Sample details: 27304b246c7d5b4e149124d5f93c5b01 --

Hashes
MD5: 27304b246c7d5b4e149124d5f93c5b01
SHA1: e50d9e3bd91908e13a26b3e23edeaf577fb3a095
SHA256: 3337e3875b05e0bfba69ab926532e3f179e8cfbf162ebb60ce58a0281437a7ef
SSDEEP: 3072:Yao79VuJ6titIi/H7ZUFgllxiBD+P5xWr3geNtdS+DlGttzhA9HY4ZUFxPkwlmlP:YaSq4TBWISSTgu7DlGtEC1xn/O5r4S
Details
File Type: PE32
Yara Hits
YRP/VC8_Microsoft_Corporation | YRP/Microsoft_Visual_Cpp_8 | YRP/IsPE32 | YRP/IsConsole | YRP/HasOverlay | YRP/HasDigitalSignature | YRP/HasRichSignature | YRP/domain | YRP/url | YRP/contentis_base64 | YRP/DebuggerException__SetConsoleCtrl | YRP/anti_dbg | YRP/disable_dep | YRP/create_service | YRP/escalate_priv | YRP/win_registry | YRP/win_token | YRP/win_files_operation | YRP/Advapi_Hash_API | YRP/Str_Win32_Winsock2_Library |
Source
http://176.107.188.203/psexec.exe
http://config01.homepc.it/PsExec.exe
Strings
		!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
HtFHt5-
\uAf9Q
r*h\.B
tthH/B
SVWjA_jZ+
uBjAYjZ+
u8h 3B
~pjCXf
VWhX7B
HHtVHHt
htHjlZ;
HHtXHHt
nt'joZ;
YYjgXf9
>0t<NAj0X
j@j _W
URPQQhp
PP9E u
<jdYf;
t(jiYf;
htUjlX;
g~jjiX;
tSjnX;
jnXf9C
QQSVWh
j"_f9y
jA[jZZ+
v	N+D$
htHjlZ;
HHtXHHt
nt'joZ;
YYjgXf9
>0t<NAj0X
~';_t|%3
tWhdoB
tHHt*Ht#
SVjA[jZ^+
jAZjZ^
;t$,v-
UQPXY]Y[
RVSQSWV
PWWWWV
PSSSSV
+t"HHt
,SVWj0X
Wj0XPV
v	N+D$
{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Calibri;}}
{\colortbl ;\red0\green0\blue255;\red0\green0\blue0;}
{\*\generator Riched20 10.0.10240}\viewkind4\uc1 
\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par
\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you.  Please read them.  They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any.  The terms also apply to any Sysinternals\par
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab updates,\par
\pard\fi-363\li720\sb120\sa120\'b7\tab supplements,\par
\'b7\tab Internet-based services, and \par
\'b7\tab support services\par
\pard\sb120\sa120 for this software, unless other terms accompany those items.  If so, those terms apply.\par
\b BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS.  IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE.\par
\pard\brdrt\brdrs\brdrw10\brsp20 \sb120\sa120 If you comply with these license terms, you have the rights below.\par
\pard\fi-357\li357\sb120\sa120\tx360\fs20 1.\tab\fs19 INSTALLATION AND USE RIGHTS.  \b0 You may install and use any number of copies of the software on your devices.\b\par
\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0   The software is licensed, not sold. This agreement only gives you some rights to use the software.  Sysinternals reserves all other rights.  Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement.  In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways.    You may not\b\par
\pard\fi-363\li720\sb120\sa120\tx720\b0\'b7\tab work around any technical limitations in the binary versions of the software;\par
\pard\fi-363\li720\sb120\sa120\'b7\tab reverse engineer, decompile or disassemble the binary versions of the software, except and only to the extent that applicable law expressly permits, despite this limitation;\par
\'b7\tab make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation;\par
\'b7\tab publish the software for others to copy;\par
\'b7\tab rent, lease or lend the software;\par
\'b7\tab transfer the software or this agreement to any third party; or\par
\'b7\tab use the software for commercial software hosting services.\par
\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab SENSITIVE INFORMATION. \b0  Please be aware that, similar to other debug tools that capture \ldblquote process state\rdblquote  information, files saved by Sysinternals tools may include personally identifiable or other sensitive information (such as usernames, passwords, paths to files accessed, and paths to registry accessed). By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.\b\par
5. \tab\fs19 DOCUMENTATION.\b0   Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes.\b\par
\caps\fs20 6.\tab\fs19 Export Restrictions\caps0 .\b0   The software is subject to United States export laws and regulations.  You must comply with all domestic and international export laws and regulations that apply to the software.  These laws include restrictions on destinations, end users and end use.  For additional information, see {\cf1\ul{\field{\*\fldinst{HYPERLINK www.microsoft.com/exporting }}{\fldrslt{www.microsoft.com/exporting}}}}\cf1\ul\f0\fs19  <{{\field{\*\fldinst{HYPERLINK "http://www.microsoft.com/exporting"}}{\fldrslt{http://www.microsoft.com/exporting}}}}\f0\fs19 >\cf0\ulnone .\b\par
\caps\fs20 7.\tab\fs19 SUPPORT SERVICES.\caps0  \b0 Because this software is "as is, " we may not provide support services for it.\b\par
