tag:blogger.com,1999:blog-17469466143903711712024-02-19T08:23:30.621-08:00Computer Forensics, Malware Analysis & Digital InvestigationsLance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.comBlogger206125tag:blogger.com,1999:blog-1746946614390371171.post-22116366753416345482017-08-15T03:37:00.001-07:002017-08-15T03:38:59.021-07:00EnCase v8 EnScript - Check hash values for tagged files to VirusTotal<div dir="ltr" style="text-align: left;" trbidi="on">
This is an update to the original (v6 & v7) EnScript to check the hash value(s) of tagged files to VirusTotal.<br />
<br />
Tag any file(s) you want to check with "Check VT":<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKZg0z4Nd5lnLwnVqbyMqmgtJQEXH3c2qkYb_jTnb2HOLleTjUDf_P2MAggh782vxN2B1JS9g94z3-ADfjO0Cmq6uX5y2NTQ_C7sLNvjLbC41wAS7cVZ2IGlIM7aOEP41gMEQfzLcmIFAf/s1600/snap00987.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="218" data-original-width="1045" height="82" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKZg0z4Nd5lnLwnVqbyMqmgtJQEXH3c2qkYb_jTnb2HOLleTjUDf_P2MAggh782vxN2B1JS9g94z3-ADfjO0Cmq6uX5y2NTQ_C7sLNvjLbC41wAS7cVZ2IGlIM7aOEP41gMEQfzLcmIFAf/s400/snap00987.jpg" width="400" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<br />
Run the EnScript and provide either a public or private API key:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1EO393SEXvQPEhUumfgfaTwjFgRLULFS8aV4oYSUnCWdxqfv1Bp1VefZ4am9RWJ-pfvyFCLuz50A-_rhE8EVDhFCzbvQBJ7CIHVVVTftML0t0AjIgtq1u4WlKTVL_iBLO-3RLk-qr22Hd/s1600/snap00985.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="229" data-original-width="622" height="146" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1EO393SEXvQPEhUumfgfaTwjFgRLULFS8aV4oYSUnCWdxqfv1Bp1VefZ4am9RWJ-pfvyFCLuz50A-_rhE8EVDhFCzbvQBJ7CIHVVVTftML0t0AjIgtq1u4WlKTVL_iBLO-3RLk-qr22Hd/s400/snap00985.jpg" width="400" /></a></div>
<br />
The console will provide results and all files with a score greater than zero are bookmarked along with the detected malware names.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHg1eWCtHt16p8U19RStyZV0_Sz2WaLZ7IXCF0-vJABSKxKtxNzSS_wku22UzXGbO7m2rYaPxFony96IqaIhOET7P-wvBeLJmct1Xaog3aogbLPi6b20UxEkm3hV4-wirvugW5W_23mIpR/s1600/snap00984.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="168" data-original-width="571" height="117" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHg1eWCtHt16p8U19RStyZV0_Sz2WaLZ7IXCF0-vJABSKxKtxNzSS_wku22UzXGbO7m2rYaPxFony96IqaIhOET7P-wvBeLJmct1Xaog3aogbLPi6b20UxEkm3hV4-wirvugW5W_23mIpR/s400/snap00984.jpg" width="400" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvhz_neDCrGJWSpd1o60Joe7QbJyHaJ62wZR_XBLXc1GFfeqicUENRwlItbZ-7fAOJwtbYwb56k4YDlGOseZkb21oEGKWNYoP2G7bhdDcpr01t0wWPMdH3ovlKesipUvrP0U_ZBgESuwdb/s1600/snap00988.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="116" data-original-width="985" height="46" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvhz_neDCrGJWSpd1o60Joe7QbJyHaJ62wZR_XBLXc1GFfeqicUENRwlItbZ-7fAOJwtbYwb56k4YDlGOseZkb21oEGKWNYoP2G7bhdDcpr01t0wWPMdH3ovlKesipUvrP0U_ZBgESuwdb/s400/snap00988.jpg" width="400" /></a></div>
<br />
<br />
<a href="https://github.com/lancemueller/EnCase-EnScripts/blob/master/Check%20tagged%20files%20to%20VirusTotal_v8.EnScript" target="_blank">Download Here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-2441949237361552772017-08-14T07:52:00.001-07:002017-08-14T08:53:57.183-07:00EnCase v8 EnScript - Check executables to VirusTotal<div dir="ltr" style="text-align: left;" trbidi="on">
<div>
<br /></div>
<div>
I have updated the EnScript to send hash values for all executable/DLLs to VirusTotal for analysis. This version works in EnCase v8 and the source code is included for customization. </div>
<div>
<br /></div>
<div>
You must provide either a public or private VirusTotal API key:</div>
<div>
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7cAB5HrPX8BH3hmjT8pTfmSEMO3ijWAplttZVZz6NPzujva_qqd1EHhOQ-g7P9YYsyNegQFeCgH5gFTEa-g9a56iy4DrG-v7-MmOwbTMT8MoV8IY_RvPZiegpQWEjeFvyMzb39egmIek6/s1600/snap00978.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="229" data-original-width="622" height="146" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7cAB5HrPX8BH3hmjT8pTfmSEMO3ijWAplttZVZz6NPzujva_qqd1EHhOQ-g7P9YYsyNegQFeCgH5gFTEa-g9a56iy4DrG-v7-MmOwbTMT8MoV8IY_RvPZiegpQWEjeFvyMzb39egmIek6/s400/snap00978.jpg" width="400" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div>
This EnScript will ignore duplicate hash values and only send unique values to VirusTotal. All hash values with a score greater than zero are bookmarked with their detection name:</div>
<div>
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlbYYyvE_bQV2RPs5E6UCJndx8sQle0t9cfKhXizcvOWtEb0hSD7wk3T6VIRMfqkFrT73r_FVGTVTLPkRu4FsAP3df25Lw4tvxhUakowQnsZ47pbb14SJbflRxhxvEVMmN46BqypPyrd3u/s1600/snap00979.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="148" data-original-width="725" height="81" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlbYYyvE_bQV2RPs5E6UCJndx8sQle0t9cfKhXizcvOWtEb0hSD7wk3T6VIRMfqkFrT73r_FVGTVTLPkRu4FsAP3df25Lw4tvxhUakowQnsZ47pbb14SJbflRxhxvEVMmN46BqypPyrd3u/s400/snap00979.jpg" width="400" /></a></div>
<div>
<br /></div>
<div>
<a href="https://github.com/lancemueller/EnCase-EnScripts/blob/master/Check%20hash%20to%20VirusTotal_v8.EnScript" target="_blank">Download Here</a></div>
</div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-3096653892649857262017-02-28T16:32:00.002-08:002017-03-07T18:07:54.244-08:00EnScripts Currently Offline - being moved<div dir="ltr" style="text-align: left;" trbidi="on">
All the EnScripts are currently unavailable while I move them to a different storage location. May of the old links will be broken, please just email me and I will provide an updated link and/or email it directly to you.<br />
<br />
UPDATE:<br />
<br />
EnScripts:<br />
<a href="https://github.com/lancemueller/EnCase-EnScripts" target="_blank"> https://github.com/lancemueller/EnCase-EnScripts</a><br />
<br />
Practical Evidence files:<br />
<a href="https://www.dropbox.com/sh/q0w7fy25qyltalh/AAD_VbL27cpa2bKuCtKaCuhaa?dl=0">https://www.dropbox.com/sh/q0w7fy25qyltalh/AAD_VbL27cpa2bKuCtKaCuhaa?dl=0</a><br />
</div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com2tag:blogger.com,1999:blog-1746946614390371171.post-1825680362212486662016-02-04T23:43:00.002-08:002016-02-04T23:44:08.386-08:00EnCase v7 EnScript to parse WiFi/Network Profiles<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;">
</div>
<div style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;">
This is an updated EnCase v7 EnScript to parse the WiFi profiles that may exist on Windows 7/8/10 system in the following locations:</div>
<br />
<ul style="text-align: left;">
<li>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged</li>
</ul>
<br />
<ul style="text-align: left;">
<li>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles</li>
</ul>
Running the EnScript displays a simple message box:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
</div>
<img alt="" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAewAAADHCAIAAABUVPd2AAAgAElEQVR4nO2deVgT977/0z/vPfee5zn3nufc8yuKrVu1rtVaytFTtgriVpVqccFzuhhtpdq69FiwBy0q4kLESm0VXBAUZEskhFUW2fclrAlLIIEEQsImOxl+f0wymUkmySRsET+v5/20McnMfDPLi28+M/MNbRzHmTNnFi1fC4G8plm2ZuGyNQuXvbfg3fcWvLt6wdLV85eumr9k1fwlK9/G8s6KtxaveGvx8nmLllkuXGa58N25C96ds2DpnPlLLea/azH/XYv5yywWLLNYsHzOwuVzFq6Yu2jlvMWr3lqy+u2lq+e/+96Cd9FFrJn5Dwt5ZePu7o73Ng3939WrVxeveP/dlWvv3A8dGB03MSOzJP3TlZfaGaaUPlPTq50hE9Mz+zKIdA8i3YOKrgFF18BYV/+YvH9U/nJU/nIEjezliKxvuLNvuLN3SNozKO0Z7OgeaO8aaO/ql8j7JfIBsXxA3DUo7hqUdA9Juofbe4Y7ekekfaOyl2Py/rGuAUX3ANI9iPQMIdpLN3lDaG9Tk3cPiruf9n47bYfMNKtgdAzZ7+QwZh7sd3IYVSB37ocuXbFm0fK1J0+eVEv82rVr/2/u20HBTzr7kQYZUtmOVHaoU0Uhle1IZTvCxUeiTsXEUm5axOqUGZNS0rQhpW1ICVmKNdKKFLciRcQUElMgwkeRj0WoyFMlF58WRY4q2WiaFdnNiixVMlV5IVAnA0uTIqNJkY5LGppGRVqjIpWY51gaFM8bFClkScZST0iS7iTqCp88CdMZnjLxdaNxNcOxVYMsbj+zvDeqpCuiSPa0oCM8TxKWKwnLET/JbQvNEgZnCO6n1gcm1f0eXxXArrzJKmdEl16PLL0aWe4byfWJrPaJrrvyrP5aXNONBGFAijjwhfRRnjy8uDe6YoBVORRXM5LAG0vmK5RB155qlZKucHRbYJtGY5Oh2xHdpvitjG53bDfA7xvYDoPtQugehe5d2M6W20LYD7GdM1+o3mkLRAr8/qyxq2scCOjRoXHIkB5W6BFHejAadTjjPWCCRuQDyN6Nth1lZYJnTGEsU8RmitjMNjZTwmZK2DFSdkwnO0bOjulix3SzY7rZUb3sqD521Esd6dP6Z29cVHdcVHdcTFdcjDwupjMuRhoXI4mLkcQx2+KYojimKI4pZDMFscyO8rK9G227BpF6GdLZjwQ+fPx/FvNQj9PGx8eXrPrgXvCT1h5NZVd3INVSZWp0p7oDqcamakeq2pVOr9QS+iupb90G19R3G4m+NQ2OczdB3yL1EZJnkr4zBWQGp6zv51Ojb53u1mHwaXU3NYmHF3SEYRLPaQvNFAan4yXOvckq99OWOKv+GruJES+8lSy+m9ERnKsp8SS+IgkvceNV/tx4lRM8bpLK8Xspfu8twNm8UKTP40VkHidVuR6PT5vK5QPIHgdbSVGxIDpCEB3REh0hjI4QxYS3xYRLYsI7YsKlzPBOZngXM7xblV5j0s0M72aFd7PCu1jhnaxwKSu8gxkuYYa3McNFzHBhTERLTIQgJkIQEyEpLt7jYNs1qJSqqAcJfBC6aPna8fFx2tGjR1et/VDWTxA3audaNJ1Ine7Uqt6mdHoHzukaNjdS5WZh8DYjDK69sxYR9V1oqr5JDT5Z+n5Ne99GSvyJhsSf4yVe5hddei2y9Epk+WUSibfpkXgSX5FUr7lKp7pXrl/lpB43VuWFRJWTHhpGeHzmuuTyAWS33QZJXn59WGhTWKggLLQlLFT4NFT0NFT8NFQSESKJCJFGhHRGhMgjQroiQ7ojQ7ojH/XqSHfkox7iP7sjQ7oiQ+SRIZ2RIdLIEElkiCQyRBwRKooIFUaEtoSHCsJDm8JD68NDJfn5u+02YBLntiOd/cjSFWtcXFxoa9euvf8ovEFOcDcqaF4nwpMhfFXqicGe53UqU9eJ1OGcrm1zTOWvkMEpllBM7IDrqJ/o17eB+olufaeaq75n0uCUJf4kR/wYL/FEvMRLrkWWXIksuxzJvRRZdSm69gqr/hq7kRHfQkXiaCZR5anGqpxalzyHanXF9C65uZVW5AOIy0fWoqxsXnBQfXBQ/aOgxkdBgkdBLSFBopAgUUiQOCRIEhLUERLUGRLUGRIoDwnsVuXWvzxd9tDR3PqXJ+kz8pDAzpDAzpCgjpAgSWiQODRIFBokCg1qCQ0ShAQ1hgTVhwTVPwriPQoSZWe7fGSNlzhfhty5H7p27VraouVru4eU2q0lurtehtTLkQY50iBHGuVIYxfSpEqjXBn01Qac2ZVC11K5RoFlkvUtMVHfEze4AX23kpe/jep9Z01Y3zp73w069Z08ucUTM3S3SRIPwUucUxUQy73JxEu8ApW4L4t/VSXxOyqJR6kkHk8mcf0qJ7X5c6LNJ9or11J5lqm9cnyhXH+VXLtLPqUeLzPS4/IBZKf1OmF6es3dgNq7AbV3A/h3A+oDAxoDAwSBAS2BAaLAAFFggDjwliTwVkfgrc7AW52Bv6Bx2UPHLiBx2UO/efKMxjOdgb90Bt7qCLwlCbwlDrwlCgwQBQW0BAUIggIagwLqgwL4gQG1gQG1gQE1gQHCjPSd1uvwEq9sR7oGkUXL19IWLV87ODqO9r7V+iaKW9CFCLqRZlUEXZrBtN4g16lyrEuux+Nm0QGnXgQ3Rt8FZL3vPB29b1KDY8WTTG19Cyaz9j09+jYXgxsv8YfpgnvP6+/iJR5FLnG/+JZfktvuZHQ8zJWHFfdGVQwwK4fYNSPxvDF0DWhL3HSVm1Ar1zrnmYkrsOj3eI4ujwtJuuSUTniaZYlcPoBsX7uyMSmhzM+3nOFbwfCtYvhW37hce+My74ZPvb9Po7+PwN+nxd+nxd+n1d+nzd9H7H9R4n9R4n/R//gJDWvjH/sfPyH2v9jm79Oqmlzg79Po79Pg78O/4VN743L1jctVDF8uw7eC4Vvm59uUlLB97Uq8xLntyMDouFriqMHR3jeqb7y7W7qRlh5ESJaWbqQFZ3bU5niVo3VzEo9r1VXMwuA6iuBGX4KiQ9+k9RMSd+sof0+keGKcvideOTHz3vdkSPw3vMQjSq5ElF2OME7iiXxFot7VS73Gol/lEyyw4KsrugosBI+TqVx/dYXKhSvTXyKXDyBbVy+r58QVXfYuuexddtm74rI398r5yivna6+c5109X3/1fP2184Jr5wXXzguvnRddOy+6dr5NlRvffod3N2bwG99+16Z6s1A1ef218/VXz/Ounq+9er7y6nnu1fMVvt5lvt4lvt5Fvt718XFbVy/TLfGxcUIHHO19q/SNylqk+q9G8DZXq1yONOr2OL4+boYGN+ESFNPL3yadvTTY+zZbfZujwScm8VvaEo8wWuJoZljlpL3yCZzzNK1QTuXClen0uHwA2bxyCS+Wle/9U6H3T8XeP5V6/1R20bPiomfVRc/aS568S548H89GH89GH89mH88WH88WH08RLoyjx1z20LtVuOyhM44eQ19C39ysmpzn48m75Fl7ybP6omfFRc/yi56l3j8Ve/9U6P1TvvdP/FjW5pVL9Elc3QdXGrztwU4ajUaj0XYH8xBRr1LZrYSUnXuDRqPRvLKVNkc93qynP47Wx4kSNwt9UzS4ofqJLoNTrYBPWN/6a99Tft7yFep9T4LEa1GJ+zPLrkeVXMVLPKrWl8m/GkuUeJFK4tXkEp9ElaeYXCs3RuXGV8nJPW5CdWXaSivyAWT9n/8r/8a1aGebmM02rM02sZttOJs/Str60fOtf0/fuv7FtvU529cXbF9ftH19yfb15dvXVxDj4+LisocuUeGyh+7j4oK9Wr59fcn29UXb1xdsX5+zff2LbevTt65/vvXvSVs/it/8UexmG9Zmm5jNNtHONgU3rq3/83/plPjQ2DifWEVp7kZausu83qD9O5to8F51kn3eoO2MKyX2yrH+OMHjnQiPtDNuJgan1gGnrG+TTmCSXnyio3iSYVTt26C+X8Ou99RI3DeizEdD4pyWX5JwEi9XSbxuLJGnSOSRSNxkmxt7EQupyjN0FFjIC+UmqhyhqnIz6JLLBxDrP/1H3jXfCAfryI+toz+2Zn5szf74wwTHD5MdrVId16U7rcvatC5v07qCTeuKNq0r3bSuDBefnTtd9tCFRFz20H127kTfULppXdGmdQWb1uVtWpe1aV2607pUx3XJjlYJjh+yP/6Q+bF19EbryI3WER9b5133tf7Tf+iTOKEUjhZSepQSF+IM3oZLis8bNJ/S1l6kFVdXIZe4DHeSEyfxinaTeuLmZ3CDJzANXj5I8eIT44onUDmZTImLn+SIH2cblvjFiKqLGhJP73iYo5I4lyhxvR6fohqLUQUWw1ciGnkZonEnPGfa4/IBxPp//jPfzzfi4/VRjutjHNeznNaznf6WsOlvyZs+TN1kle5slbXZKm+zVeEWq6ItVqVbrMpU8dm1y2UPvVGFxmOfXbvKtliVbrEq2mJVuMUqb7NV1mardGer1E1WyZs+TNj0N7bT31hO62Mc10c5ro/8eH2+n6/1//wnBYl3aUrcKxsR9bQ92knbeslvG1pf2RlXhhpcye5HPKQ0crfqn7QtEW3Nqsq4ropKZQfCNU3ik11CmegVhER9F1C+/mRS9G1s7xv0TV3iMZjE85USf5zTFprd+ihT+CCtKSiFfyex9jan6lZshT+z7HpU8ZWIYrzELzP5V7QkHqlL4mR1lelUucECy0RUrn3tSoGxl5NTuXBlcksreIn/+b8Lf7keud0uZrsdc7sd+xM7zg67hB12KTvs0nbYvdhhl7XDLm+XXcEuuyIX21IX2zIXGzQue+g8FS576D67d2s8U+ZiU+piW+RiW7DLLm+XXdYOuxc77NJ22KXssEvYYcfZYcf+xI653S5mu13kdrvCW9et//zfVCXe3K0up2ASp9F2h/ARMT9uO412PhsR9yLPfd6g+ZS29SKtOX5voKXzHkTIi9tKo/2Upe/0ZpVpEp+CIviEbuEh3oGpvwNOcvkgWf2E6sUnU6/v18LdlCTeGZ7foaylZLeGZokevWhRSjyh5nZc1a1nFTc0euKRmMSbrnNabhIlHsMdiq0e4ZBKfAI2n1yVU798RX91Ree1KyJNlRu8w5NSlXwKSuTyAWT9X/5U9FsA03XbM9dtbNdtHNdtCa5bk123pu7bkr7fOfOAc84B57wDzkUHnYsOOpcedC5TxWffXuzWHp99e0mfKT2onDDvgHPOAefMA87p+51T921Jdt2a4LqV47qN7brtmes2puu2ot8C1v/lTxOS+NbItrZeRNzbFrqTti2yDS/xZJ83aJdKsbJ44qU3aJdKsYqKhsSrTZP4ZJdQJnoNOPUTmJSv/tav78ntfZvY9Z6VBtcv8cLO8Px2rBsekiUMzmi+n9oYlMy7k1BzO66SIPHIMp9ILibxq6jEk9t+T+94kCMPK+rDSzxBj8T1etyIjvnk9cqNKJTrvnbF2BOeJl5LPqkelw8gNn/9S8mj+5wjbpyv9sZ/tTeZvjfl8N60w3vTj7hmHXHNOeKa941r0dHPio5+Vua+u8x9N9d9d6WOcLX+iU6CTp73jWvOEdesI67pR1zTDu9NObw3mb43/qu9nK/2co64lTy6b/PXv1CTuBwRdCHNXVoSj2hr60XaettCdtK2RbZhNXFyiV8sJS2nqE9sGiXxSb0V0/BNmPqvAReRGzyPtIQyifWTmdX3rHS3lsdJJR6WJ1EZXPQos+VhuuB+akNgMu9OQjUqcX9mmV9UydXIEt/IclTil6JJJP5ES+LK6F63k1NjmdxeuUnVFVKP5+m6llx3l1z7WnLy2zsn7PEynMQ/eWd+UWRU2tnTKSe/Tjn5dfqpI+mnjmSdOpLzw+GCM4eLzhwuOXO4zONQmcehSs9DlWcPVZ89VKMj1Vr/rDx7qNLzEDp5yZnDRWcOF5w5nPPD4axTR9AFoQtNO3u6KDLqk3fmdw0gFRK9EideoIKd2FRKvJVM4q29SGu23xs05SnQlrq4rTTaT5maJza1LxWnJPHJLqGYoO8igx1wQ/rWc/kg6NtcopT4GCrxZyqJPy2UhuVJHue0hmaJHmW2BGc0P0xruoeOfoVKPLbCn1nuF116Lar0SlTF5ajKS1HVl6LrLrPqr7JVEs8wIHE0s0nl+q9dMXiHp+HSiiGVT1ZpRT6AeB/Yf+/SBe6TkNwr3lneP2adO5137nThz6eLvE+XXThdduEU98KpSp9T1T4nay+frL38fb0xqb38fe3lk9U+Jyt9TnEvnCq7cKrswuki79OFP5/OO3c669zpLO8fc694c5+E3Lt0wfvAflTimMd1XCeulDj+OnGVxHuQ1l5laUV5iaFPKXppSgnxxKbG1SmktRTuNBt8gh1wHZegUB8/1vDV3xQuPqGq76ksfM82fZNKvFJ5dcrTQmlYruRxdmtIlvDRi5bgDMGDtEZU4ncSan7jVAWwuTefVdxgll+PKb8azfWNrvKJrvGJ4fmyGoyVuGGVT1653GiVUzjnSX5FuTGj2uq5cMUUj09Gl7xehtQ1d2xbsfT22R+L2LGClERBQqwgIVaYECtKiBUlxYqTWZIUliSF1ZHCkqawOo2PNIXVkaKciTiZJUqKFSXEChNi0QUJUhKL2LG3z/64bcVSXktHg0x9g6Tmbffa99w3d6nv2MSuBG/VivZF4ho3+/DQbninkd3wSTW4CSUUg9eAT66+ScvfU9f7Bn3rlHjtCLt66FnlALO8T0vizZjEg5J5d5Nqf0+ouc2pusWuvPmMy2BVXmdWXYmpuRxT68Pk+z5ruMYW+MULlRLPpSrx6VC5yb1yYwrlE1M5+bXkM1JaqZEMt0j7b36+/9DapdsWW25bbLn9nbd2LHl759L5u5YtcFm24NPli3avWLxn5TufrXrHddUS11VL9qFZvWTfatWDVUv2rVqydxXhn+ibP1v1zp6V7+xesfjT5Ytcli3YtWzBzqXzdyx5e/s7b6GLO7R26c3P9ws7+2skwxqDTQ2M6Bg7pVGurIwLugh33pt2273a4BrdcD0Sn84SiqFzmNQ74EadvXwx6fqGy04m7PH4ujFO7Qi7eii2coBZ0Rdd2q2qiePKKelNSo+n8O8m1f2eWHs7vjYgruYmu4YRW3uNVefL5F1m1V+JbbwW12yyxCnZ3Dx65ZjKSYcp11con6wuucGznRMurdTLEPnARNM1sTTISUYMJEgcG8WQZAwslcrxNjc4ABZfow+uMji+G04i8ZkuoUxfB9yoawd1DBgL+p5kifPGOLUjbOW5zZfRZT2RRTLV1SmtoVmikMwWtD+uVHlqQ2BK/Z2k+t8S+QHxfP84vl8s/8qzet9nDVfZTUSJd5km8ZlSuZ5BbvVfiWieXXJz+KW38gn/UKVeiY+MK38LQqocQhavcrzNdYV0KFr1yUxtg5N2w821hELxDkydw1cZf/ZyEnvfUDmhnnjeGKd2NK5mmF09pDq3KX9aKA3Lbw/LFT/JaUMvFQ/JEoZkCtGO+f10QVCq4G5K029JjbcSGm9wGq/FNl6JbbzGFlzntPjFiyZF4oZVbrzNJ9grp3jOU6NLTv7zbwbu8DSj0oq5eZwgcfSnGzCV43vl9TKkASd07Wj/KARe3/hrCqkY3Kh1OhGDG9UBNzgGIXkHnEr9RO/FJ1T0DYXvyZO4glM3GlejLotHl3ZHFsmeFkjD8zvC89uV99/nih/ntKHXHQZnih5kCO+ltdx53vJrUrN/vOB6XBPaDb/OafFLQCUunRSJT4XKScvl5CqndvkKleoKxS55vgld8mm8+tAcPK6W+MDIeFW76gc2O9S/rqn+kbZOhN+p/j02zajeU6sqnmC9b3wHXGcVxVxLKPoGASe7gtCo+onB8vf063vGHTrz4Sni60Y5tSPKq8UrXsaU9UQVyyOKOiMKO58WSp8WdIQXdCiFnt/+JK89NEccnNX24EVrYJrodorwl8QWP47gGltwndPsFy+cColTsvn0q9xQoVxXdUX/NYj5U9Aln02lFYLEsV80Jti8g/iLyXqD73dj7tbW95Qa3NgOuJ67eCjeQ2+wA65dP9Gn76krnkDXm6rEx9QS575ErxaPLJZHFssii2SozSMKO58Wdj4t7AwvkD7O6wjJaX+YJb6X0fbbc9EvSUI/TrOyGx4vZCSIbiaLp0jihlWu2+aTVWAxrHKD1RWKvzJB7JIbvifo9SitECTOVV09TrB5u9LI1YaitLbGD2niiick+p5cg+vYVMaXUNSDWOnvgOs6galdP6Fe/ja59w1d70mXOLt68Bm3H62oRJV0RZXII4vlSpsXyyKLZRHFsqeFsrB8aWhuR3B2+/0X4t9TW28lCRnx0ypxSjafSLncmF65nkK5gTuDDN3hma85eNZklFbIVP5qeZwgcfQpLpZ2TafrCpeYCoPinlgR3MQSip6xZCl3wHMndgLT4MUnk188AX2bKHHVuc3KfmZFX3RpT1RJlyryqGLM5vKIIllYQefjPOmjnI77mZI7aW23kkWM+JbrMyFxk1VucoGF+uUrJpzwpFglN9Aln+axVkzy+ERUTiJxLJI+RPqSJJ3EoE92TFfaSdNHEgnF9CJidRRo2rTTo2jVEZFWhGi61WnRky5FS5ei2VAExkauM00Qg5GNNcpGGztHG6Qj9dJhfscQv32I3z6oHZ5ksE4yUNvWX93aXyV6WdHSV9bcW9LUU9zYU9zUU9zUW9LUW9r8skLYX9U2WCsZ5nWM8KWjDZ1jU/0R9OwAxu5LBndOdB/Ws5PjjwX06NA+anQdX209JMejWB3lwSvppXrIk+qCVCzTpjU0pL7ViKSPssQlfci9MJabuwcE8nrlqMeBox4Hvvlx/zdn9n99Zt/X/9p75Ie9h0+70k+70k9p5zP6qT2HTu7+8sSnX57Y9fn3O/753baDx7ccOL55/7HNB45vOXB8i9vxrQe//+TzE7u+PLX70A+uh/+198iZ/V//eOCohxuWGf/UkFck98JYGh7XKXHpS8TN3WMcAAAAMBvc3D2kL0HiAAAAryYgcQAAgFcYkDgAAMArDEgcAADgFQYkDgAA8AoDEgcAAHiFAYkDAAC8woDEAQAAXmEMSJyLGzgFJA4AAGBuoBLHu5pc4tATBwAAMEOwnjiZxEfH8QMQSvtB4gAAAOaFm7uHtF8tam47MjBKlDgWkDgAAIC5gUoc72qQOAAAwCuDAYnjf+cBJA4AAGBuoBLHu5oocez31TpA4gAAAGaHUuI4V6slPjg6XqX6geOqDqQTJA4AAGBmuLl7dPYjeFcP4iVejf5WvRSploLEAQAAzA5U4nhXEyReI0WwyEDiAAAAZoabu4esH8G7miDx2k4Ei2wAJA4AAGBeuLl7yAYQvKsJEq/rRLDIQeIAAABmhpu7h3wAwbtaLfGh0XG+DOHLEJ4M4clA4gAAAGYHKnG8q4fwEq+XIVi6QOIAAABmhpu7R9cAgnc1TuJj4w1yBAtIHAAAwNxAJY539dCYSuLDY+NNXYgycqR7ECQOAABgXri5e3QPIk1yBNP1MF7igi4ESw9IHAAAwMxwc/foGUTwriZIvLkbwdIzNK0Sb29vz83JCQ8LY/j5nfX0PH7s2PFjx856ejL8/MLDwnJzctrb26etMQAAAOaJm7tHzxCCdzVB4sJuBE3LNEq8rq7uaXj4OS+v4ODg9PR0Ho8nk8lGR0dHR0dlMhmPx0tPTw8ODj7n5fU0PLyurm4amgQAAGCeoBJvUblaiJf4yNh4aw8iUqV36iUulUqZTCaDwUhLS5NKpTwe/3laVnhM6u+P0q7fSbsckHDJP5IR8DjsKbOqukYqlaalpTEYDCaTKZVKp7RhAAAA5ombu0fvkFrUrT3ICF7ibb0Ilr4plnhtTU1AQEBiQoJMJsvNK0hIqwhktZ39veV7/2b364LDvo1f+dR/cbHmy/Nln/8778i/470u309MSpXJZIkJCQEBAbU1NRQXxKHTNLBm8MfHOXT0/3j4DGvtJ3XPjM6h8kZ976K8XGNQzw37jGQfFjAFvauUdKPjdhncBIQdyZrBJ91LOXSNGRFnoLEQwo5GuqNS3nupMJk7rWkHIwVMmYm5Hyxu7h59Qwje1QSJi3sRLC+nUuLl5eX+N25wudyGxsaktKI7z+SnbrV+fV1Mvyb54kq720XxrrOibT827/Js+uynhj2eNZ95lLqeyTn4r7hzl+/yeHwul+t/40Z5ebkxy9TYNqZtKmpT8RnW2DHCZzAmeLSYvlcZJXH8e6ZiPyadp/kcMBRbonuVkm50Dh2nbrxRdC1Ot6n5DGvivNTv4zOsrel0ax27t1rw07O2TVjKjO8GU73zTyZu7h4vhxC8q9USH1WMt/chWPqHp0ritTU1/jduNDc3FxQWxiTXnv297cjV1i+vdHzu037gYvt+b/Fn58X+Ub2hz/uPXGvbfIr3yRneth+qt50s/+RE7qcnEumn72S8yGpubva/cYN6f3xaJT7JuwFIfBqYsMRJZoD3usYT1CSOUzWfYU1nMKyVs9NyOINPeIp8a4LEqTRgxhtjADd3j/5hBO/qUQVO4tKXCJYpkrhUKg0ICOByuQWFhcHP6o4xBF/4CN0uSvZfEO/zluz9uW3XWWFC4TD65pcj44d8mhyPVzufqHL6rnzjtyVO7rnbv004+N2djBdZXC43ICCAcn2cTOIchjXhey72Hr7yBc1vndobmEOnWTMYdJrmfMi/H+LmyaHTrOl0axqNztE4zAitwn0FJn59xn1Hxh/oHLKDlmS/JH71xy+FrrlEzZVBaCSdo36dsBoNfwqtJ9UL0v6yb3ChpJPrdhlhk5GvZK21pH+Vam10LYfj5EtN4ur3ow+wza7RRbdm8DXETuyJKx/q0RN+byTb/fnY1mRorQH8uzXWJDZba2tr4pYnNETPwUhciToPUIMHLOlxir1Hs81ajdG9hPZvOWMAAB1dSURBVGkHlTje1QSJy/oRLAMjUyJxJpOZmJDQ0Nh4P6Lw2+tNBy807/25de954WfnhJ+dE+4623zAWziGqN//JElifajM6bsKB/cy+6+LbI/k2x9+4XyEfdDdv66Ol5iQwGQyqS1ZW+I09fbV6B8RC47EmWgc7hw64SHx2y/xINDedbSOM1yrSErbxKlVC7W2JhzoFCWutVp0dUYIOlArT6u9xNVI7VNoLki1ukhKmZQWqjW5LolrT6S//0VxlRI3OrFvjL1B9Sdcc0/SWiHKfyvfr1z1Wvunein45Rn6q6m5f5PujYQtjpMlcQ1oHiya21S9pXB/Wkn+VlI4GNVrQ6OF+g5YPRtdZ5t1Nka9TmYMN3ePgREE72q1xMcU412D6gyOTr7E6+rqGAyGTCYLDI4+9Ytg37mG3f8WfPpTs8tPzZ+eFbicFezwaPrkTD1fNIpN4nmzdMOhso3uZXZfl9gcLvz7V3l//zLnoy9SHb+MPP3TDZlMxmAwqF13SNYT1/V9k1h/1D0TXfNRwWco+zYknTK9DVA9q7nL4ueMHdUc9LF2L0+vcdRHtF6J47q3hK6KPt1T/hSaCyL4Rvd3ILLH5JMbbJ6hv3M615Ju6evb6Mb2xFWfRPV5tCsnGo81vzEQ2kDlbznZFifv4+s6WPRsKazfodEK/VtEa0LSFho4YPUep5T2LvK/utOPm7vH4CiCd/UYXuLdgwiWoSmQ+NPw8LS0tLT0jJ8CKvZ71e7yqN/1Y8POH+t3oDlT/8kZvtP3dV9d5BVXdQhEspvBhRs+z3D4psLuSInNocINX+Zbf5Fr/c+sD93SNxyMd/rHfTYnMS0t7Wl4OIWFGyPx8fFx1YajVE7RuXOoDiJTJI7vtZF2+qwZfHS35jOs6Rz1kUZB4ur2kGpFp1v1fmQTPoV5S1zfWtLXc1dNN+GauGrJHHwxnM4g73FrfkHU7p9Tlzhx3euXODYRTc86V8+G5PuJoS2iOSHJPqnRBu05T1ziM1xFwXBz9xgaRfCuJki8ZxDBMukSb29vP+flJZVKr/0S+sWFqp3/qt5+um7bD7xtp+vQbDlVu/lk7ZaTtTZHuB/+M9/6YNqafdm2RyocvimzPVzy0VeFG77Is/5HjtXBrA/2p3+wP/kjt0j6d75SqfSclxeF+zmNlvg4yRdiapufw8ArDNsLdM+K8KVPa08lP/b4DGt8IYVOx/o3FCSOPWGg8kBskr6Wm/YpNBeEq4eY8JdDe3Ji39RYietbS9qrVHujExpFXJOUJa5Uk4a1yWr+hM9rzLcNklWqvcV1l1Nwy0b3fp26JLmKhnTpWvNXTki6JgnoPmAnJnHdS5x+UInjXY2TODLeO4RgmXSJ5+bkBAcHV1fXnPRJ2fVD6eaTVc4nqp1P1DifqHE+Ub3p++pN31VtOl618Sh3y/GqbSeqt35fvf1Elf3h4tWfpa38NGXpjoR3tsct3sJevC32nW1x737CXvNplMPegIoK7qNHj3Jzcgwt3xiJq/s3JKVDDN27LEd/RVL/YUanW2tMqpxS+6s5ofek5zDQpQYaDXdQ4ZdCWCL+uyTlcgrFT6FjQRSPc+Jj0smxtU6n6z+eyZqnvZb0rFLSja7raeoS1/z7j/+7QL5dNbcRNgftvVfHcjW3uPpTkJzY1DpYcGtSs4GEP2rkSyddw1iJSkcL9R2wVCSuq82ke9fMl1OGRhG8q8eQ6ZJ4eFhYenr647CoAx6ZW04UOx2vcDxe4Xic6/gtmoqN7hUOR7kORysexTb093dLO8SZRW3LHbz/sCb4TbvwN23D3rQNt7ALf9MuzMI2bI5d+PyNoe9t+z3gtwcZGRnhYWGT2NSZQ09f6RVidnwKgIyJFRY4uk5AApTRJ/GhsfFGOdKIjSc+2aMYMvz8eDyez/U7O09kbnQvdjhaan+0zO5omf03WMr/9nnh6j2ppSUlZcUFGRkZrSLhWucLf3jv0Rz7qDl2EXPsIizsIi3sItDH8xzCljkHfvP9BR6Px/Dzm8SmzhyzQ3+z41MAJEyorEBWDgeMxc3do2tQaWnU2OrxxAdGxsvFSBkaCdLxcpIlftbTUyaTnTwbsPV4pt3XhTZHim0OK2N7pPSjr4pX7UmdYx/1lmNMQVFRdlZ6YmKisKV5jdOFP7wXMsc+ysI2EpcIC9sIS7vwpU73t+79USaTnfX0nMSmzhyzQ3+z41MAGBMvJWhU9gHTcXP36HipErUYKZcgAyM4iZeKESztky3x48eOjY6Ofn36ttM3GR8dyt3wVf6GLwv+/mXB378qXHcge4FzrIVdxJu2EQudWQUF+SmJ8SwWq1nQuMbpwh9Wh1rYRVvYROESaWETOdfu6eKND+0+8RwdHT1+7NgkNhUAAMA8cXP3aH+J4F2tlnj/tEicfjLg48Npf/si2/qfudaf5/7t87yVe1ItN0bPsY+0dIi2sItauCk2Ly8/LjYmKipS0NS4xunCH957bGEbY2ETTUzUXNuIxY7BtiBxAABeG7Ql3j9tEkfLKUdP+9l/lfjhP158cDDb6h85y3elWG6MtnSItnSInusQ/aZN9CLnuJzc/Jjo8IiICLQn/l+rn8yxZc2xYc2xYaKxsImxsIm2tItc6vhw854zs6icAgAAoI+ZlDh6YvMnb8ZH/4y1ckv9YH/Gsl1JlhujLTfGWDrEWDrEzLWPUUk8NyY6PDo6urm5cY3Txf9aHT7HNm6ODXuuDXuuDXuOTewcm9i5Nsy37KKWb3pwyP3cLDqxOenM1vI0lWufp7klkzpLtIBsYNAC4HXEGIn3TcklhvcePLY/+PSD/UkrXBLnOcbMc1Qa3NI+Zq49802bmIXOnJzcfHZsTFwcRyRqXut06b9XR821S7C0iZ9rGz/XBg3H0iZ2vkP0Uoffbt2+bx6XGJrnYWaercIwuXkTl/hkrZlJX8Ok11Kb+XYEpg83d4/2PioSb5t8iaM3+3C5ldu+uLvONXb+ZuY8R+a8jUzLjUxLB+Zce+Zce9abNqyFTvF5efnPU+LT0tIlba1rnS799+oYS7uUebZJlsokWtomzLPlLNkYtcbxKuWbfaYa8zzMzLNVGCBxijM08+0ITB9Kibfpl3jblEgcu+3+21O+a3Y+Xrgp8i3HmHkbmZYOTEt7lqU9a649y8ImdqFTYllZaW7Oi4LCQqm0/f1NPn9czZpnlzbPNnWebeo82+fzbJ/Ps01e6MBZ6Ry2/8tzUqn0/Llzhm67JxkGVvd9hugdYHpG5uTQaVTHMiWdmPhOrTEudQ96SXZzHNkAmyQDh+pvEeloujpuoqM6Hqx65tiaJLZfa6UZ+8F13jmpb51o3OFHo3M4+sb11TnCLdkwwto/r0M+wirZrqU5uiHxfmDSWwcNrTVgNqKWeBupxNuUr5VMgcTHVQNgxXESrHbcXLrlyduO0W9tZFo6sJQSt4u1sGEvcEqsqqmtripramzq7el63/nyH1ex37bPeMsu4y279Lfs0t+2TZtv9/xdJ/bqj39hxyWmp6cbGgDL+HFLNB+rH6qVrTmsJWlfiWRMVc02aN7Epr043dPqbIn2SBd65m/w4xAXp/WQfCrczLU+haGboSl9cL23v+v5OOqG4bYwNkweybi++D+upLuKteaw1/iWYLPTsZuRzVzPPehaHwRugnzNQCVeonJ1aZuWxEtUmQqJY0PRHjt1YdWWe4s3RbzliHbDYy3t2ZZ2cRY2nAWOiU1NQmm7uK/vZV9f7wfOl/+4Km6BfdbbdmheLLBPf2dj0vtbn3793WVKQ9GaMoKgjjET1F1I/ZPrWbRWZ0tDtPoHvdSYlrQl5GPOjeueP/W1oWMV4Retb+Z622/iB9fREzeqYXrG9aU2OKI1+Z9qQttIpjVh5EUjRmEFZieYxNFoSrxkiiU+rvpRiNrauq17/71yy8NFm6LmOTybZx9raR9naRc/xybhbYdEqVSmUIyMjSn6+nqttlz54+r4hQ45C+xzFtpnL7LPXLIxde0WptOnF/h8flJiouEfhZgEiRs7ue5Fk4xuqnpa5yDUeqY1TeImrw0qEtc9c/3tN/GDU5e4nk+te1xfSp7V+N0aXYuYLIlTHIUVmJ1oSLxk+iWO/Txbamr6x7svrNgcvMgx+i2H2Lfs4+bZJ8y1SZpnm5iYzu3vH+jv788taljtcOl/3ktc6JC30D5nkUP2u45p72+NtfvEN+NFdmVlJbWfZ9OuaVAfoZTwDhWUJa69aOxdWq/gv7+Td6xIptVZ9NBbTqHycYxdRdq1Aq23GW6/CR+cmsQNfGr94/pqj3BLsgiyzY9