diff --git a/artifacts/definitions/Windows/Carving/CobaltConfig.yaml b/artifacts/definitions/Windows/Carving/CobaltConfig.yaml index d11d3f7add9..e120be1b285 100644 --- a/artifacts/definitions/Windows/Carving/CobaltConfig.yaml +++ b/artifacts/definitions/Windows/Carving/CobaltConfig.yaml @@ -6,8 +6,9 @@ description: | a cobalt strike beacon via a yara process scan. The User can define a file glob, process name or pid regex as a target. The - content will firstly search for a configuration pattern, extract a defined - byte size, xor with discovered key, then attempt configuration extraction. + content will firstly confirm detection. Next it will search for a + configuration pattern, extract a defined byte size, xor with discovered key, + then attempt configuration extraction. - Cobalt Strike beacon configuration is typically XORed with 0x69 or 0x2e (depending on version) but trivial to change. @@ -21,8 +22,9 @@ description: | This content simply carves the configuration and does not unpack files on disk. That means pointing this artifact as a packed or obfuscated file may not obtain the expected results. - Unpacking / shellcode analysis may come in a later - version. + + Unpacking / shellcode analysis may come in a later version. + Detection is optional - simply remove DetectionYara. Please submit PR/improvements on additional testing. reference: @@ -46,13 +48,60 @@ parameters: type: hidden default: | rule find_cobalt_strike_config { - strings: - $REPLACEME + strings: + $REPLACEME + condition: + any of them + } + - name: DetectionYara + default: | + rule win_cobalt_strike_auto { + meta: + author = "Felix Bilstein - yara-signator at cocacoding dot com" + date = "2019-11-26" + version = "1" + description = "autogenerated rule brought to you by yara-signator" + tool = "yara-signator 0.2a" + malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike" + malpedia_license = "CC BY-SA 4.0" + malpedia_sharing = "TLP:WHITE" + + strings: + $sequence_0 = { 3bc7 750d ff15???????? 3d33270000 } + $sequence_1 = { e9???????? eb0a b801000000 e9???????? } + $sequence_2 = { 8bd0 e8???????? 85c0 7e0e } + $sequence_3 = { ffb5f8f9ffff ff15???????? 8b4dfc 33cd e8???????? c9 c3 } + $sequence_4 = { e8???????? e9???????? 833d?????????? 7505 e8???????? } + $sequence_5 = { 250000ff00 33d0 8b4db0 c1e908 } + $sequence_6 = { ff75f4 ff7610 ff761c ff75fc } + $sequence_7 = { 8903 6a06 eb39 33ff 85c0 762b 03f1 } + $sequence_8 = { 894dd4 8b458c d1f8 894580 8b45f8 c1e818 0fb6c8 } + $sequence_9 = { 890a 8b4508 0fb64804 81e1ff000000 c1e118 8b5508 0fb64205 } + $sequence_10 = { 33d2 e8???????? 48b873797374656d3332 4c8bc7 488903 49ffc0 } + $sequence_11 = { 488bd1 498d4bd8 498943e0 498943e8 } + $sequence_12 = { b904000000 486bc90e 488b542430 4c8b442430 418b0c08 8b0402 } + $sequence_13 = { ba80000000 e8???????? 488d4c2438 e8???????? 488d4c2420 8bd0 e8???????? } + $sequence_14 = { 488b4c2430 8b0401 89442428 b804000000 486bc004 } + $sequence_15 = { 4883c708 4883c304 49ffc3 48ffcd 0f854fffffff 488d4c2420 } + + condition: + 7 of them + } + rule cobaltstrike_beacon_4_2_decrypt + { + meta: + author = "Elastic" + description = "Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2." + strings: + $a_x64 = {4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03} + $a_x86 = {8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2} condition: - any of them + any of them } + + export: | LET Profile = '''[ [CobaltConfig, 0, [ @@ -331,6 +380,9 @@ export: | sources: - query: | + -- unique function to groupby value for enumerate + LET unique(values) = SELECT _value as value FROM foreach(row=values) GROUP BY _value + -- section to dynamically generate Xor configuration yara hunt strings LET a <= unhex(string='01') LET b <= unhex(string='02') @@ -352,7 +404,7 @@ sources: len(list=X) FROM XorChars - LET XorCharsStep3 = + LET YaraStrings = SELECT -- { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 03 } X,H, H + ' = { ' + format(format='% x', args=X + aXor + X + aXor + X + bXor) + @@ -364,18 +416,38 @@ sources: regex_replace( source=FindConfigTemplate, re='REPLACEME', - replace=join(array=XorCharsStep3.Line, sep=" $$")) + replace=join(array=YaraStrings.Line, sep=" $$")) + - - -- find target files LET TargetFiles = SELECT FullPath FROM glob(globs=TargetFileGlob) -- scan files in scope with our rule - LET file_hits = SELECT * FROM foreach(row=TargetFiles, + LET FileDetections = SELECT * FROM foreach(row=TargetFiles, + query={ + SELECT * FROM if(condition=DetectionYara, + then={ + SELECT * FROM switch( + a={ -- yara detection + SELECT FullPath, unique(values=enumerate(items=Rule)).value as Detections + FROM yara(files=FullPath, rules=DetectionYara) + GROUP BY FullPath + }, + b={ -- yara miss + SELECT FullPath, Null as Detections FROM TargetFiles + }) + + }, + else={ -- no yara detection run + SELECT FullPath, 'N/A' as Detections FROM TargetFiles + }) + }) + + -- scan files in scope with our rule + LET FileConfiguration = SELECT * FROM foreach(row=FileDetections, query={ SELECT - FullPath as ConfigSource, + dict(FullPath=FullPath,Detection=Detections) as ConfigSource, String.Offset as Offset, substr(start=0,end=1,str=String.Data) as Xor, read_file(filename=FullPath, @@ -384,6 +456,9 @@ sources: FROM yara(files=FullPath, rules=FindConfig, number=99) }) + + + -- find velociraptor process LET me <= SELECT Pid FROM pslist(pid=getpid()) @@ -395,12 +470,33 @@ sources: AND format(format="%d", args=Pid) =~ PidRegex AND NOT Pid in me.Pid + -- scan processes in scope with our Detection + LET ProcessDetections = SELECT * FROM foreach(row=processes, + query={ + SELECT * FROM if(condition=DetectionYara, + then={ + SELECT * FROM switch( + a={ -- yara detection + SELECT ProcessName, CommandLine, Pid, unique(values=enumerate(items=Rule)).value as Detections + FROM yara(files=Pid,accessor='process', rules=DetectionYara) + GROUP BY Pid + }, + b={ -- yara miss + SELECT ProcessName, CommandLine, Pid, Null as Detections FROM scope() + }) + }, + else={ -- no yara detection run + SELECT ProcessName, CommandLine, Pid, 'N/A' as Detections FROM scope() + }) + }) + -- scan processes in scope with our rule - LET process_hits = SELECT * FROM foreach( - row=processes, + LET ProcessConfiguration = SELECT * FROM foreach( + row=ProcessDetections, query={ SELECT *, - dict(Pid=Pid, ProcessName=ProcessName,CommandLine=CommandLine) as ConfigSource, + dict(Pid=Pid,ProcessName=ProcessName,CommandLine=CommandLine, + Detection=Detections) as ConfigSource, String.Offset as Offset, substr(start=0,end=1,str=String.Data) as Xor, read_file(filename=str(str=Pid), accessor='process', @@ -408,7 +504,7 @@ sources: length=int(int=ExtractBytes) ) as Data FROM yara(files=Pid, accessor='process', - rules=FindConfig, number=999) + rules=FindConfig, number=99) }) -- output rows @@ -422,5 +518,5 @@ sources: struct="CobaltConfig") AS DecodedConfig, format(format="% x", args=xor(string=Data,key=Xor)) as DecodedData FROM if(condition=TargetFileGlob, - then= file_hits, - else= process_hits) + then= FileConfiguration, + else= ProcessConfiguration) \ No newline at end of file diff --git a/artifacts/testdata/server/testcases/cobalt.in.yaml b/artifacts/testdata/server/testcases/cobalt.in.yaml index eaf7e29d9df..68ae7031480 100644 --- a/artifacts/testdata/server/testcases/cobalt.in.yaml +++ b/artifacts/testdata/server/testcases/cobalt.in.yaml @@ -1,4 +1,23 @@ +Parameters: + TestYara: | + rule CobaltStrike_v3 { + strings: + strings: + $a = { 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 2e 2e 2e } + $b = { 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e } + condition: $a + } + rule CobaltStrike_v3_2 { + strings: $a = { 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 } + condition: $a + } + + Queries: - - SELECT relpath(path=ConfigSource, base=srcDir, sep="/") as TestPath, + - SELECT relpath(path=ConfigSource.FullPath, base=srcDir, sep="/") as TestPath,ConfigSource.Detection, Offset, Xor, DecodedConfig,DecodedData - FROM Artifact.Windows.Carving.CobaltStrike(TargetFileGlob=srcDir + "/artifacts/testdata/files/CSDump.bin") + FROM Artifact.Windows.Carving.CobaltStrike(TargetFileGlob=srcDir + "/artifacts/testdata/files/CSDump.bin",DetectionYara=TestYara) + WHERE Xor = "0x69" + - SELECT relpath(path=ConfigSource.FullPath, base=srcDir, sep="/") as TestPath,ConfigSource.Detection, + Offset, Xor, DecodedConfig,DecodedData + FROM Artifact.Windows.Carving.CobaltStrike(TargetFileGlob=srcDir + "/artifacts/testdata/files/CSDump.bin",DetectionYara='') diff --git a/artifacts/testdata/server/testcases/cobalt.out.yaml b/artifacts/testdata/server/testcases/cobalt.out.yaml index b4ec98ddeb6..b2f8ba0989d 100644 --- a/artifacts/testdata/server/testcases/cobalt.out.yaml +++ b/artifacts/testdata/server/testcases/cobalt.out.yaml @@ -1,6 +1,69 @@ -SELECT relpath(path=ConfigSource, base=srcDir, sep="/") as TestPath, Offset, Xor, DecodedConfig,DecodedData FROM Artifact.Windows.Carving.CobaltStrike(TargetFileGlob=srcDir + "/artifacts/testdata/files/CSDump.bin")[ +SELECT relpath(path=ConfigSource.FullPath, base=srcDir, sep="/") as TestPath,ConfigSource.Detection, Offset, Xor, DecodedConfig,DecodedData FROM Artifact.Windows.Carving.CobaltStrike(TargetFileGlob=srcDir + "/artifacts/testdata/files/CSDump.bin",DetectionYara=TestYara) WHERE Xor = "0x69"[ { "TestPath": "artifacts/testdata/files/CSDump.bin", + "ConfigSource.Detection": null, + "Offset": 11001, + "Xor": "0x69", + "DecodedConfig": { + "BeaconType": "windows-beacon_http-reverse_http", + "Port": 80, + "Sleeptime": 60000, + "Maxgetsize": 1048576, + "Jitter": 0, + "MaxDns": 255, + "PublicKey": "30819f300d06092a864886f70d010101050003818d0030818902818100ea36557a8a8529818bb7b8da542c242b5acc89831bffca4abc75afe9834af32672ad8f7674e310a7fc52468f4ad09159a6a347d13f4b33a436f21afb0cf5e5f25b5ea5527b1fbcf8326c702a0fe969542961559a6de94ab0cb1099dd13fd19505d4b195521a837dfe29ce1060c918fcd9f03c9d8170cc837d518e50358a303db02030100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + "c2_server": "31.44.184.33,/ga.js", + "UserAgent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)", + "PostURI": "/submit.php", + "Malleable_C2_Instructions": "base64:AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", + "HttpGetHeader": "base64:AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", + "HttpPostHeader": "base64:AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", + "SpawnTo": "base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", + "Pipename": "\\\\%s\\pipe\\msagent_%x", + "KillDateYear": 0, + "KillDateMonth": 0, + "KillDateDay": 0, + "DNSIdle": "0.0.0.0", + "DNSSleep": 0, + "SSH_1": "", + "SSH_2": "", + "SSH_3": "", + "SSH_4": "", + "SSH_5": "", + "GetVerb": "", + "PostVerb": "", + "HttpPostChunk": 0, + "SpawnTox86": "%windir%\\syswow64\\rundll32.exe", + "SpawnTox64": "%windir%\\sysnative\\rundll32.exe", + "CryptoScheme": 1, + "Proxy": "", + "ProxyUsername": "", + "ProxyPassword": "", + "ProxyType": "IE settings", + "Deprecated": 0, + "LicenseId": 0, + "bStageCleanup": 0, + "bCFGCaution": 0, + "KillDate": 0, + "TextSectionEnd": 0, + "ObfuscateSectionsInfo": "base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", + "ProcessInjectStartRWX": "PAGE_EXECUTE_READWRITE", + "ProcessInjectUseRWX": "PAGE_EXECUTE_READWRITE", + "ProcessInjectMinAlloc": 0, + "ProcessInjectTransformx86": "base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", + "ProcessInjectTransformx64": "base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", + "UsesCookies": 0, + "ProcessInjectExecute": "base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", + "ProcessInjectAllocationMethod": 0, + "ProcessInjectStub": "base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", + "HostHeader": "" + }, + "DecodedData": "00 01 00 01 00 02 00 00 00 02 00 01 00 02 00 50 00 03 00 02 00 04 00 00 ea 60 00 04 00 02 00 04 00 10 00 00 00 05 00 01 00 02 00 00 00 06 00 01 00 02 00 ff 00 07 00 03 