Hacked By AnonymousFox
MZ @ !L!This program cannot be run in DOS mode.
$ ցցցήց⢰ց⢰ց⢰ցրց⢰ց⢰ց⢰~ց⢰ցRichց PE L 嬚h
& , . @ @
@ dQ @ ` T P ` .text d$ & `.data @ * @ .idata P , @ @.rsrc ` 8 @ @.reloc P @ B `@@ @@ "@ `#@ 0%@ 3@ 3@ 3@ @ '@ '@ x@ @
n `'@ (@ @ @ @ @ D ;ơ}[Nko ] +H` @ |@ @@ @ `Q@ @ u ,@ ,@ @/@ P " `# 0% P% `' ' ' , , . . . @/ 0 p2 2 3
{|
N,5>
. p 0 %\0M \ )T )T [ 0 h 2 @ FA p h 0L @ @ GC P! D p h 0 8 @ DA R p PerfpSetServiceState P e r f H o s t PerfpServiceMain wmain PerfpOpenProvider P e r f o r m a n c e L i b r a r y Open Close Query Collect L i n k a g e E x p o r t PerfCollectData n c a l r p c S O F T W A R E \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ P e r f l i b PerfpRpcIfCallback PerfpCleanupServer PerfpGetClientAuthId S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ % s \ % s 嬚h % 嬚h
嬚h p2 RSDSTg&<0[~d PerfHost.pdb GCTL .rdata$brc .CRT$XCA .CRT$XCAA .CRT$XCZ .CRT$XIA .CRT$XIAA .CRT$XIY .CRT$XIZ P .gfids .rdata .rdata$sxdata .rdata$zzzdbg .text$mn 4 \ .xdata$x @ .data$brc @ ( .data 0@ .bss P ` .idata$5 `Q .00cfg dQ , .idata$2 R .idata$3 R ` .idata$4 T .idata$6 ` ` .rsrc$01 `a p .rsrc$02 UQVW|C@ t$WTQ@ E @@ E W5@@ @@ PQ@ WLQ@ h@@ 5C@ P@ WHQ@ _^u*DP@ jh@ EEjPjhp@ = E3] V
33VBVZ5C@ 5C@ P@ 5C@ ^ ̋UVWC@ WTQ@ =C@ t HEjZt +t
tjx^/33VV2 3C@ VV5C@ P@ WPQ@ _^] ̋UQS3Sh@ h@ C@ P@ C@ uzDP@ Ejh@ jEPjhp@ " 9 C@ tFVC@ VTQ@ VC@ PQ@ u3BS1C@ C@ ^t
PP@ C@ [] SSjZExSSh@ P@ C@ U ENSjjZ멋UV3E@ VVjVEP@ uuLP@ hC@ VVh@ DQ@ E^uLEPP@ u*DP@ jh@ EEjPjhp@
E5C@ 5C@ @Q@ 3]ËV~0 t3^Wj j vXP@ F4t7vP`P@ F8t&v v4`P@ F@tv v4`P@ F<u DP@ ~4 t
v4TP@ f4 F03_^ËU SVWO QAu+ʋW3ۉ]rff;u+w ^ff;EuA+Pw U Pwu Pw jh @ w@ `Q@ w ENFu+O3ۍQff;u+ʋW Zff;EuF+Pw M PwU Pw EjPjh @ p (3ۈ_1w4TP@ _4_0_^[]ËUSVWM E 8G1t M;G(u A;G,| #Ee 3Vu0P@ EN _KCuW+ٍJff;uw +Nff;Eu+Ot&AEff;Eu+MM OEE ul@ CPwU Pwu Pw uQjhP@ C
w8(w`Q@ jZ@ E
wNFuW+3ۍJff;u+ыO Yff;EuF+PwU PwM Pw EjPjh @ E(uEG(EG1G,3_^[]d0 VW3v WpXQ@ vd0 WpXQ@ vd0 WpXQ@ vd0 WpXQ@ v d0 WpXQ@ v d0 WpXQ@ d0 VWpXQ@ _^ËU$ @@ 3ʼnESVWh@ 3Wh0@ h Pp yxDž 3ۋύQff;u+M PWjPjh`@ t t P@ M_^3[l ]ÍPjj Ph P@ gjDPd0 p8Q@ uDž @jDj V( F$PP@ N F
QP
N QP @
N QP$@
eN IQP,@ ?
