txrWj]pp0cj jhm0Eu83PPPjhP؅t&P;t@txrSWj^pp|3_^[]UQQSVWPP;t@txrh%j_ppbhjjnj jh/}j[uj}uj[Sh3VS8uVhP;t@txrVh%j`pp{tjEPjhju]/hphhhCDGhjjh.pP;t!@txruh%jappJ{hдujjlj_^[		
	33UU3Wtv|%}vU3f
uEMjVc]U4P3ʼnES]VWj6Yh.jPfbjY0fh3bWP[bP=Pt @txr3h%jMpp莁9=X59=P)C<VPs9=VtB9ئ$PVP]pP3jWWhj.-,h);thPVPnPڠ3PVPoPPh<);tPVPkaPwPPhj<PPM_^33[^%08xA critical system process has terminated unexpectedly.The system process '%s' terminated unexpectedly with status code %d.  The system will shut down and restart.U}uCVujFPt-EPjVh4jjujj}P^]UjjEPjEPuuj+uu\(]UUSVWt+f:u	E#pf@@fu+DEE
t
f:u	Ӌ}t#f?ujǍpf@@fu+Lj
Ytf?ujuRQPuuj+uu\(_^[]UVutƍP@u+@jX΅uejjU RjURPQuuj+uu[0^]=PS VWP"tajj5VӅt'
P;tGAtAyr;PVjqq
u*P;t@txrVjpp[%PQh8QP5V$t'
P;t@At:yr4PVjqqt#P;t@txrVjppZhQ(t%
P;tAtyrPVjqq@t%Q=Ptajj5VӅt'
P;tGAtAyr;PVjqqs*P;t@txrVjppZ%P_^[ÐUSVWQV33`|G=X|Et
X3CtV\_^[]UVWjXjfEX3V}fEEE;@SWVPjP;
PP";tA tyrPWjXqqruj<j5[t0
P;t&A t yrP5PWjYpp3Fuj<jV[Fdu9>P"jEPF8PduaP;t@ txrvPWjZppGruj<jvP/[t(
P;tA tyrPvPWj[qqY6>uEPЙ[_^winlogon.exeU<SVWhQ`3F3E95Xu
W5XWӡX;t@WPWӅu*P=Pt#@txrh"j\ppWP=XP=Pt@txrh"j]ppZW9}X|hQ\EPhj;jXVEEPWu3Wh|QuuM}huEpFEE̋EE Eu;t@E}؍EP}܉}0EiPVjbP=Pt@txrVh"j^pp?pV_^[U(SWot3WVEP3FVjEBDMMPP";t@txrQSj`ppo}u3}uVoEteMQVPjujCt@Eet	tu)P;t@txruSjapp>oMEP}t5P;t)@t#xrPuPSjbppGME8P=Pt*@t$xrPPh"j_ppn^_[USVWEPu3ۉ]]];t.P=P@xWh"jcxEPu;t.P=P@xWh"jd7SSEPSSu;t-P=Pta@t[xrUWh"jeppm@uܩM;u/P=Pt@txrh"jfppSEP59]tEP9]tEP֋_^[U0P3ʼnEVWPh3Wh&hDž;unPPPWh;uCP=Pt)@t#xrh"jgpplPi`EhWPTPDžtt} t
P9tP=Pt@txrVh"jhpplM_3^)RÐShutdownSessionTimeoutUQQBkiwySVWEPjE?ءPP";t@txruSWjippEE EPh`?ءP;t#@txruSWjjppmPuOM9Mt1;t!@txrQuWjlpp.MMt:{;t1@t+xr%QWjk;t@txrSWjmppj:ءP;t@txrSWjnpprjEPS>
P;tAtyruPSWjoqq*_^[ÐUR
RЃ tMuQPt>jEEXEEEPju35RU5RMMUMMU$P3ʼnER
RS]Vut^SQPtQeeW}쥥EEܥEPjEt}_EPjS5R5RtplM^3[LOU$Su3ۉ]]E;VEP3FVjju|;}PEWj_EP5Qu(Ptk9]tj_3ۃeEPEPuu܉u}]x}=auuEPjujh|Qh}	P}uE	E_^}[t	u}tEU`P3ʼnESVuW3jPEWP}}}^PEPV;t3
PP?A5y+Ph"jWWWEPWu;t3
PPAyPh"j
PhnuYYtKh$"uYYt;P=P@xuh"jppnuj[EPV]};t.
