!This program cannot be run in DOS mode.
Rich_
`.data
@.reloc
msvcrt.dll
ntdll.dll
RPCRT4.dll
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
API-MS-Win-Core-Heap-L1-1-0.dll
API-MS-Win-Core-Interlocked-L1-1-0.dll
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-Profile-L1-1-0.dll
API-MS-Win-Core-Synch-L1-1-0.dll
API-MS-Win-Core-SysInfo-L1-1-0.dll
API-MS-Win-Core-ThreadPool-L1-1-0.dll
API-MS-WIN-Service-Core-L1-1-0.dll
PerfpSetServiceState
PerfpServiceMain
PerfpOpenProvider
PerfCollectData
Collect
PerfpRpcIfCallback
PerfpCleanupServer
PerfpGetClientAuthId
PerfHost.pdb
u"SShI
VW8C1t"j
_wcsicmp
memset
_vsnwprintf
memcpy
__wgetmainargs
_cexit
_XcptFilter
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_except_handler4_common
_controlfp
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
EtwEventUnregister
EtwEventRegister
RtlFreeHeap
RtlAllocateHeap
EtwEventWrite
RtlNtStatusToDosError
NtClose
NtQueryInformationToken
NtOpenThreadToken
RtlExpandEnvironmentStrings
ntdll.dll
NdrServerCall2
RpcImpersonateClient
RpcStringFreeW
RpcStringBindingParseW
RpcBindingToStringBindingW
RpcBindingInqAuthClientW
RpcServerUnregisterIf
RpcBindingVectorFree
RpcEpUnregister
RpcEpRegisterW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUseProtseqW
RpcRevertToSelf
RPCRT4.dll
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
HeapSetInformation
API-MS-Win-Core-Heap-L1-1-0.dll
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
API-MS-Win-Core-Interlocked-L1-1-0.dll
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleA
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
QueryPerformanceCounter
API-MS-Win-Core-Profile-L1-1-0.dll
InitializeSRWLock
API-MS-Win-Core-Synch-L1-1-0.dll
GetTickCount
GetSystemTimeAsFileTime
API-MS-Win-Core-SysInfo-L1-1-0.dll
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
API-MS-Win-Core-ThreadPool-L1-1-0.dll
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
API-MS-WIN-Service-Core-L1-1-0.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright (c) Microsoft Corporation -->
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="5.1.0.0"
processorArchitecture="x86"
name="Microsoft.Windows.Diagnosis.PerfHost"
type="win32"
<description>Performance Counter DLL Host</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"
/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
1T2X2\2h2p2t2x2|2
3$444 6$6d6h6
7-7]7c7j7p7
8<8B8G8^8k8y8
9&90979G9Z9`9f9
0-141_1
3 464A4H4\4i4
5 5(575=5H5O5]5c5i5v5~5
7<7G7R7
:):?:u:
;";(;-;2;7;<;B;J;W;r;{;
< <'<;<A<G<M<Z<`<i<
<$=0=6===F=L=T=Z=g=o=u=
>,?8?E?b?
13191?1E1K1Q1X1_1f1m1t1{1
24282T2X2t2x2
LJoy2@H
Ao}N6z
p~dbG1&
:5'sc1
m,;?a)_
Pqz4~v
^mbf>q
{}mCZR
W\fz'S
=}p}xv
G_}Pru
u*b_y w
J3#(|o
\b \]<
~k9(*#XV
^HE7'F
lze6>md*
]7CM';^
Hbq}pQI%
\?_XG=
?*"rYt.]U[
Lk@;t=
Kc ylob
B) L6n
aj~G<{
eO|{\P
,iU`EO
\5('UF
>Y*VD1
y=N8k.
@(+S/.
6Y-#eN
0WmW+/
Thp& }<
HI#Az\
IJ?3}J
t'@:D/
e[ruJuv
;Seiow
}tm3m'
$K,JU6;
y85i]C_
$?";uVJv^G/M
<:.=A)$
K];^:)ov
\F0!1}
Z\zev6
&K{lIh
m0l\xj
rh>ZzZs:
#Uu"tK3>
o2Eb{J
@:l=\r>
rl8a{6A
JT*CD.X
2myo@.
