From da6987054aef08d965cffd46c86113000bcdd2e5 Mon Sep 17 00:00:00 2001 From: atomiczsec <75549184+atomiczsec@users.noreply.github.com> Date: Wed, 29 Oct 2025 11:49:59 -0400 Subject: [PATCH] upload existing repo to github --- Assets/ADRENALINE.jpg | Bin 0 -> 47782 bytes README.md | 35 ++++++++ amsi-etw-ping-bof/Makefile | 61 ++++++++++++++ amsi-etw-ping-bof/README.md | 11 +++ amsi-etw-ping-bof/amsi_etw_ping.c | 38 +++++++++ amsi-etw-ping-bof/amsi_etw_ping.x64.o | Bin 0 -> 2224 bytes amsi-etw-ping-bof/amsi_etw_ping.x86.o | Bin 0 -> 1988 bytes amsi-etw-ping-bof/beacon.h | 71 ++++++++++++++++ appnumberBOF/Makefile | 14 ++++ appnumberBOF/README.md | 14 ++++ appnumberBOF/app_numbers.x64.o | Bin 0 -> 1802 bytes appnumberBOF/app_numbers.x86.o | Bin 0 -> 1736 bytes appnumberBOF/appnumbers.c | 115 ++++++++++++++++++++++++++ appnumberBOF/beacon.h | 69 ++++++++++++++++ 14 files changed, 428 insertions(+) create mode 100644 Assets/ADRENALINE.jpg create mode 100644 README.md create mode 100644 amsi-etw-ping-bof/Makefile create mode 100644 amsi-etw-ping-bof/README.md create mode 100644 amsi-etw-ping-bof/amsi_etw_ping.c create mode 100644 amsi-etw-ping-bof/amsi_etw_ping.x64.o create mode 100644 amsi-etw-ping-bof/amsi_etw_ping.x86.o create mode 100644 amsi-etw-ping-bof/beacon.h create mode 100644 appnumberBOF/Makefile create mode 100644 appnumberBOF/README.md create mode 100644 appnumberBOF/app_numbers.x64.o create mode 100644 appnumberBOF/app_numbers.x86.o create mode 100644 appnumberBOF/appnumbers.c create mode 100644 appnumberBOF/beacon.h diff --git a/Assets/ADRENALINE.jpg b/Assets/ADRENALINE.jpg new file mode 100644 index 0000000000000000000000000000000000000000..ab4b12758811f0b91949d84dd36162de0f2a408b GIT binary patch literal 47782 zcmeEtcT`i`)^DuG?xBfP73o!ak#eL85)hIQ2~9c)B|r$hcvL_zz@da1K!FfQDAH@- zC{4N$LNC&r^dg-X&%O8D`@Qkr_uV_jyMMjAGWOoTtTp#sbI&!i)|_*%oDQCT1^ld| zsjUe(bLI@-G3^65odmqo@P^v~06-u>5C8yN0$e!53b;T+XK07c8MZ&M;Te9wxj*X9 z(i$ZIv@?K_cECd6fb)OU0{||x>yJX?{Kx%&TqPbzNGpgxP>_(hOFK);D@Z;70M5NT z^A~QXrvSjavwy+oC^UTTFZj&wKN$Ux@T#)yNccl-p;PhwjP#uy`7z0Pzv5kTz@cEpy40YVqACsAn|Zi;(7*rdRGnUZhKc+ zR9f@_7wv9$8#@I48K!AYK1t{$DikXY(I= z_}fjir}{sW|4m{4KnMi>_oU9wKeX_NEGQ2RPnu}|-AJIoKCZT6hPEgq+TGe#!_(Hq z<388jKc!SqLpmYdfk+!$B`(Q-tk+gkd+Ls~gFDe0P=;EnKe}{Ppb^6DeAF#HXth5q zNJRXBh=dIIZx$r-KuY1kgTIo}hRep%!}5P3{xRy#u0Wu|V>rqK>F)E_aRk}A{S`UE z@BZ2CYTp7wA`T#xMR;4W|vpSw?gjMQC; zyAq-@qEde&_HwYLvG~8sE=KEB?8mVGMF6q?UA8~k{=r24MozQ4AMj5DR=)e6@*fTS zM+5)Sz<)IG9}WCR1ONYN;O{Q5tqaZX^`berrz-&AKfID3{^MOq(FXuIRc+vToy2Q_XUbpQ4~A%d*C+l-_J0OfY-sK=t?7t%a9g{&d(dRMOT%1V9gJ6PJ# z@G}|~cBctQ!>@nT+y4b8{=im$!FfNhJJ?W-M)Nxj-?je-Z1oS=*$Mrl-yh{i5OmGf z1p=a7FVPNm0199T&;qFbUuZ7=L8Asx1JGieANrzwr&c6pFekjcDiuk z!o{DiUHXYuZeG25`5N6#dV0E>baV{2*qIp^S()hQZr{7j%E58x&K(A3E^aPPZg$Q) zoIjYHq22n^#h-3mx^#n+k&cn`UoNM=1L!WD`TZQ_+!;E+S-Lal=+2xr0yt=@KXc(n zocd=ubN1Z%pDtavc$wC0_cP$^nR92)pS|$Y`ODX7AKFmSn(1gyL4Qx2;n5{VE(1%Z z`x0*GUrQtnql<6x$!WYV>ZPnRbMx@>OUtTSS=+{DN~sy4USU5r^xOu4AvW%>gJa?{ zrZ!~MH9cP9ODCsk{jkymID76Ng!oH87cSD;B70cN=lP~?)<$A^x}^U z+&(feTK*dSzGt0FLaJzz>AvJeZfU~}RUWI;VZb#S%d>Rn=m08!>AQbE;J*qUGrW}G zw$Zz&p7Yvf_HJt%orL=8iN#>WatNu;|3={c`C?y#DVhdVm;i zaIDRhIMpg}#%Bpq^lQG@<+J|czpXcG2;O=2IZZ#$M(x$vG$RSV=od5ATnY3btmu7S zaE7Ig)MLzlQSbj#5ihG>W?|xqzX11p1M&R1^-4$Kr^v@inoy>nR_`Zvkc`&usH5&n zq(c)b!*b?$9u+Lu%stJi-Q^RQgD$OcyqVLI7+sidKbIsATR-@UOMrTq^Ji=rO zp#`M49%I8AF2tL}@Cmeq=o!7HzxV6^Q{n%C*#&L7dvm`O+%vYov;P+2d_|7FO z>8sI`fm^45m$3Px3Ftoe!C2v8OEUxWN{4;2@`H_vTm4iih3HHYe87kaf5V$nnJMV* z)^6MwlD*y>y;;U_(;(Nf zRiGvZ*4b+i2~L+04-QROe*iq-DljHWPPNG9gjd<+w9g{H9SKOc*=J|N5I)3&F6)cB z#kPyjh7>wAG-i*kp}{TE%Gst;<1PX%@Z|{Uo_ytkJEwrlh0F07Zk=~-J06VXop|px z%%P8OY-v~L+ULNarB#GTU+LURJtc_}W~ztJ@|p~P6;rd7r;~xZ5T^0l{?d9&bP+?m zLp*msi;zew!&TMzw>;N=tOoy%LjM9gdfDtVb8a3M%Y#)FC{_O!=2xv$D+mdXS?G}N zYcQ=5dd8vb zt?dzq{guJZ$$k&L#+?sRJfVU4ll6B7{FPmN-O_tzyjx@*?%$%UPXJwn=9&XA$$@O$ zG_?Hf#9Ua3+xZmmHT@J&6?9@3w9s=32uj!-iDZj9sk3NbtVA}4`?Y%+uPpibQI%}L zfs*9;nOTCsF{eg)X5^gEsEqJP@_tE_mAwXIV<)I0^n@%b;u@HC)SrXc9N@q>z=)j8 zMDL_Vf^bDgQ5u@Usau`^S=t8D=>?nuKJ}B{-m-&ZR%foZKkMm}zlY;{Rj=F8@O~%( z=DPbbA(N?Lr9BIA`^hOlA@?Jhg}UWu-THokYj$Z>A7-bB3&^AFw~B>LWSCvyvwxkr zmF@JcGqGX(%Ob&C1ttz|68i%00ou;aXYOq)it^e{+YLBk$b16RZ&~|Ml;4l8*pntv z%K7^B-+j%QC71dRPXV4u)n>*+cq)FLYW765^pHOBsjYq&}=+>(w`)N(BTv`rr}Fp0Z*Fgv&-1BtcZ1 zzd}Uz6va_M(VuR1&zW(QEDp9u%K5BZAUf74_N3ND>J99qtQanN!LVa~q@?MzGDIXQ z{?;v%r33D$CobV|0^Mz|oNO*}y3km*gb^`bT{Yf2kIKtxR(MyLVdybGlbqu#rFN72 zvzC(uq|6878N4`MyW6B}arsaiUkQsP*ueEdmmSAL(sFPP7=ti{V6`=snPl5ie4daN zH|*IU8sez+W|@Pcro@6K@6fx5z73Lc`t&KF*OQ-wo+^kepQJLK0^D~fEfz7z0b~RS z>vgoh+Y;kMVXv@nXl-F_x(u$wSu>9=Q^3zNtZzy$Zs{u)ZnMb0k4@%`57Ta*ql?-{?V+RxAVnEivV~}Y)!RPnSnEEjp*+y%ig(UL2)}VSXQJR8- z%L#@D@~(~uWalfl!ev?CGBWkLs^^yoJk0GC22P2GVdWL)klmxt3y4;@ZX<;`t_fMk zm1Cj1>DQefj06dSy8KRbNXx5=r+{nO0(}s=vH2T%F{1`3@zI&B`Ia51*800G6o@(m?S^R?%%2#sP`MbPaPOBq(;q350yR-p_aRn7Nm_V}_*5dIfR zC@us;Mllf=2Z+Z^T%5h3o3nj}H?rE!H#a-CAop9MuZR-ef)KG_0CUVK7sS6+bL=Qa z>TD95>j)%^v*q6UwyEBv>vN#!dJ1Se1sIc6eC;o`@a0R;%k-etUN6$HJxs=9F(S>`10QrdxUScm1`5YLz4rw2xY9aw~42RVMX7z zdPDRdekxg9N?P3t71JJ)9G!W%>>E)&9lW7*4ZP4;yW_H7^75#?Q{VbYc`l2lj!40* zAXc)bEP!$P5In|P?{B~7(dCjYNhoYqq~I~bm9rd(-C2t^N>fV4e46RD%mTqDz7)ig zgbw`V>?=ZrmmP=Kubcu>pU!IzAU2|SSFNOCr>2k9pj8!x{NBCIzG#JLmXI>J#IaB% z-|3TMv0jsC#nOVs18h@g2bkENAk<-HWfV~!8YFLb$6y+fIvyx^bVFqOeNcH<+0Iki z{F^hG{*^FsSUr4m9kg~lthaNhyHp*w?Ne5hWb`Z{Nl10*LGfkA7yq7-xcm!bh8uF0 z*mlfCH`rYopzGcOT9z4C^tRp4ynqT%BzaM1Iieedo;eK24tticO6*{f$bcjbd|P%O zr`yVOp&lXeO_h~TZW!i}eTAn6J2D}z60qtwwRWW}+;3{P+i?X5T$G}!Tm(BWQD1e+ zRarSJ9s>8jw^B=TW-B;jyqwer)U9%o5?a+>*HEq=8c_#MfCIBTE=W!dW+Ad>Jwm@i{^ zi8T;Atvz}`?wkSR<1#zq@Hk~tvD|1caVv*R$+W5ywh|z#2?!{ely(Z3{G>3Nv6Cyc zSv9ed($_dG%&6(UtQ4%WYF1Dij}1CPv$S^{z%oa!#b>4i&HZ@UEh@QdeU9y6Z-!tB zF8ikdx~*wmCyABO?;i3~waO(NpfE$Xgasv?N=(dmPA+?i&A=2kxrW}CK2!ZAe+)Wt zGI7V(PN}};i|dguS#I}aMabhg8=Z@(j{6|^T|%^o3v}hG@C$)|&!_|FUywdOCSI^L zHqZLGvpk+vyhA_?rB~%KJR6{kHeg_}D!?@$*Ja;G?ebPxKuOQnW{s#LIo@@glKfBP zXM<8!<%d%h$Fc>wWF0#OZZ}o{RkUl2ty3I%k5~6q4oVndHAn^p>Qup|xV0=DTm z=dspBZ&CX#|N4X*-pWCT`#~ZcO%Ws4Cu+pdJMg8z(#b7lJ{2+H`#15y>6xn!S%E6= z%5H7-^!LJ#uUA&!CJPJf(trn+0;ksD}MTKn{uDhlN%osl|HL~T2Y=d z2r*+}N;EPL&Kftm17dpGqGX|l*F@VhP6URq?phXljt-BqkF$kpR8Y6c(xxz|eheWG z6zMt~z#hArgg43#M5>fxEAFQNBGb&6Xv4zO6; z1(=t3UyITm{r4w^LQ@!~5Bks`Us;}Gt!?|cF{Id5u{;w{+%xa{zM8eho9w(6WSorZ zr&GX!la_Fc=7f}&^ja2FZ0BD8@IoKl@)-Tj$j1sE<#f`iWGmH42YP{S*(y2cTvCwE z#Wc(n%=A^WnMGuC6N_CfqYMd+<+nbyr#IsGE^S=?dCC9r$KWd9VXMw)mW~x;YfNzr zU7W=8*YvbR+`m%J2+;lZ@!pHuw4~^Ra{$)=Imf~zI`bGi`l}}wBwmAa*4Eh9D4-`2 z&sViQ%(g#x>@bjD2(~giUKl(Dz{l8@^Y=>R_QJ~`AQeBE(x8~aJN!