403Webshell
Server IP : 209.209.40.120  /  Your IP : 216.73.217.112
Web Server : Microsoft-IIS/10.0
System : Windows NT NEWWWW 10.0 build 17763 (Windows Server 2019) i586
User : NEWWWW$ ( 0)
PHP Version : 8.3.30
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Windows/System32/DriverStore/FileRepository/vdrvroot.inf_amd64_5cdebe29069284d7/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /Windows/System32/DriverStore/FileRepository/vdrvroot.inf_amd64_5cdebe29069284d7/vdrvroot.sys
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$��������������������������������������Rich��PEd�
��Վ�"
,�p�


 ��`A�P<�Xj@(�8!8P"T P�.text�
 h.rdataL @H.data0@�.pdata(@ @H.idataP$@HPAGE `* `INIT��F bGFIDS8�H@B.rsrcXj�lJ@B.reloc��@B����������������H��(H�=�t3�H��(�L�
�L��H�&H�
�H�p@DH��(���������������H��(L�T$`M��������	����H�D$PA�R$3�E�B(M�JI�BfA;R*soI�B@A�J(D��A8��	I�B8N��M��tM�BtKI�JH��I#�H;�u<A�I�B0�ʃ�I��A�A��J��B��E��tD�D���A�B*;�r�H��(�E2���A��D#����������������̸��������������������������������ff�H;
)uH��f����u�H��������������������̹�)���������H��8L�m3�H�L$`M��uH�D���L��E�D�AE3�H�L$(E3��AH�
,�D$ H�=>DH��8�������̋9u�B9Au�B9Au�B9Au��3�����������H��(�SL��H�
H�
H��=DH��(��������������H�\$WH�� H��H���mH��H���H�\$0H�� _����������H�\$H�l$H�t$WH�� 3�H��H��H��u
�vm�H���H�
�H��H��=DL�
�H��L�MH�VH��<D��xc��؅�xQ���؅�xFH��H���l�؅�x5H��@8h0t$H�OhH��H��HE�H��H�*H�Gh3�������H�\$0H�l$8H�t$@H�� _�������H��(H��H��tH���H;�t�=�m���H��(���������H�\$WH��03�H�
�H�=�H;���L��L;�szI�@H;�wlA�8Pu_I�XPH;�w]I�@8L��H��t H�
�;H�M��L����<�H��H�
�H��;D��xL��H;�됸���{�H�\$@H��0_���������@SH��0H�H�
�H�H;�tXH;�wSH�C@H��t L�#H��H�
E;L���;�H�H�
lL��H�";DH��PH;�v�H��0[�������H�\$WH�� H��H�=�H;�v�{��,H����;(u)H�C H��t
��;H�CH��(H;�r�3�H�\$0H�� _ø���������������������H��(M�A8H��I����H��(��������H��(A�L��D��L��A��tA�@McP��L�Hc�L#�Ic�N�H�B�HH�B�T��t	�ƒ��L�M3�I���Z���H��(������������ff���������������������������������L��H+���I��OsXM��I��tDH�H��I��H�A�u�I��tf��H��I�ȈA�u�I���ffffff�����������H��rp�ك�tL+��Ao�AI�M��I��I�� �vI���o�oLH�� fA�fI�I��u��O���fffffff�ffffff���t��I�ȈH����u��f�������������������H��r��D@H�����u�H����o�oLf�f�IH��@�oD��oL�f�A�f�I��u�I��I��s��$M��I�������y������������������I�I��OsOM��I��tH�D�H��I��H�u�I��tf��D�H��I�Ȉu�I���ffffff�������H���wtH����tL+�H���oD��@�H�M��I��I�� �vI���oD��oL�H�� fAf	I��u��T���fffffff�ffffff���t�H�ɊI�Ȉ��u��f�������������������H�����w��H��D@��u�H����oD��oL�f�A�f�I�H��@�oD�of�Af�	��u�I��I��s��$M��I�������~����������H��I��rG��I�I��I��OsPM��I��I�fDJ�T�I��u�I��tJ�T��f�I��t
B�T�I��u��fffffff�fHn��L�H��H���L+�M��I��t/))AH���)A�)A�I��)A�)A�)A�)A�u�I��M��I��tfDH��I��u�I��tBD��̄�������@���A�B*3�A�R$A�R(I�RI�Rf���y���I�J0���ș���3����Lc�I��������Q������������H��(H�
=H��u3�H��(�H�Z5DH�H��(����������H��XH��H3�H�D$@H�D$0H�D$ �z���H�L$@H3��-���H��X���������H��8H��L�ND�ʺ+H�D$ �n5H��8����������D�L$ H��HH��L�L$hH�D$0H�D$(L�L$ D�ʺ+�%5H��H���������L��E�K H��XH�fI�S(I�C�A�!I�C�I�S�I�S I�C�I�SȺ+E��L����4H��X����������L�L$ H��HH�L�D$hH�D$0D�ʺ+H�D$(L�D$ L�@�r4H��H���������������������̀�w)��tA�@A�A,A�@A�A)I��3�A�A)A�A,I�A����������H�T$L�D$L�L$ SVWH�� 3�H���	L��D�׋ߋ��u<D�FA��u1fA;�w+���fD;�w H�VH��uf��ufE��uA��L��H����
���x5L�L$PM��H��I��H�Q3D��xH�H;�vH�ÿ�f�f���H�� _^[����������H��HL��M��tH�����fA�|AH�@u�H�E��
M��H�D$0�H�L$(H�I��LD�L�VH�gL�L$ D�ʺ+��2H��H��0��P��P����!�8
PP\DosDevices\GLOBAL\VDRVROOTP�4.X�B�����Z�ڙ��H��<�D�UEtwUnregisterEtwRegisterClassicProviderWmiQueryTraceInformationWmiTraceMessagePsGetVersion�H䶅��� �f��Վ%P%P��Վ
�x%x��Վ����>�}$�mVC�e��KmdfLibraryrrrrAqAq!r!rUpr\Registry\Machine\System\CurrentControlSet\Services\FsDepends�-���f{4M%ڥJ���_���G��@PŠ� �NULL{8e7bd593-6e6c-4c52-86a6-77175494dd8e}\MsCompatibleVhdHba{8e7bd593-6e6c-4c52-86a6-77175494dd8e}\MsVhdHbaVHD Bus 0%02dMicrosoft_VHD_ISO_VHBA_%02d�0�Aű5�׶Z�MniRSDS+��K�=Y��oS+�vdrvroot.pdbUGPP.text$lp01vdrvroot.sys!35_hybridbootP�.text$mn0.text$mn$00@*.text$mn$21jV.text$zy�*.text$zz .rdata$brc!.giats!�.rdata�"8.rdata$00�"0.rdata$PAGE$zz#@.rdata$zzP%�.rdata$zzzdbg)<.xdata0.data$00$brc0�.data$dk00$brc�0.data�0.kmdfclassbind$a�0.kmdfclassbind$c�0.kmdfclassbind$d�0.kmdftypeinit$a�0.kmdftypeinit$c�0H.bss(1X.bss$00�1x.bss$dk00�3.bss$pr00@(.pdataP�.idata$5�P.00cfg�P(.idata$2Q.idata$3 Q�.idata$4�Q..idata$6`�PAGE$lp01vdrvroot.sys!35_hybridboot�d�PAGE$zyfPAGE$zz�@INIT@�ZINIT$lp01vdrvroot.sys!35_hybridboot��_INIT$zy�8.gfids�`.rsrc$01`��h.rsrc$02 t-(P�8"4,`]`)"`]`)"4,�d�d@)	d4p"@���d)R0"�b8c�)�.BB"`"�)

