Process Hacker

# Introduction

Process Hacker is a tool to view and manipulate processes and services. It can display process' threads, modules, memory regions and handles, search through process memory, and read/write memory using a built-in hex editor.

## System Requirements

- Microsoft Windows XP SP2, Vista or 7 (Windows XP SP3 and Windows Vista SP1 required for certain features)
- .NET Framework 2.0

## Configuration File

The settings file for Process Hacker is stored in: `[Roaming Application Data]\Process Hacker`.

## Command Line Options

-a
  Aggressive mode. Attempts to unhook all system call stubs and hooks certain system calls to use KProcessHacker.
-e
  Enables extended command line processing (not documented at the present time).
-elevate
  Starts Process Hacker elevated.
-h, -help, -?
  Shows a list of available command line options.
-installkph
  Installs the KProcessHacker service.
-ip pid
  Opens process properties for the specified process after all other loading has completed.
-m
  Starts Process Hacker hidden, regardless of any settings.
-nokph
  Disables KProcessHacker.
-nosettings
  Uses defaults for all settings and does not attempt to load or save any settings.
-o [-hwnd hWnd] [-rect x,y,width,height]
  Opens Process Hacker options without the main window. Note that the width and height parts of the rectangle parameter are ignored.
-pw pid
  Opens process properties for the specified process without the main window.
-pt pid
  Opens token properties for the token of the specified process without the main window.
-settings filename
  Uses the specified file name as the settings file.
-t tab
  Opens the specified tab at startup. Use 0 for Processes, 1 for Services and 2 for Network.
-uninstallkph
  Uninstalls the KProcessHacker service.
-v
  Starts Process Hacker visible, regardless of any settings.

# Options

Process Hacker's options are accessible from the Options menu item in the Hacker menu.

## General

Update Interval
  The amount of time in milliseconds between each update; i.e, when Process Hacker looks for new, modified or removed processes, services and other objects.
Processes in icon menu
  The number of processes to display in the notification icon menu.
Search Engine
  This is used by the Search Online... menu item in the process and module context menus. `%s` is replaced by the name of the selected process or module.
Require Signatures
  If Verify signatures and perform additional checks is enabled, this specifies the processes that must have a valid signature. Processes with a name that is specified in this field and do not have a valid signature will be highlighted as a Packed/Dangerous Process (see Higlighting options).
Max. Size Unit
  Specifies the maximum unit of size; sizes which can be displayed as 1024 or less in a smaller unit will be displayed in that smaller unit, while sizes requiring a larger unit will use units up to the maximum unit specified here.
Hide when minimized
  If enabled, Process Hacker will automatically hide itself when it is minimized. You can double-click on the notification icon to show Process Hacker.
Hide when closed
  If enabled, Process Hacker will automatically hide itself when it is closed. You can double-click on the notification icon to show Process Hacker.
Start hidden
  If enabled, Process Hacker will start hidden. You can double-click on the notification icon to show Process Hacker.
Allow only one instance
  If enabled, Process Hacker will allow only one instance of itself. Any attempts to start a new instance will show the existing instance.
Float child windows
  If enabled, child windows such as process properties and the memory editor will float above the main Process Hacker window.
Scroll down the process tree at startup
  If enabled, Process Hacker will scroll down the process tree to the first instance of explorer.exe running as the current user at startup.
Show user/group domains
  If enabled, Process Hacker will show the domain of users and groups: `user` would be shown as `machine-name\user`.

## Advanced

Enable kernel-mode driver
  Some handles cannot be displayed by a user-mode program like Process Hacker; this option enables KProcessHacker which allows Process Hacker to display all handles and bypass rootkits/security software. If enabled, it will be loaded the next time Process Hacker is started.
Enable experimental features
  Enables experimental features such as process protection.
Verify signatures and perform additional checks
  This option affects newly created processes, and controls whether Process Hacker will attempt to verify the digital signatures of processes and detect packed images.
Replace Task Manager with Process Hacker
  If enabled, any attempt to start Task Manager will start Process Hacker instead.
Warn about potentially dangerous actions
  If disabled, Process Hacker will not show confirmation prompts for most actions.
Hide handles with no name
  If enabled, unnamed handles will be hidden by default. This can be changed in each process properties window.
Hide Process Hacker network connections
  If enabled, network connections made by Process Hacker will be hidden in the network connections list.
Elevation
  Controls how Process Hacker will prompt for elevation in operations where the user does not have required permissions.
Max. Sample History
  Specifies the maximum number of performance-related samples to be retained. This includes CPU, I/O and memory usage data for the system and all processes.