<#oq%iQ#IPzU zea*gY$Ee3ce4nnn5vu z&o5qzmb?4l@pGGt>Sz}F5VdpnUOv|ZNS&8D|39$0lHks*v-(R7onSjxn6Z(0M9PwN zuHHcJ0&?DZCwb=slsZut5!3QhsqHC%V~--QB+aBh@z}}1Ua@CoGo%^Sn0yKlx-EoA zN+RaCn4~$ipj0;+JPfObO+t0zOB@XmgphpfGZY_d(PHHOuAX@^>7+uB(mt{3Jz>^2 zkiYGnrrT{DvD4~5bFiOQ-uG?QqYhc1Vh|A z%o}Sig_yhlJzqhy-+x$;(q}_s#_%?lU2>039Lc_Sp^%BI(|7V^&WhJhnY$GaUDy|l zuDrIrtOM^>KIlCKly0%+Lp%$qbR2b0XNIQA2Kx`#HF@1OLni%WOj~F9I(rJpH-crA zIBpZlIkU&Wl%%kwujVqNdZBa`?C{o{BLa$|GH>I&c>mDt`{1;JE=V$RH?OZiexzH? zS0JSGVeOM7+Y%{>#s`Sv_3FkXn_1`J_Z(qAKR9=mh3mh6qW{`@*6^(B`DiYy6c$Yg z|8E$g!QQnbd5g+>g4ZzNac5#mYgOah{RYjRJ zzuSTliFPtBoL5(!5e45zd~KwKDvgzN#&2K{t&a#s^3S>yyUdH57&IV2ah(3Q-c;%8 zf+m!%eSO&&%Pc0w=U^PDUFhr2fe^sx`AwuBc?6Z~%^Vue29-tkQ37=WCQ3B#GboEd z{ExGdl3z9*>*gNYhVZCITo zw9R|yuI7IUoZ`*W&GlF}wr%q$h6>IG%Jeq7s`sH(lfF30t0m5Xt|)eA@QDxG`pOhL z7MZ)upl9h$CKr|T4G3md6Lt8cMbgYhqyh1=xlxOGMoDzR~%>iBb9 ztlYo+DW8t|<;OM;9^(K2iF0=)?w_a42hV?V_%mI0;Yrn5|KAI^1>e9AbOPza8n%$xmN%69FAw2pLt+0SFUH(Tl z4F94f0?xnV4x>*nyzu$GU~!I`a8?&%Qo!1^a^ClK(uiuiB=g<~Uk?r+ojF5{4>*(E zPaG*9)1syiC1y7%Ql)l$i5}Z1a8X@3zQ1o^)#Kq({EmzBzWl7F-qYQ8*&l}WOXGdL zK2t2-Zlfr@AbcMv@J&Hl%)U-(b&7#VV!Td`uis<&R z6nwyQRhEg5MV`OeO#EVvwhwMavwAFiD!KSeeO^YV8_?L%%&<#}z+ce3BQ0z7EWSJv zC{^38#{dCh8*VToYE~n*OKVcDdfB{N63XooH9Z=95-)Kyq3ER?d)>DC=&L+I8-$&GUCZn32JsXee@?n*DqD`$@K*iR&g zM99>=-3oW7LOr`g4n^+cHC(XLw(}6eE5Y>^oGX19x6T*B8GhdL66$}oGu#;g0N10R z`L0D9zG;(4Go+Jv&cgmE&ixfX{Piq{s=;XDS@q}Ve))@8p3l1QIP9jx1-C1OpnLSK znWK3mF~jz1ac~RB!By|sl<3Hz-pGcP!?H>P^z})n$pm&n)Y!tbenoK?W$GwcUO@J7njmCaaoQp!d6Zb5m0jh5@A5pz><|tK z`}JD%pFfL#2AqA$u)(EaaF4#`LJW^-i8Is?tBO_lspl-qgxB%IMF{gDj4yq9;%nIM zv3XEri}ag~gIc7vg7;Kc$&ShQQ^1>SyU9DDPjvTAHakCh_EOf4XLAuBw>-2giuy6L zso4!9Po|9WzZUQeo`m(8Or}mpok-;loajW)$>mGRW(1_Uf8Ai^>(wwA+i?%6(Vw4- z*;3-TF{;#cYq7jKa;wMVa9FU6+@AppykMQ`iCSiX%wL&Jc)_6;I?22*{+1 zZmfaAoln@DE}2$X=#8u%Mo-N@o!O{WMrKZR9&-i>2XLdLz?A$9yQ7W{ub^pteV0^V zog+n3{QKxU=UulbpT(MPSXr;^bpd$k+VZC!O8I+3(U@GGYfqxLL`^McXNFEv2_zQ6 zcZwct;Y|6rvM9FUHfZ=y8NcG!0BJcDe)!Q zBQTv!Y%QEOcBjd@ z%&avfSbSKyw1R?2mOv*Yf^6LT+MmA-*$CeTwu_V?wTPXJO+%5i&46P1nb~5x8bH|q zSQ6lmHSM(5Eqi4y!l~EdCeUCCU z!&{Vcs~1(;FvBH|eIwy@T`i~QTd1g(5?#;Z454f;Mbqoe9R>GSpVdVmDg;ge`Oyod zJ>m%5cdc*j>bjaM*4_stp79+nTZkmf=m_Z;!_rp92c-fwSu8*I{A-K-k8~H2=SQ@y z%F<67*2U|97cA5-9Fr}Mu_{d&J|_?Pzur8Xx+HJSntGd=AQHK%~kKG*IL#{BY#P=;w@?P8nntD+rbn{Vx`*v-bd#m>p^ zv)<3qP-a6p?Ie?+si0fBIH*v6Jl{BvnmGmV z%C+1}0pe2?yZGc`okC$aoRrNkWtNN9>gtu(l?l;lT6E*y$Jn~k;r*t zUr^tXp8#x6xoFaT&NV^C$96xlS+N7%sMlL4!^^>z=Mptke{m<3vUH_kpp-PQv{do7 zwf#!mNj!6)>F$*sf(kA~`^uBbHN-t^fX3%t1Fq@7^NZ8mp{^kWd(HxNEDTM;x*QWsKlb1@|_tO|5#kgBAzBC4=h8rGtDr>>D;1a=St9l@8 z(xVvcb(%|;>%d~zf7Z&NkB3A11-B;PInCz|JA1+45rbgwrM4Na5iSFvFJYH#dR}#_ z8$yzNJ;Au-?}&*#3=a={*Cgc& zc_BB0XHC*Cx2MFWxtLac>XO7vatH-H7@cdM5`|ZxWd!13wy%shjJ>f_&nUmzPx5&emN#J%@6F zQK?o+oNm)cRR<;tRTZ3(_ME~B4{LtCeH8NRDL}k^KU4PIz%)yG)MmF!bGbstQBb_D zY|xpF{p;u2zek(`q+r6184BGk`%X>y`YwSg?Q5R5@TF*_dN;R{_x9J7Om&z7VAPQ& z>g-#ew;1>J={{;baQHrR_1>)GP-KW^`E6Gi~B#YSylgb%D9%dlC!mQVtZm zZ*qDo3_B*nNQq^by`U>_(S_wIaeJ2amRSF9H=qk;#?n+cEHuHT4CuI(YBaVnGg@GU zqP^lZI8=+=LG!^}luzbeM$4T$)N8MnN#p9W9c-hlnph+#mlJ)f{pNCS9V9L-2J>Ze zpo^@J+o`lydcM*(`}2HKDD910N<}kY&2WxID^YxRmaoq9?4+fQS}yR1h8d;!NZMbk z-QEt7S}Yzi@m?z8|5_?S|31U;ea5v+A`d^yncsf@jJx*Y^BIA2f-#qjGBgdagTK7C zm-vj=XfJMMkTW7?$b>+y!sWB34&stJ?C6ZFNtVt93~M4EGe?$&^4|9*Jhh z4Nh@vZJfZA3ma?Zr;qAxhCLKj{DsQDG%DWnZF!;8nM(E_)6`!37v3Oe;IR5Pr*6rc?-F0P5S+=?^b*Ycf0EDT9 zp*oVCg*Ab@Z)K%wLHfC*n9(^CUu6+I6}qqjNotsKaUKrRy0oa?o(lv;41zKazP8fW zc^YFC85rUk^L5ULvm49nguMI`5~g$Um*0NB_Vc-WFL?Q{Y^-uYu&!Y&s>gDd6LlxC zn(^ij3=ts$@c~!i)`G$WDK5J^wjatpOKQaCZQmP{NJMZd{A1s1`j>FoB&nLRIRrus zWPAG*IXdU3z=^9ORdCI6+^iQ0&2N~i@PNQ4E9y`_&Q%heu&y|s zEzP{PWsIX>6uSz>3k`DTOC(#P$Z5@mjpIK%a$fD1zRK~a2idTbDw=PuA#9(JmeTBY zr)Q+xo$|iVfQ2Bg+!|_>BD=vLAGZ5M$0d^9Wu>9O!Vz}yl_pGjr*TzkA5^FrXN#1V z2O;QV+)VQ=rIO8Vq_V40tF7LaS>-HK)1<)$bWB~xWZ$x`qoL%ko?3!+ficM>IS%Xa z2okLOu{^ee&1{Oc_SM)MXe`WSpsv?Ib8A?#E!begW+u8r*{*{j7Z5*YL z=&?zSiF!uEJhs=*zXN;@k+_F>!~OSp=zl=iJ?Dlqh% zeX{ElunW;|%KF`?vksD4 zpYhag&G>9u70#>i=zUCehG>VM^=?S) zcJO3>aFKIq5}XN1tQjzA^a5d$XVy0&pS9f4{=Ua{z+vW9Rh5~|c1sju+AXO%);k~f zp_=0{PG;JUM?pmYwn#^XC^;%)$Hgw*BjS;8t?gF-f)82U z{*4yKM-H0XRiQk%=?K=&X^Q4t`9M07SPD?5b3_Ak)*J+*?b3q0T6S+9Is#9b-%`O z9z@D&L=4s0iT|M(LxblB9ICq=x20oN1$FZB>DKiqtyPZT)&&hOEPA8KyjGaC@x8|b zxg9lMCz|At9hz)fAvj3?ZeRpRqc?ARxX%%a#tVgm;^J`DcQ)**t**9@yO-e<#xv@C zODH#tNTlSdHkug;~d#fl+Iq|S(de1Y% zqnbzzH^2WHVXs|4%pnw;Qk$>i?aRM+y??jpGKDXz2yGSYls^Pd^To%Q%^XF!W%W@# z2b9e0#ey>WAif=@L|NR)T4)u;UXQ)^*}(yun_CrAZCiP_Sf&`07?ZeQPfK(Rk2f|9 zde($hiC{02Z^ zd*fO`PyO4#nbca#x{&Ki2RoF7RZTA0kyXFJ?cwm9l2&(dy1EI}_7CS+TZ<)H+}<@Zx!F|CNCl~c0x^@h?vja% z#%05`BP%W(%)M7pa0QWgtTVx(H`5-e7c6Ut)#AIYp&@gmcdT6K$*h*@7YrkV2aHhP zzd4Ncm{duEXLmn=BK&O;D5} zLE|=Gy8XnFU4N*B`!NXU7Si>~>@OgcWN9#`cXK?lQ~DuedwWf0D=&GhBU(6GnDsX? z`r?lFFNa_}YHGY-DF%9cHa*~X#;=JN!~W?cVBGmaH+sP+cRHaDtLntg@&E%EHunqX z8_DLw`aL-0&Y_OhxyY77S~OMrog>YJPI6+$`y{6LxV#KcdrLciVwIE-+|d;iRoCBg z^;nugzv6p5K3|mFRjSG16Ny=o2^>CX8(qM=G;afm1J_*+r)PE2gCB3P8>)~wIcb@L zE7_vze#!-)en)pR`9i+f9?ipthP!(~m2mh7LA$TeOnZ1}+#uhO&e$Dehv$xkD~D|_ zSdm@q!rrWeC@dyrTRpTSS7g0!3BT12Z|}>@s1i!Z6}y?<+``8f+Ewjs*yT26&Br@% z$lf`&UqeolTXRr9zyYDM-CiY=kfhA&`jP8eIy!G<}5jp*WTnh3d=?< z9;;x+!{3vc)NbSpOKf*^h%gAz6JCO_RqAn#Iq<_U3C#Jh^Z2`#g2J}+xoWwWXl^g& zeXP!__y;9at}<}GVOvFof2;JDFr20>gE(E1i_%XoOwyq}PG}QnEsbEdc5i4l(I_V? zQ!cwC+}Xa6jC(SQ=&a5T&p_P?SmjuKXw})8k%McQ@LS!@uDATiA?l~)sY#~IJjNEP z*{Mtlh`4E1@4)-7<~jv@tgoY2JhfE)&9$Bt0AC#o&W@y|b z6Wd@W;a0F=VziuW$A_%@F1W^6;!>4u<$1W~A4M-Cllh^{mlb{7gm(-tW%90p>lnz0=uBuh&H!P^V_m1Cx}vK{qpt!eOV1vM36&5awcCoNcH z3I+yYcA+`2r7}@xh@OuDUhkcE*&m*KP+#u0y&mEWyPKfy;t^78)5{?ni0eTv4c)4=HJD(r!jiTBo3{i1IU)&6T@{IC|RUTGiKxLf>sZOv^_)9`1a z(1mGXp!veKrKOt!BfJf_)T_e~XOiq9YT#_kH$c=9oxf3^OX@XvsCP^* zfON40fuQ(|d_ur+{*xA^t!yMmt0QrtZ#Bm-)0UM!qVYZpN}vmfXOYHe`y6&v-0U@_ z3@3}~*~=fN7I0)$5z3^@a9ya1ssj7muBVQvI|__n7AWcu1WoJgC=yf5jUvA7-EQrd zX3g;K`?1}Y4{%DC5GV{Ict|^gG1;=no2|}+oL=R!14N{b`7-6(pDrU!|=4zFe95*i>j_)2GQvkDiZR*0XGnX?K#1}Y5|N9? z@TjR@f$<2cKK=b#Cch2-e+Vl6)_ndQj~ADE!OYd)EH%w8qlFB4O67Pei7R7)I&y% zM;~0Cstt+rzk+gc){srosOyPZkP?H7jFFNnJ4)C73hKlR$s2e9dy>o|zJ#$zWHmWn z@(UR}#{hY#yk)uZlbiEnD86EiO30V<9?I17AFUlcFz{}Xs`2X-I)I633Sr6$;S1#3 z1rm#?D&RqrD4W5jW2`4{VfnN8D;3*BggBnhxLG0%Y=g6q@f8lxN=y~a?$1C}=&szyPhwahWyn4I4} z1)epSn+*?NWK6J0K;HMICOcCYDQq$;u2U z=YUrEsA9ZP={=-o0`aN;hnG4+qAcFpUUvDNA~p5N5(8CP*=utXQ-g}i)kCxdt6Ew~ z6Nmnj%6|R<&pum}ADgystu>2=yXsRQN{>)VK@z+5aAr0LDQpuf!cDi?6SF$$m`in7 z)gX(ggjhe+^g4XwgEJZO<18P|n_@l%G6DOsG{=BdpXbQty@^xrWVo)|U$M%coyQ z4-iZcxo@&__G+Y-^QelY)H}>=re9{ApO0qOmc!$@a~a}wXPrOBMytQmj^p<~gLQi$ zQN`+nAz_C-OuoID(}XUX)Hz8R5yNu7`~753`+b(j1_fkTfJb&*-Y-L4f*+3%ufQR3 z#H^U`@Oay_!~lcLoIVOrl1}AqRc3AhgY@7_ zR+r1;@5Ze09RLqmbwo5pn(y^e7Wqrq%cpg+y*e*3wv6vDKa%cLNb8pz zvnS};5#JubG9sk(#mti?=H{0i>hT5q6!pz%CCU2k!RD#{&OvH<=k4{mt^oroq|Xci zL(i-UYK97z@LdqFQXGAolFjy{qb?MbJD>h+Sg9!DM7LTAasuBz{9z(xduX!55QLmx zRyJ%@YAJ{n()&bw%@uEo!@0&7``BBh#0}KyD#Q&iX<9*?