MZ @ !L!This program cannot be run in DOS mode.
$ Dɼ* y y y Ayymxymx y yXymxymxymxym-yymxyRich y PE d TW " T P @+
`A @ , L 4 t 8 p p h .text PR T `.rdata p X @ @.data t @ .pdata L @ @.rsrc @ @.reloc 4 @ B HLH HPSUAUAVAWH 3I9+ MLD\% HpHxL`H% f9% Hc H+D
fE% HfA;i% HMc II+D
fEz% HfA;_% Hc II+D
fE_% HfA;D% L 3Dg DMNjDA f % ft:f0% f9
% ES EtSȍ Q3Iu+ $ 3Et
A;Z% Df$ IH`H$ E$ E3ɉT$PHA 3EA@ma D$X$ A$ 3H
u AX d 3H H HÛ Hě Hś Hƛ HǛ T$PH } L$ L% 3E AAu t$TAE f D DsuQHrH|$xH$ Ld$pHĀ A_A^A]][DA E 2D$\LD$\HHT$TII;u+; D$PЅuL$T+D$\E AM 3t$TkO` H\$ UVWATAUAVAWH$Hp H} H3H` E390 MLEPHHUXHHMHEDd$PALeLd$h D9%
h D9% n% H;i H|$hq 9E% D Et0Hƚ LL$P V_ = D% \$T% D LL$PH _ = % \$T=& D9%C L' Df LL$PH6 * ^ = n& \$T& D9% Ld$X' H'* 3HMDBx HH1| H H AHI@AHI@AHI@AHIHu 3Hǘ DH@HA@85 L=i Hj L5K 0) HM LhHEHE@HEHE8HEHE0HEHD$XHEHD$`HEHEHEHD$xHEHD$pHM @ f HE`E LEHE
fu`Ac] HM`H Hft 7 HHtELyt 3H
t 6 DD$PLL$PHD^t H=Jt 8 = tH|$hH
s HE3HD$THD$@A Ld$8D$0 APfDd$(Ld$ 7 H|s 3H
s L@IZDD$P H
gs 16 HHtELs 3H
Is 6 DD$PLL$PHDs * H=[s 8 = tH|$h$H
r H E3HD$THD$@A Ld$8D$0 APfDd$(Ld$ 6 Ds 3H
r M!L]H
Z 3IH]DH]DH\$xSH]H\$pH\$`H]H H @IHA@IHA@IHA@IHHuH=Wr IÀ H5Qr 38
q DL] D}HDeDmHE`fM`AHELEE
6 HMHE`HT$XHD$( ! HL$XH0AHv@ LY@HGHAHHGHEHAHGH+AHD$xHAGDA HGHD$pHA(HGHD$`HA0FDA8FDA< q L]D;4D}L}DeLd$xDmLl$pH
p HHfH\$ UVWAVAWHl$H H1O H3HE':p MH1HLs3۸ A HH
Q H H @IHA@IHA@IHA@IHHuE3DBHU AI! 1 3ۉEyHH
k Ht2HEE3HD$@SH\$8A D$0 f\$(H\$ / 3HEHE3HUE3HEHED@H%0 EtIH
k Ht3E3HEHD$@A H\$8D$0 APf\$(H\$ c/ 3HEHEA0 LMHUAH)0 EyYH
#k Ht3E3HEHD$@A H\$8D$0 APf\$(H\$ . 3HEHEHEHEHEHE HM(y
3HEHEHEH HF0` h Bh Bh B Hh HBHh HBHh HB i B(i B,
h
h J0HEHB8EB@EBDEBHEBLEBPEBTEۉBXEB\+֍BgHI3A HM'H3H$( H A_A^_^]L
i E3EL+ɺ HHtA ftfHHuHu
HAz fDA@UVWATAUAWHl$H HK H3HEL93: MLHMϋE@ s2 A0T E3H$( HUL$ EA@AI- EyaH
h Ht3E3HEHD$@A Ht$8D$0 APft$(Ht$ , 3HEHEHEHEHEHEHEHE3HEHEE- EChukE HEHEHteH %` L3HI0 + eH %` DEHI0+ HHt;A HEELMHUEAH/, E=# tx? EH
g HtBA A AIE3EHEHD$@Ht$8D$0 APft$(Ht$ + HteH %` L3HI0J* H3HEHEHEHEIH+Q H H AHI@AHI@AHI@AHIHuH I Hf DHhf HCH
H H
H HWf HCH\f HCe Ce C d C$EC(d C,
d
d K0d C4d C8d C<d CPd HHC@d HHCHd +d CTd +d CXd C\HEHC`HEHChd HHCpd HHCxd HH }d HH d HH od H3H E H H H H H H
{c B
tH
