Edit C:\Windows\System32\drivers\WppRecorder.sys
MZ? ?? ? @ ? ? ? ?!?L?!This program cannot be run in DOS mode. $ 3|?w ?w ?w ?w ?d ??Xt ??]p ??^t ??Yv ??As ??Zv ??_v ?Richw ? PE d? |?R ? " " ! ? ? ` p f 0? ( ? P : `! ? ?0 1 ? 0 ? .text ? h.rdata ? 0 @ H.data 8 @ " @ ?.pdata P $ @ HPAGE ? ` & `.edata f p * @ @INIT ? ? . ?.rsrc ? 2 @ B.reloc ` ? 8 @ B @USVWATAUAVAWH?$???H?8 H??/ H3??( H?? L?? 3????? M?H? H?? H?$pH? ?? L?? ?? L?$`f?$ H? H?$PH?? ? M??? ?$0?$4?$X?$D?$<? ? ?$8?$@H?$HH?$P?$`0 H?$h?$x@ H??H??R ?? H?$PL?$`H?$HH?$hH?? ?$`0 ?$x@ H??H?$pH?? ?? D?PH??3?? ?? H?$HH?? ?????$<?????$0?????? ? H?H?$4?H?H?$X?(H? H?? ?8H?@H?$D?PH?HH?$0?`H?XH?? ?pH?xH?$8?? H?? H?$0?? H?? H?? ?? H?? H?$@?? H?? ?? H?$0H?? H???? ?? H??? L???H?? ?D? H?$ E3??D$4? ;? ? ?;?B??$8?$0?$@D;?L$4AE?;?E?;?D;?;? ??;?D?E? ;?G?;?G??$4?$<? fA??$DfA?$H???H?$HA? ?8H?t?( H?$PH?t? H?( H3?) H?8 A_A^A]A\_^[]?H?H?H?H?H? ATAVAWH? ?PLgH?E3??A?D?? D?A!E???A???? ?f H?H?? E?3??? H?hD??? ?`D?? H?? A+??? H?? ??? H??H?pD?xD?|?M H?? H?H? D?H?H9 tA?$?)H?H?f?Gx?xf?GzA?H?f?d?? L?hH?0H?? I?XA? D?,?? H?$HH?$PH?$XH?H?$@H? A_A^A\??$H?$H?$WH? H?h3??H9Y@tH?0?? ?tH?@H?? H?? H?H?D?H9zunH99uiH?H??? fFz?xf?f9Fzs H?? H?? f???dH? H;???xA?H?? ?`H?H?$0H?$8H?$@H? _H?%? ? ?)?H?$UVWAVAWH?p H??* H3??$` E3?I?L?H?L9y@tH? ? ?? ? D8=p* ? H?$@A??$@ ?d ?x?$Dw u ?$Hr@?@?? A?PLg??? ? H?H?u H? p ?3?? H?? H? H?H?$(H?$ L?HL?JH?$0H?@?!D? D?;H?? D?? D?x???H? ?C|H?tc?L?H?I?@H?? I;?JH?f?9\u?;?;f?9\u5H?? E?H+??H;?G??tM?B?AA???XE?L;??EJ?$0L?? ?H?? ?h???E3?3??H?H? ????H?H?u H? ? ?& ?PLgH??? ? H?L?? ? L+????H?tA??t ?H??????uH???9H?L?I?L?:E?8? ?x H?(L?XH?" A? D?,?? H?? H?@H?$` H3?? H?$? H?p A_A^_^]??$WH? H?@H?tNH?hH?tEH?? H?t9???H?8 tH?(?F ?tH?8 ?PLgH??? H??' H?@ H?$0H? _?SUVWH?83??H?H?? ??u L?p9ixuL?? H?$? L?? H?H?$(H?? H?H?tH;??. ?L??H9)u???t ? H+?H?L?;?? A?I? L;?? A? ??$$?$ A?D??M IM?;?'?$&f?$ f?$"?$ ?? ?$$;??? ?A?f?$"f?$ ??$ ?? ?$$;????R I?f?f? fD??$? f? H?hH?? ? ????? H?$? ??B ? H?H?tL?H?H?? H??H?H?u?H?hH?? ?? ??8_^][???$H?$H?$WH? H?@H?H?t|H?hH?tsH?? H?tg? ?z u]???E3?3?3?????H?H?u5H? ? ?? H9s8tH?(?? ?tH!s8?PLgH??? ?H?? H?@H?$0H?$8H?$@H? _??H?@3??tH?hH?tH?? ??@3??t(H?hH?t H?? H?t9? D??AE????H?$H?$WH? 3??H?I?H?@H?? H?hH?? D?D? ?D;? D;A A?GQ D???D;?G?????H?H?u? ?iD? H?I???w0L?A? L+????A? ?t ?H??????uH???? H?H?(H???S$ ? ????#??$8?H?$0H? _??tBH?hH;? t5H?? L+????H?tA??t ?H??????uH?? ??(H?tH?hH9? tH????H?(?H?@3??tH?h??@E3??H?tL?hH?t6M?t1? ??? ???u A?? ;?? ?? ?I?? ?A? ??? ??t$?? ?h ?? ? ?? 3???@3??M?tM?hH?A? M?u? ?I?XH? A? $ AB|???3? ?H?H?H?H? WAVAWH? ? 3?M?L?H?? H?? M?? H??B ??? H?