Netstat -b on Windows



  • netstat in some upgraded version of Windows XP has a -b switch that "displays the executable involved in creating each connection or listening port." For fairness, it's also documented that "[...] this option can be time-consuming[...]" but that's a gross understatement. In fact, it took some ~2 minutes to display "the executable involved in creating" some 50 connections.

    We've had a discussion about this on another thread. I've pointed out that I had no pagefile (maybe a WTF in its own but I'm a romantic), so some ~2 minutes of disk access couldn't be justified. Someone reminded me of memory mapped files and delayed loading, but I still wasn't satisfied. So I fired up FileMon to have this issure clarified: (sorry, couldn't resist)

     

    In short, netstat -b scans the entire %SystemRoot% directory tree multiple times per connection. FileMon was displaying some 234,000 file (mostly directory) accesses by the time I got bored and cancelled netstat, at which point it was still trying to print the second connection...

     

    I'm OK with the occasional sacrifice of runtime in order to shorten the coding time, but this is plain, old MS™ WTFery.



  • Okay



  • You had me at "displays the executable involved in creating each connection or listening port."

     



  • I just tried it out on my PC then and it was virtually instantaneous. Admittedly, I only have 5 active connections, but yeah, it's not really following the pattern you described.



  • @aib said:

    In short, netstat -b scans the entire %SystemRoot% directory tree multiple times per connection.

    blinks

    WHY?!



  • The -b is a truly wonderful option though.  Highly wish Solaris would support it to make the old "ah shit, what port is this server listening on?" nag a little easier.



  • Linux has -p, and SysInternals has a utility called Tcpview that does the same thing without all that HD access...

    Just tried -bv, which shows you a set of DLLs as well... ~250k filemon entries to show me that inetinfo.exe and ws2_32.dll have port 80...



  • @vt_mruhlin said:

    The -b is a truly wonderful option though.  Highly wish Solaris would support it to make the old "ah shit, what port is this server listening on?" nag a little easier.

    Historical irritation - most other unixes have -p, but solaris has always lacked this feature. Install lsof from SFW and use that instead.



  • Never heard of that -b parameter before in XP.

    When I have had to find out which port is being used by which executable I go for the -o option which lists the PID of the processes. That combined with -n makes it really fast to find out which executable is linked to which port.



  • I would have guessed that Windows doesn't really know which process the port belongs to, so it takes an image of each running process, kills it, looks if the port is free now, then recovers the process from the image taken earlier.



  • I just tried this on a running webserver, instantanious results.



  • @ammoQ said:

    I would have guessed that Windows doesn't really know which process the port belongs to

    That's not entirely true 



  • @bobday said:

    @ammoQ said:

    I would have guessed that Windows doesn't really know which process the port belongs to

    That's not entirely true 

    The filemon and regmon (now procmon) utillities install their own drivers to intercept the requests and get the desired data. I don't know if TCPView does it the same way, but if yes, it wouldn't  technically be windows that knows the mapping. :)



  • @PSWorx said:

    The filemon and regmon (now procmon) utillities install their own drivers to intercept the requests and get the desired data. I don't know if TCPView does it the same way, but if yes, it wouldn't  technically be windows that knows the mapping. :)

    Judging from the fact that I've never had to install those programs (extract&run works fine), I guess they do that at runtime?

    Do you know if they extract a driver file and then load it, or use a less hacky way?

     

    Anyway, if netsat has a -o switch that shows the PIDs (didn't know it had one, is it new like -b?), it's trivial to get the executable's name from that.

    Of course, "svchost.exe" tells you nothing at all.



  • @aib said:

    @PSWorx said:

    The filemon and regmon (now procmon) utillities install their own drivers to intercept the requests and get the desired data. I don't know if TCPView does it the same way, but if yes, it wouldn't  technically be windows that knows the mapping. :)

    Judging from the fact that I've never had to install those programs (extract&run works fine), I guess they do that at runtime?

    You've been using Windows too long, you're starting to think that there's a difference between running an installer and running any other kind of program. The thing you download is the installer, it's just completely silent and doesn't add anything to the start menu or desktop. It does scatter files into the \windows\system directory and keys into the registry. It also doesn't have an uninstaller.



  • @asuffield said:

    You've been using Windows too long, you're starting to think that there's a difference between running an installer and running any other kind of program. The thing you download is the installer, it's just completely silent and doesn't add anything to the start menu or desktop. It does scatter files into the \windows\system directory and keys into the registry. It also doesn't have an uninstaller.

    Surely you must mean "not been using Windows for long enough"? Any decent OS would not let programs do that, at least not behind your back. User programs for the said OS would also be more user-friendly and be more specific than "You must have administrative privileges to run this program."

    Fuck me for thinking they used undocumented calls, everyone knows there isn't any in Windows!



  • FYI - netstat -o (letter oh) will show the same thing, but by PID. It's trivial then to open up task manager, add PID to the column list, and see what process is using the ports.

     



  • I've taken a quick look at it, and I think I know why.

    The -b command, to quote netstat -?,

    multiple independent components, and in these cases the
    sequence of components involved in creating the connection
    or listening port is displayed.
    And if asking netstat -anb for an example, you get to see what for:
    UDP 192.168.228.8:1900 : 1340
    c:\windows\system32\WS2_32.dll
    c:\windows\system32\ssdpsrv.dll
    C:\WINDOWS\system32\ADVAPI32.dll
    C:\WINDOWS\system32\kernel32.dll
    [svchost.exe]
    It becomes rather obvious that it's looking for what files ("sequence of components") have been used. That's more information than the process ID alone can give you. And way more than most people will need at any time; but this param is not for them. Though it's questionable wether it needs to look at every file even once, let alone one time per line of that output. Or why they aren't providing a -o speed option for displaying name or even both pid and name.




  • @asuffield said:

    You've been using Windows too long, you're starting to think that there's a difference between running an installer and running any other kind of program. The thing you download is the installer, it's just completely silent and doesn't add anything to the start menu or desktop. It does scatter files into the \windows\system directory and keys into the registry. It also doesn't have an uninstaller.

    You've been MS bashing too long to know what you're talking about. None of the apps mentioned from SysInternals installs anything to the Windows folder tree or requires an install; you simply extract them from the ZIP file and run them.
     



  • @KenW said:

    None of the apps mentioned from SysInternals installs anything to the Windows folder tree

    That is simply not true. 



  • @asuffield said:

    @KenW said:

    None of the apps mentioned from SysInternals installs anything to the Windows folder tree

    That is simply not true. 

    What do any of those install?  They're all self-contained, statically linked binaries.  What exactly do they install to the folder tree?

    (Unless you're just nit-picking since in order to launch a file it has to be stored somewhere and IE doesn't typically allow direct memory injection, so it'd have to exist somewhere.  Say, %TEMP%)



  • It occured to me that you might be refering to the fact that it loads a Device Driver.

    This is just part of the application and the driver is unloaded with the application.  If it leaves anything behind, it would be irrelevant anyway.



  • @ShadowWolf said:

    @asuffield said:
    @KenW said:

    None of the apps mentioned from SysInternals installs anything to the Windows folder tree

    That is simply not true. 

    What do any of those install?  They're all self-contained, statically linked binaries.  What exactly do they install to the folder tree?

    Most installers are self-contained, statically linked binaries, with their payload stashed in a resource inside the .exe file itself. This one is no different. 