## Highlighting

Highlighting Duration
  This specifies the amount of time for which new and removed objects (processes, threads and services) are highlighted in a different color.
New Objects
  New processes, services, threads, modules, memory regions, and handles.
Removed Objects
  Terminated/deleted processes, services, threads, modules, memory regions and handles.
Own Processes
  Processes running under the same user account as Process Hacker.
System Processes
  Processes running under the SYSTEM user account.
Service Processes
  Processes hosting one or more services.
Debugged Processes
  Processes currently being debugged.
Elevated Processes
  Processes running with full privileges on a computer with User Account Control (UAC) enabled.
Job Processes
  Processes associated with a job object.
.NET Processes and DLLs
  Managed (.NET) processes and DLLs/modules.
POSIX Processes
  POSIX subsystem processes (also known as Subsystem for UNIX-based Applications).
Packed/Dangerous Processes
  Packed images and images with invalid signatures. These processes are often, but not always malicious - normal executables are often packed to reduce their size.
Suspended Threads
  Threads which have been suspended.
GUI Threads
  Threads which have made at least one GUI-related system call.
Relocated DLLs
  DLLs which were not loaded at their preferred base address.
Protected Handles
  Handles which are protected from being closed.
Inherit Handles
  Handles which will be inherited by child processes.

## Plotting

Use Anti-aliasing
  If enabled, Process Hacker will draw graphs with anti-aliasing. This will usually consume much more system resources than normal.
Step
  This option controls the distance in pixels between each data point.

## Symbols

Dbghelp.dll path
  Select the path to the most recent version of dbghelp.dll you have installed on your computer. If you do not have the latest version, go to `http://www.microsoft.com/whdc/devtools/debugging/default.mspx` and download Debugging Tools for Windows.
Search path
  Type in a symbol server path. Most users will want to use the following: `SRV*C:\Users\USERNAME\Symbols*http://msdl.microsoft.com/download/symbols`. This will have any needed symbols downloaded from Microsoft's symbol server to the specified directory (in bold).
Undecorate symbols
  If enabled, C++ symbol names will be undecorated (unmangled). This is most useful for methods with complex signatures.

# Number Input

Process Hacker supports the input of numbers in various bases (including some non-standard extensions). This is allowed in: Get Function Address, Change Memory Protection, the Go To box in Read/Write Memory, and the insertion of numbers through the Utilities button.

A number is assumed to be in base 10 unless:

- It starts with `0` (zero) - octal (base 8)
- It starts with `0x` - hexadecimal (base 16)
- It starts with `b` - binary (base 2)
- It starts with `t` - ternary (base 3)
- It starts with `q` - quaternary (base 4)
- It starts with `w` - base 12
- It starts with `r` - base 32

# Process Tree

The process tree displays processes running on the system as a tree; processes started by a particular parent process are shown indented below it. Processes with a non-existent parent (where its parent has terminated) are shown on the far left. You can manipulate processes by right-clicking on them, and you can show detailed properties for a process by double-clicking it or selecting the "Properties..." menu item.

You can sort by the various columns by clicking on them - the tree view will temporarily become a flat list. You can click the same column again to sort in the reverse order, and once more to return to the tree view.

Like Process Explorer, Process Hacker shows Deferred Procedure Calls (DPCs) and Interrupts in the process tree. The only information these "processes" show is their CPU usage.

## Context Menu

Warning: Manipulating csrss.exe, dwm.exe, lsass.exe, lsm.exe, smss.exe, winlogon.exe or any other system processes is not recommended and may lead to system instability or a crash.