01 00 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 ea 36 55 7a 8a 85 29 81 8b b7 b8 da 54 2c 24 2b 5a cc 89 83 1b ff ca 4a bc 75 af e9 83 4a f3 26 72 ad 8f 76 74 e3 10 a7 fc 52 46 8f 4a d0 91 59 a6 a3 47 d1 3f 4b 33 a4 36 f2 1a fb 0c f5 e5 f2 5b 5e a5 52 7b 1f bc f8 32 6c 70 2a 0f e9 69 54 29 61 55 9a 6d e9 4a b0 cb 10 99 dd 13 fd 19 50 5d 4b 19 55 21 a8 37 df e2 9c e1 06 0c 91 8f cd 9f 03 c9 d8 17 0c c8 37 d5 18 e5 03 58 a3 03 db 02 03 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 03 01 00 33 31 2e 34 34 2e 31 38 34 2e 33 33 2c 2f 67 61 2e 6a 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 03 00 80 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 39 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 54 72 69 64 65 6e 74 2f 35 2e 30 3b 20 4e 50 30 37 3b 20 4e 50 30 37 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 03 00 40 2f 73 75 62 6d 69 74 2e 70 68 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 03 01 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 03 01 00 00 00 00 07 00 00 00 00 00 00 00 03 00 00 00 06 00 00 00 06 43 6f 6f 6b 69 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 03 01 00 00 00 00 0a 00 00 00 26 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 00 00 00 07 00 00 00 00 00 00 00 05 00 00 00 02 69 64 00 00 00 07 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1d 00 03 00 40 25 77 69 6e 64 69 72 25 5c 73 79 73 77 6f 77 36 34 5c 72 75 6e 64 6c 6c 33 32 2e 65 78 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 00 03 00 40 25 77 69 6e 64 69 72 25 5c 73 79 73 6e 61 74 69 76 65 5c 72 75 6e 64 6c 6c 33 32 2e 65 78 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 03 00 80 5c 5c 25 73 5c 70 69 70 65 5c 6d 73 61 67 65 6e 74 5f 25 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1f 00 01 00 02 00 01 00 13 00 02 00 04 00 00 00 00 00 14 00 02 00 04 00 00 00 00 00 1a 00 03 00 10 47 45 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 00 03 00 10 50 4f 53 54 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 02 00 04 00 00 00 00 00 25 00 02 00 04 00 00 00 00 00 26 00 01 00 02 00 00 00 27 00 01 00 02 00 00 00 23 00 01 00 02 00 02 00 28 00 02 00 04 00 00 00 00 00 29 00 02 00 04 00 00 00 00 00 2b 00 01 00 02 00 40 00 2c 00 01 00 02 00 40 00 2d 00 02 00 04 00 00 00 00 00 2e 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 01 00 02 00 05 00 00 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 61 69 60 69 69 a3 6b 79 95 e2 1d 4d 6d 3c e0 8c 81 e0 69 69 69 09 e0 8c 58 bb 0d e2 3b 59 e2 3b 65 e2 3b 7d e2 1b 41 66 de 23 4f 58 96 58 a9 c5 55 08 15 6b 45 49 a8 a6 64 68 ae 8b 99 3b 3e e2 3b 79 e2 2b 55 68 b9 e2 29 11 ec a9 1d 23 68 b9 39 e2 21 71 e2 31 49 68 ba 8a 55 20 e2 5d e2 68 bf 58 96 58 a9 c5 a8 a6 64 68 ae 51 89 1c 9d 6a 14 91 52 14 4d 1c 8b 31 e2 31 4d 68 ba 0f e2 65 22 e2 31 75 68 ba e2 6d e2 68 b9 e0 2d 4d 4d 32 32 08 30 33 38 96 89 31 36 33 e2 7b 82 ef 32 e9 17 79 69 1c 52 af 2f 79 68 01 cf fc d4 f4 96 ba 55 6f 15 73 58 a0 0d e2 28 71 50 e1 c1 68 69 69 1c 65 e4 fa a6 69 69 69 e0 f9 c1 68 69 69 58 a0 38 38 96 1f 61 96 5f 38 38 01 51 01 64 7f 96 ba a0 ab 65 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 3c e0 8c 3f 3e e2 1c 61 e2 24 65 81 69 69 69 69 31 ea a9 4c ea 85 61 e0 8b ae 2b 6d 5a 69 69 69 e0 6b 81 60 69 69 69 ea ad 7d 36 37 34 ab 61 69 e2 55 4d 96 43 21 58 a9 3e 96 bf 36 39 ae 2d 4d 6d 4a 69 69 69 e0 55 4d 96 45 4d 69 96 96 96 96 95 21 e0 a7 21 e0 8e 21 ea 8d 99 81 a1 69 69 69 28 38 28 39 3b 38 3f 21 58 bb 0c 21 e2 3b 09 21 e2 3b 71 21 e2 3b 49 21 e2 1b 39 21 66 de 23 23 24 58 a0 21 58 a9 c5 55 08 15 6b 45 49 28 a8 a0 64 28 68 a8 8b 84 3b 28 38 21 e2 3b 49 e2 2b 55 21 68 b9 0f e8 11 71 62 6b 1c 1b e2 e9 e1 69 69 69 21 ec a9 1d 0e 21 68 b9 39 e2 21 71 2d e2 29 49 20 68 b9 8a 3f 21 96 a0 28 e2 5d e1 21 68 bf 24 58 a0 21 58 a9 c5 28 a8 a0 64 28 68 a8 51 89 1c 98 25 6a 25 4d 61 2c 50 b8 1c b1 31 2d e2 29 4d 20 68 b9 0f 28 e2 65 21 2d e2 29 75 20 68 b9 28 e2 6d e1 21 68 b9 28 31 28 31 37 30 