#ttjXZA5bxyiN$qH#lWG zDCsIScjV11cYF$8?FWOBFceP$;s(ls)ohe=5^0ud>_e{^i#vu6g_9R*gE7dDAlC z=O+crp%BN0Ml)E4EjKj3tHc%1hU6&@Q?e!D(p{m`$uM~dYInw(j zg@9T@>*dkmE}Tij0xm{BqkGhsO(EH3I}xWOP3ohv={}hz!RqYa)PHeq0w(5$8NG_~ zfC<8QA`~<-K-gTh3o)6|^>^cl&rM%nYU2rHw5TkUS(=S?cA6J8RSYLJauGA`7~kMT zN{0nD?u@Ez2SBkCTY=YlQ|;1%q}|eQrNYK!Bq46;w_V0rR+L$XRw85ywqSv&m5Vx{ z%J%^|dc$NHqIN@a3eGLjU7A9K@8f_jnGgtS>98fll*6vX*fW;^WFgeE7*Ai^E+3|& z*fykk=||=5)z#(`4XeAw`1oX1RK$AI9tNFlc$8gmq`R~@uHec3P|fUfx+%eXap+Kf z%Z$1z4b+)8s3lFAnf7B56gZziYx#s;s)>?FjT=y$k*x8@rM7jnye5`W7Y*Z2qlOvn zCA=}Y>Ymg3$%+xRv--f&6!G=>rx{0ooz2W^HGUyk#p74Hb%m5VvE`MNde7C7_Z6i9 zXcKrGBUOQupz2RFbWbSbmq)t?2HKH3rI}6~EUO3^^_@3sC(G+I-B@LNr@BalF`+v* zXVy%rBGScFWZy<=-3WTGFW+t^9!X$>5~{LVNLuFPdgx6W&WzeE8Yo0k7u=ZbT|X6c z*M)oz4nC>tQ!*NFF-)bx58dY7vI(M2YDsme%#z=#t$UWyfiYYseTUZ918!89ELus^ zg$ERc#3bCTh$~SU%&v$$78abI9*A4jEa;ScLsS;iSS}Yh5(oQRZh9H5(z~^Q5JK%r zlBt6wSv}%HTeeY#9Ij@z*~zrO%*FqTy?!C%DIih(UdBJW-Rx}E?{S(J3@qu%dfv9S z#$zd}a|X{09q{1B7Qt9uT}!hk1fEbXE3W%L342)g<)%wOliDnyoHmx`kcH7Q3b%Wr zdI8&N^EH8BQ{~rRn>%X!2tYziEfFX@5jVfT5;yY(6n#fPe=EsCi>38*Q&kOGp-M4{ zi-qfUNx?*t!|O(VNFX=i>W2bK*W<)sJC>*9E6)wg;Rjl6Bo_aWn;=Qd|WW? zr>HF#f*4nqdFraycPfHgTU$>|OVZG*&5D~I9;|EnxaJ2->nHaW64MZFAtl(jgYA=Z1f~W8&~31Z zq;~VR7=0@?$)F|LDO%9_iEvU}+cv+7o1QZ@X(&Op4P^W{A2RuvL{5O)wnGG?7sjtZ zOsyY;6C(>k5;ASMOAbXGPXR{9r-1L{#}9)zZ>m7qNOCj#wX^=ddDF3TTNTRRqi%Sv z;y)!2@-+-fNyyEph)I<9I+|^L-*($yH$b$uY7r+KUs^=0(Id(2dW$(e(JNk2sGT1A z`bC!6FhVmfP36s6lel=#f>mPTLSv!p{8)T8*R62N2*G;#L6fU4*%t0r4-zr=^b6e$ z>-7p0+d2g&qjhS4ir7RWxGxxeIcM^5i6sYo?ym?$=}B^=>11vWrD@m)6>8^1)<4K_<(-@T0zgrK~6oy#QHj158KJO@1C%pdSwG_Sz)v?_EA*6XR@oO@V!zMhe1C% zl|mBgzRCXOwU1k?=x9=x|L5lWbW#3656TA@8Kw@zhD4N=K=Hj1xbh=si#E=pDc=EE zvCcjJ$`Hw^`4p9@X%0OR4_{2@c-07pGPz5mjZYgq9D=5%Wl=`(kDaW{_}n4 z@83WsBqqywv!QC|t^3>%Y(`$~Qe1jv9W=~j{UA0;4|-pto=d{kH=-u42*Z^8A+LS4 zQmr`1o^4)#c(cY+bOVB@em_;|ZkVc{nK-Xlxmq({Xw8J~K`w}8H{Y81 zPt0shTx9tg2UY9=mo0sj8i2}5m9{Wcz{dRQ4qcn6L%t)g*8TMY&7WziJh`f(HR|b6 zZShFmfFp7)7PuhNRQb(6^+}bEh`bEanq0*=O}de;e+<)}n$<< z-m>4|KQb__JyuyhRZzLn zer%^DB>nh@yH@f#|FYWYN z^pImzLfGN~DsaWw%eGziQr@wast^)n!YNaX87MhA-{}ZM)=YlC=B0Ol_Yx_=lh!~p z8(ZdBWxYTb3jz;rv%R9S1=0o|x7A%e%*Qq;Sy-?7vd*0XzAQW)>DS93r}`LHVoWpn z)ug`83iwaITu9#f=Dy>bQ^nxYX%QZH3b21 zK-26jigXf!veqx`;VvOTbke7J|Mx9NHfH||- zGS09f4cb-wCVjpZ#-=mGNm%|!{n5|mb2{LvYkX&&o`1^ec>d`d!vFE7lB?TGMXz-w zS42&1QtSkCt&=UBv)q_H7n5z3WPxL>)KsigpU8p*grFzyT&tnY6F(Ak%d%ip|Cy1s zlVzElSe@srFYN7|!=W%O`h=bZEW9cum`jL9(k# z2Y;YJBwGO+@_GfjLWU_a+QMzj-8W8Td%`HiEg83A=o)TL8~=hqvmO$G0J19Z+fuBP zKO74mMFoj<#z9SHFP^f0C@i&jsVWOSYX!q30#tK^MfXH`iE{GW!D%yc^ULl=Izn`dAbKbIM)VrS7qmy&4wsZqB8~w#+Vt#s$nN<^pf{0yZb)RbKd8D|Ih#DIOqG7I1bl+ z-Pe8HSNU9Y!~IjU^{RM&bPln}cs%t`_Kr-)C}DV|yHkI|BGQt?_;6Z3o9x z+cY=tk9$jBP2CR;1Z55f?0mN^qooRnf& zN(Lg$y7WfpvEGnMryH@(#O01$BzS$iJmB`+9Q&7{ElMNpq!w|^?>b%0pB>3_#sPG% z;~$^}+|u?Q6;A5bSXdjF<{6fj!vu(u(K7+-M?`sRk!C}fK)uOs$6k~FQT5d$o;GcQ zEMds{Wag7irzGJVVmO?A81Rh>x6&*syE%q9Nby0fLgf9XMQ@WQN{UBcffkXLap@3) zm7E&^Tv(smk@ZPnxu`VLmrxC741y>AQGj}K`NIXGoSx1roo)2hYxeK|`1POI-T(Wk za|L$w@QT*WiknP4j1m&I0>6IfeH>9l6R~#{ooP$!bCXe1?8D2%~j$=eZr)570T0sJe!?-p9c1l{PK0T zzVc9*V@-a$EC#_>SiR4{U#~W(#8czm$ax5uq&VNk+lESK%mYl{s8Ub*^|meV^*?i3 zq`*}2KgaZfRYVJ1opTc`Zyy{ytq1Pm(xlI$yBiuQ+IfpY+d`V}(Tpb4!eiM!L$}{XUCv>^9&I zX{&k=2lYuq6CuG(YKP7v)@fSBG;ZPkeZOhzwNvPBk8Wg|F7ZiwfsSjzQ!MI!u7Bma zNUegrFuh{xDxc!#L(khy*}C^#3cxnx%zg#g#KgY*O%W@{W9a?b4K?@M9WqgQ-j6Q4EOS^j(AH_V){LVjd^R|q))XhJ-*(_V5YjSS@wZod#x@)M3i6ZRQotnbi8Oo zQs0{AkNr%d-mp?>x#tQ~z3WIEH)>g*Ksu6cMjlmWL9SKK0xOZHC^BMbejLi-R_Z0` zF#a^MwRtp8aeGmof>=L&mIv*K577ndgAv)X~xRVIsgL-yl1k!$YNVonXr@!Nm{hovT`tq2A(4O+vYKSy5+^wDw8{81Ol@w_{ zRI5|q$@Yy3P1$tc?FkcqbuhPi*gVfX{KyVFIbpd>DqZlDKNw8)kaGqtz2f0}xY&*K zSwC*z8D`DV$c&^guDWBx3yA$RgWR{7%Ddh=w(0I zzxbEVqw2E_J-gX`SIv8k(;O-|eJ_Z;3rnZptP7%H(|HnT`fPJhEwmNFv?why2|Y7J z8 zHK=O|KO&`e(o#=h%VV?6kbEpRUCsE$AXiHNh8)jd!p0nwU>IU#Un>~B)TGRC8r6$ zybja($ON?1U5)$WHe!81q8gxCjd!$irY7Qi`>37r+nJmD zSRn#zV4(?SWj-cSkEKkl|UW{I~s!aNmVtgC8)5kjz1=PGB9@_*kEVY-X&PlXVOJp z+Om#<1>%ez^G2x)d~%)ay~Z6}4UJ1Suhy_Yn$Jqj^Yi+4XsAUG$ogY6@<7_1bl*_U z+Mq$Vj9yG2fBR!4(DJNpel_-gXjZA{-cY~zMFJ?8{fX)~<((HQf$wip0iRc>s8_ER z>4;&4BE5*zcSVQujK$(4ib-z0g)Oyk28akPc~6|AlV&`@$~KMgm>d&am2VIcG{(6u z7Z1j!5|R0PuZG;l!<+{QxyV0v#yS4aiL`TSYVCLeYjrhH}1?v{0e#mRsMf90!7GA@bAwW)|H*?zn~CwX^kgcD%+AIoZAN>_j<=15`kCUAHds2f{W==ZY31 z`X|ri?7}_zf<-m0$K;5*CZDoB@dBga`{Bcw+(+&B%)AUz;QXlD3|E+qDQe39K8vSS z+&6Pn35cBcqO&w(hU;^B4VOx~SGFb8*y63f@whoMfzU*Qi?U#G3) zw0o5Fl5~ZPTX5!0>kX=BB`$sGEne09_NjC36@xd_9zN%}`txs0S6Fzd-sr{9CI73I zibpI?@b#5yA!;>zi-Q;TOyIYexDNVE`%m}*ihhx zXo-bQN4#4)Y`D=amzNFvKF4^>YCIsr^b?Lz;{?Tv^$pryA&fWWK$aEr?vkr9=+=Iy zLbT7yzHeJVP*1!cc(1~#f*=<~tR7q#-R#}&|MRRz)z-5&)BI}mZ~xPML3Q=(Prus# z^effr`!`g|+Z=&6fA3N6dKDldJJ7LnRdASQCv$6n9jW*yzeNT(Re&{H=% zbs=MT%GfC#)@nN0TK))LzWl-ZloJ1BAIENIq;e5wSfhxPUt*p)U+C(-&A+N-3O~+` zQo^@sifl&ASgA~yvi^uBmik5-g41)Hz*B+y>`ulesd<7KqEM$rvUiD_2&p97N5L`7 z+{b0aDo0bOe>_iC%r(ZR=iO|Pb*#Li&iOckGo3N*hEO%%rwZF&)8e?U+GpNO=KJN^ zdnYQBLRB%0?o@RPH}GFjeoZ`|sA`N(NQS~9r=OUk7sBeUJ-e64Mg>eXrV)HLm2vClH2 z6WZmufzD?8u^)|BXLb2bEiFQEhTGU&y9lsknBDl&9k~|1)BV7p)_OZWyDOGgK);w|s^Q}P zq|da9YkKgT4O%w2@|xpB7g3~9Leq^^gJ*OmmS359HYnUdAdH^7a|h8pH9WT@%F^lj zjmpn33Q2roY9q%@vRvLjSaOQDB$nTLrC6UV+!WDPdd(sE)z$yE1N(peufe5$*&k;`^yQ^nz|NFN zpZ%tzUD(TuqtK;y>;8NNxWHGpe{2HGNE_cdhHM{vWzGRNAz^ zM_~1?r(Ex@4WNxY2^}s z9h>{;Nwqob+)}z@SFXfn z-lj6usJWh_uwR_(qknR|gX`-goHU0V*G_^@U`pz@Hhvo*tb{-%{Mec1`uG--b(ut0-5kaa`}5|&ii97}ED-s@4RecuLgaHOyVqBi!wr>^{ZIRYgJe@j zEhuNaj0J7Jp78bH*X*PJmc^B)v>H^`=T&*E;Nk+^=Q5^GDMA;?4@){WiT`N@ z_!9qK0l|M(pcGhvidoG+34;r!*5Vjc6SfxpAgGt;r6pm*s3WkU@cVC6 zUq+w1wT>?g2mr+q7UvBVKJ$prh7I;(GIs`srNxRpJ4d zmPRmXlgHeq$W-&46D3LA35Rc_OAmApJwO?@6b4>MpCCdM7v}@FRx#Uq84q1&Q5AVM%M4;739G!C9PvW*M*^VdZzW zDOWh2ssHki7*eBYUp;;H4e)*ct&hJtwaiT+nB%*z z9BwZPT-umpvrL>Fu6mqR5ok8L_&5@7QBIcT*ri!uH@Fp!$z$AwWn2oI{Xc{qnu5N# z)bC~+Wl8da<+)8$$do%SRE|A2H(_6io&EzN-T4`K-99qip6HTjL0<>9Q(MsaKd#9FOjSIq67o%1-WNmaw>Bt*WzqjExkRN+q z>KQfy^ivvgbTos26ScvK_1s#S9kwWJ9r861;#n{@xx6DNLI%Xl?C{Qk_)8W42eDMz zf6sizE)6C#~`?Z-EBq zte7wWJOJ9EW$yS`43%=@mn5yf^a6m&T6d_uu;4U@T;aKiRRVU{K~-K++&UM2tr1cI@G}Q1+Tx%@~{B&#wYs39A}cf4?`fKLIk>|CUZ)|2>JTIPL#ar5E@A zL#3HRkf_tS!`#I3&w1UeGn~MJsMrG$@KUusgy+~m+;Q#bf414^f<{BlNH0eef-xDF&>#P7aRDy1e5&i8Od*_8F;4_CU=<~eIXuDMVpg`bfcfCq_I5ZZy>wCx zem=oAD9)&ytDMxGDb9Ti$kWbk$*79TGXe085<(TTS-?)Y`~LS!DF85CF0Wr7{0O8= zx`R|D9^AwkaX&P9dlMH2f03l41hh+t8gwWRoyNfmd+?3->=IaJnkhMe)ece?KZymb z_Se9%RhLVv?Pk<&9_oZCC?J6bzl_Q7JH6sjAE_`cjIp>!C&>Bc65;Xhi2Vm+z;Mrl z&8^X2RhiPi8nfweiSVd#`EbB%+`RM}o%%Zda#dzc0ar!o_IEpyo9Xz9O|?f@E43xL=a=ihUjC-E zNk1eMa25W3mxoK;1+dzW{Q#@|5TGTvY1_!r-RcmShOF2(yJd@3yIjzNy0%qF;JKwc z92a@#)|Xz1!a(7Gt?qd10FDfpl2_&q%@Vfue`Arae!2dJHeE}#wkt^KEuy-X2D zwoKi2x8GXFOAsM~xi>m(Qv}{=H*@jYcYo!tZEDjY!u@Fu24fv`(6<{X#zo(#Fx8XR z7bbwINfd40k&pG6UJ?~=$HZ3O>pcwWNvZyLMro=XeoCq8S;A?