Terminate Process(es)
  Terminates the selected process(es). If KProcessHacker is enabled, Process Hacker will, except under extraordinary circumstances, be able to terminate any process, including ones protected by rootkits or security software.
Terminate Process Tree
  Terminates the selected process and its descendants.
Suspend Process(es)
  Suspends the selected process(es). If KProcessHacker is enabled and running on Windows Vista, Process Hacker will be able to suspend any process, including ones protected by rootkits or security software.
Resume Process(es)
  Resumes the selected process(es). If KProcessHacker is enabled and running on Windows Vista, Process Hacker will be able to resume any process, including ones protected by rootkits or security software.
Restart
  Restarts the selected process with the same command line arguments and working directory.
Reduce Working Set
  Empties the selected process(es)' working set(s). This is a safe function; the process will eventually reclaim most of its working set.
Virtualization
  Allows you to enable or disable virtualization for the selected process, if allowed.
Affinity...
  Allows you to view and modify the process' CPU affinity (the CPUs on which it is allowed to run).
Create Dump File...
  Allows you to create a crash dump file for the process. This operation does not actually cause the process to crash or terminate.
Terminator...
  A tool which tries to terminate the selected process using many different techniques.
Detach from Debugger
  Detaches the process from any debugger. This will cause any attached debuggers to stop working.
Heaps...
  Shows the heaps created by the process. Note that this action causes a temporary thread to be created in the process and should be used with caution.
Inject DLL...
  Allows you to select a DLL file (or any other PE image) that will be injected into the selected process. This option is only available for processes running in the same session as Process Hacker (usually processes in the same user account).
Priority
  Sets the process's priority - Real Time, High, Above Normal, Normal, Below Normal, Idle. This option is not available when multiple processes are selected.
Run As
  These tools require `Assistant.exe` (distributed with Process Hacker) to be in the same directory as `ProcessHacker.exe`.
  Launch As User... - This allows you to run the selected process as another user.
  Launch As This User... - This allows you to run a program under the selected process' user. This is useful when you want to start a program as another user but you do not have that user's password.
Search Online...
  Opens the default web browser with the search engine specified in Process Hacker's options.
Re-analyze
  Re-examines the process to determine if it is signed, packed, or a .NET process.
Select All
  Selects all items in the list.

## Terminator tests

TP1
  Terminates the process using the NtTerminateProcess function.
TP2
  Uses the RtlCreateUserThread function to create a thread in the process which calls ExitProcess, terminating the process. On Vista and above, the thread calls RtlExitUserProcess.
TT1
  Terminates the process' threads by using the NtTerminateThread function.
TT2
  Sets the contexts of the process' threads to point to the ExitProcess function. The process will be terminated when one of the threads are context switched to.
TP1a
  (Windows Server 2003 and above only.) Uses NtGetNextProcess to open a handle to the process and terminate it using NtTerminateProcess.
TT1a
  (Windows Server 2003 and above only.) Uses NtGetNextThread to open a handle to each of the process' threads and terminates them using NtTerminateThread.
CH1
  Uses NtDuplicateObject to close the process' handles. This method works best for complex programs.
TJ1
  Creates a job, assigns the process to it, and terminates the job, terminating the process.
TD1
  Creates a debug object, assigns the process to it, and closes the debug object, terminating the process.
TP3
  Uses the internal kernel-mode function PsTerminateProcess to terminate the process.
TT3
  Uses the internal kernel-mode function PspTerminateThreadByPointer to terminate the process' threads.
TT4
  Queues a kernel-mode special asynchronous procedure calls (APCs) to each of the process' threads. This APC calls PspTerminateThreadByPointer to directly terminate the threads. This method will terminate threads hanging due to kernel-mode code, but the system may crash or freeze because kernel-mode code is not given the chance to release any resources. Use this option with extreme caution.
M1
  Uses WriteProcessMemory to write random data to the process' memory, crashing the process.
M2
  Uses VirtualProtectEx to prevent the process' pages from being used, crashing the process.

# Process Properties

General
  Displays basic information about the process and its image file. You can also view the process' PEB contents, view/change its DEP status (requires Windows XP SP3 or higher, and changing DEP status uses remote thread injection), and protect/unprotect it (requires Windows Vista).
Statistics
  Displays statistics and performance information.
Performance
  Displays three graphs relating to the process' performance - CPU Usage, Memory Usage, and I/O activity. You can hover your mouse over the graphs to view details.
Threads
  Displays the process' threads, including their symbolic start addresses. You can click on a thread to view more information, or double-click a thread to view its call stack.
Token
  Displays the process' primary token. On Windows Vista with UAC enabled, you can also click on the Linked Token... button to view the token associated with the process' token. You can also enable and disable privileges.
Modules
  Displays the modules loaded by the process. Right-click a module for more options.
Memory
  Displays the process' virtual memory regions. Double-click a memory region to read/write its contents, and right-click a memory region to perform other actions. You can also search memory using the search button (see below).
Environment
  Displays the process' environment variables.
Handles
  Displays the process' handles - resources it has opened. You can right-click a handle and close it.
Services
  Displays services that are registered in the process.

# Searching Memory

Process Hacker supports searching using a literal string or regular expressions. To perform a search, open a Properties window for a process, select the Memory tab and select an option in the search button. A window will appear in which you can enter the data to search for. You can also control the types of memory regions to search.

Literal Search
  Allows you to enter a sequence of bytes to search for.
Regex Search
  Allows you to search using regular expressions.
String Scan
  Scans for strings inside the process' memory.
Heap Scan
  Displays a list of heap blocks.
Struct Search
  Allows you to search for addresses which match the selected struct.