33 28 31 28 30 28 33 21 ea 85 49 28 3b 96 89 31 28 30 33 21 e2 7b 80 26 96 96 96 34 24 58 a0 28 38 21 e4 2f 71 39 96 1f 79 96 1f 61 28 38 28 38 20 d1 68 69 69 69 69 69 69 69 21 58 bb 21 e2 67 28 d3 a1 51 cd 29 96 bc 21 ec a9 1d 65 21 d1 69 69 69 69 69 69 69 69 82 63 21 d1 68 69 69 69 69 69 69 69 21 ea ad 39 21 e0 95 aa 69 69 69 69 96 96 96 96 96 69 69 69 68 69 69 69 59 1c 69 69 68 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 79 69 69 49 68 69 69 7b 59 3e 59 ba 59 f3 5b 49 5a 4d 5a 41 5a 45 5a 59 5a 5d 5a 51 5a 55 5a 29 5a 2d 5a 21 5a 25 5a 39 5a 3d 5a 31 5a 35 5a 09 5a 0d 5a 01 5a 05 5a 19 5a 1d 5a 11 5a 15 5a e9 5a ed 5a e1 5a e5 5a f9 5a fd 5a f1 5a f5 5a c9 5a cd 5a c1 5a c5 5a d9 5a dd 5a d1 5a d5 5a a9 5a ad 5a a1 5a a5 5a b9 5a bd 5a b1 5a b5 5a 89 5a 8d 5a 81 5a 85 5a 99 5a 9d 5a 91 5a 95 5a 69 5d 6d 5d 61 5d 65 5d 79 5d 7d 5d 71 5d 75 5d 49 5d 4d 5d 41 5d 45 5d 59 5d 5d 5d 51 5d 55 5d 29 5d 2d 5d 21 5d 25 5d 39 5d 3d 5d 31 5d 35 5d 09 5d 15 5d a0 5d b9 5d 8f 5d 65 5c 43 5c 3d 5c ee 5c ff 5c ca 5c 3c 5f 0b 5f ca 5f c2 5f a5 5f bb 5f 53 5e 39 5e 0b 5e 16 5e e2 5e ca 5e c1 5e 74 51 39 51 35 51 13 51 ec 51 73 50 48 50 25 50 ae 50 69 53 63 53 4b 53 40 53 54 53 26 53 3c 53 20 52 09 52 13 55 f4 55 cd 55 f6 54 bd 57 16 56 ed 56 e3 56 f1 56 c1 56 d4 56 aa 56 a7 56 69 69 69 49 69 69 c9 69 69 69 63 59 5d 59 53 59 2b 59 1c 59 e4 59 c8 59 ab 59 62 58 4f 58 42 58 2a 58 27 58 1b 58 13 58 d0 58 b7 58 5b 5b 51 5b 07 5b 1c 5b 13 5b e2 5b c0 5b d7 5b a3 5b 8a 5b 80 5b 62 5a 41 5a 34 5a af 5a 7f 5d 52 5d e3 5d f9 5d a6 5d 92 5d 6f 5c 58 5c 21 5c fb 5c ab 5c 8d 5c 47 5f 50 5f 27 5f 31 5f 01 5f 10 5f ea 5f fd 5f f6 5f a4 5f b0 5f 80 5f 4c 5e 3f 5e ea 5e 8b 5e 77 51 25 51 16 51 9c 51 3b 50 97 53 4c 52 1a 55 c4 55 f6 54 b0 54 da 57 84 57 c6 56 80 56 69 69 69 59 69 69 e1 69 69 69 ee 59 a8 59 3a 58 e4 58 7a 5b 24 5b ab 5b 95 5b 09 5a f3 5a 9c 5a 4a 5d 33 5d d5 5d bd 5d 63 5c 22 5c 14 5c df 5c f1 5f 5f 5e 01 5e 17 5e e1 5e f7 5e cc 5e d5 5e ba 5e 60 51 3a 51 34 51 05 51 eb 51 bc 51 6e 50 7c 50 34 50 06 50 17 50 f7 50 c3 50 b3 50 8d 50 67 53 3a 53 95 53 3c 52 01 52 1a 52 16 52 c2 52 dd 52 a8 52 b1 52 85 52 f8 55 8d 55 49 54 43 54 50 54 0d 57 07 57 db 57 69 69 69 29 69 69 9d 69 69 69 27 59 03 59 87 59 7c 58 21 58 3b 58 0a 58 05 58 fa 58 d1 58 ab 58 85 58 49 5b 0a 5b 18 5b fa 5b 43 5a 10 5a e7 5a 97 5a 7d 5d 49 5d 2e 5d ab 5d a7 5d b3 5d 8c 5d 90 5d e3 5c f0 5c a0 5c bf 5c 8b 5c 9a 5c 68 5f 6e 5f 4b 5f 58 5f 35 5f 07 5f ea 5f f3 5f c4 5f d6 5f bb 5f 9d 5f 71 5e 40 5e 5e 5e 3d 5e 33 5e 0d 5e 03 5e 1a 5e 16 5e ef 5e e6 5e f3 5e c9 5e cf 5e c6 5e a4 5e 89 5e 98 5e 69 51 5a 51 27 51 0d 51 07 51 ec 51 c6 51 bd 51 9d 51 72 50 4c 50 2c 50 32 50 01 50 1e 50 e7 50 9d 50 7e 53 48 53 59 53 30 53 17 53 ec 53 e5 53 d9 53 dc 53 d6 53 a2 53 2a 52 0d 52 16 52 c7 52 dd 52 b4 52 8e 52 91 52 94 52 60 55 7a 55 4a 55 5c 55 e1 55 e4 55 fa 55 f3 55 a4 55 88 55 96 55 6f 54 41 54 11 56 88 56 93 56 69 69 69 39 69 69 a5 69 69 69 69 59 64 59 48 59 d8 59 aa 59 b9 59 8e 59 67 58 71 58 31 58 ee 58 c4 58 b5 58 76 5b 4c 5b 34 5b ee 5b e8 5a e2 5a 97 5a 61 5d 45 5d fe 5d c5 5d da 5d aa 5d b7 5d 82 5d 5e 5c 24 5c f1 5c 85 5c 6b 5f 78 5f 3e 5f f1 5f f4 5f ca 5f c3 5f d4 5f ab 5f a1 5f a6 5f 56 5e 39 5e 3c 5e 03 5e 13 5e ed 5e c1 5e dc 5e bd 5e 9a 5e 6d 51 63 51 7e 51 4a 51 43 51 56 51 1e 51 e3 51 df 51 a4 51 bf 51 8b 51 95 51 4c 50 28 50 36 50 a1 50 bd 50 6f 53 5d 53 57 53 20 53 fb 53 f7 53 ba 53 b4 53 68 52 59 52 1d 52 d4 52 92 52 4a 54 46 54 e4 54 f6 54 87 54 77 57 56 57 38 57 30 57 fe 57 b8 57 8b 57 93 57 70 56 69 09 69 69 bd 69 69 69 7d 59 77 59 36 59 19 59 e1 59 fb 58 9b 58 96 58 71 5b 45 5b 5a 5b 0e 5b fe 5b f7 5b d9 5b df 5b 4e 5a 59 5a 52 5a 2b 5a fd 5a c8 5a dc 5a a8 5a b1 5a 61 5d 7d 5d 47 5d 51 5d 25 5d 3c 5d 36 5d 1d 5d ee 5d bf 5d 9b 5d 6c 5c 65 5c 2f 5c 3a 5c 37 5c e0 5c c9 5c c4 5c 6f 5f 72 5f 5b 5f 3b 5f f7 5f d5 5f af 5f 68 5e 60 5e 2c 5e 39 5e 3f 5e e5 5e 8f 5e 6a 51 7a 51 38 51 08 51 80 51 9e 51 35 50 fe 50 f7 50 d7 50 5a 