    begin-base64 644 PROCMON11.SYS.gz
    H4sICF6RL0cAA1BST0NNT04xMS5TWVMA7b17WFPH1jC+AwEiBBI1KCpqWtFa
    r4EQICThIgSxFQwGEm9AEYIhcjMkqK1UFLBut+ntbXs8p55Wq6fHXo89x6pt
    rcXqEa3WeqvS6mlpa9ttQ1taqaZK3d9asxMISM/7fr/nff/4nt8bnyGzZ9as
    WbNmzbrMzI45ix6nAimKEkLiOIraT/GfNOo//ywIoKiI8W9HUHuGfHjXfsHc
    D+/Kt1bUyWvtNcvsJVXy0pLq6hqHfKlFbndWyyuq5ZnzjPKqmjLLjPDw0Jj/
    Av7//fzPf5K/XlbwcPOQYF9aOMsR3ADf7zLBwWtJmSg4GL7v+evo4NWkvizY
    Sb6dpH7hrBXke35FqRXb+/Aa9BQ1VxBMJdG3snxlHVSAIEwgoqil8DCSLwuy
    UFQjCF/jQnwSUI3wF1OwNwV52zY2eOGqBQCFH3iQ4rfU+937RT7ZgNeAGTtF
    7QrsK0c82UMhU09Rq6CD2sUUFf1v+CMt7r8WkM5Owe/Dz3BYVjng+1Q+Ty9V
    4P32+8gpyjrDXlbiKKEoRwiPszHEx4O+D/SbPYMHozw4hhJ+2OS7P9yxOblz
    8jH/vhj+wNipcO93/36/nGGvs5dSXp7Yvfjsd+CbNcNuqawBwPlAF/Kq0fs9
    EO73OfF/82G4AqaT0UsPdUSFG6qqKQPnFHNOERf5wGIBVQhjOomf7c0lAqql
    1SG2CdinYO7I80QBx3EG9slR3uemDrGB/S6doiR7g0h9AKlvn0RRTTosoJwh
    NorNh/aHCVbSt8lGWbvLBJQN/nGRC6BX6J6dfQ+Q1tVyfc0odi/As+Gj4U9y
    JmhKp5h9fC5UHi0qfF9E+eExMw1iyb4QziltahUZEIkc+kckjshyJqSczgow
    u7JEJjpLyEXmQz/FBIfYHwcDI88Su0zZzCkucu5iHLNTwtXLuSwpVx/D1Udz
    psnQRujXhskRlTPpQi5dVq5JF9nDkH/pUVzeNHc4UyB2pWcbuMhswkt/aps6
    pUaTGUd8ZaGAmhrUARxgVHtKBdSYyCuY1+2GvMk838DuzKGANXRh9zuNz2yh
    jJyzm9Z78uiCHnYp8IGA5MxFEKjqYbo4p4e5yc6GksCu4TcDVSxgG67rRJxH
    mYvFRYuP88zn6TCaJPucUmSdDVBxkVqgVLKvfftGfr7nNlmkVHnLpfoMyb4c
    KSN+THOsPpKJ7ADaAk9rPqgbwuml5epCqb2jvKlBSjmiJfv0UubU1GOHvgjI
    cwkfMZjZ4/fD9B8RTy2UNjaIKIdMsu+wTTC1y4S1fH+B7cVF5czhxX5zYTQx
    qnioMisvvXcaOnOHcpFdZUhSw3UjfMzcBaDODaPxzQWKjxVBuUgFNHxfSvmN
    ktGLANzZqNuMUuhIa9S5iDjmubJF6vBWaOXMWrdKilqwXmdtLEMskxfzMumH
    9GgQNhO4R1tbAaTpOJe3/4FPP+EM3hbTAOStB8oQDvsRcJEdC3He/aUlLw+m
    nQBxkZcX4jzHQKt3kAT1WPzr0DOqI/DddNQDDkEANTVLqtGL6gKU11uuOwtc
    eo+Bu7gdAZkCz1SDh8npGZPdownPB4xr564RaSINkFs5y0rBF3vPb94FEGfi
    LjaVSykmHHHDKqCj6GwhLdiBj8AdQZaUyRHTsUyudOoxV2aszD3cSyQOgdGL
    m+SUshWFp58U5zH6qCZLDwVjkuxrkHPOaFf0u/GgVQIPG1ixd/VJmjdSqP1F
    AlAzzmEgKGLKOYIJ3w9d07lS9xiUC2cQnSV1S5Vn38LiWV2SQ0Nn0SapZG+O
    iM6FBZYjLqdzxXQwFykHfsESZvQyOisG+qezprEv9XAcnRVdzujlsMwnM22H
    OgJAA8S4suINtEnO6ucQGQy85g5knD247mEgcn8JUbYaoIEMlAev/wwGdjTQ
    X9hfjtZ1ouNlfQbG42rZBcw1gD7cA51L9rW6XFiQB1iiOWeUPy729G2OO/5+
    1J2YTP6oENJKcHV5S0wwhAHo2GbABbIcKdl3yiV2oS/HnJ56hgllCuR0aJH/
    qEwHcQZRkaGgETHmBdMrxzC50YsRoIibiLPcTyuQtmbmlJLzyilZJfvxj+aY
    YwwDPdKkiE4XqoOIPN50CJWX3ONIR++AnW8dvDdepFo4xxjXSo8L5E7UdEgI
    bCsQmXihffEmxxUXEX3QT8/qRb3LcUdXmW9N9gLxUESWMk3m98jYP+KJP4j0
    uaMYQdMhT94OfCA90bVCVg2d8WPTnHJ+hg2QuuIid7KVJX3g8rTuJioANTVZ
    6jtQW9NET/N6ov9I+9Pd1BkDy4PRGQBOed2kvJRh5FXKRa/aEEKFyZobAshb
    SYGYFKAxtkaBBjCZCNt57pAFS4bARYoQzmitRGLG4nhpVRn5a0U0F22z32PB
    1TAb6YYeNtID4xwrhRbuUSBWHi5SBnlBQ49tNlgNkOLuGxznyunJgycwLwZb
    GHcObN95psGjTqxPc80Tv/1lGHB0lObTOjGzWhh4S3MT6laGp607FA1j1oTY
    v3KPqmjFfGAbky2mw9GEMGnSHR3EkPEdmqyjYZwmk0t/2WDlAsdTLn23oS0I
    dRb1xS9BtAr1WJv+chTINe3saNOzwADIXaGdnbSzi4uMQrtdpGztb8WaOuVg
    hukcj7LVlePJc+V05BloPQzkCq1naX0Xre926UWGNn0HIm7TdyJWLpIiBr5B
    qGwFvaAXHR8wb3LQe4AFahApcAWxE8z+aMV3oO1Z5I9W3Ksy+ywAo/IAjEvf
    Y1BeMhptAnS4LugmwJpxhChbrx4EbGabEqbCyC65DhPn0dyiGzxOrNuOCgMa
    QqXZ2xD6CjN6GUwXetSFYkekLWkBziZ6czAEWygBZBqkmluOSGxuE5ptUb7W
    gU0SjmmQQV0G1gFFo/oocs70UnL2F47THKZDHOO8cmLwgpH+uUQvAeMZvYcY
    in6as6lTbDThZLv0HKTbyksGIJXdnwGxAhfpQQ3TpbnmjEoqFDkVXGQ3FEB5
    l7fcMRYNH9AlMlqRxyYusnYRr0y68VvvwQ4H2FlgLU46eAvEnxWRWVmz0hZv
    kxvZIH4w+h4H2BYRE7kLhdQ2PvDMfOhWSHD2bFwAY+kBu+GqFWwSpSWfcP46
    9SjjFKeVgyxAn65MKgC9SlD+ttkGI/tGN8GZJXREGJFeoJICTO7Acnqcn+W0
    Kaz7i0HP7QZvVnkdpPyo/lsK2E+vFJbTiWjRaiGjYAqlms8kxG0GxnUYTCZT
    7zg0RxtC4lqvZgtQFlphkjuA+Uh0hlRzVNI8WoBrpud6mkjgCGKyte4Q5jRz
    nzbwAzrncjmTlgT0t6OVyQqgQamqDOCU/3INLOhsIViWCdDNZWCCFPDB2M/8
    wMwWljfF1FJgXUXldAhQK7DdLgal4r5H2Zp2mLGwjFPGZGHbcBvOGopBU7mQ
    4qFgHG36HozbbAlAn2RfGnywy/XQJeME+40t05j7oSovbf71dCSaW5HpDmby
    Mvn58JLibX2GZXKRonSqF105HYz0TOylJ2oweoAMMJ4c4VikGNmV08EL0Cb9
    t2w5iOL7sn4rFcOBlutH9RzlWGJ2PSxk2sDnA9dE5Jzb2CAWGN95AB02EXOC
    NzNNqZQzsunhKMoRxmRFMbnRtACcLGguQGgeDq1LYwNHLXYMsaEYy4g+6+9V
    2UgEtJq4H/01krjJ0k0ZzaCHGjxvYeev8D1vN6DNxT+aw45sEyNy1XYwKbjc
    0K8xmOmcHi4S/WldAPq/45gsOZMbQwtsSGDTJMrEhqGz9pFvOfVoDjvfLlKP
    RYzFix2jrfJSr7/buucf6O+W9vm7pT4vkZDNj6h3LdpybFKY6j/8RJyWEeBF
    2gSGtjTRtGGgKdLEoM8XDfTVwfUo7XNbmHAD76E2tcppUVua0MD7HMypHYbe
    nskgDexjMIYif3/A7KWOsCgNsu/hH02bIw1UcJSrlmUiWo47ZPyogQ0+tgBT
    fBPIc6g8CljEgkum+Zw57DxStJggLr7DbwKbYYRYSmoTKVuVlxZee0U9dksJ
    KuUexyyT1xl8/ld0i0GnzTTaonFhG0EMtpBwa00wo+8AnWS0gSsttQm8FfAV
    DQQWwbwUgxoRD+gRmGPkasXKS6hQv/f49No8sDJyaGY22qLQbBkNqKm9XXgw
    4BMtJB2Jla02Iajza69wF1BVEoXZwysaksHOwSHTewZ4/+s6cT/I2JRzjDNB
    oKZspQtBMI+8wjSImNliW1QRrd/v0u8Hdd9oIAqRLrxCF3YdnS0V0IUHaGcj
    Xdjcpt9MLHzhRrrwcbrwqV6jLNpYLL1qB/9lnQ53ByaHUlSdHJeukXgv0xb5
    hDmMPCON7pNG75hdLVbceiCgOOjLLn07kMEauDcroYJbCTPhYevA92tudYpJ
    BTwfhplRF8scoezCLtCGBVvdBcAgl36LAfnjoQu30IVbwYrqt4Tptzq1NgWY
    2G50B7pdLUnYny0QdBUhf804hhRNbVmAC8ulhb9jXEvgL52zldZvMdqELv1J
    A5pgwHuSu7D9qRJcvBsLuY2FYWCic07nEUtnFcFfHMZp9zCX/rSh9zlyMtqB
    w2tmufRdMLRjBlcLxZEo4jT71A0UAkYVAyDgrDhCOAV3YaOeY/RdoB+8T8C3
    0zzfehkIkTxLF3Y7QiCKB/+mG57byUO7QN+tLgREkr2gzTDfRfJhkGdmywCp
    Xh3lCGFEzByROxAUhcsgAs0snG9AAWf03U2t8QZjng2WE3v4J5R/aMUp2PBb
    HGfkVsp4reEeYzT6w3MrReAbsU/+xC8YSfNvGO3MFtHBTMsaGKuRzhJzb2KO
    PYgu6GE0dnz/Bgga2b+hb6/fsiknjIbVrN8KESLIJYkdT0K0yeiPQay4Sc9t
    zJ1OF8k2Zk1jXCKcoVw54xKTTAw4B+3lZ65C7KmALMtnZzQdjU8+7IiS7G2F
    yT/P6K9wChP7RTIfYzrPJ8EMjkLu8LVdWHu4t1Zd2OkYiQyGqeo0sS9DBT5h
    ZZe68LJjKPIb6i6b2Ef5RmDeWdWPHOcOhDWBAjoFuWQTIoPoYpktBJhU+BNO
    uUPKuJAftAjbCKBNUiHHqJC5jmBYDVe4CzjHJN9J8u0kf5m7gERjtou7UOzn
    THljr3BUnGaiPt3hrnSWMYg1BSJHODNE85HzR2VrMapd5VlXtpCE7q7sKDVp
    4viGGWpiVgjpEbRdyERiET2UXi2k7xPSBKDIfaSfxYXArbQvcFNeV6vQA3JK
    fJEZeMBfgxQYmUKRkX2AGC1Qdnyd2tkjadmFjkaibbKJvdvt23/4G5SBa/DW
    4xiRnCZ7C03lMtT4dJHYVSQEHCYRHXg0S+o1FqinAzm0WYDcOU1NtjMdMTwb
    XFlRxBKl8ZZoB36D7nP2pAHmQB+hQIxTCnafcgwHJcqeAFl095n8poYeCqJo