\caps\fs20 8.\tab\fs19 Entire Agreement.\b0\caps0   This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.\par
\pard\keepn\fi-360\li360\sb120\sa120\tx360\cf2\b\caps\fs20 9.\tab\fs19 Applicable Law\caps0 .\par
\pard\fi-363\li720\sb120\sa120\tx720\cf0\fs20 a.\tab\fs19 United States.\b0   If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles.  The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort.\b\par
\pard\fi-363\li720\sb120\sa120\fs20 b.\tab\fs19 Outside the United States.\b0   If you acquired the software in any other country, the laws of that country apply.\b\par
\pard\fi-357\li357\sb120\sa120\tx360\caps\fs20 10.\tab\fs19 Legal Effect.\b0\caps0   This agreement describes certain legal rights.  You may have other rights under the laws of your country.  You may also have rights with respect to the party from whom you acquired the software.  This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par
\fs20 11.\tab\fs19 Disclaimer of Warranty.\caps0    \caps The software is licensed "as - is."  You bear the risk of using it.  SYSINTERNALS gives no express warranties, guarantees or conditions.  You may have additional consumer rights under your local laws which this agreement cannot change.  To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par
\pard\fi-360\li360\sb120\sa120\tx360\fs20 12.\tab\fs19 Limitation on and Exclusion of Remedies and Damages.  You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00.  You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par
\pard\li357\sb120\sa120\b0\caps0 This limitation applies to\par
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab anything related to the software, services, content (including code) on third party Internet sites, or third party programs; and\par
\pard\fi-363\li720\sb120\sa120\'b7\tab claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.\par
\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages.  The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par
\pard\b Please note: As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French.\par
\pard\sb240\lang1036 Remarque : Ce logiciel \'e9tant distribu\'e9 au Qu\'e9bec, Canada, certaines des clauses dans ce contrat sont fournies ci-dessous en fran\'e7ais.\par
\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0  Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par
\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0   Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par
\lang1033 Cette limitation concerne :\par
\pard\keepn\fi-360\li720\sb120\sa120\tx720\lang1036\'b7\tab tout  ce qui est reli\'e9 au logiciel, aux services ou au contenu (y compris le code) figurant sur des sites Internet tiers ou dans des programmes tiers ; et\par
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab les r\'e9clamations au titre de violation de contrat ou de garantie, ou au titre de responsabilit\'e9 stricte, de n\'e9gligence ou d'une autre faute dans la limite autoris\'e9e par la loi en vigueur.\par
\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage.  Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par
\b EFFET JURIDIQUE.\b0   Le pr\'e9sent contrat d\'e9crit certains droits juridiques. Vous pourriez avoir d'autres droits pr\'e9vus par les lois de votre pays.  Le pr\'e9sent contrat ne modifie pas les droits que vous conf\'e8rent les lois de votre pays si celles-ci ne le permettent pas.\b\par
\pard\b0\fs20\lang1033\par
\pard\sa200\sl276\slmult1\f1\fs22\lang9\par
CommandLineToArgvW
Accept Eula (Y/N)?
NtSetInformationProcess
ConvertStringSidToSidW
A system error has occurred: %d
Sysinternals Rocks
RtlNtStatusToDosError
RtlInitUnicodeString
NtOpenFile
NtFsControlFile
Use PsKill to terminate the remotely running program.
The version of the PsExec service running on the remote system is not compabible with this version of PsExec.
PsExec executes a program on a remote system, where remotely executed console
applications execute interactively.
Usage: psexec [\\computer[,computer2[,...] | @file]][-u user [-p psswd][-n s][-r servicename][-h][-l][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-<priority>][-a n,n,...] cmd [arguments]
     -a         Separate processors on which the application can run with
                commas where 1 is the lowest numbered CPU. For example,
                to run the application on CPU 2 and CPU 4, enter:
                "-a 2,4"
     -c         Copy the specified program to the remote system for
                execution. If you omit this option the application
                must be in the system path on the remote system.
     -d         Don't wait for process to terminate (non-interactive).
     -e         Does not load the specified account's profile.
     -f         Copy the specified program even if the file already
                exists on the remote system.