t&QP4@
N K P@ h<@ Wh0@ h P
y Dž @@ @@ 9tnjY)Pjj Ph P@ uQFPQ~ P@ tt3ۉ2F035@@ 3wSV^~J ;t_ЃW~$WTQ@ ~1 t .~0 tv4TP@ f4 F0 hC@ TQ@ thC@ PQ@ WPQ@ _^[Ë9pu!N91uhC@ HPQ@ _^[jY)̋UQSVWC@ VTQ@ = @@ @@ jjujw P@ t,?;u3}u&UMtVPQ@ }.G}VPQ@ w$VTQ@ EVPQ@ ttE 83_^[] ̋U ESVW}3ۉ\$G$PTQ@ D$ t S0P@ D$ a _ KCuw+3ҍNff;uW +Jff;D$u+} t*M AD$ff;D$u+L$M D$D$ } M ul@ C]Pw u PwU Pw jSt$4Qjh@ Z w<E0uSPu `Q@ jZ\@ D$ w NFuW+3ۍJff;u+ыO Yff;D$uF+Pw U PwM Pw D$$jPjh @ (|$ tE3ɉG$PPQ@ D$ _^[] ̋UVu& 3^] ̋USW3EWWPWEPu ,P@ E@ u
}s*E jSjEPjh0@ E_[] EPu (P@ EuWWWEPWu$P@ EEP P@ 9}uVjjujhp@ P@ EP P@ ^t E su 0P@ E_EPh Wh@ h P@ jZˉE 9}/uP@ 3:UQSWj 5C@ h@ P@ E @ p@ tjWjEPjS hC@ P@ j j h@ P@ EtjWjEPjS _[]ËW3Wj
hp@ P@ ubShP%@ h j)WW@ S P@ uBVhC@ P@ WWu 5C@ SP@ thC@ P@ WWSP@ 3^[_ËUEP] ̋Uud0 j p8Q@ ] ̋Uud0 j pXQ@ ] U @@ 3ʼnESV W}9U wU t*ڍEf H & vFAFuፅPRW5C@ 5C@ 4Q@ M_^3[ ]ËUQVWP@ EtVWjEPjh@@ Q_^]ËUH @@ 3ʼnEVWj 0P@ uhEPj jj0Q@ jZ@ y V,Q@ <EPj8EPj
u(Q@ u$Q@ xӃ}8sj
X
EȉẺG3M_3^ ]ËSVWً3ҍNff;ud0 +4u VRp8Q@ ujX
VWP
3_^[ËSVWًNFud0 +FVj p8Q@ ujX
VWPW
3_^[ËU @@ 3ʼnEVQVQ yjzXAWQ3ff;uWh +ʍVQPW<Q@ _y P,Q@ 3M3^ ]ËUQSW3ۍEPSSS]hL@ WP@ tzuVd0 VuSp8Q@ ujX6EPVSShL@ WP@ td
0 VSqXQ@ E 03^_[] UQQVuEPVEE Pj h @ QP@ u4Er'3f;LFu Etuu 3 ^] UQQVuEPVEE Pj RQP@ u!Er|0 u
EHw3 ^] UE VW t5S]3WxEPuWS Q@ x;wu
z 3f{_[^]ËUQVu +tft fu^uҁ3fz ] > jH@@ PP@
C@
C@ YYP@
\@@ Q@
P@@ =@@ u h 0@ P@ Yl 3̡X@@ hL@@ 5T@@ L@@ h@@@ h<@@ h8@@ Q@ D@@ j h4@ 9 3ۉ]d pC@ 3
t;u3Fh P@ 3F95C@ u
j Y:9 C@ u,5C@ h@ h@ YYtE 54@@ 95C@ uh@ h@ YYC@ u 3C@ =C@ t#hC@ YtSjS5C@ `Q@ 5@@@ 5<@@ 58@@ y 0@@ =H@@ u6PQ@ M EQP[ YYËeE0@@ =H@@ uPP@ =4@@ u P@ 0@@ E ËUVu3;u s Wu>t
`Q@ ׃;u r_^]øMZ f9 @ uU
< @ @ PE uC @ f;t f;u( @ v 39 @ Ãt @ v
39 @ 3 ;
@@ u UE 8csmu+xu%@= t=!t="t= @uP@ 3] h.@ @P@ 3% Q@ j h(4@ 3ɋEtKtFMMZ f9u2P<x+ s#EPE # 3@Ëe3ɉME Uj \P@ t PtH\jXf;t
u3@]ËE]%P@ 3̋UE3SVWH<AYt} p ;r H;r
B(;r3_^[]̋UjhH4@ hp2@ d PSVW @@ 1E3PEd eE h @ z tTE- @ Ph @ Pt:@$ ЃEMd
Y_^[]ËE 3Ɂ8 ËeE3Md
Y_^[]̋UMMZ f9u A<8PE u f9Hu ]3]ËUe e @@ VWN@ ;tudEPP@ E3EEtP@ 1EpP@ 1EP@ 3EM3EEP|P@ E3E3E;t5 @@ uO@ȉ
@@ _@@ ^]h h P@ YY%P@ hp2@ d5 D$l$l$+SVW @@ 1E3PeuEEEEd ËMd
Y__^[]Q̋Uuuu uh.@ h @@ M ] Uj @P@ u<P@ h lP@ PhP@ ]ËU$ `A@
\A@ XA@ TA@ 5PA@ =LA@ fxA@ f
lA@ f HA@ fDA@ f%@A@ f-<A@ pA@ E dA@ EhA@ EtA@ @@ hA@ l@@ `@@ d@@ p@@ jXk ǀt@@ jX
@@ t@@ jX
@@ t@@ jXk
@@ LjX
@@ Lh @ ]%Q@ %4P@ %Q@ % Q@ -@ -@ /@ /@ 0@ 0@ @@ @@ N@D 6W `W NW W W V V V V V zV ^V FV 4V W W ~W W (X 6X ZX HX BY .Y Y Y Y X X X X Y Y Z XZ rZ Z Z Z [ &[ F[ PT |T rT jT 0T T T T T T T bT T [ >T T [ V U U U U U V vU bU HU .U U T U 2@ S T P S *V $Q R rW P R W <P R X LP R nX TP (S X P S VY hP S Y |P <S Y P DS Z P LS 6Z P TS Z P `S Z P pS d[ P 6W `W NW W W V V V V V zV ^V FV 4V W W ~W W (X 6X ZX HX BY .Y Y Y Y X