$@E3?? ??? ?$@?? ?H??????L03H?H???H??4 H?H?u? ?hH?$@L??B ??xB3???t L?I;? ?I?;???? ;??% ?M??3???? ??t?L03H??? H?$PH?$X?H?$HH? A_A^_???$3?8Q? H??! f9PJ? H?? D? L?L?L?H? A? t$A?ttA?tUA?0t4A?.tbA?t\A?Cu H?tL?I;??I?;?????M?t??M;??AI?;????t??M;??AI?;???t??M;??AI?;??H?$??E3???H?uA? ?TM?E??? ?? ?t ;?A?# ?2H?h@|fH~?$H? fA3KdM?A?f?$H?$@$?A?H???@SH? H???????t4? ?t-H? ?( H?t ???"vH?XH? ?($ A|?CH? [??$WH?0H???H?hH?t)?=???t ? ?tH?L?(L? H?H?$ ???H?$@H?0_???? @UH?$??? H?? H? ?' H?/ ? H?? H???o?H??H?o?H?3??L 8f H??E? ??o?G H??E L???? H?HD7 H?$ E3????? ?o ? 3??? ]??3???$WH? H?H??^ H?H?H?$0H? _??????????ff ? H; ? uH?f???u??? ?? ?)??(M?8H?I?? ? H?(??@SH? A? H?L?D?L?A??tA?McP?L?c?#?c??H??HK??t ?????3??H? [????H?H?H?H?H? AVH? M?8H?M?A?H?I?H?H?I?I??????D?D?A?A?? #???DD??tL?M?H?H??. ?H?$0H?$8H?$@H?$H?H? A^?????????%? ?? ????H+?? I?OsXM?I?t D H? H?I??????tf ? ? H????A?u???fffff ? ?????H?rp??tL+?Bo?I??I?I? ? I? ?o ?oL H? fA?I????O???fffffff ? ffffff ? ?t? I??H???u?? ? ?????????H? r? D @H?? ???? ? ?o ?oL f?f?H?@?oD ?oL ???????? I? s?? $ M?I???????? ? ???????I??OsOM?I?tH? ??I???u??tf ? ? ?H????u???fffff ? ???H??tH??tL+???oD?@???I?I? ? I? ?oD ?oL ?? fAf I???T???fffffff ? ffffff ? ?t??? I???u?? ? ?????????H? ??w? H?? D @???? ? ?oD ?oL ??????@?oD ?o f?f? ???? I? s?? $ M?I?????????????I?r,?I?I?I?Gs`M?I??????u??t D A??I???fffffff ? fffffff ? fffffff ? ? ??tL+??H??I?M?I?I?t I?J? ??I??? O? ????H?H?H?H? H?(H?0H?8H?@I????t A??I??????? t l Q u e r y R e g i s t r y V a l u e s E x ???????P a r a m e t e r s ?????V e r b o s e O n ??????L o g P a g e s ???????F o r c e L o g s I n M i n i D u m p ????W p p R e c o r d e r _ P e r B u f f e r M i n B y t e s ??W p p R e c o r d e r _ P e r B u f f e r M a x B y t e s ??Error: WPP auto recorder is already started ??rror: failed to allocate memory for autoLogContext ??????rror: failed to allocate memory for WPP recorder ???????riverLog ???Error: failed to re-allocate memory for WPP recorder ?????F o r c e D i s a b l e d C r a s h L o g s ?W p p R e c o r d e r ?" ? ? ? 4? P? j? z? ? ? ? ? ? ? &? B? T? d? ? |?R ( ?1 ? R t l Q u e r y M o d u l e I n f o r m a t i o n 2 4 ?0 ? @ 0 RSDS?gh???v??5? wpprecorder.pdb - G ? ? ??p`0P?! ( t d T 4 2??? d T 4 2p% 45 . ? ?p`P ?! ` 4 2p bp`P0 d T 4 2p d 4 2 p B d T 4 2??p 4 " 20 4 Rp P , d7 45 . ??? ? p " \b yb ? ? a 2P 4 2p 20 t d T 4 2? 2?-?+ ? ???@ K ?1 L ? 2 ? ^ 42 ` ? L2 ? H p2 H ? ?2 ? ? ?2 ? ? ?2 4 W ?2 8 f ?2 h D ?2 D ? ?2 ? 3 Z 3 d ! 3 ! J! t3 ?! ?! ?2 ?! " ?3 " ?" ?3 ?" ?% ?3 & ?& ?3 ` X` 3 X` ? ,3 ? ? h3 @SH? 3?9 ??u@H?