    8C5XySinmMCJG1dJKWewgX2eyG3P4oF+AVoXiB+TCqXg+Tvykcijt3EBOcWM
    h33ntteuKG1J1gdAdRhZ+Xe8QypzRNNJTJaM7Dbg5igIzG3kTq6sHEZgcgvM
    7HrQGe5S3GGw+xAVELeTfQoNlsellxpsMiNXL7IFQPPvfyDydjfgzelCe5nT
    TWeLmBwPnS1mcnrobClYMHZtJ8eZ2HsAtXqcI9jEjvFgaH+nDYu5TjgskDQj
    hSYS17Df/eabv0ayfySlHPfwoQt4GkBGIJBR/gNxLJbg5pUI+RwOPbpzzBhf
    eu1tqYcnHxrK+IZCaDidb0jo7yT0dxH6uwn9HkJ/D/seMKnYxJZDDFZ0vN9O
    cVMn6A8Z2BsFOOxMlE1gZJN/4wUmStL8Jgng1FZRI+7LsltYJKGFkzT/B2qw
    LCEJHHsMZpsItDeYxPKmeygII3sQnp0VQaEFWSrZF1IOJC5y5UblSfblyvJw
    kwmj20xKDDoyCgZTK7IFwWBqO8lgFOAX0yImVwzjKWck5TAgyT5J4PE81zxR
    XlOr2MDqErwKxcNeAdmwUd6okXNGsesgIiqGMfHqApCDleBdugs4Y7IB0Rwf
    o2mCtsG8SZqbQf/2zuFKeAAvCHygcnWIM6ScmQdhkgR45ZS+gx5DyzhJC24J
    qn2Nccmm2xQGtuZbnoUiSfNMALTNstYGEA6aoIJpb7nkmGMLWshvmmVEGZhb
    NsG1v7DKqxynvA7xkcm6fwy4S+V0howtUmFkiQ5p0iJ0oZxiPgyMh6erZ7FH
    HNvV93vpQD+g22BmJ8ZSlPteYJwtI8/A/usbpAi4CT5TOZ1znZdQM4LyhwhN
    DR4YwjoKhwWrUsSpslFJhnCRCujJwMbc4ufeYcIZB93ejTMBna/k526nm8xd
    XL+5y+kmlgbnDzwMmC4ye2vjvbPXw06CIZvZU9dwDnt3c4oWFw9YWcZNhaLm
    S44xjbqtZL97mFU4Bh3izEW4Z4VlguSxf0bdNrr5kuSpVoN12misTyOOg2gj
    qWu+tNhRb1Zyah1hU6LJzI+RnXOTKIobjglejWNmX/8a1EIbapwhROOU06uE
    JnYS0FkEi5pvNuwmngoNg7JG3XNIVrFzonVvNPar5fs9GvQc2WePaCJdUs4g
    dmY36kTRgN0+spvOS6LyEtNFj8Uwfjv+sQUHHjVYpyxArAY+fAQuD+OCsHKd
    Dv9SCoqyn92P6ntHJv7B3H6MKnbk4x8D0etpRoO1Eh/RLtFjy8hfKwkrcEev
    zztlVHMxdtJlw1/7CKvHjBs8HnC6+T37HejJ89CnYIEDxKmBEOgCekMr3BM0
    Wq9AlERCL35PkBep4qIdyEbfBphfFABOOFkF4GaFmEy0nkW8RIfjPoiJU8lK
    cXOtg99cu9Km70wjm2tdtLObnR8HQ/Bobq8RodJMikOLqbldDEJR1H9nBTj+
    jwDcFmaB68mHD4oAaV0oxmvnoWBT+/adJXhew2QLNTkiCHoh3nL+7I6wxaLh
    MbOGK7geGm8FOEI3ncNW7RjltYFVGDi3xncQNQbN53mTDB4siYpbWp05vtM+
    RCvF3YT4r7xHHaCQReDj8Sd+IleWFLxEWM153EqhgdXC4iYE0sEgEbQKs8VF
    mwo47AYpWTxgtw61lowJNr+HZ0PKS5o25rQ9gLnI5Ehd6eDVqKNovcw5JKlQ
    JGkZIsCTT4hUWVAIF9HSsoGS5iOQyc6WND9FCoIkzQwpcEyd/g1kJC3nUBXF
    zTewdV/yKk7S3ApFXAKjF3O1sqt/RYuRI25cHSSQtLyID+kxyrOa951BTLrc
    HX09LTgI3N40sXuoTTp/vk2A+yX5ZG9DzMyRasA7EtUFML/a4sw2ik5hw729
    OIq4BGCp+37ohkmTatoAyOMDYr/wAqm9ZES5J9iEC2xxdLDBHaIeteYuoBh4
    3uqDG4rIwDnw7dSADz6J8u7hS/vvYIDnJuUnb+9sofK48vrUQ3ROj6T5KwHy
    J1jSHCTwMupTZJSjHvLArE7CLDNaA9ECW7Yhjw5k07/wOQg63HdVNrVJze4k
    Zq1U8yt4piE0xiZgaj3uYBrseo6nr2VIb8tA0hLVuYkdP5Po16tuoKBxLfL7
    WwEGHDLNIYdUso8qh2/QyGCfYIB0DkiVXtzUGuDF+Y+OXncTWpUD38rPsOU0
    jOhZxBKYnW3AoKdW6MoKMLifZGZLvQ0f7G1Yj8ckSm5l1NUaEPOmtbJQSctL
    OOXzpMxseXo6HYY7r1YBgtWKXNniPEAH4s7VSrlaMfvXGeg4OIeC7wjBlwjI
    BGIFge7gu5w9dznFtmxOCZMW5u3OoeFWSrmVcvDPZvD0QjcwfEK1MAKPclsD
    W8HR6AHcQK0rUxFgYG9NJzxC/1XSjMYTrdHdgODqmyQ48w3qL5/7BoUb1jgo
    +dU/gWNpE2zMkbBXicXWHAXhdMSAxjKwX4CLhM9SiOcVXCRGrhv1EmKxMTKF
    dQUWWAQqBPCbAL/+c99y55TQK+oWE1sExG3SS4C+5taNWULHRGjP6KWcwpUl
    MrBpPOmNDRLKEYZmU8qbzZbrThBEOsx7LCge6HEz4F7nSnF/I01zgi7swb3/
    wm5JszjQ5/MESJo5kCNmjlhzAh0fR/T19GCRYwSvI7UCcETrpexBNJft7mno
    B1gFQjSXo6YTV+8uYDKvH42sAgaG5/jt7MlpUHlJ0kIJ+B1/awBp8/U00mZ8
    bxuY01uf+Rr9AWqvHsWpKJIyGWjzIkFFiBwSLvIB3DDIiJc0pyOti8Wwbsdc
    z4C6SL4O10sWCFI8F7lkEW+aiL/MLpuGTitutSoEZOO7t9/3/uVVAPeC/IB/
    lBHgyhDRGUKyW49Np/FNm1oV8By5ALVDQzflGMI5u/leoJLJFrccBzKRZRLU
    f9txV8nAXoe4Ax+fFBAcoONgNKFkNORoBebD4POyDv7EO46dkuZFuHohkpI0
    G9ApDQlwCJuWiclBE/hcJrYOHbJ5sDq6NqULtUH2cG1wvVAb6gzaNEfmDtw0
    J2hjThjMN0wmUBVKqALxgO6OpzPOblfBlfmugo75kn3DhTJXflzcfKags1yy
    t9UaiKvSDmwJzGNHfemTflT/m/RhG4OZ2WAKwSCBXsoS40OaFPcgMCMDf4lk
    onCfAjPRZKsCMnI6S46Z7Bg6N4ZJm0xnTS5nAskSzZom2Rdo4OpAn4DnXDrF
    uy6Bu3cBd6EOYnlYs1A3m69Dke/y+ftX2K9AZgB14yqh1BEBq4TJ6WiysBQt
    cg8HXUCCC95jYBdPwWXeyRZfRXfTyKPwNi0G30w/GSZIz94R1+FZLK4es3NI
    m16Mt53cwST4EeOpmYkcaIvYp73xmYgEbGhHWFsH8YmHMTlRTEE081PYz45g
    OpulDZ14d8AxBuoiANjcdzTgF8mI2CEwsmJla1Hh+9ED7/bUT3NlyfEaT30U
    Vz/ZRhkke7OkBjaHw5F5Y/MB93uIh4nrmCmUXT8sgOXtrNUGOOfb5tgUsAQO
    fOpVRIvB5LVliWz3wkqqxxnelCbcmCVlwy/j3YQo2sRvPsF0SsnFBdzfhemk
    i6bxu+Du0dDGSG5BOaWueWIgLU0IEcgbGI6vFTWuFYY7o9etjZJTQyjnwCna
    D1NAjkX729u8vKacHo64l05Zm97TWLGM672WYJWiZ8m33wrtB5zYkU11L6S4
    D9I+meq7ynTS+qcpUHYMdBbvjSpb++1YoFihSdJ6Q6zp7KhJFGU9go3ugUnm
    XfcdWAdmbIeYbPVHtVGYcY/dP15AtbqjmjwCtGmiHVJftZR45oUDYtIGqbAu
    ZH84BW3G4o2VJGATFIrsbiZNuAP1NKv6BOwONIzy38VuEGF3ADuRHLY1TSQx
    BzvkE9SpPgY/co/fuT6Msh+Xjb6TXB4YbASBJ+coDofZNgevo0Cs93g7f5br
    KMYGUI3lZm8PBfcQva41Ka+rC3vqleBTGh1DjVz8Pi/AZABwR/Q9HwFWwhMr
    hPIsjbPH/mGR7xS4GA/Ie89gplk78LwxbTJ/3thDq9CxtiIS6+kifs2MByS0
    /ormqGRzEyxUq4DCs3mwmjcneSvWVFvjFqBZwMNBDHXa9Ef4SOJYm/40RhJQ
    RetPovutP087220B1vumQhfr8c9nMOUQhhwxWKP6ZOlJHjf2/xAOhi8t40u9
    p3Us3qZk9FfYo0AhbjJeVzuvNIzbjmg0Rx3BBnYywG+X9T5enei7XnjSJrJS
    DwDGLGiK15S4SOsiYo+nQIgkgpVsZlRluAF+gZHgWb+ImSeE+NsmkOwToWvF
    XXBPh+Ew5G7UUJAiOl3oHuM7ZAxnl5KrUdAsvBOy0NJL824BG4XU+lYJ0CFH
    Og5OGkDHOKAjCvQSaB5CByxNMJp63NbMErpH4Ml0uohRMAVSOg67nyVk0oVI
    jKC3J7fUS4+3JK6V3TqJXEbt7TsN+57Vr28wZsmHnKPzeGWgzhGho1WJWiiY
    J8WLDRbwwA6UrazGrwPvvi1OiwhkyzG5IYLvormVmOkxZN/D//AaLxwAJIj/
    gMgShgsmN5g/juuLBm3R1gdwBI0wsRgwkND18hIUvZwOIBC8ch2EEOVqkSOI
    1ne4w8kdoBAIdD0lvQNxj+4dRQfOm298zivK42pw5Ul8hgKfl4fbqWMdOB3n
    dEK8ALFGsq8B/MgONDvlDFUeqBeVBwkpyT6PLVOyrw0dob3n0QoAZWAIcnhb
    JiIHfudgtMN7TcvBVpQT5xV3KLktKSynHw6wCazSpeSQbwl/3zTc4IUmQ2Ua
    OnDjkMUNpuuOBetuIwpJczsh9zKE9+e9yxFzJkaHPhZ30Xvizjk7TNxF9wjv
    2K1EYp1XTLwr5uXB1c3k8kpPAEaieoipvc7dl+f6xrQErwySoNrs1nuxKTl1
    wxVHqBmPFQi9tizJviDsgo/0X/C119xwRHvbb8dqQoYJb07wW2heOsAPH0YY
    BJkhB1mScUxoelhIOcZK9gVL9h07c5UxCcub1tx3e4kzuKn1NkRXzFF3AEjk
    SxMGSCQ6CiazQ4wb2gvJRjJe/QNhl6Egsni9DkEYD25LP4wAbcVFA2778Tda
    cQPA5L1895ucImfRECXRiiI3orORG8k9cuJi9SKAVbcFZfbk3SCzXLm6QezA
    a1iSfRCG3WcysxvOQo85UlqgaXMG0Q1i9wwky8Bu5fG4x/feZJAywUpO0+YQ
    mb03GQCaTvGyDKM29rW7B4yd3HatlzV5AuonN3kCHZFNHqEjrMkT4hiFxk9M
    QSzvvmGTLlDrpXU/4o1d99X9lAisyw8n+61GpkAM4YxM2XpXyNRjjow5jrFz
    nIvBx3XNEhs4u5B9lCM3H2Fmmg6J3ZOY+9BlTjYxdlGeSziCgCzvBQk8VeQO
    tEkXAsjI/fi+i+ZYXaBk3yGzYT774W0CVdzfe2FyZE13UeRiMRLpkHjVFfsc
    Dz4AmtzxHalDwXFIdShIeMfCy7UBt3CNTKHcrORoDR/AiY/qMZ7FvRabwBdT
    2Pi9TL1c0vwo8eJloNKkWoFDrBU7RNoIh1Ab7hRCS4Gp16fCaHjNb95tUQgS