`eW<+osU4%AZo%OA zCtVtbE-l|^ibt3CD(%0qBtP)~AXrOJO`nhL-caGX+xzaTF^Xq%g(Ed_6mT4@6I*95 z9mt%&u7lsGIDymj%h*ZQ4!Wyb^z_R`<)FU;-LbXhr3?9FJx2v_Ap-z90q3O$^UrQr z{qDic{Nuqm+m38@nY*eL-Agy8`fek>vq+KvG){4ZgYjcpym;tG)vr&V2*j=$1IMbo z&hbY;LrO_uX~!Y574ClUQqd3p?2EatkA7ZV+un=fgr3U;Ux#+H`x$RH2x(RHgxRGyTxe=&YM4?t9*hR*fyCM~)pY~dmowAyP3H_JK1donnjefd zoR^>I`9K+qN+j8Hq*-elg0~?sBjc1K;P}J8=u8oxzqeZU>_@2HZS@h$=8ijsU1mIix!uIQ!_vtU+ zoUPsH1-l+EiM|_0JNxmElXbeSh>Jm+dR9=u->g1)_3M?Jn)4$YPRcJWYm!6VcYco8 ze_;Uq50_o%iq;QF##gGpMjJ!k*1dUUUAJyrs5?Cr&QEvixpY5U;(xj<*cqK1eLrDH z3zO^yM&Yw}8YtEYqmqn%PIoQCUQ;sawTGL5GsbteERSi=Td3c!l6`#7yQ!4&6%J=R zfh)?N!vJs9`I*Tcj|0Y^N995^)yL6~he}8k8`u)dW1hgXbP@-Nyk6w8)kH6S2 zX`ey%4tjV2HTyK*`H??O!NG7<;CAgOFoGemrvaemiJlFe@RugL4c|}s){onFNMmzL zw;wm10K~q=cv1QCKq%v`P}Rddp1*hImA6;zA@@{y;K{3M#gz45kfRXIPn{NN6yK)q zIr4Dx7h(6l08}8N%J;N;bzxLM)FT_$eQZL6!#aCD?gi{07LTeIuVn59)lZy`xN(j6 z_J(XPHL50qLT{goKGyq_|3hHT>j4ez3T#zIlbBw`&r{KBrHl zM;2-ft(H>w4Z@VP$s#$LaXR_|x)fIH+t`hX9jhhJf}Em87`FM|lBZKSs@A4x!qsv~ zV|dFYu!bN@aUPA5wEC2$g%QFxf}C`XOa@(D(Rdyr%#ptbU+@9SDpy-t&nkL`ZT4th zM4F94dmYPCLmAfxVf)?lh$R}P^%FVIm~6hM_UU2BHjNo_&{j+vfEBP6K^E6w48 zZxkm3sn0rr=pxqy&usd52kefAYeLxi*0x(V#^mjkr3ZiZ;JuNVB5{((z>+IQ+rHZJ zvDorPY3l|m^u23+`kEGqRDgy;AnZ!&8^dYp_q$O&!)ZZ5tSogsRcl-$2IGl*>|~(+ zsac(_#;&Uu(I|!0rRfBHGT!*KBiQ*^azR1$ZS3sUX~s%$llJf~P;+c@N2Mt7a1ZdH*mG584T0l* z4eXg~z6rO0{*e&{I3ky!2@F}M$FQ6~@@AI#)n9mNX{ijTLe;cVvj9iu4_@%Y#iUe` z4l3(Nl^09^0$Jzf;k~SBI-xa7Ig^e1C)W_$C8Srz!|3BO3S%Qziubd5((vk7mNSl@ z+#{)FBX@sC%``U0aK-lGR!P$c`bgSP_=5^?am()V;ymkbE!O5wkHWA6W^dVd*@a?plPxB^xbmo7gY*;)&5r_cQoXL2-w7~d1f zH!5zxsP9^2exst;0r3Ge=E)M%>Pk*-5uf9|huXT?SNpUPd73qI=RW#&eT-{4nX9X7 z&AQjZMoq(AKxYEze?@5s9)>bA@V9lo%sG<$QH0lhxoK9w@`?>EPdk9SG zKK+t&Fc0R|hfYjR!|QacVoP;AGqRPudr#)<$A&&9T5o41ro`Aq40;+FiVdL?mpufC6?Wu*G_KPefy1ha`zQUCBe<1bttFU1jq8q7t?-Ths1J#eYhqwOaBz&2#Sr9yDAn4BWJu1CZUsAKi>sVTA>(Fcia1WaLXW8R2%TL4Z;197`;(U)WmnsW~V2 ziG42OTpaD`LNIa0OX=9UlyR9x-l7G_CJ_-)MsJwt{($jt-37WVuW5igu5t_hS#+9| zDp71iUd}KkPFwYx14r=5mrn4+GcTb2=b6{ZMq)*E&SbE0=ab5P9KtuprM2xZnn6{4 zS5T(tDo}J!>gSBzKXKQT237vHfv554`w-{+7;qeeabWn?L4XZO+3U? zU{)B4HsP!D)I0+oBsGcKF*Injkd+?Y1W64-=5ur42QsbG$ZMYG18+k;Rg-NZVDlYK zPS4N6GbBm-NBx(@LK)G1zNd|2*s&pcXZR{r_oMjR z+z{FnJ!j>#bu8oy@!>qtg#*5T78Lx!?dz;qZ+#oQ)kv_M+f09D$}e)%8CyQ~yQ}Hbx(T z^@Zsr^~1K_F_2^VvB6d=A0qPTWB_cg&ZRYoKRToPl0BG{-8%eayn52ddaOjHMcOxS z5jRa9z@kqp=kC1xB2tgr)Zaq^dDW+N%|omLk3UBPq$7l>FSY$G50#h%BNNSwHy?fhj4n5o*bi?nU;Zy2fR9^v z^-Ii60H*@nM!Y(n+_V>a|KKCtD;){j(^sIBoAzC=B}Q zX`F@*1b-L|B-I9lp**WaOQaB{^6h4yr%c`%6uPSBK)Pgq=C4A<$YksDEhfCOsCBOw zU*XT{_1r#`B)uiLD)C6lp~Ityhjd?l>I4Bb4BKbZ?d(lkht09lD%jbW6(H}g6Ignb zldl{Ok@4KPot|Cq7b?&%ZQYo*;Rc6cMh(QWV|%oDPlA(XD+3U*uDPEBo==nW5$GDu z-NSSVG;5bF(|m1i+>VK%W)hU~`GCG&l92X?ugKCHk}m{>t8`#!s%~cLZra~~Ggtz{ znIcd?E8*aO?_)QPvf^;SoyFu}Oz^~C*VpMYG-&DYWA-*&{g6;sV}~bp^run+zBCQY z)-x}ek8Sx`y45j9Y@`aif#QPbQEySeRC;^`sO?(qvQf-C`C#0Iq=cbUC9P zTBw&PC=Cem1Do}yqj-!nq8^aH67O-yxO5J%**uAH-LTSde4VWp00=nBV|@*q4UzvY z?YaFXWe$H)T-o_losj}7G z5-Sjs1CSxK=d2(eC}jtR{t^v&07)NeLoL&YC(k0nqHsF%IgMkl`vipfPofo&)OANLhgUxp>aHge_ zhUwRWoB+?VjB|ypZlw#2TGn1F>m}LjM;Qk?;E#_(*(?G>X@-ERC;MSa>U0kZub~5_MSDpZgZ^7%6bmu zE%vq;K~~b}_Nq%W1GyqH0zPdxIGqw0jgbs@1_il+tXFsI= zM!m>H*WF>1k`$LE#|Y4FBR+Ifo4%EZ^nO7neyxWqUc@n7anRtIBa`n2DqD;jAb^z*gY?j@u>s{#>2-PX;mRCA9SlFrJ zX1@`}wmQW>`f#fhPVQdP8}?Z+u1H;iLLXQ^-0d*>BWz?8l)RjWkUNyFT3w--p7dyJ z*5p_#$IhB>9X0i{zsVM)KFcZ9(Uu*J)@e(&O5JD?drw^{JP7h9f6?;=RG6TfNXE!A_)|D5L^{BZFsABMSz&u5qjD{Mn|~f zt+9)ejJ-znxjx?LOJWkh2Er(J2|88${Pf?Y^3CiyW4pIlO>Qcgl&<3)73C^)q53=WSiR9DuxQ zss`w~S6A03?YIJdBlkBVElgL=<<<1oOF;niD}XQVUbkG0lW}=+>!Ns{xgBD6oK<)( z0n_|&rbo99Sei4H`=d^emh!S07vq|xmmcj(`N>a69g#O&T>X4M11sdP0cCMTKD=BR z|J9Z)y^w6o0}l{ z<#gl*C>M03VaC<{k>LdFLDOqXi?Na_EG$xfjBxjz0hr~fF)|h8&byN_l1<>xkIDTy zMZ5=+R7$A$a(l9IPG^+gEx90cH}Ci5dM3F**Swg%zW#S{d!39u%jcbWBRlaja&9rF zN3|KX7b%7+(=na1ujh|e+8YTa&I(a(mgcLzWhfYipM<_PY>?vsP-6)fyb69>!{sSa zD@C{@xRYl|plH$XiQ6DH=1j67V2k~>Q&}-74&jrLH2XSmb)#K!Vz*3$O=D6Lq$~8K zAEWrSL4zT>r7g?Zf+5e?^f4FX_e+XN{R?IL8%dm|>i0)Vu=|wGy(DqSO}_wzJ5jI; z^7UE!RgO}#U5nD%I3V8IwTkVei9P_5!`1xNM%7zNdcJVD-A%2jo=06Sk=rM1M3ps! z`(d{@WTw+}IK%qHj5Kg#{bCsK`wTel;1JCLgDA%(C2>O^;A;Xg9E7 zg*pDhJbjBYko&x5AuOz-Su?`fYbA?ZM(~u;O_B6b+PMvhRA=c&KYQk#w$iKXw@rv< zW}lgq7zXGbU}9Puw%zy-?-Oy|h74$8Pw(E;lPKtjP3%f$bZh^P2wONPj5j74&3-UQ zsaQA-vqAVwQ+$0X!>qOIaUmnm&3Tp^&GB1WBa+{!s?Dt0 z)(BgPyp1R2m^gqHndlc-m-aQIfnri`RQZ!XsMD zcxK|uxB>4_FdiQt^D1rsz$%Z7>bVGeAmXL zc{#<9_VOnA2ke(?{{fHwFUIrAQ~F=n?X~dY0PyIRW7ocl~$_CgQL<;@t-N>dHCB10F>R1ZM&h*6V}+B13_+0h@NK z2=n%+m0)G_3__U2I!p||r35>uZkUU${OW@qpr`+se=1a>qKI@iq>VGoM-Dj3o=$%x z?dW)mJNiH_zt}m`8LRSO9WKwfF70+BAaq_y-O@^RPnknBGB-fk1`Vo_9FyzRV^)xr z9?voHUHLpZXjWeqljEQy@8ro&uAO2vn~~p)x6vZ`1&&peF?OJMTr`-Bl2hRw{1k6! zct?L)E{AKMd67zh@xYyG$C6==`Y+gNWv8gYoQFkXEA8U1lyo+M;(VkaO=KE`b`xqF zB07j4a|8|cS<{bGPWk*@>me5JN}UNh6BpC^#@LmP{6r~Mp7p**&5rthP)C7MQk*Vp zyU*ZZTHsz=pDJ0hjA%tpm&-}3TOnOIb#6*+Eek_);S1rxhDL7*aC~ri)=q9bK^Xl$ zB)qQb-mFVVJDErc3wb=ZzFFIuN)$53i7vK0<|zD@WZOo(#X`WWQsP@1=*C$q zNpRd4sS1#Ukk@jXN7&Z_%Sl?WcPGZOx1=BzXP9N4zZOjKT z!|A1kvt|Os?MBBL-{YOQg)E^3K}rF9dQ~LMya!JD{#bG|4hm(Kq&%nCb!YSP$UXgH z&h@+MSC_R@oVcwH0^f=S;T;Isd$cZ*ZVR$|6SS&CD@7y3)V5dy)itr=giH%Q4c-x>1 z!;F@J=%ua%cxH!W26B$6s>Z|hS*WADFW`6;5nvag&n{o3o95>`cE>2e@!ViiT6<1Q zEXI)J@+A9~wqG2`%*Fp36)Jm_Vk$H?psql0UlE$b3l`TP7A7!Y?Y2o zv2K*2jRnl~i{=si%z;N)cpHM+1%LEmB?LZAcT~hZ^Vy1HoI$2;V_;uv(9LB6f>rqm zUodY0@;jdEPMu7!pU3(RIPfJTGFvoSg9p!JdQWA?0m{ypHB-4N569i*D)OH7~>y>W_`mKq8 z?~T#LtO09{s%Dqm>Lz8BxMihE6uj0E-@Lec#KttotebL#IiCc3h0>3=PbmBByTu2C zON*gnjb$K2qiZt8SeqwHd$Br+|=H3qvc%T zs^~YW*z$#H5HQcAGcHIm3?F_jAL6nLOGl|7GeDziO3xKneU69rSVWaLbP21^8aUco zVKUD!qZeuW&2ECyxf3X90Q$OA>v^m+Mr8 z556`o;-W2z`!{3195iBg0-(fCvL!Q>=u66We1nTd3fS)9V_igYTrRhSVHYl16Zj2WT^dF zznXqnwcgm67+G&j9{a3`7M5xd3&v_%WW9r@c(MYHIqo8wx0&D%QST66}tvP&PXZgB^-ZLJw<_*)0)c%p_4W zH-bbz{A$Mwnk!EcU}cQCC#5qepdIlx>AxRG`h)Rhse-z<8fRFX#3_wHfA0xHGGaL{ zyTS{xSv0ufz+x^BP#hn4qT^vTpR_zL7aV*M&(!Gi8nm1*XNQNM zE6hsQKLQ$3B#p~0;ZmHTswTvo$&@H5IUfpxR`o?*He`j^Cz<$?Esrw$ZUhvN>%{R> zN*ysMS%0?%4tMVL*e^G*^S`?07iyj?`^o@kTs)h(s3{~|mq+V`9Vfp97YrL~AP zUhfNv2NcH^ASrSsSQ zY6DzU34Dt;LN?V``8t`xZ=#XXA&yM~6g&wISt%7%nSYkM3;jW2sj^=JR%yR};Xl zcCVtEW8Zb7yJXp)2RSi)SS__eEXShO)~A36x_W-JI@Q$5D=x`OqTQ=KjpIcimM{No z@N+?HE1k)QbcfPr1sijEaHK1amg4eRUuw!`SsZM|4}Ll|#X0w*(nbw-O+`dWX{au( zIchamRMIG-GS~MTRp+7ahpsU#1EHw&c{xfcr(op>= zY*4}c-tO*joN_vYPfzYlpb``@@Q%Q6GPf>u5K4bJUu>_64LYkqY6V}R&S>b)q+Dk0j+J zXZ^yV8uh6^7n6lt8b7P*b63rG_o*z?zq{OiM}oZAx5TRzz1XtDgr>Wxla{^N73<$7 zYB(1sjx|(v7^aEL(tUt>V*8x`K?@7d!;gQZW-wHY^zHk=v()STzuppmLV^AuRZg{#+YpJ3M`4QtsH<&-p9t~ocnHW zS}>7r^vvM7hEazccOrUgR}SHR)eNUN?o%}(3e0BD^RarKlx^h7IMN%#yPP&?yvd4rUqvjJ*)|`4-uj9*)D|d$uEh86_v+8Ae_oCP8=3KB=3_EJfBKd zhF+8*x!c(A&aIL|^G6Lp8EdHz=+W%z{7x{*qMH8lbvKk#YEnrdW}-SLGUtXa+%<|v zKx%}O_0!8h-TWT+bD&DfA6LVLZ8~(A%W$oKhQO|!Rr@)gS|`LyEHC-{=NL+=K?FwE zL^asT-@2YD)zy-u^kq&eM$kVR&yUhS$j1x?>X)EM7wJJWJpPNa^ZZylk8f1ZYeQ7) zllgMbp4RWqDhOt#z7M}73srNceP$0x{RZV&+7MfWH- z`#_X5ZFSvyF}`NDr(fky*oAW^G%q>;7%K3LXlE_8A-Qt_y-y!