PPtOAtI8YrDPh"jqqf/}t.P=Pt@t8Xrh"jppLj[VuY؋59}tEP9}tEP֋M_^3[oLUQQeVQV`}	PE=X|;P=P@xh"jNpp
LEuEtuhhjSW5PE"u8
PP;tdAt^yrXPSjOqqne
PA
PP;t AtyrSjPqqjK
PEXX}tV\e
P};tAtyrSjQqqKN9t%
P;t!AtyrPSjRqqd
PE3Ftjtj	^y@@t;tAtyrSjSqqJVjhp&EPjVj]+Q_[}tV\^USVW=3SSSuSV]]]׉E;u7P=P|@rxhPh"jHP蕞E;BuPSuSVׅu7P=P"@xPh"jI=|SSSujV׉E;u4P=P@xPh"jJJPE;uPSujVׅu8P=Pt@tyxrsPh"jKPppbSEPf@@f;u+ȋEPf0@@f;u+t6PdE;tuuh@VP|Y9]t	EP79]_^[t	EP&E%s %sU4P3ʼnEESVW;t	j<3Y؃PP";t@txrSWjLppauhuh
u/h!0PhPHJhPPPtlPPt;PP;t @txrWjMpphu6PShPWtPkP_PjPjX)M_^3[|FU$EV3u;t@EuhQ`;}PEX;xtmdE[_MSWVE EEuP"u_EPuP;t @txruuWjTppEEEEEP09ut	EP/V5XV5օuEP3P;t@txrWjUppAEP%Xe
Xt:jQjօu#P;t@txrWjVppDP%X;t@txrWjWppDjja_[E\hQ\E^UESV3WEuuu"P9ut;t7jW^P;@
x
Sj)pp?D
y-t)jW^P;
@
x
Sj*9u9uu7P=P[@QxGSj+ppC4EPu2uz5=t<֋P=P	@	x	VSj,ppA]	P=P@xuSj-5EPjjjuֿ#E;t8PP=PM	@C	x9	uSj.hu胗Euj^	MQuPju։E}8PP=P@xuSj/EPjjju։E;t8PP=P@xuSj0uЖEIMQuPju։E}8PP=P9@/x%uSj1TE0E04Pu/P=Pt@txruSj2ppc[M)P=Pt@txruSj3pp4[hQ`E}P=X|E([^R
R}pVQP3ҹ6;tG;tf9vȍ}xE}hjX}}pEE}EE} lt|UUUUUUU}Pf8@@fuee+DEhPjV5RM5REuDut8
PPtAtyrPuSj4qq&E(,}u1P=Pt@txrSj5pp?PMP}v-=Pt"@txruSj6ppgYPMEuMu(}$=Pt!@txrVWSj7ppP}Uj ŰU YMȉUEtURUeUu}}xtRhhjP=Pt@txruSj8ppXE3Gtjtj	_y@@t Vuhp$EPVju@E(u
Et@E(P=P@~xtu(uSj;ppN[}tPu0PuCP=P8@.x$PPSj:ppWEP}0
PPt/At)yr#uuuPSj9qq},P=XuE(53W5XWփu,P=Pt@txrSj<pp==XX;t5WPWօu&P=Pt@txrSj=pp<=X3E9utMu0Pu@P=P@xPPSj?ppJVuEEt	E
EtE	EP0
PPt/At)yr#;ƸuuuPSj>qq$9ut,P9u=j
3^EijjPuh>jhXׅuPE(P=Pt!@txru(h"j@ppfUh,C;|PEj<3Y;w	jY;#P=Pt!@txr"SjApp7;"juMk<+ijjQPhQjhXׅu4P=PtT@tNxrHPPSjBppT'P=Pt @txrVSjCppnTPe(39](t6=P@xh"jDppZ:P;t#@txrh"jEpp.:PuX;t99^t4;t@txrh"jFpp9EPSvuj](VuYu(hQ\u(E"P39}tEPJ{P9}tEP7{P9}tuP=Pt@txrVSjGpp)S_^[$77failedsucceededjhX;3EEPPEE0ËeEE9UMtKtjXjX@t
t@hth`hP3PPPPP]127.0.0.1wininit.exeUSVuW3EW}}}}};tEV;u
3f;u:f;F/u,%f;sFAA;u3f;LBu}}rEW9}WE;3MQ@PjjE|;}PEEP5Qu(Pu9}uEPjEPju8PtӉEEPu}.E;t@3PuuuuVuuu<E9}t	EPux9}t	u9}tӋE_^[USV3WS]]3];ugEPGWjj|;}	PEP5Qu(Pu
)9]t	E8]tE8]tMM9]t	u;t;uSuuuuS_^[Uhuuuuu]USW}3S@PjS;tKVPSPt4O4FFFuGP؅tWVSdG^_[]UVWEP3hWhh}}};u[5EPWEPWuu;u?u葉E;t0MQPEPWuu;u}uErMf9|At9}t	EPIvuE9}_^t	uEU<SV3EPEPjuu܉uuuuuuЉuԉu؉uủu3ۉuz!E;EPEPuPPE;thEPEPuLPE;tPEPEPuHPE;t8EPEPEPuDPE;tEPEPEPu@PE;uE9ut3C9utW=<P;tVVuuSju׉E;uY39utf#E%` 9utE t
@
;tuuVVPju׉E;tu_9ut	uh9u^[u	ulEUV3 Luuuu'^]UQV3uKu+uE;tuuP'EP!tj^^UV3KuEPuu0&^]U jX9EvE39EvMT@;ErVWh<jXPu$=t=uhj_uEPuuujuV=P=Pt"@txrWuhjpptVTP_^WininitUUt%f:ujVpf@@fu+D^j
Xt
f:ujPRjEPuuj+uu$1(]U(VhdE3PuVEEVEPVEPEu܉uuu;ƉE|
EXCP=Pt!@txruhLj
pp@JVEPjhj^Ð\INSTALLATION_SECURITY_HOLDUQVjW^EPhjhp6hu#jEPjjhhiuu3^USVEPh3Vhp6hu3uNEPEPEPVVuEu}uEwMVuCu^[UVEPh3Vhp6huu+EPEPEPVhuEu9ut3F^SystemSetupInProgressUV39utE9ut@9ut;Whx;t(hW;tuuuVVVVЋW_^]syssetup.dllSetupSetDisplayU$P3ʼnESVuWj%v3\YY;hW\;WPvӉt;vZ=h׋DPj\PvӉu