X X X Y Y Z XZ rZ Z Z Z [ &[ F[ PT |T rT jT 0T T T T T T T bT T [ >T T [ V U U U U U V vU bU HU .U U T U _vsnwprintf o _XcptFilter __p__commode _amsg_exit __wgetmainargs __set_app_type exit s_exit $_cexit __p__fmode __setusermatherr _initterm msvcrt.dll 5 ?terminate@@YAXXZ 7_controlfp j_except_handler4_common RtlAcquireSRWLockExclusive 3RtlReleaseSRWLockExclusive RtlAcquireSRWLockShared 4RtlReleaseSRWLockShared ; EtwEventRegister = EtwEventUnregister RtlFreeHeap RtlAllocateHeap > EtwEventWrite NtOpenThreadToken RtlNtStatusToDosError NtQueryInformationToken NtClose RtlExpandEnvironmentStrings ntdll.dll +NdrServerCall2 RpcImpersonateClient sRpcBindingInqAuthClientW RpcBindingToStringBindingW RpcStringBindingParseW
RpcStringFreeW RpcEpUnregister RpcBindingVectorFree RpcServerUnregisterIf RpcServerUseProtseqW RpcServerRegisterIfEx RpcServerInqBindings RpcEpRegisterW RpcRevertToSelf RPCRT4.dll GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter api-ms-win-core-errorhandling-l1-1-0.dll
HeapSetInformation api-ms-win-core-heap-l1-1-0.dll FreeLibrary LoadLibraryExW GetProcAddress GetModuleHandleW api-ms-win-core-libraryloader-l1-2-0.dll RegCloseKey RegOpenKeyExW % RegQueryValueExW $ RegQueryValueExA api-ms-win-core-registry-l1-1-0.dll
GetCurrentProcessId GetCurrentThreadId GetCurrentProcess M TerminateProcess api-ms-win-core-processthreads-l1-1-0.dll QueryPerformanceCounter api-ms-win-core-profile-l1-1-0.dll CompareStringOrdinal api-ms-win-core-string-l1-1-0.dll InitializeSRWLock - Sleep api-ms-win-core-synch-l1-1-0.dll api-ms-win-core-synch-l1-2-0.dll GetSystemTimeAsFileTime GetTickCount api-ms-win-core-sysinfo-l1-1-0.dll CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork api-ms-win-core-threadpool-l1-2-0.dll SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW api-ms-win-service-core-l1-1-0.dll memcpy
memset L 0 0 H ` x u g d `a
W E V T _ T E M P L A T E M U I <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright (c) Microsoft Corporation -->
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="5.1.0.0"
processorArchitecture="x86"
name="Microsoft.Windows.Diagnosis.PerfHost"
type="win32"
/>
<description>Performance Counter DLL Host</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"
/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
4 V S _ V E R S I O N _ I N F O
cE
cE? S t r i n g F i l e I n f o 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n b F i l e D e s c r i p t i o n x 8 6 P e r f o r m a n c e C o u n t e r H o s t h $ F i l e V e r s i o n 1 0 . 0 . 1 7 7 6 3 . 1 ( W i n B u i l d . 1 6 0 1 0 1 . 0 8 0 0 ) :