#9Z{~?#T$*#nlzl{N#h2) z4K2_o-_u9WGb)T8EP}g1F!*R}*7(}PdVOCY-#egb_xx6C-O3dBlMwwZc30rI%pgxx zIVcPXfO}4Zn+*g{aQ@G@h#hA8%m|@{T<`Rg!Rn?v&H(Z=vG#eDg+*U{qeAeJ$zYDQ z#ypKtF_I)xI5JXK1e793zVIKd+3*1qk%s!G3JO*%2h{{OL}~B*cTtRn*v>M@Ol;K6 z)l_;HxrmG^OS8$gRiXvX_Q)xJEcOzE?#n1VXh_I?t(on!CXT3_Z0b9|{aR*e6w_zE zG3(h-T|}(kKYunVGl3^yY=+{91vj!Wq}Yt-DBkUp<{{sWm6d{B4K@WhT=+sOI;78H z8p`4GjMpVj*OB*`xDY(ea*rlU&!e0_M7P)0B|4J8w{=CLODt}G^QM6D2LRS#IRB$} z@%a~Pw9#o>3omOpC{6?i+2F)dTAKM9AB3S4(f}S~j_!Mjxxb0!-qYvLu;;O-J@Wb~lLt}dJ>$)Gi;rR|GwxPf$d}!e zdM$9G#Ny`(_1{K2(Oc^nCwt{_d#3xIm)K#=SB8D`ar+iQev-|dp4pf0@<7VTb7zt~ zcG~9dF&<+~+p}cWRd`6G?2|W6H zGQ&Y#WYLxVVSh}K6VuiO)Z-%0TGkc8>kUlRUED_6%*p@?Pyr}_jloc(>3>lGqrVlP z^3yUfAQ-N))#0R6zdk$Ug8h1N<``PPJ_fJZoPzfi3hnFL88y5uLNN!(N+RziyYXvR zBV{~{T&IbBQf6ji1h?HP^l?&~>y~IkoeFekx;9l`+|{b`?h( zNG9AfrPWrq73J2{EgU&%)Bk*?L~J8YSc}r^Mcy$&i$IUe)whDL1xi}Z_+B6x z?KSE<0}d;a3x{+n-D=l(85WH8?2&vo5s+I!X^Wa7km;%NglBS`P<637mqR-0OzZuw z;9W>MeY6F}cQ(tzWI<58G{)({+#`F{RozPNB&b?FVT(KYHaM1W>(F67(}MfDEg1bN zE23Aj1aB?Jms{KprV;A|(|}f<6LJ>_xIVWsSAQTd1Vj5hY6z}V?x{?E;-Y>-O)^tSaN&S(Kq+Ha8SkS-(-KqMt7e z)JeE_S`9mm@|79PGPny*BA%c0?ypSFk6A`V1o!+p=(ak6PyAy3)M!Tl0O>FGrh?k+ zXCXXaecjzkrg7mr2Bd`<}z6GuAINtL0PlOSLkk zH?lQdN9;^XuVV~z8ABQd*yuKcF1W+|OwZX7W$n4WwTgzrZbGo-)!gR?jvRi)P_GoX zS@58&NZPycRsRk7D!xL21jRv6V)b>{>jV2d4Ofey9p;B^mqTlEQ*_(hE!(@Y@;DZE zSoJ6CWNBQ?IwLKhc|NPkeBC0WGcq9!XHB#r|NPZ#!3FOM@tY~)SRC+Y<4{F-a_(Ou z;NY#9LbA_ThHDT>`=M->FI>@XXI_Raki_FtTOceSO7z2t5ZIEJ}{^(Ycdvt+;oX9U|fZ zuU1a>5pJTn?*c$K(bCfHz4s;M2NmQ81#8~)CehF#5BPS}mdXcn6DL7>qy9>Zq|KL3 z;l{E_pisT4f3fY!jvQc<<5Oz}QE>|L>~3Qh$W1X<@H&L0sP8ln4FP1x(SZ za1Kocpm1;><}ZDtx{{RZ@( z&Dy<9{5na!W0Nrjx$@PX41vLK-TTT7jfZhFrlrPnpfF)AZCGvB(sjY9*IpOg;YR+> zL>d~JjT7ROY>cb4Y|-n~HZ@Jhu(J3$o*WBBwaGLd1FJ+(P56c#*>_*T93Pr;st{mz z5By~Xs<3m%4D%nHM(ta8;FcBYa^HzOm3aWVO93At49s6n}}e#b2_|v;r1~=XeQrZV43J|Gs@WOqBkU*~l(tK?Y1&}`wq(25Ue#%XDVX<^ z$&sOh4f27Ve=U0rHtkXupPu8X8lQ^mFr|=D{ithYDA}|a*_ZupzB21Z^q|~k$bArs z;K)_H6&zyrWoB^ne-(D#aZRLsyGPe`#ZFT|kX5Aj-a)AfB#}T8y3!$lbg6<3qy$ju zEeIGwD2bF1AQYu{gaqlZbO^mS(RbM0^L+OCoIU6LCo^+Tl1b(+bC>J)y~O|Lw zcKMV~MPBSiOMUAKd3{JBj_AovVZ58%;L?J^?M}laXp`&$Nnf)P`^Nl1zh5x%e1Jt! zsGGU_hKhYUCI;+c!}usuc>WGj+8b%lTbV&l-eE`jFmVixRBo7&OmPKEzEwoy`V8le zhyfg{LxQfSr;{BCRVO=CgB%5nV>zP>;8V$wHpN>ztLfzGl#NR$jq@1rzTKyEVO`rs zUhWIfBpJFG@%rHi-B?Zrb|je<8z&#bm$Oq%v+ ze5{DXTM6Jf&@`_=mIs?3&DPOJx=54)D$>R@RK!)h9<5Bb;Ruw{V~yNYsKVcH zHbBUDsRhqVAsR%G$T@;q@Lbc-QR-66_5P>jv>f&B=5KLzueYg-RG-`Z(rIa_9rCjWXrc!{ca(0Hn#|rN049|+Y^OVl5q4@ z@5~ESRC97b{%%?i(_kJZq9$rF3`{Wk)CK$D5!gn~w1BQc!#+!7mT|rkr)~{bIYKa) zjCV*Phy=Lp!^B?E{D&*bvmF@pgMJWH5X^OdYKdA_gL#nY0{u%au4f0pWQz1SOq)1k z2Q90uGVjif10^IOJeWbTH)Pl-2z}vv{W*gj=7*umgE=#rX;UhMLiY zw{TXz>EPF=mV9q$U;j2_d6Y`FSyN;OvD8TG0~ExODi9C5V{#6u1}`}AfbZHk8yO@K zHUs@!iJu$s^p`ZeS`BT;&_U0x*IvV@Metr5*?(WgA0MHcMCCaXewyz2-|KyRzk>m) z+!@?el#t;$y?19XyM^mw4Dd5nCZU$xEgsKdT-8>rdU?k);XbOr*DK#m(9PL8Q+$w;DtNLRfN>Tvs;WT4YY;KjJOM~R<2Nho}q_DaKU*8Zj8Z0B&V1@?~ zI|HEpon)}_%v_6@a84``cA~yApnMFEjMi4jeY)z1^!7$d0HEwl4f1|J;Yl>n_rt{E zAxOy?k5G7sF#yTPC>M6&i+mR6I%WM_i&Q*3d7rKyiknWB7b31(JGj-(Q`Ut-1APNl z*oT{OKDgcrY@nh9e8-A)GtV&bku;Zi7hqNN#te@Kd|Vk=TaYpV!z(Zbz=&m-?7YZV zEj`i(W`{qYi;E?y6WrAHCSJ-)r|Ovo9ISNq#QuBw;%1909Ym|)o#9c8hJD| zR4D+F6okIxsFf#rU;6@m`H`0Yp4^;0u9L*=2(%5tQ(#>2q9vuT$OX^27nXn6X}{6d zh4O5dKZHyVQmBiLH4coV0R&N~!q(_S|8|05WI3;g7IxUjeqvt<%q#ob$^Urb-S;9IFb2@iKIY;rE>mm$M za~Qz{?pS+?#c(k({{=iq;(#--l)2@PCtyZ*;PwxbBa40{nC@aszrDxuf5Wk9>7cKu zb|TF4fPwG%iqK=o?oxPo%<{3N&VxpofQ~pV4+e(Xp~DW10PsD$(2|0`UsmQ0bB{*D zbYhdl^ij>_R}$9gMt76L!ZE1$R6m0fNyh@qo9FJ*fdeum;CECv^aP(2P1*5rgNFuksFnC5?M zYX7ld&2marUF+d8?8NEvW+>Jhia~m-W$j)&taHmYh3S)Kx5{FE<3Ir*sbh1n7+Wdu z94f!gw11^aE_aRUs}hrwV^E6EY6DLd8B@*Ur+Xv2D$Q{J7L8bL~8n^6}$KHyI(<*2`H7}ys1g3IrFM-_?r()=4 ztzw2?2}zT(h>AB%$u%j+p3%{s{{!7hEmv)??DawJ5(~h)KGQ<}x(^M!C%HD>FD=)J zdCU`&R7A`gGz|0yG`F-lY;cG|0*?mTJjNns_ZF$+>JplT1Enf)Cd@H?d9~`!e&YzoUoWCTJ2NI}-`%c}O2oquNQF)|JxuEZ|3&g2J zU45O}Q_&>exFizA_mj@+*C5jI0ySu29*>4k_2M}3&czS2_ibV)a&J{Q)_5Hf`+f5}3={VxS zP|=OFZ)ogRFkf^G7_1}xla5Dup0#}qow5v57FBR_L$5h}A!2{hZRT8`R~{Sh;Sic6 z{o)Ibs1_z*pJji;fT-ZB1qP(#2i{%EzP8AU&>Fi+(i2|Z;G= z9l*h;v{<1~`2)=SHUDVs@@UuA{886885uq`&w_S$QBNzT&FTrl-n1Swi12nmc;mL8 zkMjd%S-bGC`(bvWJ#Tn~clP4*ljA|+J2?d~J;0hPz4W}zgExQX;8aTkOpCksSJ9C{dk4Zb?c8+nafZ1OGryU={~y*7i%Rq0d(YYk&#>~gtrsB zc%gCltM`1RLfmSN?!>`ay|Siu55$^qf`0#vjt|E-_uwS5?4@xm!BUBwH_;vMFsaS@ z5(~mCW9Ip0=iGe~orr3oMS<%>=?Y4ZMpDP34%CnIs)--w!@G&}+9G=k!~2{_u@Srn z$UrhGAPOPaB%|3Al_&2*58JlFf#W%KODSU0=d|phPhe2JuJn$63Ok``;-(%#xlF$Y z?8fhjo*5agO-*psZl-k^xi&Oo`MqpvrFJsRd{;&@zew;G<4T{}i}W-7u}@x*;iC>? zi2C~C3t#4QB=rfBJKo#V^7C1d0XTV|@n-*R%c8$IGPnrzpRuRo1&V{QF8=acCLu~< zg*(h-YQyJ>XC|p^lTikHV)Uji=_2QE@Yr$RmIUI$KF3x+esDrTx_gc>nT4079&`I@ zCH>AXya|?w^qswT;qbhOp#<>kZd**gLya!3(?+ahh~w_)4fX3nckAH6#E$8pCdKs8 z$`(r0_xX{!l!Cmzk-8Ya4l{#~#1IBgsW;Sz(>)9e@Mxr2g!ackH7Ln%F;>yOruGJw zq>!6fgTIkWRHjnuqGl^X>qwXPsZL0;=%80K2fUi;?JL7A$VPoXZZIMKc<>{X;ji)QM`lQILhe$ttTr~tWSv?g}% z3YyTLGM#frY@{##(@{bO2_CR|2qJ$NUy^%RN+}W=8|_jxHFB!#Ha79oD_BSqAFTmN zq!%O14Xe9*^q^mNT#J3din$p+Hc$f?i&CT{fR-i3e@xQPEnT3XAXc43UGKg`qoDYdhJHtv#SM#!2~i(B7nWi^PXhlC zBaf$fy$*<(uBsj-mL=0DGaLQSO!`tA8Dp%vi2ua36-_wCBxFu91 z^RxL+x+-a|gO#6jiaOYDdw}bVOw_jZhk@QTw$sFJ?wx)2Hk00>lU3+v< zp(=%J;UO3Bor8_=!_;pN-5nEarZ+Eo9q!U7D_{*)uzOGBc?l0Kj{qA1iiv+bWBw`_ zbU@hs-F%hSc-T_B}%lD z=l3sGsd6d?#yyfXH5I+C=v?ZRrm(Bp@#?!pj*e!p>>26ckehV{N6P>5%N{MI04RdZQFrvE)m;;|zi?9k4lJ2b^QA5QDjmH(_xY)MmS&d--s{|kQ`#)a7ST_u zTW7^_h~SNOD@Oc8wP&(PhJM@&*R~QvfHrBRXIpd?^EU3&Rl4N=i*o)aEspL=^$Eq{ z^c|+(>3$c~jEuWwVv&3JHq4IxkHTi7q+;x7n{@WZU;|9pOOJ5OWIJ(Lv}9uM8`kpR zAYUzHTPJaf3V^eem1pNF3PXa^0a8KYj;U7x{K*9&l^#9)hF(8q)A&bf;0j3xyKKwE zSg>SXJUK|;OKFlRBFSUY7`NS&(z5^ggS*}6wElTljC44`g;fJBK;8IE-~^SzE|K~W7p-@ zsWr~cB?-SlKF>6Gy;@5;AhgbpO-a-0&S=YZMCVRz(^fq-ZLU&o#<5@_QS6PAyj2gk zHrE9*qR-ej2L7b;HG3chOLb`3L#7}TBnOmwzPTOBP6%hCv)~`8MiYzNapxKv73+Gz zki)bwxu0~=C-}8454SCVz9#w`6JR6mchb#R>(HC(f#~RDV;x?=)8bru7`qsY74^M1 zI#>jfBHDX}{cm@O)XvnmoBXZS{=2gNwc$Ah{arusweB*PL8wVNAzy-81b(r7H*@#s z*}z^tcB)Ta*_pv%V#i&6rqQ^EMBAw0!5+CTJ%ZH%3Y1*CKlU?ZQ~~a)$-ayMJP{ZX z`Xfy@cVh|_YfOe+Hslisj?kK{A=L<9;sg%VkJuJ59bRkNeCmHQgZzR zCI`yN1#ieSsgQ4qeI*ta&r}VKDz`=&-(-r#{iM52Q*LTsU0D1vKbf+cbbbdwQN`{t zNq25HHmJL)UUd^O^P(jUgI_#wA`%3tWe+Q|z^Y7X?v3V2f(;hppPmYPTwp+=k)#%4 zolW>){-}QcQFT->{RU&So&3u7MnAzESk+Zg)&r>>2Vu}?Zfxd{S}2WkD6k6mdu@9CoURugsqLFbigL9)xtM8miC2kZPB1?01+hA2un+gYDYWky9!^Fx4^- zR*u_n9qN^@1?pdm3Q|5!Pijj6Ql5nwOhQcVZtMeQLyqlclkL>|+2M1!l9YhZ4jk`R zVt2I$j=52}s-#2gLh(!okL%tA_4M~|A4C6YpLtH*dCbJh`25{Ffp`2yn2mGwnBP$x z%a1?LW=gznZZ|uf*vxeGCG*u$;Vz_h3=C2wU z3vS1MYK^yA9E31g=))Q%`dP;)!Lc0ohRq(?m^&S=78c1OB=3<+U4A@HC8j=!%j^ zlb1tf*^!=^ZoH%4rv!GY9a!deK2HZF(OCe{3&~v1-R_r2<&)Z2ED`PxsM?a)=UY_@ zO5b=^v7_Ql4q-c{?`oB&FZ^5zER z?x^Cio(22SHz5i!!K7K*;W|s#nQ_y-j&c7h&>9RnAcr{Zt*mB{gMWg!*;B2s))#rS(%%d2Pw3!m6!a@FQZ) z1o=;o+07t(dl}{v4rrGLvN-qz5*S>-#kiI-@PmlNA?vw`EmHw_vG@%GobtI10Ho}rO5bm(X%i{;_ z;L-c9?