kc H 9wvoH L L L L H @HHT0H LD8L LLL LT L L\(L ;wreH %` L3HI0' H IH H IH H IH H IH H IH Hc W+ L$ H*HyXHc WH*HyXHMǃ ^Y+ H, A+ߍ H$( AA$IH3AE HMH3]H A_A]A\_^]@USWAUAVHl$H HF H3HE IHMHH]LLME33ҹ Q( E3E=# 3 eH %` AUDEHI0
& HHuH]E DEE3Hй ' EDž H$ skrR 9s E M6HR H L$ L$ AI DmHM DmDmAN@AF HAN0@AF@HANP@AF`@A @AH I @0A0H@I@@PAPa eH %` EC HI0DE$ LHu E
E3HEE LEHE
fDMA& HEIHUHD$(
DELMIE/ y& EDž ME3LEHH3EI EHEI@I@t#IODHAHLaLLQHI(IuMAA IM`HEA@IIHMHEA@AH AHAHD;H` HUIHD$(# HMEˋU AEӉQA AA+ FAHMAF(IHHE eH %` M3HI0 # E3L$ L$ H$ eH %` L3HI0" EH]yFH
` Ht4E3HEHD$@A Ll$8D$0 APfDl$(Ll$ # D/D+3HM H3]H A^A]_[]H\$WH HHT$0H@e HK HHT$0 %& HHKY8m4Hd$0 H H;HFHtM& WH*HyXWH*HyXY
& WH*HyX^^(H\$8]H,H _H\$WH0HJH* u6HD$( LV LωD$ 33! HtHG! HO7HO 3H\$@H0_H\$Hl$Ht$ WH H@ H3H$ HD$0 HIHT$@HD$( E3A HL$HHEHD$PHD$@HD$ ! u HMz! E3HT$`A AIP" xYH$ H$ H HD$`HM@HD$hH HM@1 HHM H= F#r HM E3HT$HAAH! m3H]HMHE eH %` L3HI0 H @SH 3HDBXHK3HHAHAHAY! HK83HHAHAHAH [H%8! H\$ WH H> H3H$ HLA Hh H u E3E33AQ HHtA E333 HGHtE3HT$ A AIP y
H$ H$ H$ N HL$HHA HHOH\$ A F#H\$(A H
u6HHO
AHO8A H uHHO8
3H$ H$ H$ H3H$ H _H(E3ɅtLD$8AQ LH. H(H\$Ht$H|$:( IHLHsE3ɸ D
E HH
`K H H @IHA@IHA@IHA@IHHuH E3
Y
Y JY BY B DX DX uEDX DX E;sEE+DB
X
X JX B
X
X J
X
X J X B$X B(DX DX uEDX DX E;sEE+DB,
cX
YX J0
dX
ZX J4UX B8HX BX D;X uED1X D.X E;sEE+DB@
X
X JD
X
X JHX BLW BPDW DW tDW DW E;rEE+DJT
W
W JXW B\
VW
LW J`GW Bd:W Bh9W Bl4W BpW BtW Bx}W B|xW HW H HyW H +Ӎ AHH3 H\$Ht$H|$@USVATAVAWH$Hx H0: H3H` :P MH1LLs3۸ As H$p H
M Hƺ H H @IHA@IHA@IHA@IHHu3H0 A H\$ LD$`ISHA H@ D$Px D$pGCH
V Ht4E3HD$PHD$@A H\$8D$0 APf\$(H\$ _A H\$ LD$` H? D$Px D$pGCH
GV Ht4E3HD$PHD$@A H\$8D$0 APf\$(H\$ _H
V LD$`A H\$ D$Px D$pG CH
U Ht4E3HD$PHD$@A H\$8D$0 APf\$(H\$ _ H
V LD$`A H\$ S D$Px D$pGCH
[U Ht4E3HD$PHD$@A H\$8D$0 APf\$(H\$ 2 _H
U LD$`A H\$ D$Px D$pGCH
T Ht4E3HD$PHD$@A H\$8D$0 APf\$(H\$ _H
"U LD$`A H\$ g D$Px D$pGCH
oT Ht4E3HD$PHD$@A H\$8D$0 APf\$(H\$ F _+G'H$p AHI$3A H` H3Hx A_A^A\^[]HL$USWAVHl$H : MHHs3۸ A DIT LMH6T Eo= uhLT 3H
S T 1 DT H
^S ( HS Ht|DS LMHй Eo= ty_H
S 3Ht5HEoE3HD$@SH\$8A D$0 f\$(H\$ Eo A EoH/J H$ H5=S H L$ Ll$xL|$pL;3DAI HAO@AG HAO0@AG@HAOP@AG`@A @AH I @0A0H@I@@P3HEHEHE E API H DHVHtwFftn A+ǃ;9 HT$(HU HM FAFAAF A HDnEF EEFEADmDm t HqEteHJQ Hf9\BH@uE A+ǃ;9s A OHT$(HUp HEAEM HHHA+Eg(AHMgAIH3A Ll$xL$ H$ L|$pHĈ A^_[]HHLD$xMt'LD$8HHfA<@ uffD$0ffD$2 3HD$8D$0HD$0HD$(