"eUcls
F}{yT(Y
mA|foJ
;M%96%
;omoKP
{u1]IB
95Pt\t
G28=()M
O44x\a
uKGL)C
fm1*.ZH
r$pMIP5
M3<[Sd
S]nhM#
aNN!4>
S>z-[(
,`L NE
Y(K^T:
E e)CO
tfkQ5\
@] ^KG,
F}p,I)
dNC)*EF
.EU+&T
N|252t
p?0%`4
{_Pymb:
c0!B%C
ca0av[:
$3Nk=G5
2}1:qC
5[Bq*J(R
=*|IFYD
Ds@^*&e
NX~JuS
/?^@G&
r(D$3#
5ve{[^
be>U":
>BKJU^G
;^jL=(
QQ=:va*
8'D>ck`
@ogcR%
G_Hj6yi
(J45tx
tlyn_k
"xLv$<D[
E_=:/w
FQICz' )B
vB%v99B(
bEit<l
]'^'P=
A"eAU3@
1v7t]1
"`{Cr/]
5VwWE0
t*_8|:
{]_2+e
VYq{U{Ue
]|-cV;
kYGDs+
%0S1.d
R1sofm
[W<@ou1Y
k03Gy-
1i"bLc
+*RywEs
@H:}ch
hF8@WG
mMQL|S(
J~x;NW
D6l3\V
KG+gpY
{Ml_n.
Wp_z8(2
{l@??e
]=lJhx
b,_bm;
W9iQ!=
c~6zmQ
bhagHX
OQDI]^
uU.th M
N* 0W{S
^EtZEY
D3IR%|
WN~jd.
)]d8|?
CgX"uks
ik<9Hny
]pK;qqi
Rp^}^E
Jng'U>
q#S|d_
U$Pkki
u/BT.{{
&b>LFC
D}t{K;
IDBB4k
Kg_CY]b2
y,\~N=
v'ue/(
r3P1Y%n
Vf8GN8~:
jg{a%O
)wm1ad}
F bF`Z
3l5'j*
]L*);[
*xAa d
OhED5um
~d9jIe
N5nT9|
vjHr@<=U
6zv"=u*
#!Pnc:3
I{$OOlZ
T02ZJn
xnT*>z
6]g4YQ
5I-{9iQ
;a)+N1
Ila%\z
p\%HR*
}+w@<;m
oK- 'Z
=)koh!
oi4oM0W
5Bq8ZH
+mI\<faF
333BQ &fW
|glYIP
Tv[yi~
pCR1dz
{WZ:AI'
Z3_My$_
{n[=7<9
zQ'4dO
~(>E&:f
jSZ+t:
>k)>x<{
$>zGt
{_,0qQ
MBwwrU?
g&\ioE
$cx j8
Bsy/|xr
fjA|!.
#\Ea_k
{OAhSf
qDyl1V
L<-C6Y`$
7M+P9U
'2XjD/
Y^p\G5
=nUYpv
>4kOCB}
g19_J@
+XqNm
:T%K)z
z6YgF5U
8O[2suU
{1>g|.
v4~<ZXRA<
AX?Kfv?
U&p]`(
e@TOWXj_
Yd$p3|
/(2ZB2
lYt'W$
yBd$~N
nr?`oB
K2N5)'
oBuyx;
j~x;E
1;O'Gl}
dA2xy8ft
vZN>l|
0"qn k
(i}M+]
UrUz9`|t(
t\\P9U
xZUn=7
+CIHz J
w&:FrJ
[S`9rU
iGsMc\
o4=`/k
E]& ,=
2??`l$
%zeQR>
?<G?np
r"BZKZ
N@vZ`O\
cZu'e4
8#[j3{
r?=;mz
b>0\Zm!
"GTXg4K`
_iyDA'
Hxv*z9
'Z#{Qy
hSm cx
R&fj_:
L\"^>@
RF2z.P.!