     -i         Run the program so that it interacts with the desktop of the
                specified session on the remote system. If no session is
                specified the process runs in the console session.
     -h         If the target system is Vista or higher, has the process
                run with the account's elevated token, if available.
     -l         Run process as limited user (strips the Administrators group
                and allows only privileges assigned to the Users group).
                On Windows Vista the process runs with Low Integrity.
     -n         Specifies timeout in seconds connecting to remote computers.
     -p         Specifies optional password for user name. If you omit this
                you will be prompted to enter a hidden password.
     -r         Specifies the name of the remote service to create or interact.
                with.
     -s         Run the remote process in the System account.
     -u         Specifies optional user name for login to remote
                computer.
     -v         Copy the specified file only if it has a higher version number
                or is newer on than the one on the remote system.
     -w         Set the working directory of the process (relative to
                remote computer).
     -x         Display the UI on the Winlogon secure desktop (local system
                only).
     -arm       Specifies the remote computer is of ARM architecture.
     -priority	Specifies -low, -belownormal, -abovenormal, -high or
                -realtime to run the process at a different priority. Use
                -background to run at low memory and I/O priority on Vista.
     computer   Direct PsExec to run the application on the remote
                computer or computers specified. If you omit the computer
                name PsExec runs the application on the local system, 
                and if you specify a wildcard (\\*), PsExec runs the
                command on all computers in the current domain.
     @file      PsExec will execute the command on each of the computers listed
                in the file.
     cmd	    Name of application to execute.
     arguments  Arguments to pass (note that file paths must be
                absolute paths on the target system).
     -accepteula This flag suppresses the display of the license dialog.
     -nobanner   Do not display the startup banner and copyright message.
You can enclose applications that have spaces in their name with
quotation marks e.g. psexec \\marklap "c:\long name app.exe".
Input is only passed to the remote system when you press the enter
key, and typing Ctrl-C terminates the remote process.
If you omit a user name the process will run in the context of your
account on the remote system, but will not have access to network
resources (because it is impersonating). Specify a valid user name
in the Domain\User syntax if the remote process requires access
to network resources or to run in a different account. Note that
the password and command is encrypted in transit to the remote system.
Error codes returned by PsExec are specific to the applications you
execute, not PsExec.
The specified application is not on the path.
ProcessIdToSessionId
Run elevated and limited user options are not compatible.
PsExec requires Windows NT or higher.
Arguments too long.
CreateRestrictedToken
NetIsServiceAccount
Password: 
CreateProcessWithLogonW
USER32.dll
GDI32.dll
CorExitProcess
RoInitialize
RoUninitialize
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CreateEventExW
CreateSemaphoreExW
SetThreadStackGuarantee
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
GetLogicalProcessorInformation
CreateSymbolicLinkW
SetDefaultDllDirectories
EnumSystemLocalesEx
CompareStringEx
GetDateFormatEx
GetLocaleInfoEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCMapStringEx
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleExW
SetFileInformationByHandleW
(null)
`h````
xpxxxx
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
MessageBoxW
GetActiveWindow
GetLastActivePopup
GetUserObjectInformationW
GetProcessWindowStation
`h`hhh
xppwpp
CreateFile2
1#SNAN
1#QNAN
SendMessageW
DialogBoxIndirectParamW
EndDialog
GetDlgItem
SetWindowTextW
SetCursor
GetSysColorBrush
InflateRect
LoadCursorW
LoadStringW
GetDeviceCaps
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
VERSION.dll
NetServerEnum
NetApiBufferFree
NETAPI32.dll
WS2_32.dll
WNetAddConnection2W
WNetCancelConnection2W
MPR.dll
GetProcAddress
LocalAlloc
LocalFree
GetFileType
GetStdHandle
LoadLibraryW
GetModuleHandleW
GetCommandLineW
GetModuleFileNameW
SetPriorityClass
LockResource