In the Literal tab, there is a small button in the bottom-right which allows you to insert data in various formats.

Insert Number
  This allows you to insert numbers in various formats - 8 to 64-bit, little or big endian.
Insert String
  Similarly, this allows you to insert strings in various encodings - ASCII, UTF-8 to UTF-32. If a multiline item is selected, the prompt box will have a multiline textbox.

In the search results list, double-clicking an item will open the Memory Editor with the search result highlighted.

## Sample Regex Searches

All of these samples must have Ignore Case selected.

A valid filesystem character is `[ a-z0-9`~';!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]`

Email address
  `[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.(au|biz|ca|com|info|net|org|uk|zh)`
Path name
  `[A-Z]:\\([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*\\)*([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*)(\\)*`
Executable file
  `([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}])+\.(bat|com|dll|exe)`
URL
  `(file|ftp|http):///*[a-z0-9%\/ .\-_:\(\)\[\]]+`

# Results Window

The Results Window is displayed when searching for data, scanning for strings or scanning for heaps. There are five buttons at the top of the window:

Refresh
  This performs the search again.
Edit Search
  This allows you to edit the search type and data associated with the Results Window.
Filter
  This allows you to filter the search results, creating a new Results Window containing the matching items. To filter using a numerical relation, enter the relation (for example, greater than or equal to `>=`) followed by the number. If the filter (`>=10`) is applied to the Length column, all items with a length greater than or equal 10 will be displayed.
Intersect
  This allows you to select another Results Window. It then creates a third Results Window in which the search results present in both Results Windows are displayed. This allows you to filter search results.
Save...
  This allows you to save the search results to a text file.

# Glossary

Affinity
  The set of processors on which a thread or collection of threads (process) is allowed to execute on.
Child Process
  A new process started by an existing one.
Command Line
  A string describing a program to start and any parameters to pass to it. Examples: `C:\Windows\notepad.exe C:\Windows\win.ini`, `cmd /TF0`
Commit
  A committed page or memory region contains actual data. Compare with reserve.
Context Switch
  The act of switching a processor to run another thread. Since processors can only run one task at a time, context switching gives the illusion of multi-tasking.
Data Execution Prevention
  The Windows implementation of NX (No eXecute) technology, designed to prevent the execution of data regions as code. This can prevent certain types of software attacks.
Elevation (UAC)
  Under UAC, a process which is elevated has full administrative rights to system resources.
Environment Variable
  A variable accessible to processes describing the operating system environment. Environment variables are normally inherited by child processes.
Handle
  A reference to a shared operating object or resource, e.g. a handle to an event, file or process.
Heap
  A process-managed structure from which memory can be allocated. Since pages can only be allocated in large chunks, using a heap will reduce wastage of memory for small allocations.
Image
  A "package" containing executable code.
Interrupt
  An event, usually signaled by hardware, that is handled by the operating system through a interrupt handler.
Kernel
  A collection of code that manages system-wide resources such as I/O, processes and threads, and security. System calls are also handled by the kernel.
Kernel-mode
  A processor mode in which code can access hardware directly and access all memory. For example, when a system call is made, the processor switches to kernel-mode in order to perform an action on the requester's behalf. When the system call finishes, it switches back to user-mode and the requester continues normal execution.
Kernel-mode thread
  A thread that runs solely in kernel-mode. These are usually worker threads that carry out delayed operating system tasks. Most kernel-mode threads are contained in the System process, but in some systems csrss.exe also runs kernel-mode threads.
LPC
  Local inter-Process Communication (or Local Procedure Call). A Windows NT mechanism which enables processes to communicate with each other.
LUID
  Locally Unique IDentifier. A value which is unique on the local system until it is rebooted.
Module
  An executable image which can be loaded by processes. Through this mechanism, code and resources may be shared.
Page
  A block of memory, 4 kB in size on x86 and AMD64 processors.
PEB
  Process Environment Block. The PEB contains a variety of data used by the process.
Privilege
  A privilege belonging to a process. It can be enabled or disabled, and certain system calls require the presence of specific privileges to work.
Process
  A collection of threads along with virtual memory, handles and other resources.
Protection (DRM)
  Process and thread protection introduced in Windows Vista, designed to enhance support for digital restrictions management. Examples of processes protected by this mechanism include System and audiodg.exe.
Reserve
  A reserved page or memory region does not contain data and has not been allocated storage in physical memory. Reserving pages is commonly done to ensure a certain amount of contiguous address space is available without actually allocating storage. Compare with commit.
Service
  A operating system managed program which runs in the background. They can be in shared processes (in svchost.exe instances), in separate processes, or drivers loaded into kernel-mode space.
SID
  Security IDentifier. A unique identifier assigned to security-related objects such as users and groups.
String
  A sequence of characters - text.
System Call
  A request that is made by a thread to the kernel to perform a task on the thread's behalf. This done because most threads run in user-mode and are unable to access hardware directly. See kernel-mode.
System Thread
  See kernel-mode thread.
Thread
  A unit of execution belonging to a process, running code concurrently. Most threads run in user-mode, but some are kernel-mode threads.
User Account Control
  Refers to restrictions on normal processes preventing them from modifying system-wide files and settings. Processes which are elevated have full administrative access to system resources.
Virtualization (UAC)
  A technology which redirects writes to the file system and registry for processes which are not elevated.
Working set
  The collection of pages recently referenced by a process. These pages are in physical memory, while other pages may be in the pagefile.
WOW64
  A technology which enables 32-bit programs to run on 64-bit Windows systems.