bqM5pKc1c7wfBfQTl/gP98tmMERKXTI3Ex3E/lJyWlrHF1Wul84MlmyIWfBz7tkP82/Yp82xT1zn6Ou36eePOC/bbvZfax863zV38ce7SjZkrN6Ws28rcvNsnMzPHyB9KVn8bJw6XaXiE0vFxqmOxckgHjNVctNboplpN0z1ShZ6RUcc1daksPeg/sal37E0jVpGOqojmzA2Mf2vSB6cocZKZay0a/07Sra//s2v/xeTQSYbk1bVrGfzrqOODaO4/IPFZjpu7h8SgxIvbkOKplPj4+Hh5ebn/jRtcLre2ts79e+81zr8sc3qy1OnZ4o0JCz9+brE+5S/r4v5vXdxfrRIW2mcu25S5YtPzNZvZa50Cvz1xlV9fz+Vy/W/cKC8vn6LmAcBkAD4FJh9U4qilySVePC0SHx8fr62pCQgISExIkMlkrGdxB+nnrLbcXOn4aIVT9HIn9nKnxBVOySs3Jax2jlvpGPGB86//oF/kJKTIZLLEhISAgADKfXAAmClA4sDkg5d4sbbEi6dR4uPj41KplMlkMhiMtLQ0qVRaXl7xy6/36e4/b3f1cvjE2+ET7+2u544cu/Trbw+5lVVSqTQtLY3BYDCZTAp1cACYcUDiwOSjIfHimZU4Sl1d3dPw8HNeXsHBwenp6TweTyaTjY6Ojo6OymQyHo+Xnp4eHBx8zsvraXg4tR+2BwAAmJ1Qlnjr9Ekcpb29PTcnJzwsjOHnd9bT8/ixY8ePHTvr6cnw8wsPC8vNyaHwU8gAAACzHKXEW/VIvBUpbkWKpl3iAAAAgEFQiRe1Kl2tJXGVwUHiAAAAZggmcczjmhIvAokDAACYK3iJF2lLvAgkDgAAYMZoSLwIJA4AAPAKQVXihSBxAAAA8wOVeKF+iReCxAEAAMwSTOKFuiReiEm8FyQOAABgXri5e0h61aLWlDj2QqEIEYPEAQAAzAw3dw9xL1IoUnucTOIipAAkDgAAYH6gEi8QqT1OIvECpcQVIHEAAACzws3dQ9yrQC1NJnGR0uAFIgVIHAAAwNxQSVzlcRFR4pjB80HiAAAA5gcq8XyR2uNqib9USlyRDxIHAAAwSzCJYx5/SZS48rV8kaINJA4AAGBmuLl7tPWqRV0gUpBLPE8IEgcAADA7UInnCXVIHDP4bJQ47kfC1b+0btqvZ1Gc0Nx+nYtae9BfTzerhgMAoAKTOOZxTYmjr802ifMZ1jQanaP+J4MzPjUSx7/0KkqcQ8evqJlpw2RNBQCzELzEUY8TJI69kDurJM5nWJOKCSRu2numug2TNRUAzEJQiecK1R7HSXx4HDN4rlDR1jNbJK7L4agaOMoqi1oS6roLNpXGU5hTOHT8u5SVCOx91OdPaCvhNVwRSPVuDp1mzWDQCZUh6hPqeLtG+5Xv0zETOt1as/H6F6d8TGX9GJwKAF5r3Nw92nqUllZKfJgocfS13BZF62ySOHk3jkPH5KGuIuAkwqFbM/ion4gzQN9D+sdBw0FU5o9vqPaC8FLW+suBvc6hE5uia0KNB9pt0Gw/6dK1Vqf+xelYNH79GDEVALzWuLl7tPYoclvUHidIPFcl8ZxZJnE9PXENX+B6lMquH8nkHDrN2lpTuLrnqX/+etpJfEYlap2zJXb2dU+opw2avXX9Sze+nbrLTZSnAoDXGlTiOSqJ55JKPKdldkmcUk0cLzh9JlW9mWZtTTpTKhLXURSYiMSxt6NONixxXYWJmZI4NguQOADoA5M45nFNiaOvzS6Ja9WuSa5OIZS5KVQ5rBl8UrUYkjh5OULPgvBlCq2CjFYTVKUj/RPqaYOecor20vW3E6d29QI1548rvlOfCoQOvL7gJY56nCBx7IXsWSbxcWINgeQ6cdKTfjS8TnBPYG/WqGLg3oqduKM0f82pyc5P6v3boDWdgQl1toGoSANLJ129uFexVtHpdNxKx68fOt1asxUUpgKJA68tqMSzW9Qe15R4NprmWSdxwOwAHQOA0Sgl3qx0tQ6JNyuyQOLAlAMSBwCjQSWe1az0uKbEUYOjEheBxIGpBSQOAEbj5u4hwiTerMjGS7xPJfGsZkUmSBwAAMD8QCWe2azujPcRJK4yOEgcAADADMEkjnmcIHHM4CBxAAAAMwQvcdTjZBIXKF4IQOIAAABmByrxFwJFpoBM4pjBXwgUQpA4AACAmeHm7iHsUVoa9bimxF+AxAEAAMwVvMRfaEsceyFDoBB2g8QBAADMCzd3D2G3IkOg9jiJxDMEiowmkDgAAIDZoZR4k9rjmhJHDZ4OEgcAADA/UImnN6k9TpA4ZvD0JkULSBwAAMDMcHP3aOlWWhr1OFHiKoODxAEAAMwQvMRRj5NLPA0kDgAAYH6gEk/TJXHM4GmNIHEAAACzQynxRrXH1RLvHR7HDJ4KEgcAADA/UImnNqo93ouXOGpwkDgAAIB5QpB4oyKNVOKpIHEAAACzBJN4KrnEVQZ/DhIHAAAwP1CJP29Uexwn8aFxzODPGxUtXSBxAAAA88LN3aOlS2lp1Ni9Q0SJo689b1A0g8QBAADMDDd3j+YuxfMGtcfJJN4AEgcAADBH1BJvIJM41g1PAYkDAACYH6jEUxrUnXEtiTcoUkDiAAAAZgkmcczjRImrDA4SBwAAMEPwEkc9TpB4Sr0CTXK9orlL4XYUJA4AAGBGoBJPxnW4CRJPrlck1yuS6hVJ9QpBl+IASBwAAMCcwCSerCnxZWt6hpBk/lgyfyyJP5bEHxPIQeIAAADmhVLi9VoSX7hsTc8QksQbSURTNyKQjx345sduAAAAwGxQS1zlcZzEB5GE2qF4NDVDTbLR/V+fmekGAwAAAGrc3D0EOIknqyX+7nvdg4q46gE07KqBxs6RfV//a6YbDAAAAKhBJZ5Ur/a4UuIL3n2ve0ARW9mH5hm3r0E6vPfIDzPdYAAAAECNpsTrFT0qia/uGhhjVfSyKnqY5T3M8p76jiHXw6dnusEAAACAGkziSZoSX7q6a2CMWdbNLOuOKe2KKe3itw+60k/NdIMBAAAANXiJJ+ElPn/pqq7+sZhSeXSJPLpEFl0i47cPuNJPznSDAQAAADUaEk/SkHhUiTyqWIaGJxn47BBIHAAAwIxAJZ6oQ+KjUcWyqOLOqOLOyOJOkDgAAIC5gUk8ESQOAADwykFF4rLIYlkklFMAAADMD7zEE7UlHq0qiEcVy/iSAVeQOAAAgDnh5u4hkKslnkjaEweJAwAAmCdKifN1SDxSVUuBcgoAADPIg9TKPYykDV6s1yp7GEkPUiv1r5kDRz2a5IoEniKBr4xa4vL+0YiiTiwgcQAAZoR7Kdx1NzPX5PVZVyteq6zJ61t3M/NeClfPykElHl83Fl83Fs8bi+eN9QwhC5etoc1fskr+cjS8QKpMvrRO3L/nqxPTttkAAABQXPwS1+b3HW0aS5AOv1Y52jS2Nr/PxS9Rz8rZ/82PjbIxds2IMrUj3YPIwmVraG8vWSV7Ofo4r+NxXsfj3I7HuR21bf27vwSJAwAw3WzwYllXKRKkw7KXQ69VEqTD1lWKDV4sPStn79dn6qWjrMohVuUQq2qIVTXUNYgseHcN7a13Vnb2jQRnS5TJklS3vnT54vtp22wAAAAoqMTjO4Y6X75eie8YMijxz+j/qmsfeVraH4GmrF8+oJi/9D3avMUrpX0jgRmtyqS3coV9O/753XRtNQAAACVqifcNvlahIvFPvzpdIx4KLejBIusfe3vJaprl4hUdvcO3nwtvPxfeThHeThGWN/duP3h82jYbAAAAygYv1odVCk77oLTv9QqnffBDQxLf+cXJytaBe1mye1mye9mye9myzr7Ree+sos1dtKK9Z9g/scU/QZmSpp6tbiBxAACmm+mWeNSXNBXvX65SPc88SLO6UI4+rrpgRaN9zjQHiW//x4nylv7bqe3KpLV39I5aLl5Fm7NwhaR7+HpcM5prcc1FjT2b9x+bts0GAACAgko8TjLY3jsw5Yn8gkaz8i5F/1npbUV7/3Jle+9Aey/TTfX848+xJ6c2cRLDEt968LsSQd+NpDZ/Vdp7RuYuWkmzWLhC0j18JbYZjW9sc2FDjzNIHACAaWeDF8uqaowtHpD0THW4P1vR3CJxz5ReeZ/2RWjPgKQnxo1m9XPpQK6PFe2fMVPfkgFJzwBbPGBVNaZf4s4Hjhc19V7liK6pIukZmbNwJc1i4Qpx9/Dl2ObLsc0+sc0+sc0FDT2bQOIAAEw7G7xYVpVjseIBcXf/1Kbkyvu0L0IJT3J//sDq55J+cXfMAZrVzz5f0D64kjPVzVAlVjxgVWlI4vuPFzb2+rKFvmzhFbbwClso6R62WLhCKXGf2JZLqhQ09Djth5o4AADTzQYv1tqKkZDGrgrRFCfLZ9VaHzbhyeIf1tI+fdRVIQr/lEaj0dDH05SQxq61FSP6Jb5p//GCxl4fthDNZbZQTJS48JIqBQ29IHEAAKafaZU47Z+/akr8gx+yUIl/8MMjn1U09J/mJPGGXp9YIZrLsWqJrxR3j1yKFWEBiQMAMCNs8GKtKR95VC8va5FNcQpPr6W5BOOeyby4ivaPWy2yspZwF9oHpzNlZcH/oCmfmfI8qpevKTcgcaf9xwsaevGuFnePWCxcCRIHAMBcQCX+kC8vaZZNeR4epNEO/qL8Z/guGm3lvwtVjz84lSEraZYx//0Bbe1F5tQ35iF/whL3YYuwFDT2bgKJAwAw7WzwYr1XPnyP11nQJJ2O3D+IXSe+8z72fNhO2gcn0pX/vLGPRltzMXqKW3KP1/le+TC1mrja1SBxAADMiw1erNVlw0G10rzGjtcqQbXS1WUgcQAAXnFA4npWDkgcAABzZ4MXa3Xp8N2ajux6yWuVuzUdq0tB4gAAvOJs8GKtKh3+vbo9kyd+rfJ7dfsqkDgAAK86G7xYq0qHbldKMuraXqvcrpSsKh0CiQMA8Grj4pe4LKtrd/nLXyvFr1V2l79cltWl/+fZQOIAAJg791K47/u/WJbdvbJk8LXKsuzu9/1f6P+hZJA4AACvAHeTK3ZeS9jgxXqtsvNawt3kCv1rBiQOAADwCgMSBwAAeIUBiQMAALzCgMQBAABeYUDiAAAArzAGJA5D0QIAAJgzeoaiXSHuHr4Ev+wDAABgxqgkrnY14efZLj0TYilo6HXaBxIHAAAwI5z2HS9o6MW7miDxi89asOQ39IDEAQAAzAqnfcfzG3rwrlZJfMEKcdfwRZYAS359j9O+YzPdYAAAAECN075j+fU9eFeLu4YtFqygvblgRVvX8AVmE5b8+m7Hvd/OdIMBAAAANY57v82v78a7uq1r+M0FK2gWC5aLu4YuMhux5Nd3O4HEAQAAzAmnvd/m13fjXS3uGrJYsFwp8UvMRizp1XKvG4+c9n4LgUAgEDOJ141H6dVyvKtVEl+4XNw95PusEcuTnLYXNfLChm4IBAKBmEle1Mif5LThXS3uHrJYuJy2ZNmqW3cePHjRepXdBIFAIJBXIg9etN6682DJslW0bZ8eWLB0Zamgx48jgEAgEMgrkVJBz4KlK/9ms5E2Pj4+d9GKX+8+TObKbsQ3QyAQCMTMk8yV/Xr34dxFK8bHx2nj4+Mu+77837/O+TXwYXlz75Ncyc3EFggEAoGYYZ7kiMube38NfPi/f51js3GLUuKoxy0XrVi4dOWtOw/ae4YhEAgEYoa5defBwqUrLRetQA2uljjKxi0ulotWQCAQCMRs8+HfHfDe/v+L5aGrt1EnugAAAABJRU5ErkJggg==" /><br />
<br />
The EnScript will then search the case for all SOFTWARE registry hives that it can find based on name and location (\windows\system32\config) and attempt to parse any WiFi profile keys that may exist. All output is to the console in CSV format for quick import into Excel (copy and paste).<br />
<br />
The EnScript parses the profile name, DNSSuffix (helpful sometimes in identifying owner or location of the network), MAC address of the access point, creation date/time of the profile & last connection date/time to the profile.<br />
<br />
<img alt="" height="166" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAzoAAAFZCAIAAADfLM0+AAAgAElEQVR4nO1dzYGzOgxMXRREPenj3VPJd0sxvAML6Gckm8QQJ8ycdg3+kwZ5LNj17T+CIAiCIAiiY9wmgmiHf//+fXoIxO+AdDoNNHUPoBcICcMHyjWiJRhuiIYgnU4DTd0D6AVCgnKNOBAMN0RDkE6ngabuAfQCIUG5RhwIhhuiIUin00BT9wB6gZCgXCMOBMMN0RCk02mgqTUe4+12G+7Pc3ulF7rEZ8gwHSnXnvfhdrvdbrfxMU/vNj628vln4sfRX7iRtJxilhI9oj86Scxc8lE8Ku8aHZv6E/YsLNBHhY6OvdAJLkSGKZZrc5cb9nauRdnLcs0srnurEx8GCjeWWoL3JXev12UtWBjAsCdmKdEjcjopz22skMWeYL6ZiEZxXXXDr8u1sqF24YV4Du2ZRJUG/f4t0I8t1OiuzpRrL6d20ik3dutrIBkKyOWaykC8YEVU5TW5tlqccu2bUAw3mlupu9WD+bwPcWGMVK4RvSOWa8MweOE/DMa9uNQGuOd9APE9qGvv+Gm5VmWofWi6QuOo8n6/ViGd5tFz5NoBbn0NJEMBNXJNDGiOWfe7uApkuRK3azWcXRO5kSjSzTESVhc9bUu2lr7rWy4QucN+iTaoCTeCaqm74aYFFiqObOQ1tLzHLFVP4Mc+VCAsYrk23u9Srz3GtUyQ43kfbrfxYYNz1W44qCtC0DCOMm7DchA/cSDyOcMgi3gUElPb7qsn5cK1vE1H8KSusbO8jKPKe/2Ctv0KbXeVrRagWrnm10FLGDhlYCrQF2rYTDAtjycripdHi2TIlppX5NrNxhD5iKrp6pdYXm+pu+YQCxbeZbrCuIstfG9/I1SOGO7P5IUs6pdog5pw8zTOTdzt+ZwUOvLaKxlLV7ZQrHWETEM8hV77e6SNt9cH/YV34EFdSY+/MCx+8eU2fgaBSNR+3sc1eqmSgwFMHRmqclIwXKdPpIjMkZ314GBUeatf1HTFCt1qAaqSa3CCgDBBDinkf7S4/znA7aGj8gqfTo/RpnXqKl6JDFOdXPt73bB1qQX8+pu8WCXXonBqTLFlRsZHwLltIPHqbO/J+iXaoCrcGMck7oabEF/YQK6pTRi50QnSlM+m15YHGjhUEkT+XPBxUBe9ddlGAMpN/IwCkYi4apYnbhu8qUNDVU5KwJkTP4LGIMCesMmg4JV+g4bKK3SjBWjvy9DtGiAMXjpDt4aLu7pgpZMvr/IpGiHJ4FD5pwbaOHpe20CrDGB3AAaBXFsbf7g560HWGKjcL9EGr2XXInerCjAWyRzwm3JtZQlTa90gf0OncrMuExYG+YrsWp36Unv4rIKjmA9EfrNw8vZhd3Zt36RueKEI6ob2NIPDUeX1flHDcAQ7V+jqBahSrqEJesLsy67Fi/tOuZb6FEV2kuFFuRb4UD+ZcFtVL9fS1VCs30vFcVGfstF92bVyv0QbVH+7Jh6bwN2+Dbhnd5HgRbkGE3nEZ1H4oGrzmY/CKCiqlxSJBorrvpZdC+Knh1+L4Op0BICpI0PVTQqH6zgDqrA/obL+/la/wZUmK3SNE+u3u26CfqiBXIvcGi7ur8i1iA9Zdo1kcHhPrqmuwGpXkGvlja1cv2U4FpvpTTFXy7WaDTXRAq/8ZWjs7vWKFGa+EPy4V65tLCJVOkLp+3eTd812hmDDLQSHip5JXdCKi0K+3MRP9H5KZkiG+9OXvG7EOsC/DMWGqp4UCNd2QhWpHv1Eq05RVHmr38Dc767Q1VGlWq7ZCULCpPrH8z9a3HfKtar0HeiSZPB4U67pLIS4UCfX1o5AC1tFK5M1b+bfx3GPXCv2S7TBK/93LXQ3pFrAv7WTv5dj++QakAAkSAco/rkielHi3p9M4iJKpobpCVg3YBouBwkOGIjEcPwAT6Fi9H/XgKFqJ4XCtWxRLp3+mY7sjHtEUeSFfmszQ3tX6HiaZS+YisPyj77MBBFh7JRTt9pSnD6tkGvxZG06nGQwprbgIVTEgeB/5SYagnQ6DTT1dF4qMwS90A8+ToaJco04FAw3REOQTqeBpu5hgaYXusHnyTBRrhGHguGGaAjS6TTQ1D2AXiAkKNeIA8FwQzQE6XQaaOoeQC8QElau/SMIgiAIgiA6BrNrREv84+6QaAfS6TTQ1D2AXiAk/vFlKHEcGG6IhiCdTgNN3QPoBUKCco04EAw3REOQTqeBpu4B9AIhQblGHAiGG6IhSKfTQFP3AHqBkKBcIw4Eww3REKTTafi4qR/j6+c3vFO3K3zcC52j0tG/ygfKNaIlGG6IhiCdTsOnTU21Nk2f90LnuJpaC+Ta8z7A4zvt2W/6fCt1aKqpYyAPI/vcfwo2w3uMDQYjZ/YbFHkHDDdEQyg6wVM0i0drslYdmj+56OxVXDhN0/QY/SmM/ja/4pi6OBoHZtnXSxzqw0lV1DIrIuNntp5iRzumN+UDdFNeZYopFNWKZh1l15wgFQXyUZLC7jHehmGwdsAH229je96HTwm2UE2+06JixtUFWxRu2lse4ne2VcQ0KTqJILL9CAslWKsWTYXC3P3jPtjDtl3hdk2eFY5ve4y3YRxd+VYXR+PEVjt6SRvHk4prTc+gwtXlWrqeKpJIuuiQ35APkZumKayyjABRKKoVzzp8GWqmLX/VO5/tymP863i9E63KyRIKNeXcxprRU0IRlUftGBEt7xEugpK7PJhoNp8+Y+zT8OFG7yT2OnG/0/82NhRtv4CNTupZXcIMLLRB+Oq1dpu6GWBAhIV6hcG3zTPy5b6ubiAzS30v+STs71gtb3cFY6ZckwBGDfJbqrghH0I3Zf0jCjk+xATTV+Jv19Q07C9KCQptOtyfsgQEifz9qNR5f7+o9V2MIypXP+vRWTEOXobKxncMBoGpHU2vPz2lTJI6d4/9A6dnfRNfh5VO2sV/v8HCSTz5rPWCqduhWq6BZREJovFRvzqvASI1S3UvQeNRO3FKdHwstw/ohRzl2gafQAIucZZuyIfYTQJVFNoh1/Sskz81CF5/6t+0CEJxxMwqEjH21rUxfUFlNlF5pMFRv6Fc2z0YPJ+r59bC9XVF4sQ99q/beFFAfzsiOs3+Lu6FWWuqxufkWsVtWxgo6C1fnpqlspfivGqCf5BJUBtVyrUVJUevb1xcOqAZH2I3hT2+TiFcnv1l6NqXedRXy5j3Uepd8m0JGZVyDW1Q1q3HTrlmsMg1GAOgXNs9GDQbirW67Bqw5177R05P+ya+Dq9l11awljVojI/JNTxSWSqDQNUs7TpblU2Je4kbz+cQ1nLv49YrlGszrJFjAysd1ZIPmZtM/3spFF311Er/kcdfI1aVJPlFM7e7l2uRXmuZXauRg6DPVtk1arUVdd+uLdfeyq5FUuzBb9d+Bq99u7aBtarxKbkWDFTeptIFcncG69poXPutUthL1ng207iWup1yzcIbOWOzsF9TPmRuwt3XUShqDVIr/79rz/v8tlZXq5Jra8bD2et5H9BfhkayeKdcC+2oX9uuXersYPjtVKHTaHJXR+kvQzMn7iVDsI2iUPsdmL8M3T7V8Flx8+OwvXa6eK39pm6FGrkWLcR7kxnbVVctMUtNL3nj+H7hKVhL3K9X6cvLtdBc9iWNXCyCpMvbfAjdNIVVcLmrDTqCrRT+Te6sufz7zAq5FlQWV5zeFGpUa9o9cs02rwWxLlpK5t+1s3YNBlT6w7XVQincJPbca//A6cQPIfi/a2CTaMNKEgQuVqsSzf+Rh8Rwf+JCoNZg3RVpLiWKxsAs1b0UGsftbJ4qD0nN4epyDZoLkEQG/1i9v8+HwE1ZFTFCJNdQrVhF8FQD4kBcPdwQTUE6nYaPmHr3K9tGdbsFCe9R6egr8IFyjWgJhhuiIUin0/AJU1OtWZDwDldWa5RrxJFguCEagnQ6DTR1D6AXCAnKNeJAMNwQDUE6nQaaugfQC4SElWv/CIIgCIIgiI7B7BrREv+4OyTagXQ6DTR1D6AXCIl/fBlKHAeGG6IhSKfTQFP3AHqBkKBcIw4Eww3REKTTaaCpewC9QEhQrhEHguGGaAjS6TTQ1D2AXiAkKNeIA8FwQzQE6XQaPm7qdw6Q+5nD5z7uhX5APkyUa8ShYLghGoJ0Og2fNjVX52n6vBf6AfkwTZlcEwdXjY/JnLo9CRvMN8oTsqLTuoDJ0GFf7ujIqrNU5e/60C0zaFOqz5r868wUooPf7Vx3tHMdMNwQDaHoBM/vyw71Y60daP7kzmMBh0rD4Yk1AN+1u27ZLGCES3uwfFfjhVpB7z8cPxvzIXbfaXzYPaloSP7M0OVKINeUMHmM9qBaezj9MAx2+mpoj/E2jCM8vVed0b32I09UDQJNQa7ps4+94FwmhU+rcAeyCkPamYlzYqvbuQqicHPSESEXtPhPQ9DJnJLsIhTe5rFWLZoKhbn7h47Y2fBEAF8DtY3D5brriqJif2IrM8K1uXH05Tsar6wFev9RuXYQH5D7TuPD/knFQ3LtFo54t1rI1pRNPMa/UaqElex3NhgoxWvpYt98sa2Va1s7eFJlmaXJglOMe9u5CHy40fuP2WjrbsL6021L9t4/JYld4uuw0Uk9h8ujBwttEL56rd2mbgYXDMPh4UC51d9fd6uc1fUrxHxDsBxWN47VcraC/eFH5dqMdnyICuK6h/GhalJ1fACF0cvQIBGIRvtnD1EYGFtXiwPIqv9SbVMt17YLcFJFmaVVr3KA/GVnO9eApNefnooT2Eb76tfVWwoT3e88AZxM0fb1WOnkQ8nffhA99mtwZK0XTN0OagzZ8PAKu61x++tGe3ZjFrSmxBv9+sbjlKh9+XZZufYOH2CDad3j+FA1qTo+gLLsTw2WJIZq+K8QSV8VPpSmFDJubSzOncF+HWQ2ZQGSa8Y0rnHTjpQFIIdjU7DaGXvauQSC9XWF1rirPa30DS6oYtl68Izm6Vqie0R02tL3rlBWZ62pGufKNTk8FyrWZHqwH8vquq5Ts0QJhVyuVTaeWSMa/FXl2j4+wAaDElvemg+VkypUlFOVsyz/ZejzPtzsFNyHaZtMWiIFfLRMBizLrj1NMkoIH2wy23aqksSkSlkxN861gnftrnaugJrsGpBfaN+5fn4YyLVAucd9E1+H17JrK1jLGjTGx7Jr8UjXFWFvXbljr86mhIvYq42HtaB9ZlxVru3jA2wwqXskH+om5QDzbb5CzT/y0GtkJtf+Ftr7dkuykBa/XXPuSOdi5FopNgUKADQWkcB0sr+dC6Du27Xl2lvZtYgo/Hbtd/Dat2sbWKsan/p2LRvo2sCeunYhrP1WSW35o53/nsbjWqD3P1xHrr3Fh+T3c/lQOanCkFDlGViuPbe/V3CN5XJt1WfBN3VSgokUl+rUp+vAFPfLtWBSRZkVfGQwABG3s53fR+kvQwP5pZW62WpF99cRnvhimL8M3b5JEOHGFcogwlovmLoVzEMKh+ei6PM+yDiQTc1HYLPCJP3CEeblOxoXnoK1wl4uJNfe4gNs8GQ+1E+qig8wWZX/qUH0XimRa0vV8QGmP9kylXyDYitMsb2QXYOTsvm/NbGHjW6nCBuvbefnUQo3kfya1G5GsyG4X9v/amnMayD4v2tgt3gzTAKP+0VrVaL5P/JwsREND+x5g5Wopq5PiGwawDQYjFB0hlb5ysaFp3CtsPcflWvN+YAaPJkP9ZMq82EyD/cKnmpAHIgfDTfEZ0A6nYaPmHr3K9tGdbvFxQlPPhhQrhEH4uLhhmgL0uk0fMLUXJ0trk148sGCco04ENcON0RjkE6ngabuAfQCIUG5RhwIhhuiIUin00BT9wB6gZCwcu0fQRAEQRAE0TGYXSNa4h93h0Q7kE6ngabuAfQCIfGPL0OJ48BwQzQE6XQaaOoeQC8QEpRrxIFguCEagnQ6DTR1D6AXCAnKNeJAMNwQDUE6nQaaugfQC4QE5RpxIBhuiIYgnU7Dx039zgkwP3N6zMe90A/Ih4lyjTgUDDdEQ5BOp+HTpubqPE2f90I/IB+mqe7MUHGS1TRNYvb2ptttuD9hYXjeangsl+gLjyI71xQ2Ak8J9SeBmuZAoSj6DRIcB4YboiEUneBjWHw2WasOzZ/ceSzgdGk4PHEcMA7X8EjhyrpBv2CEoiu4wrgqelELjF7f0Q/HT/LhhY4yuWaO21bHn/qO4bGnWyGWa8UgIk/xVqe96yNQn/chFGyP8TaM4zo4catssDB81dxSho9hJTZE4eakI0J+Z1tFTJOiE3wMi88ma9WiqVCYu3/oaJoNbwv7OFybFXhv3chWDxzv5fJRmFQxsO3r6EflGvmQ1wo7qpNrk1r50CJYVDsN5JrouX4dnnuBw5MD1P3Azs0QqqdwZfhwo3cSswHXnZG0NtwI7b1/WrYo9NIvYKMTfAyDZ1MH4avX2m3qZvApgGh4MBqLBtTt5uZS3axfv0ykyweogu3s5EdtRz8q12aQD7s7qpZrYlpeK1WkplrINeyeDMuNgX3Va91hMClRVOgnxfRaAkmvPz2l/KbEm+CVSqSKX6L71c/AK6hv4uuw0gk+htGzuQZH1nrB1O2gxpANL1hhbcrgNj6yXAqum5rFtlZYPoIW/Eu54vIcdXQduUY+vMCHl+RahViL5Frxva60drCbjLH1WRqitN+qDlChaSgiAzEjWF9XaFas1rRkCS6o4oodFd+NfjkiOs3+Lj6brDVV41y5lr7NQtWnJW1eylLY8tQsUYahfnnWF8JoU9vRVeUa+VDFhxfkWpVYq8yuCQUnVbOTp8G6q6vL9sEglcJ1GdHh/oSFb+5Zr4aa7BqQX2hDsCY3A7lm4NnH7NrX47Xs2grWsgaN8bHsWjBSnZDYAsTzPuhNdaFudTalsHzASfluk4/Lazq6qlwjH3Br7367VinWKuUanOKreRKl9MwibrORkDmwkN+u7UHdt2vLtbeya5Ef+O3a7+C1b9c2sFY1PvXtGhyoCdfREltTt/pbpWz5CCdVd6W+o+vINfLhBT4Eck1JViNlq8Raa7lmRjQ9k78MtWMyVd0Nmz9hYaBbCYTSX4YG8mv2EdgSZPcH2yg66Hdg/jLUPYb42RQBmrVeMHUrmIcUDg8vE+jNiIwOKPUe1c3MEq2otdmUx6jlR5QdqO7oQnKNfNjPh+j/ruFEm7lpzmLAQtSgvRHOP/nkQtUvJPqN8PLDU83pN71J4a7XC1dEKdxE8mtSftL7huB+TSd65hcR/N81s9G2hSo4Xr5WJZr/Iw8Q6v3w/AobhGtZDLdySV1klmCEf4CrKaoChrXcGiw/eUc/KtfIhzZ84KkGREv8aLghPgPS6TR8xNTvfFzykx+mXJzw5IMB5RpxIC4eboi2IJ1OwydMzdXZ4tqEJx8sKNeIA3HtcEM0Bul0GmjqHkAvEBKUa8SBYLghGoJ0Og00dQ+gFwgJK9f+EQRBEARBEB2D2TWiJf5xd0i0A+l0GmjqHkAvEBL/+DKUOA4MN0RDkE6ngabuAfQCIUG5RhwIhhuiIUin00BT9wB6gZCgXCMOBMMN0RCk02mgqXsAvUBIUK4RB4LhhmgI0uk0fNzU7xwg9zOHz33cC/2AfJg+KteWox94XtDvIg03v/mfDEMk56kRdeDqdRo+bWquztP0eS/0A/JhmvbKNXBg/R4zqEPutA3doaeuX33MF/EVaCnXwPmt+pzQ7WBrfzIcujM4EvYoCLmWs/2L0FBx1zSl6FR/yK/ERg94tiauZTiFDkwOhz7fhzvD29VCy/NgYlPB9qsOaJY4Ryg44ywQDwt2TuIyXLdMkmgws8GhxUCVIgPhDfCE5OvJNfJB9VHiw7FyTaE+2fC8D8rcFGxfg3ZyzZyKO/9YbmHZFMA7H6PUT0fT6heza5+Ta5APsFBAFm4uL9XCrpOnL0dhaW7uoc9pLk40b/kx3oZxTJqA7e921PFCARpnu7b5CTykmcu2unjhSJiDBrPYOyCTqVLkUtS7HOhW60pyjXzYzQch16zoU/uzeVhSAKp4oFY/HRd9W+PD1khgj6gnuoakl3C6FFvrPgIRdP1Z8WPlWmkR2poq3BnRyo05TPKBiaibh/tdZ9fUbHSD6Yas5kHzLejna53uHMDQyPFG9DHOE7ndbrdh0BEADbOyZRNbwsd7oxPkAybJFga1l5eYWKo1qfCpZrEWyl9cWDbkwlQUtcKWt6G4Nkz1b5BrM+CTh3c2262By5K6pUgSDWa+IVl1HKdyLsEb7CN9Tbk2g3zYwYdVrm0a1q6eUXZN/PK8j4P4Zf3RLi5GhdaEk995DX0JbPQC64XKHMs0wkI5rbY2tki1ka3yWL/kWxw7QDNm+FyoiZhO5SKO5JpWBcP9GTx6cFTBg4ZakA+OtitygUrqmJ2o1X1Zit/bJBjIzuwa5ENAkig4/v1SrlWXXVtvaCrXsFqD5b8j1/AKq5PqyGVxXZ1mj+q6wcj1s2Z5LnIpu8GTkXJtBvmwoOJlqFoekpehMnc2PpYlQ97ztlxLzET0CC3XjIeTbdBjnLM3warln0HQfMApdeea/YHcQ42i4bvnwFNfDxoknAtdwHmFDxpqYespfqClGJBtrUO3w83lWmATJD/ekmsi5ZSSZBIOn/nlI2KpFs4IpjlBsAa41uz9uGWzRcB9wvaLnVp8Tq65EveQxi6LrBJt/Iy7/eq5WW//8hyEqeCGv1nqCpRr5EPCh02u6ee7Rq6JtwtzFBzuT33Lm3ItyIEQ/QJ+Gx7kUzQFlv3FVjXcA6Hq2SMFuBYKMztm+FwE0sT0E8k1mLdJV9big5Y+vPLOwAWhKmsi1wzel2vPPLsWoJBdM7em2bU8NgG5lk40bDlbCnT1L86uFXRomhEJ6krnVGdT7GPyTjYlmNz6m95KiTso18iHhA+LXLNvLKrk2l9U+9vuP5fPYkD+bbsZXkKgVvtGoHAjk0NJdm3+RgomZtHaA9I2iZAoLL7hmPFzkUiT/dm14NGzw0ketKiF+Wen607PrtVUwHjt2zWM9eaKWmW5lgWw9+Safl6w1HXVv1euZQMFy9kUP4d/sAtH5m45GJ1RDc3ttXXKJXRDsqhTrpEPCR+AXJNpjkR8LvcO4zisK9E4SrX2slwzEpP4GqBws7J2Xn7ARkh+VyBpaH7cPtFyD6HJluE7n/dBKhm5n0Fi0AgC8VwE0sQmRuq+XYu7MH2ED1rw8G7r/dZO5ALVnSjPU5iyVmSTNClUesbNX4Y6asBCuNPTZi/V2pVdc91VybUoibZdgO2C0X61XHPjxA8pdJmfI1w4sLvRYIrl/lKRS+gGu7/axnR5uUY+ZHzYXoauYnK430dd+WYWIWEBtTzotcJao16ueV27K/AQn4NOh/i3c/IvjKPkkMxG602NbNNuG3yBv1OmK1QCWwQBSzn0XETSRPYwPp7bn5G7PZUaQ9SF3fnkD5p/eJeuzPZR/P0mbONmtIONntstNXLNmB28Zk40W/B/16xOB4PecnuIL3mtWK5JKLVsPSlbtxW3vKWJqrplFCG1UA2qJ50mOOcfedghAVUJH1LkMl83WjiAu6Gn1BicxYIqJS6FN6CuryTXyIfdfOAhVERLXCncfAPqX2Z2CdLpNHzE1O/Q8cuoXIeLE558MKBcIw7ExcNNb4DJsS+KaaTTafiEqbk6W1yb8OSDBeUacSCuHW56g3+f9mVBjXQ6DTR1D6AXCAnKNeJAMNwQDUE6nQaaugfQC4SElWv/CIIgCIIgiI7B7BrREv+4OyTagXQ6DTR1D6AXCIl/fBlKHAeGG6IhSKfTQFP3AHqBkKBcIw4Eww3REKTTaaCpewC9QEhQrhEHguGGaAjS6TTQ1D2AXiAkKNeIA8FwQzQE6XQa+jR1elbh7tv6R59e6AcX5wPlGtESDDdEQ5BOp6FLU19tde7TC/3g6nwQck0cW2VPDEWnWc2321MN8Rld8P4FwZlgEqZpcV647+jFE/TsqWDu4O/1BskFNLAfIst+MNwQDaHoJB5ieyqqKZQAN1ScpwkPUBVXonOgS5Gneoy+SRgbX7MJwjlP7jw0MxVYOE366NbNI+jwRn/OcIVBXL/aWch2YKgla0fX4Xm2V4uf5AMqD/lwk/duIkScVho88I/xNowjuoxPrw/u12dzi0OxXWV04rLyHTxqWtxciFxm2EiNbmczC7kGp0q5ZnDSf9O/sul/EYJO5iB1d066jiRprSIZTbzXYWEYRxTgksij1g7Q8RpvNX/LsfE1m2AcLxTm0Tx8nHWF2zUwEfeMb7cJGwlbJ1Yy/ebESMafMhANHC+S15Jr5MNuPki5hlNOeLizSYoBqnB/7epalGvaRS/JNaf/tLrUVKFcC+DDjd5/zI5Yd0Yun2m3HXvvn5I0LvF12OikHqrlcYaFNgj7G3A0COScfMTnC26jWIo8qr4M1llQC6NIYXaBTYo4SyjA5SFZM/xlE3RhDA7ehliDmH53LxNlBuKawZivJddmkA/xmOOXoWFWMgoZa6rf9oPK8P3VwaQk1+S29WW5Jm+aOxS2xz9SrllIev3pKZDx9SuSSjyIX6L7S1sT1DfxdVjp5APH3+7PFU4iOAY3lOTan+QfH15sjQ+Q16+Va1FFNIR0p5zMLrJJEd3JNfvmS2Ud1Uc2cIbLXalBwK/hKzZUpchAMyApNwb0ToxyLSwkH8yfGixJDNU7eHkrBhWslLoour9a12zvqbdhqLEFJsY3h52u41mSqKvrZfC0osE1S7k2hQuFXoWgfZMLqrhiR3VlT/wEIjptyXpXKKsHN1RFg79H24m1WAPVRJ4g6K9xJFiDIF6zSYTO5Bp4wlcbDgNaioIGU4OEclZtH+OhVlkbOxelGijXwkLyYZrgX4Y+70P+kUc2QFQS3h+EJBHhVLIrHEU5/w8KfS9rQyqJOdyfujqzawlqsmtAflmTrbclcs3AkzDW5cSX4LXs2opd2TWBjY5LMJRVsiWh8GkI/pxF3z23sVuu/VZ2LRu4ScoHC7YxSAYAACAASURBVCJMaRayKUEv8VB3WTtwrqpFuYYLyYdpmoJ/5BEslrKXZKm0g0zub/Xtmv35tZeha0ePUeuxh9UMlGsR6r5dW669lV2LTMxv134Hr327tmHPt2srUMy9jzaGed1VIdeKsWG7vSKK/O63a6XnO/vwxUriHd8qlYbpL+yyttov4CWecg0Wkg8zbustaAsYRUAnz5Ipp/eLTJ4bhu6z4FG9H35Zrk2PUeVW514GVZlyLUHpL0MD+aVJJFyb3R9so65q+l+E+ctQ97VB/HWpT7wXQoSoZb+LNDcr7u35ds2NbI2yqLcoNpZmh21SRE9yLQnXNlHiXeNaTwxiXFmTBo31N2Qgdq5oRPdEuYYKyYc/mD81MNtGmxgb1Of3aP5u/MX7VR9xIrLkUfndmd8Dw0KIx6gvzzVN5odyLUIp3ETya9JfI6jcRnC/9mnlKx/iqxD83zX3fOpCFfHADTgayFqCi4XIY+RaMfKobypARb+ztVdKswsKd5n6EEijroNDhcGym8cG1IP/gFD5zfabej0Yf5GBgXNFsZzDleQa+bCbDzzVgGiJK4Ub4nCQTqehH1NXvgrZ8aL3e9CPF/oB+bCCco1oCYYboiFIp9PQjamvvDr344V+QD5soFwjWoLhhmgI0uk00NQ9gF4gJCjXiAPBcEM0BOl0GmjqHkAvEBJWrv0jCIIgCIIgOgaza0RL/OPukGgH0uk00NQ9gF4gJP7xZShxHBhuiIYgnU4DTd0D6AVCgnKNOBAMN0RDkE6ngabuAfQCIUG5RhwIhhuiIUin00BT9wB6gZCgXCMOBMMN0RCk02no09TvnBDzjafL9OmFfnBxPlCuES3BcEM0BOl0Gro09dVW5z690A+uzgcr1+ZzsMys4vNNbcUbOvfqaMhTuL7OHz8GhhuiISSd8GMenLWHKq2n9OnCUjUQDNM4g0e0xUccSUH89Cce2m7Do5DhmYo5znly54GZMcHCaVJnBEOPZJG/VDdijh9MRrGyj/bx4Wrx89f4MAVnX5dmHbWZy7XHeBvG8ZXTHOBh52fgeR+UGyjYPoko3Jx0RMhX7qCIEBud8GMuNpJ4Twl5VyJjFlKKEfIxyrPY3TAjihbjJ6qHJ6KOoK/G8UJhtsJDjw4Wbte2c7G9R9LIX6iLmROMsOA6PUMvE/bw4Upy7Sf5YFQhnMSONlO5NvflgoBo4jHehvt99DIQhRt3M9CQc2erIs3PqC/l0V4LVEQ7+HCjdxKxu+P90p77p4r0B/E1wKvX+pir2LaFLRF6d8i1WO/p1SSKkK7uWlW3sUVKs2pnkUs0UZrdixvns4QCjNGwMJhIVQOlugFz4g7SC+7ya3yYriXXZvwWH1RV/KTvajOTa0vzYK5CruG1MJBr8uZNQooO1GpuOtpCmTNprFy5Tn8S4O2VckjkbrUdEr9E95fIgPomvg549Vp8r/2+/VYj1/z7CizXdEjJIqSta/brMojjJEuiBCzzk9k978NtGNLXNRDdybXIIjDIm8JS3Yg58Qin4jdBgY9Q9YAPE+VaUvglfHiM81OnalXLNXtjLNeMhjIJSqGiYATQL/G3cITDxRZndMRZzeqrlvUyc2ufx0qvwBmBu+26E1xQxRWbJ8r3LwdavTbfw8yXv9nFJXO58B0aDONZrFlDIfxU6TYMUW4vHGfEYzQ7GfD3fB3SmVyLDFxTvVw3ZY6rjhzqEMeaPXygXAsKv4kPf9crs+Vpm6FcUw24dG2NXIPZNf/Vng5JsVzD+RIJN1+KtU+jJrtWoc7X2xK5lpGB2bXfgF+9rBoJ98Rb4e7PjVBftoOKvWEglnCPSXYt7grNzr3WqQyKfcm1YOAwyNvCirovZVMy9Vtj6Bo+UK7hwq/hw+bN533I/9igps1IrmULYBu5Zl9fvZBdS77vpVbrAnXfri3X3squZYsshdpvwNDJPubZFydJobmOAwd8f5FuEeoaDyJoLNcSQRm+DN0hKhd0Jdeg26rW5sq6L32rFF+pS+NX8IFyDRZ+Cx8qNpD72gzkGg5OXqO1kWvL+90pXI/Bt2tZSpNarROU/jI0crfaVJiXTtH9wY6JQu13IOgEH3McmfKvu7ZPaN3XY4qNpq9ihFw3EuATTNxKzbdrvpHCt2vy0dizi+1Jrvl5Qe+HhRV1kzXNrbmZQ3H5a3yYKNdw4ffwweakwFequ9rEcg0tc1tZq5eh6/vZ4X4fC3JN7mZB0VasP/pgYuWzKIWb2N3qcw61QQnuR2QgfgsbnaLHHEQJJ7wMTWRTgjZbLdRXOUKCHmVOGfC0Qq4BwVWYnS6uj4Xn/CMPN1pU6FdY6H1YWFl3gsyBI0QOdfOq81GBD9O15Npv8gFGF8GHfW3yVAPiQFwp3BCHg3Q6Df2YuvQC+6i6PaAfL/QD8mEF5RrREgw3REOQTqehG1NfeXXuxwv9gHzYQLlGtATDDdEQpNNpoKl7AL1ASFCuEQeC4YZoCNLpNNDUPYBeICSsXPtHEARBEARBdAxm14iW+MfdIdEOpNNpoKl7AL1ASPzjy1DiODDcEA1BOp0GmroH0AuEBOUacSAYboiGIJ1OA03dA+gFQoJyjTgQDDdEQ5BOp4Gm7gH0AiFBuUYcCIYboiFIp9PQp6nfOVXuG0+k69ML/eDifKBcI1qC4YZoCNLpNHRp6qutzn16oR9cnQ9Wrs0nWhXOoUUwR2GdbJf5zC2eG/lxMNwQDSHpJM/V28JL4XxMeKqmLixVA8EwjW94RFt8xFEqip/x8ZJV46wPiec8uTBQh9FbHKQKZ5pMv1g3Yo4fTIFi8KzjfNb+2Mql5avFT/LBVMn5YOTaY7wN4/jKwQ3BEcUnYBaTD3XEPfEhROHmpNNAvnIHRYTY6PS8DyrauqPV8Z4S8q5ERtzXjGKEfIzi1HY/zIiiMH4+86CWjHMZZk9yDQbqLHpvNoEzzdxUqouZE4wwc51RAXASheVJNnsluUY+7ObDzd443J8umon6j/E23O+jl5Yo3LibgS6dO1vlpWgjuDkQtoXIRpwDH270TiJ2d7xf2nP/VJH+IL4GePVan3UVL7ewJULvDrkW6z29mkQR0tVdq+o2tkhpVByOnyjFUBrnPL59IfEsoQBHBQuDDEBVA6W6AXPiDoILqir2bN6muXIluTaDfMgazeTa0jyYq5BreC0Mwo28eZOlogO1mpuOtlDmTOqmS7nWBcDbK0WWyN1qOyR+ie7PyYD7Jr4OePVafK/9vv1WI9f8+wosg/QOOouQtq7Zr8sgjpNutoHnfbgNg9uzFse5zPnL5Vr0vgamJ01hqW7EnHiEU2b42/jQteqXZzNwyrWwkHxQcs1oKJOgFCoKroH69esWjvCCuUVRHU9Xs/qqBb1MudYFVnoF/gjcbVfV4IIqrtg88d3olwOtXpvvYebL3+y/CNGXC9+hwTCehZs1FMJP127DEOX2zDhljC8M1IxsC61fK9eiwddUL9dNmeOqI4dK/F3PbJ0t+bJVyrWgkHyYJinXXDZd7zsr5BrMrvmv9nTojOUazpdIUK51h5rsWoU6X29L5FpCBmbXfgR+9bIaJtwTb4UpCTJFb/bESYSECCQW7hHET/eCJtOHIJv4zXItGDtMaNjCirovZVOgQzcnPe9D/nG5v+ZLKddwIfkwTZOQa9kC2Eau2ddXL2TXqvfBxIdQ9+3acu2t7Fq2yFKo/QYMnWwgzr44SQrNdRw24PuLdItQ13gQQaOXoUV5qMepk3RVo/xDV3INuq1qba6s+9K3SiUVkaxBtVSgXIOF5MOMm7jTByev0drIteX97hSux+DbtVyQUa51gdJfhkbuVhsV+GrH3x/smCjUfgeCTnCziiNT/u3a9gmt+3pMsdH0VYyQ60YCfIKJWyl8uyZJbj6ES8YJq1egJ7nmvQZnGhZW1E3WNLfmJg61OQjwVWI0a5h8pVxDheTDH26+F99zq5eh69ZvuN/HglyTu1lQJIrthpKi7YMohZvY3erzHrVBCe6HZCB+ChudfNpIvHIwDLCCxtBENiVos9VCfZUjJOhR5pQBT0tyTVVcO8/HaSr3JNdgoEaFfoWFM4WFlXUnyBw4QuTQoHkkxKPlCeaGLiXXyIfdfOCpBkRLXCncEIeDdDoN/Zi69AL7qLo9oB8v9APyYQXlGtESDDdEQ5BOp6EbU195de7HC/2AfNhAuUa0BMMN0RCk02mgqXsAvUBIUK4RB4LhhmgI0uk00NQ9gF4gJKxc+0cQBEEQBEF0DGbXiJb4x90h0Q6k02mgqXsAvUBI/OPLUOI4MNwQDUE6nQaaugfQC4QE5RpxIBhuiIYgnU4DTd0D6AVCgnKNOBAMN0RDkE6ngabuAfQCIUG5RhwIhhuiIUin09CnqStPlfuZw+f69MJH8I5Pf5UPJ8u1r/+3dUQOhhuiIUin09Clqa+m1vr0wkdAtTZNlGvEoXgt3HyWFvIQuPpR4DPeDsM1nxxJJ+wmeNKsxlwRHagc1kN9oeNHg7626/6AwsCL843BuYK+lh6MuAgnW4MPCoXQF/og1ZrbMEnQ0asTslVwY1alyEDcZtDT1eTaLtfXeuqzfCjFlnWM/rIvpFwjDsT3ybXnfVDPdqf0vOaTs9EJu8kEZh8cZ1H9MNcKh5/jvsoeKJ6pHu76H+NtGMegNqoFB4MnW4lPCYXEaHLJrrotJInUwfOP0FaPUR64be0bVCkyELQJhzRNF5Nrda7f7amP8qEcBJYhuucdFYZyzUhCPb51DHOYWDcUeO8Ty1gRZU7OThCnQNHLJAm2Vc9Swm1PwaZILVCKneIXR8KAxgGW6zV96eA73O8jniRen+PnCNSFJroE8OplotFf6RalXWh5hkusAA5IW1Us13TsT50jRqH7mlsOyIlrJdqxar3w+JBQSIwmL1XeJrCaQT2/xm6hrWIj6iu1DNQ14yFdSa7t8mm9pz7Kh6rYAp93HAQCueYffzkrHbOUNl1XLLDHkIOcb1i6oVb7UQh6qU1OyhPLvph6qyobh+HmdBxqHLcVYL253JfdK9sXdIU+o+corHv17JqENf340GYuyLXnfbgNg9tc4pi09VWSa0GzaNSqr6XdOD0IakkFX7uw5fiMUEiM5nJr5dskFsMB3+s1EtVO1idbpY6Bk2MKHtKF5No+n1Z76rN8qIgt8HmPgkAi10K9phavQa9LeD86PiYdaeS1+2vxhPgCqLdXkq0JTwyrQDw0yut5H8bHos3wKio1XO3bLNlxuS+jGeIUXmny8pa4LuXaArhe5rs/XcXGzsSuVjC7XLFAodngRejmV7hUlD+adl19lVwLjVbpsmiyepcXZj9QaibJiQc9Fhjo2kyGdCG5ts+nlZ76NB+KsQU+73EQiL9dW8IRVHzSlFCu6WC2yDWkka/3SudCgNk1mzFya56TawZbO3/p7Hk3K/O15cYLgsdsoIp9pXINj18gkWu4LuXaDO0mrcXDqOJDarg5iPsqeSBtNkmyJqtUnfIyku7r5Boyml9Ua26Tt6MsfnU2JZHx4chSBqo2mV2bpr0+rfPUx/lQiC3wec+CQPFPDcyXQPPr1OBdr098yFui7Nojtgrx5dDZNZeKgDwBci1YFme+/eW6Zg31GEuNIxqDhsGWOemrINeKwiqRa7gu5drk3JRGXonkxrAWfKNam5xN5YbpJNb25dQamsFXybXAaNbWlbdN0+Qd99K3SvnCHbi5ZPn1Or9dm/b5tNJTH+dDKbbA531wW/RtwEW5Zhc6udrWyLXlXb4xlP52LVGrxDdjo5fSNtNWCHhSH/Ue8x/PrPQaR9FL0HhEY9l5sCWL+0rkWjh+2ynKUldGhatARCvkJpe29XFnvYZlnrjVfhmG3gxgRnvf+bycroq+hUGyK6i1faRZnmwtPiQUoNG8qXfc5iYfP6k+8AA2xQOeKhiI2wyHdCG5VutTd/MUWbUDPpRjS1QRFwZyTco+s/K4AvgydG1guN9HzWAhF2X15PM94lsh6aW2EnU8kRlr+C5R6TAtysLGAxqLyKkBm4d9BQ99MP4auRbP3ZroElDqH7lJFq+WMXFSQrrCRLutFu5L+0X/AwDjI00VnLothe+0Fpx2NNm9pj4Z3mhwya65LXqW7TIEbl1fS8XGw+YtMTBoEwxpmq4l1ypdX+2pPvhQiC168q/KtQh1+XiCmLHSyy8+n9QZpPF34lqr10fRj6kr3/v/5OcB/XjhI3jHp1fgQ0GucZkjdmGll/+e64NyjTT+Ulx89ToT3Zj6ymqtHy98BFRrFrvkGpc5Yh/sx0ZxKvlEkMbfimuvXqeCpu4B9AIh8dlDqIgfB8MN0RCk02mgqXsAvUBIWLn2jyAIgiAIgugYzK4RLfGPu0OiHUin00BT9wB6gZD4x5ehxHFguCEagnQ6DTR1D6AXCAnKNeJAMNwQDUE6nQaaugfQC4QE5RpxIBhuiIYgnU4DTd0D6AVCgnKNOBAMN0RDkE6noU9TV/4Pnp/5Vz19eqEfvOPobyQJ5RpxIBhuiIYgnU5Dl6a+mlrr0wv94GpqLZFr4ggseAr7Ot35RnsaMTqtC1gHHcOlTihKjxKVtb/O9FfAa+Hms/+R+jVSnXzk7W/+0+4SFJ22AGUPkU3+FXPo3Pw8QHtC6FoVnxxaUdFcQ4PFR45us4z9b0dl7pwv52z9oFAIzSIXhsTR4jbs7sCw3iyxB8IqxTpwSFElyrWpjg/Rcx1SvR1J1vaiZyp/3EDv/mzT5Uog15Q2e4z++GJ90vwwDHaminWP8TaMIzytVZ1lvfYDTsGGE1UWv97y1T2+T659CamuLtdk6Nj2ySYGI+0EnRsEIl3zhqoW/RBVLB7EZg6ml7cG4RR3+hf9pbGG+6N4CtynhEJiFuHdzNFq+QCmh4aFZlkWPpyKCaqEXlvGAYcUdES5VsWHzNGY6u1IsjY3jqCj0uNWsdxISiRyDUvSLaMmYt08IBWJZL+zbUApDjiLKfekKz98CiWBEaRDxIbBbmLgWVVgB6LYpJgifnE7pH1Hly7Xa/oSxY/xNtzvI55kvOUeH6uBgh0+aO1apF/p5PTIcH96TmTrpmgiC0Ry47i2IX7Bcq2ionqFACqqQelecDgNO51sa+gGhw8JBWwWeylwdNbCOuPEsLFZYnt5ZQwaLzEwLLu8XKvjg4S1KnRdW5LMNyTPlL1UzwdTGL0MDRJ4aGB/U49jmIymag8biLFV/+1Yir7yTfTvQ9BL50xXZYM2yZ4/ICchbnrex0H8sgVJ3zhuK8B6c7kvI9eULKvoUz1uZi8E6zK7Form2/jQZsbBETkX3AIEUNkP5YrP+zC/k9Aafq3oY6WcDrgll2s2PvYq1wKzTJNdYaGj/W2q/DY+UsPGZkm+dIjk+GSjTsLAuKOry7VqPqjy4s6kKUmWEPC2XItSuHG29WZvdRv4x2gNt85dxRqlTVEUiQUW7DcFc2udYqOX5AR8WpQkwvzRleV6Oz4WbYbXT73R3ZJUmeKRHZf7MnItTuGVJi9vieteXa6pXO0w6GRLRfDQea6yKVVG86YXaJcxrqgoAzZ6C2I8rx0firKgtp9kr3ItNAsYMHJ0NC+9y4OGhdVXktW9d04bzypGHV1dru3hQ1BeU2LLd5BkC8Q75Fr1PTY2lf8y9Hkfbna07sM0HYTkLSGdU7n210jdipTsfYjPAmbXbMbIrXZOrhls7fxlrudt9pLjDaqaxguCx5Cq2Fcq1/D4BRK5hutSrgmAbzRs1PIVKvaNAn5xzXYH5YrubYsZa7S/z9RBVBtMsme5VtzoT6Gjg2nZRX93dg0qalAlbTwcUtIR5VodH8Ttttjd2pIkodLRKD9ukA++Ws0/8tAhKZNrf/a960RJsFhln4ysSbpiIKVW6xk6u+aSEFa4RXItIMFMlL9c16yhHmOp8b+f03UWkCrvqyDXqtRAINdwXcq1DVWvMPTtLoVSsqXfb5fepOYVi7ILfz1Tpf2DLFHpDZHGB1+GerMYK2da1jnDunvfZ0nFK16OlyNXtmbp9q4u1+r4MCOwqvVcU5KIFH/2QBYet2DkIC5hufaUfxtlGsvl2hpQtldPTtoqKaceu/kXn64LpplvoYnPQ31shL/xkR98CWJUbVIf8x/krFwbR9FL0Lil6FqCWVnXVyLX0tw7FKj41ZevfD3mo9VLhAiXtnVBCDs3CUTYEaXsWmVFMWz8oyVUGk7DTsGke5Vr2CxoyQGO9r6A7o6fVG83wKZ4wHHjBQbGHV1drlXyIVMCIDfWkiTlcnCpGJGmgHL5nxoguViQa0tV83JC3R68rhIazcSa8KWpwfXyDZ0j+NhIp1j/Cu6jDsHiLp1UMNFRpdMUBXDjiqGiYFvbManKfQXPdzD+GrkWz92a6BKAyVobB135Fhxj50aBSDmrVO8m+ylUVFfUFsO5GMpROWOsSoElgAki/nxMKHizIEkMHO1vi9ztDBuYJV4Ewyqw8SIDw44uL9fq+ICtihzUniRqoI4luEpFRMKJKp5qQByI4D8vOIl/Mqo+VyK6A1ev09CPqSvf+//k5wH9eKEfvOPobycJ5RpxIFZ6+e+5PijXqNa+FFy9TkM3pr6yWuvHC/3gymqNco04EoJe8HXTR0C19q3g6nUaaOoeQC8QEpRrxIFguCEagnQ6DTR1D6AXCAkr1/4RBEEQBEEQHYPZNaIl/nF3SLQD6XQaaOoeQC8QEv/4MpQ4Dgw3REOQTqeBpu4B9AIhQblGHAiGG6IhSKfTQFP3AHqBkKBcIw4Eww3REKTTaaCpewC9QEhQrhEHguGGaAjS6TR83NTv/Ludn/lXPR/3Qj8gHybKNeJQMNwQDUE6nYZPm5qr8zR93gv9gHyYpuSId3eKfdUxp/oOdxBWC+j/TGxOx/sNp/wOGG6IhlB0Qmdu4kJYR96xq5Y6wjP9t8+oWdlW6ShkfHBsbS1/HOGe8HjakzsPExyxbc7lvvmCYFqiLrZb4G7XSzrCqApyn69iOw+4dMH4ST7oWhkfbqINe5K2aS1Ta/YA7MfYTkh5uaaOYKVg6wlRuDnpNBAS4rcg6CSOQNYHJrtCCci7l2vJRQBHddvs8z6olSMby8be12r5W/Y8CicJhcd4G8bRmU8Yd57bQ5s4ix9bXWy3hDkP4MhghLhK2RGPEVwPuXQ5uUY+mOmmfFhfhloZNIyjMEiu1pLIoM2qmikK3+H+9AcZPa11yjtSWD57ctW042O7Dbb40VOUvgc+3Oj9x8yH1ewuowvctOv+CWw1iK/FRicVY5aoAgtVzERh/bVaqmyLOzrgg2Z1C0DOReGsVa1KnCIUZrP4wfkpmHuS5TlYm9YGMr/4kUQjxFUiR8BdwHZzwKXpcnKNfNjHh5uqrLSeFn/J+pddDeWarBSMGzYhDSJ3nmoXKn5Jy9XP4pd4MEQOSS9lVlUmSFzjPnB/wJ+0b+LrsNJJu/jvN1g4OeFldlyVtdC+eNvXqQQ/kFAovpuACkQeiqQv1Xohy3yCUFjM6owDVliwPOOdc5RJWEyQ+sWOJBxhNLDAEWh5VmWQS9PF5Br5sJcPN11dpeLXiRd0i111ZcIjkGt2VMsFlPr3cg04yg5RNojK9QWrblc7cMHfiWB9XZHwoeymMn8M+G70yxHRafY3LIyaWp/miloqyNw0AaNUe6nZMOKvqePbbRhsoH2t1iu8P1wobI9yYY2MC5cLOnLn3kj94tduOMJsYKkj9B3eSY5LF5Jr5MN+PtzM/X8Cb9WEw/1ZzDL54LCVJMutgUqZyWGH2bUo2SIrReU1cg0NhshRk10DfKhzUxV/4r6Jr8Nr2bUAIr4VasGIp4NaYfuPgng5iNjH4LVaRUNAHCwUpElr/JZMwqQHwF3SbtXZlHiELwwsqimyLZBLl5Fr5MMrfFD/yGN9CSpE0PwtXb7suWFVybXaNkO5Jn8+IruWTJAIUPft2nLtrexa5JAHv137Gbz27RrGGi3KtUBheUmJm61TXTbMvFbr5WB1sFAQSQe9wwrcFq+CSdRfe7JKOXK37CUcYe3AioZfqiZcuoxcIx9e4YP+v2uPUSfwnvchyui5fm2kGR/mR7VuF3eAUSJS/2ZaB2I4K6+Wa2V1Scwo/WVoIL/q3GTuD7ZRdNTvwPxlqIspsHAL0NtfYamoXaiFn3eXdN9GkDULM3HFb1leq2WGtg8nCoUohxHdE/nR14V2w+72vUS9111ynyKtG0vPmoBL04XkmgT5UMsH829yH6OWkFaHJXiq91P67fDyqla9KEYVpKJVYkqJb9O4fCGKVDAsr5BrcDBEilK4ieTXVOOmqcgf4rcQ/N81F6F04RYc5SPsRE1Yy1ArbUxFZd+s36KvoWXLE8Oh7K/lhvO6qY9Fng+xkx/uT2x6XzewG3I36gWOMB9Y4IiAS9jDsuLV5Rr5kPKBpxoQLXHJcEMcBdLpNHzE1O+8tvjJVx4XJzz5YEC5RhyIi4cboi1Ip9PwCVNzdba4NuHJB4t35Br6+I6voQiBa4cbojFIp9NAU/cAeoGQYHaNOBAMN0RDkE6ngabuAfQCIWHl2j+CIAiCIAiiYzC7RrTEP+4OiXYgnU4DTd0D6AVC4h9fhhLHgeGGaAjS6TTQ1D2AXiAkKNeIA8FwQzQE6XQaaOoeQC8QEpRrxIFguCEagnQ6DTR1D6AXCAnKNeJAMNwQDUE6nYaPm/qdA+R+5vC5j3uhH5APE+VagN/8J3vng+GGaAjS6TR82tRcnafp817oB+TDNMVyzR6Td9Bs2xhS/L/elxvTAo1yrQ0YboiGUHQSIUo/uIVQMN8SHCMc/5NvcLifCZKwQ32PuCU85/PlcYJ/W/7XX7EvjzOe3OhU50kdB4xdmjga1y2TxBs8Z9OuxlElc5A3qHWt+PmLfIg8C6v53o0xMrlmThw94riCBnJNHVn/GF8dJeXaEYjCzUn2/Z1tFTFNik7ilGR9hLsrlJhLHy64ySPYEWF0a8/7MNyf/H2iZwAAIABJREFUOkiqMCSAmQ7PiG4wTtPE+KjoC+N4oWBWUatLt6mCSWeO3uoufpqUexLmaIPjrhfsaNxUc57DTU3TteTaL/Ih9qwYHRh59MzWyTUzQKcH9ei3usVdnag483gV2Ov9UXk4UnkBit1tpH+eVDueNRBnnRJ18OFGb1kSOyfuq79/WrZsFG2/gI1OKuIsDzUsBAFchQy3MfXBMxJHYTsm8Lq6YvXRpe+NEw4N91XE4UJBGcYMEo9ZzSkK6dF818pZ3XQtSaxYarzEh7CnC8m1n+RDUKhloe89fGar5drW8KYxsb3W0ooUipFrKEBG5coMLmIpLSt+gXLNXyh2SlRB0utPTylLpk4P3Af9Aglo+6EXvxwrnbSL/36DhVNJBunHe/tlqxXGMZtdW9s0y7Pdsj7vw20Y3CuQd8cpsF0O+iriBKHwGOcBZbkUc/vmEOTouO5mkaxuuApjSVzfeIEPqKkZF5Jrv8iHqHCtj3uPn9kX5JqA3j9YQRS9H8CNRkIqFFi2HRsQTYoFhd5UrhU7JYoI1tcVgZ33us+2nrCEiu2LEdFp9jcsRM0Auqwr6OClWUgblZUv5uC3cCijfRYkd44Tjri2L4tzhMLfjBKROolpB/ux7C2aazMlSblrhMrGUTXwRk1VuZRcm36OD6XCoPf4mX1FrukoZdQWylJJFaxrtZJrojef4ZSNUK6diprsGrDzXveZddOvncyu/QRey645JJeQNEvlms5+5WFiaci9AWkzTlitti+LU75dkwtKaYUVK1fo6KCuXf52Z1MyoVvdeGYB39SMK8m1H+RDXhj2Hj+z+79ds6+d9M/4xUEYXNrKtUg0Mrv2KdR9u7Zceyu7Fi1eD3679jN47ds1h3gFwIEqCl9+b1y361b1XpJrWVf6Wm1fFkcLhWiZzB7l9a7A0bCuXSlf+lapZuEvNV5oE67o15Frv8mHuDDrPX5m6+SalLsm0a47C1bG0Obvy7Xn9rcX9nU2TJbaJGGssinX3kfpL0MzpyP3ZfcHTw+F2u/A/GWoS9HDQh8uoyisbnRvJFR08LJLVlh/lH+pbj5gsre2GOdknpy4ryIOFwp224/S53OBvws72q8yxm+uY5TFV24GXb/SeA0foGeuI9d+lA/Ys+ahhyOHz2zl/11ziba/0vvo3nyq1dS+MrVokV2TQ7WyOR3++JCtLc2sgZhy7X2Uwk1iZ+i+5H7NWPrrFxH83zWrVkyhCY42rgni2PABG77pVVZgZeZWV3YoWxdVQa3Xx4kUGeprn6mPAbAN2NcH4d072te1VvRf8yjRaw0erix7Gy/xIWrqUnLtJ/kQ9Kie0kIcU3NoeqoBkxmExqXCDXE0SKfT8BFTl14fHlW3W1yc8OSDQUu5RrVGGFw83BBtQTqdhk+YmquzxbUJTz5YNJRrVGuExbXDDdEYpNNpoKl7AL1ASPCId+JAMNwQDUE6nQaaugfQC4SElWv/CIIgCIIgiI7B7BrREv+4OyTagXQ6DTR1D6AXCIl/fBlKHAeGG6IhSKfTQFP3AHqBkKBcIw4Eww3REKTTaaCpewC9QEhQrhEHguGGaAjS6TTQ1D2AXiAkKNeIA8FwQzQE6XQa+jR15T+L+pn/KdWnF/rBO47+RpJcXa59o8++CAw3REOQTqehS1NfTa316YV+cDW1lsu19IysvdhzvnANzIF9L1r+K532PWC4IRpC0Qkeq1c8HzO6oS7WzWcAguP+0ihiasnCpBYaqT2l1I1U3yBaD04cDXHOkzuPyp1rH5hUnhG8ncaITm+U50ZWk8QPJmfTrsaLEwSmuF78fJ0PBfdldc8iSZEOu/kg5JqWV8/70Nmp2eLU+jdUF+XaoYjCzUlHhNC7vwVBJ3Me+naAtiuUCG6ojHWP8TaM4xp2xH3P+xAyzdQypSE9H6Mc3d9txecG36BiZR2OFwqz0R96aJkHtxXW+k7NeLsNOyhhjhtM2Mmuxv2sa3qfpmvJtTf4AOumj+dJJClczXsv82GVa/FCB+Ti3Oe63xkf201bdy7orPfXCmI/DtW6chRqBAldLuiHwocbvWnYy4QXmFPMYhBfg41O6rldNAostPHW3xDGAKfibuMjUD6iuKrWHK+cuIJLvKiM1ZioBW/QWYg6nCUUXBhHHlyuiUkGoT+c7Fon6yKUtQW9W2q8xMCwkyvJtRmv8AHXza58gCTyKlbytn6ZDzdxZxDB5EorHp9len+r5vZLsEdU4lWWCw1YfFcA1bM0tYqiYOSUa8dC0ksxQ5XVMyG6P3J61jfxdVjppF389xssnERwxDfEGSsZVZe7gpgs+FdTa1kuQLlrHbUXjhO9033eh9swFN7JWHxErkUenCb/JjTYcUfSdLkr6yJccEsf8pQaLzAw7v3icq2WD/AGCbPMf4Ak6mqceLWvQ+vkWo2K2UKHCiLqFxPFYEp/tZ2NRfmmUAam2LawEdER5dqhCNbXFXuZkNxfsXmis78cEZ22XJUrlNXxDftjXZb/qqlldrpRkJOvK0RNgWzY2ybH6r2qZ6ADuWa/L7K6don9wxYTInNu5SlJUBK0ztIVjecTxIOnXKvkQ1zoy88lSRWF4KhayDUdMJrKNaQu4zmqxJlJxWiAjScaFdEeNdm1PUxI5Bp2etI38XV4Lbu2At9QDgGSdaDZYFsd1spWpKh7FGlLWCbm3uwU+pumqQu5tkPVioUlSH3idb5yIc9UbnXjr/ROubaHD7jUPp6fIEnxKooh9XItimFWGH04uwbMGwU0PHLKtWNR9+3acu2t7FrkRX679jt47du1DTu/XZPVou1A/AokqlXcWzjobX8tlddae+XhNE2dfbtWer7huiKu27zc7s+Satb4UuOv9H5xubaTD1VbqfNJUrya7Pcq5docVJTCNDvRx9g6u6YFaCmuRH5NHiw/csq1Y1H6y9C9TMjuz51O/ADMX4a6ZxiHGxEN43jkY115y2vqiZEltdxlyfXt4vM+qBcG2Tq11tq+z3UftEW9R/iMXMMOStRa/mEfdBDmABgMdsErjRcZiEwxTZRr+/gA0mDwSTyPJMFV82zWq7/s/66pbaDcTf4V3MfGck02v2PLaZs3+9ds5FzQj0Up3OxlQnI/djrxSwj+75oN0aZQSRRYK4l1BeGlsSbr4loo4Gi9KeO4HarNzFlZKYdkXwDJMe409SGw5nPzLsiwPDagHsyfw8nacDDQBS80XmRgYIprybU3+ADrQgedTJLgKn5gt95r+XC5Uw2IQ3GlcEMcDtLpNPRj6soXwHveE38N+vFCP3jH0d9OEso14kAw3BANQTqdhm5MfWW11o8X+sGV1doXyDX0xS5fdn0JGG6IhiCdTgNN3QPoBUKif7lGfDEYboiGIJ1OA03dA+gFQsLKtX8EQRAEQRBEx2B2jWiJf9wdEu1AOp0GmroH0AuExD++DCWOA8MN0RCk02mgqXsAvUBIUK4RB4LhhmgI0uk00NQ9gF4gJCjXiAPBcEM0BOl0GmjqHkAvEBKUa8SBYLghGoJ0Og0fN/U75838zFk1H/dC57gaSSjXiAPxQ+Hm6//F4g/gh+jUOz5t6qstxBif9kLnuBxJQrl2wmzMAlh9+nABrdoh3oekV0O/fMLFlGufh1+95n+iDf0yX8I02f73Njx0NvMzaDY/NjA46LPcHbpDthWdcm0OILQzLs5wmqYDhMI8sshu4BhVdxLsC3WxuYK6vpeij8DAghNN85FHbr2aXGtMkqDQ1D2QJOB//AMi2TbjWh3JNeL38EPhhmz9PBydHuNtGEfkmOUKjtTqFPfldHVf5uGb1VuH531wPULmFLsT7a4/itaf9wFVEyfQ61v00lZG0yd3nsDjrtyBJiiuSfO8WBebC9YNesl8BKsoB8SmqHXrD8XPIg4iiXWQrXssSdwM61gU1aqRa3O4WSWfmIXWotVqdbg/1S5wM8Z6O9wMQh3rCv3A4GbGz4hoDptdSxm1XNnl4vlpg64sZSKmKOfwMmfMYMbH1pR8ONDPRAXs6jUHXSCH5iJlX7k4arVlXSBvcGLMNBuGaFGxIPRxd6ph1IKoZvpax2ta/pxc88PJJ+gH+05d3UBWN3wg4yfVXMG9v+bW6VpybUY7kmSFJ5PEXnbKs5ZftXINqDQ5JTMUXxwx07wM/ftVad+tECxzeqdsTa32KuKXYEZEayRyDdn/VRdLtggOIXpKQJpVcSbJbZi9xfaLnRrF2m6YaLX4z1py8SaWa35fqB2pYqn8BTQbK7FquYa701NCVNHhEsk1O/2u5Fo2wYKE3lt3KfecsIaNHsnk4wvQ3uB2nK+5dbq8XHuHJFnh2SSRbcNbw7XAhKf67Jqf6naLlmWyXxlR8RYY9CgvQMuuN0TpRd+OaiuaEdEYaXZNXHjZxdGWK+Ih7GIKqRFfyAftfnESYRgo1nZDRSujmlSM9yJZQSRVh2GQqidOxcJmq7Z6Mllr1vCwu1LSJpqa6UvnKfwYYpwr1+QEy4vuzrqqPDWsq55Twlex6h4teXvcSrn2MkniwvNJMpUiRSYBZa135JoSo+A9kgkZyyUQV22PSBLatpe13M0S5/9Uh5RrJ2GvXNvt4ohECQ9VM2nOWLUfsxXc7H4xtz/GqjWT0JB0CuK6tHpN/hL4sbS1fEWuFV6GFt6Jgc1HMLFQPXxNdg077Z26TkTtTpxgH4Eq7iWaaW2vWynXXiZJWPgBkhQjUe183pJrf1dsKMvjV5j80hfgZtT1wuxa39gn115wcZZdK62jkGYnZdeG+53v4HdD0CnS4zqLFAn1FaHqNnWiZmv0WomLMFa7hV/nZqMZ+bzAtg3pSq5FEwyM9Xpda67YsNmqmq7RwcqO6ux068Xl2lskCQo/QZJilCiHgBnvybW5m0FeLu5otdGj0OInZ77VEMmQLdm3BmyZ6wObYsq1k/CyXNvnYrDpyjLeGc1SzkQdwXlFck0lACnY9mCjE/z6I331hJZDUfa8DyqLL5xla7k1WQfEjcsw2qz3FboDjHG9wWl8R3YtmSB6Jl6rC80F66JeAh+lAzOZV/xjpVsnyrW3SAILP0ASXw6jF0jEutbelGt/ixiYv9nayt2pWtD0LTKV5jbHa+Fwv28r7dYbfEEhWtIqk3LtBOx9GbrfxXNT8PMBxEP9FECaxZyZ/+AakbhertkMIpm3AyudCinXPwRyTfDCRTJEhVSumZqKyUrom1squnO0Bzm+lVNBXzqj+ym5ZsftBivfQhm/vlE3MBeoi3vBPqoeWJA5q3brdC251pwkqPBskkwwhBj5DmYd5NB7PNXAC2yuaV+K48NN6U1TXpM0+ypcafX6MD5i6tcf5vfqdgsS3uPKJOlRrultMlMQX4ye5Rpp9nXg6nUaPmHqKy/EGCS8w6VJ0qNcC14vEN+HnuUaafZ14Op1GmjqHkAvEBJ9yjXiR8BwQzQE6XQaaOoeQC8QElau/SMIgiAIgiA6BrNrREv84+6QaAfS6TTQ1D2AXiAk/vFlKHEcGG6IhiCdTgNN3QPoBUKCco04EAw3REOQTqeBpu4B9AIhQblGHAiGG6IhSKfTQFP3AHqBkKBcIw4Eww3REKTTaejT1DVHtB5R91Po0wv94OJ8oFz7cnT2v/kZboiGIJ1OQ5emvtrq3KcX+sHV+WDl2nyi1VfMqvL/pc4zskf+nTHD8Di/lqBcI34Xnk7+cY4Kp2nKn0F02GPagO6gFCpN1+jE06oxuxOXk//zHB6YXA5B5zy581jcadexjeS5kegu0GBW1xxrErIiOFsWWLBkXVwdD+l68fP3+LD2hocRdBRNJ5drj/E2jON3HNxQL9eGYbB+OUuumWPE2yurL5FrJ9n8K3dQRAhLpyU+KcrDwj8kz+BjlKcrQ9boY5ef98EcOZuGStn18z7oLmrHLCsWnyGzIs0/m9Olw2BxvFCYu3+4k3vD4Yn5QGfBBl1d4TZhTdgvbDA3e5FFqDoe0jRdS679JB/WzqKnO+goYFEq1+Y5gfFAPfoYb8P9PopCeNtsnnXft05Bd6NkR7G7YQCnCWHR/Bj/LK52NjAClsYQHzoZTdzRDe+VY5NC1b0VDvd70W6nwocbvTuZDe7JMCU23HP/9FUJYqIATaeZDE8UPVWhiIj5MyiakOFSRNOQRkGojLrW49gxZvELXie2iur6EstczIlmdJZQ8AI6Gh7eiTqPwsN/g13sem/WLyTYvokZb2bVdW9Xkmszfo8P6dNdeh5NZ5lcW+ZkJyy7ENfMuqj2CeIXtV6bciiV6roz9aPel4Zx2Ns5BlyaTdy/P9lUGKhi5riJbjN8OUxgWrCdPwmSXn96Ks5VC3NWkUeaPyBJ1jfxdbB0Gh9AzbjCTK4BEaZ28YH6schCJej65THbnzO59hcOxoeJTVomRum1j8i1bHh4hfUZQjSp6J3D4vzULOBXmxkACFhUrK75eHG59gN8yJ/u0vNopxPLtUARoIgEhKILJuttkUYOpFJld6Z+2Luuv5osl2sVY9ARMZw4XirCKvGGfq1SZ86YocdipVewMiQGryBP2UEaaX6E6B9btNqIADdekRBJ5dqatA3fhAbkiUKlu0nAi65szKCiLcdj+5sT1IlpUOhArsnhOeOEzvJmLJMhNUvoUrwHzllUqG77olz7bj6Unu6wo2A6oVwLzWaixBYMdDwL1ZTXF6hcrcQV3Zn68UWTMhvUG4y9Y0CCK504XirCKuiCCdDmljo1expqsmvA4JXkqXBQ0jfxdVjoJGmwPlaw0KAmu5Ysw/HWKdzNBl372FM55sp0nx7x8z7Mtb41u1ZQwTZWqFuDujJxsSebYtuIXIBZlFb3qSHKtW/mQ/npLj6PZjqRXIsXwDBKHJddq9rt7s2urW3cq+RasrGeX0xLv9Rl1wKlGsoW+8Lvm7JrK2Zi+dzCNL2ZXYsio31pTnwvFjqte08ZngYXsfzbifgZTO+Kb50q9gqw0bk1OJF8zGHUSPtbflOTyFro6tu1bKDWWeh3qL1NOj40Sy4N4qCaX3U3eK02XV6ufTkfKp7u4vOo2wzkmuOOUHnRcIG0RNpSrdeyLbMZLAlpJNd0eILK1ic25Wq+cwzLpSH9bA42sm54syqhXFu+SpnAdxHyl9LO/WiU/jI0kF+pDaP7gx0ThdrvANEJul4VmicEP4PP+yD5Jh809ZSq2osAikJl3DVYnOvGXMqubdft7s5l49On4zNyDQ/PzTRwFmrQW8m4MekXNLh9Phz5MGVRUB0OaZoo176dD2Et9AG23IgF08FyDT3I7um3gtFXEupSx0ixrbTJ4L9CparqulvukvLPS1qbZZpraU1UPQbUQDrxXGa7Kyhb/nfLfQTeGB9P+d8FsAXORCncRPJrSskD7w8dRPwMmsi1gCXyUhiCVf2/BTgLlXHXhZxeRUVbvok0EAHhg5I9JOf8Iw/gDD88oEuhs1CDvq5Pecj9ebFBbNN8YEZDFwe++fhKcu0n+aBGiJ5u2BFm0fSJUw2yRCbxY7hSuCEOB+l0Gvox9TsLxrcvNv14oR+QDyso14iWYLghGoJ0Og3dmPrKq3M/XugH5MMGyjWiJRhuiIYgnU4DTd0D6AVCgke8EweC4YZoCNLpNNDUPYBeICSsXPtHEARBEARBdAxm14iW+MfdIdEOpNNpoKl7AL1ASPzjy1DiODDcEA1BOp0GmroH0AuEBOUacSAYboiGIJ1OA03dA+gFQoJyjTgQDDdEQ5BOp4Gm7gH0AiFBuUYcCIYboiFIp9PwcVO/c4Dczxw+93EvdI6rkYRyjTgQDDdEQ5BOp+HTpr7aQozxaS90jsuRJJZr4jCst2eVnZeXHozaBvNUzCyO6zf5R8Dm1LG2dLGnJ8an3UqqwiG14jLDDdEQik4iqGxUhYWwjryjUMtVVYe+pxW3p8ucW50dM5hECRjKohbeOT34nCdXGFCPSx/tPN8GznqGlhd1sYOCur6XIi/2DSwcUkBLxs8peILWSzlJEtqfRpKKRw+MXFSV5YFcUyu9PHX+NWgh8Rjro0YLPMbbMI7nnaWQy7UDJ270mgvta+9GrmGiHCnXTjra4it3UEQIQSex29IHaLtCCci7Yi1b/rwPf8dFq4ifNayPfZfVQHdxlKgLZctdou9Cjx4nCIVkLGLEsxEfPrRFLtvqYgclzHG9eO+pfvYNLB5SGA6vLtfwE7RdLJEkpP2JJMkfPdjmWlU+xdOUyjX0JAElOVNt1ZDw+UPWWhrQkwz2q3i/Wd7cLtO+P90ToYcw3O/j0s7sQDgj2KOsPgxinwSdg/cIW+/JvIrzVXZ2oX3r/INyTe8kEvLAye69f6rORxBfgI1OiqDLsw0LVehF62K5VsXTIJ68taLbpK6lwSMJ5JUbahTKlJi8jQ/RedBjjuOFQjISf8lv+IHLsmbhmwVbNxSQsbKsGli8d5hLKdcw8BOEf3W3Z7Q/iyQVD3tQ1T3F0zTFL0Nhfm4TkiYYlAKbH43abKoXc1IGbq36yKM2tHh3q4xkx2AUo3s1IqcnVBTo0QqCndk1Wz0wQlguIbqeu8K6+CNy7U9PqWYj8kSmDslWMA7qm/g6rHTygflPxrjCyck1s5kq16pJBZuHyyexTcT72xaqzVVRrmWhTG+A/M7N95jjcKHwvA9yc2t2WHaUauSRy4K6S7m3izVIZJ8o6Vo7MFx/YwSg5YyLy7XoCfr7LSXJlND+RJIUH3bYJnyKp/xPDZYkRq4LdDDDhqiTa8Dabj+6tm9jaEkvw1eFMMEXbdfCHq22yeWagNeruREq9gdrY0uOFxrMCh07pPZyLeB4QJ7Q1Mn9e4xDfCciOm1ZJ1cYNbXuAcq1yrQJZZB4uIZBb7SjyDoFj2QSyvRAwmCa9OhxuFCwGjPfiiaqSLos28bCUKHdjdb15GXGjoEVKqpS0dnV5Vr4BJVJoqoXUlm2vC1JKh69KC+4R65tddHmFL93f1euGax6yCVU6jRS8jDtkWv+VYu8bZ9cg9k1LdeQEULj+B4WMb8aarg/XVq2n+waIE9o0USupcZhdu0n8Fp2LYB4UvJapYchyb2gVkzAAzXhI5npAnFLnpePevQ4Ra6pFxqpFK3LrgU+t8pwd+LEqqjdA4Ozx9eUXSjXBMzblwJJQtqfSpLKR0+2GT3F01T3jzyW+vaF0xtyDWqlSOaoxdgPIOk4W8Y/lV2rkGuREarUxvoSVOmxh/XS+XJtxuwSRM03s2vRcB/8du1n8Nq3axhrTCrXyp6GOq1W+Z5luxdmDkrbNZ2VW256VPTocc7LUK9zAreFW+14KRL32jRj5O7YOOkaXRxYYUhxe5RrG4xaK5EketDOJEm1fLebq+hRx3Ltuf21hJiKETgFuSa1ph82lE2x7g18E70oEBk4Zz6g0YBcQ5+2RD0iuWZmm2kj0Hueqk3ssPQhX7w874Mu+Khc28a0LF4l8lgXRPcHOyYKtd+B+ctQ9/jiZ1oEMBDVirUmtzNewiPeMKPFGPcWxarghWwaymyFID7FaSKD44WCGWG+8QoTJ+l2HzooDvw+cpfNVjMw6SAwpICW00S5tsE+jmWSYNqfS5KKhx20GZfnf2pgd3Gr8Bvu9xE+JLFci7aF2btAKDjBcOwfRtm3Dqi3UnZtbdxIITwM1c8yiS2m75BroRGCck+Sx6htPFez0/ioXJNDC1KzoXOD+yOjEb+D4P+uOa7753PLgyOG5LXMLTfUmggVWnuA3uAocrlWDmWJXIvnXWvqgyDsE6dNrJVl2FMT8nUDByF3w17wIrh7YBED1yHF7rm6XINPUDVJgF3PJknxYQ9YJKZaI9c6gt+/HLwWV793JEq4erghmoJ0Og0fMfU7kfcnozYJ73FlknyBXPPpN8q1bwHDDdEQpNNp+ISpr7wQY5DwDpcmyRfINfgi4ujuvtqp/YDhhmgI0uk00NQ9gF4gJL5CrhHfCoYboiFIp9NAU/cAeoGQsHLtH0EQBEEQBNExmF0jWuIfd4dEO5BOp4Gm7gH0AiHxjy9DiePAcEM0BOl0GmjqHkAvEBKUa8SBYLghGoJ0Og00dQ+gFwgJyjXiQDDcEA1BOp0GmroH0AuEBOUacSAYboiGIJ1OQ5+mfue0lW88ka5PL/SDi/OBco1oCYYboiFIp9PQpamvtjr36YV+cHU+2DND0Tl1+BCt9U59CBY2iD2awJ17ud5gjtLzTaPz8ohewHBDNISikz9xMirUmG+JjgON/hG3Pb3QHzWIOnR9/cHEUQ9/Q9SUr5UdQFy9QH32ycX20ecPQoOEVhJ1pUWKzHnBg8FRsWk/Qe+MnzPIhxmZXBsGe97TY7yN4zJPc3Y5Op8YnFEvmlfngOpxReeOU5h9F6Jwc9LBEV+5gyJCCDqZU5K3M51docRc+tDRp0zG4sl30RHsrq/lyjCOSZP2hrgpWE2N5MVH7ZNCIbCPiP/QIJmVtrrP+6DWabfrt3Ta58ESVdRCuTgm5C3l2jSRDyEflFwbH16+irJgILpOtGCqyi7MbG3I+pGG44rcLXy40buTlVJ+8wH3PHvvn3DGgfhObHRSj/2iSGAhUG7PGrmmQ2Yqk0R7pb7W7mwAFDeBG2BTtq95mHY2XyfXoul7L8AVCBYGHlQvcQBzggajEYYdwb3DVj/unXKNfEj4YOSaS5WpIpwXVAOMtaUYxVzDiEv/I+Xa90HSC71fVxQSrlRpWfFLdL/6GZAueLdPfBdWOmkX//0GC6f35drypiF6n2h5mMq1pbNQrsEbYFOmryU8gtkl72IifEoohNMH0b96eY709uK5iDmwwdhBIVXQ8mz4hXunXCMfEj5YuSZC0TJFnz3TgUBezz4sW1tespEqbYeWYfhVHOVazwjW1xV6pYQMSC6Eid7gcSRXvhwRnba8EpAvHomgieQYeF8iL8es8rF323ikD0RZrkX9RPeFn6YgfEYohNOvT5zU220rT5mzx4MFqqz3KKIlvV9drpEPKR8yhTmHAAACnElEQVScXFuD0VoJRcHnfVA5D7edExFR/U3C+NAvLYb7Uy/JzK59NWqya0B+WaeutyVyzcA/ocyufT1ey645VGXXNrh3E3ZvnSWt5HXZUbi0xDdkXalr4Y07guUnhEI8fTyjuuU5sIZdSauyKSUPplQBoy/lcq4t18gHW6so1/5+Ul+TpbvC0oceai7D/fkYtR572BWZcu17Ufft2nLtrexaRAJ+u/Y7eO3bNYedci2TQsXwI+/XrwfAtiK/oSBA0/1KqQGHTwiFcPqBh6qWZ1gXfPZX9a1SyYN1qtnezG/XMMgH23tZrtnMhPhEYut7x3e5Ao/xNgyDHpkqoFz7cpT+MjSQXzpxLGie3R/smEiO34H5y1D3PUT8/Wu2v8bBX9QS9+u2/PuN4rdrsBx9NFLOrm21YK9/ChYG6TI+LRSiHEZ0T1To68pXQSuCz6XDXip612vitrEEn+SGvX/aC/2AfJimKrlmgpJZU52k3CHXZnFqbOn/ro9y7WtRCjeR/JrUxkWvj8H9OsFQTUHiixD83zUXQVxEknES7tX99liJG3GL2UsaopX6UqOvlmu4qbUWioHiI5aXHopPC4VwjzZNU2AQVOjr+oTI9hbJmGmHB3WxpYqR/qA9SObPe6EfkA/TxFMNiEPBcEM0BOl0Gvoxdeld9VF1e0A/XugH5MMKyjWiJRhuiIYgnU5DN6a+8urcjxf6AfmwgXKNaAmGG6IhSKfTQFP3AHqBkKBcIw4Eww3REKTTaaCpewC9QEhYufaPIAiCIAiC6BjMrhEt8Y+7Q6IdSKfTQFP3AHqBkPjHl6HEcWC4IRqCdDoNNHUPoBcICco14kAw3BANQTqdBpq6B9ALhATlGnEgGG6IhiCdTgNN3QPoBULC8OF/VnvRFLaJK8UAAAAASUVORK5CYII=" width="400" /><br />
<br />
If you have access to the Google geolocation API, you can then possibly geolocate the WiFi access points based on the MAC address, which can tell an interesting story when also lined up by dates & times. <br />
<br />
<a href="http://www.lancemueller.com/blog/Parse%20WIFI%20Profiles.EnPack" target="_blank">Download Here</a><br />
<br /></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com2tag:blogger.com,1999:blog-1746946614390371171.post-25737713392890615982016-01-07T07:09:00.000-08:002016-01-07T07:13:39.099-08:00EnCase v7 EnScript to export files based on condition and maintain original file path<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
A reader asked if it was possible to automate the export of files based on extension and then also maintain the original file path once they are exported.<br />
<a href="https://www.blogger.com/blogger.g?blogID=1746946614390371171" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"></a><br />
This is certainly possible, but there are some risks of doing this since the original file that is identified by extension may be deeply nested in a sub directory, whose original path is close to 260 characters in length, then when exported, it is placed into a new export location, but also maintains the original file path, plus adding the new export path, pushing it over the 260 character limit.<br />
<br />
The following EnScript is a slight modification of a previous export by extension EnScript that uses a condition to define the files you want to export, in this case by extension, and then exports them to a base export path and maintains the original file path into the export location.<br />
<br />
<span style="color: red;">Any file with a new export path length of 260 or greater is skipped and printed in the console window. </span><br />
<br />
Run the EnScript:<br />
<br />
<a href="https://www.blogger.com/blogger.g?blogID=1746946614390371171" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"></a><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-1lzXtPxnAuAOCDg-0q87hkgHENTKJBjKRMT0h7NgRdJXYt1n1w5CajJBwz-Vftvq-2KMoJqZfu6irJrBfTC-EU40X-5Kn4lbsEoidxxftwDEQr7HqZGnfMFBSbd0AJlf0EK6nzMTVP0i/s1600/snap1036.jpg" imageanchor="1"><img border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-1lzXtPxnAuAOCDg-0q87hkgHENTKJBjKRMT0h7NgRdJXYt1n1w5CajJBwz-Vftvq-2KMoJqZfu6irJrBfTC-EU40X-5Kn4lbsEoidxxftwDEQr7HqZGnfMFBSbd0AJlf0EK6nzMTVP0i/s640/snap1036.jpg" width="640" /></a><br />
<br />
<br />
After you set the export path, you will be presented with a condition window. Create a condition:<br />
<br />
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT3UA9D-Q_omNEjQqhK4XoVmcEBeRjfKGl0kq7gcI7w_3fINapGRfheAE5WzYVMVAYlf3fD3avkZB0GevHLm55lDNONLv9NLO0zfKRx9L1pjYQw4uYMl6wXtVJz6xX7KpBV9MBPbu2pkUe/s1600/snap1032.jpg" imageanchor="1"><img border="0" height="302" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT3UA9D-Q_omNEjQqhK4XoVmcEBeRjfKGl0kq7gcI7w_3fINapGRfheAE5WzYVMVAYlf3fD3avkZB0GevHLm55lDNONLv9NLO0zfKRx9L1pjYQw4uYMl6wXtVJz6xX7KpBV9MBPbu2pkUe/s640/snap1032.jpg" width="640" /></a><br />
<br />
Click "OK" and once the EnScript is done, check the specified export path.<br />
<br />
<a href="http://www.lancemueller.com/blog/Export%20based%20on%20condition%20-%20maintain%20original%20path.EnPack" target="_blank">Download here</a><br />
<br />
<br />
<a href="https://www.blogger.com/blogger.g?blogID=1746946614390371171" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><br /></a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com2tag:blogger.com,1999:blog-1746946614390371171.post-63579558546385856102015-12-28T20:20:00.001-08:002015-12-28T20:21:13.187-08:00EnCase v7 EnScript to export files by extention<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
This is an updated version of an EnScript I wrote in 2009 to export files in a case based on file extensions. <a href="http://www.forensickb.com/2009/07/enscript-to-export-files-based-on.html" target="_blank">The original description & EnScript is here</a>.<br />
<br />
This version was rewritten for EnCase v7 with exactly the same functionality.<br />
<br />
<div style="text-align: center;">