dFFPh3Whhh+PPPW6Dž;tO'W\;QPPW6ӅX3fLC;+f;!j,S\YYt3fvWPYYF{ǍPf@@fu+‹+L@;sǍPf@@fu+H	PWXGF;t	NXf@@f;u+DPQjW6m3fDžtj,XfCCFtFPf@@fu+\ASj\3f~u,vѭWG-hW-SW-~uhSW-vSW-9thDžt4Pf@@fu+DPjj69ththFM_^3[),VWjW_VOu_^ÐUSP3ʼnESVW5Ph3Shp6W;PPSShDž;u3P=PtT@tNxrHQhLjppJ-
PPtAtyrPhLjqqB-
PPtAtyrPhLj
qqSBSePt5t0PhShhWօuh9Qt/h$7hhP8jhXh k54hh3ȸ95XtȋӅt5ȸu6QPhhPz895QuVQVVVVjPW7|;t?
PPAyWPhLjqq5QsNPP;t!@txrLSjpp&LV=tit>PP;tl@tfxr`Sjppd@JP;tA@t;xr5PPSj͡P;t@txrVSjpp@M_^3[&winsta0\Defaultntsd %s %s-d%s\WinlogonAutoAdminLogonCmdlineUjjE PjEPjEPuuj+uu%0]UU t%f:ujVpf@@fu+D^j
Xt
f:ujPRjEPjEPuuj+uu%0]UjjXPM(QPM$QPM QPMQPEPuuj+uu$@]$USVWPP\;t@ txruSj
ppE>}M';H--Ht\Ht0HP;}@ sxiSjVP;T@ Jx@Sj-P;+@ !xSjP;@ xSjP;t@ txruSjpp3=}tS} t'Wh
@j5|%
P;A wymPSj@Wj	j5:%O
P;?A 5y+PSjqqP;t@ txruSjppi<EjuP;@ xSj-w-DHHHHt5P;j@ `xVQSjpp;B}8P;t@ txrSjpp!jjju2P;@ xPPSj낡P;@ xSj
P;@ xSjzP;t|@ tvxrpSj`P;tb@ t\xrVuSjP;tB@ t<xr6uSjpp:#P;t@ txrSjpp _3^@[]UVWPP\;t#@ txruuuWjppE EHHte-t(P;tU@ tOxrIuWjpp96P;t @ txruuWjppuju3_@^]UVWPP\;t0@ t*xr$Mqqq1uWj ppPMt0ItIuN;tD@ t>xr8Wj#(;t/@ t)xr#Wj";t@ txrWj!pp1E 3_@^]UV3uuR8tIuuV!;M
PP{A qygPh\j$i95Pt=Pt
E0BEPEPjVV'
uIM
PPA yPh\j%qq8u9uPSW3ۿ\Mr0=P@ xQWj&pp7s=Pt!@ txrQuuWj'pp$uEu48 t2P=Pt!@ txrMV4Wj(ppE03PEM;M8_[9u^tu3@UV3uux6tLuuuV;zM
PPcA YyOPh\j)NEPEPjVVeuIM
PPA 	yPh\j*qqW6u9uPSW3ۿ\Mr0=P@ xQWj+pp5v=Pt!@ txrQuuWj,ppbuEuu4t2P=Pt!@ txrMV4Wj-ppؾE03PEM;M5_[9u^tu
3@jhxee"EE0ËeEElÐVdUVuWtƍP@u+xj_uuEeUt#f:ujpf@@fu+Dj
Xt
f:ujWuPRuuj+uu(_^]h@h8,E3j_Pj[SVh%h;t8PP;2@(xhj
PPPVh5։99u=PP;@xhjpp]Dž
PPPjh։3;3f;EDžPPPWh;PP;t,@t&xr QQhjpp,P;u?P;E@;x1hjQP;P;@xhj9u
Dž
PP;@8Xhjn9u
Dž
PP;t^@tX8XrShj
4u
Dž
PP;t(@t"8Xrhjpp0Pe;t@txrhjppP;tl@tfxr`hjppnLE0ËeP=Pt@txrhjpp1hEtt"1pK

ޗyRestoreFunctionRestoreModuleRestoreInProgressJXUuuuuhhP`]ÐUE8csmu+xu%@= t=!t="t=@u3]%lUMMZf9t3]ËA<8PEu3ҹf9H‹]ÐUEH<ASVq3WDv}H;r	X;r
B(;r3_^[]ÐjheVbYt=E+PVYYt+@$ЃE E3=ËeE3Ð%U(S
SSS5S=SS
SSS%S-SSESESESRSRR	RPPjhh	PÐRR%PQRPh+ZY%PP2%P(P,P0P4P8P}<Ps@PiDP_HPULPKPPATP7XP-`P#|PQRPh|+ZY%|PPݐ%PPː%PxP빐%xPPQRPh+ZY%PPݐ%PPː%PP빐%PV395XtX;tVP=uF^ÐXtP%XÐUSV5x3SSjEPE]E֣X;tSSjEP֣X;u
3;t^[ÐUVWh質395XthX5X35X9utHX;tPX;t/h'Pt
V5X5X5XTh0_^]UP3ʼnEESVWEh|ʩ}j^t9ug;;u5Qh	h\	SP"  5Qh	h	SP 3Ʌ;tjz[jDVP=DžDDž ;t XXPXTlPPVVVjVVPDV9uPuT;t
h脨9t
P;tuhYM_^3[lpXt|VP;td@0;uMQP9	;SPVVVhnEPt;0hXp;;hPN	3@\`dDžh\PVVj
jP5Xl;h,ɐ@Winsta0\Winlogon"%s" /flags:0x%lx /testclientprocessid:0x%08x"%s" /flags:0x%lxLogonUI.exeUQd@0MQh|juu}thXjjjjupPuuuUQS3V3C95Xt0tF}S95XuEP5XSuU95XtMh0u5Xu85xW5Xֿh,5X;tX_Sa^[ÐhDh	E=PW+hjP
PW@DžPtt}u
PWPSjhhW5օuMDžPPPjhuPWPSjh&WօuWDžPPPjhtu0PWPW9Ev3Tj^tFeu5XEPËe苵EVerboseStatusUIVerbosityLevel?SUQEPhh
EEH2DpH2FpH2$FHP!pH 2$FHHHP!pH2@$D
P!pH2FHpH2@FH$HP!P!pH2$DHP!pH2DpH	x2`G 0HP@DHHHLP|HTHXH\ `P!dP!hP!lP!pptH
208D 0pH$2HRG 0HHH  p I 2\TG 0HHApH