53 51 53 57 53 23 53 0b 53 a0 53 54 52 21 52 12 52 e4 52 c3 52 b1 52 5c 55 1a 55 c2 55 83 55 64 54 42 54 29 54 07 54 13 54 eb 54 fd 54 d3 54 97 54 77 57 5b 57 22 57 67 56 73 56 1c 56 fe 56 89 56 69 69 69 19 69 69 a9 69 69 69 7f 59 48 59 46 59 5d 59 53 59 25 59 3f 59 0c 59 14 59 68 58 3c 58 a8 58 46 5b f0 5b 8f 5b 87 5b 63 5a 26 5a ee 5a f0 5a cb 5a c6 5a a9 5a ae 5a bb 5a 81 5a 4b 5d 41 5d 47 5d 5d 5d 53 5d 24 5d eb 5d f9 5d f1 5d a1 5d 72 5c 25 5c bb 5c 95 5c 79 5f 49 5f 4f 5f 51 5f 39 5f 0f 5f f3 5f a3 5f b2 5f 93 5f 96 5f 51 5e 32 5e 07 5e fc 5e f4 5e cc 5e c2 5e db 5e d0 5e a0 5e 67 51 77 51 53 51 26 51 09 51 e1 51 f8 51 5d 53 3a 53 1a 53 e4 53 d7 53 8e 53 5e 52 39 52 37 52 bd 52 a5 55 80 55 74 54 18 54 db 54 ad 54 8f 54 74 57 2f 57 3f 57 01 57 97 57 43 56 b6 56 69 e9 69 69 cd 69 69 69 78 59 2f 59 3d 59 f8 59 d7 59 be 59 8a 59 90 59 7c 58 40 58 22 58 0e 58 ee 58 4d 5b 0d 5b ef 5b c8 5b d6 5b 84 5b 37 5a ef 5c c8 5c 9b 5c 81 5f 6f 5e 5f 5e bc 5e 76 51 4a 51 4e 51 42 51 46 51 5a 51 5e 51 52 51 56 51 2a 51 2e 51 22 51 26 51 3a 51 3e 51 32 51 0f 51 8e 50 98 50 92 50 bf 53 8c 53 86 53 6b 52 70 52 53 52 38 52 15 52 83 52 96 52 79 55 77 55 30 55 0d 55 1e 55 f6 55 bf 55 9d 55 41 54 a9 54 95 54 78 57 59 57 2b 57 32 57 fb 57 f6 57 a9 57 a4 57 7c 56 69 69 69 f9 69 69 0d 69 69 69 81 5e 3b 51 f4 51 af 51 89 51 6d 50 62 50 4b 50 25 50 32 50 07 50 fb 50 d3 50 ae 53 26 52 35 52 db 52 7b 55 3f 55 08 55 d2 55 8f 55 97 55 66 54 71 54 74 54 59 54 53 54 05 54 e8 54 ef 54 ac 54 78 57 25 57 33 57 03 57 14 57 c1 57 9d 57 64 56 5e 56 3d 56 c6 56 d6 56 be 56 69 69 69 c9 69 69 79 68 69 69 7a 59 4d 59 55 59 2e 59 24 59 3a 59 06 59 1c 59 13 59 e9 59 f8 59 cb 59 c0 59 d0 59 aa 59 a0 59 b3 59 82 59 98 59 92 59 65 58 74 58 39 58 19 58 1f 58 fe 58 c9 58 cf 58 d0 58 a2 58 b2 58 83 58 99 58 97 58 6d 5b 63 5b 78 5b 4e 5b 5f 5b 21 5b eb 5b e5 5b fb 5b ce 5b ac 5b b1 5b b7 5b 8d 5b 83 5b 99 5b 42 5a 5a 5a 51 5a 21 5a 0d 5a 1f 5a ea 5a fa 5a cc 5a a2 5a 81 5a 99 5a 9e 5a 69 5d 6e 5d 79 5d 7f 5d 48 5d 4e 5d 5b 5d 51 5d 56 5d 38 5d ad 5d 95 5d 7f 5c 2a 5c 30 5c 09 5c 1a 5c 13 5c da 5c d3 5c 91 5c 7b 5f 2d 5f 39 5f 00 5f 1a 5f f8 5f f4 5f d9 5f ae 5f b8 5f b4 5f 80 5f 9f 5f 7d 5e 0d 5e 1c 5e 16 5e f8 5e fe 5e c8 5e d8 5e 3e 51 13 51 db 51 ae 51 be 51 48 50 fe 50 b2 50 4e 53 5f 53 1f 53 e9 53 f9 53 c9 53 dd 53 e5 52 f0 52 a4 52 b4 52 43 55 9d 55 67 54 41 54 51 54 0e 54 15 54 e6 54 69 a9 69 69 e1 69 69 69 8f 5e 9c 5e 21 51 04 51 ec 51 d4 51 af 51 a2 51 8c 51 84 51 97 51 65 50 7d 50 75 50 4d 50 58 50 28 50 25 50 45 52 29 52 db 52 d4 52 ba 52 25 55 33 55 0f 55 04 55 e8 55 ff 55 c7 55 d2 55 b2 55 7a 54 75 54 48 54 55 54 2d 54 26 54 32 54 05 54 12 54 fb 54 a1 54 ba 54 80 54 5d 57 3c 57 08 57 f4 57 c2 57 a2 57 b8 57 b7 57 99 57 73 56 28 56 3c 56 01 56 1c 56 fd 56 f5 56 ca 56 8f 56 69 69 69 b9 69 69 e1 69 69 69 69 59 73 59 58 59 c9 59 c2 59 a8 59 b5 59 8d 59 82 59 47 58 2d 58 26 58 0c 58 e9 58 fd 58 4a 5f 2c 5f 04 5f f8 5f fa 5e a3 53 a7 53 bb 53 bf 53 b3 53 b7 53 8b 53 8f 53 83 53 87 53 9b 53 9f 53 93 53 97 53 6b 52 8b 52 93 52 37 55 9e 55 76 54 4c 54 3e 54 02 54 ef 54 e6 54 f5 54 cf 54 d5 54 a6 54 09 57 0f 57 ea 57 c0 57 d4 57 be 57 9b 57 97 57 4a 56 57 56 2e 56 3d 56 37 56 b8 56 83 56 69 89 69 69 f1 69 69 69 7c 59 5d 59 39 59 06 59 e2 59 ce 59 d7 59 b8 59 82 59 9e 59 73 58 41 58 d3 58 95 58 71 5b 59 5b 09 5b 15 5b fd 5b c1 5b ad 5b 79 5a 43 5a 2f 5a 0a 5a 14 5a ff 5a c6 5a ae 5a b5 5a 99 5a ed 5d ca 5d 82 5d 9c 5d 62 5c 72 5c 40 5c 74 5f 42 5f 51 5f 21 5f 3e 5f 03 5f 1d 5f ea 5f 5a 50 4f 53 43 53 47 53 5b 53 5f 53 53 53 57 53 2b 53 2f 53 23 53 27 53 3b 53 3f 53 33 53 37 53 2f 52 34 52 02 52 eb 52 e7 55 cc 55 da 55 a3 55 fa 54 69 69 69 99 69 69 25 69 69 69 25 59 39 59 3d 59 31 59 35 59 09 59 0d 59 01 59 05 59 19 59 1d 59 11 59 15 59 e9 59 fb 59 ad 59 a1 59 a5 59 b9 59 bd 59 b1 59 b5 59 89 59 8d 59 81 59 9a 59 e5 5c dc 5c a0 5c 6e 53 4f 53 ef 53 90 56 69 69 69 69 68 69 65 69 69 69 04 59 87 59 69 79 68 69 65 69 69 69 6b 59 4d 59 69 49 68 69 