    8EQthimMCjwcqI8Giy/nw4RaEYQMepmBHKV0fuzdIY4uZ4KJax8CDQ1cvdAl
    HG9g6XFEJEzsCDy5dsrZdgi6ikBc+66w8mPiXb0eUAkyDNzIjVEinSjwQWTf
    zCFC9/rqWXK+NPCGVoOIc4xC3dXb6MvzxAVi95/Fqyj9b7EZlZewBV5tqFMX
    iteYTGaXPgrPJSB+J32zibf5y6xk3/u22YvUdZ6cHA0v11xzREBhlAGjAXZT
    D8epC6OKixzRRrzwyp8IS8l9NG9LIyGnh70XyBl4IuE3etxdt4ltgb3DGMJf
    mZXhgsMzHhlYahSjL84Mxgdw95F8MX8L53nC9CjG43+hl4s8tpQcmuBteyyD
    Ff3NbTw+wRcKfo8uKU9XUN+94NrffITJCGHRhDApm+0jLKqfL29EFqMrL246
    wbHjb/CUgXYCIcL7nSj+UAIwKJAGfgD1aOXa+VvEfnIa2UVGEM0QWLORbcQo
    u40czkUNiCA8HLnjDWKMG3dy4E+0kX3yFpncctDRZJIATTQbxBfiKZVk31FX
    jjzPYJPi5QkprY/2DvqhHkLpDFe2uByXd8t1eoGQXiVyAH+jJfvw3M2VaZAa
    8tiVN3mBV59GZd0DAc5ifuOmxxuC6j3HfSGej9o+Fn3EsT2/IAIcOZiza9dJ
    v9F4SV3v6b1T7WWTBNnkufPuNhcpRpvZBTN8oYef4QE3uQdKntQW3Ct5j90i
    fY72SV4UOWmEySZ2qeQj7zTL/m9X1uKbg60s5ZlBV5bi1/90Zf16ml9ZH526
    c2Xheoji+cGzKpgsiWjGcwerTntlqosvBp5N4Xyr4j/hWUgvz3Bsv8+z6acG
    49kdND7zuzSK7qBx2q3BafQjEnfCQFeH8dG5iN33q0+bethnP+Q43rltX0oO
    9kH5O0bybUzI1K0fIS0e1g6ARHz8LZHJDHiH8FhVRN5FQHTkSZ/Qldz0Edf/
    JqCUJ64LRZ2VXeP6ExqKNTxSsR+pXScJqTwjugen9odTPLVHTnqpFQ1uY6Te
    nvq02QseX09SdsNJ7zT1ixJQjUCkQCxNqtopdorXNeCbgwHOQJuwyKtFCC7r
    KX4HCLRLhMmVI8szsOtG9p5+Tj5JzuP7nyzIkDaTuc9+v/wv36m7izjLnQay
    BwjUVf6MF78cMixDLnWDAj36C3ESg3yOp4k/PMMFFoz+LG+4V4ogYkOjncgT
    OAWDMTyxjSAHtiLJvog8MNzYgD09ovewfeUJvAdRcAMPbUddIFptMFVzfvAp
    WfwhPyWxJ3wKKHrgyD1c37j/ftl7cUXSvBMPndATdkzixy8m8lL5Exl/mG/8
    YreEDNs91Oc1wAjf7PZubC3kr217fJyAefV5MUQEBOyUD33MEP0eMw5HepnR
    zdo+QGZkX+dVTujH6M2gJh9ghb07YUS+yWqW4mrmGdXhWx6zbviWx4AbJWJe
    GsgV2Ou+6BOtti4Gb9mP9y0XEwwggFSzX/7Cs/mD4/zGT6TQNx0exwgCa0aC
    PzzBg+04zgcNA98aID37ieGES7wY0g3dvgkRUSZnEANsH8oPiPBbj9ehu/B4
    TLIvzE/4XJkiYZ/0iQnD3zrhdRln3eEyzhYaWJMMD3T4beLZAbhNDLW4U5yZ
    BLVJMpwKvHnIfn4MLIZTvBiDoH3dOK5udvU5MiE9fncJbFHW/RjN3IZJ3E9i
    yHbG05TTwZHtJP5u5RXy/tKwH4lkDcUyYOoVoLXqZ3RA+oDE5O7QAKBsBPKY
    jSZ2L/hREMUb2Xu6cbXcBX/dIf13IHxScJmXArzqloyr9yj7QqTfroufFveb
    jqc+8bKukr/d7YxAnYMu1BFyz9CP82lpfXwPJ3xP/4AIesydIh5gYDuG9a73
    R9pQxC3XcATorXr5KerjZzvy83UZBt5XSMgMqpHnUQdh5PHvCY+isQzXQQf0
    PuEnZM2Vgeywke38CK8DA3yhfKsjpptwZbOM7Jz1Wx/SAWxpaPeyBRVfF9GS
    Bzs5jrcj0PfKHwYwp6nVTyojCHcmHCfcmejjTnZAL3tA7A4N7WWP9SiyJ+tn
    ZE/omYHi5ud3ksNi5XXm8NSjZtxcCsl2jrQJ3QE2ke/tFhn7RJfXF/IQq4T+
    EPgTol5/Iuxn3t8ER5M4E3huCh5nOR3rGAbuprnP3wzpImqGPf7Pf+Nv9vM7
    cG9cjg5F5JpFA2NMo8lbhSdSTJfyEnhls83sUTB4RiO5hCo20sF4efu9bQBn
    prNE/B19JpwitwzF5JYh5o10utC8gyIXQRrJFZDF/d8mxtBAySkvsVbAbobP
    QURpIjcjEeV2bPsWRV6kZQp61AYPuZhxyPmzO5wRMQYhHUrnCV0Lus0mXw/M
    4b4bJgQ7on0H0Rp5nAcJuvGMiCb00iuEBFNTazcdagBsPM9Iz5qjZudFYy/t
    /m9u4Ua95x7JIzUBeHmikdXjTlhMy0Y9blRJuXoxVy8CCeISwIP/CsKlq2MD
    KL9rNABTH8RkReMmEJcAgBDws1+DI3L1F9zD//y27xwuAs88w7EZE/w2ttR8
    YIaWq+TQktN8ANk0gsRswAPjWiHuw86+gWI6HAO7q6cEFE8QTw0rAb/s6hPe
    QiTuUfAir2IQBUtBenU5nxl6dSmfCbi6kM9Irhr4zJCrs30o+dE9Cwbxaqqv
    bMDQd8PSv3o3DkncOyQNwgZztTKuVgy2uI/uN0HvXB3ph6kXzf1YcwlsEPvP
    3suV3dTvoKlG4NOUF43sDpouI02PUoN0E4VKeyVb0tvH47/Xx2681lzjm2m+
    9TRYhm41O8H37rIJW0rxrKtW6D7ix7FYYLlbin65bxKugZYyGdg1EKm5x7Nf
    9HgxyPo6HPojzmkq1BTxe2EMdytDQL2UKaCEkOSQTwDZOw75pZBCIR8F3z9D
    +QOQvwrfHfC8BtI4eFbBdzKULYU0G57fgO+jCAPpIqS1UEYJAgKFQcEhoiEj
    R44MDQvFjzg8QhIaKh0qHTosdHioLDQydERo/70YCmN5EeqwyI2L+r1cM2An
    ZvsWfMkD2ANLlIt8Cg/528gRgRO33/OZ8C3k/uMKkdnAFogpisAz2biJiS/p
    cwpo9Tjfyimig0mrsQYucjOCBZc3ZQcLbFIzmAozLDBytaioeKD2UV5SF4ok
    zSWwyJLG7sZLnS3rIb/9VfJSgyPqul4kcg6zelB7WCngC3f66lR8j8+M+01o
    Ueixu/CADuNFJvIYdm0XgDuZFB3rHM08KDgYpQOVqN3/SCKtIs7ffMFR4VAB
    Qy6HAGgvnKkPTugPd2QA3JOqXrhj/nCtA+ByE3vhxP5wBwbATUnohevyh9s/
    AO6FpF640/5wewbAZal74UT+cLsHwFHJvXAn/eFeHQCX0AfX7Q+3awBctqYX
    7rw/3M4BcH/qo6/dH27bALiXU3rhLvvDbR0AdzO1F47qg8O3XNnvcN+l6GjQ
    bnIndDovYI6JaiIxjrHsEohwOVUP2lqVh1hcrNhIwPzPQX07RPxFTSuFty1x
    l5i7YI0v8Z5KQP7lBZDHkyPI52O5lJT7Xd1cbrY2L/Dd3eQvfHpvcKK8Wxct
    6H+v04oXeKzzLcuqbDISixC/YAcSyUWehsb7KfJ6N9rWHUK8aspb+pPEWg54
    zzkNbLH14AL+uIc/+LEtPYjveYMLCy4SO+1tWEE68qJ3VO9lDYGzx7aUf89b
    /DbvjpM3iI22MO5iS6vzwl16D75a2KShJBuG432jOjET/NaM+2D5HqoLZ0zC
    wNOaM/XC3QJ3QFwrXnl2CptbncMgJ5C0nALt3twqacFrR+tyWilil2j9ESZL
    6MqV4ZHwIdcqwSZpWvNZ569T28pp/WWbgD+86jTQ+A4mRY4FJZubyVlvV3lT
    0hJHIaM/z+R0Bh4C+G/wFduleCiV8xYf3LIOHXKAhBTkEImPb/FpAZmPVt/d
    ICxks87wfjLr3f2S9QPoNLATz6Cz2wll5/EATd/N6LvXHSVvtgdK1nehnw0s
    avAESNafu+13DWbg76k0dUbjD3y0lvT9wAc5yrvkHspkiYw79mBFAnfRaOIu
    Mip80lxzfs2/3WykC7uNV/Fkz7bUJjayJft9Lz59TcrAdTayc/eTdzqCJc0n
    cVcjx4PXw3Ejr9t7fF4SQhFe7iI2F88rIWZgIJghF4K7yHCNyJSNhRwX2c6/
    FQ1eTxeTNg3PiIKaPAHOEHBQ8cVVmAD+ODapkHNMbXpYGLAfaXaOVI/Fb4eE
    ETWtFgY4QlzpInWU8ycGf62DVriHGH2D5PBVBw//FraPxIPBFKUbTVGNkpZh
    eDbbB+1lHP8bDP05m5fn/aUR/NGcy6g+GsQb9Z53sIXvDVyII1paebbWB2cz
    9SLnTTD/tYQN+Ds9gQLbHD4kbkVhovYRYZotdOQwEZJ9Q8ppiWTf8TwmIj09
    z8BKg0jA4ntrF+yvmRcuM/vIWfLm4Hi8xu91dJuWCUFseq6uQAvW28TDk+r/
    wyn8aMq3dwGReLkQY8i4S+WaY/XjwciarFgu2fdrOf7WifdEOOD24XI6pbho
    0yC/iWFiamPM4Mea2Z0cIepeM8ue4cmDEPAQCCseoTpV7BJwqKDkb76SCXh9
    miwqz5uED1lChwRPeP2OZr0/uoF3rPmf2yi+YydSQW5Ikvc9LtFF/L1rvYdf
    sEb2z2/63ketlexDYcVb2HsDCWdBLoy0vou880fjhUADWcen2/TtKbl4H/Ey
    XXiaX6SaILzzDnUQkIFV4C9MBRvY6/j+k5F/bZAPS4y94dodv1bT1LlkeyUa
    hX8CPU06K4oaiJN44cGbqFAbTl77S3ERubRgxJczXfpXvRoWr0LZ5Pi6hhVf
    RTLQ+v2g3mj9MZd+J4DtMVgDKCmsxVetVnLjYA//cxCtaeSOwgEQBnIhu0f5
    IVsGXk//m/uTMQQ02wIX0/oOjPaVnDWYCqD436toJzdsGi636a8QZA0s3QAr
    8hi/alebQFHIzGzSHu+JY5F1ykJkU1fvnQCPwSYz2QL4mB4cyAN8y+lMkVjz
    uXMSvoZKfgzCC9Cm78FfJ+OIH0QaoOE3m3ov13lfRVa2aj7HdwP6rOt2HHqT
    h3Og74gwTeGEweQ3WzpKfD/X0jQRf+GD6vvJj/34SzG969zke+PPEUOTb3b9
    PzjOegqCJvY6qH7ykg+PDSe76HC/tdDUibsFJhOnwB0HHBLu/KkIHZEs0LSu
    oWst3uiYYJPhq1ceAsMD0E4PjZJzBcDYmRzZYPatWPZdclC3Jsx6Xx7UfgIq
    +DD7LPz1I957x1BlIL9axSlb08wG68kS/LEWxK47Qv4eI34Fe+ZX/mD119/I
    Ls9ss5kf1AVrAv7GTBchmHgpL0OHPLMaHWdH0zrkHtsJXbeRg2v8aTi2+O8c
    x17GndC+xakJR0l3Blw7fBV/x89PjdI5PaC2VLXYhwqBYMFYb5BJ71rke5ud
    m5i5uC+f5pdP8sv3LOzLr/Jre8yv/IhfvtUvf8Avv98vv8cvv9sv/6pffpdf