2@FH$HP!P!pH2$FH$P!pH2@Hp8ntR+XV5t
Pփ%XXt
Pփ%X^ÐUuhPj%uY|3]3BDB59A0-D736-4D44-9074-C1EE%08XU|P3ʼnEVuWPEP3WjDžDPtcPPEPPPEPDžDžt!PEPhLuVa|GM_3^^%s\%sUP3ʼnESV5W}EPjjhhփ'؅u3uEhئjP|WuESPu֋uM_^3[Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionDataUVu6\u
Vu!^]jXhDjDEPP3;VVVVx؉];u3uE]uuVuuuEPE&EEPËeEEE]39utSETjS5֋ujEPTEujS֋uuWEPXESME<'UujP]UujP]U}VuFEujVXVEP^]jph |]]3uu3}u}uuuhh1j%EPEPEPE;uEXWulWSh|WhVhTWDEu5W3PHEEE]39ut
93t	S3Ðpjh3ۉ]jDxu;ujXjDVP;tVrlEPu@;uEFF F$]SuuuV
)EEP'Ëe}uEPEjh3ۉ]jDu;ujXjDVP;tVoEPu@;uEFF F$]SuuuuVS)EEPLËe}u:EPEUQeVEPu9uuuuuEPM^UQeVEPuuuuuEP^UQeVEPuuuuuukEP^UEPhhh-]UEPhhh	]UVutƍP@u+@jX΅uejPQuuj+uu ^]UVujPu*P=Pt@txrh`j
pp^]UujPu*P=Pt@txrh`jpp]jh3uuu܉uEPV8;t>
PP+A!yPh`jqq(9uu;P=P@xh`j
ppV;t3
PPAyPh`jr3C]܍EPhV(Pu.P=PtXtxrh`jppu9P=Pt-Xt(xr"9u乔6u6Qh`jppEEi39ut4t*P=Pt@txrh`jppÐz	jdhuj_}3ۉ]jTSEPE]EPVE;tEljEEEÐ|tUE3@]UE3@]UE3@]SVW339=Qt%hHQ5Q5V$;t=Q9=QthQ(;t=Q5 9= QtjW5V;t= Q9=$QtjW5V;t=$Q=PQ=TQ=XQ=\Q=`Q=dQ=hQ_^[ÐUu0uh;EEPuuutdQPQt}u
juXuu4]Uu0uh>EEPuuuuthQ`Qt}u
juXuu4]Uu0uh.EPuEPuXQt}u
juXuu4] Uu0uh+EPuEP\Qt}u
juXuu4]\Uu0uh-EPuuuTQt}u
juXuu4]j Pjh!D3}}ԉ}}E܀}3C=WEPSWhh;t=
PPYyPhjqqXEP=E;j0YfEPuEPWh u=WEf80tWEPE;9Wu:EPjWhWW;tjVVVS PE39}t	uÐReportBootOk UQV5WEPjuu֋|uEPjuu֋}+P=Pt@txrWhpjpp
_^jh"L3EEu$u uuPuuuuhPu	EEE Ð!U]%HUQujh:Et`Sh"tDh"Pt4VMQjjPhjutjVVV^u[DbgBreakPointntdll.dllh$hx'u3ۉ];};3fPhSh'h;DžPPPSh&;H	HuWVP;h&PYYtbV3Ƀ;
PPAyPVhjqq辇P=P@xVhj
PPAyPhj
qq
xh&PYYt+PWVV3Ƀ;P=Pt%@txrQhj
ppP3fWVh&;wV3ɃunWVhX&;wV3ɃuCh,&WVV3Ƀu"WVh%;wV3Ƀ3E3ې9tÐ%SystemRoot%\System32\ntsd.exeC:\Debuggers\ntsd.exe%SystemDrive%\Debuggers\ntsd.exe%SystemRoot%\Debuggers\ntsd.exentsdBpidDebuggerSoftware\Microsoft\Windows NT\CurrentVersion\AeDebug%UxP3ʼnESSP$u>P=Pr@hx^uhjppDVuWV3Wh;QjQjPL;PhlP7jD^VWPxu3Phd*SP3 P9t:P;t@txruWjpphX*SP3QQPPPPPPQPPt;P;t@txrWjppk52
P;t"AtyrPPWjqqL`
PPtLAtFyr@PVhj*P
PPt AtyrPVhjqqӎ4
PPt AtyrPVhjqq葎_^M3[R -pv%s -d -p %d%%%,%pPP
P PhPlP%d%h%`%<%,@,`RP\-p,dRPd-,hRPp-,lRxP-,pRP--|RP-0-RP.API-MS-Win-Security-SDDL-L1-1-0.dllAPI-MS-WIN-Service-winsvc-L1-1-0.dllADVAPI32.dllWINSTA.dllWTSAPI32.dllAPI-MS-WIN-Service-Management-L1-1-0.dllAPI-MS-WIN-Service-Management-L2-1-0.dll.L.b.v......./ /,/B/Z/v/////00,0<0J0Z0n0000011.1F1Z1l1|11ConvertStringSecurityDescriptorToSecurityDescriptorWQueryServiceStatusPI_ScSendTSMessageQueryTraceWCreateProcessAsUserWACreateWellKnownSidDNotifyBootConfigStatusILsaGetUserNameCheckTokenMembershipARevertToSelfImpersonateLoggedOnUserEqualSidGetTokenInformationSetNamedSecurityInfoWGetSecurityDescriptorSaclGetSecurityDescriptorDaclGetSecurityDescriptorGroupdGetSecurityDescriptorOwnerdGetSecurityDescriptorControllDeregisterEventSourceRegisterEventSourceWAEnableTraceControlTraceWStartTraceWReportEventWOpenProcessTokenDuplicateTokenExWinStationSystemShutdownStartedWinStationQueryInformationWWinStationGetTermSrvCountersValueWinStationSystemShutdownWait+WTSDisconnectSessionAWTSFreeMemoryWTSEnumerateSessionsWWTSQueryUserTokenOpenSCManagerWOpenServiceWCloseServiceHandlePNotifyServiceStatusChangeWN32T32L324242526p26d2profapi.dllAPI-MS-Win-Security-LSALookup-L1-1-0.dllKERNEL32.dllRPCRT4.dllAPI-MS-Win-Core-LocalRegistry-L1-1-0.dllntdll.dllmsvcrt.dllUSER32.dll677.7B7Z7t77777778 808F8Z8r888888888888899(989F9X9r99999999::":4:D:Z:n:::::::;&;8;J;b;r;;;;;;;;
<*<@<P<n<<<<<<<=.=H=b=|=====>$>8>L>j>>>>>>?"?8?P?h?z????????@@,@F@d@@@@@@@A$ADAbAtAAAAAAABB2BNBdBvBBBBBBBC$C6CNCjCCCCCCCDD0D<DRDdDzDDDDDDDDEE(E4EBEPE`ErEEEEEEEEF,F@FZFpFFFFFFFG$G0G@GTGdGrGGGGGGGGGGHH*H:HLH^HvHHHHHHHHII.IBIVIjI~IIIIIhSetWindowStationUserSwitchDesktopWithFadeLoadLocalFontsSetWindowsHookExWWRegisterLogonProcessSetProcessWindowStation^CreateDesktopWJCloseDesktopNCloseWindowStationSetUserObjectSecuritySwitchDesktopUpdatePerUserSystemParametersIRecordShutdownReasonGetAsyncKeyStateExitWindowsExUnhookWindowsHookExSetThreadDesktoppCreateWindowStationW_vsnwprintf_wcsicmpmemcpymemmoveQwcschr__getmainargs_cexitb_exitj_XcptFilter_ismbbleadexit_acmdln_initterm_amsg_exit__setusermatherr__p__commode__p__fmode__set_app_typeY_except_handler4_common7?terminate@@YAXXZ'_controlfpmemsetdwcsstrRtlNtStatusToDosErrorRtlInitUnicodeStringNtShutdownSystemRtlDeregisterWaitExGRtlFreeHeapcRtlAllocateHeap5EtwEventEnabled9EtwEventWrite8EtwEventUnregister7EtwEventRegistercNtOpenProcessTokenYRtlRemovePrivilegesNtCloseQEtwUnregisterTraceGuidsJEtwRegisterTraceGuidsWCEtwGetTraceLoggerHandleBEtwGetTraceEnableLevelAEtwGetTraceEnableFlagsOEtwTraceMessageNRtlRegisterWaitRtlDestroyEnvironment
NtSetValueKeyNtReplyPortNtCreateKeyNtReplyWaitReceivePortNtAcceptConnectPortNtCreatePortNtAllocateLocallyUniqueIdQTpSimpleTryPostJRtlFreeSidRtlSetSaclSecurityDescriptorXRtlAddMandatoryAceRtlCreateAclRtlCreateSecurityDescriptor[RtlGetDaclSecurityDescriptorRtlCopySidRtlLengthSidzRtlSetDaclSecurityDescriptorORtlAddAceRtlUnhandledExceptionFilterNtQueryInformationProcessNtQuerySystemInformationRtlSetThreadIsCriticalRtlSetProcessIsCriticalRtlLeaveCriticalSection
RtlEnterCriticalSectionRtlCompareUnicodeStringwNtPrivilegeObjectAuditAlarm:EtwEventWriteEndScenario>EtwEventWriteStartScenario4EtwEventActivityIdControlvNtPrivilegeCheckkNtOpenThreadTokenaRtlAllocateAndInitializeSidRtlInitializeCriticalSectionNtQueryInformationToken~RtlSetEnvironmentVariable.RtlQueryEnvironmentVariable_URtlInitUnicodeStringExRtlCreateEnvironmentNtCreateEvent_RtlAdjustPrivilegeNtSystemDebugControlNtCompleteConnectPortRegDeleteValueWRegQueryValueExARegQueryInfoKeyARegQueryInfoKeyW