7d 69 69 69 64 59 34 59 3b 5d e4 5d cc 5d ab 5d 69 29 68 69 f1 69 69 69 0b 5b 01 5b 07 5b 1d 5b 13 5b 25 5d 1d 5c 26 5e 86 51 9f 51 6f 50 78 50 51 50 56 50 26 50 33 50 eb 50 e0 50 f0 50 cd 50 a5 50 ba 50 8a 50 87 50 aa 53 a3 53 bc 53 8c 53 ee 55 e7 55 f7 55 c0 55 a2 55 bb 55 8b 55 84 55 66 54 7f 54 4f 54 58 54 3a 54 33 54 03 54 1c 54 d9 54 de 54 ae 54 bb 54 9a 54 93 54 63 57 7c 57 5e 57 57 57 27 57 30 57 12 57 eb 57 fb 57 f4 57 ad 57 a2 57 b2 57 8f 57 2e 56 27 56 37 56 00 56 a5 56 ba 56 8a 56 87 56 69 39 68 69 c9 69 69 69 38 59 31 59 01 59 1a 59 35 5b 0a 5b 1a 5b 17 5b c9 5b ce 5b de 5b ab 5b 8d 5b 82 5b 92 5b 6f 5a 41 5a 46 5a 56 5a 23 5a ec 5a e5 5a f5 5a ce 5a a1 5a a6 5a b6 5a 83 5a 65 5d 7a 5d 4a 5d 47 5d 39 5d 3e 5d 0e 5d 1b 5d f9 5d cf 5d d4 5d b9 5d 59 5c 2f 5c 34 5c 19 5c bb 5c 81 5c 96 5c 7b 5f 1d 5f e3 5f c8 5f dd 5f 2a 5e f5 5e c2 5e 8b 5e 71 51 55 51 03 50 f1 50 cd 50 d9 50 36 53 06 53 e8 53 b9 53 bf 53 8e 53 94 53 66 52 36 52 0c 52 ec 52 d5 52 a4 52 94 54 69 09 68 69 01 69 69 69 6e 59 d6 59 95 59 6c 58 5b 58 24 58 3a 58 35 58 0a 58 ec 58 8d 58 85 58 96 58 63 5b 66 5b 76 5b 40 5b 59 5b 52 5b 2d 5b 33 5b 0c 5b 16 5b e2 5b fa 5b ca 5b d1 5b 91 5b 6c 5a 46 5a 5d 5a 56 5a 2d 5a 0b 5a 6d 5d 78 5d b7 5d 08 5c 72 5e 7d 51 f4 51 95 51 b5 50 09 53 b5 52 59 57 04 56 69 69 69 19 68 69 95 69 69 69 d0 59 aa 59 82 59 9c 59 72 58 4c 58 13 58 c6 58 a1 58 a6 58 be 58 b5 58 89 58 8d 58 64 5b 5a 5b 38 5b 31 5b 35 5b 09 5b 0d 5b 01 5b 05 5b 19 5b 1d 5b d7 5b ad 5b a1 5b a5 5b b9 5b 5f 5a 28 5a 35 5a 0a 5a 01 5a 05 5a 19 5a f8 5a d2 5a 84 5a 9d 5a 91 5a 95 5a 69 5d 6d 5d 61 5d 65 5d 79 5d 33 5d 09 5d 0d 5d 01 5d 05 5d 17 5c ea 5c e4 5c a8 5c b0 5c 88 5c 8e 5c 44 5f 5a 5f 27 5f 17 5f f3 5f db 5f 6c 5e 5b 5e cb 5e df 5e d6 5e 8e 5e 6a 51 60 51 23 51 16 51 f1 51 f6 51 ce 51 c5 51 d9 51 dd 51 b4 51 6a 50 48 50 41 50 45 50 59 50 5d 50 51 50 55 50 29 50 2d 50 e7 50 fd 50 f1 50 f5 50 c9 50 6f 53 78 53 45 53 5a 53 51 53 55 53 29 53 08 53 e2 53 d4 53 ad 53 a1 53 a5 53 b9 53 bd 53 b1 53 b5 53 89 53 43 52 59 52 5d 52 51 52 55 52 69 69 69 e9 68 69 65 69 69 69 26 59 69 69 69 f9 68 69 4d 68 69 69 ec 58 e0 58 e4 58 f8 58 fc 58 f0 58 f4 58 c8 58 cc 58 c0 58 c4 58 d8 58 dc 58 d0 58 d4 58 a8 58 ac 58 a0 58 a4 58 b8 58 bc 58 b0 58 b4 58 88 58 8c 58 80 58 84 58 98 58 9c 58 90 58 94 58 68 5b 37 5a 05 5a e9 5d 8f 5d 85 5d 9b 5d 91 5d 97 5d 6d 5c 62 5c 7b 5c 70 5c 49 5c 4e 5c 47 5c 5c 5c 54 5c 2c 5c 24 5c 30 5c 0b 5c 0e 5c 04 5c 1e 5c e9 5c e2 5c fe 5c f5 5c c5 5c d8 5c de 5c d4 5c ba 5c b3 5c 84 5c 60 5f 45 5f 56 5f eb 5f ee 5f fc 5f f4 5f c0 5f d9 5f d0 5f a5 5f bf 5f 8b 5f 82 5f 9a 5f 94 5f 6a 5e 60 5e 7f 5e 74 5e 4e 5e 38 5e 36 5e 0c 5e e1 5e e6 5e c1 5e d5 5e ab 5e a2 5e b7 5e 6b 51 fe 51 de 51 ac 51 a3 51 64 52 72 52 48 52 52 52 29 52 26 52 31 52 0c 52 19 52 eb 52 fc 52 c9 52 cf 52 c5 52 d8 52 d3 52 be 52 b4 52 81 52 84 52 9c 52 92 52 6c 55 65 55 49 55 4e 55 44 55 52 55 2b 55 2e 55 39 55 34 55 0a 55 14 55 e7 55 fd 55 cc 55 63 54 69 69 69 c9 68 69 19 69 69 69 cf 59 db 59 8c 59 62 58 2c 58 e3 58 34 5a 01 5a 19 5a ec 5a cb 5a 9b 5a a5 5d bd 5d 85 5d 6d 5c 32 5c ea 5c d3 5c bb 5c b4 5c 68 5f 63 5f 78 5f 73 5f 33 5f 36 5f ee 5f c5 5f b8 5f 8d 5f 95 5f 67 5e 5b 5e 30 5e 0f 5e e2 51 fb 51 7c 50 74 50 5b 50 54 50 4d 53 af 53 8d 53 63 52 03 52 14 52 f1 52 8a 57 ba 56 69 69 69 d9 68 69 6d 68 69 69 34 58 e5 58 d8 58 fd 5a f9 5c fd 5c f1 5c f5 5c c9 5c cd 5c c1 5c c5 5c d0 5c a2 5c f4 5f ce 5f dd 5f a6 5f bf 5f 87 5f 7c 5e 72 5e 4f 5e 5b 5e 2e 5e 27 5e 0b 5e 00 5e f9 5e ff 5e c8 5e c4 5e ab 5e a0 5e b4 5e 8d 5e 95 5e 61 51 67 51 73 51 40 51 46 51 51 51 2d 51 3b 51 31 51 0d 51 03 51 1e 51 e8 51 e1 51 c9 51 c6 51 df 51 aa 51 8f 51 92 51 48 50 08 50 0e 50 f8 50 fe 50 da 50 a2 50 98 50 02 53 e7 53 f1 53 b9 53 b1 53 4d 52 5d 52 53 52 2f 52 25 52 35 52 0b 52 1e 52 ec 52 f9 52 fe 52 db 52 de 52 d6 52 ac 52 a5 52 bb 52 b0 52 b6 52 8e 52 87 52 9a 52 92 52 6d 55 79 55 7c 55 73 55 49 55 4d 55 43 55 46 55 5c 55 53 55 20 55 36 55 03 55 06 55 13 