4
Rp
dT4
rp20d42p4
rp4�p`P

4
2p
dT4r����p		��b��@B,4~x�
�p`P��2p`0
dT42pBR0
	
4
2p0� 1��"��"�0�"���3�2��-�+�] �f���0�R�)`"�)`~�)���*4c+p�P*���*��+���)�+v(+��+�+ %8+@y@+�iH+j��)���*8�*@o�*x��*��*$k�*�g�*p��)`]`)]`�b()�b8c�)@c�d�)�d�d@)�d�eP)�ef�)f�f�)gj<*0j�j*�j�k,*�kIl�)Pl1m�)@m�n*�nho*po�oP*pAr`*Pr�rP*�r {�*@���d)����|)�S�S�S�SfR�R�R�R�R�R�RFRS6SJSbSrS�S.R�SRRS�Q@� �HQ�S(P QTP�S�S�S�SfR�R�R�R�R�R�RFRS6SJSbSrS�S.R�SRRS�QBIoReportRootDevice�KeEnterCriticalRegion
ZwLoadDriver�RtlInitUnicodeString�ExAcquirePushLockExclusiveExExReleasePushLockExclusiveEx{EtwWriteTransfer�KeSetEventuEtwUnregisterExReleasePushLockSharedExMmGetSystemRoutineAddress�ExAcquirePushLockSharedExpEtwRegister�IoWMIRegistrationControlKeInitializeEvent�KeWaitForSingleObject�KeResetEvent=KeLeaveCriticalRegion�
_vsnwprintfntoskrnl.exe`RtlCopyUnicodeStringWdfVersionUnbindWdfVersionBind	WdfVersionUnbindClassWdfVersionBindClassWDFLDR.SYS����������������H�|$ UH�l$�H��@H�g��H3�H�E8L��H�T$8H�
���H�=���H;�t�A,��*�=���H��$`�7H����A�*H�
i������H���B�3�H�M�D�B`�۸��H�T$8H��H�
0��L�E�H�E�E3�H�.���E�`�E�H�����H���L�L$0H�
���H�T$8E3�H��X����؅���3�H�L$`D�B`�Y���H�T$0H��H�E�H�L$@H����L�D$`�D$``E3��D$h�D$m�D$d�E�����H���H�L$ H�
f���P��؅���H�_��L�����H�T$0E3�H�
9��H��h���؅���H�C���H�L$HH���DH���L�D$HH�T$0H�
���H�������؅��rH����A�H�T$0A�H�
���H������k���H����L�E H�T$0H�
���E H�E0H����k�E3�H�
Y��3�H���DH�
t��H;�t�A,��
��H��$`H�M8H3�议��H��$hH��@]��������������@SH��0H���H9��tL�\��H�
������H�-��H�K8H�L�k���H�L$ L��H�K3���H�[H��u�H��0[���������H��HH�;���D$PH�L$0H�9�DH�L$0H���DH�|���H����H�L$0H�	�DH�L$0H���DH����H����H�L$0H���DH�L$0H���DH�t��H�]���[��H��tE3�H�L$PE3�3����|$ProH�u���H�L$0H�y�DH�L$0H� �DH����H��t:H� ���H�L$0H�D�DH�L$0H���DH��������H��HÀy)����H�I�
茷��H�T$8���H�
W��H;�t�A,�t�y)rH�I��w��������H�
&��H;�������Q,��������y)������D����D��H�IL������]�����d���H�
���H;��m����A,��I����y)�?����D���H�
���H;��>����A,������y)�����D���H�
z��H;������A,�����y)����Z����y)���H�IL����D��譵�������̃��W���H�
��H��H����H�p�D��/����������������H�\$WH��0H��H�
���H�=���H;�t&�A,�t�y)rH�IL�X����D�J��"���H�
���3�H�D$PH��H�����D$P�D$TH�� �M�H�
f��L�D$PH��E3�L�QHH�
@��I��'���H�
F��H;�t(�Q,��t �y)rH�IL�ȼ���D��蓴����H�\$@H��0_���������������H�\$L�L$ L�D$UVWH��PH��H��H���DH����H��H�
���H������H��H�
���H�-���H;�t�Q,��t�y)rH�I�L��詴����$�=,Y-��=8�-t
���H�S��L�L$8H�
7��A�H��H�D$ H��h���؅�yCH�
#��H;����Q,�����y)��H�IL������D���d����H�T$8��؅���H�
���H;��}�A,��r�y)�h��fH����H��$�H�L$ L�L$HH�
o��A� H��H��h�I��؅�yBH�
d��H;���A,��
�y)��H�IL�ֺ��D��覲����H���H��$�H�L$ L�L$@H�
���E3�H��H��p����؅�y,H�
���H;����A,����y)����D��$�H�D$0L�D$HH�΋�$�H�D$(H�D$@H�D$ ���؅�y#H�
���H;�t<�A,�t5�y)r/��*���H�\��H��D�D$0H�
=��H���� �3�H�7��D��H�
��H��H��8���H�
��H;�t�A,�t�y)rH�I��>���H��DH�\$pH��P_^]����������������������@SH�� H��H�
���H����H;�t�A,�t�y)rH�I��ٰ��H����H��H�
p��H����S����9���H�� [��������H�\$H�T$WH��@H��3�H�
��H���D������u]H�<���H�L$0H���DH�L$0H���D�ظ����u�����H������؅�x~�������uk3�H�
���H���DH�D$XH�D$X��-�A�H�D$ E3�H�
l��3�H��D3�H�
=��H���D�=:��u
�.��3�3�H�
��H�|�D��H�\$PH��@_�������H�\$WH��03��:t��
��&�=���uRH�����RH�
�������؅�y5H�
���H����H;�t�Q,��t�y)rH�ID�ˉ|$ 舯�����3�H�\$@H��0_��������H�\$H�l$H�t$WH��@��H��3�H�
F��A��I��H���D�==��w63�H�
"��H���DH������xn3�H�
��H���D�=���u4H�L$xD��H����L��H�L$(��H�L$pH�L$ H�
������������3�H�
���H�3�D��H�\$PH�l$XH�t$`H��@_����������������H�\$H�t$WH�� H��H��H�
���H�5���H;�t�A,�t�y)rH�I�轭��H�&�D3�H�
 ��H���D�
���A����������������H�
���H�=���E3�3�)���K)
���C )����K0�
���H�&�DH�
��H;�t%�A,�t�y)rH�IL�e���� E3��0�������tH�h���觬��3����3�H�
I��H���DH��DH�t$8��H�\$0H�� _��������@SH�� H��H��D3�H�
���H���DH9���un�=���ueH�
���H���D3��������H�w��H�x��H�y��H�z��H�{��H�|��H�}��tH�T�����3�H�
n��H���DH�+�DH�� [���������H�\$WH�� H����H�=x���H;�tY�������u.H��tBH�K8H��tH������%�H�C8H�[H��u����u��H��H���DH�=���H�\$0H�� _����������������H�\$H�l$H�t$ WATAUAVAWH��@L��$�3�M��D��A��A�]A��	��H�
��������"H������H��$���H��L� ff�H�@��H��u���?v
�
�������M��uD���
D��A�/��A�A;�wtE��3�I���Ũ��A�.E�fA�vM��tA�A��I�f�H��E�I�W�W�����t,I�N(��H�GH�I �A�AЈ_)�_,H�H��u�A�m��#�A����A�.A�E��H��$�H��t(A��0�(���I�V@H�O蛠����uH�H��u껕��A��u�_)�_,H�_��=����I�FH�D$0H�Gu`H�����L��$�A�L�t$ H�T$pA�H������u�D$p�G)H�i���H�W,�L�t$ L��$�D�A��������D$4�G,�D$2�G)���L�\$@��I�[8I�k@I�sHI��A_A^A]A\_����������������H�\$WH�� H�����H��H��I��H�
w���H�@�]��D�CH���Q��H�
p���H�i���H;�t&�Q,��t�y)rH�IL�k����
D��趨����H�\$0H�� _����������H�\$UVWAVAWH��$@���H��H�����H3�H���(հ��H��(
װ��E3�)�0A��(Ӱ��)�P(��A�wH�D$H����)�p(��)�@(
����������)��(߰��)�`(
����f���H��0)��(հ��)��(
����H�D$hH���)��(Ͱ��)��(
����H�D$X���)��ư���� H��)��(
�����H�T$0�D$@��D$`tv)��D$P^`�D$pH�D$xL�|$8H�
����L�5����I;�t(�A,�t!�y)rH�I�V�E��L�������H�T$0H�d���A�*H�
G���H���*��H�C���L�D$PH�T$0H�
"���H�������؅�yCH�
 ���I;���Q,�����y)���D��H�IL�����a����H�վ��L�D$PH�T$0H�
����H��������؅�y/H�
����I;����A,��e�y)�[�
D���H�{���L�D$`H�T$0H�
Z���H����=���؅�y2H�
X���I;��G�A,���y)��D���4���D��H�����H�L$@�Ѧ���؅�y2H�
���I;����A,����y)���D�����H�ҽ��L�D$@H�T$0H�
����H��������؅�y2H�
����I;����A,��b�y)�X�D�����H�u���H�T$0H�
Y���H����<��3�H�M�A���Ӣ��H�T$0H�w���H�
(���L�E�H�EPH�)����E�H�������D��H�����H�L$@����؅�y2H�
����I;����A,����y)���D������H�
ʸ��I;�t�A,�t�y)rL�L$HH�I����H�����L�L$pH�T$0L�D$@H�
u����D$ 	H����P���؅�y2H�
k���I;��Z�A,���y)��D���G���H�1���A�	H�T$0H�
���H�������H����L�L$8H�
��H�T$0E3�H��X�����؅�y/H�
��I;����A,����y)����D������H�T$8L�EpH�
����3�H�Ep�0H���H���H���H�~����up�EtH�ExDž�Dž�HDž�Dž�Dž�������H������foP���L���H�T$83�H�
�H���H���H���HDž�Dž����Dž�H�������3�D�F H����0���H�����L���foګ���H�T$8H�
q���Dž�PDž�Dž�Dž�Dž�Dž�Dž�HDž����Dž����Dž������Dž�f��Dž�Dž�H�������H�ֹ��D��H�T$8D��H�
����H�������H�T$8H��H�E�H���H�E�H���H�E�H�1��E�0H�U�H�
g���L�E�H�E�3�H�E�H�E�H�E�H�E�H�E�H�
���H�E�H�G����u�L�}�H�� �����H�
2���I;�t%�A,�t�y)rH�IL�5����D��耠����H���H3��W���H��$�H��A_A^_^]���������H�����H��tH�2��-�+H;�tH��H�k���ù�)�����������H�\$H�t$WH��H��H��賏��3�H�����H���H�5h���H�i���H�5j���H�5s�����H�5g����2�H�
[���H�5T���H;�t�A,���3�H��$�H�D$xL�L$`H�D$`L��H�D$pH��H��$�H��$�H��$�H�1�H�D$h3�H�D$@H�D$PH�D$XH����H�L$(H�L$@H�D$HH�Ʋ���D$`8�D$x�D$|�D$@ H���H�L$ H�
�����m�������CH��H�A��DL��$�I�[I�sI��_�̀y)����H�I�
莙�������H�
A���H;�t$�Q,��t�y)rL��$��H�I�<������֘�������`0@�p��`g0j@m�npPrL�0�0�H�`�x���������	�			 p	����=`�t&��
WEVT_TEMPLATEMUI�0�0�PPMpMpd��������2�3��
d�f�<n�~������|������������"�М#(Starting an IO.