RegEnumValueWRegGetValueWRegQueryValueExW%RegSetValueExWRegOpenKeyExWRegCloseKey]RpcBindingFreeRpcStringBindingParseWsRpcBindingToStringBindingWkRpcBindingServerFromClientRpcRevertToSelfRpcImpersonateClientRpcServerInqCallAttributesWRpcServerListenRpcServerRegisterIfExRpcServerUseProtseqEpWRpcExceptionFilterRpcServerInqDefaultPrincNameWRpcServerRegisterAuthInfoWRpcStringFreeWRpcServerInqBindingsUuidFromStringW~RpcEpRegisterWRpcServerUnregisterIfRpcEpUnregisteruRpcBindingVectorFreeNdrAsyncServerCallRpcServerTestCancelSRpcAsyncAbortCall$I_RpcBindingIsClientLocalNdrAsyncClientCallZRpcBindingCopy\RpcBindingCreateWYRpcBindingBindRpcServerUseProtseqWWRpcAsyncInitializeHandleTRpcAsyncCancelCallURpcAsyncCompleteCalltRpcBindingUnbindNdrClientCall2NdrServerCall2-I_RpcExceptionFilternRpcBindingSetAuthInfoExW_RpcBindingFromStringBindingWRpcStringBindingComposeWRpcMgmtIsServerListeningVSetEventCreateTimerQueueTimerUSetErrorModeGetTickCountGetWindowsDirectoryW8FindFirstFileW-FindCloseHeapSetInformationCreateProcessWInterlockedExchangeCreateThreadSleepExGetCurrentProcessIdSetThreadExecutionStateSleepResetEventWaitForSingleObjectQueueUserWorkItemWaitForSingleObjectExHeapFreeHeapAllocHeapDestroyHeapCreate>LoadLibraryWDGetProcAddressGetFileAttributesWSetTimerQueueTimerOpenProcessGetModuleHandleWCreateRemoteThreadResumeThreadDeleteTimerQueueTimerRegDeleteTreeWUnhandledExceptionFilterTerminateProcessxGetSystemTimeAsFileTimeGetCurrentThreadIdQueryPerformanceCounterGetModuleHandleASetUnhandledExceptionFilteraGetStartupInfoA<LoadLibraryExAInterlockedCompareExchangeDelayLoadFailureHook_MoveFileExWLLocalSizeJLocalReAlloc>FindFirstVolumeWGetDriveTypeWDeleteFileWIFindNextVolumeWOFindVolumeCloseAlstrcmpiW`GetShortPathNameWCreateFileWCLocalAllocReadFileCreateDirectoryWGLocalFreepSetLastErrorJlstrlenWGetVersionExWCreateEventWGetDateFormatWGetTimeFormatW$FileTimeToSystemTimeSystemTimeToFileTimeGetLocalTimeSLockResource@LoadResourceLFindResourceExWIGetProcessHeapaFreeLibraryGetComputerNameWTSetEnvironmentVariableWGetLastErrorGetCurrentProcesszSetPriorityClassGetCurrentThreadSetThreadPriorityGetExitCodeProcessRCloseHandleWaitForMultipleObjectsExExpandEnvironmentStringsWLookupAccountSidLocalW[J$0J0>[J5~
,J,>~RSDSt,pO!6CV]wininit.pdb5<***!+5?IS]gq{<<***1CF4<4"5PN@DD~be,ULC3umstartupumstartup.etlDontWatchSysProcsumstartup000.etl
RP%7666
	
"c88ا88lL00H`x				 xd^pt`a
WEVT_TEMPLATEMUI<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright (c) Microsoft Corporation -->
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
    version="5.1.0.0"
    processorArchitecture="x86"
    name="Microsoft.Windows.Security.WinInit"
    type="win32"
/>