$0E3?3?3?]???$0s? ? H? ???????? H????? ????H? [??$H?$ WATAUAVAWH?p H????H3??$` M?L?A? ?=???t ? ?? H????3?H?t A???? A??? ?E??? H?$0A?0 L?$ H?? ???????- ??A?H?????H;? ? ? D?E?M?? E94$s ?# ?? ?? A?? E;?? ?Hi? I?i?( H?H?? ??.f? L?H?0H??I ??u`? (A)(JA)I(B A)A (J0A)I0(B@A)A@(JPA)IP(B`A)A`M?? (JpA)I??? H???"A? I??????Hi?( H?I? ??;;? ???E?4$?= ?H?$0H;? 3????????H?$0H;? 3???????T$ ? A?uxK???H?H?$(H?u? ? D?$ ???H?$` H3????L?$p I?8I?HI?A_A^A]A\_?UH? H?H??3?? ??H? ]? ?R ? (p hp ? d ! ` ? H ? ? X ? ? h ? 4 , ? ? ? ? ? q q q 8q Zq zq ? ? ? ? r )r Fr WppRecorder.sys DllInitialize DllUnload WppAutoLogStart WppAutoLogStop WppAutoLogTrace imp_WppRecorderConfigure imp_WppRecorderDumpLiveDriverData imp_WppRecorderGetCounterHandle imp_WppRecorderGetTriageInfo imp_WppRecorderIsDefaultLogAvailable imp_WppRecorderLinkCounters imp_WppRecorderLogCreate imp_WppRecorderLogDelete imp_WppRecorderLogDumpLiveData imp_WppRecorderLogGetDefault imp_WppRecorderLogSetIdentifier H????H?tH?2?-?+ H;? H?H????? ?)??? ? 0 ? ? ? 4? P? j? z? ? ? ? ? ? ? &? B? T? d? ? ? ExAllocatePoolWithTag ? ExFreePoolWithTag ?RtlInitUnicodeString xMmGetSystemRoutineAddress 'RtlQueryRegistryValues ?RtlGetVersion ?KeReleaseSpinLock HZwClose T DbgPrint ?ZwOpenKey SKeAcquireSpinLockRaiseToDpc pKeDeregisterBugCheckReasonCallback ?KeRegisterBugCheckReasonCallback ntoskrnl.exe ?ZwQuerySystemInformation 4KiBugCheckData ?PsGetVersion ? ExAllocatePoolWithQuotaTag __C_specific_handler ? 0 ? H `? ? ?4 V S _ V E R S I O N _ I N F O ?? @?% @?%? S t r i n g F i l e I n f o ? 0 0 0 0 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n N F i l e D e s c r i p t i o n W P P T r a c e R e c o r d e r r ) F i l e V e r s i o n 6 . 3 . 9 6 0 0 . 1 6 3 8 4 ( w i n b l u e _ r t m . 1 3 0 8 2 1 - 1 6 2 3 ) @ I n t e r n a l N a m e W p p R e c o r d e r . s y s ? . L e g a l C o p y r i g h t ? M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . H O r i g i n a l F i l e n a m e W p p R e c o r d e r . s y s j % P r o d u c t N a m e M i c r o s o f t ? W i n d o w s ? O p e r a t i n g S y s t e m B P r o d u c t V e r s i o n 6 . 3 . 9 6 0 0 . 1 6 3 8 4 D V a r F i l e I n f o $ T r a n s l a t i o n ? 0 ???? @ ? `! 0?!N *?? ?!?0?!;10 `?e 0\ +?7?0L0 +?70 ??? 010 `?e ????C???,?&0=???1?V?? ?0?0??3 $? h?? $0 *?? 0?1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110 130617214338Z 140917214338Z0p1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation10UMicrosoft Windows0?"0 *?? ? 0? ? ?b?\E?F??:??,??x???????4?D??K?_?????<}]???S?? AB???irSSO?x??1??#\t?&???}??`0D??;?? ???O? ???(?:?h?it?q^i" ?+?CT???Sb?<??v ????;ph??????+??'??'??? ^???? T?5E& ?0?{0 U %0+ +?7 0 U ?IS? iC(?(&o?3s?&?0QU J0H?0D1 0 U MOPR1301U*31612+09a6d5f3-8125-416a-b9b1-447d2c25afa90 U #0??)9??x??O?|U?0TU M0K0I???http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a+U0S0Q+0?http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0 U ?0 0 *?? ? x&?C&??2?!e??'? k????Hj??V??w3???i??W?34p;*?;0X????????0?/? ?9<8????.?+?:?;?h?D??????"06?$?94GK??G???(???F?$??{<?IF? ??Vbd?GXY?!?F?eUQC{?!/=;/?S??O?/ ? ?z'J?? +G%??'"? ??=-???-0??0?? avV 0 *?? 0?1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 111019184142Z 261019185142Z0?1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20110?"0 *?? ? 0? ? ? ??. ???? !?33?????? ???8??-|by???5 p????6u?1?p?7?F?([?#,?G??'???? ;S5|??'? ??# o??n?<A???]jM? %(\6?? ????['?'x0?* k"?`,? S?I?a?h sD]}?+???5]l +\??#?n?&?6??'?2;A?,???TN? ??ú?w?$? ?C0??0 +?7 0 U ?)9??x??O?|U?0 +?7 S u b C A0 U ?0U ?0?0 U #0??V??\bh?=?[???0VU O0M0K???http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0?>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0 *?? ? ?qQ???9>?<Rn+?s?h??4M?&?1F?y?8.Ek??(? ?? ?? 6fj?????@26v?Z???????TlP0X?|?????W?!s4Z???? ???~?? ???? rS???=1e????=??B??T ??? G??NA???*???!(??9_>?`?? ???Q?G??=?*hw?Lb{??z?4Kbz???7?-?| ?=?Z???:???!7??ug?W^)9?-??s[????X????5???$?5? u?V?x,??????~,c??#!?xl?6+???-??@?E??k>??* j?G?c 2??6 *pZ?YqKW???!<? ?????? ????b?c ?w}=?????o3??? Y~1??0??0?0?1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1.0,U%Microsoft Windows Production PCA 20113 $? h?? $0 `?e ??0 *?? 1 +?70 +?7 10 +?70/ *?? 1" ?9?????H????G???+??0Z +?7 1L0J?$?" M i c r o s o f t W i n d o w s?"? http://www.microsoft.com/windows0 *?? ? ?????L?T??? l_kgA?'5H???P[???~s?? =[?.?!??6?t>f??~(?????)&?IV? ????<MA_?3??=?+?>>?P?????|??? ??? ?>?~??? ?K 77? ?=???aE? <????0????T???*?????????tY C???;??-?c"????? ?J0?F +?71?60?2 *?? ?#0? 10 `?e 0?= *?? ?,?(0?$ +? 010 `?e ??+??%??lrw%?%O??.i?Q?C??20130822124008.573Z0?????0?1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1 0 U MOPR1'0%U nCipher DSE ESN:C0F4-3086-DEF81%0#U Microsoft Time-Stamp Service??0?q0?Y? a ?* 0 *?? 0?1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 100701213655Z 250701214655Z0|1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20100?"0 *?? ? 0? ? ? ??: ???i?tT? ??|hK,_????>f+[?S'1 A? ? ?a0Y?0D??TC ??8???s0W&?E ????$`2X`F?G?2? tag??????]?n(????a??' $gr!?Kd?b?? =?u??M@Q??>g???~?K????z* 1?N??5? ??<?/D??d?? ????]^?O"M ??0??0 +?7 0 U ?:\?1?C{|F?3hZ?U0 +?7 S u b C A0 U ?0U ?0?0 U #0??V??