55 16 55 e3 55 e6 55 f5 55 c3 55 d9 55 d4 55 b4 55 8a 55 96 55 4d 54 af 54 8d 54 63 57 1a 57 ee 57 c4 57 69 69 69 a9 68 69 35 69 69 69 95 58 84 5b 1d 5d cd 5d a0 5d c0 5f a1 51 a5 51 b9 51 bd 51 b1 51 b5 51 89 51 8d 51 43 52 58 52 24 52 31 52 bb 52 82 52 7d 55 70 55 59 55 ed 55 e0 55 c3 55 c6 55 bd 55 e1 54 e4 54 f6 54 d4 54 b8 54 be 54 29 57 1e 57 eb 57 ca 57 75 56 4b 56 52 56 28 56 69 b9 68 69 cd 69 69 69 78 59 7f 59 72 59 49 59 59 59 36 59 04 59 dd 59 d0 59 97 59 6a 58 63 58 66 58 7f 58 72 58 e3 58 fa 58 f0 58 4a 5b 5b 5b 28 5b 23 5b 36 5b e6 5b c1 5b c7 5b a1 5b be 5b 8d 5b 99 5b 69 5a 6e 5a 7f 5a 4b 5a 46 5a 3a 5a 0c 5a 1a 5a e1 5a fb 5a d1 5a 82 5a 93 5a 6a 5d 4e 5d 3f 5d 0c 5d 59 5f 34 5f 14 5f f4 5f 6c 5e 41 5e 23 5e 3c 5e e2 5e f2 5e a1 5e b9 5e 86 5e 96 5e 78 51 7f 51 1c 51 e8 51 e4 50 aa 50 41 53 b5 53 95 53 85 52 7c 55 07 55 95 54 b5 57 cc 56 bf 56 85 56 69 89 68 69 15 69 69 69 44 59 25 59 80 59 74 58 25 58 ce 5b a3 5b bc 5b 91 5b 2e 5a f7 5a b2 5a 8c 5a 94 5a 4f 5d 33 5d e0 5d 08 5c fe 5c 49 5e b1 5e 8b 5e ff 51 cc 51 75 50 40 50 68 53 62 53 c0 53 8f 53 73 52 20 52 8a 52 9e 52 71 55 77 55 39 55 ce 55 c6 55 86 55 90 55 48 54 53 54 12 54 c2 54 d4 54 66 57 7c 57 50 57 3e 57 10 57 af 57 ba 57 85 57 63 56 21 56 1e 56 69 69 69 99 68 69 fd 69 69 69 b6 59 9c 59 90 58 6f 5b 4f 5b 29 5b 1d 5b ca 5b cb 5a 7e 5d 4a 5f b1 5f a1 5e b8 5e b4 5e 7d 51 74 51 40 51 0b 51 02 51 1e 51 dd 51 d4 51 a0 51 88 51 99 51 41 50 5b 50 eb 50 e4 50 fe 50 c1 50 da 50 0f 52 1e 52 16 52 ec 52 e3 52 f9 52 95 52 6b 55 71 55 4a 55 53 55 2f 55 3a 55 33 55 f8 55 89 55 9a 55 4c 54 57 54 3b 54 1c 54 eb 54 e7 54 ff 54 f7 54 c3 54 a7 54 bf 54 ee 57 8a 57 91 57 57 56 2d 56 39 56 cc 56 bd 56 9c 56 69 69 6b 69 a5 69 69 69 5f 59 09 59 c0 59 b5 59 92 59 46 58 15 58 f7 58 a8 58 9f 58 7f 5b 53 5b 34 5b 0d 5b 19 5b fd 5b f6 5b 8d 5b 77 5a 3b 5a 09 5a ed 5a e3 5a f8 5a f1 5a f7 5a e2 5d ce 5d dc 5d d2 5d a2 5d b9 5d 81 5d 87 5d 94 5d 6a 5c 7b 5c 71 5c 4f 5c 46 5c 57 5c 2a 5c 24 5c 32 5c f2 5c d1 5c bc 5c cc 5e c5 5e db 5e b4 5e 2d 51 18 51 8c 51 4b 50 50 50 c5 53 d4 53 9e 53 6d 52 67 52 75 52 4c 52 46 52 0a 52 07 52 11 52 f8 52 f2 52 c7 52 bb 52 60 55 57 55 38 55 a8 55 b7 55 4f 54 fb 54 d8 54 4f 57 5b 57 2c 57 3e 57 1b 57 13 57 eb 57 f0 57 db 57 a7 57 be 57 b4 57 8f 57 82 57 93 57 48 56 23 56 32 56 17 56 69 79 6b 69 05 69 69 69 2a 59 04 59 d1 59 6d 58 3a 58 f2 58 68 5b 71 5b 40 5b 0c 5b e5 5b fe 5b ab 5a 89 5a b9 5c 61 5f 22 5f 38 5f ec 5f f9 5f da 5f 1e 5e ed 5e da 5e bd 5e 89 5e 6e 51 7d 51 70 51 4e 51 89 50 09 53 a2 53 b7 53 93 53 65 52 76 52 58 52 18 52 f8 52 1a 57 fc 57 a4 57 9f 57 7a 56 77 56 5c 56 33 56 18 56 69 69 69 49 6b 69 cd 69 69 69 4f 59 59 5d fc 5d c8 5d 70 5c 5a 5c 55 5c 0d 5c 1b 5c 13 5c ee 5c cc 5c c6 5c d1 5c aa 5c b1 5c b6 5c 8c 5c 92 5c 7f 5f d2 5f 40 5e 08 5e 1d 5e ec 5e c3 5e 8c 5e 9c 5e 79 51 59 51 ef 51 fe 51 bb 51 87 51 20 50 3d 50 eb 50 f9 50 f0 50 b0 50 82 50 24 53 33 53 eb 53 dd 53 d5 53 93 53 5a 52 36 52 ee 52 d7 52 a1 52 7d 55 2e 55 16 55 83 55 99 55 28 54 2e 54 02 54 e7 54 ab 54 a1 54 bd 54 72 57 77 56 40 56 53 56 29 56 2f 56 33 56 01 56 04 56 ee 56 f0 56 d2 56 8a 56 69 69 69 59 6b 69 ed 69 69 69 24 59 e8 59 f3 59 ca 59 b7 59 91 59 34 58 0c 58 18 58 12 58 e8 58 ee 58 e4 58 bd 58 e7 5b fc 5b 6a 5a 63 5a 57 5a 39 5a 34 5a 00 5a 1a 5a 12 5a ef 5a df 5a 8f 5a 14 5d" + } +]SELECT relpath(path=ConfigSource.FullPath, base=srcDir, sep="/") as TestPath,ConfigSource.Detection, Offset, Xor, DecodedConfig,DecodedData FROM Artifact.Windows.Carving.CobaltStrike(TargetFileGlob=srcDir + "/artifacts/testdata/files/CSDump.bin",DetectionYara='')[ + { + "TestPath": "artifacts/testdata/files/CSDump.bin", + "ConfigSource.Detection": "N/A", "Offset": 0, "Xor": "0x2e", "DecodedConfig": { @@ -61,6 +124,7 @@ SELECT relpath(path=ConfigSource, base=srcDir, sep="/") as TestPath, Offset, Xor }, { "TestPath": "artifacts/testdata/files/CSDump.bin", + "ConfigSource.Detection": "N/A", "Offset": 11001, "Xor": "0x69", "DecodedConfig": {