<description>Windows Start-Up Application</description>

<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
        <requestedPrivileges>
            <requestedExecutionLevel
                level="asInvoker"
                uiAccess="false"
            />
        </requestedPrivileges>
    </security>
</trustInfo>
</assembly>

CRIM\mo MrȸK$WEVT88LCHANPMicrosoft-Windows-Wininit/DiagnosticSystemTTBLTEMPh=Y$"sbD	EventDataAAoData)KNameWin32Status
Win32StatusTEMP Q"m͠ @D	EventDataA=oData%KName	SessionId
A5oDataKNameFlags
SessionIdFlagsTEMPƓ>K8YOD	EventDataA=oData%KName	SessionId
A;oData#KNameIsRemote
AAoData)KNameGracePeriod
A5oDataKNameFlags
A7oDataKNameReason
A9oData!KNameMessage
`xSessionIdIsRemoteGracePeriodFlagsReasonMessageTEMPpJZ)",޻tVD	EventDataA5oDataKNameFlags
FlagsTEMP,hL5g}$ҧD	EventDataAAoData)KNameStringCount
A7oDataKNameString
StringCountStringOPCOx000 win:Infowin:Startwin:StopLEVLhP\Pxwin:Warning(win:InformationalTASK			
H
	x
3
5
7
q 8WaitForWinstationShutdown4PreShutdownNotification4WaitForSystemProcesses0ShutdownSystemRestore$ShutdownWindows(NtShutdownSystem(SentLogoffRequest4ReceivedShutdownRequest,ShutdownDiagnosticsKEYW8,PerfInstrumentation$PerfDiagnostics,win:EventlogClassicEVNTTPPPPPPP	 P	$		P	(
	(P	,@D33P8	055PT	477Pp	8@@<@DHLPqqP	TXXXXXXXXXXXXXxxxxxxXh4VS_VERSION_INFO@@?StringFileInfo040904B0LCompanyNameMicrosoft CorporationbFileDescriptionWindows Start-Up Applicationl&FileVersion6.1.7600.16385 (win7_rtm.090713-1255)0InternalNameWinInit.LegalCopyright Microsoft Corporation. All rights reserved.@OriginalFilenameWinInit.exej%ProductNameMicrosoft Windows Operating SystemBProductVersion6.1.7600.16385DVarFileInfo$Translation	^K[>opY!ntT~hm**WEVT_TEMPLATEMUIMUIen-US	4"4;4E4M4[4f4s44445555<6A6G6N6V6m6666667C7777778h9999:7:B:::;;|;;;;;;;;;<<*<@<o<|=====>>$>(>,>0>H>L>P>T>$?0?4?8?<?j?z?????????? (00000"0000111 1&1E1X1c1t1z11111112V2[2n2222223,383<3@3D3X3\3`3444444555 5|555556797R777777777'838B8o8889N9W9d9i9t9z9~9999999999:*:/:S:X:k:::::;@;};;;;;;;<<*<]<<<<==J=O====>>3>G>Q>?/?:?H?N?a?}??????0$(0-0U00000000+1c1R2g2x222223!383=3R3e3~33333334=4G44444455@5c5s5z555555555666B6G678$818r8y888888888999::::::;B;Z;;;;;<
<<<<<$<,<7<=<K<e<<<<<<<<<<<<=.=4=I=R=c=m=q=y======>H>t>>>>>>>>>>> ?????@.001x2222233333454N4e444!5g5555516J666666677-788N99999":-:::::U;[;;;< <K<V<<==>
>>*>8>=>B>V>_>d>q>>>>>>>>>>??(?8?[?a?????P0=0[0y00003181K1t11111122/2R22222222	331393Q3V3o333334W4\4h4l7r777778888888888899999999::
:::(:/:5:;:E:K:P:V:\:o::,;p;;;;;<)<X<<<<<=E====>G>\>b>v>>>>>>i?v???`00f0t0000001$11111112.2N2m2222 30383<3@3H3L3P3h333333344t4|444'5D5U5[555555555	666 636H6]6677787I7{7777777778#8:8K8^8!9,9C9S9\9999:3:l:r::7;I;O;_;o;;;<<)<><Q<V<i<n<{<<<<<<<<<{========M>h>n>}>>>>?	?,?7?R?b?y?~??????p\0