LzG9|s
wN9\qJY
'"'&Q<
r'nu?8
3~oqVy
~,Ew4
Wro%-=bc
vc:$.X
~L\` :&
epL)g#!5#
]S*dI9H
z/ wH)
VTii4QP
vM\P[4
xSO?Md
OQUgW;
l(Mq,^
iZhus3
=wvz r
~H4CX,4
jr^%$2
FihuGO
neB0v/
H^"3y3
88W0?Sm
z$fR~u|
00,4zc
!xcdT.
{\p&z?
em)/EuV
=j O_
fb_2.R$
80Wl_>
laiUz:
TOR}14
04p~j=
Xf>/T1|
Re\Ulg
RcRgfH
Mm@^;q
Tn;Q;=J
-5_0m] 3%
L;$4'3C
K-Gt8|jy
xGjo%s
%uYg0D
kC%?\dj
1|)&"W
-tmlL|
[;:m{/mz
N79{e'
FKY[V-
R+_my6
tcGi*/
LNjn*p
\_*]@l
Z^s?{ib
";uf^)
Ku5wB
KD7LvU
em$KKms
<^4EL"
Bchg4B
.w&l|J!
IWdVoZ
?H7+,FWX*
L]lYO9
VIx>1P
,Crw1s:
gR6.QaM
Cj8qzPL
|1ATxYiT
}XxGI-
Jh!7wc
tW??:B(
\. XSD1
u|bAB:
%%F_/@^
?h c>cZ
fU9O*#
:tXwY:
f1rB&#
7JJpH:c`
lOoEviS
r2c%a4
dCzc"YX
&79Hc(
oCb-7i
T]dbnM
EY|7K5=y8
2H2{71
0).4@Vj
xq6WMK
0\R;"[O
^v$fJ@h
q|xO>)
; u5H<
gPL;%R
0J[%^R*h
dH{dbP
!GOLKu
YU"IBH
B,ZKnW
W$=;E@
t?99Pk
vj*K:,
\R<E'%
-eT;19Xc
YmFa@7
{>+ob*
i&!JGF
1b`IleRN)h7
ij.gdxQ
:/#'0k
= &w J
/EZ+cu
rV60BCK
aEW/s-L
~)f`2cf5l
oF,6Ni
&|eXK4W]
@rD#qX
8-$nHI
u`\OZ7
E$r3aR
nsC7dY
>|lxKC6<
ZbVFa3/
T'<
&DwZ%|
weY5Pj
;Mipsx
U`'&lD
U{uEe2
sVOwZgb
g_.%M)
SzT`0:T(<R
!QoRxWze
C<!LjI:c
?[vlutV
Z'`{ZM
UzJpxF8.
v "' xFu/
*8swB?
5p ]8p
S&)S:/%fYC.
MVlxKY
fl%&)'
y9u?hLl)'
}YaEL-
[aWWT!
6Q0`6$
MGZV@G
F-\>}Nqq.kl -
,'! lPDV8D
d,]/8
]2OK0vx
m_G=3M
q.`Gbr#
Sr8chOD#
:i@c`Qa
KAac|J
xA?4v05
iCnuXz
h[#2B>
tCJJh;g
z>@1L-4
pl+KI]
/{vsu5Y/
b{m?"D
yKv\"Y
qO/V*G
=1DDvruUV_$
CDJ2+;
8I!s&H
v"C[Sx
rv2[bN
g?K2$.
CVq$aH
oajCHD
x5#SQMLU
n 3L~yP{
I{-P;x7i
Q"nhB?
K'akZ?G
Xm->cx
rsIP _
_(X!$7v
":Pm-/
H,wNfJ
$, uUc
)Xog;$
[Rv)v/mq
$0aX6c
Qm->dU
c9*gaP3
nz;dI-s
"0J;K(u
.JZ qv+
:;n`^W
#~q?56
K'aki]
QkGDLH
BTV//z
rXhuYX
)Z@ ,8,*
y3'\[|
R^lWE/
<}PrM<
l%.'TA
z/>:wh
|F;%DJ
)"D8c0
H@]m(r
0Z*Y?+
^r9n\J
qtiX4!
