<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v3" manifestVersion="1.0" copyright="Copyright (c) Microsoft Corporation. All Rights Reserved.">
  <assemblyIdentity name="CanaryService" version="10.0.10586.11" processorArchitecture="amd64" language="neutral" buildType="release" publicKeyToken="31bf3856ad364e35" versionScope="nonSxS" />
  <dependency discoverable="no" resourceType="Resources">
    <dependentAssembly dependencyType="prerequisite">
      <assemblyIdentity name="CanaryService.Resources" version="10.0.10586.11" processorArchitecture="amd64" language="*" buildType="release" publicKeyToken="31bf3856ad364e35" />
    </dependentAssembly>
  </dependency>
  <file name="Microsoft.CanaryService.exe" destinationPath="$(runtime.system32)\" sourceName="Microsoft.CanaryService.exe" sourcePath=".\" importPath="$(build.nttree)\">
    <securityDescriptor name="WRP_FILE_DEFAULT_SDDL" />
    <asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2">
      <dsig:Transforms xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
        <dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
      </dsig:Transforms>
      <dsig:DigestMethod xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
      <dsig:DigestValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">1WhG6pV6yKdC0ElR2cUrLtQACF8cQNzjFHqV2asKslg=</dsig:DigestValue>
    </asmv2:hash>
  </file>
  <file name="CanaryWMIProvider.dll" destinationPath="$(runtime.system32)\" sourceName="CanaryWMIProvider.dll" sourcePath=".\" importPath="$(build.nttree)\">
    <securityDescriptor name="WRP_FILE_DEFAULT_SDDL" />
    <asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2">
      <dsig:Transforms xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
        <dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
      </dsig:Transforms>
      <dsig:DigestMethod xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
      <dsig:DigestValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">+JbnybcAcHrcOoplmPoEopa46SIbuK0ESUkbZiox2pY=</dsig:DigestValue>
    </asmv2:hash>
  </file>
  <file name="Microsoft.CanaryService.Core.dll" destinationPath="$(runtime.system32)\" sourceName="Microsoft.CanaryService.Core.dll" sourcePath=".\" importPath="$(build.nttree)\">
    <securityDescriptor name="WRP_FILE_DEFAULT_SDDL" />
    <asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2">
      <dsig:Transforms xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
        <dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
      </dsig:Transforms>
      <dsig:DigestMethod xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
      <dsig:DigestValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">DyFWRBDD0i7rVuk9ZdM/T4PEmt0nYOxElWhbNKXuttQ=</dsig:DigestValue>
    </asmv2:hash>
  </file>
  <file name="CanaryWMIProvider.mof" destinationPath="$(runtime.wbem)\" sourceName="CanaryWMIProvider.mof" sourcePath=".\" importPath="$(build.nttree)\">
    <securityDescriptor name="WRP_FILE_DEFAULT_SDDL" />
    <asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2">
      <dsig:Transforms xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
        <dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
      </dsig:Transforms>
      <dsig:DigestMethod xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
      <dsig:DigestValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">dD3y8YIKPH8ggruzEN4CQaJL6aaVQxWcSaa6Gaw6q3s=</dsig:DigestValue>
    </asmv2:hash>
  </file>
  <file name="CanaryWMIProvider_Uninstall.mof" destinationPath="$(runtime.wbem)\" sourceName="CanaryWMIProvider_Uninstall.mof" sourcePath=".\" importPath="$(build.nttree)\">
    <securityDescriptor name="WRP_FILE_DEFAULT_SDDL" />
    <asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2">
      <dsig:Transforms xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
        <dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
      </dsig:Transforms>
      <dsig:DigestMethod xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
      <dsig:DigestValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">ma793mzUiRtsZ/T5hAJSuCUcoD0qp9I2ye5mDXMAK50=</dsig:DigestValue>
    </asmv2:hash>
  </file>
  <directories>
    <directory destinationPath="$(runtime.windows)\schemas\CanaryService\" owner="false">
      <securityDescriptor name="WRP_DIR_DEFAULT_SDDL" />
    </directory>
  </directories>
  <memberships>
    <categoryMembership>
      <id name="Microsoft.Windows.Categories.Services" version="10.0.10586.11" publicKeyToken="31bf3856ad364e35" typeName="Service" />
      <categoryInstance subcategory="Canary">
        <serviceData name="Canary" displayName="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-101" errorControl="normal" imagePath="%SystemRoot%\system32\Microsoft.CanaryService.exe" start="demand" type="win32OwnProcess" description="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-100" objectName="NT AUTHORITY\NetworkService" sidType="unrestricted" requiredPrivileges="SeChangeNotifyPrivilege,SeCreateGlobalPrivilege,SeImpersonatePrivilege">
          <failureActions resetPeriod="1000">
            <actions>
              <action type="restartService" delay="1000" />
              <action type="restartService" delay="1000" />