,Completing an IO.

Error

Warning

 Information

Verbose

 IO request

8Microsoft-Windows-VHDMP

PMicrosoft-Windows-VHDMP/Operational

@Microsoft-Windows-VDRVROOT

XMicrosoft-Windows-VDRVROOT/Operational

|The VHD %1 has come online (surfaced) as disk number %2.

�The VHD %1 has been removed (unsurfaced) as disk number %2.

`Failed to surface VHD %1. Error status %2.

|Failed to surface VHD %1. Surface attempt was cancelled.

TFailed to %1 VHD %2. Error status %3.

�Operation failed on VHD %2. Operation type %1. Error status %3.

The Vhd Chain for VHD %4 is corrupted. The expected LastWriteGUID %2 (%3) did not match the parent's actual LastWriteGUID (%1).

�The change tracking file for VHD %1 is corrupted and cannot be read. No change tracking information will be available for this VHD, and change tracking will need to be enabled again before changed are tracked.

�The VHD file %1 has been modified without updating its associated change tracking file. Because the consistency of the change tracking information cannot be ensured, the change tracking data has been reset. No change tracking information will be available for this VHD, and change tracking will need to be enabled again before changed are tracked.

�Error %2 occured when attempting to update the change tracking file for VHD %1. This will invalidate the file's change tracking information. Change tracking will not be available for this VHD until change tracking is enabled again.

�Surface for VHD %2 is invalidated and will be removed (unsurfaced) because of a %1 operation failure with status %3.

XPerforming %1 VHD for %2 (target '%3').

LSuccessfully performed %1 VHD %2.

�Vhd resiliency initiated for %1 (VM ID: %2). A %3 IO failed with error %4.

tVhd resiliency successfully recovered %1 (VM ID: %2).

�Vhd resiliency failed to recover %1 (VM ID: %2) with error %3.

�Recovery initiated for %1 (VM ID: %2) due to an IO failure with error %3.

XRecovery succeeded for %1 (VM ID: %2).

lRecovery failed for %1 (VM ID: %2) with error %3.

HFile %1 is invalidated (VM ID: %2) from current mode %3 with error %4. Any recovery in process will be failed and the virtual disk will be invalidated as well.

�Waiting on file (%4) recovery for %1 (VM ID: %2) due to an IO failure with error %3.

�Waiting on file (%4) recovery for %1 (VM ID: %2) completed with status %3.

lFile (%3) recovery succeeded for %1 (VM ID: %2).