)cO|Pc
i|3i2~
T8N-gOo
|D;)uU
>^y7Wc
AS}#uo#
M:K|k9
!5g;)pqN
NTBP+N
R,Fsnv 8
k36KLv
-v>$j}
&R?l.>
["R\:&
xay4dL
K"Afo"
aAVz)@
9fG+<<a{
Mr(]H9
{|\6JJ
y${W>d
5U!wvi
Q:"["J+
{J(L'>
ppb3:.P
Pa=EXe
\KCn>j
'xtsv5
Tz6p=w
q28.&A
^;v1>|
@%vA+d
rLf7=-
v:,Cq$
jE\Y[e
u97DJ{
UA%%uM~
rE#TSB7
'E;vf4
7A#~`4s
{u4|!`
S~Cl0@
T[e&mmZ
YG2R!L
{c)2}J
{O{&<-
8,m2Zk
^E3o>=
A/ xjO
JrljN1
C]v~[}
lCe$G~
#6/ !&
~{ uhS
KnOX8]
k9SN4zk
Ggj]AP
]u5a H-Z8
#[T:D0X
f=Tu>wjv
-JH)a6 %
{2W)**
1@_0Rh
fI.Gwqf
6]W]+{
D4n#sZ_x@
oZ5YST
`YagZ]Gv
3"c)d4UD
<3uPhlt
H;ll$.
QcS+.}K
3Jnf<tG
_6U6\^lZ
Q>)?N:
">Ku$1
4Rk"9Z
yf%IdH
QbLHk*
BLwe}Yt
vMVDN8|[
zsR@hxv
UU[tP?V6
[w;JU`D6~'
:-}f0
E~W@@L
m}E_r,'
ZdWc_^}
&#D4k^K}QT
wM:I[_
sYVpG,
18P:9w
{q6.6,1
CsY;eDp(
aaRVGE1
TCGMFl
><d1A_~
jDu*0P
qD4Xj\
Kyh Uo
v$ k,L7I
W0gB^A
Cjw zD
y# '^&
V~r|qlo
:5 `\YOo
5]F{ 5
,Ktr'M
x4E3L vW7
Wnlp{|
YP|4`BGT1
,>$[.T
1A Srg
[dT8m
e&$:!!
,lyh:G
rDtE[h7
(!,q?@
r^IX| o
sJ,2'.
%lh% w
v88ry<
/3H[E\
r~AvK+
>q)Pgb
Q_{rm#
;DXR&7
2186r@
Oi#>/:
jv>ZUX
j^#*d=
9U'`3~I
,hG|J\
c}_X:g
Y"n\r!
KG54 q
$eNs* *f
WLxp~|
_.gy[a
yyf<-b
T+K[@r
.aHUUD
{"|p'(P
M?2O=x
IU;?z]0
:$zz{w)
`Rl'1f
%/-EBl
B<R xm<
#5V3y4
8+Y)XH
z IB9WoO
V)oj_py
%62JD
QVd3}Z
&2H1txW
vH!1gGN
v?-ukm
Ki7Zr~
T] )dd
?B jpE
v>iwsi?
#M88gE
^s3Nz@
^#jK6KqL$
Jk6<E$
_!f?Nq
!iYJTKk
{>[}TY
"bo5gx
Ir Ved
>?zPC9X
guZFL?/
%Zu@zF
Oxeru,
h<,o2>
:Ip'Yv
7}J~"+
B4WzC-
|^ }=|+n%
v B><Z
3&,Pzq
0f:|}y6
r?:v>~N
|%&,A*
3;R)0$s;
L~(Nrlx
Dq-k+c
$1oht%
lG$I\:e
R?<t>;
d4]&JB
$j']P'=
L(Xar?|
a AlOj\
!5'#t>
<YRy#C
?Kgrze
c^FlMi:
<`qfHr
KSjr q
cw@{ *
`t.W\q,URwWp
8hzY5)
EtAU8-
n[J>~
?,~-(K
vpxaiv
9iC5=?F
^JdlYS
I~oasEC
&%O}`w&
._t4G]
J BPVQ
Jb1pwt
Z*8|7,
jS/[l3+
Je BQoS
Ft7|-w
h3:?q?[
\c`V0r
|7?++0{T
,Xm*P5
5CfJy[a
Pf_d`x
V0a[}T
B6%yI[
SgKC2Q
qW_4rU
w`)#%\
Q Y8hB
jQPk_t
QS@K.t
0CU3(V
E!a.IjH'7
*+tm2>i
OY|% w
|<?0OE
9WS1Mj
:y[ -5
GxMDzW ChZ
|0dh6E
7BB3 Z
sUN:Gu
Nqu3 ]
q%$yDn
~Pi|Xa
yD[gl)
f]?E'V
3Cic'/
yLs<^[
>h-k|]L
JMBJ[&
oc'OX
R:14g+
H?,VJYw
:)Ge+n
G\RHb0j
>iY0QSM9
|iW7{6K
.LF tX
8HVc6\
WP1VI|A
P!4qZ.