              <action type="none" />
            </actions>
          </failureActions>
        </serviceData>
      </categoryInstance>
    </categoryMembership>
  </memberships>
  <registryKeys>
    <registryKey keyName="HKEY_CLASSES_ROOT\CLSID\{75E96CAA-A5D1-44E3-B3DD-F969D4DC9EBE}">
      <registryValue name="" valueType="REG_SZ" value="Microsoft Canary Service WMIv2 Provider" />
      <securityDescriptor name="WRP_REGKEY_DEFAULT_SDDL" />
    </registryKey>
    <registryKey keyName="HKEY_CLASSES_ROOT\CLSID\{75E96CAA-A5D1-44E3-B3DD-F969D4DC9EBE}\InprocServer32\">
      <registryValue name="" valueType="REG_EXPAND_SZ" value="%SYSTEMROOT%\System32\CanaryWMIProvider.dll" />
      <registryValue name="ThreadingModel" valueType="REG_SZ" value="Both" />
    </registryKey>
  </registryKeys>
  <trustInfo>
    <security>
      <accessControl>
        <securityDescriptorDefinitions>
          <securityDescriptorDefinition name="WRP_DIR_DEFAULT_SDDL" sddl="O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464D:P(A;CIOI;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;CIOI;GRGX;;;SY)(A;CIOI;GRGX;;;BA)(A;CIOI;GRGX;;;BU)(A;CIOI;GRGX;;;S-1-15-2-1)S:(AU;FASA;SDWDWOFW;;;WD)" operationHint="replace" />
          <securityDescriptorDefinition name="WRP_FILE_DEFAULT_SDDL" sddl="O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464D:P(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;GRGX;;;BA)(A;;GRGX;;;SY)(A;;GRGX;;;BU)(A;;GRGX;;;S-1-15-2-1)S:(AU;FASA;0x000D0116;;;WD)" operationHint="replace" description="Default SDDL for Windows Resource Protected file" />
          <securityDescriptorDefinition name="WRP_REGKEY_DEFAULT_SDDL" sddl="O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464D:P(A;CI;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;CI;GR;;;SY)(A;CI;GR;;;BA)(A;CI;GR;;;BU)(A;CI;GR;;;S-1-15-2-1)" operationHint="replace" />
        </securityDescriptorDefinitions>
      </accessControl>
    </security>
  </trustInfo>
  <mof xmlns="urn:schemas-microsoft-com:asm.v3" name="$(runtime.wbem)\CanaryWMIProvider.mof" uninstallmof="$(runtime.wbem)\CanaryWMIProvider_Uninstall.mof" />
  <firewallRule xmlns="urn:schemas-microsoft-com:asm.v3" action="Allow" active="True" desc="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-111" dir="In" group="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-110" internalName="Canary-TCP-In" lport="8084" name="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-112" protocol="6" />
  <firewallRule xmlns="urn:schemas-microsoft-com:asm.v3" action="Allow" active="True" binary="%SystemRoot%\System32\Microsoft.CanaryService.exe" desc="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-113" dir="Out" group="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-110" internalName="Canary-TCP-Out" name="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-114" protocol="6" svc="Canary" />
  <firewallRule xmlns="urn:schemas-microsoft-com:asm.v3" action="Allow" active="True" binary="%SystemRoot%\System32\Microsoft.CanaryService.exe" desc="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-115" dir="Out" group="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-110" internalName="Canary-ICMPv4-Out" name="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-116" protocol="1" svc="Canary" />
  <firewallRule xmlns="urn:schemas-microsoft-com:asm.v3" action="Allow" active="True" binary="%SystemRoot%\System32\Microsoft.CanaryService.exe" desc="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-117" dir="Out" group="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-110" internalName="Canary-ICMPv6-Out" name="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-118" protocol="58" svc="Canary" />
  <firewallRule xmlns="urn:schemas-microsoft-com:asm.v3" action="Allow" active="True" desc="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-119" dir="In" group="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-110" internalName="Canary-ICMPv4-In" name="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-120" protocol="1" />
  <firewallRule xmlns="urn:schemas-microsoft-com:asm.v3" action="Allow" active="True" desc="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-121" dir="In" group="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-110" internalName="Canary-ICMPv6-In" name="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-122" protocol="58" />
  <firewallRule xmlns="urn:schemas-microsoft-com:asm.v3" Action="Allow" Active="True" Binary="%systemroot%\system32\svchost.exe" Desc="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-123" Dir="In" Group="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-110" InternalName="Canary-WMI-In" LPort="RPC" Name="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-124" Protocol="6" Svc="winmgmt" />
  <firewallRule xmlns="urn:schemas-microsoft-com:asm.v3" Action="Allow" Active="True" Binary="%systemroot%\system32\svchost.exe" Desc="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-125" Dir="In" Group="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-110" InternalName="Canary-DCOM-In" LPort="RPC-EPMAP" Name="@%SystemRoot%\system32\Microsoft.CanaryService.exe,-126" Protocol="TCP" Svc="rpcss" />
</assembly>