<img alt="" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgcAAAFxCAIAAABoUJwtAAAgAElEQVR4nO29e5RU1Z33Xa/rWe8MWe9accZF1MfWoAhCuAiayOSJEZ9MdNQkkBiTUeFREEUEREjogAMG0LTG0YxREB8zZpLRREczKt5N1CCCXJrm3jRVXVV9q75Ud1d3VXXdu06z3z9Oc+r0Ofvss885u6pOV39/67Pw1K69v/u3L2d/u6rbKg9RxcVL6y+5t+GSexsuWhK4aElgwtKgzMSVoUkPtE+t7pr2YLf874yNkWkP9k6t7v7Kut5pD/Z+Zd0wU9ZGQMVw2dooqACmrO0BlcKI21Nzw05cFZm4KnLp/eGJqyITlnVfen/40vvDE5Z1T1wV+fJ9kQnLuics67zw7q4L7+6asKxzwrLuCcu6v3xfpOru3vMXetVG4JH/I5vB7C3Jq57Mz31Guv556frnpe++IN38onTri9KC/5IWvSwtella8urQkleH7vmTIXIFUBkwFhqMIsq+kYBA9Isrn8zKv0bc+qKW774gffcFae4z0pWPDp6/0PvFeYcLrnDJvQ3T1vfO3pK88tH4nF/l5z4jKcbwvd9J3/uddPOL0o//WGDBfw2jLgQAAFBUbn5xGPVD+XCXf4iXT2yF774w4qF8qivIR/3cZ6SvPZ7/2uP5y6oTX7rVSwjxXLDw2MSVHZNWNV++KXL5psisLf0yVz4a/+ovk199PDvnV/mrnsxf9aR01ZOSfD3nV3ml8MxFfs6v8lc9UagJAHAJVzyWB5WBvJpnjtm8wuya7MzNmdkPJy/fHJ++MTltw8CUdclpGwamrhuYvjEpl0zfEJX5yrq+6Rui0zYMTF4z/NbTV9b1fWVd3+TVnVV3+s5d0OK5YOGxi5fWT60OKUx7sHvGxl7ZIa58NC7z1V8mjbjy0fjsh5MKl2+OAwAAKAEzH+qb+VDfjI2RGRsj09b3TlvfO7W6e8pPw1N+Gp685gyrO2UmPdA+6YH2iStDE1eGLrmvZcLSlglLg8pvkavu9J1zy3HP1z7wTFjacvHS+kmrmmXUxqB4g8zsRwYUlMJZW/ov3xRRuxCoIHoBAK5ianW3BtkApqzp3PJKb28sTyzGpt+1X7Cw/rzbTpxzy/Gz59WePa/Wc/a82gsWHrvk3gYjV1DQOMHlmyIzNvbKf4wk/xmSkiIAAADhKD/1q18ETFzZMXFlaMsfe7LhUOj3j7c8s67p8fuDD9/j37So8V9u929c2Lj+x43rf+yr/qGv+ofe1d/xrv6O9/5/arh37vFFV9WuvCna4t/029AX5x0+e17tF67f9bfXfkh1hS6qK6icQDGD7mkPjrCsKeqXLWC0o2xBMJqR3zcAlYSysrIlXHJfCyGk/cUnu997qeeDV7pefz70n0+0vfCLtuc2tT77UMvWB5t//bPmX1c3P7mm6V9XBR9dFti8uPHBfz71wI21i77+/pLreqODsiucNXf331zzjufsebXn3XbiwsV6Vxh+KaB4g/zWlWIJ6tcyFCsDALiDsh9hQCATV4YmruyYNOwHHcovCQghrc9u7PnLq70f/3fXm7/t+ONTod//su3fH2l9blPLto0tWx9seWZ987+tbX5iTfCx5YGH7/ZvXOD96byDd1/zp5suI4R8cd7hL9x0dIQrXLQkoLaEaQ/2nvGAEUxbX3jLiPquUfl/vAUCKfdxBoRQ9oMMiOKME6gJTVgWmrAsRAhpfmJ115u/Db/zn52vbgv97rG257e0bNvQ/FR10xOrmx5bGay5L7BlSWDLXf6NCxsf/Gdf9c2nVn/n4D3Xvv69rxBCzrnl+BduOuq59ujfXPOO54vzDp+/0Cv/D8yTV3cq/7sy1Rjk33FPW99Lfa1Q/lMMAAAql0vvD6st4eLlnRcv71Rcoemx5R1/fKrjladDv3ssceowIaTpX1c31awIbLnH/9Adjetv81Xf7Pvp9wkh/Qc+9j5wQ8P9/1R377fe+MEsQsjf3+KVXeFvr/3Qc84tx790q3fC0pZJD7RPXhOWXUHzS2q6MawvuiuEo3lCSH9Cmrwm3J+Q5Au5fDB/uuwrRE2Ympg6edcyKpIcRXm6B/mTD0AlIfuBxhWCD98TeuEXod892vb8FuX0Dmy5x//QnY3rb/VV3+xd/R2l3Lvy2w0rr6tbqnWFv7nmHc/f3+I9/46WCUtbJq/unLwmPGVtj+IK42ZsVaC6wrT1vYUP6LBlDPWtuWRmiPqUv3OQEPKHD9rHzdh63vxP+hNSfzx33vxPJq8Jy+n9/T++Ucpbi5GqglFi6uTLAk/yxUuSp3d+yj6ZAJQLtiv4f35H63Ob2p7f0rptY/O/VSsG0PgvCxp/9iPfT+YpJaeWXeNd/r8bVvxj3dJr3/j+TNkV/t8bGoZfKyiucOn94cnDrtCnuIL8v0jM/HlU5owx9Kn5yrpe28YgdzT+xg+Mnho3Y+vE+5rkkvPmf6J2hXEztpZyPRip6nPWP6UkXxZ4ki9ekpy981PeyQSgvKhdYcKyEa7Q/PS6lq0PNj+9rvnJnzQ9ulKxAV/1zQVLuPcbp5Z+/dSyqxuWX3to6dw3vj+DEHL2LUGtK0xc2THlp8MvFEa4whk/aItIhJC3D2dnbIy8VZchhLRFpGnrh2smM0OEkHBUmrK2Z/KayOQ1EX/n8P9M4e/MyyWT10SUkmRmSHkoh1JHXVN5SlNNdfhSOnqzNt2fGJKz2v5hUq9cF8gpCf9hVyoclTSV5WflCnKhPlVFJJkZerM2rU4s3JNQC+qTb+vND+ZPq/Unr4nIaQzmT/cnhuoCOU3aRj3am2fGANlJqtF33dabJ4TIub1Zm5ZF9L0b5azvUb+UAqUAGKUorxgmLOtWvIEQ4vvZLc1PrGn+t7XNv1rb9K+rg4+tCDyylIwM34q5vvu+4b13jnfZ10/dd/Xhu7/x5rzphJCzbwnKLxe+cP0uzzk/Dl54d9el94cnrxn+QIzpG6Jqlcs3x2dvSc7ekkxmpNyg9Ms3+gbzp5OZoXEztl608KBcZ9yMrXsO9xBC/KHklLWR+rZBQshHB/vfeK+BEFLflJQ/bUOu/Oe/+nfs7v3Sd/+slMhvUmk+FVbzlPJQfe3vyhNC9hyPyR35Q+kpayPycfCL3zb2R9N7DvdMWtWhl/2oLvbsf/nl6+fej21/vZUQkkznlcpf+u6ft71wgBDSPzAoF6rzqQvmCCH1zakvfffPraFo3cm+icublTrbXjjwxw87CCH98ZymrXL93BvtL70VIISE+7KTVnXIlvDHDzteeu0oISQcyUy4q0GdNrVH6vA555kxQOV6u5JkJDtxRbt6X8rH8Z5jha7lcnmT1PxX72D+dDIjjZux9YJba9W9GzWk9ji8lC8ML6Wcg6JW3zpICPmotrDNrEoBMBqRPzFbQX7pQAjx/XR+U819zf/6QPMTq5sefyD46PLgw/cENt+pHOaNa77deP81jcv/V+OyqxqXzTm17B8OL5nz5vemEELG39okv1z422s/LLiCYgnTNgyob+NxM7bKrvDK/pyi/tLbwfPmfzR9Q1ypednaKCEkNyhd9H+OyXfguBlbL1nWPFy46KRcQSmfuLxNXaL/UHjNU5qO5Gulo4vv8Su9JzOnCSEvvXZ08uqe83+w6+J7/FRZOTf5etKqLvn6S9/9y2Vro/6u4Z805Tj/B7s0CchdjJuxVR5X1W11E5Z41XUUQX1bfZ3/+eN9SuGlK9uVQnXa1B6pw+eZZ9MBUpNU52PU9R92Zwqb5K2APJ9qZdOc1T1Sl1K/+kbbzFQKgFHHpJ/EFdTeQAjxrroxsGVJ0y9XNj2+qvmX9zc9tjz4i3vIyAg8cI1/5dcb7/tq47Kveu/96uFFV+z4ziRCyPjbQ2ffEvR82/+F63d5zl3QcuHdXZPXDLvCtA0D0zcmlftq5ubMrEeyV/wiIxMI5wkh/mBk3IytU9f2zHgopdScsm641TnXvaUUTl03oBQq13K5jL7E6Cm95rgZW4kuzrnure0fZZPpPCGkrTe//aMsQ5Z6HY4NEUI+OhilDkR/bUnc6Fo5s/6wJ0cI6Y+mNeLUHqnDN51nqwO01PXUdQOBzkFyZpNMfiBMVWPnrFxTl1J5Vt/EqtQY4bLqBKg8VN4Qm7gqRgg5dd+3/BsXBh9Z2vTY8qbHVgQfvU+5y4I//5F8MZRJBlZ9PbD8Sv+yWb57Zh1ZOOOtGy8hhJx3R/v420Pj5rV84fpdnvG3hy68u2vymmFLmLZhYOamjHIvzXokq7jCb3YNKn3833d7Zm7OzNxcqCl7SW5QUv8Qpy5Um4384a7UEqOnNB2RkT8tqpm+MTm1OrLncC8hJDc4NLU6YiRLvVYuJq8KGVVWD9CSuNH1c59klbkNR6VtLxy44Ed71MrUHo2Gz55nngEq14rZy9cK1K6nrEtu/6gwkOd2hOXKagWjhkY9Tl5dWMrJqyPqZxUpuVDeZpakABi9aLyBENKw9Grfuh8FNi8K/mJpsGaZcicGN98e/PktwQ2Fv0EKrrgicO/lvrumH7l9yo7rLiKEnL+oZ/ztHQVXqLq7d+KqiGwJ0zcm1a4wuyZ/RU3uykcHr3x0MJk9PZg//dJrR3ODUjKVm7ExNuuRrFLz80aJEOIPRs65/p36dokQ8ue/+vf4JELIiYbwOde/M32j2kIyMqrDLqNBU1n9UGlV1ywRQg4e6djjkwbzp+vbpekbM+HY8IV8UshdU2Wp1/7wECFk2wsH5OTla02qSr/TN2baIsPd8YgbXfcnh18ryKdk1e11U6uj6rSpPVKHbzrPRgPkSVifj6ZrzSaRR0GdOkbOyjV1KZVnebYZWwqA0cXUBwso3jDpJ4lJP0kQQk4u+pr3J/MaN9we2LxYMYDA5v8T3HRb8KEfBjd8r3nddYXye6Y13nnZ4R9fuuMfLyCEVN3dKxvD2fNqPeNvD01Y1j1lbUS2hBkPpZRXAEpc+ehgoGeIEPLR/u5zv/PeJ/U5QkgglJhdM/wXIMlUjhAS6MyNm7H1krsbZm7K+DuGDaO+NTtuxtZLl/nVZjNzU0bmo/phBaVEQVNZ/fCtI/ncoPTZvpaZmzKH/Onc4PAfET37ivfSZX5Fsz95etsLB8bf8I6RrNG1vz1DCDkZygc6c4SQN95rmLY+qkn1kD8tjzqZPf3c2136AVq6bosU3uWXNT+qz2smhNqjfvg880wdIE/Cmnw0Xct+89H+8Pgb3vn4eJYQ4m9L6Hs3zVm5pi7liJUy22ZsqTHCtI2DoDKQvUG5GLaHn2Uuq04TQuoXXH5qxXW+6psbN9weO7ybEBL4+YLAz28LPPSj4IbvBx+8qan6W00/vZoQEtv7dmDJFN/CSYd/MOHNuecTQqqWRs9f1PN3t/Z+4aajnvG3d3z5vshla6PDLxTkXyTU5DSv8a96Mj91lW/cjK0zN4SveiI/81+6x83YOnlFo3LX/c8ffjpuxtZLl/lm1+RlLl3mk9tOXtmkFMolysPZNflpP+vWF1Irqx9OXx8Zf+N7U3/aObsmf9kDbeNvfE/OYebPE2rNC2/bJ5cYyRpdy8lPXtkkX0xfH9GnetkDbfKolX45xfXXz++SPj4Ula/lPw3KDUrTftatyZzao374PPNMHSBPwpp8NF3LanLmco/yltBPHTtn5Zq6lPqBMLYZW2osMHMLqEAUq5C9gRBy4tbpDUuvPrXqBl/1DxrX/ahx/Y8a1/3Qv+4H/nXzAz+7KbD228E13wyumhNccUXgnmn+RZO9t11yaN6X37hm2BWq7u79u1t7vzjvcMEVlBcKsit87fHs1x7PX/XE8Pduyt/KqXCmXFJc4cpfSjJlvwdGI+H46cH86Zf3pGbX5D8PDBFC+qPp8Te+V/bEAABug+oNhJAjN08+fseV9Uvnnlx5fcMDN51a851TD9xwavUNp1Zf533gf/vu/6Zv+ZzGe2f7lkz33XGZ9/aJJ2+5+MBNF732jfMIIV9enqhaGv27W3vld5AKriAbg/wb5isfHZS/4ln5WmaqMehdAdjg8b8MBdrPvK+SJYGuwXEztl60YH95syr77gcAUNEbQ298aN9d1+y9eereW2cduGPOgcXfOLD46gOL/lft4q/XLppz8M6vHrpz9qGF0w/f/pVDt04+dMsldd+fcOA7F33y7ar//uEVhq4wdV3h9wrKH6RqvOGqJ8+8SjjzWuGqJyX5VTnOEYdcvjl96TKf8r6K+r04AABQoL6V9PCfEv1NvvcWXv3Kty7673+a+KcbLn3txsmv/dOl/33jpNdvnPTGDZfsuGHCW9df9PZ1F+741gU7rj3/7WvPf/3q817/4RW9Qe+WVwY0rhBSXGHYGzbEp2+Iz3goNfvhpPp/VpD/EunKRwevqMnpkdOVX2eAyqDs75wCAPSof/Nc+MOkdamHX0sQi9Ebkzb/ceCS+weU3ysUXOHi5Z2TV3cOf3mO6n9yvnxzXGb2w0mFWY9kZ9dombll+G9myv7HW0AUZf+LCyCEsm8kIIqpD2ambRyU/+5I/rPUyWtTl1WnL6tOT16bmvSTxMQHEvK/8oXCxFWxCcujE1fF5Ge/vDwhvzjQUHCF8beHJiwLnXfbiao7Gy5c1HDh4oYLFzdMWBqUueS+FpmJK0MXL+9UvvBB/8VA6g93BQC4hAuXhEBlMGFZaMIy+oJesKjl/Dtazr+j5dwFw5y3sFl+KJeff8dwyXkLm8ff2jT+1qZzfhyUP/7onB8Hz74lOP72kNYVqu5skLlwUcEb6CwaRqk/oiGoFJQtAQCoeORPvDh7Xq3n67+ITlndGu1rAQAAMJYZf1vz/7j6PbgCAACAlihcAQAAgBq4AgAAgAJwBQAAAAXgCgAAAArAFQAAABSAKwAAAChg4gp9vcHuDm9nqL6z7YQpbcHDRhSqheq72k92d3j7eoNlHzwAAAANJq7Q3eHt6fI9/fL7c1dsq5pf45xZi5/a/Js3I93+SLe/7IMHAACgwcQVutpPPv3y+6t/veOwN2T1c/io0dQRWf3rHc+8/AFeKwAAgAsxd4W5K7YdOtV2WlgMHTrVOnfFtlh/W9kHDwAAQMO5C1rOmvOGoSt0huqr5tcMFUJyiCTlM+lU1fyagVhn2QcPAABAg4krdLWfrJpfk8/n8/lBHjwej8fjMa6Qy6RTiXh/1fyaRByuAAAAroPLFXKDuVwum8tlPWdCfqjBqFxFJpWMx/p74QoAAOBOuFwhm01ns+lsNpXNpjwej3yhh/GUTCaTSiai0b4wXAEAANwJpytQjn6PKjQl1IfZbCqTSSYT/dG+LrgCAAC4Ey5XyGSSmUwynU6k0wmPx6O5UK71JZrrVGpgIN7X19sJVwAAAHfC5Qrp9EA6PZBKxVOpuMfj0Vwo1/oS/XU83hvp6YArAACAO+FyBflATybjyWTc4/FoLpRrfYnmOpGIxaI9PeF2uAIAALgTS64QSyZjHo9Hc6Fc60s014lENBbt7gmH4AoAAOBOuFxBOdOVXyDL14lEVEZfoqksMzDQF+3v7gm3wRUAAMCdcLlCIhFNJPqdMxDv6490dYdbq+bXJOJdZR88AAAADVyuEIv2RqM90WhPLNoTi/baIxrt6Yt0dYdbO0OBqvk1iXi47IMHAACgwcQVwu0NsxY/VXesvqujqbM90Nke7Oposkdne7Aj5G9tPrXnwIFZi59KJXvLPngAAAAaTFyhp9O76fk376556d2PdwV9R50Q8B0JeA/v3LP7rod//8hvd2TS0bIPHgAAgAYTV5C/BWHbqx8K/Nadmv94O53uz2YHyj54AAAAGkxcIdbfNhDrTCUj2Uw8mx3IZRO5nCH5fNYIVbXUYC6VyyUHYh1lHzwAAAANJq4AAABgTAFXAAAAUACuAAAAoABcAQAAQAG4AgAAgAJwBQAAAAXOXdBy1j/AFQAAAPS1ROEKAAAA1MAVAAAAFIArAAAAKGDZFTweT9mTFoU8FneOSGBubhhgGXOQv/pJSCa22xZ1+JbEeSqXd5h6EYErWC6oOYsaiPAJMXEFz8igZsDOSa9gWs3eFNi4NyrSFawuUCmHU/ou9KeJ1UysnkdFvf9tZ+V8CPziDmdAU9P5Coodo9g5t323FtUmuV4rOMmgqLvQoUhFukKRptf9OXAeRnAFIXWsNhTiCgIns5Q3xZhwBSU0z2rKGcM2UqBWUypo/tWLMHrXXOj/1TRhyOoTM1LWN6cmaVSTPXtGm0Pfl2kyRqOzmjBDzd5AeNLT1+fZRaYra6TAkxJDxHQs+u2qV7ORlb1MGOX6nNkzbDpL1MSsrqCN3WVjM7OniNG10cDZmVPHqEmGna1VHL1W8NCWynQXUtV4ppK689gJ6AX1OZv2xeiFWoExCqOtoK/G351pQ3sl9hJml7CVNa04EzaabbYI5/5hjEJfn2cfcja0N4H2GtqYIqM5N2pejISF7y7+tbC0ZOyltzpRzueTB5GuwDNm04w5t5TpslEzZPxr1Jc6bCTGVtNI6TvSd6dX0NRkzA9jLPzdsRNm52CqzL621AVbhDobnAqaa8Y8WGpIXUqj+TedKP6G1KlgTx1jw2hkjfplTBpPwqZjpD7lJB+qlI0STao847VRjTE5PAhzBaNhs2fB6FnTKWCXUJ9i/2spPc7ENHPCWB4jHdPJ1Nfknx/TOjYSZpeYKlvaaaaLxT+x+sUSkpKlhkZL6XCirC666dBM96emIc9KcW4VnhVkLy5Pj+yaRjnw7wfNHrO035xvAB4Eu4LpQ8714NwZPBNB7c50Z9sYLCMN0xuDc+vz7Bh7+9VSd7b1+RfFeRf8E8u/gW3vQ/7Mea5tZGVjCIw1Mppwxi4SnrDw3WUpH/4NybkfSrYBeBD8DhJ1o6jDSEHf3HYTnuSNlpb6kJGYPhNGTcYsGelQh6NXMBqjUao8rewlbJoDYxqt7gqjxWLPjO2RWp1nGwvEs/2sZsVeNfasstOjiuuXj7o6jBxMp850jDy7i50PtVOeKTLqiGc+OSfK4QbgYbT+v832RgtGEVhiUBkwdrI7NzlcAbgULDGoGIx+2C97YlRGqysAAAAoBnAFAAAABcrjCuw32vhfWLnkJRgjZ325S3IGAAAq7nIFqyem/lfwpU+b3TtcAQAwuoArOE0brgAAqCTMXUH/B7n6P7m19Ae2jMqmD9VS6n+pPfI05xkOuyPOnHnGHoVnAADKzbkLW86aw/x+BaOW1FNMf/IynmKXsPvSHNbszI1OXs6UqPVNh2yUIU9HAABQLiy7guZnXs1Z5hkZRlLqtho1dl96BWqSjEx4DnF2CWOKLLkCe+wAAFAWrLkC4wQ0PdrYB66pPqPE9LB23gVD07YrcCYMAAClRIwrRDnOUCdHsENXUK419V3iCtRRwCQAAGXBxBWiqvc6NA+Vs0z9LLVE/5ReTXnIWV9/vut7ZIhrkmfkT01JU8LTqY2xl31zAADGIOauAAAAYOwAVwAAAFAArgAAAKAAXAEAAEABuAIAAIACcAUAAAAFzl3Qiu9XAAAAMAxcAQAAQAG4AgAAgAJwBQAAAAVsusIo/TyGUZq281FUxsCFD1P/YSdlH0LxBgsAJ1yuQP0MH+GpeEaGUR0bsk6aCx+j84Zj1hWoo7A9M/qGbpgl/hzckC2oSHhdQXNdJFcQUsc0+TICVxA+e0JcwT2zBFcAZcepK+h/tDctMXo1QC1ht9U/1Ouo6+gFGfkY6Wv64hmvvj57mOyRUutrMtT3bilPzmUyqkytw86QMWR2SqYzwxiIuqHVXV2aHcJoS+0UAOc4cgV9ub6Vx+BQoD7Fc4+xszJKw6qg0VOaVjyCpjew1WnkydkoYRt5mk6LvVllzAmPbDHW11K/RuICdwjncIzSA8Aejn6v4BkZ1Mrqp4yaqDWNSqh3hb4vavJsQUY+1Kes3rdG9dmCjKExBNWV9f+yB86eW6NerA6ZkZvpkPlnj3N9jbLSZ2LUNVXcNCXO6aJmwt5LADjH8msFdYlROfWacWOzezHqkV2fJyWr+VgV5LyTHR4cRuui/9fe2hklrNSxNGR7GTIWS8j6GmWiqU8di5OULC2upTUCwDbnLuD4HCSj3Wn7OGBUMCrhuX8cnhqMfDQnoKUD0fROLsHBIbYLJ7MqKsNirK/VLVrsHcJZkzotANjGkStEz/wApdms6kJGBb2mvq1Rj1Qpo9uDR5DalqGvGR1jgBplfV9sEf3AqaOgljAy58yTMaXsytRBMZKh7hz26jtcX31lxswYTQVjDhVNxuSY7hCeiaUmBoBtuFwBGCHkhhx1d/WoSxhzBQA/cAVHwBUA5gpUGHAFAAAABeAKAAAACsAVAAAAFIArAAAAKGDiCs+9vgcAACqbaF9LX2+wu8PbGarvbDtBpS14WE3hqVB9V/vJ7g5vX2+w7Ad6iVyBIBAIROWG7ArdHd6eLt/TL78/d8W2qvk1/Mxa/NTm37wZ6fZHuv1lP9DhCggEAuE0ZFfoaj/59Mvvr/71jsPekKXmTR2R1b/e8czLH1TUawXG5yDBFRAIRGWH4gpzV2w7dKrttOUYOnSqde6KbbH+trIf6HAFBAKBcBqyK3SG6qvm1wwVQuJEkvKZdKpqfs1ArLPsB7pLXcHj8RRj5cQGZ5LuGYt7MkEgKiyU1wpV82vy+Xw+P2iFXCadSsT7q+bXJOJj2xXUH9Glf4qnWmnCMzKU9Gy4gl6Kp1PnyTvJxFJfQnQQiFEXalfIDeZyuawVMqlkPNbfO9ZdwfRMNL0uWRh1as8VnPRoNTQ6xZ5JuAJizIbaFbLZdDabzmZTnGQyqWQiGu0Lj2lX4DlnjX7CJbof1fU/8LJ/tNfU19Rkv3DRp8FOgDEWaqrsyTHtxVSHnYl+gJxD09Sn5o9AVHCMdAVePzjjCslkoj/a1wVXoAS/K7CfZdTXd2d6dntGBtEdhYwE9MqMs9uoOTtthg71TDfKhDEh7MGyfQiBGAuhdoVMJpnJJNPpBCep1MBAvK+vtxOuYBKWTlL1tek5Sz3iqeQRWSYAACAASURBVBdG2WpcQS9opMAwDKNsGWlr2hqNi2eMjHyMcmP0gkCMtVC7Qjo9kE4PpFJxfuLx3khPB1zBJCydpOpr/pNLlCsY5c9zFnO6AmMIRq3gCghEyULtCvJBn0zykkjEYtGennD7mHYFYuXsG0WuYPoSwerZza7GHqMNVzCaEKu9IBBjLWiuEEsmYx6PR75gXCcS0Vi0uyccGuuuQMzeGiK0c8eomlpEr2xUX4gr6BPQ56NuwsiNMQRq2kajZpRYykSfA3Ww+rklCMQYC7UrKGd9IhH1eDzyBeN6YKAv2t/dE26rLFdoLcr/2+z8fHHPCTUaM3FPzgiEy0PtColENJHo52cg3tcf6eoOt1bNr0nEu8p+oFemK1B/Ri5vuCcZuAICITzUrhCL9kajPdFoTyzaE4v2solGe/oiXd3h1s5QoGp+TSIeLvuB7mpXQCAQiFERsiuE2xtmLX6q7lh9V0dTZ3ugsz3Y1dHEprM92BHytzaf2nPgwKzFT6WSvWU/0OEKCAQC4TRkV+jp9G56/s27a1569+NdQd9RHgK+IwHv4Z17dt/18O8f+e2OTDpa9gMdroBAIBBOQ/kutmhfy7ZXP7TxrTs1//F2Ot2fzQ6U/UAvkSsAAEBlE+1rifW3DcQ6U8lINhPPZgdy2UQuN4J8PqtG9VRqMJfK5ZIDsY6yH+ilcAUAAABjCrgCAACAAnAFAAAABeAKAAAACsAVAAAAFDD5HCQAAABjCrgCAACAAnAFAAAABeAKAAAACsAVAAAAFIArAAAAKABXKC4ej8eFvRcjq/KOtLyM5bGDyoPLFTRfCWlUx0kezu+rMt6ZpTx8BSbGTo+nTukHW7xe9OO11FfZ1xoAUfC6gqlQ2e8KuEIxEnObK5RrxsbI8AGI2nYF/Y9UmlcSRg81DZUS2w2NCql1jGoajYXRqTpto3z409NMhWk55wAZ3VGTp9Zh6BjNFc+cs4djpOmxskDUh0ZNqLNB3R6mK86eCgBcjuV3kNSFUYM7gVGNWsJZjdqQ0an+2ugp07FQS9ingKUc9FLsciM1S3PI07XVZTVdGupTPGvEMyIbk2CpGs+csMcLgPtx9A4S4/ZQB7Wm8pSmkKeEmo/pvWqUG09zGwei6dFGVdNcGJVrBmIqTl0Onq41alQd9iahPqXXYXdkdVfwpKpvYjQi/URR02PMAACjiGK5An9Nj/EZxNPQajL2xsKfmNUc9CeOpXJL4tRydhf2lpVRjX8zMKRsKNjegYyJYg8TgFGKfVdg3CqWzlD2Pcl5/JkmwH7KdCyWErORg75rznJL4tTZZndhY1n1s8G5Uvyjs1HB9g60cU3dDwCMFmz+ZarRzaC5pt4nigK1gtWG+jypOtThmHahecqolaZr/cxQmxsNX5MJo4LRGPVPUbtjd6FpazSr1L545lxdwpClTqmmJo+CaRP9ePVNGOkxKgMwusD/xUZB1F09Nk8HjBqAUQ1cgYLAO3ysHRZjbbxjedSgUoErAAAAKABXAAAAUACuAAAAoICJKzz3+h4AAABUyn6CF8UVFpq5AkEgEAiELuAKCAQCUZkRj/UMDeUt1SdwBQQCgajUkE/5yIDk75QaWnLHAtnDjdmD3mytN72vIbP3ZPrz+szuE+lPj6XaewcJIZ3hLgJXQCAQiEoN2RX8nVI4ejoUOd0UlgJdQ/4OyRcaamiV6lvzx5ulI0Gp1je4vz5JCPE1hwhcwW3h8XiUf10YjMT0T1kdhXMF6ECnGDoOo4y3s+wKDS25UOR0a7fk7xiS/eBkq3S8SToWlI4EpbpGqdY7eOBUihBy8GQrgStoQrN+ysfCMErERmW7AntcnPVNJ4czE9N1LKUOu5xTxzMyHObjfFwC8ynvejkMfkHhXcuucCyYlV8leEPSyVbpZKtU35Sva5RqfQqDtaeShJBdhwIErqBZEo0BaK6NnhUYcAXTEueuwLmOJdNRCp2fwozmlvLhkbLUyg3zbFvHYfCvS5Fcoa4x6++QfB1DDa1SfXO+vjm/pHp7rU864M3v9+YPePMHvHnZFf6y30/gCvqF4Sw3vYH1HqMuMXqouALPDzU2OnIowr6X9K2MLmwrmIrw65iqlVJHWXcn4zKdmRLrqGuKysfJPDvRUR5Sy20PkD8reyG7wkFv1huSvG3DLxSWVG+X2e/N7/Pm93vz+8+4wvufwxVo62daaLoJ9G3ZN4l+W9jYKDwdORdh30tUHf6x8CiYivDrCMzHoY7RYWpDh/OQKo0OtaY9HVHj4kmJcT9qLpwL8ovYC9kV9jVkTrZKDa1Sg8oSZPaeMYYDDSlCyDu7GwlcgbF+7HWy9NNB8VxB35GNTcYvYnXrswduQ8FUpPQ6pmqmOp6R4YZ8hOiYKpQ+H9vzrHlKU241MaoCW8ReyK6w92RaeeNI5kgwrzaGvd78/oYkgSuYrh97keztKtNenO82oroZeDaZJREbo+ZszqlgKiIkE0v5mAry6wiZH+f5CFxxtkJZ8rGto78YLa6wpz5zvKnwKuF4k3S0SaoLFIzhc+/g5/VJQsjbcAXO9WM/y1NNiCtw5sPo17mIvVFz3pacCqY3kqmOqHyEz4zV7VekfASOy94OdPk8O0+Mpya1gtWQXeGzE5kjQel4s7SkevvxZulok3S0SaoN5vf48kuqt+/x5T9rGNx9Ik3gCvoZ9JwJzUNqIXvlTBsy+qI25+yI2krTkRMRhg67jsf4LrKqYDotpjqaKHs+ptelz0egjr5V2cdlOx/Nhb4mpyC1Jo+U1ZBd4a9HM3WN0pGgdDQ4bAlHmvK1wfz+QP5zf36XN//pycHPTuC1grj/i835ypWyI1HZOtdxTybQgY7AtgIPBFGu8MmR9AFvvq5ROhLI1/mlOr9UF8jvD+T3+fN7fPldp/I763O7jsEVBLkCLGG0ZwId6Ahs7ipLIGdc4eNDyb0Nuf2+fK1vsNY3WOvNHfDl93rzu735zxpyO+tzn57I7DqWIPhts/MZRyAQCDeH7Aqh7tze44l99cn9Z9hXn9x9Ir37RHr3idSu48lPjybaujOEkJ11QQJXQCAQiEqNeKznaLCXs/LOo934JO0R4baXfpCqDClEGSdT4PuurnoLlz/isZ54MvVxXeerO5t/90HTv7/b+Oxb/u07fNt2NG7b0fjsW36Z37wbeHVnWzyVhSvYWTDq3xKUXYqnMo+UZ2Q4z0rIAMVmVeIVLFm4JA19uNAVbNxWo9cV8K07xXUFzj8aK7GUUlPI+cvZl6hqVu8T90w7pxQCrmCvXyFB/dYd5Yt35O/eUX/rTiTSTeAK6gXT/OjHvu3ZZ0qJpXg2Lo+U1Z+RSyNl9NBhVg6nnd8V9FLqh9TuTHUYGfJIsbOyNzRqJtRy21Kco6NODnsJTEUYE84/NEYCnKtmNajfuqN88Y78XQvqb9053thG4ArUdTW9N0w3AacUz9Y0leK/63ikOG+YUkoZPbQnJXCAPImZPmVPxygf52rORTQX+sQcSrGDnTynDv9eMlWzupfExojPQWrN1zfnTzRLJ5qlo03SkaB0JCjV+vPqz0HC/69gsnhGa2ZjSxlJmQrySHlGhnuyEiVlKlKurKxOO7WVS1yBqm/jKKf+a2ntBEpR7xHTcVFFjCZWiJSpiO1Qfw6S/AF5x5ul482S/FFIR5uk2kB+jy+Pz0Fy5Ao861fi85czN7hCMbKyJEVVdoMrKIU8g2WnxP7XoZQ+T7aU7VO4wlxB+STt+tb88SbpeJN0NCgdCeaPBPMHGkd8kjZcwWTx2NeMQqtS1DPLYSZlz0rsAHks0P3TTq1sIyWGjj01nrHYXgLGhVUphjijoekpbE+E/ZSTfKgl9gKu4NQVlGAsqr4adUVNpdTVjCrwS1FTLXtWYqX0Dd2QFee6aDYMTwlbh9GEZ4BGauzB8gxNX19f6ETK0tBM55xfhL1GlqSMBmKako2AKzhyBdshav0gBSn+Q8FSR0IG6J5ZEi7ltnwE6sAVyuAKLtxPkBp1UjZ+TuTvq1LPTVFSbstHoA6BK5TFFRAIBMK1gb9MhSsgEAhEIeAKwlxB4Cu4Euu77TV1icX1HQnvrkj525PV/MayZP2O3ij7+0UlXi+4AlzBUFnILyeLajlFOr4r0hUEDq0CXMHh3nby2yAbUow6Yn+fJAdcAa4AV9AKVqQrCMykAlzBUrjZFex1yg64glNXsPpnxfpr0xW1qs+5G0yV9R05FBE+docDN+pI3y+nlNEAHWbIljUVUffOMy7T2bAxP5ocqMO0nY+NVk6kCG1FPLrVESjF0GQMhHN0+oArOHIFzRqYlpCRtwTnklvSZ5Q7V3YoUuyxF2Pg9jLUXBg9FCXLL1K8NeWUota3JCKklaiFJsarI1CKxxV4ZDkDrlCBrsDWdKjsRKRkjsjOWR38OVuSYtzVTjK0eljoKxdvTa1KkZEj5Rcx7ZenlcCBCN/V7DypgrbXiBpwBbjCmHMFGx1ZlXLoCjZkGSLudAXbIvZGYSkfUzW4AlyhRK5g78AyasXeFk4yty1S7LEXY+D2MjS6qx1myJblESnBmlqScihiu1UxBiJqV+svTAVtrxE14AqOXEGeaCU0Jfo6jIU3WjPb+gKVRYkUb+z2Bm7Ukb5fTimjC4cZsmVNRYxy4G9olI+9HIyeFZIPZysjKaqa0XiNVoGRmD0pU0GjgfBMlD7gCk5dQWBwrlm5lIuXXvHEBcq6OUO2CONZnoacGdrOwbmI2OG7ec/YmwGr1fCtO25xBViCm2XdnCHjpND88GivIU+StnNwLuKka/bP8g6jZJbA2Rd/PnAFt7gCAoFAuCHgCnAFBAKBKARcoQJdoZQvXUdFF0WaEFe92+CqZBDs4H9XzUkT2wFXcOoKxVgqh5pwhWKLjwpXsK1Z1HfbETYmU/OXRULToQRcwakruDDgCsUWhysgbMdocQV8F5tNV1Be1nlUoXmWWsL+cwIeTZ4/SNDU5Oxa3TujU724PgEnXTgUNNJkz4AlQZ61EC5oaQKLIcUYjpAu7Anqx+tkMvVPKYWaC4YmQ83SMG00dxhwBUeuQGg/NvKXGIVDBX1l0x41dTQXnJlQ+7XdRTEEGSU2BC0th6UMhacnUMrqEemkC3uCxVOzNGSe3GwoFNUP5IArFNEV1EGtYxSiXEFTv9jHBDsrq10UQ1CzIg4Fi+QKPHvDanoCpVzrCjbm05Ka/l+2Jk9u/Ar8zZ0HXKGIrkCtqb+2p8m/L/m9obJdQfghXgxXKNJ4BUq50xWU6+Kp2XYFRm6cCnCFCnQFq6eAQwVNidFDRkMnxwR7B9s4IkUJWp298goKVyveSN0wmUVVMxJka/Lkxqlgqik28DlIwlxBCfVTRiWMncqpabrX9dX0UtSG+gue0Tm8D9njsndjUzU5Z49H0GhaBApamkBqHeFS7OHwd2G6NPYE1TWdTCYjE84MjdQ0TfQKPE0Yg3IeGlcYyJzWAFfgdQVL885eVB5N59uiGPup2F2MNUGBaq5abvZhakOQp69izIBzTYcKJXCF+ub8S59mNcAVDF3B6oYz/eHFVJNHgTMTew3L2MVYE6xUS6BW5vQJS10U+2fqirQEgtcKDl0BgUAgKizwWgGugEAgEIXAa4VKc4USvFdQrlC/G2DjFzkVPDMIhMDQfw6S/rUCPgcJriAmhLyLakNE1Pu/bptbsb+MLUa4bcYqJoo6sRpXoLxWwKfjwRVExeh1BbE6ogKuMGajlK6A1wp2/jJV86cOmhJ9HaOwIaWvQ73gSYCq41BEU2KqwB6ybRH2Q04Fh10zRmRjKmwPhC2ivzZStieursYvy9OREB2Hw+fRFzUDpsN3EvgkbUeuoF9mnhJq2JMyKlHvHtu9CxExqmBDgappT8SegvD8Be4HsflQl955hjxpCxm4k/SoF6LyLOUM2A64QilcQW/1+rAnxT7NqRVs925PxNKJDFewLSU2n2Ifi85zLoZOMYZfvBlgizgJfA5SKVyBZyWc32PU86u8rqBcF+kUsy1iTwGu4DxDgcvH9gYbOsKHT80TrjC6KN07SPznu+0S4b3bEGFo2k5DiIg9BeH5C9wPRcqnGBnyL4dpfSFbWl9B1PCN8nQ+A6ZL7yTgCo5cgZz5QYC6e9SFPD8v2JDyqMKoFbsOT+9ORPQDZ99pRk2UQtP7wTRV04EwFGw31Is4mQpNiSgR6niFi1uVZZToBZ3oOBw+v75zZaKaWKqIk4ArOHUFeyFqFS3pCNlDAjci9X4ovYhtBYFdu2QqSi/OI8vTkSid0usLUYYrFNMVWs+aU3xXKOq9Sq3j/McKISIaQc7CoorYVnDSNc9kln4qSi/OKWvvTBToCsXTF6Is1hIIvl+hLK6AQCAQrg24AlwBgUAgCgFXgCsUJYS/qhUoXtTcihSa3zSWrNMS9+jOsDH5+t8VFyGvYgVcoeiu4ObzsXiabh51uW5R27/wEPtrUodt+QU9uj89KkEI3Buc+bObCPlFsXMRza+y2AFXgCsURdPNox5TruAk3L8ThHcn5HfdYl2B5zTn/3U0z/zAFRy5gkcVpiXUa/ZaWhXnWXu9CCNJ/sQ0XVN7sSRFvRCVG6M5tUcbzdmLxd/cdkN2Mgwpfb+aIfA350mes1P1s5xS1IfEbAWt5s9uYqO5OlX9tW0RTimCz0Fy7gqaa54S6gV1pS2JGxVakjVtbiMxe2Nk3MmWBBnK1ObUZy0dSUaZcN7bjIFYSltzTvGoMXaC1R1L7dpep7bvGmoyDu8Oq01sNGdf2xbh0ZEDrlBRrsAWZMg63ILCXcHoXxuC7GtGc6L6Ecz2AaG+FnVvm6atLrE6e6Y5WG1u1dLEuoLzFSylKxh1WhoRJeAKcIXCtcDboAJcQfixXjJXcH5O8WxdzuachxGjU4d3DVWKv3lluAK/JRC4gntcgX2+c7oCz25gPMu5I52Pmp2MvULTavbm3GhQpW9uoyG1a/6zlXPrspvzH3A2XKEESyDkduBszllitQl1zhkLAVcY4QoLrH9mqhJGJUohsb6/7YnbltVrciroC43qcEoZXesz5xmdRo3dnKGmf5bRnL1Y/L077NfecrCHwN+cc9RW14uhpu/O0goS3bQ7bGKpuVET04Vji3hGBkNEDnwOklNXMC3hDB4pG+LORUo8xlIKCu/dkrjAabTXxF4CPMeK1UxsR1FX0CU9ll4EruAKV+C8aZ0f6FZFinGaOJcSIljs29uhZ4htKHyjwhJK02NZROAKjlwBgUAgKizgCnAFBAKBKARcAa6AcEuIfYOllCH8N0YOw1VvVY0iNTngCo5cgefNZc3fBlDr8CyVExHqHyHYy8ThcERlImRinYu4/w4vTQJiXcH5PIj9JRZ1dKY7p1xq7HKewOcgFdEV1M+W/Sw27YKnGmeqPH2xa5ZgYoWLOA+4gqgwOnmFqHHunLKoKYVwhXK6grIA7NVlnztsEf1TVkX4XaHYIkYPbWdie2JFibDvQKMFVbfyqEKIjm0RfgX95tQno++UX42qaVXBaMhC1ByOrnhq+r1qNeAKTl2B55q9QmwRnruLR8T0BiuNiNFDqyJChsOTDDVtzkUx7ddeGqY6xRPhOYM0J7tDNbaIqa9w6thQMxW0mpsQNf6dyQi4gjBX0K8Qoya/iGdk2BMRlYlzEdPmpczExsTy985Inm1XtnXEJmPa3OiMU0oEqtlQsHqIl1fNVJNTjfO4YAdcwe2uwKNQmkxEncXs5iXOxKoIf+/sfpWb1rYraHSoD50kY9rc1BUsjYjaymE+9nYd/xgF5mYqa1XNtiUQfA6SWFcgxluHsdE5V5S9KUuQiajh2JsBl0ws+9gyuhUZ/XKOhTN/hyI8wzFN2GiKrKo5WT5GYs7V+A90q2q250rfxKqHqQN/merIFeQZZ+88dgUeEX2hDREhmYgS0dcv43D4MzG6LS0dxNTMNYU2dDgnhDMZhgJjEoza6mfPVM1Uk0eBqkZtaElNE67KzfSaJ2RXCHXn9h5P7KtP7lexrz65rz65+0R61/Hkp0cTbd0ZQsjnR5oIXMFJWF0hiIwiESE5iNJxLiJqOKLU3JZPparFYz1v7G7jrPzx4bDsInAFm+GSux0ixRCBJRRVzW35VLBaPNYTT6Ze/Wvzv7/b+OwO/7YdjXq2vx144d3Aqzvb4qksXAGBQCAqOeKxnlQylk7G0qmBTHogm0nkcqnBXHpwMCdJOUkalKTBoaH86dOSDFwBgUAgKjngCkVxBc2rNpe8NeF+NYQ6MLfUsDctjN94lyYBgSICx0INuAJcwUVqxe6F+tcjomRFqallhWs6jLIfiLabwxX4A64AV3CRmlEXrvpFbgk0i61sO9yQElwBrlBaV2g9a46t/4tNc6F/yPPzKaeaWlCsGkNQYG4MKX1bnhuAX5DzRiqjoFGhEEEh43WyT0xX01JzHh19W9MhUJvr2xqlaikfYmVK9WMx7ddewBWK6ArUZXN4S4wiNXtS1BLOe5hH0NKhUBZBfStRgiVQY0hZOj1Nm3NmYjoiS83ZT9kQ5DzQGW2FWwKBKwhxBeq/RvvP9JbgUeM5jMqYm5GIqZS+jsORMoYmRND57JVAUOyKiJJy0pzzKLQ9vUbN+ZO0kY+NtvzNLQVcoViuoF5IIbcEVY0RZclNqSz2EGcPGa5g2lzUirjEFXgyMW1VAa5gSYE/4AqOXIG6WvoLdp1KUhMixVBzKChqsKNIsHjpOU9MVHOGjsPdzp8/5xZl5GO7LXsgNiIe6xkayluqT+AK6uDZLuqgNrSkptYUq+b8dnWYmL45o749QeEZFk/Q3nLo2xYjPRtS7EIbzZVrng2j/MszIfxzy27Ck7PpWjPGYqTpMORTPjIg+TulhpbcsUD2cGP2oDdb603va8jsPZn+vD6z+0T602Op9t5BQkhnuIvAFYSEqCUUqMa+XR1qiqoJQYc1Bao53CeitplL0hAiWK626pBdwd8phaOnQ5HTTWEp0DXk75B8oaHhD9Zulo4EpVrf4P76JCHE1xwicAXn4UJLIKJ/4rAqJfZEg2Cx1VxyFrskDSGCbrAEcsYVGlpyocjp1m7J3zEk+8HJVul4k3QsKB0JSnWNUq138MCpFCHk4MlWAldAIBCISg3ZFY4Fs/KrBG9IOtkqnWyV6pvydY1SrU9hsPZUkhCy61CAwBUQCASiUkN2hbrGrL9D8nUMNbQOf09nfXO+1icdkL+FzZs/4M3LrvCX/X4CV0AgEIhKDdkVDnqz3pDkbZOWVG+XXyvU+qT93vx+b35J9Xb5QnaF9z+vdFfAJ2kjEIixHOrvbV5SvV1G/sbmvd68UqJ8b/M7Ff69zXAFBAIxtkN2hb0n0/K7RmpjUK73evN7vfn9DUkCVyjzciEQCESRQ3aFPfWZ402SjGIGakv43Dv4eX2SEPI2XAGBQCAqOGRX+OxE5khQOt48jGIJe3x5mc8aBnefSBO4QpmXC4FAIIocsiv89WimrlE6EpSOBqWjTdLRJmlJ9fbaYH5/IP+5P7/Lm//05OBnJ/BaAa6AQCAqPWRX+ORI+oA3X9coHQnk6/xSnV+qC+T3B/L7/Pk9vvyuU/md9bldx+AKcAUEAlHpIbvCx4eSexty+335Wt9grW+w1ps74Mvv9eZ3e/OfNeR21uc+PZHZdSxB8NvmMi8XAoFAFDlkVwh15/YeT+yrT+4/w7765O4T6d0n0rtPpHYdT356NNHWnSGE7KwLErgCAoFAVGrEYz1Hg72clXce7a78T9KGKyAQiLEc8VhPPJn6uK7z1Z3Nv/ug6d/fbXz2Lf/2Hb5tOxq37Wh89i2/zG/eDby6sy2eysIVEAgEAqGNinWFhS0mrgAAAIBK2U/wMrgCAACAMQVcAQAAQAG4AgAAgAJwBQAAAAXgCgAAAArAFQAAABSAKwAAACgAVwAAAFAArgAAAKAAXAEAAECBcxcyPwcJAADAmMLEFa6652keyj4MAAAAQjB3hVCoWaa9vaWzsy0cbu/pCff19cRifQMDsWRyAK4AAAAVA68rGFlCKpUcXa7g8XiUf4UrC5G1IVKM4bgEUbMqMB92hq7KtsTTYmnsPJUFTiZVSuxiVczSc7kCwxIymbTeFUzvZFHTZ+NuLJIrFHv7lqx3N8xA6cfF35Gmpn4HWs25vDvHVKd4t1UpXcFIx83nQBkxdwW2JeRyWZe4gqUmbt4No9QVisHocgV7ObvcFSw1gStUxp1o7gpsSxgczGlcQZkX/UVUtXvUzsF4qDEYdk3TOtGR21efmL4jdu/8I6LW1Ojzd03VoarZnm0bM2CpOxupstOgbjD+5Nn9GqWtLmTPg9FwOIdsadSWFtq0Juey6mdAc200k4yJMhLUi7B3C3vJGHNLvTAauNGQRx3mrsC2BEnK23MF6iTql8poohnbxWio6gqma8mTM3Ub8dc0Gh17h1GHyTkQS7PNmQajlaWl519NqoLRWEQtn9WcOcdi2jWjCX+e7IW2qsxo4nCJxZbwzKqpmtEGU5cwuhulmLsC2xKGhoZK6QoeVZgqM5owFpuRlWnvlsZLnR9GZU3XPL3ziBvlw5kGdZasTgVPZeqCOlkCRn3TYZp2RBUxGg7POnJOvo2FtqrMaKJRpraibhir4+LRYSwupz71X0a2Rgs36jB3BbYlnD59Wu0KHl1wLir1WcYm4ykxXW+jVjzKpqMwHa/+wlJzZbYZFSyJO5xtzsQ4UzWac6NCG0vAs3ymz5puML2UqYKNyeEZkaiF5hm10STwLLG9kRpNuFEXRoulL2cvK0/JqMPcFdiWQAjRuIJ+gty8fY1W0d7W5G9LvbDU3FKFEsy2w6XnWU3GVBuNpXjLx67sZEVs7wrOUThcaHujdjIKIVuRmgmjLWehXpxaeXRx7sLWs+YwXYFtCTyuIF8ooS7RPGs0rTw6DDV1Cf/21egw8qQO3LSm0e4xqqwZBWcmjAlh58OeAaNpdDJp7MqWpped+l+bmgAABmhJREFUPGPJqDWNBI265pl2/q4ZORiVWFpoto7pcNTV9LNhaRT8I9VXMJ060znRqxldUxXYrUYX5q7AtgSNK4w6GHu37Lm5c2ZGBaM6+Qqg2PNvVb9k+6EyNp65K1T25yDBFazOzKhgVCdfAbjNFUqQUmm6KA0mrgAAAGBMAVcAAABQAK4AAACgAFwBAABAAbgCAACAAnAFAAAABeAKAAAACsAVAAAAFDh3QQvrc5AAAACMKeAKAAAACsAVAAAAFIArAAAAKABXAAAAUACuAAAAoABcAQAAQAG4AgAAgAJwBQAAAAXgCgAAAArAFQAAABSAKwAAACgAVwC89PUGuzu8naH6zrYTwmkLHhZFQTZU39V+srvD29cbxDwInwdQqcAVAC/dHd6eLt/TL78/d8W2qvk17mfW4qc2/+bNSLc/0u3HPAifB1CpwBUAL13tJ59++f1v3rXdHzk9WvjmXdufefkDsT8jy/Ow+tc7DntDZDREU0dk9a93CJ8HUKnAFQAvXe0n567YdjCYGV3MXbEt1t8mfB4OnWo7PWpi6NCpVuHzACoVuALgpTNUXzW/pjaQrg1khoaGhoYkl1PrT9cGMlXzawZincLnYagQ5R8pG0nKZ9Ip4fMAKhW4AuClq/1k1fyafY2p/Y2pfH7Q9eT2+9P7G9NV82sScZGnoTwP+Xy+3APknYdMOpWI9wufB1CpwBUAL/Jp+Pmp5F5vMpfLup7M597kXm+ySK6QG8yVe4C885BKxmP9vXAFwAlcAfAin4afNSQ/a0hmsymXk8mkPmtI7m4olitks+lsNl3GAXo8Hs55SCai0b4wXAFwAlcAvMin4c4TAzuPJ4QcanJQjznOI495GiZ3Hh/46/GBormCncE6H5d1V0gmE/3Rvi64AuDk3IUtZ82BKwAO5NPw42Pxj44NZDJJJ3g8Hv21/sIJ6XTi42Pxj4/Fi+cKmUzK6mAFwimbTicSA339kU64AuAErgB4kU/DDw9FPzwcTacTtvF4PNQS9b/OSaUG/nwk9uHhWJFcQTlzrQ5WKZdD81Bd36gOW1k/DwPxvr5euALgBa4AeJFPw3cPRt89GE2lBmzj8XioJfKR50R5JPH3DkbfOxgtkisoZ67VwRqNnVHCU4ExD/F4JNLTAVcAnMAVAC/yafjW/r63D/SnUnHbeDweaskZV7CvrOHt/f1v7Rf/F5lnXGEgnR6wMVilXAlNNX2Jpj61AoN4vBeuAPiBKwBe5NPw9b19r++NFMkVLB12bJLJ2Bt7+17fGymSK9gerKkHGLkCp9/o5yEW6+ntbocrAE7gCoAX+TR8bXfva5/1JpNxJ3g8Hv21/sIJiUTsT7t7/7Rb/N/pq13B6mCNhs8u4anAmIdYtKcnDFcAvMAVAC/yafjKpz2vfNqTTMYcorwZoi6hXtsjkYjKqRbZFawNVhmXpoQ6dqMmlqYokYjGot094RBcAXACVwC8yKfhH//a/Ye/dicSUZczMNAnp1okV1DOXJczMNAX7e/uCbfBFQAncAXAi3wavvhJ+MVPwolEv8sZiPe9+En4xWFX6BI+D4lEtOxj5JyH/khXd7hV+DyASgWuAHiRT8P//CT8n5+Eo9GeWLQnFu11J9FoT1+kS061an5NIh4WPg9yL6NiHrrDrZ2hgPB5AJUKXAHwEm5vmLX4KfmoHUXMWvxUKtkrfB7qjtV3dTR1tgc624NdHU3upLM92BHytzaf2nPggPB5AJUKPgcJ8NLT6d30/JvfvGv7fc/Ubn4+Oir45l3bH/ntjkw6Knwe7q556d2PdwV9R91MwHck4D28c8/uux7+vfB5AJUKXAHwIn+/47ZXPxxF31dc8x9vp9P92ewA5kH4PIBKBa4AeIn1tw3EOlPJSDYTz2YHctlELieMfD4rCpVsajCXyuWSA7EOzIPweQCVClwBAABAAbgCAACAAnAFAAAABeAKAAAACsAVAAAAFIArAAAAKABXAAAAUACuAAAAoMC5C/A5SAAAAM4AVwAAAFAArgAAAKAAXAEAAEABuAIAAIACcAUAAAAF4AoAAAAKwBUAAAAUgCsAAAAoAFcAAABQYNgV/u77TdNXhWVvuHRlhIcL740DAACoJM5d0PL/3bjvrDlveM76hzcqjTlCEdtpWdTc3OmYWlYwuhhzq7/jrH944//56qsez7QXAAAAAJn/H0vQY8BMxaoOAAAAAElFTkSuQmCC" /> </div>