&Y5)4q&M;+(vl*+Smp)fp0Yki0i9vh27YCI5m0f(|$rZCWMl)-~iqmizTvWe9jYqpOEc*^&1{<>L>Z(%i}r zDXy}qY0OOwz0YJ*GgKI~RBml1AnnqO8=R9ak_Eq)=wl2L1X1Plm-btVTr$oEfRmhZ zzvV!y3)&IP^8#M-&GNhUi4wogt|<&>{7T+wg4t!|^%?|J5#b-jMwZyh5zm2#SFpGFeIjS+=AkMgg5&WwQh6vuw_kXB*a$ZOqpmD= zOL`i-Zz0MSuc(RLadp~eHZG8!C1QIG?eR!^)9h6ms1^%NwYi*b$m-vZl$$fXC2`TI zgD256jz{9W=e2v{+;_tNY8}#F&;iVsw{52bpP%-8@QVA~m&A*|zs`7$dT#sq|Ev-J zqaFF@F1 z$n^MZS$-3Z zdNhAA?u#&G1c0C09IB)S0wJ34nmfLhaBtwO)}!77$l^%7Mh-(YT`OA1}rT(K>PEulXI0gFFZZ47KmvH1@BsNFZJ(9 zfrKeHtoG6+rhfg=LS3Q-_*~G7>@OOl*QPQ4T~e2lxeX05*~iL688_qHS>=+g{Rr}^ z@6$Rj{3F9G-MRTVw6x(v^G^oGAkwf5JTgU=4Y*SKy1^g^+6q`}E!`rR1rnq*7^G z8aFT+Us|LJv}Y)iuBI1Q=X=FHku+%c@>?9?9Lj-Q%03QGtxP}WI11t&FDDq2r7{zH zd|wLQps|k<>li1fuy2bb z6E|1S?)Z<3BQ!bY?3vBs=m&Quv{sd>6!KjgJNg!<96M zn6mWV z-3q2yvBktDUcMh%;xBpA7on+;&51y}TMp&FNzHW7lo4-i~&L7)j6M&M08N`3-dc?wb*YDbJWE9;sIHcEO$&ee7)P z0@W?x2#%>TD)q!?W)RAEm@A;p?G*6Z%&(lCb5{8lOk9&s4*_}pq`NZ`6D#*4hhjmc zKypyiBKI1X@~;Q(xtkC7W8tB$;5m!{B}v-uIvgZD;PYm5WzjL!n`)?HeQQDb8jbWZ zJF==#XZe6V7Jq4I@zQFmY1}PGjsFK=SoiUL#$=!dNIeH8p-(!XpTE4d61=PMJm&FZ zPgZf%`}k8A9|KcO|5_pbm&B9#D5&jY$y1UHp}K(m$wj_o!1P4imK7o{9`hJQ4>-)6 zv%o5|Bx|!tukx_G9_IKIW87^3pX?y>O3){_bG!EeN;~lR%`Xy63Z?~!conQ+uehXMX`U&%c~@|AkKKxgZqixAU!?N7HZs literal 0 HcmV?d00001 diff --git a/README.md b/README.md new file mode 100644 index 0000000..632fa7e --- /dev/null +++ b/README.md @@ -0,0 +1,35 @@ +# Adrenaline BOF Kit + + +*This repository contains BOFs (Beacon Object Files) designed for various red team and offensive security engagements. The end goal is to have a toolkit of BOFs that we can run interchangeably when looking to orchestrate large scale recon or actions.* + + + +DISCLAIMER: The creators of this repository are not responsible for any harm or damage that may occur as a result of using the information or code provided in this repository. +By accessing and using this repository, you acknowledge and agree that you do so at your own risk. diff --git a/amsi-etw-ping-bof/Makefile b/amsi-etw-ping-bof/Makefile new file mode 100644 index 0000000..36d976a --- /dev/null +++ b/amsi-etw-ping-bof/Makefile @@ -0,0 +1,61 @@ +# Makefile for AMSI/ETW Ping BOF + +CC_X64 ?= x86_64-w64-mingw32-gcc +CC_X86 ?= i686-w64-mingw32-gcc + +CFLAGS_COMMON := -c -Os -std=c99 \ + -fno-stack-protector -fno-stack-check -mno-stack-arg-probe \ + -fno-builtin -fno-builtin-memset -fno-builtin-memcpy -fno-builtin-memmove \ + -ffunction-sections -fdata-sections -nostdlib \ + -fno-asynchronous-unwind-tables -fno-unwind-tables -fno-ident \ + -Wall -Wextra -Wno-unused-parameter -Wno-unused-variable + +CFLAGS_COMMON += -fno-leading-underscore -fno-ms-extensions + +TARGET := amsi_etw_ping +SOURCE := $(TARGET).c +HEADERS := beacon.h + +all: $(TARGET).x64.o $(TARGET).x86.o + +$(TARGET).x64.o: $(SOURCE) $(HEADERS) + $(CC_X64) $(CFLAGS_COMMON) -o $@ $< + @echo "Built x64 BOF: $@" + @echo "Checking symbols in $@..." + @objdump -t $@ | grep -E "(GetModuleHandleW|GetProcAddress|KERNEL32$GetModuleHandleW|KERNEL32$GetProcAddress)" || echo "No problematic symbols found" + +$(TARGET).x86.o: $(SOURCE) $(HEADERS) + $(CC_X86) $(CFLAGS_COMMON) -o $@ $< + @echo "Built x86 BOF: $@" + @echo "Checking symbols in $@..." + @objdump -t $@ | grep -E "(GetModuleHandleW|GetProcAddress|KERNEL32$GetModuleHandleW|KERNEL32$GetProcAddress)" || echo "No problematic symbols found" + + +debug: $(TARGET).x64.o + @echo "=== All symbols in $(TARGET).x64.o ===" + @objdump -t $(TARGET).x64.o + @echo "=== Relocations ===" + @objdump -r $(TARGET).x64.o + + +verbose: $(SOURCE) $(HEADERS) + $(CC_X64) $(CFLAGS_COMMON) -v -o $(TARGET).x64.o $< + +clean: + rm -f *.o + +info: + @echo "AMSI/ETW Ping BOF Build System" + @echo "Targets:" + @echo " all - Build both x64 and x86 BOF objects" + @echo " debug - Build x64 and show all symbols/relocations" + @echo " verbose - Build with verbose compiler output" + @echo " clean - Remove compiled objects" + @echo " info - Show this help" + @echo "" + @echo "Requirements:" + @echo " - MinGW-w64 cross-compiler (x86_64-w64-mingw32-gcc, i686-w64-mingw32-gcc)" + @echo " - objdump (for symbol inspection)" + @echo " - Output: COFF objects for Cobalt Strike BOF loading and COFFLoader" + +.PHONY: all debug verbose clean info \ No newline at end of file diff --git a/amsi-etw-ping-bof/README.md b/amsi-etw-ping-bof/README.md new file mode 100644 index 0000000..a6c3bba --- /dev/null +++ b/amsi-etw-ping-bof/README.md @@ -0,0 +1,11 @@ +# AMSI/ETW Ping BOF + +## Summary + +This Beacon Object File (BOF) checks for AMSI and ETW presence in the current process by detecting loaded DLLs (`clr.dll`, `coreclr.dll`, `System.Management.Automation.dll`) and ETW-related exports. + +### Example Output + +``` +CLR_DLL: true CORECLR_DLL: true PS_DLL: true ADVAPI_DLL: true EVENT_WRITE: true EVENT_FULL: true NTDLL_DLL: true ETW_WRITE: true ETW_FULL: false +``` diff --git a/amsi-etw-ping-bof/amsi_etw_ping.c b/amsi-etw-ping-bof/amsi_etw_ping.c new file mode 100644 index 0000000..bcb0d21 --- /dev/null +++ b/amsi-etw-ping-bof/amsi_etw_ping.c @@ -0,0 +1,38 @@ +#include "beacon.h" + + +static inline const char* yn(int b) { return b ? "Yes" : "No"; } + + +static inline int has_export(LPCWSTR modW, LPCSTR nameA) { + HMODULE m = KERNEL32$GetModuleHandleW(modW); + if (!m) return FALSE; + return KERNEL32$GetProcAddress(m, nameA) ? TRUE : FALSE; +} + +void go(char *args, unsigned long alen) { + (void)args; (void)alen; + + int amsi_dll = (KERNEL32$GetModuleHandleW(L"amsi.dll") != (HMODULE)0); + int amsi_api = has_export(L"amsi.dll", "AmsiScanBuffer"); + + int clr_dll = (KERNEL32$GetModuleHandleW(L"clr.dll") != (HMODULE)0); + int coreclr_dll = (KERNEL32$GetModuleHandleW(L"coreclr.dll") != (HMODULE)0); + int ps_dll = (KERNEL32$GetModuleHandleW(L"System.Management.Automation.dll") != (HMODULE)0); + + + int advapi_dll = (KERNEL32$GetModuleHandleW(L"advapi32.dll") != (HMODULE)0); + int event_write = has_export(L"advapi32.dll", "EventWrite"); + int event_full = has_export(L"advapi32.dll", "EventWriteFull"); + + int ntdll_dll = (KERNEL32$GetModuleHandleW(L"ntdll.dll") != (HMODULE)0); + int etw_write = has_export(L"ntdll.dll", "EtwEventWrite"); + int etw_full = has_export(L"ntdll.dll", "EtwEventWriteFull"); + + + BeaconPrintf( + CALLBACK_OUTPUT, + "AMSI_DLL=%s AMSI_API=%s CLR_DLL=%s CORECLR_DLL=%s PS_DLL=%s ADVAPI_DLL=%s EVENTWRITE=%s EVENTWRITEFULL=%s NTDLL_DLL=%s ETW_EVENTWRITE=%s ETW_EVENTWRITEFULL=%s", + yn(amsi_dll), yn(amsi_api), yn(clr_dll), yn(coreclr_dll), yn(ps_dll), yn(advapi_dll), yn(event_write), yn(event_full), yn(ntdll_dll), yn(etw_write), yn(etw_full) + ); +} \ No newline at end of file diff --git a/amsi-etw-ping-bof/amsi_etw_ping.x64.o b/amsi-etw-ping-bof/amsi_etw_ping.x64.o new file mode 100644 index 0000000000000000000000000000000000000000..d06550a2a20f0d62b035212caeaa0a9a7fafcd8c GIT binary patch literal 2224 zcmai$PmB|F6vtm_0YhAg=w3)jdKe-hq3!