I n t e r n a l N a m e p e r f h o s t . e x e . L e g a l C o p y r i g h t M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . B
O r i g i n a l F i l e n a m e p e r f h o s t . e x e j % P r o d u c t N a m e M i c r o s o f t W i n d o w s O p e r a t i n g S y s t e m >
P r o d u c t V e r s i o n 1 0 . 0 . 1 7 7 6 3 . 1 D V a r F i l e I n f o $ T r a n s l a t i o n CRIM {|
N,5>$ WEVT
t
h CHAN| ` M i c r o s o f t - W i n d o w s - D i a g n o s i s - P e r f h o s t / A n a l y t i c TTBL
TEMP =Z_BWzT@EC D E v e n t D a t a A5 o D a t a K N a m e E r r o r
A; o D a t a # K N a m e F u n c t i o n
E r r o r F u n c t i o n TEMP, >DY PdXd D E v e n t D a t a A5 o D a t a K N a m e E r r o r
AC o D a t a + K N a m e P r o v i d e r N a m e
$ E r r o r P r o v i d e r N a m e TEMP 6E{^
A . D E v e n t D a t a AA o D a t a ) K N a m e R e t u r n V a l u e
A; o D a t a # K N a m e P r o v i d e r
AA o D a t a ) K N a m e P r o v i d e r D l l
A; o D a t a # K N a m e F u n c t i o n
, H R e t u r n V a l u e P r o v i d e r P r o v i d e r D l l F u n c t i o n TEMP$ 4ybDY%*$νR` 2 D E v e n t D a t a AE o D a t a - K N a m e
F i r s t A r g u m e n t
A; o D a t a # K N a m e P r o v i d e r
AA o D a t a ) K N a m e P r o v i d e r D l l
A; o D a t a # K N a m e F u n c t i o n
8 P l F i r s t A r g u m e n t P r o v i d e r P r o v i d e r D l l F u n c t i o n TEMP` a1rIS' J1 \ D E v e n t D a t a A5 o D a t a K N a m e Q u e r y
A3 o D a t a K N a m e S i z e
A; o D a t a # K N a m e P r o v i d e r
AA o D a t a ) K N a m e P r o v i d e r D l l
A; o D a t a # K N a m e F u n c t i o n
x Q u e r y S i z e P r o v i d e r P r o v i d e r D l l F u n c t i o n TEMP n/~\@Y!E D E v e n t D a t a A; o D a t a # K N a m e P r o v i d e r
AA o D a t a ) K N a m e P r o v i d e r D l l
A; o D a t a # K N a m e F u n c t i o n
< T p P r o v i d e r P r o v i d e r D l l F u n c t i o n PRVA` M i c r o s o f t - W i n d o w s - D i a g n o s i s - P e r f H o s t OPCO LEVL TASK KEYWX 8
L e r r o r s c a l l o u t s EVNT
D `
( ( ( ( D/n]]qW$r5t%C WHoQ * W E V T _ T E M P L A T E M U I M U I e n - U S 000 0000 0(0,00080H0x0|0000000,10181@1111 88 8(8-838:8?8E8K8T8`8g8w88888888!91979>9[9`9f9l9q9{999999999999
:::Q:]:i:n:u:{:::::::::;;';4;E;;;D<Z<<I=q====@>S>f>y>>>>>>>5?]???? \ L0000-12181_1d1111292F2L2Z2`2g22222222233+333+4Z4x4445l5t5555555 6656@6_6v6{66666666666 77 7#71787C7I7R7777 8$8*8M8c8~8888888B999::>:E:b:y:::::9;;(<4<:<A<J<P<X<^<k<s<y<<<<<<<<<<<<=
= ='=,=1=S=Y=`=e=r=============>
>> >!>Q>k>s>y>>>>>>>)?A?G?P?W??? 0 h0m00000f11111111112 2&222222222222223 333!3(30383@3L3U3Z3`3j3t3333333333333 4 4<4@4\4`4 @ 00 P `1
Hacked By AnonymousFox1.0, Coded By AnonymousFox