<br />
<a href="http://www.lancemueller.com/blog/Export%20by%20Extension_v7.EnPack" target="_blank">Download v7 here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-85395007035888843882015-11-06T19:47:00.002-08:002015-11-06T19:47:58.068-08:00EnCase EnScript to find files on remote systems by MD5 hash - GO FETCH!<div dir="ltr" style="text-align: left;" trbidi="on">
I have had a few recent requests for an EnCase Enterprise EnScript to help find files on remote systems. The following EnScript accepts a plain text file (ASCII or Unicode) that contains MD5 hash values, one per line. The EnScript also contains a condition feature that allows the user to refine what files on the remote system they want to hash and compare to the list. Choose a text file, define a condition, go fetch. <br />
<br />
The logical choice is to define a condition that contains specific file sizes (logical size). This will cause the EnScript to only hash the remote files that match the file sizes (or path or other criteria) you specify, dramatically speeding up the searching process.<br />
<br />
The initial screen prompts for the role, a list of target systems (hostnames, IP addresses or IP ranges) you want to search and a text file that contains MD5 hash values:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6mSTgprGsnx1z2-n1x4CAllH9FDvtPLbSrd71mRjplm0vbeF-eFWzj5AOCtnLJXiP2jmKAdRrnmedLRjeV9MrUy8p1etGYcNe4JMPwC6g1EI4YqNXKSgKNL9jsIXSzzzjbF5RW3zJ6dz4/s1600/snap1003.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="355" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6mSTgprGsnx1z2-n1x4CAllH9FDvtPLbSrd71mRjplm0vbeF-eFWzj5AOCtnLJXiP2jmKAdRrnmedLRjeV9MrUy8p1etGYcNe4JMPwC6g1EI4YqNXKSgKNL9jsIXSzzzjbF5RW3zJ6dz4/s400/snap1003.jpg" width="400" /> </a></div>
<div class="separator" style="clear: both; text-align: left;">
The next screen allows you to define a condition. I <u><i><b>strongly</b></i></u> recommend using the logical size to reduce the number of remote files that need to be hashed and then compared with your list. If you do not have logical sizes of the files you want to search for, you can use other criteria such as name, path or other metadata, if feasible. Its important to remember that this is a normal condition used by EnCase, therefore if you do not specify any criteria (and leave it blank), no remote files will match that criteria and no files will ever match. So, if you do not have any criteria to help refine and reduce the remote files that need to be hashed and compared, you need to at least define a filter that includes everything, such as logical size >0.</div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHriHwtu3YA6j-9u_h7SXs_I8rnNBSccJHL1WHKyAyQUD5fJlf7Mm9RBnOt82t9KPs7cIpIXuQhM0Gxa6ynJlxJqOupDyRqS0h9mcTbbLNeng773EEf3FIx5MXqvrYQ492w03facB6jYww/s1600/snap1004.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="376" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHriHwtu3YA6j-9u_h7SXs_I8rnNBSccJHL1WHKyAyQUD5fJlf7Mm9RBnOt82t9KPs7cIpIXuQhM0Gxa6ynJlxJqOupDyRqS0h9mcTbbLNeng773EEf3FIx5MXqvrYQ492w03facB6jYww/s640/snap1004.jpg" width="640" /> </a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCoqOaIFYq8_nO3N6UzvFK2zRSRhv2JiXZFh4An7_tuvEn7-WH7rgY0zzJ0rOuecxA91vO9dPN86jY_pXLoQKEpTzE_YECvCGdE4feMqRjOJT6A7w4onVxFtS7pSg_3FEa800hUsOCdlO6/s1600/snap1005.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCoqOaIFYq8_nO3N6UzvFK2zRSRhv2JiXZFh4An7_tuvEn7-WH7rgY0zzJ0rOuecxA91vO9dPN86jY_pXLoQKEpTzE_YECvCGdE4feMqRjOJT6A7w4onVxFtS7pSg_3FEa800hUsOCdlO6/s640/snap1005.jpg" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
Once launched, any files that match your filter criteria are hashed and then compared against the list of MD5 hash values you provided. If a file's MD5 matches, a LEF is created (in the case's default export folder) that contains all the files on that volume & host that match the MD5 hash values. Original paths are maintained:</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0ztT6dHK9r4wcf_sNXxiwj7TVDYM-BkA0atGUUcbXTaLm3HKSo2Uywt0027S8lm0-qnfBGiy42gtD7GTa4j509MTquYqS9EMeYlzkTguOMjjt-vFDA5nsixW61iPaYWWF2h3YkqX5cuLl/s1600/snap1007.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="184" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0ztT6dHK9r4wcf_sNXxiwj7TVDYM-BkA0atGUUcbXTaLm3HKSo2Uywt0027S8lm0-qnfBGiy42gtD7GTa4j509MTquYqS9EMeYlzkTguOMjjt-vFDA5nsixW61iPaYWWF2h3YkqX5cuLl/s640/snap1007.jpg" width="640" /> </a> </div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO7MIGQgIpxppMVFzzYaIu1gEb0ntTKYjRPvC5HNa8UDFVq9_dLdftf12lUVfkT5KGnQZCeyeupPF7AVoMQQKRntw3-9nRZ9tM-R7KVIGYBOtIFTtCyUpMcvQ_U0J3mdJiL2Uy9FWUpHvC/s1600/snap1006.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="102" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO7MIGQgIpxppMVFzzYaIu1gEb0ntTKYjRPvC5HNa8UDFVq9_dLdftf12lUVfkT5KGnQZCeyeupPF7AVoMQQKRntw3-9nRZ9tM-R7KVIGYBOtIFTtCyUpMcvQ_U0J3mdJiL2Uy9FWUpHvC/s640/snap1006.jpg" width="640" /> </a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="http://www.lancemueller.com/blog/EnCase_Enterprise_Find_Files_by_Hash_EnCase_v7_v1.0.EnPack" target="_blank">EnCase v7 download here </a></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<br /></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-18218069073437670822015-05-23T09:06:00.000-07:002015-05-23T09:12:21.260-07:00EnCase v7 EnScript to check files to VirusTotal - Updated<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<div style="margin-left: 1em; margin-right: 1em;">
<br /></div>
<br />
<br />
<a href="http://www.forensickb.com/2013/10/vtbookmark.html" target="_blank">In October 2013,</a> I wrote an EnScript that checked files that are tagged with the "VirusTotal" tag to VirusTotal. That original EnScript simply calculated the hash value of the tagged files and then sent it to VirusTotal for evaluation using their API. The original EnScript used an external EXE (VTBookmark.exe) that I wrote in C# to do the actual communication to the VirusTotal website.<br />
<br />
I have updated this EnScript to include the name of the detected malware that each AV product associates with the hash value. <br />
<br />
I have also rewritten it to no longer require the external "VTBookmark.exe" application. All the processing and communications are handled natively by EnScript now.<br />
<br />
When using this EnScript, any hash value that has a positive value (> 0) is bookmarked. The console pane will display the status of each hash value, but only those with a positive value are bookmarked. Each hash value can have one of three values:<br />
<ol style="text-align: left;">
<li>A score of '0' signifies a hash value that is known to VirusTotal, but is not identified by any of the AV products as a risk. </li>
<li>A score greater than zero (> 0) represents the number of AV products that recognize the hash value as a potential risk</li>
<li>A score of '-1' signifies a hash value that is unknown to VirusTotal. This means the file contents have never been sent and/or analyzed by the AV products.</li>
</ol>
VirusTotal restricts the use of a public API key to four requests per minute. Therefore, if you tag more than four files, the EnScript will pause in order to wait for the time restriction applied to public (free) API keys. The console will indicate when this is happening: <br />
<br />
<img alt="" height="73" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA+QAAAByCAIAAABV6IyFAAAesklEQVR4nO2dS5ojOY6Eddk50RykjzJ9nN55L2pS6UEABgNId9EV9i/yc1F4GMCHmFGRqte//v2ff/37P//zv/93CCGEEEIIIXbipcu6EEIIIYQQe6LLuhBCCCGEEJuiy7oQQgghhBCbMl7WX6/X6/X65+Fjmv5o6DkOvq8TrgvpHmXEsnF2Xjz2BXqq2dOGAHfXsVqCEEIIIYR48+Oy/r5RnW9Xk9es9rV7xiV6rrrgOL0RXglZxdmm0YTIoJHdFaObuhBCCCFEG/+y/vft+Kez0Q9i7QPpPjjawaSSuct6ar/PZd1tiO0biF9VTt718WIQQgghhBBV/F+DSS9q/D2Sdz8/NK53WBJ5jY4G2+5RduDIiI/cS3/9SHVGf9GKUtgq8F8hhBBCCCEEJvwHpvj+d8S/5RzFiXzdRAsv69EgKZV3xxH44I2GuP0kfRlj5rIOVoIu60IIIYQQPcJfg8FXRv5alrqTcVIW6kxdwF9gGHcyUaMhvZt6ozOpuy7rQgghhBDzjJd196ez7s9N7U9zeffI2P0JsfvTYr+YSvbIN5K00H1evBuwJDX1JZWfzV4GPo4QQgghhLD8xu9Zn7w46t4phBBCCCHu4Tde1oUQQgghhHgEuqwLIYQQQgixKbqsCyGEEEIIsSm6rAshhBBCCLEpuqwLIYQQQgixKbqsCyGEEEIIsSnjZf0LvhK7XcIX1H4/k027ruc3zOalKR4t/pdT/R8UCJLffNqcc+0j5p3xHiV8olLeGZ0bTscj0AFYxfnJ+qPbp+9Qf7PPh8el7rdFdqPxKTZcWhtK+gKYrp5tvmMWdNp8ah4nz6WraSipuiwp9tKO7TMdl9L7NPyO5txQhfOTdTLx6wQ5OIycHyLLNHsqqQSf+sjEY7PUHVTEJHr9JI0JKmXMbDl8RZE7EON2wLq7bbe5mDKjfpK1g+nAlUYasO/wbB+seGwJKnKrY8qslg8sX95suoPDiJXayJ5Kcn3d5yhLqhObkWUyrXMDvn7SaEgkyTWz5fAVRe5AjNsB6+623eZiyoyyW9+o86UyXcvJWTtHjozd7KAikMiNwEh1dUZlRlIZScCegffF3cMtdctsZGfM3GcQEEvCZmRFTJfcgK+fpDFBpcCseVl3DdwJiGbFrQrHZyz59RR1NnU/aPHDdDbc3dRkotQdU5oOnD2VhA2wJH4xVN1Bdiyer51PNzlxWGe0OPmK0jU/Iz61xO57HkG8vU6bwfK3nTZ8ovMgXybZT1LtEKdxXICM/DIrTYfdI27AaiKQscRTTkUQhJHER/udB6D/O+vk/hws+Wpd49dPcOooTm8zVN1J8fO1g5E0UTjl9SnuTQdfkfsMEtlJd3WCl+dQjTJT8XiOGMAi4R3TFYKbxiyw85+RZQlyOlz91TkCqXtrPtLAu2NjoHO+TDCSJoqqIKfyoOcdlElW5D6DRHZ+XZ3g5TlUqczzn0winB0ksjpJ91QSrr20lqK3mEE+eym1O86swyrksomyY9nYmF+0b2Nsk2YExkDSfEVgpL1o+alPm/zjsl7qICm31MFqRus1sx94d1L8wtobTS5tVzImb8lnb+xbsrHRy2jjMakZ8b2GgHT8WwdRph1M+wkGhxnpnSE4O+/1lCOosebTFDptmOzPOm2sAPyyUeYVh1Uas52dX1pVx8Y2TB3xScvzxFORt9QByLgfx+my/vrD8ed8wavQtXHHwQjjjgX03HFFaVvJ7LgbPXc7Hj3blyBm2pDIPlUSDWJ3rCrVGSkfDNo9adROFhiJ50XaMnFnmOdI/NsSN2RQxdcO7CMbdxyMMO5YwEL3mTJx4T13Ox49uxU1uoHtUyXRIHbHqlKdkfLBoNGT959udrctpTKBJS8SSwK1l7IziaqWwBiUWarxMMvg5a2oUpOrOlP9PfdJyIC8JFxjz92OR89uRXzfXgbHRt+zfh0LV7YQj4Y5sMQMaq8Qz0Kn4kK+vpO6rF8F+TcqIX4D2giXotNGiMehDbuK33AA6rIuhBBCCCHEpuiyLoQQQgghxKbosi6EEEIIIcSm6LIuhBBCCCHEpuiyLoQQQgghxKb4/wfTY+7fKbvfVTmjMkqx4T/+5VUxXdqqRvANo8fqKU6/c3Qm7HX2QgghhBBr8f8PpvN3lEuvOPwd8SM3LSYpL2z5JXiV+w1TzPy9sSrjU50XQgghhGjgX9ZHo58/4Bx+vGotD3PvHy55jDu4KpFXRvDTWTA4ZAeDae2MMBAwKhBXtLAhWAzfDdBVLD6tvVFRWiOQFI3Yihoxe4miMoUQQgjxHfi/BvPy7mSHuZ/ZQfuuDdJwd3RzdxTXIKoIa7ODbfGMsGgQZ5/Pi0OBjO7IpPi2O6io3SuwKZbMOF5gbiJ+4oQQQgjxUMJ/YDrcPofLcemSgV8y7pG2kuUw3q6Ib0hVGHlZt9nP45N5yQjkZZ1MFImfueu7XQL2bgRSPB/QzhrOi42jxSCEEEKIryH8NRh8GXriZb13L8eDDUlkkGiwdx133+39TWPJZT26XK5aNvxSBCy/rGOdjUS6oAshhBBfz3hZj34YeR6PngfLwaDqnujmzFzLlwFk7w1iYTg1HkzdGw2JBoF7VE4q6T0yPJCSyMGXIdKJy4zCYjM+4Hwi4O4KYAaFEEIIsQ+bfs/6Zy8QbnbdaYQQQgghxM3sdVknf0h5Z/bPShJCCCGEEL+ZvS7rQgghhBBCiDe6rAshhBBCCLEpuqwLIYQQQgixKbqsCyGEEEIIsSm6rAshhBBCCLEp42UdfPlJ+gXPr59YSxsw/TLpUkwwmKZOLVNJuCI3YK9MvnyyzIaknp7D9DPKAmq3MJZRFmzPDPb0MEFm3A9abeTozrsbMJ24SIZNBJbWfEMeDdOB87Zam/rqaLfN8mQi4E6eDFHAo3VuPH133Lnfl8RMg6TL+2VOy6sl9aJ9ZEW1s7c3DjneM1tL/n8wPYsbRsZYnnsUM1rT7ZhYfBqzZMkkbbtf2rrUeFU/efGNxqbu2JLcY2Sfed+2Wcly0quxuZi5buwOLOOzfOqTjHk3/RSZWdhLwAKuVkImit6d1BndDw5i4q7QcwUlJXfu9yUBmZscGFxb1EXRemfIFdmv+Igs3ax496uhLuvvo+SHZ/1ilE7ATMxoxIrvXUP5mFi8687rbHzQpomiQV481tm4tDWu4G3L1x+APZki9R2OoTNAj2sZPZ9fMmWSysEzM9dke1PLtKKhUW6XBgPX3XWxKXB2AJPIvoUD8omYQevL63QjY6lnl4aAIVH0TCaKGuK6u2agIakZEA/6lrYu6pIr4/3suuMCQevsuNsQpiK3S64knAvotIORJFzRexCUY7OQxqkl7okV6Y67nbeDUcY0tZudT3ScOpwmcjNe5MVPhzvFP0JFvwYztMDKAqGjYtzJbsTEEVzHnnvUuGgCXPFkmeSgmwhnd0dmOh+FZZrMiweSInnY2LUE7kw3mFxkdhwhFWNjnrvX69IwbicOB8cl9GrHSauDw2KOLN3eprIBjUTkXojmaEa8uzEZnXzMKFRUSHuF8InARnANopdY7fslsxSxnlJFW+2O5fu9Okd8opnl7W7hyDLVyVf0fk4PEFdn7wypdozJvjCRtXmd4B0be/PwpoOJGf4D06EFoAy8/vj9wMdkcp0HwQTwS9+Ol3qd7hwyZqmffEPAZo7WtLUkIzDi5/cDaQmWN18LMBuSDolAtKqYtJ94F/cS4Yp6mwtb8suGcR+WPV8RWP9ph22uaplMcLIiJnh7Oo64Ie7IYBktWibaedzqBwHbU8x0qWTpinf1YPH77472Aot0MpGBJVkmX5EVmVoOI+5G4Ctyw2L4ecfZgSQy+xWJcNuxe8mSn7jI8q+Ne1nnG+RmTb2qvQ7VZ13DBr1Tw9VcqohcXpOt603iqtnsZWxsvIYl6ZI2sJRrcs2ny6+xGLByUid4t1ERflldvfbdwfL8Z+rOKMGDjZiTG2FJRfOHQBqTHOlZllLziw1rmN8IrniQ97m7Y3K/A52rVvIVy5u3BGvgorV0BLWTlnYtpYUw2a9IhLPzOvlEhzcd6dQch/md9XPxQ/ThrcjYHbGW/KCNiX3fbzHPwD0tnGkI6Q4KJ7vEJEqf3bBuilQ/WRFO7UawMJZRFvctVxWQCgJG7kzronGb6/zACADicSLrS+p8v8XEPFsC2VinlXR4s4C7FD3jwt2KIpFWBpAEIkc27ji2jHSSDQEjQzqspxQTjOMaew2JUkfdi2oH/bTiLTgF2SUrwOK6A/GlbrgN4Sty3aPnSJWrM6rdxgQVMXORlo/FMxWdHyJ62a2lfUhTM9lBogE+EV8RLwkXZVuEy/9roO9ZF0LcQ3qMNizFbpBzd88U77CQ3I/wnuO38n2Vfl9FPdSHVeiyLoQQYhbyx1q38XE9MwI+Ll6IebSMF6LLuhBCCCGEEJuiy7oQQgghhBCbosu6EEIIIYQQm6LLuhBCCCGEEJuiy7oQQgghhBCb8veyDr7l0f2eyOhrJu1bZNg0l43pBoyyAElRFlJk1Xgy0bzOg/v64XbtoJ82gjUGvi6M5ZKYpHspEQgy437QaiPHwX1mLUUybCKwWuYb8mj4RX6s/rq0G6LdNsuTiYA7eTJEAY/WufH03XHnfl8SMw1yp+xHzDs/oa+f3CPvQYz/U6T/Hw0+aK3B0FNsED2DQeDCRMDiFw6Seu6UhFvHTzETk5843KV0gUUwZktiLtTDm5UsJ72uWEuukoblPif4R5SQt4TefeLOishD4OrsjS7x7nzY93z17ihP3x137vclAdMgd8reZ9IB/IRuuJj3wb+sH0HXyEtb75ir7oHqZR0IjgaxS+S+KvsVOg9vjvjLtDvYK9MalyQxChlJx5/PSNzMUiLge070+gnQ41pGz+eXTJmkcvDMr7o0UWqZVjQ0yu3SYOC6uy42Bc4OYBLZt3BAPhEzaH15nW5kLPXs0hAwJIqeyURRQ1x31ww0JDUD4kHf0tZFXXJlvJ9dd1wgaJ0ddxvCVOR2yZWEcwGddjCShCuKxLs6o4DtinBP2u5ul6KYVi1oXTu7G/NrWH9Zj5YUM0+g0cwytYPRnJWyR+WcjUsVRWt0eC51Huvk47hS3bC4zCsaAqja9PpJJnLN0uw4QirGxhzWJw6VvrtkLTGJsGVjd4DB85/A0u1tKhvQSOTuRBuW2UdV8eBM4Fddmg432R4jUTR+WfLLBuvEL7Ha90tmKWI9pYq22h3L93t1jvhEveXda92qioYIALxl0g2VhmU2V7Rf+O3MSHoin//JOtlrZsQOpjb8ye6y9nBsD7o6wbYftkRaLx68YtlUN177JHIbAmKSp0BUMug8TjS5kkGZOG81Jpg4pqLUkl9gjPuw8PiKIvFMh22uaplMcLIiJnh7Oo64Ie7IYBktWibaedzqBwHbU8x0qWTpinf1YPH77472Aot0MpGBJVlmqaJGzF5F1t2aRUTufCIclhl01Vb7+ZVc9TvrpDuT1A1LDk5mx9PPd+nOwVTebuKxPP6U4W3IU4xfdUyuyTWfbsOZlcwnckOR08pUhF+WFq377mA5fDbw+yhdQo2jo5eIj9nInr5sNwSvIhCnYbnwQ4pXNb8RXPEg73N3x+R+BzpXreRVFS3PziQC46SZXYr8B0pqTJY8eeR+AZd8Gwx2rw4e3oq0GtxBMlHq6xqvLXNmsFQ7jrBEUqSHTB35uoBckVn6lhuTTES62/G0Ijf1e6SkH4jHiawvqfP9FhPzbAlkY51W0uHNAu5S9IwLdyuKRFoZQBKIHNm449gy0kk2BIwM6bCeUkwwjmvsNSRKHXUvqh3004q34BRkl6wAi+sOxJe64TaEr8h1j54jVa7OqHYbE1RUap3NnioH47ilrvLI3drj8kGHI1+3olJ2UtJD0fesCyFugj9Dv/K0/SWQc3fPFO+wkNwrUc/xW/m+Sr+vIvFZdFkXQggxy24/0/q4nhkBHxcvhNgKXdaFEEIIIYTYFF3WhRBCCCGE2BRd1oUQQgghhNgUXdaFEEIIIYTYFF3WhRBCCCGE2JTxsk5+9eYwPoww7mRAG/P1E9I9zW7DRonScSC+6v5+q1E+TmRTpAF5nalCXqebiIHxjXSWYpLuk+W8g8y4H7TayJGfo3TZRDLcFcKI+YXwi/xY/V1yN0S7bZYnEwF38mSIAh6tc+Ppu+PO/b4kZhqkmuKKiVsYc9VEPHR9fgrnJ+v2UzZ9juyZEfcjGWgouZcSWYN5S/uy4R4FxNNxWz9dna4LH59ZaSmlT0oyi2s249s2K1lOeq1aDNirZ7nPif8RJeQtoXefuLMiLOBqJWSi9FNv1ZZ8z1fvYvT03XHnfr/n3rnPRCzhy8p5BLXLOh6M3iKN8TN/b44GSQELJbmWV7u7pDFxqPR+dltDSpQu6/bZ/ZhcflkfEr1+AvS4ltHz+SVTJqkcPPOLIU2UWqYVDY1yuzQYuO6ui02BswOYRPYtHJBPxAxaX16nGxlLPbs0BAyJomcyUdQQ1901Aw1JzYB40Le0dVGXXBnvZ9cdFwhaZ8fdhjAVuV1yJeFcQKcdjCSBilydURayzEhnNOI2BNd+zgLURr6pSFeS+If+ZR2sqsiYt3yZVe4uPnJJuTDLNE3EDFoZVfFtnZG7HTyCTdLWCZ6r/QSTOJi5lWJcnZH4KCaTyDVLs+MIqRh3jpgyU+XnaKUe4hJ6teOk1cFhg0SWeP0zFQFLMlG6Ow44RzPi3d3K6ORjRqGiQtorhE8ENoJrEL1MDyt+KWI9pYq22h3L93t1jvhEveUNZnNt7dHLxponp9XNC3Y3kCTeLPjJOmOfemHL4WhL4zRW0vuZSVSyjM5l5tw/08jujriSgHs66OrkWxcN4uwMjGN0Ermdj2KSCqPmgNbhRPzerJaJ81ZjgvXJVJRapmXy4oc/SxWBBZx22OaqlskEJytigren44gb4o4MltGiZaKdx61+ELA9xUyXSpaueFcPFr//7mgvsEgnExlYkmVWK4pW4/Ayys5Mx8Iy0xoj0mUGJIl/aP7O+uTSxzMBllGafca9EWoyUbqf3UHrvnA6Gk3mg6eOZCISxpesF79FiiQnbtVsRgcuuQ35RG4ocu/w53W6Cxid7ruD5fnP1J1RggcbMflPtUZDyESTHxNMTHKkZ1lK3fjscMfnN4IrHuR97u6Y3O9A56qVvKQiZjWC4Mx0pDEbHxOlD5HImN8d4jh+XtZfP/lrZEbcQd7dtcSOrwAssiG+UY477orna0/D8qpwPye7hIOnARsNYYi6BMzSt7DOVC3jDsqPErmp3yMl/UA8TmR9SZ3vt5iYZ0sgG+u0kg5vFnCXomdcuFtRJNLKAJJA5MjGHceWkU6yIWBkSIf1lGKCcVxjryFR6qh7Ue2gn1a8Bacgu2QFWFx3IL7UDbchfEWue/QcqXJ1RrXbmKAiVycj6WVWgo2ZigQBGWNb7BAh0tOQJN7oe9aFEJ+EP5p1iD8Xcu7umeIdFpLVsFWLduD7Kt2non2UvNlQ0lbosi6EEOISdvtR2cf1zAj4uHjxHWy4kDaUtBu6rAshhBBCCLEpuqwLIYQQQgixKbqsCyGEEEIIsSm6rAshhBBCCLEpuqwLIYQQQgixKcu+Zx18RybjzmR3c2HLns5qzCVdqjaq54sH3ZhW50F8t6tNFNX++gnWGYlJLXHnI3tmsKeHCTLjftBqI0d+OtIFBlaRXSSMmF8I04G3zdpe3RDttlmeTATcyZMhCni0zo2n74479/uSmGmQaopHTByo+hH6v4PxJ+v2U9P90MWD0ed0w2DSknexL6PBRqKF2VPfhqSqALt1q12K3BmdTCJsSZ4vpRm51KxkOenVWDbpJnWVNCz3+WD4iBJ+eTfuE3dWhAVcrYRMlJ69q7bke756t8mn74479/uSgGmQfSZiIeRNQFyHf1lPT/Mlt8PIgLl+kZYlSY3PMP5Thx9kUjOXdV7S4fWzMZiq5bNfelm3z+6hs/yyPiR6/QTocS2j5/NLpkxSOXhmJo5sb2qZVjQ0yu3SYOC6uy42Bc4OYBLZt3BAPhEzaH15nW5kLPXs0hAwJIqeyURRQ1x31ww0JDUD4kHf0tZFXXJlvJ9dd1wgaJ0ddxvCVOR2yZWEcwGddjCSBCpydUZZojLditzUrnGUy+JWZIt6j0SSgH7QhCg70Lmw9s1xLuvRArIjtin2OTI46MXn665bppKiNRo1hBkks7trFCxcZjpSSTZgOuhWwWfvdT6aWRyTtATubjScApgxbQQRUjE2ZrrqSOXnaKUe4hJ6taf7qDQ4rHCwN0FMpiJgSSZKN8IB52hGvLsxGZ18zChUVEh7hfCJwEZwDaKXWO37JbMUsZ5SRVvtjuX7vTpHfKLe8gazSUoq7Y70XUY2v7zT4I0Ni7mi9v2hfrIODtYjm7a0WXyvrVdpJnqSlg8uaR1/FpAxX38YvIbB109Aomr2yBeM45ikJaiILxCYRd1Lo1XFpGsJT1wvEa6IX7RYQ2/LMO7DwuMrAms17bDNVS2TCU5WxARvT8cRN8QdGSyjRctEO49b/SBge4qZLpUsXfGuHix+/93RXmCRTiYysCTLrFYUrcbhZSM7jgksseyqziNoCOhPFBaIBNl5nU+k9jvrf93gdgJrq2owb7lERm/wiuzpy1XiGxXxMSP9OJEL1plm4Y8nUk+U69IpPp9EaSJSOakTvNuoCL8srTr33cHy/GfqzijBg42YjeUduTeypy/bDWF2elRv1bKUml9sWMP8RnDFg7zP3R2T+x3oXLWSl1TErMb5JtssvTOEfIsZB0VVwzJJ+XqfRf5tMO7gedyajTm8cRAQJ+pZur49nY2KFmbnaycHzy9fhmpdTKLILFKVwhhH2d23sKRSrsgdVBolclO/R0r6gXicyPqSOt9vMTHPlkA21mklHd4s4C5Fz7hwt6JIpJUBJIHIkY07ji0jnWRDwMiQDuspxQTjuMZeQ6LUUfei2kE/rXgLTkF2yQqwuO5AfKkbbkP4ilz36DlS5eqMarcxQUWuTkYSqCLSaR9ARS5M4VH3mHKGcZw6sgQ6rT1Z+P7oe9aFEDfBH5dPP1h/M+Tc3TPFOywk96rRc/xWvq/S76tIfBZd1oUQQsyy24+vPq5nRsDHxQshtkKXdSGEEEKIX8HL49OiRIIu60IIIYQQQmyKLutCCCGEEEJsii7rQgghhBBCbIou60IIIYQQQmyK8z9Fmv837NW3Hsc31XIRF/3LlcmAVVVr9bupgZ77v+hwSWeWNO2Lt1ijdctP44v44JTdeSxMckWWJeWngzuwpyohrmb8nyL9faO7H4DjwivFkjhXa9hBZ5sl961Vodyw1eC95X3FonU7435YNoJPsiTpEj3fdFwM3HBIXhHtupjz2SdVkYfVhmtpkuq5tAMbShLiasLL+g+jn3/Jjp7fI647iD/Y4L/iv36SV+gZRzGPnwdWJAmUyegkxUcCQEy3Xt7dDcI0OdI/PJSyu+KjaGQ/o3HcT9KSZAgInsmwVqFVhcfd1NEcpZaupLMxrmvoPFgMfDQwcUyTq7JdwcOzLef8Vpo6KsqN5s6d1cbMUdRPPMIU5UoanqPs52J7DFMDJEWVujrBc+TLvGXNyJi9JqRekQa3ImxJNgTHFOL7yC/r7r4Fmzl6mW6nYceS2TG8+PMp4Gomy0x1Ns5BPlEkuNHP+bNvZjYbC4zXkybi+1mlOpu9mJFmMjs/cTO7A9fSW8k45qQkxnJ561Ibvp/YfbKfQKc9VMns/HHByMbMHFYHvbmilyC7jYz1g5jYPV0hTF7gXhokGzIz40I8i/su61H8RiJ+i1YrYj5XopdncHZryetPEzHnoM3ujmBtKSBLKTu/wFI9eLDXOh53NucTgYbgCeVrH1SlwaNcpQW/ajr4eQcRqolS8VH2VC0j2Cp3B91NV5ojRucQ1s3eax0vLMXtBtaZpo76CWaTWSGMgKr7TPaZ1s1vGWZjCvEF5L+zjgfdT4LoJd5R8/sWx2QS2c+VKBR+SYpPSQ96JhHzYYN19o5CV0nDZZMFNvl5wE8cdkkjg081JvuSbRjl4heAm6i0ksmYaahVCywSXz1JUhmuJVPFzByBl+BQxTGXtI6EPKz4zXXE/WQ2bPX4veFU5DUwa7ianey2EN9K+G0wP4ziQftgjaPxKMVgyUvCkV1JrkK3orQcJhGwJJUzqobB84NrmSayg0C269vObh9A7VVVzGAqtZqaFM8XdZhPMpAF156KjEjLHETiWmyE93OkloyZDqZ6gD0o/OUtYKZ1jDHW41YKpOJuDO5APCgWVwRKwJagA6VyqjqjZlpVoEuujChsOyZTPhjE2dNxpp9kQ15mjdnsWLkQz0Lfs4544oZ/omYxyfDh90ElgG2FreILCnxuCXsqX6Jqz9KEEHeiy3oI+aOFrXiiZrGQPRfAnqrW8vQan65/N+b7qRkRQrzRZV0IIYQQQohN0WVdCCGEEL8I/ScL8Sx0WRdCCCHEL0KXdfEs/gvuzlyvPzei3gAAAABJRU5ErkJggg==" width="640" /><br />
When run, you can choose to tag specific files (recommended when using a public API key) or not have any 'VirusTotal' tag and the EnScript will conduct a file signature analysis and send the hash values of all identified executable files to Virus Total (recommended only if you have a private API key).<br />