�File (%4) recovery failed for %1 (VM ID: %2) with error %3.

PFailed to open file %1 with error %3. The file handle was previously invalidated due to a critical error. This operation will be retried periodically. (VM ID: %2).

�File %1 has been closed before initiating a recovery attempt. The file was open in mode %3. (VM ID: %2).

�Recovery attempt initiated for virtual disk %1 (VM ID: %2).

�Recovery attempt completed successfully for virtual disk %1 (VM ID: %2).

�Recovery attempt for virtual disk %1 failed with status %3 (VM ID: %2).

\Reopening handles to file %1 (VM ID: %2).

�Waiting for handles to file %1 to be reactivated (VM ID: %2).

�Recovery attempt completed for file %1 with status %3 (VM ID: %2).

lI/O failed with status %3 on file %1 (VM ID: %2).

�Change Tracking has been enabled for the VHD %1 (%2) with log file %3.

xChange Tracking has been disabled for the VHD %1 (%2).

�Change Tracking for the VHD %1 to the log file %2 has been stopped due to the error %3.

�Flushing of the header of the log file %1 has failed due to error %2.

�Flushing of the buffers to the log file %1 has failed due to error %2.

�Opening the log file %1 for tracking has failed due to error %2.

�Offline changes are detected for VHD %2. Log file: %1, VHD time: %4, Log file time: %5

(Starting an IO.

,Completing an IO.

�A %4 %3 IO to %1 (VM ID: %2) failed with error %7. Recovery of this virtual disk has been initiated. If this IO was initiated by a VM then it will be internally retried later when the virtual disk has successfully recovered.

�A %4 %3 IO to %1 (VM ID: %2) failed with error %7. Recovery for this virtual disk could not be initiated either because this is not a recoverable failure or recovery has failed or the virtual disk is in an invalid state.

�The VHD HBA driver is registered with the root enumerator.

�The VHD HBA driver is unregistered with the root enumerator.

Write

Read

Flush

$Offload write

$Offload read

$Project read

$Project write

Unmap

(Get LBA status

<File wrapper access check

Storport

Private

Internal

Mirror

,Read-only, shared

4Read-only, exclusive

4Read-write, exclusive

Invalid

,Shared Reference

0Exclusive Reference

$QoS Reference

CRIM�=Fc���O��y@���8�H䶅��� �f<WEVT�;�	�P�
2L2�2h3�3�3CHAN�������LMicrosoft-Windows-VHDMP-OperationalHMicrosoft-Windows-VHDMP-AnalyticMAPS�8l�VMAPd�
��������		�

�VMAP4���
��VMAP4d����VMAP,����FileModeMap$FileRefTypeMapIoTypeMapSrbTypeMapTTBL0/TEMPH��CpH&aWW�\!�/����D�	EventDataA��A�oData)K�NameVhdFileName
A��E�oData-K�Name
VhdDiskNumber
�VhdFileName VhdDiskNumberTEMP���c��U�\��P���bD�	EventDataA��A�oData)K�NameVhdFileName
�VhdFileNameTEMP,�����{�V�Y�,-d����D�	EventDataA��A�oData)K�NameVhdFileName
A��7�oDataK�NameStatus
�VhdFileNameStatusTEMP�8�V��Y�)5��פ8���D�	EventDataA��=�oData%K�Name	VhdIoType
A��A�oData)K�NameVhdFileName
A��7�oDataK�NameStatus
lt��VhdIoTypeVhdFileNameStatusTEMP��T
G�v�x]�y�I�5u���D�	EventDataA��?�oData'K�Name
VhdMetaOps
A��A�oData)K�NameVhdFileName
A��7�oDataK�NameStatus
	0	L	VhdMetaOpsVhdFileNameStatusTEMP��
ҷ�^��~T��$��!���D�	EventDataA��?�oData'K�Name
VhdMetaOps
A��A�oData)K�NameVhdFileName
A��M�oData5K�NameTargetVhdFileName
�
�
VhdMetaOpsVhdFileName(TargetVhdFileNameTEMP�T�N�"���Q�D��'���D�	EventDataA��A�oData)K�NameVhdFileName
A��A�oData)K�NameVirtualDisk

A��A�oData)K�NameLogFileName
�
��VhdFileNameVirtualDiskLogFileNameTEMP@�
!�aqZ��]Ј�,2P<���D�	EventDataA��A�oData)K�NameVhdFileName
A��A�oData)K�NameVirtualDisk

�

VhdFileNameVirtualDiskTEMP�@C���aU��X䧵����D�	EventDataA��A�oData)K�NameVirtualDisk

A��A�oData)K�NameLogFileName
A��7�oDataK�NameStatus

|��VirtualDiskLogFileNameStatusTEMP,��!���?^������D�	EventDataA��A�oData)K�NameLogFileName
A��7�oDataK�NameStatus
��LogFileNameStatusTEMP,��!���?^������D�	EventDataA��A�oData)K�NameLogFileName
A��7�oDataK�NameStatus
�LogFileNameStatusTEMP,��!���?^������D�	EventDataA��A�oData)K�NameLogFileName
A��7�oDataK�NameStatus
8LogFileNameStatusTEMP����G�A5\z�a�*FA���xD�	EventDataA��A�oData)K�NameLogFileName
A��A�oData)K�NameVhdFileName
A��7�oDataK�NameStatus
A��A�oData)K�NameVHDFileTime