FreeLibrary
GetCurrentProcess
GetLastError
SetLastError
SetEvent
WaitForSingleObject
LoadResource
SizeofResource
WriteFile
CloseHandle
GetTickCount
FormatMessageA
LoadLibraryExW
FindResourceW
GetSystemDirectoryW
CreateFileW
DeleteFileW
GetComputerNameW
MultiByteToWideChar
GetConsoleScreenBufferInfo
ReadFile
GetVersion
SetProcessAffinityMask
GetCurrentProcessId
GetExitCodeProcess
ResumeThread
WaitForMultipleObjects
GetFileTime
DuplicateHandle
DisconnectNamedPipe
SetNamedPipeHandleState
TransactNamedPipe
CreateEventW
GetEnvironmentVariableW
GetFullPathNameW
SetFileAttributesW
GetFileAttributesW
CopyFileW
WaitNamedPipeW
SetConsoleCtrlHandler
SetConsoleTitleW
ReadConsoleW
KERNEL32.dll
PrintDlgW
COMDLG32.dll
RegCloseKey
RegCreateKeyW
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
GetTokenInformation
SetTokenInformation
AllocateAndInitializeSid
FreeSid
GetLengthSid
InitializeAcl
AddAce
GetAce
AddAccessAllowedAce
LookupPrivilegeValueW
GetSecurityInfo
SetSecurityInfo
LsaFreeMemory
LsaClose
LsaOpenPolicy
LsaEnumerateAccountRights
OpenProcessToken
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
CryptAcquireContextW
CryptReleaseContext
CryptGenKey
CryptDeriveKey
CryptDestroyKey
CryptExportKey
CryptImportKey
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptHashData
CreateProcessAsUserW
ADVAPI32.dll
RaiseException
LoadLibraryExA
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
CreateThread
GetCurrentThreadId
ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
RtlUnwind
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
OutputDebugStringW
HeapSize
HeapReAlloc
SetFilePointerEx
WriteConsoleW
SetEndOfFile
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
SVWjA_jZ+
uBjAYjZ+
~pjCXf
HHtVHHt
htHjlZ;
HHtXHHt
nt'joZ;
YYjgXf9
>0t<NAj0X
j@j _W
URPQQh
< t8<	t4
PP9E u
jA[jZZ+
v	N+D$
~';_t|%3
;t$,v-
UQPXY]Y[
PWWWWV
PSSSSV
+t"HHt
,SVWj0X
Wj0XPV
v	N+D$
{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Calibri;}}
{\colortbl ;\red0\green0\blue255;\red0\green0\blue0;}
{\*\generator Riched20 10.0.10240}\viewkind4\uc1 
\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par
\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you.  Please read them.  They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any.  The terms also apply to any Sysinternals\par
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab updates,\par
\pard\fi-363\li720\sb120\sa120\'b7\tab supplements,\par
\'b7\tab Internet-based services, and \par
\'b7\tab support services\par
\pard\sb120\sa120 for this software, unless other terms accompany those items.  If so, those terms apply.\par
\b BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS.  IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE.\par
\pard\brdrt\brdrs\brdrw10\brsp20 \sb120\sa120 If you comply with these license terms, you have the rights below.\par
\pard\fi-357\li357\sb120\sa120\tx360\fs20 1.\tab\fs19 INSTALLATION AND USE RIGHTS.  \b0 You may install and use any number of copies of the software on your devices.\b\par
\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0   The software is licensed, not sold. This agreement only gives you some rights to use the software.  Sysinternals reserves all other rights.  Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement.  In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways.    You may not\b\par
\pard\fi-363\li720\sb120\sa120\tx720\b0\'b7\tab work around any technical limitations in the binary versions of the software;\par
\pard\fi-363\li720\sb120\sa120\'b7\tab reverse engineer, decompile or disassemble the binary versions of the software, except and only to the extent that applicable law expressly permits, despite this limitation;\par
\'b7\tab make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation;\par
\'b7\tab publish the software for others to copy;\par
\'b7\tab rent, lease or lend the software;\par
\'b7\tab transfer the software or this agreement to any third party; or\par
\'b7\tab use the software for commercial software hosting services.\par
\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab SENSITIVE INFORMATION. \b0  Please be aware that, similar to other debug tools that capture \ldblquote process state\rdblquote  information, files saved by Sysinternals tools may include personally identifiable or other sensitive information (such as usernames, passwords, paths to files accessed, and paths to registry accessed). By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.\b\par
5. \tab\fs19 DOCUMENTATION.\b0   Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes.\b\par