|(Lb7p(-NE1LbggZ-RbUy$cD7E^ZJTxq z7<&+#8b&e+B${ZvaPy=mVxsX-vkQnvB_#g2$$=CwcRaBxKH}%C={3ZjqT;$n;Zhw_5*WgZI(*;^9%( z6o!cyz@3EBx8O<6+Z>(v8hQ@n5gj=1to$BYrOrAwxP!<2LBA9xs9#R_Ka1{zoI0b|G(2eHfisQr#ExI1QWgMJu$(f)Qm`yM&ZwEjr){BVLzTQ?nu|fF%tbX z6=Y>_Qw1N(;FfCk6$QbB(rye|O@0%qy1zc0;0IK7|As33U0Fz5@NW(a{|r^#za>>O z*n=YU`t9wA^az{5B%O@jhKG`Rc!LR&(!Gb?c3ci3u4>@=navUXG;O$ooF?KAz;+F27#Z_=F_{!lNjUqb(>GuEx0hz_+DZ^RrBQm^7v-rXx&qOs_H( zn3kDbrUp}osmpYg=~JdJn7(ED1L=AE2Dm@1xK#&<#-j~@O3cRhuH|^=t%h5x(9M)X zKI=#cNJ1Q|!$D6h)`dF*Y(vkM5sz|5_d-gK_8E90+Y#+iPxM6g!1yK}>XxJr9JIoC zjCMfk7>-nA@1tir9{YT3)zN*AcK3MfU-a;0;bzlJ!&%-KQzDlLSMmYoRrh!7mgQV% z)SDhea4ct8?rOt&&B!hq=AnbyD~^}0m)liG*tK%iDZ+R@)2x^Da=Gc?{|qX7+_6jb LTBhmNycKv1lKFXI literal 0 HcmV?d00001 diff --git a/amsi-etw-ping-bof/amsi_etw_ping.x86.o b/amsi-etw-ping-bof/amsi_etw_ping.x86.o new file mode 100644 index 0000000000000000000000000000000000000000..1c650fc0a4c1b66496222cb7523d65ab318d894e GIT binary patch literal 1988 zcmai#OK2NM7{@=^t`n$M+NE|I6#^AlP(yuiAc2thkV6PLglzsZyP930n5@{D z-~7M-_wDRMGl@_?v192IqMe-jLQ!44taIMDiO{}t(VU_y8(VlJM*HmOc}@F>jjqD? z)ljF44f{ewqkXR4gN|Rf+Iivc;W>mec;LD*ejkJRN?X_AX`#qzuihX6tlpIMG;J-L z>syl!e+1^zK;71NrBZ26sM{w`g>T#8-|QDX`|ayz-u|-`^ zsgUx>F5Kd@@H09jThfDhrttiQdmu|{`3kG}u+VT*R=t$Pc_z3S&soObzHpCyjSH-) z+w*8CEH&z{e`i8idRhPfJ|k=V3HPy>^9NUqwXpPt+ss;vS|f|!O&4@UL`|Vx6U5%9n{h|@eh}J^f_@UwUxfCnp!(ba)d=-;cwBdIZ(!lhI-V!6JhL_XgPy>i(7S<$Rg16&2b*DUXb3H<=pWI* zUVtqOp1WPM4(n+^eL!l;B3zL*F6pRxc=;tX`h0RCNkqS4@_R zvvcwZDK#M_4jvf%TGhuZIisYGD&<^B&BTVN+mWnRvhiH5s%l#7kQYCuD%naoSuK|J G8F~)_Uv}#N literal 0 HcmV?d00001 diff --git a/amsi-etw-ping-bof/beacon.h b/amsi-etw-ping-bof/beacon.h new file mode 100644 index 0000000..dc44220 --- /dev/null +++ b/amsi-etw-ping-bof/beacon.h @@ -0,0 +1,71 @@ +/* + * Common BOF (Beacon Object File) Header + * Provides standard Windows API declarations for BOF development + * Compatible with Cobalt Strike BOF loader and COFFLoader + */ + +#ifndef BOF_COMMON_H +#define BOF_COMMON_H + +#ifndef DECLSPEC_IMPORT +#define DECLSPEC_IMPORT __declspec(dllimport) +#endif + +#ifndef WINAPI +#define WINAPI __stdcall +#endif + +// Basic Windows types +typedef void* PVOID; +typedef void* HANDLE; +typedef void* HMODULE; +typedef void* HINSTANCE; +typedef void* FARPROC; +typedef unsigned long DWORD; +typedef unsigned short WORD; +typedef unsigned char BYTE; +typedef int BOOL; +typedef char CHAR; +typedef short SHORT; +typedef long LONG; +typedef unsigned short wchar_t; +typedef wchar_t WCHAR; + +// String types +typedef const char* LPCSTR; +typedef char* LPSTR; +typedef const wchar_t* LPCWSTR; +typedef wchar_t* LPWSTR; + +// Constants +#define TRUE 1 +#define FALSE 0 +#define NULL ((void*)0) + +// Process/Thread types +typedef struct _PROCESS_INFORMATION { + HANDLE hProcess; + HANDLE hThread; + DWORD dwProcessId; + DWORD dwThreadId; +} PROCESS_INFORMATION; + +// Beacon API declarations +DECLSPEC_IMPORT void BeaconPrintf(int type, char *fmt, ...); +DECLSPEC_IMPORT void BeaconOutput(int type, char *data, int len); + +// Beacon callback types +#define CALLBACK_OUTPUT 0x0 +#define CALLBACK_OUTPUT_OEM 0x1e +#define CALLBACK_ERROR 0x0d +#define CALLBACK_OUTPUT_UTF8 0x20 + +// Essential Windows API functions - BOF format with LIBRARY$ prefix +DECLSPEC_IMPORT HMODULE WINAPI KERNEL32$GetModuleHandleW(LPCWSTR lpModuleName); +DECLSPEC_IMPORT HMODULE WINAPI KERNEL32$GetModuleHandleA(LPCSTR lpModuleName); +DECLSPEC_IMPORT FARPROC WINAPI KERNEL32$GetProcAddress(HMODULE hModule, LPCSTR lpProcName); +DECLSPEC_IMPORT HMODULE WINAPI KERNEL32$LoadLibraryW(LPCWSTR lpLibFileName); +DECLSPEC_IMPORT HMODULE WINAPI KERNEL32$LoadLibraryA(LPCSTR lpLibFileName); +DECLSPEC_IMPORT BOOL WINAPI KERNEL32$FreeLibrary(HMODULE hLibModule); + +#endif // BOF_COMMON_H \ No newline at end of file diff --git a/appnumberBOF/Makefile b/appnumberBOF/Makefile new file mode 100644 index 0000000..82285b0 --- /dev/null +++ b/appnumberBOF/Makefile @@ -0,0 +1,14 @@ +CC_x64=x86_64-w64-mingw32-gcc +CC_x86=i686-w64-mingw32-gcc +CFLAGS=-c -fno-builtin -fno-builtin-memset -fno-builtin-memcpy -fno-builtin-memmove -fno-asynchronous-unwind-tables -fno-unwind-tables -fno-stack-protector -fno-stack-check -mno-stack-arg-probe -Os + +all: bof_implant.o bof_implant_x64.o + +bof_implant.o: bof_implant.c + $(CC_x86) $(CFLAGS) -o $@ $< + +bof_implant_x64.o: bof_implant.c + $(CC_x64) $(CFLAGS) -o $@ $< + +clean: + rm -f *.o diff --git a/appnumberBOF/README.md b/appnumberBOF/README.md new file mode 100644 index 0000000..f089f94 --- /dev/null +++ b/appnumberBOF/README.md @@ -0,0 +1,14 @@ +# Count Installed Applications BOF + +## Summary + +This Beacon Object File (BOF) enumerates installed applications by querying the number of subkeys under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` in the Windows Registry and returns the total count. + +### Example Output + +``` +[*] Tasked beacon to run BOF +[+] host called home, sent: 10 bytes +[+] received output: +Found 123 installed applications. +``` diff --git a/appnumberBOF/app_numbers.x64.o b/appnumberBOF/app_numbers.x64.o new file mode 100644 index 0000000000000000000000000000000000000000..fd8eef25d09bb3c587288e01339950c1142acecc GIT binary patch literal 1802 zcmZ`(O>7%g5PohF;83~=DndCR7HK1e1I9~1qUDk$-e|4bZTb_t5^mj%y|xzCyYBvg zBNZtT4&^DalmjOO7Z3^@kT^t0sW{jLV&z1rKtd5n96(^Dh;oTke!9%O=LTCgPx8!o zzWICeW~cDR2*LB~Fd;{oL`c*(s(wdCwtk3^?}5KQ#FYXtk;E=X3%aj!)d3xcINfK8 z#2V3g&+FC=k{8j=?G5-981}~-oqFn++!q4t?>P^Q5+$Rgl{w{nIx}}pTe|h({e%cl zY)EUsTXD%kbFChiDjJPTqE>&HDOydq?V>6-l+AH+h=feL-0&XtzAA^U8iNV=@uJ3jDJB3B z>7NPuU5fspgx@YVf=LZ3sfo4kV7Z7YSJ1QvgB2*&H-!zG=oF;TK+CrLAqppmBr!hpkHFu)lP4I z3sQ@p@p%69^$~avc{@pePSL+r`g?-@aIYzG;nUh-Oshi8&uU?l?lgZKiR{E94SGXc zxg5AAG!>vKy?eQ=S=}w&9QI|tsl5ZZby|o7OF4PDBT6jY{{&ldYEQKLdEL>~f z4MQbt(b_5+wRhn!Jm5!w$=eFO%}Zy!=b|vl=T2Mt0>|*hi@8fmR=KELQgWZi!0SHv z4U-w5hnaNdK!*dv(IQAVb;INXphuYW2~dvy1QLFj!{jzl9_4-L21hqQ8f9n`q%kI4 zftTXwRgie(Yans--07L~8Re{+O__Pu@tmTc&6sw$qaxDHtcj39HcMbtN#s zy4y`O?V{7~5;whyr7xV)%LX|Wl;;gsbc&*0saR%S_n{~c99d090h0thI}JKOh9bDt zuwft1u0Mnt*n3^;2SBi4>JC8-*mUhOT!+0jd_i{aF&?Y%O%OTr<^Y^ID(g?LN(awc>Xj zEyDA5Z0pcP$DWqX8l`E=@r;wk0*PAIE9IPC zD8T5HI)*P8dfu^TUDNi91ANcmP$Xasz+V}FpN3HbNUaV6RXZsEFUTUNbt^E?`Cr;w BrP2TZ literal 0 HcmV?d00001 diff --git a/appnumberBOF/app_numbers.x86.o b/appnumberBOF/app_numbers.x86.o new file mode 100644 index 0000000000000000000000000000000000000000..18cff01ad668f19224f264634d92ca0e0d498eda GIT binary patch literal 1736 zcmZ`(L2DaF6duKLs)H0MMS+y=VJQ=uLc5jX9O|?OE0)uSIEfnD@*!