A��A�oData)K�NameLogFileTime

\x�
�
�LogFileNameVhdFileNameStatusVHDFileTimeLogFileTimeTEMP���Z��Yn_;�;�-}���D�	EventDataA��Q�oData9K�NameParentLastWriteGUID
A��c�oDataKK�NameExpectedParentLastWriteGUID1
A��c�oDataKK�NameExpectedParentLastWriteGUID2
A��A�oData)K�NameVhdFileName
� `�,ParentLastWriteGUID@ExpectedParentLastWriteGUID1@ExpectedParentLastWriteGUID2VhdFileNameTEMPT���D�X=Wv�4��+���D�	EventDataA��A�oData)K�NameVhdFileName
A��K�oData3K�NameCorruptionReason
��VhdFileName(CorruptionReasonTEMP���c��U�\��P���bD�	EventDataA��A�oData)K�NameVhdFileName
�VhdFileNameTEMP`h�C6qp̤X�T���ig��\D�	EventDataA��5�oDataK�NameVhdId
A��=�oData%K�Name	VhdIoType
A��?�oData'K�Name
VhdSrbType
A��7�oDataK�NameOffset

A��7�oDataK�NameLength
�l���

$VhdIdVhdIoTypeVhdSrbTypeOffsetLengthTEMPe���~V��)Y�EG���D�	EventDataA��9�oData!K�NameVhdFile
A��7�oDataK�NameStatus
,@VhdFileStatusTEMP,` ���wo@_<� `�����D�	EventDataA��9�oData!K�NameVhdFile
A��3�oDataK�NameVmId
A��=�oData%K�Name	VhdIoType
A��?�oData'K�Name
VhdSrbType
A��7�oDataK�NameOffset

A��7�oDataK�NameLength
A��7�oDataK�NameStatus
� !l!�(!