\bh?=?[???0VU O0M0K???http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0?>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0?U ??0?0? +?7.0?0=+1http://www.microsoft.com/PKI/docs/CPS/default.htm0@+04 2 L e g a l _ P o l i c y _ S t a t e m e n t . 0 *?? ? ?Q ????=??!o???1???Wm0?????x??%??kTW+Q??S????@A?\?\?5?$VKt?????7}Z? ?yJ? ?8?/y?????? oK0D$"<???)????2J'??/??3?_?W@??f??jb?J ?&?9?Jqc?!m??<?}????? ?8??? ????B???"8 ?%???~cY%z.9Wv????????G????}??;q ?t?"a?P o?? ?1?:?Gx????~akow?? ?9????? ?? ???*T9?? U??;?-??3.)?/T'!???(??????AM??*?f0?t2K?{??/?!???<?q??U????0??M? ?O? 8/?X.? ?5? ' ?~5 ?6?_?t?0??0??3 (???<nf (0 *?? 0|1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20100 130327201313Z 140627201313Z0?1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1 0 U MOPR1'0%U nCipher DSE ESN:C0F4-3086-DEF81%0#U Microsoft Time-Stamp Service0?"0 *?? ? 0? ? ?H?H?!?k?-?c???????1?f??gZ?"?gR??7E??3?s?!?}?/??????M V?/??_????2L? R??<it??h?U??g?D?3?s]?(?_R-D/?x?;/???;/???J?2 V?KZ?&' C`??@ `?A?s????U'?M?}l?#?|l?? Rx?P?:???'r!u ?0?0 U ????G????S?0 U #0??:\?1?C{|F?3hZ?U0VU O0M0K???http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z+N0L0J+0?>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0 U ?0 0U % 0 +0 *?? ? ?"?=d~K?&???N ?V?Z??A ?2??Ev?`$???T)??{???13?z;???<?????>? ?r ?1 E?H??E????? veY/?B?????Ip???!?`S~???? <??Qt??r??)?? ???LT?2??*nt?D???0y??: ???'???4?'7??"?H*??v0?^0????0?1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1 0 U MOPR1'0%U nCipher DSE ESN:C0F4-3086-DEF81%0#U Microsoft Time-Stamp Service?% 0 + ?? ?;fNe?S?? D??0???0?1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1 0 U MOPR1'0%U nCipher NTS ESN:B027-C6F8-1D881+0)U"Microsoft Time Source Master Clock0 *?? ?u?0"20130822113521Z20130823113521Z0t0: +? 1,0*0 ?u? 0 ?0 ?0 ?? 06 +? 1(0&0 +? ? 0 ?? 0 ? 0 *?? ? ?U+w?TZ?R??8??OH?p ?1???[??3??%???g?????_u(??i?7?y??X???%?t ? ??c?/w ?l?7J?spb?#9z???H?d???M??? ??|PV?U?X??????g?!;?k?_]G}?'^?.u?p??&???df?8?p/=??A?JS*'{?8?0?i?!??01??0??0?0|1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20103 (???<nf (0 `?e ?20 *?? 1 *?? 0/ *?? 1" 0???!?F? ???i ?-@? ?%0? *?? 1?0?0?0??? ?;fNe?S?? D0?0??0|1 0 UUS10U Washington10URedmond1 0 U Microsoft Corporation1&0$U Microsoft Time-Stamp PCA 20103 (???<nf (0???5H?| ????N0 *?? ? z?"??\ ??U??(?x??`.??@??? ? <0GB?3?q?al;??6?B?r`6??H?r???<?N?????;RE?? [?w? ?w??@?G?%?Zl????? )kh? ???&.$???gO???~?BAf?? C?>?!? ?/=(???M?R-`x?}?S?*^?T???)}??,??(??? ?8c. ?
Ms-Dos/Windows
Unix
Write backup
jsp File Browser version 1.2 by
www.vonloesch.de