\caps\fs20 6.\tab\fs19 Export Restrictions\caps0 .\b0   The software is subject to United States export laws and regulations.  You must comply with all domestic and international export laws and regulations that apply to the software.  These laws include restrictions on destinations, end users and end use.  For additional information, see {\cf1\ul{\field{\*\fldinst{HYPERLINK www.microsoft.com/exporting }}{\fldrslt{www.microsoft.com/exporting}}}}\cf1\ul\f0\fs19  <{{\field{\*\fldinst{HYPERLINK "http://www.microsoft.com/exporting"}}{\fldrslt{http://www.microsoft.com/exporting}}}}\f0\fs19 >\cf0\ulnone .\b\par
\caps\fs20 7.\tab\fs19 SUPPORT SERVICES.\caps0  \b0 Because this software is "as is, " we may not provide support services for it.\b\par
\caps\fs20 8.\tab\fs19 Entire Agreement.\b0\caps0   This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.\par
\pard\keepn\fi-360\li360\sb120\sa120\tx360\cf2\b\caps\fs20 9.\tab\fs19 Applicable Law\caps0 .\par
\pard\fi-363\li720\sb120\sa120\tx720\cf0\fs20 a.\tab\fs19 United States.\b0   If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles.  The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort.\b\par
\pard\fi-363\li720\sb120\sa120\fs20 b.\tab\fs19 Outside the United States.\b0   If you acquired the software in any other country, the laws of that country apply.\b\par
\pard\fi-357\li357\sb120\sa120\tx360\caps\fs20 10.\tab\fs19 Legal Effect.\b0\caps0   This agreement describes certain legal rights.  You may have other rights under the laws of your country.  You may also have rights with respect to the party from whom you acquired the software.  This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par
\fs20 11.\tab\fs19 Disclaimer of Warranty.\caps0    \caps The software is licensed "as - is."  You bear the risk of using it.  SYSINTERNALS gives no express warranties, guarantees or conditions.  You may have additional consumer rights under your local laws which this agreement cannot change.  To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par
\pard\fi-360\li360\sb120\sa120\tx360\fs20 12.\tab\fs19 Limitation on and Exclusion of Remedies and Damages.  You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00.  You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par
\pard\li357\sb120\sa120\b0\caps0 This limitation applies to\par
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab anything related to the software, services, content (including code) on third party Internet sites, or third party programs; and\par
\pard\fi-363\li720\sb120\sa120\'b7\tab claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.\par
\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages.  The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par
\pard\b Please note: As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French.\par
\pard\sb240\lang1036 Remarque : Ce logiciel \'e9tant distribu\'e9 au Qu\'e9bec, Canada, certaines des clauses dans ce contrat sont fournies ci-dessous en fran\'e7ais.\par
\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0  Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par
\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0   Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par
\lang1033 Cette limitation concerne :\par
\pard\keepn\fi-360\li720\sb120\sa120\tx720\lang1036\'b7\tab tout  ce qui est reli\'e9 au logiciel, aux services ou au contenu (y compris le code) figurant sur des sites Internet tiers ou dans des programmes tiers ; et\par
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab les r\'e9clamations au titre de violation de contrat ou de garantie, ou au titre de responsabilit\'e9 stricte, de n\'e9gligence ou d'une autre faute dans la limite autoris\'e9e par la loi en vigueur.\par
\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage.  Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par
\b EFFET JURIDIQUE.\b0   Le pr\'e9sent contrat d\'e9crit certains droits juridiques. Vous pourriez avoir d'autres droits pr\'e9vus par les lois de votre pays.  Le pr\'e9sent contrat ne modifie pas les droits que vous conf\'e8rent les lois de votre pays si celles-ci ne le permettent pas.\b\par
\pard\b0\fs20\lang1033\par
\pard\sa200\sl276\slmult1\f1\fs22\lang9\par
NtSetInformationProcess
ConvertStringSidToSidW
Sysinternals Rocks
RtlNtStatusToDosError
RtlInitUnicodeString
NtOpenFile
NtFsControlFile
NetIsServiceAccount
CreateRestrictedToken
Wow64DisableWow64FsRedirection
LogonUserExExW
WTSGetActiveConsoleSessionId
WTSQueryUserToken
install
remove
PsInfSvc
%s -install          to install the service
%s -remove           to remove the service
%s -debug <params>   to run as a console app for debugging
StartServiceCtrlDispatcher being called.
This may take several seconds.  Please wait.