<img alt="" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAiQAAAGICAIAAAD+p2wvAAAgAElEQVR4nO3d749dxX3H8fNHrKJI5dE+QInUZ16kPlgM8VZOMCKEbrOkJcFPUkvhAVhqVlbSlJUSBVsxwraCG2wHQkNKmlKquoEGsyb8cimEH8Y2sQPEgO0N2MbABdsgbFfbB9d7fXxm5jvfmXO+99e+XxpZZ+eeM/OdOfeej3fBdjFfMgYAQG2XXHLJZz/72XK+FJ2YWbZs2Y4dO44cOTIPAEAN586de/3YiT+bWDHymc+0e4r5+fmxsbENGzbMzc3d9dDLNBqNRqM10va2PvnV/rfaeVPMz88vW7Zsbm5uy0N7aDQajUZrsD35/ulL/vqG+fn5Ymxs7MiRI1v/ey+NRqPRaI23fzt2+pJLLinGxsY++eSTbb/ZR6PRaLRF1e69f+c3Lr9mYmS02faNy6+59/6dnVnuf+fU2NhYMTY2Nj8/f/cjr9BoNBptUbVrL73s0a3bTu17odn26NZt1156WWeWf367FDb37HiFRqPRaIuqTYyMntzzu2O/+mmz7eSe302MjHZm+emfSmHzi9++SqPRaLRF1SZGRj966dl37t9y9Jdbjv5yy9H7z7d2zzvtg4Xjoxe1reevun/rhQsXDj566dmJkdHOLGvfKoXNvzz+WrkVReHtcfs1rfDJGCdUWJ0xsyvp2oA0Go1m1CZGRlvP73r755svtPs2v33f+eOffPd7k1Or2u0n3/2et8dtf/r55tbzuyZGRjuz/OCNUtj88ok/lltRFNGejKYZRD5HLiyjyEbWZTogjUajGbWJkdEPnn1y7p6Nc3dvnLt745GFg3abnFrV+UOak1Or/mnNdyo9R+7eeKR0/tw9G9tDffDskxMjo51Z/vFgKWz+9cmDlVYUhfe4TtOMI5/jvlqzzqaWZjcgjUajGbWJkdH3dj12+K71h7asP7Rl/aG7bl84WH9oy/rN02smp1b934LK8ebpNYe3rD+0ZX3710Nb1h/acnv7+L1dj02MjHZm+c4fS2Hzq6cPVlpRFO5x5aD8q/eq8peVV8vnlIct91ReDY0gzO4WEBrQXVqlquggld1wS6XRaLS+au2weXPz2jfvXPvm5rVvbV775uYLB2/dufbOb09PTq06c7HJqVV3fnv6/Gl3XrjqzYWr2mHTmeXvXz95IWwe2PVmpRVF4R6XD9xO75mhMfMudF8t55N+5Epn5aXoMqO74V0FjUaj9VWbGBl9desdj0z8udC+f83Vk1Orji2YnFr1/Wuuli95desdEyOjnVlufq0UNv/+P2+5rSiKzq/lnlCncOztiY7c/rJNM6ZcXqhTU5V7HKrKHZBGo9H6s7XDZvaqJY+uWDK74vyvsyuWzK4Ym71qbHbFkh9c9+XJqVWHLzY5teoH13159qqx2auWPHrVkkevWjK7Ymx2xdjsVUvarR02nVm+9WopbP7jfw+5rSiKzq/lnlBn5TjpS3lk76vZg1Q6NVXJxVROc4uk0Wi0PmwTI6Ov3b3p8cmlTrv88cmlP/zq5OTUqj8uqBz/8KuTvguXPj659LW7N02MjHZm+eaBUtj857OH3VYURefXco/QWe6vnCZ/GR3ZO0LeIG6n9yV9Me5pbp00Go3Wb21iZPTgfXftunHF0zde/fSNV+9auWLXjRfa5NSqAwsmp1at/du/qfTs6lyycsWulSt23Xh1+8KD9901MTLamWXl70ths/25OW8risL7pdvf7imfUDnHvapzWmg09wRhBO8g0U53ZO+r7nGoKqFUGo1G66s2MTL61gP3PnfT9c/d9LWFdv3Cl9f/aOXKzp+q+dHKlc/d9DWn5/rSJdc/963z47z1wL0TI6OdWW4oh81/Pf8nGo1Goy2qNjEyOvfQAy9Nf7Oh9nftg7mHHpgYGe3MMvXKRxfC5tcvvE2j0Wi0RdUmRkaPPvbw3plb9t56y76ZW/bdesveTpu5ee/MLXtnbtl76837zh/fvHfm5r23Lhzfer51ruocHH3s4YmR0c4sf7WvFDYPvfg2jUaj0RZV+8rn/2Ln1m0nnnmi2bZz67avfP4vOrN8eW8pbB5+6R0ajUajLaq27WcPX3vpZY3/ezbXXnrZtp893JllxZ7Sf7P5ze6jNBqNRqM13r74cuk7m0dePkaj0Wg0WuPtL3eXwmbHnuM0Go1GozXelrXDpiiKdti0AABo1I49x6946aPzfzKRsAEAWCBsAADmCBsAgDnCBgBgjrABAJgjbAAA5ggbAIA5wgYAYI6wAQCYI2wAAOYIGwCAuYSwKXza/d6T5Ykrg2jOVCwnPm+SzmjuQWoNzRYGAIMl5zubynMz7zGaER71n9fZIySFjXc6wgbAYjZIYVMfYQMAPdFY2FR+0lU5dh+1oR73ZO+Z5dPKP81zO8s97k/k5GPlj9G8Y3p/2OhdXWhe8gnA0GgmbISHcuiJ6T76veO4X4ayx51XU4w3sUJfakYInazcJWETAGBwNfxjtNBzNjpI9BLN4z5agFCJ91sKZdi4qSmvqBItBAyAodeNsHG/jPZEUyGpAOuwCfVowiY6GgAMgX4PG7dz8YQNwQNgaJiHTflnRJWrhJ8gVY4rg2gudMcX6tGngryWUPH61RE2AIbS0P4NAjypAaB/EDYAAHOEDQDA3NCGDQCgfxA2AABzhA0AwBxhAwAwR9gAAMwRNgAAc4QNAMAcYQMAMEfYAADMETYAAHOEDQDAHGEDADBH2AAAzBE2AABzhA0AwBxhAwAwR9gAAMwRNgAAczlh0/kXl0P/9HJR0mSxNcg1d0qNLq3nkgoLLdZirs75lZ30vpqq8MkYp+Xc4r690cCQSQsb93MefZz1yYdZSJGaT+Q6l2TIflgrR6hz7zRhU5NmEOUCTesEUFHrO5sWYVPvkgyDEjY1h5KnqHMOYQP0RN2wcb9sBZ4y7pPI/WGI9zsn7znCCaFxQsWXTw49KOUavONEz4l2Rq9166wcV4pxOy/eNu2Z3mtd8v5XpghdJay3UnNoCe7eyjXn3UcAsq6GjfvEafkeQ8JL0alTR4gWoxlB6NcvWTljaAcqT23vl51j/W5k7ENoKPcg9f3gdmZcmFS2fDlhA+hZhY38O0p92MjjeK+qXKuZRShGU0OosKTnqTCjPHU5V0IZo7kRyjO9GxJSqSe1JLk8zcgt8UYINWsu1+wAgDbz72y8nfqwqVlAI2GjqSFpHH2ncFqlp5th01KrGTZJXyp3NSls9DsJQEbYdDtsvL9Nln/r7T2t8upwhI27wL4NG/mWAajI/F+fO5+0aK6EOsuDCJ2VHu+rcqmV2VNDIlqDO6m8Fu/g8oyh0+QlKCcSViEPpXzCurc41F+Z1DuFtyf0RvKeoCk79T4qtwJYzOr+DQJ8zDJEAwMDgVsG6NUKGz5seQib4cAtA/T4u9G6pCiRO9HPuGVAHsIGAGCOsAEAmCNsAADmCBsAgDnCBgBgjrABAJgjbAAA5ggbAIA5wgYAYI6wAQCYI2wAAOYIGwCAOcIGAGCOsAEAmCNsAADmCBsAgDnCBgBgjrABAJgjbLCouf+6s/dffQ79a9D849CAEmGDRaqdE+VfWxeHh3zsvRxACGGDxavyzYr3uxz3pXKn+70OAC/CBouX8G1NpScUNt6rALgIG+A8OWz4Pgaog7ABztN8Z0PYAHkIG+C81B+jAdAjbIAL9P83GoAkhA1wEc2fpyFvgFSEDQDAHGEDADBH2AAAzBE2AABzhA0AwBxhAwAwR9gAAMwRNgAAc4QNAMAcYQMAMEfYAADMETYAAHOEDQDAHGEDADBH2AAAzBE2AABzhA0AwBxhAwAwR9gAAMwRNgAAc4QNAMBcWtgUCzpfas7xnpaqM448+0BTrqjLCx+OfdavInpm1zbEbqKmPpKh/spL7plyAU192Jt6+FTG7Mm13RR6sNccNvM7m2jeNFWfZpYu6M5cwizllwblLVvW85p7XkCG1JobDNQ6g9QMm6Y+7EZ3PDU48860Fg371Es0CJv8Aro5C2Ez6AVkGMSw8X72CZvUM60NZNh4i+h8C1z5kZr7aqXf+21vZZzQu9k7WmgotxjNVZV1CedEO6PXRncguuTQaaGtCA0lr8g7i3uOW39lcM2N8JatKcAd351dWK9bg3xCqADlDQptcmj28jjutssjN1Ked3NCNYd6vIMrb4pyD70L9JatX7Vmososmvq9L4UKDpUUusrdZO/OyNsVKliQEzbu2kInhHbcPSG0KuFVzUF0CdFi5IVoytOXKpQdutPygWZDoovVv9eV7wT9OJqykwrwLk2z3rwTvD36Jes7NaelvtMyPqf6M/Vvdf2BZpxohU09nUJnJi0kdE7eIPJpLfUmaD6eXr0JG/nMjE9RhzBI5WTvyO443tHkQeROzbXesuXjjJFDi01dUegqTTGpNyJpZO9p+pJa4X3TnyBc0mCn97Sa74ek2+3tUZYqr8I9cN8bSbepqf3XTxQtI/Rujy5WvsvKFZXH0VwiFCxLDhvN+0ZYeau52ynPoiws+pZNLUDfWb+AOiPrd6/OMqP7nH0jsgsQPm9yf6gn6ROhrzypUzgt9dWMSso9FZpiNHXW+bAnraWpp5P+TOVWZEyhnDT7M5Uq+X991nTKZTV1O+u8/7KfcfIg3g+Y8lNXPk1ZQGgh8iXRC0MnRFckX+I9LftG1CxAvyHRz7PdBz77vSS/qly+vrzQjJ1OzRbJq6jzYdeMmb1qzUTKMvSLUr4HhOL1m6y/BVGZf85GXm3nBOH95z323svQJcK1oXG8Zwqvui+FTvMuWeiUT5MLUG5g6LToYt3ylKUql6lZcvRGpBYQqkRYr1CAfIKwfKFatx5lp7zJ0UFCoyWVJ4xZHtmtzb0qdC+EOuXb5L0qtJbUVbs1hNYlrFpzSai20F2OFi/U7K1TnkKj7t8gkDrf0NO87/MG6Sv9X6FgoIsHBlStsOFD66ofNgOxqwNRZMhAFw8MKP5utAaEvuvM+2azbw3Biga6eGCgETYAAHOEDQDAHGEDADDXwJ+zqampMd3/vS9j5OH4gb5+FXXW6+6zO1r/72eo5rzKC5+mCvPOJVzi/hfEUKnRMctnauaVFx7aJe8lRm+h3r4z++dz0c1KhiRsuvk2jer5O6nLBfQ8bOrcfaOaNYPI52herRk27rFwmuYc4VhYhf78mnr+wexYnJUQNs3r+TuJsEmaOun5WKekpHOUr1YOvPdC7hQG0UwUGl+DsOm5fg+bym9tyt8IVzpDX5avCj0p3BG847hDhT5aoW0tv+Rdl/sxE5YfKsYtrHJJ9iYIp1VG06zXe4n32B3Ee2tCI2tuh/dLdwneHQjdF++M7rH3ZgkbImydtwD3feJdqZdQcOjOCp3CIN5rNecIBQv93neLvM/l/qT3iffdIlcizJg6QuhV7/mht5ZyRu+AobeE8JIwoFLOX1cjrMH7Uuj9Gh2nFdhZ/SVyYZpSM2qI3iTvOMItzCvAuzTNeqMDer8MldTs7dBvnf6jEn3zRN8V8ux5F2reD+75+lKLEuHM7AP5vertT323yCuVR2jkky4UEx1Bv1L5g+zOqLncW7A8headKcv/MZr3jSu/Kt9geZY6l3g/VxnTKZcvnCZcG6pNObL+7as5rnS6v0ZnEcZPuh2aHdDfVs0yhcH1Y1Z6NGULK9UM7r1HQiXKBWrOF1YUWkL0/Gh5GVfV7IyWofmoypOGPhfeu9DsR0PoDL21UjUQNtG3mnKvlbNkXKJ/09d5X+ofT9HPT15VypI0/ZUe77tNs8/6D4CmvKQBo3fBPTnpZslbJ3yZejdD1XqL9y6kIqkkzZtQ/3bSLESYzjtmxt7mdWp6GnleuRr/rCU9W0JvrVQ9Dpvyu185izygpjCX/ABNfTqETlOuRbkQfQGaz0aoGOHd1vgHQHOmfsDQJgsnJz2M5K1LfYxm76owlPfMlnqxrcCbVjhHOWyoPGVJwiDKvc3r1PQ08rzyEvbZ2+P94KcWLHz8M9T9JwYq/eUvhRPK54Q+D5o3sfyqO533QmGWSoXymd5ro+MItbkvKQsIVSKsN1SAPGnowC1MueTomdGbFRpN2GRv8fLNasW2TtgKZYXCrgrVCseVTu8IwmLdhbtLCK1U89YKVa58i7ozyhvuPVmuRDmjZgS5PGFG4eToffH2y/sQXUgS/gaBuJpb3FsDXTxCuK0y9qcPd4CwievD26Y30MVDwJ0VsDl9uAOEjV/o+9wBMtDFA3Us5nd+337wCRsAgDnCBgBgjrABAJir9edsMn4y2PMfJob+d0Dh1dA4of8TsTya/L8S1qkZAAZI5nc2g/v4k8MmaRzN/5Dujpy3dYO74QDQImyETs0goT/xRNgAQFn+PzGg/K196+JvAioHmh9GuS/Jhcn1yGe6Zet/7JYaNtEtig4FAIMi87/ZRL8/0Dw6QwkkTBF6ST+afKbyyV4/bOQgjM4FAIPFPGxCx/rOyhShb3rqTJEUNnJ8Ct9dlU/zLio7fQGgz3UjbLwXZoRN9NuF7ClSw6ZCuEQZNqGrCBsAw8EkbITnqf6h32DYhCIhI2yEhevDJlRG5bToHgLAoGgybFqlR2QoNqK/Z3dHcMcPfbvgfUB761FWpfkupBUOG3kEea5QhaEaAKCf9e/fIJD0SB2+568m5ABgUBA2fYpvZQAMk/4Km9BPwzQXGpXUfRnLB4A+119hAwAYSoQNAMAcYQMAMEfYAADMETYAAHOEDQDAHGEDADBH2AAAzBE2AABzhA0AwBxhAwAwR9gAAMwRNgAAc4QNAMAcYQMAMEfYAADMETYAAHOEDQDAHGEDADBH2AAAzBE2AABzhA0AwBxhAwAwR9gAAMwRNgAAc4QNAMAcYQMAMEfYAADMETYAAHOEDQDAHGEDADBH2AAAzBE2AABzaWHTPq3S03hNxQLNmY3PLg9uOqOgO/PWnKXxIlMHdM/PKCnvEuGqvnojybI3sD+Xg75iGzY1P+rRywfiEdxsDd3P165dXn/A7AKS3nWpkxI2QCsjbFopn0zr35kSNkaz9OTy+gMSNjURNrDTZNhUfvxVlJR7vNdGezpTuyPI32x5L3SrdSssX9jpl2d0B/TWqZlXWL6wpaGlRQtwZ5EHFGYJle2dWi41tCehSrxbIS/NvVzeBPlaeVtCpco3S6hf2L3Qhgs9wgZGBxGqEk5rYTHJCRv5QN8pPBq8V4VG8H4sy19mVCufHHoQCKtQbl20tqSPq2b39HUqO93njjC4ptQ6G5I6e+hM/bWppXoPlLcmukzNQqIbmDSI8GGJfkww3DLDpiW+dUKdHZrx5aGiB0LNoc6kk0PPiNCTonzsnpb3wPKutzKLsgDN1JpOoTzhWC7Vu67ordQUrK8zddO8UytH9t7TvN1LnU7/lggNIuyA+ysWla6GTbSa1IeF/F7PKyzp8yNPLdcQOkf/wIr2pN4I/V4Jz6DogHKF7pM0NKBmaXUeqaHLs69VjqwPG/2NTv2AZA9C2CAkP2xaFz8LMsJG/6FSjp/xKfUuSnlyZcbGw8a7vX0eNsJc2Y9LfZwMStiEPjjCXF0IG3kD9YOEOr1hQ+osHo2FTedLOZDkj5k8jnssPPrd0byFCSN4X5Jn9E7krtTdh9CmySsNLdk7hbJO5V55O93phP3UlCosP3p3lJXIg8jzekcTtkWYRbhZcv2a3YsuRN5Azd2PbpSmMAy34fkbBELvWt7NANBzhA0AwNwwhI33hxvlV7tZDADANQxhAwDoc4QNAMAcYQMAMEfYAADMETYAAHOEDQDAHGEDADBH2AAAzBE2AABzhA0AwBxhAwAwR9gAAMwRNgAAc4QNAMAcYQMAMEfYAADMETYAAHOEDQDAHGEDADBH2AAAzCWHTVGSMV/eVXkDKkv1vppapztL4ysFgMGVEzbeY6Uuh032CIQNADSIsGksbFq1NwcAhlVjYeP9gZXb2TmuHJRPcy/xDlJ5vrsP91CKhEoqv+p2emcXOivL8Y4QWnJoUgAYUM38Nxs5TtzO0KO8cuxOHTpNzhVNSfpX3WCIjibXL88VGg0ABkgz39kkdXq/J4geC5kRehALj3tvnULBcgp6r9XXr5kUAAbaAIRNNBWswyY6rPdaff2aSQFgoPUgbEIvRccRRo4GQOr4dcImNEKdsCF+AAy0xv6cjbIz48nrjlPzW5BQSa1SSChnD83lThGtP2NSABgU/A0CAABzhA0AwBxhAwAwR9gAAMwRNgAAc4QNAMAcYQMAMJcQNg/uOvD1H++8/B8epNFoNFpS+/qPdz6460A3H+79JiFsHt79zjNvvD8PAEj0zBvv/+K5I918uPebtLDp9f0CgEFF2BA2MNF+RwFoI2wIG5ggbIAywoawgQnCBigjbPLDxn2atHvynjKFT9Y99RdWc8xslUndSkKFyT3yitx+ux55Xe6Z3qUBQ4+waT5satIMIp8TfUznFZZRTPnJm3RyKKJqTtr4gbeeYuH3HKEQJWywCBE2tX6MZvEQJ2xCZxI2wOAibJoPm8pB+VfvVZqHbPm0osR9NTSCZvbygEIB887zNPQA9e5J9GTlKpImNToI1TZf2kbvS27ZwHAjbGzDxvt4Ep5ZbmfGhUJcZRQcukQuRlOS8KWyRz6NsAH6B2FT9/9GCz1QQp3CsbdHEzaVINE8f8tX6RMxujTNvKElyCeEJkpdbOgcZbS4mV3pF/JYE8/AsCJsehw2SV8qA0Dz++6804zCJjVFlKdpXkoNm6QewgboIGy6HTbu74sXediELh+msJlX7xgwrAibBv5QZyge3H73d7j6x1ZoNPeE6JjChcJcwuPSuxDvS96hhDI6OxbqyZvUW3O0R5jUu+ehHQuVDQwxwoa/QeACHoINYjOBMsKGsLmg5vPR/f5jMWMHgDLChrC5gOdjg9hMoIywIWwAwBxhQ9gAgDnChrABAHOETULYPPPG+72+XwAweJ55433CRhs2r82995tXaTQajZbTXpt7r5sP936TEDYAAOQhbAAA5ggbAIA5wgYAYI6wAQCYI2wAAOYIGwCAOcIGAGCOsAEAmCNsAADmCBsAgDnCBgBgLjNs2ue7PeX+ypedTuFLvdQLveeXS80rI09T03W5bADI1mTYuMfu09B7WqqMC+Ww6WdykQOxBADICRtvlqSGTZ2nJGGjfBUA+kRvwsbbH7oq+i1U5dssoZLQmZVO9/u20Eve5Qhzub96r3J/FFnp8W4IwQOgb/UgbKLf7iSFjTtXqBLhTM3zOjpstKq8ZWrSMVo8APRWctgIz8TQb/zd891B3N+/yyMIxxmddcIm48xoQHq3oqXeZADoNzlhU9Hp954c6tFkkvxS6HigwyaaQ/J0ANCf0sJGeNilhk1L8cjWP8q9ownfH0QPlPPWDJuWs8w6YUPqAOhbhmHj/sDHPa0SDMJTWL7KHbZSlffM0ANdyLnQCN7TornoXaa8FZVXo8UAQD/o379BQHh09vnv5btZVX/uAABUDGTYtMLfTvWDrlXVn8sHAFc/ho3wAzT3TOtiMvRnVQDQQ/0YNgCAIUPYAADMETYAAHOEDQDAXELY7D/w6uxjTz3w4K9pNBqNltRmH3tq/4FXu/lw7zcJYXP4yPFjJ1rzAIBEx060Xn/z7W4+3PtNWtj0+n4BwKAibAgbADBH2BA2AGCOsCFsAMAcYdNM2LQv7xy7X1Y63avclypXuYMI5wgja+ZyVyGsyzugcpmheoQi5bIrI3i3SDmjvkj3FriVJw3irTw0l3f5wp7IJYUIS6iM3NSrqVVZ3AVvkdH74o4culNyMXLZA4ewaSBsvM8y+dM+H3sbaV6KTqEkf0hSJ9U8DVPrkWtzT9CsSD+jvoykfatzvtAfulA5RUi0HvdeK1/Nq0e41uIuZNwX+X0YOl9eyEAjbLoUNt633dCHTV5VjYeN5lmcVGGoDNOwyXtLdPqtw8btUb466GGjfx8KJ3tPIGyGSQNh074wNWzcq9zf1ITSKOmq7J7ogXdplXWF1i73dAZJXb6mAO/goc5QqZ1+90u3SG8NlcG9B5p6MvYkby53i9xVeMf0virU0293IWOv5p09D+1A6MJo2fMDiLDpi7AJnTave5+ljpMxV511aR4xlQPldKHx5QKSZvRWqO+MPu+EV5XnKKtKmss7YOoIylf7+S5k3xf3fRj6QIWGla8axLwhbGqFjf7dqfmEVN5Y3nEyetyRo3PpK9R8EryDVB4xoQeNMJSybGHA6Iyawhp5zLlz1Vxd6q2M9mhutLC6pFLlau3ugvL8Zq8KnRAaMPQ+6X+ETd2wqdz+6CdHf1UjPU19frxzRdcVvSRpiujn01uAW6T3QqGzC485TY/yreUehJ5QSdVG1566utQpunAXmvqwJO15aFhlGQOEsGn4f31WPlM0VzXS09TnRzjHpXm+K3syppNnbOpRVf+x5T6J5LXUvDs13yR9GDaN3wW7D4twlXAJYTNMuvHnbObVb6zK+74yTl6P5jThKs0g8ifKPU1fjzxdaPb5wCc2aXC51Pnw5z+6k6FBohvuDiWsRdiTpJW6V4X2trhY9FXlcoTa5pu+C5oLhQrnHUl7rtmi0FADgbDhbxAAAHOEDWEDAOYIG8IGAMwRNoQNAJgjbAgbADBH2BA2AGCOsEkIm2MnWr2+XwAweI6daBE22rB59933jxz7gEaj0WgZ7d133+/mw73fJIQNAAB5CBsAgDnCBgBgjrABAJgjbAAA5ggbAIA5wgYAYI6wAQCYI2wAAOYIGwCAOcIGAGCOsAEAmCNsAADmCBsAgDnCBgBgjrABAJgjbAAA5ggbAIA5wgYAYI6wQbJ7f/vK1IZHx2e2D0eb2vDovb99pTtbt3HjxjVr1qweFmvWrNm4cWN3tg6DjrBBmnt27rvizqeWP//hl/5wdjja8uc/vOLOp+7Zuc9669auW7dp06ajR4+eGxZHjx7dtGnT2nXrrLcOQ4CwQZrJO3Ysf+HDmw5++tGwuOngp8tf+BAqIx4AAAOPSURBVHDyjh3WWzc9PX38+PEzZ870esWNOXPmzPHjx6enp623DkOAsEGa8ZntXzpwttdPuYZ96cDZ8Znt1lu3evXqc+fO9XqtDTt37tzq1auttw5DgLBBmnbYfDhcuhY2Z88O29adPXuWsIEGYYM07bDpdRUN62bYWM/SZYQNlAgbpBmf2f7F/Wc+GC5f3H+ma2HT67U2jLCBEmGDNKZhUyyodApfNmIgwsa7OU3JHpawgRJhgzTtsHnPQFEUSccN6lrYnDmTuXXWm5A95pkzZwgbaBA2SDM+s335/k9PNK0oilCPe9C45fs/7VrYZJRnt/D6UxA2UCJskGZ8Zvvy33/6btOKogj1tA/cExq0/PfdC5uM8kJr7/xgrXJmpTN0pnthBsIGSoQN0ozPbF+25/TBphVFEeppvzkbn7Fs2Z7T3Qmbjz/+OKO86PK9e+UeeM9XThHy8ccfEzbQIGyQpidh4z2hQYMbNp1vWdwz5bARLkxC2ECJsEGa8ZntX3j51OtNK4oi1OMeNO4LL5/qWthklBdauLxFwr5pepQIGygRNkjTDpvXDBRFkXTcoG6GTV6F3k0QDkKd+h4lwgZKhA3SjM9sv/Llk3+w0fnZTqVT+LIRV758sjthc/r06ewiQ5tT7iy/WjmuXCtcmOT06dOEDTQIG6QZn9l+5e6T+4fLlbu7Fza9XmvDCBsoETZIQ9hkI2ywmBE2SDM+s/2Klz56Zbhc8dJH3QmbU6dO9XqtDTt16hRhAw3CBmnaYbN3uHQzbHq91oYRNlAibJBmfGb70hc/3DNclr74YXfC5uTJk71ea8NOnjxJ2ECDsEGayTt2LH362A0vHt89LG548fjSp49155+FPnz48IkTJ3q94sacOHHi8OHD/LPQ0CBskOaenfvGNz1x+a5jl7/YGpK269j4pifu2bnPeuvWrVu3YcOGubm5k8Nibm5uw4YN69ats946DAHCBsm2ze697vZHxme2D0e77vZHts3u7c7W3XbbbdPT06uHxfT09G233dadrcOgI2wAAOYIGwCAOcIGAGCOsAEAmCNsAADmCBsAgDnCBgBgjrABAJgjbAAA5ggbAIA5wgYAYI6wAQCYI2wAAOYIGwCAOcIGAGCOsAEAmCNsAADmCBsAgDnCBgBgjrABAJgjbAAA5ggbAIA5T9jQaDQajdZ4+9zuufNh87ndczQajUajGbUCAIAu+H/mjiVYSnf4nAAAAABJRU5ErkJggg==" /><br />
This EnScript can be used with a private VirusTotal key with no time limit restrictions and can process several thousand hash values per hour.<br />
<br />
<a href="http://www.lancemueller.com/blog/Check%20tagged%20files%20to%20VT.EnPack" target="_blank">Download v7 EnScript here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-12958714004337369912015-05-21T08:00:00.000-07:002015-05-21T08:00:06.359-07:00CEIC 2015 - EnScripting for EnVestigators<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlwQQ0mqA-lVLe2v_L0yChoB2D9ntL3PRGeO1hc5f8qE2RXTYKJ1ArsH7E-gCk2TsVAGNZe8MC7FBUhYMAarE_GzubGHl7YZ6zGdtrPiLgEMPIEY3bW0ZldKe_r0jxMdcaKF_vgF-KaO0E/s1600/snap2181.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="182" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlwQQ0mqA-lVLe2v_L0yChoB2D9ntL3PRGeO1hc5f8qE2RXTYKJ1ArsH7E-gCk2TsVAGNZe8MC7FBUhYMAarE_GzubGHl7YZ6zGdtrPiLgEMPIEY3bW0ZldKe_r0jxMdcaKF_vgF-KaO0E/s640/snap2181.png" width="640" /></a></div>
<br />
<br />
Below is a link to the slides from my presentation at CEIC 2015, as well as some example EnScripts.<br />
<br />
<br />
<a href="http://www.lancemueller.com/CEIC-2015_EnScripting_for_EnVestigators.pdf">PPT slides </a><br />
<a href="http://www.lancemueller.com/CEIC2015.7z" target="_blank">Example EnScripts</a><br />
<br />
<br />
<br />
<br /></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-52644409923577265932015-05-10T22:29:00.000-07:002015-05-10T22:29:26.556-07:00EnCase v7 EnScript to create LEF based on condition<div dir="ltr" style="text-align: left;" trbidi="on">
A reader recently asked if I could create an EnScript that would create a LEF based on a condition. Unfortunately, the reader wanted to use it with the free EnCase Imager program, which does not support creating LEFs or using the ConditionClass.<br />
<br />
However, I did create an EnScript that can be used with EnCase Forensic/Enterprise, which will create a LEF based on condition criteria that you can define.<br />
<br />
When run, the EnScript will ask for a location where to save the logical evidence file. The EnScript will initially assume the case default export folder unless set otherwise:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEha_VxKRjNuWkVR3DzdwdCNKMq_Kxh8RXzRRQzoqhhJ2mxbuUvqbDZuQiYCsDc5qwxy_tArcxW41JNKHxGWsu_rIJ9yx_yXZgqFo1uwu4tBGYc7aPo57Ibpy_Eca2r5bXjn109WgGiba5Bo/s1600/snap0799.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEha_VxKRjNuWkVR3DzdwdCNKMq_Kxh8RXzRRQzoqhhJ2mxbuUvqbDZuQiYCsDc5qwxy_tArcxW41JNKHxGWsu_rIJ9yx_yXZgqFo1uwu4tBGYc7aPo57Ibpy_Eca2r5bXjn109WgGiba5Bo/s640/snap0799.jpg" width="640" /> </a></div>
<div class="separator" style="clear: both; text-align: left;">
The EnScript will then go through all the devices/evidence files loaded in the case and apply a condition that you can define:</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJek6B_OcFkxQ2YeQGJ-MhXDQtKKhHdibrh4w2n74j7zGt1EIHXKCWrpalW5QPjPSzh6KLOriFDV6VcWBIZC1UbuttYCOKVq2r5RCKPxF7eFfyF0s9u8yOw3ekNHKAO9SdYdIvijdDUeq8/s1600/snap0801.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="377" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJek6B_OcFkxQ2YeQGJ-MhXDQtKKhHdibrh4w2n74j7zGt1EIHXKCWrpalW5QPjPSzh6KLOriFDV6VcWBIZC1UbuttYCOKVq2r5RCKPxF7eFfyF0s9u8yOw3ekNHKAO9SdYdIvijdDUeq8/s640/snap0801.jpg" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjft6jxmmTtsN33TxKAn8qz6jiPkUmStiHKsj0Ts8HUJ1HWrrhxf4aOnu6lND7Wq4T1ArkWzSYnu4o1Pdxl2hEyGX_Me1vbVByRuonSieHbEyQ9VxWP86e6fK9REgaM__kbQwYDwn5Roleq/s1600/snap0800.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><br /></a></div>
<div class="separator" style="clear: both; text-align: left;">
The EnScript will create a LEF containing all the files that match the criteria you define. A separate LEF is created for each device/evidence file:</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3QhtW8I3UQSraA4ey6xhdR1NZqSOyqF5K_-c4LsEqP1dtRa_Y6WVF4Oba2iPds_JSjmfuixa57NTMKbneu9uNqKGX0ESScrARPqCIjv27orYjfbByhjvsJQXV5VkGo4chypjrsDqCsaMn/s1600/snap0798.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="36" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3QhtW8I3UQSraA4ey6xhdR1NZqSOyqF5K_-c4LsEqP1dtRa_Y6WVF4Oba2iPds_JSjmfuixa57NTMKbneu9uNqKGX0ESScrARPqCIjv27orYjfbByhjvsJQXV5VkGo4chypjrsDqCsaMn/s640/snap0798.jpg" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="http://www.lancemueller.com/blog/Make%20LEF%20from%20condition.EnPack">Download Here</a></div>
</div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-31660193297202111192015-05-05T21:04:00.002-07:002015-05-06T05:43:54.836-07:00EnCase v7 EnScript to Parse PST Email Metadata to Excel<div dir="ltr" style="text-align: left;" trbidi="on">
A friend recently asked me for an easy way to export some of the common metadata from a PST file within EnCase. You can easily export data from the records view and even include columns that are not typically displayed by selecting the small down-arrow on the far right side and select the columns you want displayed:<br />
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEUnnajwQLL_XGod42Fwp7XC8ZsKkHnJ4F0P3yW5rbOLp_irPl6a4jcazRzM9j8kd1J6X0FyEMYTWat39s8ypUCwb35ynE7Mn9eorol0NJ4Bbde_qdCkUnw8UkqYV6ZYagZ_hZ697o1XvW/s1600/snap0791.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEUnnajwQLL_XGod42Fwp7XC8ZsKkHnJ4F0P3yW5rbOLp_irPl6a4jcazRzM9j8kd1J6X0FyEMYTWat39s8ypUCwb35ynE7Mn9eorol0NJ4Bbde_qdCkUnw8UkqYV6ZYagZ_hZ697o1XvW/s1600/snap0791.jpg" height="222" width="320" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWPChCEvymGPz4zf9PsaWIDF6GpcnrBFUKTOjLaHJ_D84tUmPXg2D-jY4aYeMjjHeFFJ8XEOJTRal6c-ixQ91fKPYs5q0ACYsHu2wfKjqgeH9GLPspxprXmJ36qHnPHWvAVOOTN3McKmF0/s1600/snap0790.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWPChCEvymGPz4zf9PsaWIDF6GpcnrBFUKTOjLaHJ_D84tUmPXg2D-jY4aYeMjjHeFFJ8XEOJTRal6c-ixQ91fKPYs5q0ACYsHu2wfKjqgeH9GLPspxprXmJ36qHnPHWvAVOOTN3McKmF0/s1600/snap0790.jpg" height="220" width="320" /></a></div>
<br />
<br />
But he wanted a way to quickly show some of the common fields, including attachments, in a spreadsheet. This EnScript grabs some of the common fields and builds an Excel spreadsheet automatically:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1n4Y1E4gzads5YPxhekU6dQ1mcbs3zQ8ZOt-ODiGsi8p9hqPp4gyHOYE_lpufGI9feeMVwW3X1rjMJlQOr9Z9XWEQbKD9AQHIYPGyMJxXnUhOG30RlNzYkGxKs6isIqTNaH185ZMN4jb3/s1600/snap0788.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1n4Y1E4gzads5YPxhekU6dQ1mcbs3zQ8ZOt-ODiGsi8p9hqPp4gyHOYE_lpufGI9feeMVwW3X1rjMJlQOr9Z9XWEQbKD9AQHIYPGyMJxXnUhOG30RlNzYkGxKs6isIqTNaH185ZMN4jb3/s1600/snap0788.jpg" height="88" width="320" /></a></div>
<br />
<br />
<br />
This EnScript requires Microsoft Excel be installed on the same computer where it is run from. When run, the EnScript will parse all .PST file found in the case.<br />
<br />
<a href="http://www.lancemueller.com/blog/Parse%20PST%20Email%20Metadata%20to%20Excel%20Spreadsheet.EnPack"> Download here</a><br />
<br /></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com1tag:blogger.com,1999:blog-1746946614390371171.post-41184270744414711932015-04-01T17:57:00.002-07:002015-04-01T17:57:49.651-07:00EnCase v7 EnScript to carve RecentFileCache.bcf data from selected file(s)<div dir="ltr" style="text-align: left;" trbidi="on">
The following EnScript can be used to quickly search for and parse RecentFileCache data from memory images, unallocated space or the allocated RecentFileCache.bcf file.<br />
<br />
To use, simple blue check whatever file(s) you want to process, then run the EnScript.<br />
<br />
Output is to the console and bookmarks: <br />
<br />
c:\windows\system32\lsass.exe<br />
c:\windows\system32\lsm.exe<br />
c:\windows\system32\oobe\windeploy.exe<br />
c:\windows\system32\sppsvc.exe<br />
c:\windows\system32\winsat.exe<br />
c:\windows\system32\rundll32.exe<br />
c:\windows\system32\mcbuilder.exe<br />
c:\windows\system32\winhost.exe <br />
c:\windows\system32\logonui.exe<br />
c:\windows\system32\dllhost.exe<br />
c:\windows\system32\taskhost.exe<br />
c:\windows\system32\userinit.exe<br />
<br />
<a href="http://www.lancemueller.com/blog/Carve%20RecentFilecache.bcf%20from%20selected%20file(s)_v7.EnPack">Download EnCase v7 EnScript here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com2tag:blogger.com,1999:blog-1746946614390371171.post-68446745945498526652015-04-01T15:19:00.001-07:002015-04-01T15:20:35.112-07:00EnCase v7 EnScript to report on file types by extension<div dir="ltr" style="text-align: left;" trbidi="on">
<a href="http://www.forensickb.com/2008/05/summary-report-of-file-types-by.html">Several years ago I wrote a quick EnScript</a> to produce a quick report of how many files with each extension were found in the case. That EnScript was originally written for EnCase v6 and not compiled so it could be used as a learning exercise.<br />
<br />
I recently had a request to update this EnScript for EnCase v7 and to add the byte count for each extension.<br />
<br />
The output goes to a TSV file in the case export folder and to the console:<br />
<br />
Extension: txt Count: 9 Size:6787<br />
Extension: csv Count: 16 Size:1357315<br />
Extension: dat Count: 9 Size:2129920<br />
Extension: sqlite Count: 4 Size:11272192<br />
Extension: log Count: 35 Size:4739968<br />
Extension: evtx Count: 9 Size:3772416<br />
Extension: fls Count: 1 Size:0<br />
Extension: mft Count: 1 Size:52166656<br />
Extension: raw Count: 1 Size:1073741824<br />
Extension: pf Count: 129 Size:7745128<br />
Extension: db Count: 7 Size:4099460<br />
Extension: bin Count: 1 Size:508<br />
Extension: fx Count: 5 Size:9060831<br />
<br />
<a href="http://www.lancemueller.com/blog/List%20filetypes%20by%20extension_with_size_v7.EnScript">Download EnCase v7 EnScript Here </a><br />
<br />
<br /></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com2tag:blogger.com,1999:blog-1746946614390371171.post-68863204291695287402014-08-18T17:02:00.000-07:002014-08-18T17:02:15.465-07:00EnCase v7 EnScript to find files based on MD5 hash values<div dir="ltr" style="text-align: left;" trbidi="on">
I had written a version of this years ago for EnCase v6 and I was recently asked to update it for EnCase v7.<br />
<br />
One EnScript listed below will generate a text files of SELECTED files. That text file can then be used on subsequent cases to help find/identify files with the same hash value.<br />
<br />
To use, you do not need to generate hash values, the EnScript will do it automatically. The second EnScript is also optimized to first match file sizes first before generating/comparing hash values to help reduce the time needed for the comparison, thus saving the need to hash everything in the case and then using a filter to identify files that match a particular hash set.<br />
<br />
Any files found that match the size/hash value in the specified text file are bookmarked for later review/export.<br />
<br />
<a href="http://www.lancemueller.com/blog/Create%20text%20file%20with%20name,%20size,%20md5%20hash%20from%20selected%20files%20v7.EnPack">Download v7 EnScript to create text file with name, size & hash for later comparison</a><br />
<a href="http://www.lancemueller.com/blog/Bookmark%20files%20based%20on%20MD5%20hash%20v7.EnPack">Download v7 EnScript to do comparison</a> </div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com3tag:blogger.com,1999:blog-1746946614390371171.post-45345658574795322512014-04-10T21:22:00.000-07:002014-04-10T21:22:21.361-07:00EnCase v7 EnScript to quickly provide MD5/SHA1 hash values and entropy of selected files<div dir="ltr" style="text-align: left;" trbidi="on">
I recently had the need to quickly triage and hash several specific files within a case, but I did not want to (or possibly could not) run the "process evidence" option to generate hash values for *all* files.<br />
<br />
EnCase v7 has the ability to generate hash values of selected files through the right-click context menu->Entries->Hash/Sig Selected files.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi417MKv7EZWjTAkmqJSKJ8jW2sPv5t-f3NxGZ4HCZlVAvEYt6qfiyOyZvFqPbWnCqENDJehxv6hiRo1E49tSw-CGwEPBv-IiVhidqubTAEede0IfC8a0GJ-2N4CmnperjaUzBHiP2kzPLL/s1600/snap0636.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi417MKv7EZWjTAkmqJSKJ8jW2sPv5t-f3NxGZ4HCZlVAvEYt6qfiyOyZvFqPbWnCqENDJehxv6hiRo1E49tSw-CGwEPBv-IiVhidqubTAEede0IfC8a0GJ-2N4CmnperjaUzBHiP2kzPLL/s1600/snap0636.jpg" height="200" width="320" /></a></div>