{L$)u@
<,fHO#
7M{~"_v
.| Ej7
cEE)67
(1 |[u
43/_Sl
[<qnG+i
f|a<(x
0I+[B}
~(O"NK;
n7:D`O/
a-14,&
><]hzG
be[~Q`JP6
#pKSHij
aH4[*8
Hfq)\?
"@nh5FK
A+:tYF
eb8#j@
*Z^y'AX
*ii<ye
yIHGFd
Uu# U\
h= XFo
9Y`CS,J~
kAe%W<
1A~)**
;H|@DY#OX
G7YC~`
izJ<?D{I
'I{'Y!
+`oY?~
`PQhWje
zx5 @?
J6azZM
?Kv|udV>
i>sNW54
hvmx d
-^8^n0
z'gm!.B9}
w~wr&~
G2G0Fn
cu4MdG
+R/Wt_
fzxGKVx
Z0=|JA
Jj "kQ
j9`dvd
SnUel8
PqaVIH
4L1ob[
mgcrUf
cl1|< u?
c>@$I,N
|;=q #$
-Kha?me,
C_;3DO
`z]_0&
5)nOz`
{:c8%(
_Kf)m=\-
O{Aac}OE=
9;Y{UJf
J-G7xJ
?81c'Y
VV"V^;
P| D|O
~\(d(>
i-DSu :
-_~G0g
BT?#gS
RH?DM0
Kj"&a
@GwP_!W6
{-kH]f
I<AsSXy
cPNVgV_
c wU/U'?
Y_OYaA]l
ToT-*F
;zcOeo
h=w3p"
GT?T7T/
wPoPgP
1RPOPG2)
UUd_Ky
2^&8R@
nJHMK{
F./(/Q
;cbO<p'l
4Ja(Tm-/
-;7JV{
A}|x#
@l'"<#
@Ggkd:
L-__}@
ux&lNY
_Oec3(P>
O=\Tw2B
mJuNG\
;BDJJ_.}
;sNm";76
$*bPCO
~gL)B,[
Wm->dd
F~]kCH
LVUEvsuUV/P6
A)X!%|Gk
-8]HG2
{gs_Ce
zruUV/
yO!*/|\
nUZzT%
'H*N8*
?DvsuUV/
K'akZ>
QPRgWee
PQRSUVW
jLUV/
rHDvsu
_^][ZYX
PerfHost
aExport
Linkage
Library
Performance
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
ncalrpc
SYSTEM\CurrentControlSet\Services\%s\%s
WEVT_TEMPLATE
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
x86 Performance Counter Host
FileVersion
6.1.7600.16385 (win7_rtm.090713-1255)
InternalName
perfhost.exe
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
perfhost.exe
ProductName
Microsoft
Windows
Operating System
ProductVersion
6.1.7600.16385
VarFileInfo
Translation
Microsoft-Windows-Diagnosis-Perfhost/Analytic
EventData
Function
Function
EventData
ProviderName
ProviderName
EventData
ReturnValue
Provider
ProviderDll
Function
ReturnValue
Provider
ProviderDll
Function
EventData
FirstArgument
Provider
ProviderDll
Function
FirstArgument
Provider
ProviderDll
Function
EventData
Provider
ProviderDll
Function
Provider
ProviderDll
Function
EventData
Provider
ProviderDll
Function
Provider
ProviderDll
Function
errors
callouts
WEVT_TEMPLATE