D!X!l!VhdFileVmIdVhdIoTypeVhdSrbTypeOffsetLengthStatusTEMP��"}�kް%S�3+��%q���D�	EventDataA��9�oData!K�NameVhdFile
A��3�oDataK�NameVmId
A��=�oData%K�Name	VhdIoType
A��7�oDataK�NameStatus
#0#l@#X#VhdFileVmIdVhdIoTypeStatusTEMP4$�^�@�Su�)�9�4���D�	EventDataA��9�oData!K�NameVhdFile
A��3�oDataK�NameVmId
\$p$VhdFileVmIdTEMP|�%��MP�_U,�F4�K<����D�	EventDataA��9�oData!K�NameVhdFile
A��3�oDataK�NameVmId
A��7�oDataK�NameStatus
�%�%�%VhdFileVmIdStatusTEMP|'��MP�_U,�F4�K<����D�	EventDataA��9�oData!K�NameVhdFile
A��3�oDataK�NameVmId
A��7�oDataK�NameStatus
@'T'd'VhdFileVmIdStatusTEMP��(|]�/���\����±����D�	EventDataA��9�oData!K�NameVhdFile
A��3�oDataK�NameVmId
A��3�oDataK�NameMode
A��7�oDataK�NameStatus
)),)<)VhdFileVmIdModeStatusTEMP�,+4��Z��0�����D�	EventDataA��9�oData!K�NameVhdFile
A��3�oDataK�NameVmId
A��7�oDataK�NameStatus
A��9�oData!K�NameRefType
A��3�oDataK�NameMode
A��S�oData;K�NamePendingRecoveryCount
�+�+�+8�+�+,VhdFileVmIdStatusRefTypeMode0PendingRecoveryCountTEMP�x-�Q�kn�?R&���mx�g��D�	EventDataA��9�oData!K�NameVhdFile
A��3�oDataK�NameVmId
A��7�oDataK�NameStatus
A��9�oData!K�NameRefType
�-�-�-8.VhdFileVmIdStatusRefTypeTEMPx�/�.��TKr���3���hD�	EventDataA��9�oData!K�NameVhdFile
A��3�oDataK�NameVmId
A��9�oData!K�NameRefType
A��3�oDataK�NameMode
A��S�oData;K�NamePendingRecoveryCount
0(0880L0\0VhdFileVmIdRefTypeMode0PendingRecoveryCountTEMP|�1��MP�_U,�F4�K<����D�	EventDataA��9�oData!K�NameVhdFile
A��3�oDataK�NameVmId
A��7�oDataK�NameStatus
�1�1�1VhdFileVmIdStatusPRVAD2Microsoft-Windows-VHDMPOPCOh��0p2��0�2 VHD_START_IO$VHD_COMPLETE_IOLEVL�P�2P3P$3PL3win:Errorwin:Warning(win:Informationalwin:VerboseTASKDMMp��.����A��w�2�P�3VHD_IO_TASKKEYWEVNTP,����2�����2�����2���,�2�����2��� �2�����2�����2�	�	��2�
�
���2��� �2�2�2�`	�2�3�3���2�d�d��!�2�e�e�l#�2�f�f��$�2�n�n��%�2�o�o�l#�2�p�p��$�2�q�q�x'�2�r�r�P)�2�s�s�0,�2�t�t�.�2�u�u�P)�2�v�v��$�2�w�w�x'�2�x�x��0�2�y�y��0�2�z�z��0�2�{�{��0�2�|�|��0�2�}�}��0�2�~�~��0�2�����,�2�������2�����$�2�������2�������2����� �2�����L�2���M@���X2�2t3���M@���d2�2t3��@��T�2��@��T�2�WEVT��P<
�<==X=d=p=CHANpl<�TMicrosoft-Windows-VDRVROOT/OperationalPRVAL�<Microsoft-Windows-VDRVROOTOPCOLEVL@P0=(win:InformationalTASKKEYWEVNTp��$=\<��$=\<�4VS_VERSION_INFO��
cE
cE?�StringFileInfo�040904B0LCompanyNameMicrosoft CorporationdFileDescriptionVirtual Drive Root Enumeratorh$FileVersion10.0.17763.1 (WinBuild.160101.0800):
InternalNamevdrvroot.sys�.LegalCopyright� Microsoft Corporation. All rights reserved.B
OriginalFilenamevdrvroot.sysj%ProductNameMicrosoft� Windows� Operating System>
ProductVersion10.0.17763.1DVarFileInfo$Translation	����|����5��
�GX��uS��	��Ss��e�*����WEVT_TEMPLATEMUIMUIen-US X�p�x�������0�@�H�P�`�x���PРؠ��,A���R2�YT�t�8]`��qy�XsiS�s�S�s�St)TMt^T��:���z�8�f�{���x|�<�|=�����o�{>�����J�V?ӿ�x��SCT�TOU d[�[\`\�]`4�P�PQ�Q�Q�Q0RgR#S�S�V�V@W�W�XY�Y�YZ�[�\�_p,�QRuR�T�T;U�U>V�V�V�W�WX�X8YZ<Z�Z�eQpO 8!0�!+	*�H��
��!0�!10
	`�He0\
+�7�N0L0
+�70	���010
	`�He �
�mpn�f��Q2&��Y�F����f�+�,O]��
�0�0��3�"���y=���0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110
180703204550Z
190726204550Z0p10	UUS10U
Washington10URedmond10U
Microsoft Corporation10UMicrosoft Windows0�"0
	*�H��
�0�
�����p�����T�C:(N�,��Y��f��܅�eJ���h�8��<�"o;l�`�ӜI��[N"l��O��B������.9^��8�|۳��Yn�o&�	3��8U��4Qm�u��	F-}~�۩�E� CM�Ś�s� �����Ꞔ���-I�0o�"��k(�)�PX"#�[�nԍ�	ӆ�����G��\d�X�t�$pN��z�v��P���c���'�z���Y,�;7%	�w���0�~0U%0
+�7
+0Uqr��5�o1�!���A10TUM0K�I0G1-0+U$Microsoft Ireland Operations Limited10U
229879+4379540U#0��)9�ėx͐��O��|U�S0TUM0K0I�G�E�Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a+U0S0Q+0�Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0U�00
	*�H��
�gr0���j�
8�ր�D��iSHp6�:Ik~՘��z�p/c�������QB�����v+��?�r�ѕ�m��׺@gM����,^�x֔�WG�y��)CK��s��p���fuV��t���ae��a
�[ު�{bs�z�x[j>{��C��y~t�������*&4��E���v|�^:�1��nwV*@�H#hI����$50lzs��ډ�P����J�vj�e�;/�kt�*0��0���
avV0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
111019184142Z
261019185142Z0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110�"0
	*�H��
�0�
�����.	����i�!�i33��T����� ��ҋ�8����-|by��J?5 p���k�6u�1ݍp��7�tF�([�`#,��G�g�Q'�r��ɹ;S5|���'�����#	o�F��n�<A�ˣ?]jM�i%(\6��C
��������['�'x0�[*	k"�S`,�hS��I�a��h	sD]}�T+�y��5]l+\μ�#�on�&�6�O�'��2;A�,���w�TN�\�e�C���mw�Z$�H��C0�?0	+�70U�)9�ėx͐��O��|U�S0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