    fqdffptffqtffotf/im//ON++c1++Y1++Wa/fKNf/mRv3vcxmwpg3r9nMmNk
    Ya0NkbP1TH6M9Eb7jU+b2ikaCml4hMpoqJTNhrqovrpoqIsKa3VOZubGRCEC
    5dkbPzHtkJPCdxdz+EYZlB9jjuJ34Bn3bKhDyPwYGcKccZ/55Mx3Z9rDLjm7
    ER6gogE6E7r4JvCMPUIDcCtFdokGYOuH5E6FijH5MdHKS5CTQk6Wszrkxqc3
    2ps+pZgPmHPMJ9jVPKevrLCo2Lc5b5UXCKgyTkV+ORAa05UxUhekqR1gmIly
    jdX3KP9poC0s/g6dvse7RwkWAZZa2Q5sd5jJ6Sqj8VoftbAYlDTzdWHe4ZN3
    fnynG0amUGxi6kRKIq1mJrjJcxt/k6NN78E7Tq6HpI5wJlcY+JFSnMQKcdcg
    Vwy+Fv/c3UPeG7ueJiyXtHxJ3qWRugo6aWMPs1jcdOs2re+kc7ocxa45lEu4
    mJm7QdZy3JW5QYqX4fFVNIeMucj+A19abEV/aE3a2tmoaDy3mXbnKfwhD0cM
    IciPhHU9PAkmQkIyu4KQ4OFHehioxpG7j0OMzjahq6wXqxeIHcOs/OjOMcfY
    DXwxOU4RD0R/9wD0wwj6bojomYtX5dDybWS42ih2bPKiPMFCsEtdzYdiH2/x
    F6l4cZShIBXMN+TlWTlT79zydvIIiKaojJ7onW0Fs0AE0NOUo5hacdPt244Z
    gCO+6eZth1Dzc/1drvh615J/SJkwILrpIXAwTr6F88NkiNgzOOJ3yx4jPyna
    dCQKNwEBk/BGuhB/aXQ/wjmU0IUIhqE8xqbc4mDyrVFku0jK1crY+/GFmCPi
    QgIDlNMB+9FQHS4ANCLmXm5FNLciilsxmb3bCwiKsMBkNjLf4S9xKM8qrys5
    7sxi0JCHme+Yn5hDpPg4VHDcN/wtb2KpnjcLqDz2Xooim6yAvjJGND+Pc8TI
    2GO3vZi9ZoE7fdirC8pAJy6iVlLzqFrKQlVTBspO1VClkK+Df/mQX07K9dQq
    QIyQeZQTSuzUamoOlJcDhJ2qokooB1UB+WpoY4USC5SU4dvuq+sclirq5JIB
    mHMIbAW0wvYG8hd/ATUDcBVAzXyAWwb1dVCKvWUAvkr4txS+S4EmHvI/h5pM
    ZUJNOTw7odxBIXuWUEagnm+DOGrgn2NAqZKKg5JMwFlB1RPcddSSf9PWN7oq
    Mq4ZwM0q8oO1Rqgt8Y5t8Lb/Xz71KyhqPqR4SFGQhJDYWoo6C6kV0i5IT0Ja
    A8kGKRdSMqTJkIA0qqOGok5DOgJp0woe51OQb4Rkg5QPKQnSrhq+rrWCoj6F
    1AVJaqOoSZCyIIEHTlVC2gDpcUi7IL0N6QikDkhdkIJhGsZBSoB0H6QlkB6E
    tBXSQUifQvoZUg+k6EqKSoE0H1I5pHpImyDtgn73wPcxSGchdUEKqAI6IGkh
    LYBUDmkVpKcgvQDpdUgHIH0A6TNInZBuQ5JVQztICZAyIRkglUHaAOk5SG9D
    ugDpG0i3IYmBB6MhPQ401EMqh2SCNAtSBCQFpJ+t0Aeko5D2QnoO0iZID0Kq
    hFQEKQuSFtJkSOMgySBdX0ZR7ZCOQHoV0lZIf4KxNcP33hX959z3m8h41zUH
    0oJiPuHH99PCA78H5p+bKKBeuFfQr9y/LGCQssBByoSDlAUNUhY8SFnIIGWi
    QcqGDFIWOkhZ2CBl4kHKwgcpixikTDJImdSvzPcZOgjcsEHKhg9SJhukLHKQ
    slGDlI0epGzMIGXcIGW3Byn7bZCynkHKbg1SdnOQsmuDlP08SNlPg5R1DVL2
    4yBlPwxS9v0gZZ2DlDVSd34UfaJP7V7Mw709VUCdnyIYBJr/+K+17N+F+s8/
    6K7sLhYQAuYbM43qMe9NDxEuyniKSdbtOL39KOIvTV5SZy9dUmuvKa2qqV5S
    t7puSc1SW7ndUrwybnnxqqSEJRVK+OOtj42bUVu21L8PeQHIgwnmn+OIWOz2
    fuPzYSmEaZAwbxwKTtdQQS/cHj84/E6Y7pUj73O7X/1+qDvwb+qzZwiouTN+
    v/4lqHttQP0Rv/qamQKqbiZP23KFgKpR8Pm34Ptdxe/jHRsnoO6K619/zK9+
    aqqAmpn6+/XJaQIqJa2/HGjB98kFa15AZcG/OeB3zAEPKRd8HznYdT3UzIO6
    +VCO+RS/NiYqnZoLuUyAzIV8DkDw9Uv6eTPoX+H/rcBxud+kvfPGqPcy/8sC
    9b+f//387+d//sMfYVeSnz98C1cpxJKHnOOYyE48GMPyQ6xIGbCD7GaFMIdI
    5sbpHbh9VXj1nechpBWV96GbAj5mF/4/EX7//8IBKDsPZVv8yl5ecef/+eD7
    /G9c8P+fuCCZ0q9Kr6ysKS1xWAw1NZXmCoc1v2QZ9WmAoW62xWGy2OsqaoDO
    MYHzHZUZNbWrC6orSmvKLEaHvaIacQvut8yprnBUlFRWPGjR11uqHVQR4JxT
    7bDYAe1yS5mhplZf7bCvNs6tqINA9YEBtc46q1/1KmFxSWVlWUU9tZrkqpyV
    1CXs21xSuTzLXlJlybCWVFRTLwirLFWltWDeZAH3W8wlFY6sGrsRSKq0zFtq
    s5Q6qFtAmdHi4EmiRAHkKb+iymKnqL9CXUZJdamlki/4FzznOS1ABNlowEKq
    nedAhtNuBwz5VrulpGxOGUgLtq20lNi9mM8DXAZUOizexgQSvTn9qiy7pR9X
    FwgXrfTrZ051eY29qsRBOJxD+OLjZK6hZJmlbG5NzfKSuooyC+HN4X68zqwt
    pU70K+HHkg59zKu1VBvAjbPU1VF677OPrjwfDX6959cst1RT7wbMW1qeabFb
    yiEBc7yMpN6EcsTAP89abaipwPmjrsDI5/uADfaKqhL7ah5TsmBOTR/vfJR8
    5Q8/p6oWZKum2q//PTCagRyHVRIAs59eXVfBi1x+zQAJ3C2sc9irURT2A53z
    +xM/a3V2SXVZpYWKgPkvqK5zlJQuz7TAX6uPKGoHSlJVTb2FCkUZQYh0Rz8I
    K8wMcMxpMdfYl8/BjajxwMOMypo6C2UYhJu+hutQbudaqpc5rMYKGMms/jPD
    D5pyQOlg8nuxn/x524AAniFzXmexOwhN6SAG1KF+coBFbmgN8j63BoS2CkQp
    t8ZRUb56fo3TUVFtoVi+lhdbL+r+EFf9Ifip6A9AZQTkVAF9vCR7S9PLyuw4
    ciuOHAkaMFd/4+eqqpbKg9Y5JbVzeR0ABNYZay2lgD8DOA/YBYghvRa4VdYP
    R36ND9dakDFc0TW1cy31lso5drA8c3i561f2UQAMcKkF2DufyNP9MJsAY7Bb
    6itqnHU5gJo63Qtjtlc4LNRQXttV1ZbYLf2HsBdkjMx3Lqgib9lOlKA6C6yU
    Od41n18zyPKlrsIszbeA6qiz5DgdllVgJfy0b5a9pmqwVhXAqYLqqn68gpZQ
    OstZUVmWU1YJZOeC1GFbVDZUEtTxEweVVOIADU9RN4hmtNdXlFoyLXWl9opa
    R409v2QpLBNqBUhjQXUliM39ltWUGp7mevNKyGdVgrbGB2oirgDSBz5OhadM
    GJnDYiqpdJIiakpvGT4q4Elf7QQF5W1CxfqX9DZb6FtPvSVVUALz3Pts9EEQ
    LGneNYUPbf1WAc/i3H5adTD+5uNc46QNkFUdL0uZFuQTvyZ9io962Ct7ZF1k
    l9jL9HZ7jZ2IEhXTy5msCuSohaffTz/w5U5c9yht5DEcdE9+RenyjBonGJUX
    YSSznMsyrJbS5XqQk2pHTd1ye3XlDMsqaJlFea2VwWInSEHdkXZAmgDG65Wx
    rJI6h1fOKJSB0hXOCrt/6Xzq/nIvrLG2ohrlCyLO+8u9kL1lmZS/Xp5jXwEy
    lJ0+d0ZZZSU1hsqqdPCqkLqb5PuGvgGffcRAAS4Zf5M3C+sJi+tAefSyZiAY
    NQPheK1tqqkEiaGKvS35R2yAXOHLBkOxGeuMoEtyQDuBDOD/u+ajO6OyAvVr
    jR1kYRuWFlTbLctANCx2QIU8rcJSXgL8rCPuI0I5byu8dCViSZ9Qk8I6amxf
    XzVVVU4QM95MYJdbCGWOEruD7wxFLwXLUCKNllInSMjqvlVK3dXH4zuRUWKs
    JWoh01Je4sQx34FhPT8r/UaYMAjd/vzLmpufM3v+DONCI0WdwPVSUL2yorrs
    vykE4j8Csj8adcfWGv9/7ikGKR8i5PfMHoAVmRlI3fHJDMT/iclEGUFeTJQe
    5N0IGnoe6IRisouSBXn8vCv88Tbik1G+fVX+O9WLRwj/EH2IH+4XArCFkeyx
    VFDV1DLAVkFVUpbe8yzQEgRGQcVDUpPvpTgO8CdioDwDYKogXCoB+NVATQk8
    8QEaf76DWPnzqGpyHlVHyanpkFaSfzPgeXCoGVQpwYwjHwn9+OjKJGdmpYTe
    2t5zNvz0P1OTDzhVk/c7v8LPFCrID6/Je67Vhy8WaIgjI4U4D2RSQHjiT2Xf
    aAeeePGjgvgS1pKAmkv2srAFcqsW6pCSZcBB/pRvYJmcmgyl98I39q8AuZ7u
    zSWScc0gO2tOMk7kXA2MqgJ6t0I5zkMZfM8iUIh7GUCtBArwLBA/aWQs87z9
    VXjH4uNDde+YageMyegdUxpIuMA74jKgohQo9p/3fz8PqAeD7mg/kPv+vM8k
    q8RETg7vlE6wVOQEJh9qcex1UF/STy6GCHcP+N8j//s/eMH0+fjX4t+N/zD+
    X/E/xIepIlUNqu0qtyokITxheMKohPEJyxKqEp5O+HPCOwlBifLEyYmKRGPi
    wkRHYkMinfjHxOcTdyW+nrgn8UDiicQziRcSLyd+lXgrUZAUkiROGpY0OkmT
    lJNkTipKqk9qSdqW9GISpR6pTlQvTbYl1yQ7k9ckNyVvTn4u+aXkvyXvSX4/
    +URye/JXyd8l/5T8a/JwTaJGq5mlKdKUa5ZrVmkaNIzmD5ptmhc1r2je0OzV
    vKM5pGnTfKg5r/lRc0sToBVpI7TDtaO0U7Wx2gStRpuuzdbmavO1i7R12rXa
    3doOLavt0l7XhukidSrdet0nut90eSlnU8JSo1MnpKakZqXWpLpS/5R6JfVW
    KipDGfAmUTFP8bziE8WU2IrYh2MfiT0c+2HsL7FBcWlxs+PmxuXF1cY9Hbcj
    7tW4d+IOxR2NOxl3Ma4nLkg5SnmX8h5lgjJNmaUsU9qUNUqHklG+qzyi/EYp
    jp8YPy2+NH5b/EvxI1X3qnSqHJVZdUEVkZCasDShJeHRhPBEW9JrSf9I6ki6
    liQAbo1X36OOVeeo7eo/qF9V71G3qo+pP1V71BGaR7R/1LZqj2rPagN1+Tqr
    rl7H6N7Xtes6dDkpVSnOlIdS1qVsTHk65dmUnSl/TzmQci1FmBqeOhzGOzH1
    vtT81IWppakVqfWpa1IfSd2c+kTqM6nPpm5LfTn1b6lvpr6Teii1LfVM6sXU
    z1J/TP0FlbEcom0UGsVQxQhFtOJuxT2K6QqlIllhV7Qq2hRnFO2KkNi7Y6fE