HHH\$Hl$Ht$H|$ AVH HLHL$XD AEtHADIfB|@ tHQC G 3HoG _HtfEt
MHO Ht$@H\$0HflGHl$8HH|$HI3H A^3 HHIHu@SH H) L3HH [H% @SH H A H
MHH;tL+3ҋKA;C DHSCH L I HHCM H [H%I @SH H L3HH [H%m H\$Hl$Ht$WAVAWH AHHMHALHHtHLHuH in A HIHH;tH+эMILRtlIntegerToUnicodeString NtQueryObject NtOpenKey !RtlInitUnicodeString NtClose NtQueryValueKey RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind ntdll.dll HeapFree DisableThreadLibraryCalls HeapAlloc GetProcessHeap ) SetEvent InitOnceBeginInitialize InitOnceExecuteOnce 4 WaitForMultipleObjects InitOnceInitialize 6 WaitForSingleObject
FreeLibraryAndExitThread GetModuleHandleExA GetLastError + SetWaitableTimerEx CloseHandle CreateThread FreeLibrary
CreateWaitableTimerExW CreateEventA CreateSemaphoreExW CreateMutexA # RegQueryValueExW RegOpenKeyExW RegCloseKey - Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess M TerminateProcess QueryPerformanceCounter
GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount api-ms-win-core-heap-l1-2-0.dll api-ms-win-core-libraryloader-l1-2-0.dll api-ms-win-core-synch-l1-2-0.dll api-ms-win-core-synch-l1-2-1.dll api-ms-win-core-errorhandling-l1-1-1.dll api-ms-win-core-handle-l1-1-0.dll api-ms-win-core-processthreads-l1-1-2.dll api-ms-win-core-registry-l1-1-0.dll api-ms-win-core-profile-l1-1-0.dll api-ms-win-core-sysinfo-l1-2-1.dll ReportEventA CreateFileMappingA RegisterEventSourceW DeregisterEventSource api-ms-win-eventlog-legacy-l1-1-0.dll api-ms-win-core-kernel32-legacy-l1-1-1.dll 3RtlInitializeSRWLock RtlReleaseSRWLockExclusive RtlAcquireSRWLockExclusive RtlAcquireSRWLockShared RtlReleaseSRWLockShared memcpy memset V `S D pV `Z pA @ J ] f 2-+ @ d ( d Q! ( Q ( Q ( d A ( S Q ( ( Q 0 ( 6 7 A 8 ( 8 9 < ( Q @ ( Q H ( Q P ( Q X ( A ` ( A h ( A p p @ d (
d A (