	*�H��
��|qQ�y�n��9>�<Rn+?s��h�H�4M��&�1F�ay�8.Ek��(�����	��L
6fj���������@26v�Zƿ���Ӭ�h�b��TlP0X��|���N���|�sW�R!s4Z�V��	����~�����?�rS��c��=1e�������=����BА�_T���G�o�sNA�@�_�*��s�!(���s9_>�\`����	���Q�fG���=�*hw��Lb{��Ǻz�4Kbz����J7�-�W|�=ܸZ��ij�:��n�i!7ށ�ugӓW^)9��-���Es[���z��FX�^���g�l5��?$�5�
u�V��x,��Ј���ߺ~,c��#!�xl�X6+�̤��-����@�E�Ί\k>��p*
j�_G��c
2��6*pZ�BYqKW�~���!<��Ź���E��� ����ŕ�]b֠c �uw}=�E�����W�o3��w�bY~1��0��0��0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113�"���y=���0
	`�He��0	*�H��
	1
+�70
+�710
+�70/	*�H��
	1" �����A�a����L��&��|�!�R�0<
+�7
1.,sjH6jFEnf/I5hssG+Rv+ef59PCd+alVxgFDnWWi22bk=0Z
+�71L0J�$�"Microsoft Windows�"� http://www.microsoft.com/windows0
	*�H��
�dd4Rk�NBt���/��$�O�gԊf>"Z}t(WuIu/a'͎�J�Y_�(ց��k�5�Kx-��:|}`�C*8A�w	ƞ�@tP��p3x���W�@[>h{��!�4��~c�#�}2�؟.6Y��7��D�͖��q��½3��4���2u:s�QuB)�ɀ�&���CX�f�T�v�V��և�=�=gO�?�>�R��'�n�����$2�j@��0�	A{v��E��L���x��Z~b֥O����0��
+�71��0��	*�H��
���0��10
	`�He0�Q*�H��
	��@�<0�8
+�Y
010
	`�He x`|�A����j~aҜ��<�^P)z��7�Ra[�
h'�20180915013010.355Z0����0��10	UUS10	UWA10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1&0$UThales TSS ESN:179E-4BB0-82461%0#UMicrosoft Time-Stamp service��<0��0�٠3۪m�"4%�0
	*�H��
0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
180823202653Z
191123202653Z0��10	UUS10	UWA10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1&0$UThales TSS ESN:179E-4BB0-82461%0#UMicrosoft Time-Stamp service0�"0
	*�H��
�0�
������$�K6n�;�OT\�S
��0Ϊ 0ޖ��&
u0�	�%
�M�R��t����	a��)���V	���������ݡ�cfc̳?v�H���j��`&,o�2~�n�}"��(&�gw;��eb _���T?k=#�)e!�9�E��u��"�F�Q�s���-<���5�߷Ԫ�8�P��?�Da��:�ֱ
�㾁b����\C��o"�Y]M,#�
�4/�z6�-�ods1��ӳ%/�M��0�0U����\s�Ͷ�����*CH0U#0��c:\�1��C{|F�3hZ�mU0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0U�00U%0
+0
	*�H��
�Bš��`~"G�$違�^nWcQ��G엓Y1LXi ���O���P2���8@��q�Vv(��C�f�d}Z���,�������ٹ�0�z;�F����k/�`���vȂ�Lu���=�Et@�������B��O+�G8����,����=�ɍI>��ѯ�1W��3�—Fg����>ݭ�2�LF�ld�ȣq��m��Df�\��_����R�XX��{���Bs�Q�J�p�:ZTd=!�0�q0�Y�
a	�*0
	*�H��
0��10	UUS10U
Washington10URedmond10U
Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100
100701213655Z
250701214655Z0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100�"0
	*�H��
�0�
��
�w�: ����i�ktTե
����|hK,_���a�v�>f+[�S'1A��	�|a0Y�0D�`��TC�M�8�Bݓ��s0W&��E
��G�Ϳ$`2X`F�XG�2�tag�_�T�ϓL��Ħ]�an(������a�F�'$gr!��Kd�Pb�]�w=�Wu���BM@Q��>g�f��D~��K�n�ʱ��z*
1��N���5�x���<�/D����d��� 	�x����D]^�O"M���0��0	+�70U�c:\�1��C{|F�3hZ�mU0	+�7
SubCA0U�0U�0�0U#0��Vˏ�\bh�=��[�Κ�0VUO0M0K�I�G�Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0�>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��U ���0��0��	+�7.0��0=+1http://www.microsoft.com/PKI/docs/CPS/default.htm0@+042 Legal_Policy_Statement. 0
	*�H��
��Q
���?�q=���!o���1����Wm0���f�j���x�Ǩ�%��kTW+Q�D��S���`�v�@@A��\�\�^5�$VKt�Bȯ���7}Z?�yJ�R�8�/y�e٩�k����zoK0D$"<�����Y)����p�2J'�U�/���3�b_��W@��Ιf���jb��J�&�9�Jqc�{!mÜ��<�}�j�x�m���8ؔ�ƥ
������B�����"8 �%�d��~cY%z.9Wv�q����a�˚�G����ͧ��}���;q	�]t�"aڰPo�����1��:�eGx�H���r~akow��˧	�9����؂�r�����*T9�[��
U�z�s;�-��3.)��/T'!�ȬN�(���ۖ��B���AM�*��f0ӻt2K�c{���/�!�Y���D<�Pqס��U�i�W���0����M�
�]O�8/��X.�
�P5��	'ճ~5��6��_��t�I���0�70����Ф��0��10	UUS10	UWA10URedmond10U
Microsoft Corporation1-0+U$Microsoft Ireland Operations Limited1&0$UThales TSS ESN:179E-4BB0-82461%0#UMicrosoft Time-Stamp service�#
0+[�)N���p<$OjD[�o��0���0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100
	*�H��
�F��0"20180915065440Z20180916065440Z0w0=
+�Y
1/0-0
�F��0
��0i0
�H006
+�Y
1(0&0
+�Y
�
0� �
0��0
	*�H��
���9M�����z�B�(��L\�W)5(�l�1�A8�p����7�/��ǿ��dů0(�t�]�T�����^����W!�aV(� �R��wwq��k��ߔ�}��.I^�G�kW���Ԫ��,’�j1�
0�	0��0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103۪m�"4%�0
	`�He��J0	*�H��
	1
*�H��
	0/	*�H��
	1" ��(r%���u�'�E�� e��+iE״0���S0��*�H��
	/1��0��0��0�� S�Ә-"�j#%c��}G�� ������!���0��0���~0|10	UUS10U
Washington10URedmond10U
Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103۪m�"4%�0" �%�!���(���$�:��B��ǩd\[_д�0
	*�H��
�zJ��;�5u�c~����N�p�\[�# 7�8�����H‰��ܑ�e��>�-+jV�7�� �L���e��"�<�?5��hk
!�����"��G��_�eю��׵��k��{�%p�6�v��c�Q�ӛ[f!����y�<І���Vg	������8����<���n��2�5ȴYJ�0���߬z��zN���F�t	����5��k�/����U�q�'B��<�V��}=�	D݊(S�+>�l�|�X

Youez - 2016 - github.com/yon3zu
LinuXploit