    ro5tjn0idlHc+bho1WRVs+qo6oqqNmFzwrMJPycIErMSVybtTHo7Sa/OUz8F
    I7qgDkuenbwu+ZHkV5LfSP5n8g/JN5ODNKGaYZoxmlhNsqZas0nzpOaPml2a
    jzWhMLsarVm7XPuQtlHbov279oD2K5jX77U3tL9ph+tSdDk6i86h26A7pDup
    +17Xo4tIqUhZlfJEyh9TLqV0p4xOnZq6NHV16p9hTN04JgXaA/AlYExjFYmK
    +xUmRZ2iQfGh4oLiF8VNRVBsZOy42M9jlXFmZZGyQvmI8k/K8aoDqocTdIl/
    TVyddDapXn1GHZ28NnkRyOYw7Xzto1qNzq7brvtC91rKvpT01NrU31KJ8qHw
    N8qHKBYqHlG8FtsGcvRlLBsbGieLGx03KU4RlxBXGLcsrjJuRdyWuD0gT61x
    H8R9EfdN3M9xMmW0UqusU25UbVY9rnpKtUW1VbVNtVO1S/Wqardqj2o/0NOq
    OqI6pjqpOq06r2pXXVZ1AMfvTYhPyE4oSLAmrEpgEp5PeDOhPeErmAFPgiRx
    dOL0xKREfWJB4gOJVbCSNyY+nfiXxN2J7yZ+mNie+HXiL4lUUnjS2KTJSaok
    fZIhqTCpKmkVrOCnYQ2/lvRu0rGkj5O+TupK+i0pXB2lVqjV6nR1rjpfvUj9
    gPpB9Vp1s5pRPw7yulW9Q71LvVt9AGT2nLpdfVPNqYOSQ5OlyZHJo5PlycnJ
    mclLkpclv5AcprlPs0CzVLNS0wScPKS5rPlSw2p+0QQCT1u0L2n3ad/T/qKN
    1I3RaXWzdfN0i3Sv6N7UfaD7TPetjtONTJmQsi3ljZRhINuTU2ekalPnpy5J
    daY2pjKpL6aeT3WnEgVP4ctvGkWBoljhVPxZ8aLidcU+xUeKS4ovFG7FT4ob
    ituKUbF3xU6NVcemwoqvid0U+0zsntgLsV/BXP0Q2x0bERcJ8yWPmxg3NU4F
    WqA47uG45rgn456Lezlub9z7cafiPiVzdjsuVDlCebdyhjIZdMB8kB2bsl65
    XvkoyM+Lyr8rDyrfjD8bH6eSJpQmPAG69enEDxL3aw5oTmpOazo0VzTdGo9G
    pBVro7VyrUIbr80EXbZAu0Rbqa0FuW/WPqXdot2lfRWkv1V7WnteewXWgEcr
    1kl1cl2MLl6XpMvWzdUt0T2gq4XV0KzbqNui26p7Vbdb16o7ojsPOoLVdcLq
    oFKkKbKUmJTJKUkp2pS5KYaUB1LKUhywYjambE7ZCjzdnbIn5XLKlRQ2ZW6q
    IfVk6unU9tTLqR7k5wPoX4CeVEQp4hVJinzFAoVDsUrRqGhWbFY8rnhVsVtx
    UnFa0anoUoSpxqkmqKarEkDf/U/btP9XPuT/og4IoBTrh6qCh0zZkL3hRrgg
    JGDb+qGToOjuAIEgNkwxJDhoakRgwOggSmENDp0aLBAK1icGCITbFgG3lX4l
    EsXEQAG1Tf7CuMZoSkv+zQOHtw7cCXQ80P1LwX+Ku/xwCmVxBcN/XWhKf+W1
    4L0vn/9jw5DkXyM/2rY+4qBivfA9SJO3BQYIAgKk6U9sX6Re9flHcyzlSWPn
    Ot9XhPdSLAgC2ooJqYEFwuDhAQXG2JGKSHwIHR5hgpjKWLGsepp8TnXpjNhE
    hQorwobPyKgsqauTK+UG59LKilK5d/9SnmGxOyrKvVGVPN3psNZgAKUYNzIc
    hCwxNkFBPotGhsfioypOqVKr1IsU6/b8FykYrxjLUzDCVyHPtzvrHPJci2Nl
    jX15rEah5gHi8i32qjp5TbncWWeRlzjkVoejti555syVK1fOqIfGddB4RmlN
    1Ux7bYl8cum9ivjYGYpp2Dhw+MRe7L6BZtSUWeRYAjGmPE6hiJdnpCvWC+72
    Z6UgiApcL5CASAhCA9YLBNTBAz8cePjHJndH4rxbgdKkg6Kzmxv+fPPJtaPE
    7y//Ydb8zZ+di84ePvG7Q6UP/ppn+eHcy5pfup7aOvXWz+XnYz698cvz1aPU
    CQdO76gXjbv7npjKpCfu+bJ5zutjNm3/beL6aVIFu+KVyezK+/J+6vzQ05V/
    vqb1q6rQxz5pL3OV/n167j3XWyJuV3117x+/bJm9ZvqGtaz5sdeWva+Me2K4
    vOelCbI/Vb3ffH+9VfjximmFd93cGD7pt/HTn5j6raAg5+cq1eT1n3+yfMne
    C5+8vO634g+b3i798+m7e17SzKr4+6PJbx7Y85yk6Mh309Yzk38zip7515sC
    +Zlf/xL1besPebWJX+wNyp6fXZP03WG28qHM5ncCQKYFO9YLtgFHtiqGAW/H
    DhcIOKFIEQxfARDeZWKZXKhT4LyFPbAhW7DBoxeEjAxUTFFMDhbB+ggKCgkQ
    jIj+d7OniEUs44XQRDFpW8y2uzeQyQboUntlf+ja0hLlDCglYjR2onCEQubr
    JTCgNxeoiMBqCdIqhCUUrBgaPIQnbpZAgEWUQHEvggwV3q2Q7xyniI4drYji
    ZWcoERllRnqcIj5peuz0eCXfWYRwhFAm+iWPvXVbpytLWGP9aPGqXZ+/9c9E
    xbpGrJ8gXK1Yub10Z8n/+HJcL619+8pY6Sf3xu9N+uChwJNvvzdAIQSuW0e9
    njxy/30PFdwsK+hM2/n9nPTH/7iVPvC3GWM/WDXh1+hRkrVu64G4TzYmfXY5
    9Ry9J/WN9c/8tHPR29/PmHTuszWCaiqU2hn85NDsIWm/RketXjYhpuOdj78w
    vD7ml4h/dcxY92Hjjsr5855wFmx6++6fz36X7tw4s7SgYVz+oqcXfvBJ/LrW
    4qLrD74J6qtLsT6w3avCGqbR54Z8/dAPP1984p1HL7xQM1CF/T+qQVAxJoIX
    rupTjFATq+5VjP/oP6wIhRgfRMOD8i2rSupiJcAHeA4ZHpzuxH3A2EjFcDJu
    mdi4uo5suFaXVNbFpii0/KBUmRXLKhwllfI5mb2UTZfnVJTaa+pqyh1yI/xZ
    WWK3yE0llRVlvODUx/nQhsnE2ZaSshXOEjtgrvMVB/bvTbHu+YFqcZ0LpogO
    ALl6JSkiPWPz978FjHBp9hnU+9/d0rV/Zv0vX67Z8/aY/xA7Hzzx5p4Hty4a
    O2Tmn+8zJE76MOXCzpKeoZOejFq1u6ol53tD1Ownvn35QfMLL1ddP1T7eNPi
    bwtOZ+UHvr/sU9t7815TaZ+956BSfa3wwheN1oOlf15lPpB88ftz9bMy/5IR
    XlU3Y/WR37b7dNJa0EkPEdaOHS4MUFD9l3xIoyKNVypqmB/VNuW22A0zvUol
    w5ihnI4TOP0O9dJbRXTMf49yG85rKrEi1E8/OX15UEcVimWKGN+zQrAhyktn
    TWldbT90itReqIANyjtGU1JR8jujIVWlFrtiPK+oohQjGgdXZQP1pFCqGOHn
    5ozhVT8FXB6octBebj/155+fGHvs4t3rzx2JPn5f0dEU6tLnDwgWig7UJqx6
    48VHJ57pNDdemcjtfTRlzO7vlp58dqc2YtK0m8WVBTELKmwnls2aMPlz+V2L
    XphR5Moc2W597ETwoc8kV2K/WRf5zK3wE+yyx755fIsl4ZHd6a/k/ngualRZ
    61/uLu7Y/kBN96FpqeaL38g3hH9Yvmu/KcN165EzEYaD3z3XRJedXZA99GbT
    5IevlbKPzvvn/tPPz9xz27324s9/rS854fzetO3cXsln32csm22unW20j/Uc
    axzHFmVH3bwlmPDHN87ZHh25/4r47W2/0WOqZgRFXjp/MePKjO9UL73xxHuT
    dhl+7B696MVPzI/Hbd10167NQ2++rVgfFKhYH+DmdV5oiXgYf3t3zEBtt7a/
    VhgOfCdaIdRcUmcF/eKoqY6VEokG1RAy31JWVVNdFgtmiteJkX3rPaPGXltj
    J+s89l7FPbzykvvXg9ZCXdZrRubX1DiI3kpQgP8GRig2To16y/sYi4//8x7l
    v1Mxx5csfO7nMZsEsj3Sz4Vpl74y/82mT3usWRx2RvnJJ0M/+iFgwfiJN6bs
    ygx6uTNw/Kq1z/3HW3+iXp7QcOHVlhdK9W32e052zz3qXHFW/eO8WV3Oz0Mf
    P/qovGaLxPPqhOLaexN2Ht/w7Rt/kp8w/qXlW93Bhj/djtErL9dHfi95YUXZ
    XMuMdVb9X30qZgKomPFkakALhCpA9IOFkKUUCcFDvEsiMkSIXB/vexS5Os7Q
    uc0Xtx4O2fDihlvRj51778VIwagAQTV6S2FERRGXZINC0utOBSkCcUH1eRlf
    rn2ofeXHnz8XmvrcnhMRM1768VLFSqj2dSqDZTkugsoge6G4W5pBpfdb2ktv
    hd61eG1G9dBPh+Qblv9y9pkVPz2nKOD1Ya5iruK+bdnbsjZk+jlZVT6B4b2s
    5RVYOrPWXlPmLHXUzeyVJxQnIk0oRURJDlQDME7Blax/aPRrncMfebg447Os
    R09senfv7PQDJ086nmg/pc57eueLb85u/fHspw89Zh7aHbd5zYepP8z6VHjX
    fTeOZWy8r2bJB7Ke+888P/fd8wXVJwMOhr+48bENQ97eOfFddnfXTWZF7rLd
    J9bvuvhowY1Ed1fKxh+vdGz6Lbp6Rkl6tnPP7mljJ7fPkVyM7Iqpm6g9uVH8
    2eS5lvzbRa9v/m7Ua9Py/v5s8uxftI0qwcgv5zxyIf++W/e/EnLgvYbVH72n
    opa889xHPevpMepteX/Y+1nrP0K4zGcyW+OnjFryyg9dms57c98c/s/Eloed
    H++5EB5c/ebZygkrln3304pH/5breFn8a+d7cxfcLHr82Sr1iQ0bU5noXSPi
    Pr5d9dZPnn98d/GJ6wmzV7XeMyWyzXqh+58983KPLUuVTk97/qdxx0uyv/1r
    YE9snbgra+Nt06dz7n36xyGf7vj64I8PdH6Sv23h1snv5v9YHrn2kbnNl16M
    eHrZjLyH4tV709/f3GyddDkmYMi36x4N/cP0H3/461tbXpSsc7VJ3/zi+y0z
    s2uMLXPKVj3bWfjqH8IKJh3+8W3XsTN/mblo7X8sLxmtfDZq/wtLpZ/FfFf/
    xcwMd+e/1gyLj6E/nVzw+tfO3Nipy0r37rr4Sl1o4Kl/frcwtc09Rf/6rqWL
    Z1J/VL+yp7jusKizcehjsyMemzI844sngpcWvMO9rXvpJd0kyesfNCxlIgvo
    C0/F51ywxK4XfAlL5zOIoRXrjv8/6toN4rL2Re7bahVSP7MojkUHZFTvShgS
    GCv23y4Avd33FEacwL7nSMWEvobCWFj+qmWbX9/9T8FfjnStrnqgJjfgwMuT
    KgdoS+G6xoKwP17/9v3x+yJj4tePvO/7kwf3/7i4OPu+1bXCLXnZTd/MpzY9
    +IPjXx9eFmjWndBFnlpcGf1nefCkl9aNHnHu52ubrrX/kvtM+tDX7gt4kdq5
    Z/OkTdfGPr+oJX7aG1+eFD1FP3bxMaa64/WdH//Hlj+s//hfmz7eOf+5GcrY
    108+037DYJhQ89ipujjv9s3/AZf6L9HIjgAA
    ====