# Copyright Information

## Process Hacker

          Process Hacker

          Copyright (C) 2008-2009 various authors (see README.txt for the full list)

          This program is free software: you can redistribute it and/or modify
          it under the terms of the GNU General Public License as published by
          the Free Software Foundation, either version 3 of the License, or
          (at your option) any later version.

          This program is distributed in the hope that it will be useful,
          but WITHOUT ANY WARRANTY; without even the implied warranty of
          MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
          GNU General Public License for more details.

          You should have received a copy of the GNU General Public License
          along with this program.  If not, see <http://www.gnu.org/licenses/>.

## HexBox

Process Hacker uses the HexBox component by Bernhard Elbl, licensed under the Microsoft Public License:

    This license governs use of the accompanying software. If you use the software, you
    accept this license. If you do not accept the license, do not use the software.

    1. Definitions
    The terms "reproduce," "reproduction," "derivative works," and "distribution" have the
    same meaning here as under U.S. copyright law.
    A "contribution" is the original software, or any additions or changes to the software.
    A "contributor" is any person that distributes its contribution under this license.
    "Licensed patents" are a contributor's patent claims that read directly on its contribution.

    2. Grant of Rights
    (A) Copyright Grant- Subject to the terms of this license, including the license conditions
        and limitations in section 3, each contributor grants you a non-exclusive, worldwide,
        royalty-free copyright license to reproduce its contribution, prepare derivative works
        of its contribution, and distribute its contribution or any derivative works that you
        create.
    (B) Patent Grant- Subject to the terms of this license, including the license conditions
        and limitations in section 3, each contributor grants you a non-exclusive, worldwide,
        royalty-free license under its licensed patents to make, have made, use, sell, offer
        for sale, import, and/or otherwise dispose of its contribution in the software or
        derivative works of the contribution in the software.

    3. Conditions and Limitations
    (A) No Trademark License- This license does not grant you rights to use any contributors'
        name, logo, or trademarks.
    (B) If you bring a patent claim against any contributor over patents that you claim are
        infringed by the software, your patent license from such contributor to the software
        ends automatically.
    (C) If you distribute any portion of the software, you must retain all copyright, patent,
        trademark, and attribution notices that are present in the software.
    (D) If you distribute any portion of the software in source code form, you may do so only
        under this license by including a complete copy of this license with your distribution.
        If you distribute any portion of the software in compiled or object code form, you may
        only do so under a license that complies with this license.
    (E) The software is licensed "as-is." You bear the risk of using it. The contributors give
        no express warranties, guarantees or conditions. You may have additional consumer rights
        under your local laws which this license cannot change. To the extent permitted under your
        local laws, the contributors exclude the implied warranties of merchantability, fitness for
        a particular purpose and non-infringement.

## VistaMenu and SplitButton

Process Hacker uses the VistaMenu and SplitButton components by Wyatt O'Day, licensed under the following terms:

    Copyright (c) 2008, wyDay
    All rights reserved.

    Redistribution and use in source and binary forms, with or without modification, are permitted
    provided that the following conditions are met:

        * Redistributions of source code must retain the above copyright notice, this list of
        conditions and the following disclaimer.
        * Redistributions in binary form must reproduce the above copyright notice, this list of
        conditions and the following disclaimer in the documentation and/or other materials provided
        with the distribution.

    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
    IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
    FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
    CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
    DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
    DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
    IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
    OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

## LINQBridge

Process Hacker uses the LINQBridge component by Joseph Albahari, licensed under the following terms:

    LINQBridge Copyright (c) 2007-2008 Joseph Albahari

    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:

    The above copyright notice and this permission notice shall be included in
    all copies or substantial portions of the Software.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
    THE SOFTWARE.