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEVPKy2U4QYhZKIdnknqBnriO9db4fo8mJR0g4HzJmMbDpV1CqIzXRD6af8X9orZQTtJ9xA5ckEiu1Bn_QISvzQ-Y2YoJOVK7YgWAsSAvxUwAWnxPb07pauFXWRgz4xLHYmzZZwrRp5cNd/s1600/snap0637.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEVPKy2U4QYhZKIdnknqBnriO9db4fo8mJR0g4HzJmMbDpV1CqIzXRD6af8X9orZQTtJ9xA5ckEiu1Bn_QISvzQ-Y2YoJOVK7YgWAsSAvxUwAWnxPb07pauFXWRgz4xLHYmzZZwrRp5cNd/s1600/snap0637.jpg" height="154" width="320" /></a></div>
<br />
The downside to this option is that it requires you to close the "evidence" tab and then reopen it, causing you to lose your place/highlighted file.<br />
<br />
So I wanted a way to quickly generate the MD5 & SHA1 hash so that I could paste to VirusTotal or use it in some other manner without having to process the entire evidence file and/or reload the evidence tab.<br />
<br />
This EnScript will compute the MD5/SHA1 hash value and entropy of each selected (blue checked) file. Due to the way EnCase v7 handles "selected" files now, you must be in the "evidence" tab, select the files you want to process wih the EnScript, then run the EnScript. If you select the files and move to another tab, then run the EnScript, it will not work. <br />
<br />
When you run the EnScript, the data will be displayed in the console tab and bookmarks are created:<br />
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9W4ieBkZhvy9DH1nPa-Jcc9DBA4rnI9sH-BnoEHSCEtZfmAT68yJwlnBlFge6db_7Q-tDMQ-wSu9W6VyawYYtRaSe3Sb-rIYiJstorkIy9jpLoYMCtYCMEeaY1vwhfGOTUbVvDb8IIBbe/s1600/snap0640.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9W4ieBkZhvy9DH1nPa-Jcc9DBA4rnI9sH-BnoEHSCEtZfmAT68yJwlnBlFge6db_7Q-tDMQ-wSu9W6VyawYYtRaSe3Sb-rIYiJstorkIy9jpLoYMCtYCMEeaY1vwhfGOTUbVvDb8IIBbe/s1600/snap0640.jpg" height="486" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc3TqlCZy-lV5XtVxcQqVFdtrQqNBHJs_jj1tp9W6idltzwsbD6Zm-Q-MHiP0VLMdUXJrAmJMk2KD5pBfwEylcGs64I2jLbwxUAUNAwdlgOvtf7PkBN-iSi02lnGYdi5VibL7_buGpB6qb/s1600/snap0641.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc3TqlCZy-lV5XtVxcQqVFdtrQqNBHJs_jj1tp9W6idltzwsbD6Zm-Q-MHiP0VLMdUXJrAmJMk2KD5pBfwEylcGs64I2jLbwxUAUNAwdlgOvtf7PkBN-iSi02lnGYdi5VibL7_buGpB6qb/s1600/snap0641.jpg" height="176" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<br />
This allows you to quickly generate a hash value and do something with it (copy & paste) without losing your current view state.<br />
<br />
<a href="http://www.lancemueller.com/blog/Quickly%20Calculate%20MD5,%20SHA1%20and%20entropy%20of%20selected%20files_v7.EnPack">Download EnCase v7 here</a><br />
<br />
(v6 has the ability to do this already, no v6 EnScript is needed)</div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com2tag:blogger.com,1999:blog-1746946614390371171.post-27241711391165972022014-03-20T22:33:00.000-07:002014-03-20T23:09:58.650-07:00EnCase EnScript to show file summary of user's profile by extension<div dir="ltr" style="text-align: left;" trbidi="on">
This is another "quick hit" EnScript to generate a quick report on the types of files under a user's profile based on file extensions. The EnScript will automatically create an Excel spreadsheet, with a sheet for each user, showing the total number of files for each extension and the total number of bytes for each extension, percentage for each extension and total bytes for each summary. Folders and files with zero logical size are ignored:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT3cF0lI67JzzwmIEbKFP2dFf1FpoBUjKjFwHJ9SFmgIdTDQRLbd7g-yzxSqQ7bGArsUzyDv1f42Rnjyy4izZQy1yt_TdmK6xJ3r62_H1lg51N8q9msJ4x1ue1Ly0femefUO2mUa1XDngk/s1600/snap0634.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT3cF0lI67JzzwmIEbKFP2dFf1FpoBUjKjFwHJ9SFmgIdTDQRLbd7g-yzxSqQ7bGArsUzyDv1f42Rnjyy4izZQy1yt_TdmK6xJ3r62_H1lg51N8q9msJ4x1ue1Ly0femefUO2mUa1XDngk/s1600/snap0634.jpg" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<br />
<a href="http://www.lancemueller.com/blog/User%20Profile%20Summary%20by%20File%20Extension%20in%20EXCEL.EnPack">Download EnCase v6 EnScript Here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-90898436877722226712014-03-19T21:20:00.000-07:002014-03-19T21:20:30.295-07:00EnCase EnScript to parse each NTUSER.DAT for RecentDocs<div dir="ltr" style="text-align: left;" trbidi="on">
This EnScript is another "quick hit" to parse out all the recently accessed files recorded in the user's NTUSER.DAT.<br />
<br />
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs<br />
<br />
When run, it will parse each NTUSER.DAT and display the results in console, as well as automatically open Excel (Excel is required to be installed on the examiner's machine in order to use this EnScript) and create a worksheet for each user processed:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLa57Kx6V8Xmay2MTQXzBjocTqZG6S3eaxVkfT2n-cNA3HXDZ-5MciML9L9czai4d-GltHZBk2QLVSM7SAlWgg960iqwkmGA8tCj2ePtBIo3pw8cf6jMU6hahXl5a3DVpyz4wrfpu0VmyL/s1600/snap0629.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLa57Kx6V8Xmay2MTQXzBjocTqZG6S3eaxVkfT2n-cNA3HXDZ-5MciML9L9czai4d-GltHZBk2QLVSM7SAlWgg960iqwkmGA8tCj2ePtBIo3pw8cf6jMU6hahXl5a3DVpyz4wrfpu0VmyL/s1600/snap0629.jpg" height="600" width="640" /></a></div>
<br />
The EnScript will also create a bookmark for each user. It will put the date the registry key was last modified in the comment section of each file extension for consideration:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjsKFYX9zXChyphenhyphenpp8mkATeXqgiKDjR_ysvZVSWFdE24i6A6f-Xq2d-wuNJhvUg9rmve0JOMl9PBjFj_vJ3sjYR2foTuP0MEJnIPuuD7RqOMy0VUYu6NBYhZcCup1bku3PSu4PDt_OrOf2Pw/s1600/snap0630.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjsKFYX9zXChyphenhyphenpp8mkATeXqgiKDjR_ysvZVSWFdE24i6A6f-Xq2d-wuNJhvUg9rmve0JOMl9PBjFj_vJ3sjYR2foTuP0MEJnIPuuD7RqOMy0VUYu6NBYhZcCup1bku3PSu4PDt_OrOf2Pw/s1600/snap0630.jpg" height="352" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgn6p_C_dxgBX1tcROySIv6ZLFDxODUpL45e4NwE6-lK8q_wqxjfeWjdI3IT3DAJABn-GfE8ZzBiOqDEpHESX9ocU_mVKn-MTl4t6DAdDi4gFmhyhUhnAeQQl_7WsAQXyXj8K1ysFxJ8uys/s1600/snap0631.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgn6p_C_dxgBX1tcROySIv6ZLFDxODUpL45e4NwE6-lK8q_wqxjfeWjdI3IT3DAJABn-GfE8ZzBiOqDEpHESX9ocU_mVKn-MTl4t6DAdDi4gFmhyhUhnAeQQl_7WsAQXyXj8K1ysFxJ8uys/s1600/snap0631.jpg" height="386" width="640" /></a></div>
<br />
<a href="http://www.lancemueller.com/blog/Parse%20each%20NTUSER.DAT%20for%20RecentDocs%20to%20EXCEL_v6.EnPack">Download EnCase v6 here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-64564377934288828642014-03-19T10:20:00.001-07:002014-03-19T11:54:27.856-07:00EnCase EnScript to parse & display recent RDP sessions from user's NTUSER.DAT<div dir="ltr" style="text-align: left;" trbidi="on">
This EnScript was designed as a "quick hit" to parse and show the MRU values for the Terminal server client for each user.<br />
<br />
The EnScript checks the Software\Microsoft\Terminal Server Client\Default for each NTUSER.DAT and displays/bookmarks any values.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEid2vojtgfAg3kjUdUq-gvB_LpDTs-YfU1hqn_luRL0fA1DKd_I45taRIkViBrb-m34fDhihc13p0LHAJ1i9rjlpXhWTNfDsAv5TBKyW5c3D9K4tdXslSAOUuf6NXVG7BEtYPfeg_AUcN1X/s1600/snap0626.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEid2vojtgfAg3kjUdUq-gvB_LpDTs-YfU1hqn_luRL0fA1DKd_I45taRIkViBrb-m34fDhihc13p0LHAJ1i9rjlpXhWTNfDsAv5TBKyW5c3D9K4tdXslSAOUuf6NXVG7BEtYPfeg_AUcN1X/s1600/snap0626.jpg" height="136" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYrp-wRlcWtycVgedRONsrzdc6UWfpNy8bT350w6xoflqyOwBd_-pTMSYUFha9bjjPbUKd2olMriiVN2PCH6mzQqH9-RXVyZUMOdHJLWde4iP5XxIRZJu0DXBDvWZ7QqKZVs8Gzz8dzqtm/s1600/snap0625.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYrp-wRlcWtycVgedRONsrzdc6UWfpNy8bT350w6xoflqyOwBd_-pTMSYUFha9bjjPbUKd2olMriiVN2PCH6mzQqH9-RXVyZUMOdHJLWde4iP5XxIRZJu0DXBDvWZ7QqKZVs8Gzz8dzqtm/s1600/snap0625.jpg" height="342" width="640" /></a></div>
<br />
*The link below has been updated to an EnScript that can be run in either v6 & v7.<br />
<br />
<a href="http://www.lancemueller.com/blog/Parse%20recent%20RDP%20sessions%20from%20NTUSER.DAT%20files.EnPack">Download EnCase v6 & v7 here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com3tag:blogger.com,1999:blog-1746946614390371171.post-56050775971513589952014-03-17T19:56:00.000-07:002014-03-17T20:56:29.994-07:00*Updated* - EnCase EnScript to parse wireless network information for Vista, 7 & 8 <div dir="ltr" style="text-align: left;" trbidi="on">
I updated the <a href="http://www.forensickb.com/2014/03/encase-enscript-to-parse-wireless.html">original v6 & v7 EnScripts</a> to now include the date the access point was first connected and the date it was last connected to:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjVqdRD4J4SRjh1ljUuNOXb-lmzqGtt3U7ZfkTrzFeI0XPXAbdtGxcAZTfK2xJG_Ephujvp7AWq5L8imR6Dhv66safZhcuQbmWpyUv9Cj16hvO6qTEPZ6jEfaTmc6NOyK8r3u0hhw4wFYt/s1600/snap0624.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"></a><br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjVqdRD4J4SRjh1ljUuNOXb-lmzqGtt3U7ZfkTrzFeI0XPXAbdtGxcAZTfK2xJG_Ephujvp7AWq5L8imR6Dhv66safZhcuQbmWpyUv9Cj16hvO6qTEPZ6jEfaTmc6NOyK8r3u0hhw4wFYt/s1600/snap0624.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjVqdRD4J4SRjh1ljUuNOXb-lmzqGtt3U7ZfkTrzFeI0XPXAbdtGxcAZTfK2xJG_Ephujvp7AWq5L8imR6Dhv66safZhcuQbmWpyUv9Cj16hvO6qTEPZ6jEfaTmc6NOyK8r3u0hhw4wFYt/s1600/snap0624.jpg" height="640" width="366" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: left;">
<a href="http://www.lancemueller.com/blog/Parse%20Wireless%20Access%20Points%20Win7.EnPack">Download EnCase v6 here</a></div>
<a href="http://www.lancemueller.com/blog/Parse%20Wireless%20Access%20Points%20in%20Vista_Win7_Win8_EnCaseV7.EnPack">Download EnCase v7 here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-36150480150990651782014-03-13T22:57:00.000-07:002014-03-14T17:16:50.463-07:00EnCase EnScript to parse wireless network information for Vista, 7 & 8<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<br />
This EnScript is an update to one I did several years ago for extracting wireless network information on <a href="http://www.forensickb.com/2007/08/enscript-to-list-wireless-ssids.html">Windows XP</a> systems.<br />
<br />
This EnScript supports Windows Vista, Windows 7 & 8. When run, it will search for any SOFTWARE registry hives (Single Files are supported) and extract some useful information and display it in the console as well as make a bookmark.<br />
<br />
Example information:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnLPzOWiqkzaOZRNQiOVIpHfjWHMJx_hjJ8M1S0-W_OPnz4gJye5V0MAmB9IkyqeVnFg__wqSP9kKo90gufClfdj27LRHlqnRAnRWgvFVDiNodmQ_C8bqmiV8XkkBaciF5mz3nl5KQ-vyN/s1600/snap0622.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnLPzOWiqkzaOZRNQiOVIpHfjWHMJx_hjJ8M1S0-W_OPnz4gJye5V0MAmB9IkyqeVnFg__wqSP9kKo90gufClfdj27LRHlqnRAnRWgvFVDiNodmQ_C8bqmiV8XkkBaciF5mz3nl5KQ-vyN/s1600/snap0622.jpg" height="457" width="640" /></a></div>
<br />
<br />
<a href="http://www.lancemueller.com/blog/Parse%20Wireless%20Access%20Points%20Win7.EnPack">Download EnCase v6 here</a><br />
<a href="http://www.lancemueller.com/blog/Parse%20Wireless%20Access%20Points%20in%20Vista_Win7_Win8_EnCaseV7.EnPack">Download EnCase v7 here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com2tag:blogger.com,1999:blog-1746946614390371171.post-26244182835832831072014-03-13T16:21:00.003-07:002014-03-13T16:24:11.016-07:00EnCase EnScript to search for and parse prefetch files in unallocated<div dir="ltr" style="text-align: left;" trbidi="on">
<a href="https://twitter.com/Carlos_Cajigas">Carlos Cajigas</a> and I were recently having dinner and talking over some EnScript ideas. He recommended an EnScript to search for prefetch data in unallocated and then if found, to parse it for some basic data. Prefetch data can be very useful when handling employee misconduct, criminal and malware cases, so I agreed to write one and name it the "losprefetcher" ;).<br />
<br />
This EnScript will search Unallocated cluster, pagefile.sys and & $LogFile for the known file signature of a prefetch file (*.pf) and then if found, it will parse out the name of the executable, the last run time and run count. The parsed data is written to the console and to a bookmark:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9pJp1NMjmrYIwyI2QDxMfv5fWf81gVwlsA9fR5vhb8MdC-2Lwub6R7QxbjhR6kL4Fo10TTwxdaR6U0Dp13PswlRTi6uOt9npdCagZEL2XKfhUP0y1XCN2EkgCxI817YNUUq_DnXuZE1cy/s1600/snap0620.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9pJp1NMjmrYIwyI2QDxMfv5fWf81gVwlsA9fR5vhb8MdC-2Lwub6R7QxbjhR6kL4Fo10TTwxdaR6U0Dp13PswlRTi6uOt9npdCagZEL2XKfhUP0y1XCN2EkgCxI817YNUUq_DnXuZE1cy/s1600/snap0620.jpg" height="164" width="640" /></a></div>
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1CfsR0m4TBO9C96UCA58lINMc1DLL3507ksHrXy6Kx-P3bcY31KVviFp97gsmZwzuwB_TKqosiQxXOcdzkxmLwcxhbkjgczvvrPoMochUPdnPBFJrhFVEVMWMhUrF101ofkzMeHPhAjAR/s1600/snap0621.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1CfsR0m4TBO9C96UCA58lINMc1DLL3507ksHrXy6Kx-P3bcY31KVviFp97gsmZwzuwB_TKqosiQxXOcdzkxmLwcxhbkjgczvvrPoMochUPdnPBFJrhFVEVMWMhUrF101ofkzMeHPhAjAR/s1600/snap0621.jpg" height="150" width="640" /></a></div>
<br />
<br />
<a href="http://www.lancemueller.com/blog/Find%20&%20Parse%20Prefetch%20files%20in%20unallocated_v6.EnPack">Download EnCase v6 here</a><br />
<a href="http://www.lancemueller.com/blog/Find%20and%20Parse%20prefetch%20files%20in%20Unallocated_v7.EnPack">Download EnCase v7 here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-29160347836235562672014-03-06T20:18:00.002-08:002014-03-06T20:21:06.527-08:00EnCase v7 EnScript to parse USNJRNL<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
It's hard to believe its been almost six years since I wrote the original EnCase v6 EnScript to parse the $USNJRNL file for Windows XP (when enabled), just as Vista was hitting the scene. <a href="http://www.forensickb.com/2008/09/enscript-to-parse-usnjrnl.html">Here is the original post and information.</a><br />
<br />
Someone recently contacted me about a version that works in EnCase v7, so I figured I would post the updated version for others. This version works the same as the version written for EnCase v6. It recurses through all the objects in the case and parses the $USNJRNL•$J file. The parsed entries are written to the console as well as to a CSV file created in the case export folder.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyef58p6FZsSZxSF_WS3oLz6i1bKkkkjqKH4kOmPhhagGmWeb3wpPjq8_KZQGb7hbfUsV_kdAJ9pthMZT54L8YW6_3-6g3eTdJm53eCRnT6vzT_miqnzNibFGcY6-xhD7ntXDI4Gl-MVdv/s1600/snap0616.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyef58p6FZsSZxSF_WS3oLz6i1bKkkkjqKH4kOmPhhagGmWeb3wpPjq8_KZQGb7hbfUsV_kdAJ9pthMZT54L8YW6_3-6g3eTdJm53eCRnT6vzT_miqnzNibFGcY6-xhD7ntXDI4Gl-MVdv/s1600/snap0616.jpg" height="467" width="640" /></a></div>
<br />
The reason codes for what caused the entries to appear in the USNJRNL are referenced here:<br />
<a href="http://msdn.microsoft.com/en-us/library/aa365722(VS.85).aspx">http://msdn.microsoft.com/en-us/library/aa365722(VS.85).aspx</a><br />
<br />
Download <a href="http://www.lancemueller.com/blog/Parse%20USNJRNL_v7.EnPack">EnCase v7 EnScript here</a></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-7838641572275271132014-02-27T10:29:00.000-08:002014-02-27T10:29:38.479-08:00Understanding a Hyper-V server when doing Forensics<div dir="ltr" style="text-align: left;" trbidi="on">
<div>
<div>
Hyper-V is Microsoft's visualization server software. <a href="http://en.wikipedia.org/wiki/Hypervisor">It is very similar to VMware in that it provides a host allowing you to run several 'guest' machines on a single piece of hardware</a>.<br />
<br />
When doing incident response/forensics, you may run into one of these servers and need to understand a bit more about how to deal with them.<br />
<br />
Hyper-V comes in two flavors (modes):<br />
<ul style="text-align: left;">
<li>A stand-alone Hyper-V server based on Windows 2012 core OS (current version)</li>
<li>A role-based Hyper-V add-in available in Windows server 2008 & 2012</li>
</ul>
</div>
The stand-alone version of Hyper-V server is a complete operating system based on Windows 2012 core (current version) and can can be <a href="http://technet.microsoft.com/en-us/evalcenter/dn205299.aspx">downloaded for FREE here.</a><br />
<br />
For the Hyper-V Server version (Windows Core), once downloaded, it is installed just like a typical version of Windows, except there is no GUI interface for the user. There will be an initial GUI screen displayed for the login, but once logged in as the administrator, you will typically be presented with two command prompt windows:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1r6sko6RhdCOvkiCpoye70JMJ42fU-nIfQtqeih57Ip5AQHyPlSGWYnNE67VOTIg4ADxQBcrCgMCDIfUO-jHh8mHG74E8z7bUFwjcV7goO9vwKhqB39CfrVdC_UH2tTCSah7nnkP7ebSi/s1600/snap0492.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1r6sko6RhdCOvkiCpoye70JMJ42fU-nIfQtqeih57Ip5AQHyPlSGWYnNE67VOTIg4ADxQBcrCgMCDIfUO-jHh8mHG74E8z7bUFwjcV7goO9vwKhqB39CfrVdC_UH2tTCSah7nnkP7ebSi/s1600/snap0492.png" height="488" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQMw-xJEh9O6kTLWRZmaWjm9_HVfhAULXZoBg9mtb9SZxcIqDE3QtzUu7_cMQsuge1mjAB8P2oqsHHNi8251okjljoBop-BTqSX026BClbbKknF5kXbstYFY7GXa0r6xaIHosl7qfLeLTk/s1600/snap0490.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><br /></a></div>
<br />
From this initial console, you can change some of the options the server uses, such as the hostname, networking options and if remote management is enabled, but there is not much more to see from this console. The Hyper-V server is likely administered via the Hyper-V management console from another Windows based computer. The management console allows you to connect to the Hyper-V server and manage all the virtual guest devices. This management console is part of the administrative tools set that needs to be installed separately on workstations (Windows 7 & 8), but is included on server-class operating systems (2008 & 2012):<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJMKG7bFIugUQd_U9wOuBAVczgxMbqp1PIG5QPCthMkYhR3nG3BfoGLOARR5Ok-7NrlpogSScGbiFU2gmvxNEgMaBTeZXDForj7iyTLWE4X_yRbHucqUXV5qzgSoytA3eIoYXXyxvfc5Zf/s1600/snap0493.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJMKG7bFIugUQd_U9wOuBAVczgxMbqp1PIG5QPCthMkYhR3nG3BfoGLOARR5Ok-7NrlpogSScGbiFU2gmvxNEgMaBTeZXDForj7iyTLWE4X_yRbHucqUXV5qzgSoytA3eIoYXXyxvfc5Zf/s1600/snap0493.png" height="456" width="640" /></a></div>
<br />
However the Hyper-V serer is typically managed, you as a forensic analyst are going to be concerned with two major things:<br />
<br />
<ul style="text-align: left;">
<li>The path to where the virtual disk(s) that are configured for each virtual machine are stored</li>
<li>If the virtual machine has any 'snapshots'</li>
</ul>
If the administrator is cooperative and not part of the investigation, you will want to leverage their knowledge about where the virtual hosts are stored and getting access to the server. The following information could be used to help verify what they are giving you is what you are expecting. If the administrator is not available, then you will have to do the steps below on your own.</div>
<div>
</div>
<div>
The first item is needed so you know what virtual disk files are associated with a specific virtual machine. The easiest way to determine this is to identify the virtual machine of interest in the hyper-V manager and look at its settings by right-clicking and viewing the properties of the hard drive configured for the virtual machine.</div>
<div>
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRcMcCv87oCY141l5xgNNXxoLaQiFy06lWQxvoJ8Ptz5xW9e_KP3wlncCPaTg9V8g6hhwc7wLJNxuDcnJ5LxB4UNaQDSCwjT8ELxht4t6u_LrGuRSIfPp10KOvUxNOwq5gf1ZVEmdwpHLP/s1600/snap0494.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRcMcCv87oCY141l5xgNNXxoLaQiFy06lWQxvoJ8Ptz5xW9e_KP3wlncCPaTg9V8g6hhwc7wLJNxuDcnJ5LxB4UNaQDSCwjT8ELxht4t6u_LrGuRSIfPp10KOvUxNOwq5gf1ZVEmdwpHLP/s1600/snap0494.png" height="231" width="400" /> </a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqdflmPU1ytLqMris21m3hEpgLhjjKiW_aAD92j7_ySql3x0cof8u-Ysot3qvKcOCWxkSMIFJC4V8HBQnQ5GVgm84C2oR69UXoNmZKXXnIN7u_deMMUdveB0XtMYnb564NYyj7dUi0ufdu/s1600/snap0496.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqdflmPU1ytLqMris21m3hEpgLhjjKiW_aAD92j7_ySql3x0cof8u-Ysot3qvKcOCWxkSMIFJC4V8HBQnQ5GVgm84C2oR69UXoNmZKXXnIN7u_deMMUdveB0XtMYnb564NYyj7dUi0ufdu/s1600/snap0496.png" height="600" width="640" /> </a></div>
<div class="separator" style="clear: both; text-align: left;">
The important items to note is the path to where the disk file is stored AND if it notes that there is a snapshot in use. Pressing the "INSPECT" button gives a little more details and view to the path where the disk file for this virtual machine is stored.</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKKb8WiN0G_y1Wjd8o-jdBINM1dWRk2VQjuGJt7zxH1RW6sdBdlTbZq81gLYDvvNSaXNSPcymkl646O2mspMMSWrbBvm7rGqNwDgGQ2_tyrIcApIscSOTdMenGbi2YPzcDSgwE9scB_XU7/s1600/snap0497.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKKb8WiN0G_y1Wjd8o-jdBINM1dWRk2VQjuGJt7zxH1RW6sdBdlTbZq81gLYDvvNSaXNSPcymkl646O2mspMMSWrbBvm7rGqNwDgGQ2_tyrIcApIscSOTdMenGbi2YPzcDSgwE9scB_XU7/s1600/snap0497.png" height="356" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
A "differencing virtual hard drive" is the terminology used for a disk that uses snapshot technology, allowing the administrator to save the state of the guest host at specific time and then revert back to that snapshot at some point. The reason this is important to know is the same reason when dealing VMware virtual machines. The snapshot data is actually stored in a different file and if you do not get a copy of that file, you will end up with a copy of the base system, but not with the data that represent the current state.</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
Hyper-V uses *.VHD as the extension for virtual hard drives. Snapshots are stored in a similar file with the extension of *.AVHD. Many Forensic tools can natively read VHD files, which is good. The complication comes in when there are snapshots (differencing files), which most forensic tools DO NOT know how to deal with them.</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