    You will note that this file bears the cryptographic signature of sysinternals and the product name of "Process Monitor". It is installed into windows\system32\drivers. There's a couple others in there somewhere.

    There are few things more tiresome than people who argue with empirical facts, particularly when they're just trolling. 



  • @ShadowWolf said:

    It occured to me that you might be refering to the fact that it loads a Device Driver.

    This is just part of the application and the driver is unloaded with the application.  If it leaves anything behind, it would be irrelevant anyway.

    Well, I just wanted to point out that it got the information from its own device driver and not from a windows component. But in principle, asuffield is right (even though I'd choose another tone): There is no per se difference between an installer and any other program - unless you set permissions. The *mon utilities are so nice to remove their drivers once they exit. But there is nothing forcing programs to do that. In fact, there are lots of "stand alone" executables that create a whole heap of registry entries once they're run the first time. There maybe aren't that many that actually write files but it's very much possible.



  • Is that PROCMON11.SYS.gz thingy usefull for anyone here? If not, I'd rather have it removed, because of copyright and stuff.



  • You can get it by yourself if you open procmon in any kind of resource viewer.



  • I hope you weren't accusing me of trolling because I was assuredly not and it's rediculous of you to accuse me of doing so.

    That said, from my understanding it unloads and cleans up anything it installs.  Do you have proof it does not, which was your original claim?

    If it doesn't, it's something worth bringing up.



  • @ShadowWolf said:

    I hope you weren't accusing me of trolling because I was assuredly not and it's rediculous of you to accuse me of doing so.

    I think A was taking a stab at Ken Black.



  • @asuffield said:

    @KenW said:

    None of the apps mentioned from SysInternals installs anything to the Windows folder tree

    That is simply not true. 

    Andrew, as usual you have no clue about what you're talking about.

    Let me reiterate for you:  None of the apps mentioned from SysInternals installs anything to the Windows folder tree.

    And by "none", I mean exactly that. None. They're all self-contained executables, usually a single executable and a help file in a simple .zip container. The "installation" is simply unzipping the files into the folder of your choice.

    Let me ask you once again to keep your mouth shut when you're clueless, instead of posting nonsense. Thanks.
     



  • @KenW said:

    @asuffield said:
    @KenW said:

    None of the apps mentioned from SysInternals installs anything to the Windows folder tree

    That is simply not true. 

    Andrew, as usual you have no clue about what you're talking about.

    Let me reiterate for you:  None of the apps mentioned from SysInternals installs anything to the Windows folder tree.

    And by "none", I mean exactly that. None. They're all self-contained executables, usually a single executable and a help file in a simple .zip container. The "installation" is simply unzipping the files into the folder of your choice.

    Let me ask you once again to keep your mouth shut when you're clueless, instead of posting nonsense. Thanks.
     



  • @KenW said:

    Let me reiterate for you:  None of the apps mentioned from SysInternals installs anything to the Windows folder tree.

    And by "none", I mean exactly that. None. They're all self-contained executables, usually a single executable and a help file in a simple .zip container. The "installation" is simply unzipping the files into the folder of your choice.

    I already posted cryptographic proof that you're wrong, so you are now obviously just trolling. Get a life.



  • @asuffield said:

    @KenW said:

    Let me reiterate for you:  None of the apps mentioned from SysInternals installs anything to the Windows folder tree.

    And by "none", I mean exactly that. None. They're all self-contained executables, usually a single executable and a help file in a simple .zip container. The "installation" is simply unzipping the files into the folder of your choice.