CorExitProcess
RoInitialize
RoUninitialize
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CreateEventExW
CreateSemaphoreExW
SetThreadStackGuarantee
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
GetLogicalProcessorInformation
CreateSymbolicLinkW
SetDefaultDllDirectories
EnumSystemLocalesEx
CompareStringEx
GetDateFormatEx
GetLocaleInfoEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCMapStringEx
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleExW
SetFileInformationByHandleW
(null)
`h````
xpxxxx
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
MessageBoxW
GetActiveWindow
GetLastActivePopup
GetUserObjectInformationW
GetProcessWindowStation
`h`hhh
xppwpp
1#SNAN
1#QNAN
LoadUserProfileW
UnloadUserProfile
CreateEnvironmentBlock
DestroyEnvironmentBlock
USERENV.dll
GetProcAddress
LocalFree
GetFileType
GetStdHandle
LoadLibraryW
GetModuleHandleW
GetCommandLineW
GetModuleFileNameW
SetPriorityClass
GetCurrentProcess
GetLastError
SetLastError
SetEvent
WaitForSingleObject
WriteFile
CloseHandle
ConnectNamedPipe
LoadLibraryExW
CreateFileW
MultiByteToWideChar
ReadFile
GetCurrentThread
InterlockedIncrement
InterlockedDecrement
GetVersion
HeapAlloc
HeapFree
GetProcessHeap
SetProcessAffinityMask
TerminateProcess
GetExitCodeProcess
SetThreadPriority
SetErrorMode
ResumeThread
WaitForMultipleObjects
FlushFileBuffers
SetHandleInformation
CreatePipe
DisconnectNamedPipe
lstrlenW
CreateEventW
CreateNamedPipeW
FormatMessageW
SetConsoleCtrlHandler
KERNEL32.dll
OpenDesktopW
CloseDesktop
OpenWindowStationW
CloseWindowStation
SetProcessWindowStation
GetProcessWindowStation
SetUserObjectSecurity
GetUserObjectSecurity
USER32.dll
RegCloseKey
RegOpenKeyW
RegQueryValueExW
GetTokenInformation
SetTokenInformation
AllocateAndInitializeSid
FreeSid
GetLengthSid
InitializeAcl
AddAce
GetAce
AddAccessAllowedAce
LookupPrivilegeValueW
GetSecurityInfo
SetSecurityInfo
LsaFreeMemory
LsaClose
LsaOpenPolicy
LsaEnumerateAccountRights
RevertToSelf
OpenProcessToken
AdjustTokenPrivileges
LogonUserW
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CryptAcquireContextW
CryptReleaseContext
CryptGenKey
CryptDeriveKey
CryptDestroyKey
CryptExportKey
CryptImportKey
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptHashData
ImpersonateNamedPipeClient
OpenThreadToken
EqualSid
CopySid
GetAclInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
LookupAccountSidW
LookupAccountNameW
CreateProcessAsUserW
DuplicateTokenEx
SetEntriesInAclW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
ADVAPI32.dll
CommandLineToArgvW
SHELL32.dll
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
CreateThread
GetCurrentThreadId
ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetConsoleCP
RtlUnwind
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW
OutputDebugStringW
HeapSize
SetFilePointerEx
WriteConsoleW
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='asInvoker' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
2Q2Z2m2
3/3F3^3g3
4P4U4Z4`4g4
5%555c5
5	6Q6\6f6
8'8,8H8M8i8n8
8&90969`9
;7;J;\;c;m;s;
<"<(</<4<D<M<R<X<_<d<t<}<
<B=L=`=i=
>!>8>Q>~>
?h?q?{?
'010E0N0g0
1"1;1n1
2'2.2C2t2
4?5[5z5
657A7H7O7x7
758<8F8S8
;"<(<;<B<p<
<A=Q=m=t=
>.>~>(?Y?
0<0H0T0i0
1D1I1O1V1[1p1
4-4I4i4
546B6K6Y6`6f6{6
8:8[8a8
9+959E9K9R9v9{9
:*:1:D:
;&;9;E;Q;e;
<(<.<5<C<L<Q<a<g<q<|<
<.=@=I=}=
0:0E0O0T0[0a0g0t0y0
1:1S1a1l1q1
2,2F2Q2
3+303:3A3L3Y3b3g3
474X4m4
5 5&515]5d5
6)626J6~6
7$7*70767<7B7o7v7
7E9M9V9_9
:&:<:]:
;!;-;=;C;T;s;
;M<S<e<
2 2$2(2,2024282
3 3'3,30343U3
4$4(4,404
516K6X6g6q6
797F7O7s7
:&:H:O:
=<>C>K>W>]>d>p>u>{>
? ?,?2?9?D?I?O?Y?_?
K0S0j0
091@1S1
2&262F2V2_2
3#363;3
3C4S4b4
6:7?7I7
9Q9\9b9
:h:";U;	<O<e<
=*=T=[=b=i=
 050C0L0w0
0'1A1I1T1k1
6E6K6t6
848H8x8
979=9G9]9p9
:D:I:n:
;2;B;K;S;k;~;
<$<*<2<7<=<E<J<P<X<]<c<k<p<v<~<
=!=)=.=4=<=A=G=O=T=Z=b=g=m=u=z=
>*>1>>>G>h>
?1?8?>?L?R?g?x?
1,232;2
3%3A3b3
4$4)43494[4h4p4v4
41565?5D5M5R5_5
8>9S9z9
=)?/?U?[?z?