The Hyper-V manager has a feature named "merge" which allows you to merge snapshots into the base disk file.This feature can be used to apply the various snapshots to the base disk file (VHD) and you will end up with a VHD with all the snapshots applied. If there are multiple snapshots, its important to apply them sequentially one at a time.</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
In the example below, you can see multiple snapshots exist in the lower "Snapshots" windows. To apply the merge feature, you select the "Edit Disk" option on the right side:</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHgr6EhefZotFvEpMdbnpRUEWwEH3PDe4kNixZoIj-h3gNPmHqTkoRjBH0M0L3S7CZCb2HBbOrtkcDek5yoKn1rJwuWK6XlQ1I7Cq1wHhrEg_HUP4NltpXHUkCFyTXVcRQjzQXl4bzxh1f/s1600/snap0498.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHgr6EhefZotFvEpMdbnpRUEWwEH3PDe4kNixZoIj-h3gNPmHqTkoRjBH0M0L3S7CZCb2HBbOrtkcDek5yoKn1rJwuWK6XlQ1I7Cq1wHhrEg_HUP4NltpXHUkCFyTXVcRQjzQXl4bzxh1f/s1600/snap0498.png" height="206" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
Once you select the "Edit Disk" option a wizard will open up asking you for which VHD or AVHD file to merge. You want to select the OLDEST AVHD file and merge that into the VHD file. Then repeat with the next oldest AVHD file, etc, etc, until you have merged all the AVHD files. This can be done as a non-destructive process, meaning when you merge you can tell the wizard to merge a AVHD file and create a NEW VHD file from that process. My recommendation would be to create a new VHD, leaving the original one intact and allowing you to have various versions with the snapshots applied along the way, which can be loaded into your favorite forensic tools.</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFcxj4U3vG7lCMmBnTLjnBYNEZbuzFyjIOBubeSf3VCZY3yTfIqK3XsxvXGym7ndx8gKSgkr4sXecL8zVgwyqqRcOn28UL9xTppzH6iDN9AVz80s_tCb-AQ2iSpLbjru4b5xwBQmmATtWb/s1600/snap0499.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFcxj4U3vG7lCMmBnTLjnBYNEZbuzFyjIOBubeSf3VCZY3yTfIqK3XsxvXGym7ndx8gKSgkr4sXecL8zVgwyqqRcOn28UL9xTppzH6iDN9AVz80s_tCb-AQ2iSpLbjru4b5xwBQmmATtWb/s1600/snap0499.png" height="292" width="400" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1Q4FKb054IrGUOowr4TTBcZGCd2A04uOyTHS0_lvYby3No5fpk9miEOq6V5WW_PKLbcXPyplLopOQhPwKLhQdUwHNsEJoWCqmU1JkybEdKxc_3UEXMJOZmZnHAUuukSiVoQyziBfu19GH/s1600/snap0500.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1Q4FKb054IrGUOowr4TTBcZGCd2A04uOyTHS0_lvYby3No5fpk9miEOq6V5WW_PKLbcXPyplLopOQhPwKLhQdUwHNsEJoWCqmU1JkybEdKxc_3UEXMJOZmZnHAUuukSiVoQyziBfu19GH/s1600/snap0500.png" height="291" width="400" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi04NIlNDqPN92ZOkKpc2cdqJX65lqJBOIOF1a8_3lMqBebhmv6oHc6MrWbXmBtVxY2e45sYsAM9Byu22v9hD-hKwSLP0WKEEz9MlVy22n0eWC-alEA9MDOvwRAoZUIVRIosYLlYaBqhJhi/s1600/snap0501.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi04NIlNDqPN92ZOkKpc2cdqJX65lqJBOIOF1a8_3lMqBebhmv6oHc6MrWbXmBtVxY2e45sYsAM9Byu22v9hD-hKwSLP0WKEEz9MlVy22n0eWC-alEA9MDOvwRAoZUIVRIosYLlYaBqhJhi/s1600/snap0501.png" height="183" width="400" /> </a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiiHJ8Yy9nZc72CYjzDFECICLc84atLbaGWTueOpBKS7S7hnp5KulenxNLMueYoaI70BeXY-ApP0rDJLr4lIxBU_o3u9CfgzMg2fpxQsMKuSriDs4Tad8dtYHTCDWunfq4-0qtMauJIg0Mj/s1600/snap0502.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiiHJ8Yy9nZc72CYjzDFECICLc84atLbaGWTueOpBKS7S7hnp5KulenxNLMueYoaI70BeXY-ApP0rDJLr4lIxBU_o3u9CfgzMg2fpxQsMKuSriDs4Tad8dtYHTCDWunfq4-0qtMauJIg0Mj/s1600/snap0502.png" height="290" width="400" /></a></div>
<div style="text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzbpfikrlqdDTBbZT_HazZuRnWs4AaNhFT2BJtCKdzO1lLcPCuYqFIyZS5yYw9HPmryObPJe4Ywsl50PeleG2vJ_Z-Pw6b4owO7vedPFbcSttJlm1oVGlRu7m3Jh5WdwJKiygyFVEESOuK/s1600/snap0502.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><br /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-HheoVuRSRgHzRiIWsUM6807i-xbOg1UNg9fOXjTsbbMfG4ZUXZ92PyT4SqdOG5-YWhjoaokP1zywt5oN2Y2sodXPmYvP3VzRlHODaq7Zh-6bRx1iaYOaUWqsih2T3nR-QezkVFJkZc0x/s1600/snap0504.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-HheoVuRSRgHzRiIWsUM6807i-xbOg1UNg9fOXjTsbbMfG4ZUXZ92PyT4SqdOG5-YWhjoaokP1zywt5oN2Y2sodXPmYvP3VzRlHODaq7Zh-6bRx1iaYOaUWqsih2T3nR-QezkVFJkZc0x/s1600/snap0504.png" height="292" width="400" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<br />
<b>Note: You will only get the "MERGE" option if you selected a AVHD file in the step above. If you select the VHD from the file picker dialog, you will not be presented with a MERGE option.</b><br />
<br />
Once you have merged all the snapshots into a VHD, you can then load that VHD into forensic tool that supports parsing VHD files and it will be displayed with the snapshots applied, in a state as it was when you encountered the machine (assuming the file system used by the virtual host is supported by the forensic tool).<br />
<br />
Alternatively, if you are comfortable with PowerShell, you can either locally or remotely use <a href="http://technet.microsoft.com/en-us/library/hh848559.aspx">Hyper-V cmdlets </a>to get all the information you need and even do the merging without using the Hyper-V manager GUI.<br />
<div>
<br /></div>
<div>
You may also want to grab copies of the other files present in the same root directory as the VHD & AVHD files, specifically the *.BIN files, which is a saved version of the virtual host's memory. The XML file contains information about the virtual host's configuration, including how much memory it was allocated, etc.</div>
</div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-74639877896984692542014-02-20T15:42:00.002-08:002014-02-20T15:43:59.141-08:00EnCase EnScript to parse out the VS_VERSION_INFO resource in executables<div dir="ltr" style="text-align: left;" trbidi="on">
I wrote this EnScript awhile ago in order to quickly parse out the string resources inside an executable to assist in determining if it was suspicious.<br />
<br />
Most executables contain a resource known as "VS_VERSION_INFO". This structure contains metadata about the specific executable, including the manufacturer name, original filename, version info and other useful information. This EnScript specifically targets this resource instead of just running a "strings" search across the entire executable, which often leads to lots of noise.<br />
<br />
The information in this resource is what is displayed if/when you right-click on an executable in Windows and choose the "details" tab. <br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiiYKFBmxAuSqnGQI4fPa7EeqFY5a4EegOQUoD3BJ3vxzKVVMHiv7UxbS_HNh8x55aHmFUVbMNWEgVaX7w1a1qGlpLh6IV6W26NpeEC9yhyphenhyphenxnpocStx5xo_EG8kvR_7YI5-dFQcXF4ovXB0/s1600/snap0473.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiiYKFBmxAuSqnGQI4fPa7EeqFY5a4EegOQUoD3BJ3vxzKVVMHiv7UxbS_HNh8x55aHmFUVbMNWEgVaX7w1a1qGlpLh6IV6W26NpeEC9yhyphenhyphenxnpocStx5xo_EG8kvR_7YI5-dFQcXF4ovXB0/s1600/snap0473.png" height="640" width="448" /> </a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
Looking at this information, while not authoritative or definitive, can commonly give you some initial hints about the legitimacy of a file and/or if it has been renamed from when it was originally compiled. </div>
<br />
The EnScript is designed to be able to check any executable(s) and then run the EnScript. It will then print out the information from this resource to the console tab (and make a bookmark). For example, if I came across an executable in EnCase with the name of "cmd.exe", I can run the EnScript, which will output the following:<br />
<br />
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXpd4Evu9VWmpea5Z-z8HOpfxwixnQwEwwDvbPqYHIcN7LYFavnYd9-azYBOf0CYvgA4KBGlxY1z9gVi-FNtvtihZurACIGmMt7wrKXKoA4zsHe_FckF914onAnkAZ0aIaWAO_wPNxN5s3/s1600/snap0475.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXpd4Evu9VWmpea5Z-z8HOpfxwixnQwEwwDvbPqYHIcN7LYFavnYd9-azYBOf0CYvgA4KBGlxY1z9gVi-FNtvtihZurACIGmMt7wrKXKoA4zsHe_FckF914onAnkAZ0aIaWAO_wPNxN5s3/s1600/snap0475.png" height="100" width="640" /></a></div>
<br />
<br />
<br />
<img alt="" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAuIAAAA2CAIAAAANsWt4AAAPx0lEQVR4nO2d0YGsIAxFrcuCrMdqbMZifB8qJCE3gqOjO++er1mHgUASiMiabiGEEEIIeSXd0wIQQgghhPgwTCGEEELIS2GYQgghhJCXwjCFEEIIIS/l8zBlGrqu68cLZPku09Bt9OM89sP0tEAFq4T9OC/LMo99kvZrTWdeODpnkXq/vPKkJXfopmHTZiKp1Vz3mU3139ZKKf+z9ZTVPuUvN+o992SYFt2xq4fwJr2oBtpMdxqKsmY8aht89zzm2sNT9vygHyEu2U2Zhr8WpkxDNtlVE+804Gno+14I+t1xnsf+3mnr61i93xKpCFOqi38bxnkasqXKzryPRyL/B/3lTr3bCfaVd1UHzGPfaq5j3w2j7us0JJ+VrnDYdP089uDYlnI+Zc/PrjslOUyRd5lj34/T2Hdd1/fDGoVuX+u1vdu/O+yGvBFMhfeLw5Sa39Xklr+KcBIRDYvbF28c1i/GUW7L7LWIMD5d3eKhobil2Dq7FUx/Lev8NO7uKM2lrB/LKSp1x3MawI2GcRsovxm3vu8LFZftWnubVbwoI/pUeT/O0mSO+uX3x8iwVgTrz2Juij6c71bbcocO/dyZRlG/9Nycf4jHwdeLN/7BOLjyQ/u3uz5Z5GAcrN8d2Ztrt46/xH7h+Wnk15hb9a7UPg35V6A8tmffHu7Wy4mlbtva0XO17HplLLjUz2PYbpvGORofz96QnMtz8/+DfuTS5VZUj/pxFgHw/vVuGHJ3sOqhjxx/dRe7/iHbistfgjJ2I6cYyxS5w3FY1EbMPPZZbZOcF/Q0nb1dtqUXgK3Menn7UpmpV38kZzCetWFKIL/8PA3ZHlC7vr2ZmceoaY9c1s8V/TrujmrCr1+NbY2fBZvy6K6uvA77ZW4h9z9ReaQXNP5oHLCcwP7Du1K3HsfvAn/JghbTa+kv2C+Qnwb9Qtyrd+EY0mYj+/f0iOwBy3ONXpZp6Ieh/nFVHvI4TKlbF+rnsQXY7YlxBvO8b29Izqfm/wf9yKVLUjlfJvn22XATy6wfh+ZSRKlqUPRewnF5B/sI8qA8ClOK8NzqyYxDYWq5At0FGaagZdidh5QAcpzd+pGczeOZGyndG8gvVQDvTvJeCTCYOEyJbj0r+nUYpjj1CznRYmNw76rjGuz1oF9umBKNg6eX+CktDuLdZcy3/6YwBfldbA+B7MZfsP8iPw36hbhX72mlwZOAtX9/uFx7wPJcpJftVjz9+Ci8MBO6nQ+FuHE9fr8q52Ejfcs4w/qBvSE5n5r/H/Qjl6+EKUfToqv5+j40gwQ+E6a4fq3Ooslaa5Zht8g89sOYxAb1QzlPjmeTe8uOdElOv92LwpTWfhV6h3vpbvmK6Xhp3EUA13G//Ic+deNwrJf0ZX2YAte1J8MU4y+BXwA/PRLQ4V69730rNxfi8pHEYnfEl+faMEU9K6nxJEcGZf7Vi96nYUr7OIP6ob0hOZ+a/x/0I5f80MfcGadbAyCW1EJXsYkEn87K0whyQ7LakM/g99cO667dcDdFu9/+tQ57q8KU9ef6otpY6fa2UP1YznA82x76uPKrgsI6ULto/HOLc/GQxZsOWvsVHaH16pf9UhvgfvVrsc+XK9wv63nbH6h8nV70WdzG3RTH/k3TxVHfo3Anz6qhv8DN6vxt7L/YT4N+PaN32F9c/sie7c7cnXpZ1I21WTXh/FO0tCzzOAgFF77tV9MYpjh22zrOfv3Y3pCcT83/D/qRSz5CK3dt1E7RMO2ibgeF1g0VUXrQx1OgmXa4hVShWPkaNqlOYPu7Um5eheMw9uKRa3Fadr22Fhimg/7uI6fjP1nGPhvW9Y+hvqLxBMt5UTyQP1AW+upo/OWRVVecg/qRHea6rMXG8qwnDmddj/X90bEFp34ZmqOWnX4Vm7eH41CpFxG9uPVDOZH96x+ldnF/vU3jI3+x+vX9JfRf10/jfj2g9x033PHKQ3sGld+rl8AgwvKFQk0XnFrs8LTOY4GY9eMc1A/szR//p+b/B/0Iwde7fUTD7mUNdY8VyCOYRcJurvyXXGz/ryHoF/X+TqiXF3KVHzFMOY+IID89SaM2py7fOCIf4Gt5Pn9q/We40P5fRdQv6v2dUC/v40I/YphCCCGEkJfCMIUQQgghL4VhCiGEEEJeCsMUQgghhLwUhimEEEIIeSkMUwghhBDyUhimEEIIIeSlMEwhhPzHiJduPi0KIcShWxbzrt5bXpKTXqbrpmXJr9I9m5roHJWZg+Qrhy9p9L/qb6LqjaVFdsCY6C36f5wb7QT5ezgPnJbHy0t9ocZEzpETzPllmEWKm1p/+R9p8tOH1pcit4S7/rTymb01IhNLn2Ydfvu2/r4fzIDs5ZTCdE/NiH7NO/Juyhde1O6m2jLpI9650ATzctMK8r/1N1MuAp8WzKDUbn+XL9gJzm/tXD8vT6nOxki0qo2zFSrLYaqKFlr99PvrS/oziXrRPHHe3k5wiczT0Pe9cOCUSlB4siqzFyu0ptT+tXn3KEyREamT1rLTKeJMHObkjVQXw5sy0bDMo7Y1p1rYhJS5dTdp0xd7P3IuSSCk368tn7W5IQhTwTkptX68vxHlu5Hl3bmyi/ZlrJyeuj0hZimmySWofrPLE8spvXvStyRo/IP6/f7U28la83ZvNEybuMeaaQhTPtjMMXq3u19yuvTs2elvEilfVcuGWx7pZe/sJleZOvSn7Kp9fOA8v5zY+Pz6+iLqMvYL+4vqR/ZWyh/7I6gfj/8ibUN+5dtbbsOkku3HcR8FGaYM0+bb8vOSvizVpsbya08DDsIUqfd1f3S/rhZAcUcySdP37qNUDlUUjKm8RCIzpAr/ZF4Am4y72MreM1BLkUqzRv2SfxUp6JCmCnP58f4GeEnX1Uxrcme2Bellv+axlyGa7Ff6PA1yLfTtHMk5B4nsvfFH9fu02knq7S5uzfTREKacvxH2brnd5Q3YM/ALaSFqEx75USpo9LI2u0lZdPPX7Kp9fOA8n35fbRcPrC9CUMcd3HnSrz+wN0/+wB8D+cG8LcIUFR+49iYqKsKUeVeBDlPWq+sQSevbP5utoxfupjgP9/bIS4g+W12Z0otf0m9yL2f3JbaCRrWyYP5YuDcaS2d3B/QrmD4alu3/rb+yanNTHc6nrWnE3OUEyO+di0B2juWMlxM7/rB+QKudJD3uc8hbwhSr9/2iN6qOPaP+GnnMtIsE93qxXtvMpy5M+cN21To+wTy/LEujnz6wvuSm/TDFKezWH9hbLH/pj4H8wMu2H1iDaTvfpSYK6y858JI+2DkfTbtPn03ZhxW4k5lo8i9VfF3OlfEyqa7DZdtWUHp16Ist8ogfXrNs/2/9lQ29JUwRyLtzX56LlpOj/jq1N9nJx2GKLO9cR/LUdKQ6THHs+VthSl48tGA/aFcfhCllgdNhypfWl1xBZZgC6kf2dii/9cdQfhymDMMQxSJmV8wvIiL/sfCXfY9H9BhFvyeODl5AHKbAfT1pD3kjUZqX2aVa0veqNl1/3grVBbM1rDuAQgzVwtivzw21wPXLNurXwbItnMh5EG839n63vwHOQx93HJwvK6hfTlRBfceAJjhXztxiuRnuL4dBlz62k7vDlAN9hY3UhymePQO/UNWihyx2FfH0ghY29O1ft6vW8UHzQ9S406yt/mvrS5KoKkyB9UN78+VH/hjLD8OULTQvD6yA7sGHPvlbENaDBz2Lmh6Q6wO9X0L5D8k2ftIbW85+Zt+rhwXp8jCkgxVlA3LEvatgc2zst2r9TSc/UCjrwfJ4/UrX0g6ZajpXZlTk6+13+xtR3nj547C03bu7HQ7k9425kKfFPuURP3wTEjX9mZ3I3m5T0HYQD6oH+Xv1PFCveKN3u0vueIy+hDbJ1Z73oGZepzzWi9jv0WcRnGH4Bbs6Mz67QL0OAoCfTklqIwho4tb1BZgP7C+oH9tbKX/oj5Xy68HpxzmXOLS3Uu/mt9vui7S02Y6UKK5+LQp5a9FtT4EueL1bfEdyLQdNnT/r5/DNfiF+p7/Vm4XP7CqSm2hS56X2XEmen2l2IbPdivEHrNh0ubhd8k4u17vkfJgi4sJvvuvGb7HtQNHZVr7Mj/W3arY5fQyCvJUavV9oz+Ra/PkhOD51kQLfMw+TY67Tuwtflk8IIYSQl8IwhRBCCCEvhWEKIYQQQl4KwxRCCCGEvBSGKYQQQgh5KQxTCCGEEPJSGKYQQggh5KUwTCGEEELIS5E5fZpfp9OafKU5WUuByBFmk2BZwiQxqB7yHYy+rtCCSrB+CXtmdZVA4Asvm3qqXUIIeSFbmCKTacxj//I50X19skqjVJN7ja9hfhL1ru2L9NCYMFbjWsw09L1M2Pstv3iqXUIIeRvdsjjzYFpD1nu5lDypTOnk5cLev8mps/zyW0KmwUtlJ96eXZnXVCShtE2g+3WnnlklVzoj51q677f8T1sBJ6VWEQvalFF+u3H93rht+avGofgG48opjWBraK8q6peLClNSVInsbVEbMDoezVe3MEUm3pM7E3aE+nHTf5F2S6ULHndJpZvcqXe/3e/onRBCXka3uKu1zAG2z/TrZzmblj/Mb/YvE5GDxOgy9BGNTnJ9qknYrRM+HpcH8qts4zpSqZYzld43qcQy7Ne/1lUuV367uH40bipjbkX+BSjnvGeY0onIw3654N0Uz95UXqs1w2f6VCYoN7tpJou5ihxkvnh/N2Wc9wpUmHKv3v1279c7IYS8jaowBd2F2R/qXRk3KCmvuMsJTOAO6lnAbkpQ3pe/M+QFqEHONA77Wjwn4UD9CL9dVD8eN7NAHTwTi+Wc05ZHXXkflbtcaaG0t0LcrYgpKcwP6Ct6KhSEKXk/o9hYuknvfrt3650QQt7HwUOf9Y9zYUr5w+owRZ15LefW47MpsZzwOlzG2uSEy0nz4YnGMAWOW6mocLkK5dwDDPXoq/nwBMoD/8owZa1wTPXfrne/3dv1Tgghr6PiCG19mKKnRbVRD8ofLMOLfbiA6lmuCVPg/yK1yYnvesP/dfIf+jSEKXjc1ucbqVo9Vu5DBzgO8tSHfJgC++VUv7SFKXa5Tau+CafVQx/5gAzIKa1eNCEum+dFnQkXlrv0ftDuNXonhJA/QPwPyWpnXkyl9rp7VLDv1cRflk9l98ftef9fVjMM6QE7bFcdUPSOS+ryWH77v7Ltco6i9LbEbAdC0zELt110hNa2uzYD6gfjtox9/l1nj+/4cUTTOAT92mVElUf6csbCq32/OqgVPdU/KglkRTY005fFafB5+1ufqlbjfJ3e/XbnqP5TeieEkD/Aja93Q3sY5Ps8qIpyU418DbogIeSvc32YIu7r+LKHV/CkRvjfJc9BTySE/AB8WT4hhBBCXgrDFEIIIYS8FIYphBBCCHkp/wBzS26wzkkQ8QAAAABJRU5ErkJggg==" /><br />
This technique goes way back when I wrote the <a href="http://www.forensickb.com/2007/07/exporting-program-icons.html">EnScript to extract the embedded icons in an executable</a>. Since EnCase does not show you a graphical representation of the embedded icon, which could be quickly identified or recognized regardless of the filename, I wrote that EnScript in 2005.<br />
<br />
This EnScript follows the same line of thinking since there is no easy/quick way to see the VS_VERSION_INFO resource in a file from within EnCase. The raw VS_VERSION_INFO data looks like this in EnCase when looking at the specific data inside a file:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGgWqf3tSOh1-UZowuwqlccJbMdWDFM8zYB5D0sKT4EKVNqIeD00inW1RkXFh-msBIsyN9BT5qEMQKo2g975Wp7j5Hn12nvioaolY0l2m6cIS_ZxLy2fGowSlVD_FJODxFZ92aKioFDO9K/s1600/snap0474.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGgWqf3tSOh1-UZowuwqlccJbMdWDFM8zYB5D0sKT4EKVNqIeD00inW1RkXFh-msBIsyN9BT5qEMQKo2g975Wp7j5Hn12nvioaolY0l2m6cIS_ZxLy2fGowSlVD_FJODxFZ92aKioFDO9K/s1600/snap0474.png" height="260" width="400" /> </a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
To use, simply check the executable you want to parse and run the EnScript. Each file will get its own bookmark and the formatted text will be displayed in the console tab. </div>
<br />
<a href="http://www.lancemueller.com/blog/Parse%20selected%20Executable%20for%20String%20Resources.EnPack">Download EnCase v6 EnScript here</a><br />
<br /></div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0tag:blogger.com,1999:blog-1746946614390371171.post-45132860525464414082014-02-01T10:59:00.001-08:002014-02-01T10:59:48.692-08:00EnScript to create EnCase v7 hash set from text file<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
It has been nearly seven years since I posted an EnScript to <a href="http://www.forensickb.com/2007/08/importing-text-file-of-hash-values-into.html">import hash values from a text file and create a EnCase v6 hash set.</a> That EnScript still remains popular to this day.<br />
<br />
The EnScript linked below was written to basically do the same thing for EnCase v7. The hash values in EnCase v7 are stored completely different than in v6 and while I had to create the hash sets in EnCase v6 from scratch, EnCase v7 includes an EnScript API to create the new hash set using the new format.<br />
<br />
It still surprises me to this day though that EnCase does not have a feature to import a list of hash values into a hash set from a simple text file. So many examiners and incident responders obtain plain text files that contain hash values from 3rd party tools and commonly don't have the original file, especially with malware databases like <a href="https://www.virustotal.com/">Virus Total</a> and <a href="http://virusshare.com/">Virus Share</a> that provide hash values but you don't necessarily have the file itself to obtain the hash value on your own.<br />
<br />
This EnScript was written to read a text file with up to three fields per line:<br />
<br />
MD5<delimiter>SHA1<delimiter>logicalsize</delimiter></delimiter><br />
<br />
The order of the fields are not important, they can be in any order. The delimiter can be a space, tab or comma and there should not be a header row with field labels. The EnScript was designed to read/parse an ANSI text file.<br />
<br />
Here is a sample input file from <a href="http://virusshare.com/hashes/VirusShare_00001.md5">http://virusshare.com/hashes/VirusShare_00001.md5</a>:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXMAG0D3JDErxtRFTPimtG8HVV1HImH_ctuf3Nz9Rz6FMsD27sWQMAk9nY1KkAzDXXsNLlB6oXKnaiOp95HaPDR3xJT1QOJY16KRs3T4WBCAKZ6XvLCZHbj6zk3io3B7mlqa30gzcH3TQp/s1600/snap0605.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXMAG0D3JDErxtRFTPimtG8HVV1HImH_ctuf3Nz9Rz6FMsD27sWQMAk9nY1KkAzDXXsNLlB6oXKnaiOp95HaPDR3xJT1QOJY16KRs3T4WBCAKZ6XvLCZHbj6zk3io3B7mlqa30gzcH3TQp/s1600/snap0605.jpg" height="400" width="290" /></a></div>
<div align="left" class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: left;">
The lines above with the '#' are automatically ignored.</div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: left;">
Here is another example file that contains three fields (MD5, SHA1, logical size) that were extracted from here: <a href="http://a4lg.com/downloads/vxshare/">http://a4lg.com/downloads/vxshare/</a> using awk:</div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC89Fh79ru2GGUznLKl9AMLlqy4AEOGFxuUohmlIgtbsV0dc3GyvvxFyUqCe4iemcDyv1zN_zaLsoiq_-X7F-nFipKzyOqfzwr8a8yZQsXzdV9moYmZQAXOe-eIl8x9kjGUAhqqdseXjDF/s1600/snap0608.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC89Fh79ru2GGUznLKl9AMLlqy4AEOGFxuUohmlIgtbsV0dc3GyvvxFyUqCe4iemcDyv1zN_zaLsoiq_-X7F-nFipKzyOqfzwr8a8yZQsXzdV9moYmZQAXOe-eIl8x9kjGUAhqqdseXjDF/s1600/snap0608.jpg" height="322" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: left;">
The above example is a text file that contains the MD5<space>SHA1<logicalsize> that was extracted using AWK.</logicalsize></space></div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: left;">
Once you have a text file with the hash values you want to use (second hash value and logical size are optional), run the EnScript and select the text file:</div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7ZXdlZTjN7z_pPKH5hD6_E5wg83yAymsqOt1mO_f0I2ZIIzTOvCLzhCptAsCh6SDvyhJTnhVlFroIwmVln9BncsSREfeAZ1m8V6jPqK1WN6yUmzXRNG4bZtmEWZfGKaQzilkAFHYwug9Z/s1600/snap0610.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7ZXdlZTjN7z_pPKH5hD6_E5wg83yAymsqOt1mO_f0I2ZIIzTOvCLzhCptAsCh6SDvyhJTnhVlFroIwmVln9BncsSREfeAZ1m8V6jPqK1WN6yUmzXRNG4bZtmEWZfGKaQzilkAFHYwug9Z/s1600/snap0610.jpg" height="446" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: left;">
Specify a name (it will be the name of the directory created that contains all the hash indexes as well as the name displayed inside the EnCase Hash library Manager), Category and a Hash Set Tag.</div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: left;">
Once run, a directory containing the EnCase v7 hash set indexes will be created in the default export folder for your case:</div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAt9PRR7MGGJNuHoPXmmOrR7FwlJcLfVllyrEEaIrouECRv1g-c5dOc_9sGMRcm78AwjxN7f-BWRnmBMfvp4DF_z0dqnQyXi0MHmYf9epdV-UCTdgWESF_fPl7DrzCT9-4DMZTn3tRTxZY/s1600/snap0611.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAt9PRR7MGGJNuHoPXmmOrR7FwlJcLfVllyrEEaIrouECRv1g-c5dOc_9sGMRcm78AwjxN7f-BWRnmBMfvp4DF_z0dqnQyXi0MHmYf9epdV-UCTdgWESF_fPl7DrzCT9-4DMZTn3tRTxZY/s1600/snap0611.jpg" height="152" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: left;">
You can now add the hash set using the EnCase Manage Hash Library option:</div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDXEGlfaEAeYnXZQapuNE8fXWkMWA0kGZJcgyGy6AviFhN03wAcd0MeqO51V3Rhxi-6vcMhsYamYYPIZJgaOH3ZMMxziTdpMyhkQ6HTIthXkOa7RtUon2srcNwbPMGEoNf4l1de-zE8yS9/s1600/snap0612.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDXEGlfaEAeYnXZQapuNE8fXWkMWA0kGZJcgyGy6AviFhN03wAcd0MeqO51V3Rhxi-6vcMhsYamYYPIZJgaOH3ZMMxziTdpMyhkQ6HTIthXkOa7RtUon2srcNwbPMGEoNf4l1de-zE8yS9/s1600/snap0612.jpg" height="516" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7bloQNbY6yhuKmOB7leK1rMZ9pRQUlWb3KUZQt-vTihAS1DBNsw317SgOuquVl0-xJXLMPwhLAKi4XibTCFsAu7uk1InPZA7F9OoujR34Kr5HXaxtL_1kQ3Us1iL3F2b9acN75lrl2SnL/s1600/snap0613.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7bloQNbY6yhuKmOB7leK1rMZ9pRQUlWb3KUZQt-vTihAS1DBNsw317SgOuquVl0-xJXLMPwhLAKi4XibTCFsAu7uk1InPZA7F9OoujR34Kr5HXaxtL_1kQ3Us1iL3F2b9acN75lrl2SnL/s1600/snap0613.jpg" height="184" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbwMt7gOcs3Gunn7GBVKC1bPcKoNCz0NnDbqrbZj1n8mX9dBGa45OOCSVgKFGKNU-dE2ks_6DDZLoziIZs5Rincvnq1zlAsf778zfcqh-QSL9nAD84MwCpu8z9yi9RByOGSvT4s3oL77eU/s1600/snap0614.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbwMt7gOcs3Gunn7GBVKC1bPcKoNCz0NnDbqrbZj1n8mX9dBGa45OOCSVgKFGKNU-dE2ks_6DDZLoziIZs5Rincvnq1zlAsf778zfcqh-QSL9nAD84MwCpu8z9yi9RByOGSvT4s3oL77eU/s1600/snap0614.jpg" height="228" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNftECMpoqG_An1u1o8FlylyshnlKhC7aUXdQ8epXxGML8zxYWWrBuhVOR5RO9fQz18Kw8IaFi-XTisWV2-rCOc-95BhYsf_UOdekUvQjC9ZV5kQOQsE06Lyc0_uWPApPDmiVJD4SaovBT/s1600/snap0615.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNftECMpoqG_An1u1o8FlylyshnlKhC7aUXdQ8epXxGML8zxYWWrBuhVOR5RO9fQz18Kw8IaFi-XTisWV2-rCOc-95BhYsf_UOdekUvQjC9ZV5kQOQsE06Lyc0_uWPApPDmiVJD4SaovBT/s1600/snap0615.jpg" height="144" width="320" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: left;">
<a href="http://www.lancemueller.com/blog/Create%20EnCase%20v7%20hash%20set%20from%20text%20file.EnPack">Download EnCase v7 EnScript here</a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
</div>
Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.com0