    I already posted cryptographic proof that you're wrong, so you are now obviously just trolling. Get a life.

    At this point, you're picking nits, which like I said in my original post, is largely irrelevant.  It has to load a device driver to work on XP and older OSes. There's no other way around this.

    But it also shouldn't leave the driver operational in the background.  Per Microsoft best practices, the binary for the driver likely remains behind; however, this is largely in part because Microsoft reccomends that you do not delete the binary data for your drivers in case something else is attempting to use it at the time.  More information can be found in the DDK or Windows SDK.

    [edited: clarification]



  • I don't quite see why "installing" has the prerequisite that the file stays there as well. The point is that there is nothing that prevents the programs from doing so.

    And KenW, I don't accuse you of trolling, but maybe you could actually proof or at least explain your statement instead of just repeating it in increasingly eye-catching font. The resource entry IS there. As is the appropriate error message when you try to start them without sufficient permissions.

    Of course the driver is there only temporary. But what does that change?
     



  • @ShadowWolf said:

    At this point, you're picking nits, which like I said in my original post, is largely irrelevant.

    The troll made an irrelevant rant, I proved it false. Your ire is misdirected.

     

    But it also shouldn't leave the driver operational in the background.  Per Microsoft best practices, the binary for the driver likely remains behind; however, this is largely in part because Microsoft reccomends that you do not delete the binary data for your drivers in case something else is attempting to use it at the time.

    And anybody who has had to hit up drivercleaner.net to get the ATI or nVidia drivers working again knows that "do not provide a (real) uninstaller for your drivers" is a stupid and wrong recommendation. Just because it's not trivial to get right doesn't mean that you shouldn't do it at all.



  • @PSWorx said:

    I don't quite see why "installing" has the prerequisite that the file stays there as well. The point is that there is nothing that prevents the programs from doing so.

    And KenW, I don't accuse you of trolling, but maybe you could actually proof or at least explain your statement instead of just repeating it in increasingly eye-catching font. The resource entry IS there. As is the appropriate error message when you try to start them without sufficient permissions.

    Of course the driver is there only temporary. But what does that change?
     

    The point is what he originally wrote:

    You've been using Windows too long, you're starting to think that there's a difference between running an installer and running any other kind of program. The thing you download is the installer, it's just completely silent and doesn't add anything to the start menu or desktop. It does scatter files into the \windows\system directory and keys into the registry. It also doesn't have an uninstaller.

    Either way, there's not one ounce of evidence that supports the assertion that "It does scatter files into the \windows\system directory and keys into the registry".  "It also doesn't have an uninstaller."is either a red herring or false depending on how you look at it.  It extracts one of three driver files, starts it and then hooks in to whatever callback mechanism exists on the machine to do its job.  That driver exists until you reboot at which point it's cleaned up.



  • @asuffield said:

    @ShadowWolf said:

    At this point, you're picking nits, which like I said in my original post, is largely irrelevant.

    The troll made an irrelevant rant, I proved it false. Your ire is misdirected.

     

    But it also shouldn't leave the driver operational in the background.  Per Microsoft best practices, the binary for the driver likely remains behind; however, this is largely in part because Microsoft reccomends that you do not delete the binary data for your drivers in case something else is attempting to use it at the time.

    And anybody who has had to hit up drivercleaner.net to get the ATI or nVidia drivers working again knows that "do not provide a (real) uninstaller for your drivers" is a stupid and wrong recommendation. Just because it's not trivial to get right doesn't mean that you shouldn't do it at all.

    mmm...those issues occured because ATi and nVidia were determined to use their own method to install drivers instead of using Microsoft's way of doing things.  Had they followed best practices in the first place (as they do now), this would be a complete non-issue.  I haven't had to use Driver Cleaner to update a driver from either company in quite some time.

    But their installers were not the pinnacle of install technology.



  • I can't check right now, but I believe PageDefrag has some kind of an uninstall button.



  • @PSWorx said:

    I don't quite see why "installing" has the prerequisite that the file stays there as well. The point is that there is nothing that prevents the programs from doing so.

    And KenW, I don't accuse you of trolling, but maybe you could actually proof or at least explain your statement instead of just repeating it in increasingly eye-catching font. The resource entry IS there. As is the appropriate error message when you try to start them without sufficient permissions.

    Of course the driver is there only temporary. But what does that change?
     

    What that changes is Andrew's assertion that an "installer" runs and puts a bunch of stuff in the Windows System folders, which is just wrong. I never said anything at all about SysInternal's utilities not containing resources, but as usual Andrew reacted by posting crap and calling people who had the audacity to disagree with him trolls. Andrew is a pompous ass who has a reputation for being so and pissing people off; 99.9% of what he posts is unfounded MS-bashing FUD. See his other posts here for evidence of that fact.



  • @Cap'n Steve said:

    I can't check right now, but I believe PageDefrag has some kind of an uninstall button.

     

    You apparently don't read any better than Andrew. Try again:

     

    @KenW said:

    None of the apps mentioned from SysInternals

     

     



  • @Daniel15 said:

    @aib said:

    In short, netstat -b scans the entire %SystemRoot% directory tree multiple times per connection.

    blinks

    WHY?!

     Comon!!! Are you really surprised? After Microsoft's end task nothing microsoft made EVER surprised me again.
     



  • @dlikhten said:

    After Microsoft's end task nothing microsoft made EVER surprised me again.

    End task? zuh? Could this be a WTF yet unknown to me? Please elaborate, this sounds interesting.



  • @KenW said:

    @Cap'n Steve said:

    I can't check right now, but I believe PageDefrag has some kind of an uninstall button.

     

    You apparently don't read any better than Andrew. Try again:

     

    @KenW said:

    None of the apps mentioned from SysInternals

     

     



    Congratulations on winning an imaginary argument on a technicality.  The original discussion was about whether there was any difference between a standalone program and one that uses an installer, so I was contributing a relevant example.



  • @Cap'n Steve said:

    @KenW said:

    @Cap'n Steve said:

    I can't check right now, but I believe PageDefrag has some kind of an uninstall button.

     

    You apparently don't read any better than Andrew. Try again:

     

    @KenW said:

    None of the apps mentioned from SysInternals

     

     



    Congratulations on winning an imaginary argument on a technicality.  The original discussion was about whether there was any difference between a standalone program and one that uses an installer, so I was contributing a relevant example.

    I've never seen an uninstall button on PageDefrag.  To refresh my memory, I redownloaded it and there is no such button that I can see.

    I got it from here: http://www.microsoft.com/technet/sysinternals/utilities/pagedefrag.mspx

    As for whether there is a difference between a standalone app and an installer, I would always contend that there is a substantial a difference.  An Installer is a seperate, independent application designed specifically to place files and resources on the machine for configuration and use later.  An Installer is not functional application - ie, it cannot do anything outside of that goal.  A standalone app could easily be an Installer.  Calling any one of the SysInternal tools an Installer is deceptive in my mind.



  • Here's what my version looks like.  Not exactly an installer, but the authors seem to think it's close enough to use the word uninstall.

     

    [URL=http://img248.imageshack.us/my.php?image=pagedefraguk3.png][IMG]http://img248.imageshack.us/img248/4756/pagedefraguk3.th.png[/IMG][/URL] 



  • @Cap'n Steve said:

    Here's what my version looks like.  Not exactly an installer, but the authors seem to think it's close enough to use the word uninstall.

     

    [URL=http://img248.imageshack.us/my.php?image=pagedefraguk3.png][IMG]http://img248.imageshack.us/img248/4756/pagedefraguk3.th.png[/IMG][/URL] 

    An odd decision on wording on the part of the author.  I'm not sure exactly what it's uninstalling, but I kinda wanna find out now.



  • Okay, look, here's the deal. FileMon - at least the FileMon that was available before the Microsoft acquisition of SysInternals (I haven't had the chance to test any prior versions) - probably does install something to the Windows system folder. However, it cleans itself up afterwards. Let me explain how I believe this is true.

    I used to run it on the computers at the college I went to. I was just an ordinary student, and the college computers (running NT 4) were set up so that there were no write permissions to the Windows folder, especially the system folder. Don't get too cocky on reading this - the program refused to run normally. It just wouldn't start.

    However, I did notice that on computers where it did run, it extracted a file to the current directory, which was removed very quickly. This file - which I have on my USB drive - is called filem.sys and has an md5sum hash of 5888bb7122cb80babf3a849189bee679. At least, the version that was extracted did. I got the file by having a batch file continually running which attempted to copy the file to another directory repeatedly. Not the best or most efficient way to do it, but it works.

    Now, when this file is in the same directory as the EXE and the program is run on a system with write permissions denied to the Windows folder, it works. I'm not kidding.

    My best guess here is that the program attempts to use the SYS file, and if it can't find it, it extracts it to the current directory, moves it to the system folder, and then tries again. The system folder is probably used because that's the canonical place for such files. But it would explain why it doesn't work when it's not extracted, and does when it is.

    Now can we stop the argument now? 



  • @Ciaran said:

    Okay, look, here's the deal. FileMon - at least the FileMon that was available before the Microsoft acquisition of SysInternals (I haven't had the chance to test any prior versions) - probably does install something to the Windows system folder. However, it cleans itself up afterwards. Let me explain how I believe this is true.

    I used to run it on the computers at the college I went to. I was just an ordinary student, and the college computers (running NT 4) were set up so that there were no write permissions to the Windows folder, *especially* the system folder. Don't get too cocky on reading this - the program refused to run normally. It just wouldn't start.

    However, I did notice that on computers where it *did* run, it extracted a file to the current directory, which was removed very quickly. This file - which I have on my USB drive - is called filem.sys and has an md5sum hash of 5888bb7122cb80babf3a849189bee679. At least, the version that was extracted did. I got the file by having a batch file continually running which attempted to copy the file to another directory repeatedly. Not the best or most efficient way to do it, but it works.

    Now, when this file is in the same directory as the EXE and the program is run on a system with write permissions denied to the Windows folder, it works. I'm not kidding.

    My best guess here is that the program attempts to use the SYS file, and if it can't find it, it extracts it to the current directory, moves it to the system folder, and then tries again. The system folder is probably used because that's the canonical place for such files. But it would explain why it doesn't work when it's not extracted, and does when it is.

    Now can we stop the argument now? 

    You know...all this information is on the website :-)



  • @ShadowWolf said:

    @Cap'n Steve said:

    Here's what my version looks like.  Not exactly an installer, but the authors seem to think it's close enough to use the word uninstall.

     

    [URL=http://img248.imageshack.us/my.php?image=pagedefraguk3.png][IMG]http://img248.imageshack.us/img248/4756/pagedefraguk3.th.png[/IMG][/URL] 

    An odd decision on wording on the part of the author.  I'm not sure exactly what it's uninstalling, but I kinda wanna find out now.



    I'm guessing it's registry entries or batch files or whatever it uses to run on startup.


Log in to reply
 

Looks like your connection to What the Daily WTF? was lost, please wait while we try to reconnect.