0040@0K0X0k000011$1+141:1B1H1U1}111,202?2]2~22222222h333341464I4^4c4v444444444505F5O5]5b555555555666(6-6M6S6X6o6t66666	777P77778=8888888N9999):<:B:W:e:m:r::::::::;;';1;6;[;g;l;;;;;;;<2<e<v<<<<==G=l=========>>H>M>f>>>>>>>$?<?A?f?}???????0'02222253K3Q3l3334
434@4l4445?5H5R5555556B6n666677\7~77777788"8'8J8T8|88888819T9f9999(:-:W:\:::::::::;;#;,;1;S;Z;};;;;;;;<<(<?<D<d<m<r<<<<<<<='=,=?=S=]=b=u========>>'>@>E>X>>>>>>>?\:0O0o00000001&1+1P1v1{1112222233F3P3f3l3q3333333
4434c4i4s4x444444455\5h5t555
666667
77L7R7\7b7k7w777768A8E8P8[8f8r8888888889D9I9k9w9|9999999:
::0:9:>:_::::::::::;B;n;;;;&<]<<<<<<<&=7=B=I=N=e=========>.>9>>>c>>>>>>>>>(?0?5?V?n?v?{???????800>0C0e0|00000000001!181\11111111123282X2o2t222222223303<3A3U333333333334*42474Y4g4o4t44444444455&5+5M5[5c5h5555555556Y6h:l:p:t::;; <'<|<<<<<<<='=,=3=9=F=i==========	>g>l>q>>>>>>>*?5?>?C?W?]?b?u????????????400
0 0&0:0b0h0n0000000001$1<1B1V1\1q1|111111132Z2_2d22223 3S3b3l3t3~33333334.4@4N4_4@5S5x55555555666688888J9Y999-:5:<:A:M:Y:::::::::;;&;K;R;_;k;;;;;;;<:<V<d<i<n<<<<===W========>>&>,>3>8>K>a>l>r>>>>>?? ?%?9?M????P&0^0t0}00000001
1*1;1F1K1k111111111272R2s22222223*3>3C3H3\3333C4j44#5Z5`5t55555555 62686@6H6w66666677 777L7X7q777777778&8+8;8K8P8r888888889K9R9]9l9t9y9999999999:%:*:N:W:`:m:w:::%;=;L;g;;;;;;;<<<6<;<[<a<<<<<<
=]====*>>>o>>>R?X?c?p?????T001080D0L0S0v0|00000013181I1111222N2S2~2222333S3Z3_3333334-424V4\4j4w444444_5h5n55555555#6?6b66666'7Q7V777777777
8898D8a8j8w8|888888899'9-9j9p9v9999999999:*:4:U:Z:m::::::::::;,;K;b;w;;;;;;;;<'<5<:<?<<<<<>=C=>%>E>P>b>k>u>>>'?=?H?T?]?g???0%0,0000+1111122.2223333344244444555"585555556%6;6L6n6w66666667<7G7N7j7777	8/8L88889{99!:c:::%;P;;;;;<1<D<X<}<<<<<<<<===%===Y=k=w=}=======>(>/>N>T>u>>>>>>>>>(?>?D?N?y?00111111212222G33343494C4l44444-52575w55555(666667.797?7_77777
88A8888889!9D9M9`9999:;:_::::;
;=;;;;;;;;"<'<H<<<<4=9=\=v=======>1>6>\>w>|>>>>>>?"?7?S?\?a?t?????\L0P0k0p000\1j1111122
2222%2+21272=2D2L2T2\2h2q2v2|222222222222222333"3,363@3J3T3^3h3r3|3333333333333344 4-424?4D4Q4a4h4t444444445$5+51595C5M5X5]5m5x5~55555556Z6_6d6|666666#717;7F7`7q7777788"88889999:9:E:U:b:h:r:y:::::::;!;9;E;q;};;;;;;;<
<2<<<<<L0000000111*1112#2f2s222233333D4R4j444444445+5;5L5{5555555555686D6o6666777G7b7|7777888859j9q9|99999999: :*:0:P:l:q:::::::::;;-;2;G;N;T;;;;;;<B<<<==
==!='=.=4=B=H=N=Y=i=o=z============>>3>Z>b>w>>>>>>>?&?4?K?i?~???????? 0 0_0h0n0}000000000(1:1l1q11111 212L2Y2_2e2n2u2222243?3l3x33333334)4.4N4[4a4g444444455!5F5L5o5555777778@8`888888 9)9S9e9k9999999999::::4:::::::::::::;;;P000000 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0x0|00000000000026666666667777 7$7,70787<7D7H77

Anon7 - 2022
AnonSec Team