d A ( A ( , A ( , A ( A ( A ( ( A , ( d A 0 ( d $0 8 ( , - @ ( D ( H ( A L ( A P ( A T ( F G X ( F G @ \ @ d ( d Q! ( Q ( Q ( d A ( S Q ( ( Q 0 ( 6 7 A 8 ( 8 9 < @ d % ( d A ( , ( , ( ( ! A ( " # A $ ( $ % A ( ( & ' A , ( ( ) d A 0 ( 6 7 d A 4 ( * + , A 8 ( 0 1 A < ( 8 9 @ ( : ; H ( 2 3 , A P ( < = T ( @ A X ( \ ( 2 3 ` ( 4 5 h ( B ? p ( D E x ( F G ( H I ( J K ( L M ( ~ , ( ~ , @ ( d e , ( f g , ( 8 9 A ( ( ( ( ( ( @ ( ( ( ( ! ( @ V W " ( X Y , A ( Z [ A ( \ ] A ( ^ _ ( ^ _ @ ( ` a ( ` a @ ( b c , A ( d e A $ ( f g A ( ( h i , , ( h i , @ 0 ( j k , A 4 ( l m A 8 ( n o A < ( p q , @ ( p q , @ D ( r s , A H ( t u A L ( v w A P ( x y , T ( x y , @ X ( z { A \ ( | } , A ` ( ~ A d ( A h ( A l ( A p ( A t ( A x ( A | ( A ( , ( P 0 @ d ( d ( d ( , ( , ( , ( , @ ( ( @ ( ( @ D x D y y ,y ty d y p y 2 y 2 O y ` z K $z K 8z Lz \z [ z p z ! z ! k! z ! ! z ! " z " " z " 0" z 0" " { " " { " " 8{ " `# @{ `# g# T{ p# $ d{ $ v$ z $ $ { $ % { % '% { 0% R% { R% o% { o% % { % % { % % { & & 0| & ( L| ( ( z ( 5+ h| @+ }+ + - | - - 8} . 8. z @. / <} 0 m0 D} 0 1 h} 1 1 z 1 G2 p2 r2 x} 2 2 ,} 2 .3 ,} .3 3 ,} 3 3 ,} 3 *4 ,} *4 4 ,} 4 4 ,} 4 S5 ,} S5 v5 ,} 5 5 ,} 5 5 Hy 5 7 Xy 7 > y > ? y ? %? y %? 8? z 8? ? lz ? ? z ? @ z @ 0@ ${ 0@ @ p{ @ @ { @ @ | @ @ | @ A <| A !A X| ,A bA z pA nD |} D &E ~ &E 2E ~ 2E J 4~ J wJ H~ wJ J X~ J KK } KK K } K N } N N } N N } N _O ~ pO O h~ O QQ t~ XQ Q z Q YR ~ YR R ~ R S ~ S MS z `S \V ~ pV V ~ V 2Z 2Z RZ `Z [ 0 [ ] @ ] ] ` ] ^ ^ ^ p ^ _ z _ w_ z _ _ z _ ` ` a a a a Pb ( @ X p 0 R
W E V T _ T E M P L A T E M U I 4 V S _ V E R S I O N _ I N F O
98
98? S t r i n g F i l e I n f o 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n v ' F i l e D e s c r i p t i o n W i n d o w s S y s t e m P e r f o r m a n c e O b j e c t s D L L n ' F i l e V e r s i o n 1 0 . 0 . 1 4 3 9 3 . 0 ( r s 1 _ r e l e a s e . 1 6 0 7 1 5 - 1 6 1 6 ) 6 I n t e r n a l N a m e P E R F O S . D L L . L e g a l C o p y r i g h t M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . > O r i g i n a l F i l e n a m e P E R F O S . D L L j % P r o d u c t N a m e M i c r o s o f t W i n d o w s O p e r a t i n g S y s t e m >
P r o d u c t V e r s i o n 1 0 . 0 . 1 4 3 9 3 . 0 D V a r F i l e I n f o $ T r a n s l a t i o n CRIMP v/AVIǠσE
$ WEVT, 0 CHAN8 A p p l i c a t i o n OPCO LEVL TASK KEYWH 8 , w i n : E v e n t l o g C l a s s i c EVNT $ ( , 0 4 8 < @ D H L õaöv x *fX2 * W E V T _ T E M P L A T E M U I M U I e n - U S p hHPp (@Xp