1E3I3M3Q3U3Y3]3a3[4
5090=0A0E0I0M0Q0!2(2
2_3h3p3
5)565;5I5w5
;Z<c<o=x=d>
0:1@1G1
3%414<5
;J;V;b;q;|;
<%<.<;<j<r<
=/=A=S=e=w=
>&>8>J>\>
8-838o8
:':-:3:;:A:G:O:X:_:g:p:
2"313P3l3
3U4o4x4
7P8<9B9F9K9Q9U9[9_9e9i9n9t9x9~9
>$>0>?>
< <$<(<
1_3 4(939s9
< <$<(<,<0<4<8<
= ='=,=0=4=U=
>$>(>,>0>
0U2`2p2
P2T2X2\2`2d2\9d9l9t9|9
,=4=<=D=L=T=\=d=l=t=|=
>$>,>4><>D>L>T>\>d>l>t>|>
?$?,?4?<?D?L?T?\?d?l?t?|?
0$0,040<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;
>(?H?h?
000P0l0p0
101<1X1d1
2 2@2`2
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
7 :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
< <$<D<l=p=t=x=|=
>(>,>0>4>8><>@>D>L>P>
Washington1
Redmond1
Microsoft Corporation1!0
Microsoft Time-Stamp PCA0
160330192128Z
170630192128Z0
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:98FD-C61E-E6411%0#
Microsoft Time-Stamp Service0
Chttp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X
<http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Code Signing PCA0
150604174245Z
160904174245Z0
Washington1
Redmond1
Microsoft Corporation1
Microsoft Corporation0
MOPR1301
*31595+04079350-16fa-4c60-b6bf-9d2b1cd059840
Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z
>http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
	microsoft1-0+
$Microsoft Root Certificate Authority0
100831221932Z
200831222932Z0y1
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Code Signing PCA0
?http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
8http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
`Ge`@N
	microsoft1-0+
$Microsoft Root Certificate Authority0
070403125309Z
210403130309Z0w1
Washington1
Redmond1
Microsoft Corporation1!0
Microsoft Time-Stamp PCA0
	microsoft1-0+
$Microsoft Root Certificate Authority
?http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
8http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
1Jv1=+r
L&*H$_Z
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Code Signing PCA
http://www.sysinternals.com 0
Washington1
Redmond1
Microsoft Corporation1!0
Microsoft Time-Stamp PCA
160628184214Z0#
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
151028203146Z
170128203146Z0
Washington1
Redmond1
Microsoft Corporation1
Microsoft Corporation0
}*U{LM
MOPR1301
*31642+49e8c3f3-2359-47f6-a3be-6c8c4751c4b60
Chttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20110
110708205909Z
260708210909Z0~1
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
Ihttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^
Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
3http://www.microsoft.com/pkiops/docs/primarycps.htm0@
*?*kXIc
QEX82q'
WqVNHE
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 2011
http://www.sysinternals.com 0
eTc8d 
20160628184215.304Z0
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:BBEC-30CA-2DBE1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20100
100701213655Z
250701214655Z0|1
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
$`2X`F
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
oK0D$"<
r~akow
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
160427170619Z
170727170619Z0
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:BBEC-30CA-2DBE1%0#
Microsoft Time-Stamp Service0
Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
8L(f2wy
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:BBEC-30CA-2DBE1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher NTS ESN:57F6-C1E0-554C1+0)
"Microsoft Time Source Master Clock0
20160628165800Z
20160629165800Z0t0:
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
cOXMV3ac
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='asInvoker' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
1:1E1[1a1{1
2*383C3N3d3
3:4V4s4
5!575@5^5t5{5
7+7O7h7
;6;R;[;e;
<!<(<3<:<R<f<
<(=5=Z=p=
=A>W>c>o>
353@3M3Z3k3
7-7H7p7
9C9N9S9Z9`9u9
<U=`=v=
=,>X>a>
? ?'?0?;?Z?
2>2O2k2
808:8H8N8T8\8c8
9:9D9q9
91:<:F:_:s:
<(<-<I<N<j<o<
=@=l=r=
>(?-?7?i?
0S0_0d0m0r0|0
1&1=1H1_1e1k1t1z1
363E3M3Y3m3r3
4.5Z5w5
6#676j6q6w6
7	7"7+707D7q7
;><Q<q<
>P>U>z>
*090Z0|0
2M2T2]2b2
3#4,4>4h4q4y4~4
5 5>5[5
6'6:6L6R6Z6_6f6k6{6
7 7@7W7x7
9!9,919S9s9
:#:C:u:
;0;O;^;d;i;z;
<+<1<j<{<
<*=@=H=[=a=|=
0*11191?1N1U1
2&2-2N2Z2g2
4#4-474A4K4U4_4i4s4
5#5-575A5K5U5_5i5s5}5
9*989P9U9j9o9
:!:&:+:=:M:j:o:
; ;*;4;>;H;R;\;f;p;};
>,>6>s>
0"0f0n0
2*242:2E2h2m2y2~2
3%3D3[3j3
6[6e6v6
7+7Q7k7w7
:,:3:;:@:D:H:q:
:";(;,;0;4;
<Q<X<\<`<d<h<l<p<t<
?#?2?9?J?X?c?k?x?