%JwKS48UG2KN zvrQawu#j9>Quh}W+H;||QfO(xX-q@XLk%HN>d@vYoR&Z!5CYwPv#XUQlnl(woA15% zy*IOO-)v-@i1BrlkhCumqHuPF_hhkU_YiU)dtxjAU&bbr%tfWDay5YZ>y4gG2uzX8 zhO%Va;rT`Ts<5+$3IB%iC|_af?TI5JG$Q|@5lfMUxy54Zq4W}N@WkabzMiMiLgN*( zhZGwr7&maQRqudsYj394Hu$TB0M7%tln6Dc?(Y#ouEV+gFaw@9F%M(XOLt2F!^<DihI|)*WQ#7BkKOSlga+$>NJL%#)6wJ%z2!q!&Jm2 zB`->Mqq>jZe;3&#+kYVR&S!8=BX$aJM1Jj12`Lber3&jED&tVVK`JaXz6B0qDI`AV z-o!B$9;0j9?qg?S^{0S=zwzTZo;iCv`Tcis!MXN?AI`a3Hy(^fwjz(*Us_KIzMu18 zCq0y0_oC-{?$+A&ZoXW~-k$7yE}_hlogCD;$={rRThBZsbUEgBz7(2iuyiSuy%+V4 z(#8)kxJ1GP{6{w>*zEP^>saHybhM96_N5%8gnw#b-RDbR_^a^$ z22#>L#c|buMZ8^rore^}V30%^?j;=3eqZ{zZ@1N#68IK@#{oz|+}9ul9&j5Pb7xP? zFXqn8lum0E%e2iJFD+_D)x2z%rX9;-1}`$p)=Z0_jaC?m-65u`POd^LjX<|>$#8a{8&=0D_9k1UzBvev|>Ft`$A zu>pNqVC8ZyU(6LwP8^} +#include "beacon.h" + +DECLSPEC_IMPORT LSTATUS ADVAPI32$RegOpenKeyExA(HKEY, LPCSTR, DWORD, REGSAM, PHKEY); +DECLSPEC_IMPORT LSTATUS ADVAPI32$RegQueryInfoKeyA(HKEY, LPSTR, LPDWORD, LPDWORD, LPDWORD, LPDWORD, LPDWORD, LPDWORD, LPDWORD, LPDWORD, LPDWORD, PFILETIME); +DECLSPEC_IMPORT LSTATUS ADVAPI32$RegCloseKey(HKEY); +DECLSPEC_IMPORT LSTATUS ADVAPI32$RegEnumKeyExA(HKEY, DWORD, LPSTR, LPDWORD, LPDWORD, LPSTR, LPDWORD, PFILETIME); +DECLSPEC_IMPORT LSTATUS ADVAPI32$RegQueryValueExA(HKEY, LPCSTR, LPDWORD, LPDWORD, LPBYTE, LPDWORD); + + +static unsigned long hash_string(const char *s) { + unsigned long h = 5381; + unsigned int i = 0; + unsigned char c = 0; + if (s == 0) return 0; + while (i < 1024) { + c = (unsigned char)s[i++]; + if (c == '\0') break; + h = ((h << 5) + h) + c; + } + return h; +} + +void go(char *args, unsigned long alen) { + HKEY hKey; + LPCSTR lpSubKey = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"; + DWORD dwSubKeys = 0; + LONG lStatus; + + lStatus = ADVAPI32$RegOpenKeyExA( + HKEY_LOCAL_MACHINE, + lpSubKey, + 0, + KEY_READ, + &hKey + ); + + if (lStatus != ERROR_SUCCESS) { + BeaconPrintf(CALLBACK_ERROR, "Failed to open registry key: HKLM\\%s. Error code: %ld", lpSubKey, lStatus); + ADVAPI32$RegCloseKey(hKey); + return; + } + + lStatus = ADVAPI32$RegQueryInfoKeyA( + hKey, + NULL, + NULL, + NULL, + &dwSubKeys, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL + ); + + if (lStatus != ERROR_SUCCESS) { + BeaconPrintf(CALLBACK_ERROR, "Failed to query registry key info. Error code: %ld", lStatus); + ADVAPI32$RegCloseKey(hKey); + return; + } + + // de-duplication by counting unique DisplayName values + { + #define MAX_TRACKED 256 + unsigned long seenHashes[MAX_TRACKED]; + DWORD seenCount = 0; + DWORD uniqueCount = 0; + + for (DWORD i = 0; i < dwSubKeys; i++) { + char subKeyName[256]; + DWORD subKeyLen = sizeof(subKeyName); + if (ADVAPI32$RegEnumKeyExA(hKey, i, subKeyName, &subKeyLen, NULL, NULL, NULL, NULL) != ERROR_SUCCESS) { + continue; + } + + HKEY hApp = NULL; + if (ADVAPI32$RegOpenKeyExA(hKey, subKeyName, 0, KEY_READ, &hApp) != ERROR_SUCCESS) { + uniqueCount++; + continue; + } + + char displayName[512]; + DWORD type = 0; + DWORD nameSize = sizeof(displayName); + displayName[0] = '\0'; + LSTATUS q = ADVAPI32$RegQueryValueExA(hApp, "DisplayName", NULL, &type, (LPBYTE)displayName, &nameSize); + ADVAPI32$RegCloseKey(hApp); + + if (q != ERROR_SUCCESS || displayName[0] == '\0') { + uniqueCount++; + continue; + } + + unsigned long h = hash_string(displayName); + int found = 0; + for (DWORD j = 0; j < seenCount; j++) { + if (seenHashes[j] == h) { found = 1; break; } + } + if (!found) { + if (seenCount < MAX_TRACKED) { + seenHashes[seenCount++] = h; + } + uniqueCount++; + } + } + + BeaconPrintf(CALLBACK_OUTPUT, "Number of applications installed: %lu", (unsigned long)uniqueCount); + } + + ADVAPI32$RegCloseKey(hKey); +} diff --git a/appnumberBOF/beacon.h b/appnumberBOF/beacon.h new file mode 100644 index 0000000..d656a3d --- /dev/null +++ b/appnumberBOF/beacon.h @@ -0,0 +1,69 @@ +/* + * Beacon Object Files (BOF) + * ------------------------- + * A Beacon Object File is a light-weight post exploitation tool that runs + * with Beacon's inline-execute command. + * + * Additional BOF resources are available here: + * - https://github.com/Cobalt-Strike/bof_template + * + * Cobalt Strike 4.x + * ChangeLog: + * 1/25/2022: updated for 4.5 + */ + +/* data API */ +typedef struct { + char * original; /* the original buffer [so we can free it] */ + char * buffer; /* current pointer into our buffer */ + int length; /* remaining length of data */ + int size; /* total size of this buffer */ +} datap; + +DECLSPEC_IMPORT void BeaconDataParse(datap * parser, char * buffer, int size); +DECLSPEC_IMPORT char * BeaconDataPtr(datap * parser, int size); +DECLSPEC_IMPORT int BeaconDataInt(datap * parser); +DECLSPEC_IMPORT short BeaconDataShort(datap * parser); +DECLSPEC_IMPORT int BeaconDataLength(datap * parser); +DECLSPEC_IMPORT char * BeaconDataExtract(datap * parser, int * size); + +/* format API */ +typedef struct { + char * original; /* the original buffer [so we can free it] */ + char * buffer; /* current pointer into our buffer */ + int length; /* remaining length of data */ + int size; /* total size of this buffer */ +} formatp; + +DECLSPEC_IMPORT void BeaconFormatAlloc(formatp * format, int maxsz); +DECLSPEC_IMPORT void BeaconFormatReset(formatp * format); +DECLSPEC_IMPORT void BeaconFormatAppend(formatp * format, char * text, int len); +DECLSPEC_IMPORT void BeaconFormatPrintf(formatp * format, char * fmt, ...); +DECLSPEC_IMPORT char * BeaconFormatToString(formatp * format, int * size); +DECLSPEC_IMPORT void BeaconFormatFree(formatp * format); +DECLSPEC_IMPORT void BeaconFormatInt(formatp * format, int value); + +/* Output Functions */ +#define CALLBACK_OUTPUT 0x0 +#define CALLBACK_OUTPUT_OEM 0x1e +#define CALLBACK_OUTPUT_UTF8 0x20 +#define CALLBACK_ERROR 0x0d + +DECLSPEC_IMPORT void BeaconOutput(int type, char * data, int len); +DECLSPEC_IMPORT void BeaconPrintf(int type, char * fmt, ...); + + +/* Token Functions */ +DECLSPEC_IMPORT BOOL BeaconUseToken(HANDLE token); +DECLSPEC_IMPORT void BeaconRevertToken(); +DECLSPEC_IMPORT BOOL BeaconIsAdmin(); + +/* Spawn+Inject Functions */ +DECLSPEC_IMPORT void BeaconGetSpawnTo(BOOL x86, char * buffer, int length); +DECLSPEC_IMPORT void BeaconInjectProcess(HANDLE hProc, int pid, char * payload, int p_len, int p_offset, char * arg, int a_len); +DECLSPEC_IMPORT void BeaconInjectTemporaryProcess(PROCESS_INFORMATION * pInfo, char * payload, int p_len, int p_offset, char * arg, int a_len); +DECLSPEC_IMPORT BOOL BeaconSpawnTemporaryProcess(BOOL x86, BOOL ignoreToken, STARTUPINFO * si, PROCESS_INFORMATION * pInfo); +DECLSPEC_IMPORT void BeaconCleanupProcess(PROCESS_INFORMATION * pInfo); + +/* Utility Functions */ +DECLSPEC_IMPORT BOOL toWideChar(char * src, wchar_t * dst, int max);