5-5[5w5
G0S0]0
1%11171p1w1}1
3+41474=4C4I4P4W4^4e4l4s4z4
42585>5D5J5P5W5^5e5l5s5z5
7Q:(;8;G;j;z;
=N=S=Z=`=
3&3-343L3[3e3r3|3
767P7k7s7
7%8[8n8
;9;q;y;
<?<Z<r<~<
<E=O=q=
>C>L>V>\>p>|>
?(?;?Q?Z?f?q?
090N0T0^0d0t0|0
161I1O1U1\1e1j1p1x1}1
2#2(2.262;2A2I2N2T2\2a2g2o2t2y2
3%3-32383@3E3K3S3X3^3f3k3q3y3~3
434\4o4
525C5O5V5]5x5
:<:B:G:Q:W:y:
;O;T;];b;k;p;};
3I5O5u5{5
5;7e9i9m9q9u9y9}9
:#;K<`<
<!<:<D<Q<[<3=T=[=
>;>P>Z>
1~1K2z2
=A=V=\=
1Q2 3B3M3
5 6?6^6
4#4l4x4
5*565E5N5[5
616C6U6g6y6
7(7:7L7
0%0+070G0M0\0c0s0y0
1+212=2t2
2A3G3S3
5'7?7o7
2!2%2)2-282X2
9:9P9f9
:+:>:e:
<8<U<k<
>3>[>k>y>
2O3T3Z3a3
3~4%6>7I7c7{7
G1R1r1}1
: :$:*:.:G:
00R1Z1
3.464B4Q4
;E=c=|=
> >$>(>r>x>|>
? ?$?E?o?
2E4P4`4
034383<3@3D3<:D:L:T:\:d:l:t:|:
>$>,>4><>D>L>T>\>d>l>t>|>
?$?,?4?<?D?L?T?\?d?l?t?|?
0$0,040<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,54585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<
80X0x0
1 1@1L1h1
2$2(2D2H2d2h2
383X3t3x3
484X4x4
585X5x5
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
7`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
<,<L<X<\<`<d<
=0>4>8>@>D>H>L>P>T>X>\>`>d>p>t>x>|>
3 3$3(3,3
Washington1
Redmond1
Microsoft Corporation1!0
Microsoft Time-Stamp PCA0
160330192127Z
170630192127Z0
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:7AFA-E41C-E1421%0#
Microsoft Time-Stamp Service0
Chttp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X
<http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
@8A*90C
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Code Signing PCA0
150604174245Z
160904174245Z0
Washington1
Redmond1
Microsoft Corporation1
Microsoft Corporation0
MOPR1301
*31595+04079350-16fa-4c60-b6bf-9d2b1cd059840
Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z
>http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
	microsoft1-0+
$Microsoft Root Certificate Authority0
100831221932Z
200831222932Z0y1
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Code Signing PCA0
?http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
8http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
`Ge`@N
	microsoft1-0+
$Microsoft Root Certificate Authority0
070403125309Z
210403130309Z0w1
Washington1
Redmond1
Microsoft Corporation1!0
Microsoft Time-Stamp PCA0
	microsoft1-0+
$Microsoft Root Certificate Authority
?http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
8http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
1Jv1=+r
L&*H$_Z
Washington1
Redmond1
Microsoft Corporation1#0!
Microsoft Code Signing PCA
http://www.sysinternals.com 0
:^-ppI
Washington1
Redmond1
Microsoft Corporation1!0
Microsoft Time-Stamp PCA
160628184324Z0#
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
151028203146Z
170128203146Z0
Washington1
Redmond1
Microsoft Corporation1
Microsoft Corporation0
}*U{LM
MOPR1301
*31642+49e8c3f3-2359-47f6-a3be-6c8c4751c4b60
Chttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20110
110708205909Z
260708210909Z0~1
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
Ihttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^
Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
3http://www.microsoft.com/pkiops/docs/primarycps.htm0@
*?*kXIc
QEX82q'
WqVNHE
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 2011
ZYVS0@
http://www.sysinternals.com 0
20160628184324.664Z0
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:BBEC-30CA-2DBE1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20100
100701213655Z
250701214655Z0|1
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
$`2X`F
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
oK0D$"<
r~akow
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
160427170619Z
170727170619Z0
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:BBEC-30CA-2DBE1%0#
Microsoft Time-Stamp Service0
Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
8L(f2wy
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:BBEC-30CA-2DBE1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher NTS ESN:57F6-C1E0-554C1+0)
"Microsoft Time Source Master Clock0
20160628165800Z
20160629165800Z0t0:
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
ikp6F(